@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.4

package/dist/identity/extensions/user-extensions.js

@@ -0,0 +1,455 @@
+"use strict";
+// =============================================================================
+// User extensions: what an app adds to `GET /api/auth/me` and to each row of
+// `GET /api/users` (PP-14.25)
+// =============================================================================
+//
+// Rung 2 of the extension contract. An app attaches its own facts about a user
+// (a plan, a team, an unread count) to the two payloads the web app already
+// reads, with no new route and no edit under `packages/`:
+//
+//   registerCurrentUserExtension({ id: 'billing', resolve: async (userId, ctx) => ({ plan: 'pro' }) });
+//   registerUserListExtension({ id: 'billing', resolve: async (userIds, ctx) => new Map([...]) });
+//
+// The contributions appear as `extensions: { billing: { plan: 'pro' } }`, keyed
+// by the extension id. Nothing registered, no `extensions` key: the payloads are
+// exactly what they were.
+//
+// IDENTITY DATA IS SENSITIVE, so the contract is strict, and every rule is
+// enforced here, not left to the extension's good manners:
+//
+//   - JSON only: plain objects, arrays, strings, finite numbers, booleans and
+//     null, at most `USER_EXTENSION_LIMITS.maxDepth` levels deep. A class
+//     instance, a function, a `bigint`, a `Date` or a cycle is refused.
+//   - Bounded: one extension's JSON is at most `currentUserBytes` (4 KiB) in
+//     `/auth/me` and `userListBytes` (1 KiB) per row of the list, and all
+//     extensions together at most `currentUserTotalBytes` / `userListTotalBytes`.
+//     Over a bound the extension's contribution is DROPPED, never truncated.
+//   - Never secrets: a key that names a secret (`password`, `token`, `apiKey`,
+//     `clientSecret`, ... at any depth, any case; a `hasToken` presence flag is
+//     fine) and a string value that is plainly a credential (a JWT, a PEM
+//     private key, a platform `pat_` / `nod_` / `lnk_` token) are refused. The
+//     same idea as the credential store: a secret belongs in
+//     `CredentialsService`, never in a payload a browser reads.
+//   - Isolated: each extension runs under its own timeout and its failure
+//     (a throw, a rejection, a timeout, a refused contribution) skips THAT
+//     extension and is logged at `warn` with its id and the reason, never its
+//     data. A throwing extension never fails `/auth/me` or the list.
+//   - Resolved per request, never cached by the slice.
+//   - No N+1: a list extension is called ONCE per request with the ids of the
+//     page (at most one page of users) and answers a `Map` keyed by user id. It
+//     cannot answer for a user that is not on the page: such entries are
+//     ignored, so an extension cannot use the list to leak about other users.
+//
+// The registries freeze when the application has bootstrapped
+// (`RegistryFreezeService`); register at import time, from
+// `apps/api/src/app-registrations/identity.ts`.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_IN_FLIGHT_PER_USER_EXTENSION = exports.userListExtensionRegistry = exports.currentUserExtensionRegistry = exports.MAX_USER_EXTENSION_TIMEOUT_MS = exports.DEFAULT_USER_LIST_EXTENSION_TIMEOUT_MS = exports.DEFAULT_CURRENT_USER_EXTENSION_TIMEOUT_MS = void 0;
+exports.registerCurrentUserExtension = registerCurrentUserExtension;
+exports.registerUserListExtension = registerUserListExtension;
+exports.checkUserExtensionContribution = checkUserExtensionContribution;
+exports.resolveCurrentUserExtensions = resolveCurrentUserExtensions;
+exports.resolveUserListExtensions = resolveUserListExtensions;
+const identity_1 = require("@marinoscar/platform-contract/identity");
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../core/index");
+/**
+ * The default timeout of a current-user extension, in milliseconds. It runs on every `/auth/me`.
+ *
+ * @stability experimental
+ */
+exports.DEFAULT_CURRENT_USER_EXTENSION_TIMEOUT_MS = 1500;
+/**
+ * The default timeout of a user-list extension, in milliseconds.
+ *
+ * @stability experimental
+ */
+exports.DEFAULT_USER_LIST_EXTENSION_TIMEOUT_MS = 3000;
+/**
+ * The longest timeout an extension may ask for, in milliseconds.
+ *
+ * @stability experimental
+ */
+exports.MAX_USER_EXTENSION_TIMEOUT_MS = 10_000;
+function validateExtension(kind, extension) {
+    if (typeof extension.resolve !== 'function') {
+        throw new Error(`${kind} must declare a resolve function`);
+    }
+    const timeout = extension.timeoutMs;
+    if (timeout !== undefined && !(typeof timeout === 'number' && Number.isFinite(timeout) && timeout > 0 && timeout <= exports.MAX_USER_EXTENSION_TIMEOUT_MS)) {
+        throw new Error(`${kind} timeoutMs must be a number between 1 and ${exports.MAX_USER_EXTENSION_TIMEOUT_MS}`);
+    }
+}
+/**
+ * The registered extensions of `GET /api/auth/me`, in registration order.
+ *
+ * @stability experimental
+ */
+exports.currentUserExtensionRegistry = (0, index_1.defineRegistry)({
+    name: 'identity-current-user-extensions',
+    idOf: (extension) => extension.id,
+    idPattern: identity_1.USER_EXTENSION_ID_PATTERN,
+    validate: (extension) => validateExtension('a current-user extension', extension),
+});
+/**
+ * The registered extensions of the rows of `GET /api/users`, in registration order.
+ *
+ * @stability experimental
+ */
+exports.userListExtensionRegistry = (0, index_1.defineRegistry)({
+    name: 'identity-user-list-extensions',
+    idOf: (extension) => extension.id,
+    idPattern: identity_1.USER_EXTENSION_ID_PATTERN,
+    validate: (extension) => validateExtension('a user-list extension', extension),
+});
+/**
+ * Add a field group to `GET /api/auth/me`, under `extensions.<id>`.
+ *
+ * Call it once, at import time (before the application bootstraps), from
+ * `apps/api/src/app-registrations/identity.ts`. The slice resolves it on every
+ * request, bounds and checks what it returns (JSON only, no secrets, see the
+ * file header) and skips it, with a logged warning, when it throws or times out.
+ *
+ * @param extension - the id and the resolver.
+ * @throws RegistryError when the id is malformed or taken, the resolver is missing or the timeout is out of range, or the registry is frozen.
+ *
+ * @example
+ * ```ts
+ * registerCurrentUserExtension({ id: 'billing', resolve: async (userId) => ({ plan: 'pro' }) });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+function registerCurrentUserExtension(extension) {
+    exports.currentUserExtensionRegistry.register(extension);
+}
+/**
+ * Add a field group to each row of `GET /api/users`, under `extensions.<id>`.
+ *
+ * The resolver is BATCHED: it receives every id of the page at once and answers
+ * a `Map`, so a list of 100 users costs the extension one query, not 100. The
+ * same bounds and checks as {@link registerCurrentUserExtension} apply per row.
+ *
+ * @param extension - the id and the batch resolver.
+ * @throws RegistryError when the id is malformed or taken, the resolver is missing or the timeout is out of range, or the registry is frozen.
+ *
+ * @example
+ * ```ts
+ * registerUserListExtension({
+ *   id: 'billing',
+ *   resolve: async (ids) => new Map((await plans.forUsers(ids)).map((p) => [p.userId, { plan: p.name }])),
+ * });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+function registerUserListExtension(extension) {
+    exports.userListExtensionRegistry.register(extension);
+}
+// -----------------------------------------------------------------------------
+// The contribution check
+// -----------------------------------------------------------------------------
+/** Key names (compared lower-case, letters and digits only) that name a secret, at any depth. */
+const SECRET_KEY_SUFFIXES = [
+    'secret',
+    'password',
+    'passwd',
+    'passphrase',
+    'token',
+    'apikey',
+    'privatekey',
+    'signingkey',
+    'accesskey',
+    'authorization',
+    'cookie',
+    'credential',
+    'credentials',
+    'bearer',
+    'otp',
+];
+/** Keys that would reach `Object.prototype` through a naive merge. */
+const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+/** String values that are plainly a credential. */
+const SECRET_VALUE_PATTERNS = [
+    /^eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]*$/, // a JWT
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // a PEM private key
+    /^Bearer\s+\S{8,}/i,
+    /^(?:pat|nod|lnk)_[A-Za-z0-9_-]{16,}$/, // this platform's own token prefixes
+];
+/** Whether a key names a secret. A `hasToken` presence flag is not a secret. */
+function isSecretKey(key) {
+    if (/^has[A-Z_-]/.test(key))
+        return false;
+    const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, '');
+    return SECRET_KEY_SUFFIXES.some((suffix) => normalized === suffix || normalized.endsWith(suffix));
+}
+function isPlainObject(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function clean(value, depth, path, budget) {
+    budget.nodes -= 1;
+    if (budget.nodes < 0)
+        return { ok: false, reason: `${path} is part of a contribution with more values than the ${budget.maxBytes} byte bound can hold` };
+    if (value === null || typeof value === 'boolean')
+        return { ok: true, value };
+    if (typeof value === 'string') {
+        // UTF-8 is at least one byte per UTF-16 unit: refuse before scanning a huge string.
+        if (value.length > budget.maxBytes)
+            return { ok: false, reason: `${path} is a string over the ${budget.maxBytes} byte bound` };
+        if (SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
+            return { ok: false, reason: `${path} holds what looks like a credential` };
+        }
+        return { ok: true, value };
+    }
+    if (typeof value === 'number') {
+        return Number.isFinite(value) ? { ok: true, value } : { ok: false, reason: `${path} is not a finite number` };
+    }
+    if (depth > identity_1.USER_EXTENSION_LIMITS.maxDepth) {
+        return { ok: false, reason: `${path} is nested deeper than ${identity_1.USER_EXTENSION_LIMITS.maxDepth} levels` };
+    }
+    if (Array.isArray(value)) {
+        const items = [];
+        for (let index = 0; index < value.length; index += 1) {
+            const item = clean(value[index], depth + 1, `${path}[${index}]`, budget);
+            if (!item.ok)
+                return item;
+            items.push(item.value);
+        }
+        return { ok: true, value: items };
+    }
+    if (isPlainObject(value)) {
+        const copy = {};
+        for (const key of Object.keys(value)) {
+            if (FORBIDDEN_KEYS.has(key))
+                return { ok: false, reason: `${path} has the key "${key}"` };
+            if (isSecretKey(key))
+                return { ok: false, reason: `${path}.${key} is named like a secret` };
+            const raw = value[key];
+            if (raw === undefined)
+                continue; // JSON drops it
+            const item = clean(raw, depth + 1, `${path}.${key}`, budget);
+            if (!item.ok)
+                return item;
+            copy[key] = item.value;
+        }
+        return { ok: true, value: copy };
+    }
+    return { ok: false, reason: `${path} is not JSON (${typeof value})` };
+}
+/**
+ * Check one extension's contribution against the contract (JSON only, bounded,
+ * no secret) and return a clean deep copy of it. Exported for the conformance
+ * test and for an app that wants to check its own resolver; the slice calls it
+ * on every contribution.
+ *
+ * @param value - what the extension returned.
+ * @param maxBytes - the byte bound of the JSON (`USER_EXTENSION_LIMITS`).
+ * @returns the clean copy and its size, or why it was refused.
+ *
+ * @stability experimental
+ */
+function checkUserExtensionContribution(value, maxBytes) {
+    if (!isPlainObject(value))
+        return { ok: false, reason: 'the contribution is not a JSON object' };
+    const cleaned = clean(value, 1, 'the contribution', { nodes: maxBytes, maxBytes });
+    if (!cleaned.ok)
+        return cleaned;
+    const bytes = Buffer.byteLength(JSON.stringify(cleaned.value), 'utf8');
+    if (bytes > maxBytes)
+        return { ok: false, reason: `the contribution is ${bytes} bytes, over the ${maxBytes} byte bound` };
+    return { ok: true, value: cleaned.value, bytes };
+}
+/**
+ * How often the slice's own logger repeats the same warning (an extension that
+ * fails on every `/auth/me` would otherwise write one line per request).
+ */
+const LOG_REPEAT_INTERVAL_MS = 60_000;
+/** A logger that writes a given message at most once a minute and counts the repeats it swallowed. */
+function throttledLog(inner) {
+    const lastWritten = new Map();
+    return {
+        warn(message) {
+            const now = Date.now();
+            const seen = lastWritten.get(message);
+            if (seen && now - seen.at < LOG_REPEAT_INTERVAL_MS) {
+                seen.suppressed += 1;
+                return;
+            }
+            lastWritten.set(message, { at: now, suppressed: 0 });
+            if (lastWritten.size > 200)
+                lastWritten.delete(lastWritten.keys().next().value);
+            inner.warn(seen && seen.suppressed > 0 ? `${message} (${seen.suppressed} similar warnings in the last minute were not repeated)` : message);
+        },
+    };
+}
+const defaultLog = throttledLog(new common_1.Logger('IdentityUserExtensions'));
+/**
+ * The most calls of one extension that may be running at once. A call that
+ * timed out is abandoned, not killed (JavaScript cannot), so an extension that
+ * hangs on every request would otherwise pile up work without bound; past this
+ * many unfinished calls it is skipped until some finish.
+ *
+ * @stability experimental
+ */
+exports.MAX_IN_FLIGHT_PER_USER_EXTENSION = 16;
+const inFlight = new Map();
+/** Runs `run` under a timeout; the signal aborts when it elapses. `key` counts the unfinished calls of one extension. */
+async function withTimeout(key, timeoutMs, run) {
+    const running = inFlight.get(key) ?? 0;
+    if (running >= exports.MAX_IN_FLIGHT_PER_USER_EXTENSION) {
+        throw new Error(`${running} earlier calls are still running; skipped until some finish`);
+    }
+    inFlight.set(key, running + 1);
+    const controller = new AbortController();
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            reject(new Error(`timed out after ${timeoutMs} ms`));
+        }, timeoutMs);
+        timer.unref?.();
+    });
+    const work = Promise.resolve().then(() => run(controller.signal));
+    // Counted until the work ITSELF settles, even after the timeout gave up on it.
+    const done = () => {
+        const left = (inFlight.get(key) ?? 1) - 1;
+        if (left <= 0)
+            inFlight.delete(key);
+        else
+            inFlight.set(key, left);
+    };
+    work.then(done, done);
+    try {
+        return await Promise.race([work, timeout]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+/** The longest error message that reaches the log. */
+const MAX_LOGGED_MESSAGE_LENGTH = 300;
+function messageOf(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.length > MAX_LOGGED_MESSAGE_LENGTH ? `${message.slice(0, MAX_LOGGED_MESSAGE_LENGTH)}...` : message;
+}
+/**
+ * Resolve every current-user extension for one user. Never throws: an extension
+ * that fails, times out or returns something the contract refuses is skipped and
+ * logged. Extensions run concurrently; the result keeps registration order.
+ *
+ * @param userId - the signed-in user.
+ * @param context - the organization the session acts in.
+ * @param log - where skipped extensions are reported. Default the slice's logger.
+ * @returns the `extensions` object, or `undefined` when no extension contributed.
+ *
+ * @stability experimental
+ */
+async function resolveCurrentUserExtensions(userId, context, log = defaultLog) {
+    const extensions = exports.currentUserExtensionRegistry.list();
+    if (extensions.length === 0)
+        return undefined;
+    const settled = await Promise.all(extensions.map(async (extension) => {
+        try {
+            const raw = await withTimeout(`me:${extension.id}`, extension.timeoutMs ?? exports.DEFAULT_CURRENT_USER_EXTENSION_TIMEOUT_MS, (signal) => extension.resolve(userId, { orgId: context.orgId, signal }));
+            if (raw === null || raw === undefined)
+                return null;
+            const checked = checkUserExtensionContribution(raw, identity_1.USER_EXTENSION_LIMITS.currentUserBytes);
+            if (!checked.ok) {
+                log.warn(`Current-user extension "${extension.id}" skipped: ${checked.reason}`);
+                return null;
+            }
+            return { id: extension.id, value: checked.value, bytes: checked.bytes };
+        }
+        catch (error) {
+            log.warn(`Current-user extension "${extension.id}" failed and was skipped: ${messageOf(error)}`);
+            return null;
+        }
+    }));
+    const result = {};
+    let total = 0;
+    for (const entry of settled) {
+        if (!entry)
+            continue;
+        if (total + entry.bytes > identity_1.USER_EXTENSION_LIMITS.currentUserTotalBytes) {
+            log.warn(`Current-user extension "${entry.id}" skipped: the extensions together would exceed ${identity_1.USER_EXTENSION_LIMITS.currentUserTotalBytes} bytes`);
+            continue;
+        }
+        total += entry.bytes;
+        result[entry.id] = entry.value;
+    }
+    return Object.keys(result).length > 0 ? result : undefined;
+}
+/**
+ * Resolve every user-list extension for one page of users, each extension called
+ * ONCE with the page's ids. Never throws: a failing, slow or refused extension is
+ * skipped (for the whole page, or for the one row whose contribution was refused)
+ * and logged.
+ *
+ * @param userIds - the ids of the users on the page.
+ * @param context - the requesting administrator and the organization.
+ * @param log - where skipped extensions are reported. Default the slice's logger.
+ * @returns a map from user id to that user's `extensions`; users with none are absent.
+ *
+ * @stability experimental
+ */
+async function resolveUserListExtensions(userIds, context, log = defaultLog) {
+    const out = new Map();
+    const extensions = exports.userListExtensionRegistry.list();
+    if (extensions.length === 0 || userIds.length === 0)
+        return out;
+    const onPage = new Set(userIds);
+    const bytesByUser = new Map();
+    const answers = await Promise.all(extensions.map(async (extension) => {
+        try {
+            const answer = await withTimeout(`list:${extension.id}`, extension.timeoutMs ?? exports.DEFAULT_USER_LIST_EXTENSION_TIMEOUT_MS, (signal) => extension.resolve(userIds, { viewerId: context.viewerId, orgId: context.orgId, signal }));
+            if (!(answer instanceof Map)) {
+                log.warn(`User-list extension "${extension.id}" skipped: it must answer a Map from user id to contribution`);
+                return null;
+            }
+            return { extension, answer };
+        }
+        catch (error) {
+            log.warn(`User-list extension "${extension.id}" failed and was skipped: ${messageOf(error)}`);
+            return null;
+        }
+    }));
+    for (const entry of answers) {
+        if (!entry)
+            continue;
+        const { extension, answer } = entry;
+        try {
+            for (const [userId, raw] of answer) {
+                if (!onPage.has(userId) || raw === null || raw === undefined)
+                    continue;
+                const checked = checkUserExtensionContribution(raw, identity_1.USER_EXTENSION_LIMITS.userListBytes);
+                if (!checked.ok) {
+                    log.warn(`User-list extension "${extension.id}" skipped for one row: ${checked.reason}`);
+                    continue;
+                }
+                const used = bytesByUser.get(userId) ?? 0;
+                if (used + checked.bytes > identity_1.USER_EXTENSION_LIMITS.userListTotalBytes) {
+                    log.warn(`User-list extension "${extension.id}" skipped for one row: the extensions together would exceed ${identity_1.USER_EXTENSION_LIMITS.userListTotalBytes} bytes`);
+                    continue;
+                }
+                bytesByUser.set(userId, used + checked.bytes);
+                const row = out.get(userId) ?? {};
+                row[extension.id] = checked.value;
+                out.set(userId, row);
+            }
+        }
+        catch (error) {
+            // A throwing getter, a hostile iterator: this extension's remaining rows are skipped, the request is not.
+            log.warn(`User-list extension "${extension.id}" failed while its answer was read and was skipped: ${messageOf(error)}`);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=user-extensions.js.map

package/dist/identity/extensions/user-extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-extensions.js","sourceRoot":"","sources":["../../../src/identity/extensions/user-extensions.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,6EAA6E;AAC7E,8BAA8B;AAC9B,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,wGAAwG;AACxG,mGAAmG;AACnG,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,0BAA0B;AAC1B,EAAE;AACF,2EAA2E;AAC3E,2DAA2D;AAC3D,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,wEAAwE;AACxE,6EAA6E;AAC7E,0EAA0E;AAC1E,kFAAkF;AAClF,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,0EAA0E;AAC1E,+EAA+E;AAC/E,6DAA6D;AAC7D,gEAAgE;AAChE,0EAA0E;AAC1E,2EAA2E;AAC3E,8EAA8E;AAC9E,qEAAqE;AACrE,uDAAuD;AACvD,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,8DAA8D;AAC9D,2DAA2D;AAC3D,gDAAgD;AAChD,gFAAgF;;;AAsLhF,oEAEC;AAuBD,8DAEC;AAmJD,wEAOC;AAyGD,oEAwCC;AAeD,8DAyDC;AAlkBD,qEAA0G;AAC1G,2CAAwC;AAExC,4CAAiE;AASjE;;;;GAIG;AACU,QAAA,yCAAyC,GAAG,IAAI,CAAC;AAC9D;;;;GAIG;AACU,QAAA,sCAAsC,GAAG,IAAI,CAAC;AAC3D;;;;GAIG;AACU,QAAA,6BAA6B,GAAG,MAAM,CAAC;AAkGpD,SAAS,iBAAiB,CAAC,IAAY,EAAE,SAAqD;IAC5F,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC;IACpC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,qCAA6B,CAAC,EAAE,CAAC;QACnJ,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6CAA6C,qCAA6B,EAAE,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACU,QAAA,4BAA4B,GAAmC,IAAA,sBAAc,EAAuB;IAC/G,IAAI,EAAE,kCAAkC;IACxC,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE;IACjC,SAAS,EAAE,oCAAyB;IACpC,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,SAAS,CAAC;CAClF,CAAC,CAAC;AAEH;;;;GAIG;AACU,QAAA,yBAAyB,GAAgC,IAAA,sBAAc,EAAoB;IACtG,IAAI,EAAE,+BAA+B;IACrC,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE;IACjC,SAAS,EAAE,oCAAyB;IACpC,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,SAAS,CAAC;CAC/E,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,4BAA4B,CAAC,SAA+B;IAC1E,oCAA4B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,yBAAyB,CAAC,SAA4B;IACpE,iCAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,iGAAiG;AACjG,MAAM,mBAAmB,GAAsB;IAC7C,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,eAAe;IACf,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,KAAK;CACN,CAAC;AAEF,sEAAsE;AACtE,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE/F,mDAAmD;AACnD,MAAM,qBAAqB,GAAsB;IAC/C,2DAA2D,EAAE,QAAQ;IACrE,oCAAoC,EAAE,oBAAoB;IAC1D,mBAAmB;IACnB,sCAAsC,EAAE,qCAAqC;CAC9E,CAAC;AAEF,gFAAgF;AAChF,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAY,CAAC;IAC1D,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC;AAYD,SAAS,KAAK,CAAC,KAAc,EAAE,KAAa,EAAE,IAAY,EAAE,MAAmB;IAC7E,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,wDAAwD,MAAM,CAAC,QAAQ,sBAAsB,EAAE,CAAC;IACzJ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,oFAAoF;QACpF,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,yBAAyB,MAAM,CAAC,QAAQ,aAAa,EAAE,CAAC;QAC/H,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,qCAAqC,EAAE,CAAC;QAC7E,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAChH,CAAC;IACD,IAAI,KAAK,GAAG,gCAAqB,CAAC,QAAQ,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,0BAA0B,gCAAqB,CAAC,QAAQ,SAAS,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAc,EAAE,CAAC;QAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,iBAAiB,GAAG,GAAG,EAAE,CAAC;YAC1F,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,GAAG,yBAAyB,EAAE,CAAC;YAC5F,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS,CAAC,gBAAgB;YACjD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,iBAAiB,OAAO,KAAK,GAAG,EAAE,CAAC;AACxE,CAAC;AAmCD;;;;;;;;;;;GAWG;AACH,SAAgB,8BAA8B,CAAC,KAAc,EAAE,QAAgB;IAC7E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACjG,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,IAAI,KAAK,GAAG,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,KAAK,oBAAoB,QAAQ,aAAa,EAAE,CAAC;IAC1H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAgC,EAAE,KAAK,EAAE,CAAC;AAC9E,CAAC;AAgBD;;;GAGG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC,sGAAsG;AACtG,SAAS,YAAY,CAAC,KAAuB;IAC3C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC1E,OAAO;QACL,IAAI,CAAC,OAAe;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,EAAE,GAAG,sBAAsB,EAAE,CAAC;gBACnD,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;YACrD,IAAI,WAAW,CAAC,IAAI,GAAG,GAAG;gBAAE,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;YAC1F,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,IAAI,CAAC,UAAU,yDAAyD,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9I,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAqB,YAAY,CAAC,IAAI,eAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAExF;;;;;;;GAOG;AACU,QAAA,gCAAgC,GAAG,EAAE,CAAC;AAEnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE3C,yHAAyH;AACzH,KAAK,UAAU,WAAW,CAAI,GAAW,EAAE,SAAiB,EAAE,GAA4C;IACxG,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,OAAO,IAAI,wCAAgC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,6DAA6D,CAAC,CAAC;IAC3F,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,SAAS,KAAK,CAAC,CAAC,CAAC;QACvD,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,+EAA+E;IAC/E,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,IAAI,IAAI,CAAC;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;YAC/B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,MAAM,GAAG,yBAAyB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;AACpH,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,4BAA4B,CAChD,MAAc,EACd,OAAiC,EACjC,MAAwB,UAAU;IAElC,MAAM,UAAU,GAAG,oCAA4B,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,SAAS,IAAI,iDAAyC,EAAE,CAAC,MAAM,EAAE,EAAE,CAC/H,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAC5D,CAAC;YACF,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACnD,MAAM,OAAO,GAAG,8BAA8B,CAAC,GAAG,EAAE,gCAAqB,CAAC,gBAAgB,CAAC,CAAC;YAC5F,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,2BAA2B,SAAS,CAAC,EAAE,cAAc,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAChF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,2BAA2B,SAAS,CAAC,EAAE,6BAA6B,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,MAAM,GAA4C,EAAE,CAAC;IAC3D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,gCAAqB,CAAC,qBAAqB,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,2BAA2B,KAAK,CAAC,EAAE,mDAAmD,gCAAqB,CAAC,qBAAqB,QAAQ,CAAC,CAAC;YACpJ,SAAS;QACX,CAAC;QACD,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,yBAAyB,CAC7C,OAA0B,EAC1B,OAA0D,EAC1D,MAAwB,UAAU;IAElC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmD,CAAC;IACvE,MAAM,UAAU,GAAG,iCAAyB,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEhE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,SAAS,IAAI,8CAAsC,EAAE,CAAC,MAAM,EAAE,EAAE,CACjI,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CACzF,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,YAAY,GAAG,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,IAAI,CAAC,wBAAwB,SAAS,CAAC,EAAE,8DAA8D,CAAC,CAAC;gBAC7G,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,wBAAwB,SAAS,CAAC,EAAE,6BAA6B,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;oBAAE,SAAS;gBACvE,MAAM,OAAO,GAAG,8BAA8B,CAAC,GAAG,EAAE,gCAAqB,CAAC,aAAa,CAAC,CAAC;gBACzF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAChB,GAAG,CAAC,IAAI,CAAC,wBAAwB,SAAS,CAAC,EAAE,0BAA0B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;oBACzF,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,gCAAqB,CAAC,kBAAkB,EAAE,CAAC;oBACpE,GAAG,CAAC,IAAI,CAAC,wBAAwB,SAAS,CAAC,EAAE,+DAA+D,gCAAqB,CAAC,kBAAkB,QAAQ,CAAC,CAAC;oBAC9J,SAAS;gBACX,CAAC;gBACD,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;gBAClC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0GAA0G;YAC1G,GAAG,CAAC,IAAI,CAAC,wBAAwB,SAAS,CAAC,EAAE,uDAAuD,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1H,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/identity/identity.configuration.d.ts

@@ -0,0 +1,81 @@
+import type { ConfigService } from '@nestjs/config';
+import { type TenancyMode } from './organizations/tenancy-mode';
+/**
+ * The configuration identity reads, as `identityConfiguration()` builds it.
+ * Each key is read with `ConfigService.get('<key>')`.
+ *
+ * @stability experimental
+ */
+export interface IdentityConfiguration {
+    /** JWT signing and lifetimes (`JWT_SECRET`, `JWT_ACCESS_TTL_MINUTES`, `JWT_REFRESH_TTL_DAYS`). */
+    jwt: {
+        /** The HMAC signing secret. Required: identity refuses to boot without it. */
+        secret: string | undefined;
+        /** Access-token lifetime in minutes; 15 by default. */
+        accessTtlMinutes: number;
+        /** Refresh-token lifetime in days; 14 by default. */
+        refreshTtlDays: number;
+    };
+    /** The principal cache (`AUTH_PRINCIPAL_CACHE_TTL_SECONDS`). */
+    auth: {
+        /** Seconds a validated principal is cached; 30 by default, 0 turns the cache off. */
+        principalCacheTtlSeconds: number;
+    };
+    /** Google sign-in (`GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, `GOOGLE_CALLBACK_URL`). */
+    google: {
+        /** The OAuth client id. */
+        clientId: string | undefined;
+        /** The OAuth client secret. */
+        clientSecret: string | undefined;
+        /** The OAuth callback URL. */
+        callbackUrl: string | undefined;
+    };
+    /** The address that always bypasses the allowlist and becomes the first administrator (`INITIAL_ADMIN_EMAIL`). */
+    initialAdminEmail: string | undefined;
+    /** The device authorization flow (`DEVICE_*`). */
+    deviceAuth: {
+        /** Lifetime of a device code in minutes; 15 by default. */
+        expiryMinutes: number;
+        /** Minimum polling interval in seconds; 5 by default. */
+        pollInterval: number;
+        /** Lifetime of a device session credential in days; 7 by default. */
+        tokenExpiryDays: number;
+        /** Lifetime of a device-issued personal access token in days; 90 by default. */
+        patExpiryDays: number;
+    };
+    /** Tenancy (`TENANCY_MODE`): `single` (default) or `multi`. */
+    tenancy: {
+        /** The parsed mode; an invalid value throws at load. */
+        mode: TenancyMode;
+    };
+}
+/**
+ * Builds identity's configuration keys from `env`. Spread it into the app's
+ * configuration factory.
+ *
+ * @param env - the environment; `process.env` by default.
+ * @returns the keys identity reads with `ConfigService.get`.
+ * @throws Error when `TENANCY_MODE` is invalid (an invalid `AUTH_PRINCIPAL_CACHE_TTL_SECONDS` falls back to 30, with a warning).
+ *
+ * @example
+ * ```ts
+ * ConfigModule.forRoot({ load: [() => ({ ...identityConfiguration(), appUrl: process.env.APP_URL })] });
+ * ```
+ *
+ * @extensionPoint option
+ * @stability experimental
+ */
+export declare function identityConfiguration(env?: NodeJS.ProcessEnv): IdentityConfiguration;
+/**
+ * The JWT signing secret, or a boot error naming the variable. There is no
+ * fallback: signing tokens with a key published in a package would let anyone
+ * mint a session.
+ *
+ * @param config - the app's configuration (reads `jwt.secret`).
+ * @returns the secret.
+ * @throws Error when `JWT_SECRET` is unset or blank.
+ *
+ * @stability stable
+ */
+export declare function requireJwtSecret(config: Pick<ConfigService, 'get'>): string;
+//# sourceMappingURL=identity.configuration.d.ts.map

package/dist/identity/identity.configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.configuration.d.ts","sourceRoot":"","sources":["../../src/identity/identity.configuration.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAElF;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,kGAAkG;IAClG,GAAG,EAAE;QACH,8EAA8E;QAC9E,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,uDAAuD;QACvD,gBAAgB,EAAE,MAAM,CAAC;QACzB,qDAAqD;QACrD,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,gEAAgE;IAChE,IAAI,EAAE;QACJ,qFAAqF;QACrF,wBAAwB,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,0FAA0F;IAC1F,MAAM,EAAE;QACN,2BAA2B;QAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,+BAA+B;QAC/B,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,8BAA8B;QAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;KACjC,CAAC;IACF,kHAAkH;IAClH,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,kDAAkD;IAClD,UAAU,EAAE;QACV,2DAA2D;QAC3D,aAAa,EAAE,MAAM,CAAC;QACtB,yDAAyD;QACzD,YAAY,EAAE,MAAM,CAAC;QACrB,qEAAqE;QACrE,eAAe,EAAE,MAAM,CAAC;QACxB,gFAAgF;QAChF,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,+DAA+D;IAC/D,OAAO,EAAE;QACP,wDAAwD;QACxD,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;CACH;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,qBAAqB,CA0BjG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,MAAM,CAU3E"}

package/dist/identity/identity.configuration.js

@@ -0,0 +1,87 @@
+"use strict";
+// =============================================================================
+// Identity's deployment configuration (issue #727, PP-6.6)
+// =============================================================================
+//
+// The environment variables identity reads, and the `ConfigService` keys it
+// reads them under. `identityConfiguration()` builds those keys from
+// `process.env`; the app spreads it into its own `ConfigModule.forRoot({ load })`
+// factory (the reference app: `apps/api/src/config/configuration.ts`), so the
+// keys and their defaults are defined once, here.
+//
+// Deploy-time secrets only (`JWT_SECRET`, `GOOGLE_CLIENT_SECRET`): runtime-
+// configured features never get an environment variable.
+//
+// NO FALLBACK SECRET. A missing `JWT_SECRET` is a boot error
+// (`requireJwtSecret`), never a hard-coded default: a public package must not
+// ship a signing key anyone can read.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityConfiguration = identityConfiguration;
+exports.requireJwtSecret = requireJwtSecret;
+const principal_cache_config_1 = require("./auth/principal-cache/principal-cache.config");
+const tenancy_mode_1 = require("./organizations/tenancy-mode");
+/**
+ * Builds identity's configuration keys from `env`. Spread it into the app's
+ * configuration factory.
+ *
+ * @param env - the environment; `process.env` by default.
+ * @returns the keys identity reads with `ConfigService.get`.
+ * @throws Error when `TENANCY_MODE` is invalid (an invalid `AUTH_PRINCIPAL_CACHE_TTL_SECONDS` falls back to 30, with a warning).
+ *
+ * @example
+ * ```ts
+ * ConfigModule.forRoot({ load: [() => ({ ...identityConfiguration(), appUrl: process.env.APP_URL })] });
+ * ```
+ *
+ * @extensionPoint option
+ * @stability experimental
+ */
+function identityConfiguration(env = process.env) {
+    return {
+        jwt: {
+            secret: env.JWT_SECRET,
+            accessTtlMinutes: parseInt(env.JWT_ACCESS_TTL_MINUTES || '15', 10),
+            refreshTtlDays: parseInt(env.JWT_REFRESH_TTL_DAYS || '14', 10),
+        },
+        auth: {
+            principalCacheTtlSeconds: (0, principal_cache_config_1.parsePrincipalCacheTtlSeconds)(env.AUTH_PRINCIPAL_CACHE_TTL_SECONDS),
+        },
+        google: {
+            clientId: env.GOOGLE_CLIENT_ID,
+            clientSecret: env.GOOGLE_CLIENT_SECRET,
+            callbackUrl: env.GOOGLE_CALLBACK_URL,
+        },
+        initialAdminEmail: env.INITIAL_ADMIN_EMAIL,
+        deviceAuth: {
+            expiryMinutes: parseInt(env.DEVICE_CODE_EXPIRY_MINUTES || '15', 10),
+            pollInterval: parseInt(env.DEVICE_CODE_POLL_INTERVAL || '5', 10),
+            tokenExpiryDays: parseInt(env.DEVICE_TOKEN_EXPIRY_DAYS || '7', 10),
+            patExpiryDays: parseInt(env.DEVICE_PAT_EXPIRY_DAYS || '90', 10),
+        },
+        tenancy: {
+            mode: (0, tenancy_mode_1.parseTenancyMode)(env.TENANCY_MODE),
+        },
+    };
+}
+/**
+ * The JWT signing secret, or a boot error naming the variable. There is no
+ * fallback: signing tokens with a key published in a package would let anyone
+ * mint a session.
+ *
+ * @param config - the app's configuration (reads `jwt.secret`).
+ * @returns the secret.
+ * @throws Error when `JWT_SECRET` is unset or blank.
+ *
+ * @stability stable
+ */
+function requireJwtSecret(config) {
+    const secret = config.get('jwt.secret');
+    if (typeof secret !== 'string' || secret.trim() === '') {
+        throw new Error('JWT_SECRET is not set. The API refuses to start without a JWT signing secret: there is no ' +
+            'built-in fallback. Set JWT_SECRET to a long random value in the deployment environment ' +
+            '(infra/compose/.env) and restart.');
+    }
+    return secret;
+}
+//# sourceMappingURL=identity.configuration.js.map

package/dist/identity/identity.configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.configuration.js","sourceRoot":"","sources":["../../src/identity/identity.configuration.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,2DAA2D;AAC3D,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,qEAAqE;AACrE,kFAAkF;AAClF,8EAA8E;AAC9E,kDAAkD;AAClD,EAAE;AACF,4EAA4E;AAC5E,yDAAyD;AACzD,EAAE;AACF,6DAA6D;AAC7D,8EAA8E;AAC9E,sCAAsC;AACtC,gFAAgF;;AAyEhF,sDA0BC;AAaD,4CAUC;AAtHD,0FAA8F;AAC9F,+DAAkF;AAoDlF;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxE,OAAO;QACL,GAAG,EAAE;YACH,MAAM,EAAE,GAAG,CAAC,UAAU;YACtB,gBAAgB,EAAE,QAAQ,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI,EAAE,EAAE,CAAC;YAClE,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,EAAE,EAAE,CAAC;SAC/D;QACD,IAAI,EAAE;YACJ,wBAAwB,EAAE,IAAA,sDAA6B,EAAC,GAAG,CAAC,gCAAgC,CAAC;SAC9F;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,GAAG,CAAC,gBAAgB;YAC9B,YAAY,EAAE,GAAG,CAAC,oBAAoB;YACtC,WAAW,EAAE,GAAG,CAAC,mBAAmB;SACrC;QACD,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;QAC1C,UAAU,EAAE;YACV,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,0BAA0B,IAAI,IAAI,EAAE,EAAE,CAAC;YACnE,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,yBAAyB,IAAI,GAAG,EAAE,EAAE,CAAC;YAChE,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,wBAAwB,IAAI,GAAG,EAAE,EAAE,CAAC;YAClE,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI,EAAE,EAAE,CAAC;SAChE;QACD,OAAO,EAAE;YACP,IAAI,EAAE,IAAA,+BAAgB,EAAC,GAAG,CAAC,YAAY,CAAC;SACzC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,gBAAgB,CAAC,MAAkC;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAS,YAAY,CAAC,CAAC;IAChD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,4FAA4F;YAC1F,yFAAyF;YACzF,mCAAmC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/identity/identity.constants.d.ts

@@ -0,0 +1,3 @@
+export { DEFAULT_ORG_ROLE, IDENTITY_PERMISSION_IDS as PERMISSIONS, IDENTITY_ROLE_IDS as ROLES, ORG_ADMIN_ROLE, } from './identity.permissions';
+export type { PermissionName, RoleName } from './identity.permissions';
+//# sourceMappingURL=identity.constants.d.ts.map