@pattern-js/mod-identity 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pattern contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,53 @@
+# @pattern-js/mod-identity
+
+The identity kernel for [Pattern](../../README.md): users, revocable cookie
+sessions, roles→scopes, a single-use token system, the login page, and the
+admin's Access screens (Users / Invite / Sessions). Login *methods* are separate
+mods that plug into it — `@pattern-js/mod-auth-magic-link` is the reference.
+
+```bash
+npm install @pattern-js/mod-identity
+```
+
+## When to use
+
+Install it the moment you want **users, sessions, or roles** — a login page,
+who-is-this-request, gated routes. It's opt-in: a project without it behaves
+exactly as before. Installing it alongside `@pattern-js/mod-admin` **flips the admin
+to secure-by-default** (`/admin` starts requiring the `admin` scope; pass
+`adminMod({ auth: false })` to keep it open). If you only need a machine-to-machine
+API key you don't need this mod — reach for it when a *human* must prove who they
+are.
+
+## Prerequisites
+
+A login method mod — typically **`@pattern-js/mod-auth-magic-link`**. Identity owns
+the kernel; the method owns the sign-in flow.
+
+## Config
+
+Defaults work from the bare config entry:
+
+```jsonc
+{ "mods": ["@pattern-js/mod-identity", "@pattern-js/mod-auth-magic-link"] }
+```
+
+To customize, export a local wrapper mod:
+
+```js
+// mods/identity.mjs
+import { identityMod } from "@pattern-js/mod-identity";
+export default identityMod({
+  signup: "open",                          // default "invite"
+  roles: { admin: ["admin"], editor: ["edit", "read"] },
+  cookieSecure: true,                      // REQUIRED behind TLS
+  storage: "./.pattern-data/identity.db",  // or "memory"; gitignored
+});
+```
+
+On first boot with an empty store, the `ready` hook prints a one-time bootstrap
+link to the server console to create the first admin. Gate routes by stamping
+`requireAuth` on a `boundary.http.request` trigger.
+
+Full documentation: the **Identity** chapter at `/docs` (served by
+`@pattern-js/mod-docs`), or [the source](docs/index.md).

package/dist/admin-routes.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @pattern-js/mod-identity — the admin screens' dedicated routes.
+ *
+ * One purposeful route per screen and action (Users / Sessions / Invite /
+ * Settings, plus whoami) — no generic op invoker. Each is a normal workflow
+ * (request → extract → identity.* op → status → response) built by the shared
+ * `httpEndpoint`, admin-scope-gated at the boundary (the ops also re-check
+ * `admin` in-op). `whoami` is the one exception: it reports the caller's own
+ * principal, so it needs authentication, not the admin scope. Paths are
+ * single-sourced here so the workflows and the manifest can't drift.
+ */
+import { type Workflow } from "@pattern-js/core";
+/** Route paths relative to the admin API mount — the manifest's `RouteRef.path`. */
+export declare const PATHS: {
+    readonly users: "/identity/users";
+    readonly user: "/identity/users/:userId";
+    readonly userRunStats: "/identity/users/:userId/run-stats";
+    readonly userSessions: "/identity/users/:userId/sessions";
+    readonly userLoginLink: "/identity/users/:userId/login-link";
+    readonly userToggleDisabled: "/identity/users/:userId/toggle-disabled";
+    readonly userRevokeSessions: "/identity/users/:userId/revoke-sessions";
+    readonly invites: "/identity/invites";
+    readonly sessions: "/identity/sessions";
+    readonly session: "/identity/sessions/:sessionId";
+    readonly settings: "/identity/settings";
+    readonly whoami: "/identity/whoami";
+};
+/** The route workflows that back the admin Access screens. */
+export declare function identityAdminRoutes(): Workflow[];
+//# sourceMappingURL=admin-routes.d.ts.map

package/dist/admin-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-routes.d.ts","sourceRoot":"","sources":["../src/admin-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAsC,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAIrF,oFAAoF;AACpF,eAAO,MAAM,KAAK;;;;;;;;;;;;;CAaR,CAAC;AAEX,8DAA8D;AAC9D,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CA6BhD"}

package/dist/admin-routes.js

@@ -0,0 +1,52 @@
+/**
+ * @pattern-js/mod-identity — the admin screens' dedicated routes.
+ *
+ * One purposeful route per screen and action (Users / Sessions / Invite /
+ * Settings, plus whoami) — no generic op invoker. Each is a normal workflow
+ * (request → extract → identity.* op → status → response) built by the shared
+ * `httpEndpoint`, admin-scope-gated at the boundary (the ops also re-check
+ * `admin` in-op). `whoami` is the one exception: it reports the caller's own
+ * principal, so it needs authentication, not the admin scope. Paths are
+ * single-sourced here so the workflows and the manifest can't drift.
+ */
+import { fromBody, fromParams, httpEndpoint } from "@pattern-js/core";
+const API = "/admin/api";
+/** Route paths relative to the admin API mount — the manifest's `RouteRef.path`. */
+export const PATHS = {
+    users: "/identity/users",
+    user: "/identity/users/:userId",
+    userRunStats: "/identity/users/:userId/run-stats",
+    userSessions: "/identity/users/:userId/sessions",
+    userLoginLink: "/identity/users/:userId/login-link",
+    userToggleDisabled: "/identity/users/:userId/toggle-disabled",
+    userRevokeSessions: "/identity/users/:userId/revoke-sessions",
+    invites: "/identity/invites",
+    sessions: "/identity/sessions",
+    session: "/identity/sessions/:sessionId",
+    settings: "/identity/settings",
+    whoami: "/identity/whoami",
+};
+/** The route workflows that back the admin Access screens. */
+export function identityAdminRoutes() {
+    const admin = { scopes: ["admin"] };
+    const r = (id, method, path, op, io, auth = admin) => httpEndpoint({ id, name: `Identity · ${method} ${API}${path}`, method, path: `${API}${path}`, op, io, auth });
+    return [
+        // ── reads ──
+        r("identity.route.admin.users.list", "GET", PATHS.users, "identity.users.list", { out: "users" }),
+        r("identity.route.admin.users.get", "GET", PATHS.user, "identity.users.get", { in: { userId: fromParams() }, out: "user" }),
+        r("identity.route.admin.users.runStats", "GET", PATHS.userRunStats, "identity.users.runStats", { in: { userId: fromParams() }, out: "stats" }),
+        r("identity.route.admin.users.sessions", "GET", PATHS.userSessions, "identity.sessions.list", { in: { userId: fromParams() }, out: "sessions" }),
+        r("identity.route.admin.sessions.list", "GET", PATHS.sessions, "identity.sessions.list", { out: "sessions" }),
+        r("identity.route.admin.settings.get", "GET", PATHS.settings, "identity.settings.get", { out: "settings" }),
+        // whoami is about the *caller* — authentication, not the admin scope.
+        r("identity.route.admin.whoami", "GET", PATHS.whoami, "identity.whoami", { out: "whoami" }, true),
+        // ── actions ──
+        r("identity.route.admin.users.invite", "POST", PATHS.invites, "identity.users.invite", { in: { email: fromBody(), roles: fromBody() }, out: "result" }),
+        r("identity.route.admin.users.loginLink", "POST", PATHS.userLoginLink, "identity.users.loginLink", { in: { userId: fromParams() }, out: "result" }),
+        r("identity.route.admin.users.toggleDisabled", "POST", PATHS.userToggleDisabled, "identity.users.toggleDisabled", { in: { userId: fromParams() }, out: "user" }),
+        r("identity.route.admin.users.revokeSessions", "POST", PATHS.userRevokeSessions, "identity.users.revokeSessions", { in: { userId: fromParams() }, out: "result" }),
+        r("identity.route.admin.sessions.revoke", "DELETE", PATHS.session, "identity.sessions.revoke", { in: { sessionId: fromParams() }, out: "result" }),
+        r("identity.route.admin.settings.set", "POST", PATHS.settings, "identity.settings.set", { in: { signup: fromBody() }, out: "result" }),
+    ];
+}
+//# sourceMappingURL=admin-routes.js.map

package/dist/admin-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-routes.js","sourceRoot":"","sources":["../src/admin-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAiB,MAAM,kBAAkB,CAAC;AAErF,MAAM,GAAG,GAAG,YAAY,CAAC;AAEzB,oFAAoF;AACpF,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,KAAK,EAAE,iBAAiB;IACxB,IAAI,EAAE,yBAAyB;IAC/B,YAAY,EAAE,mCAAmC;IACjD,YAAY,EAAE,kCAAkC;IAChD,aAAa,EAAE,oCAAoC;IACnD,kBAAkB,EAAE,yCAAyC;IAC7D,kBAAkB,EAAE,yCAAyC;IAC7D,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,oBAAoB;IAC9B,OAAO,EAAE,+BAA+B;IACxC,QAAQ,EAAE,oBAAoB;IAC9B,MAAM,EAAE,kBAAkB;CAClB,CAAC;AAEX,8DAA8D;AAC9D,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,MAAM,CAAC,GAAG,CACR,EAAU,EACV,MAAc,EACd,IAAY,EACZ,EAAU,EACV,EAA4C,EAC5C,OAAoC,KAAK,EAC/B,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,MAAM,IAAI,GAAG,GAAG,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7H,OAAO;QACL,cAAc;QACd,CAAC,CAAC,iCAAiC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACjG,CAAC,CAAC,gCAAgC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC3H,CAAC,CAAC,qCAAqC,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,yBAAyB,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC9I,CAAC,CAAC,qCAAqC,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,wBAAwB,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAChJ,CAAC,CAAC,oCAAoC,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,wBAAwB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAC7G,CAAC,CAAC,mCAAmC,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,uBAAuB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAC3G,sEAAsE;QACtE,CAAC,CAAC,6BAA6B,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC;QACjG,gBAAgB;QAChB,CAAC,CAAC,mCAAmC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACvJ,CAAC,CAAC,sCAAsC,EAAE,MAAM,EAAE,KAAK,CAAC,aAAa,EAAE,0BAA0B,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACnJ,CAAC,CAAC,2CAA2C,EAAE,MAAM,EAAE,KAAK,CAAC,kBAAkB,EAAE,+BAA+B,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAChK,CAAC,CAAC,2CAA2C,EAAE,MAAM,EAAE,KAAK,CAAC,kBAAkB,EAAE,+BAA+B,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QAClK,CAAC,CAAC,sCAAsC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,0BAA0B,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QAClJ,CAAC,CAAC,mCAAmC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,uBAAuB,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;KACvI,CAAC;AACJ,CAAC"}

package/dist/auth-provider.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @pattern-js/mod-identity — the session AuthProvider (§9).
+ *
+ * The bridge from cookie to principal, run by the engine's provider chain on
+ * every authenticated surface (HTTP routes, app mounts, WS upgrades — they
+ * all call `engine.authenticate`). Returns null fast when the cookie is
+ * absent so other providers (API keys, bearer tokens) get their turn.
+ *
+ * CSRF lives here by design: a cross-site state-changing request simply does
+ * not authenticate, so protected writes 401 without any token machinery.
+ */
+import type { AuthProvider } from "@pattern-js/core";
+import type { IdentityService } from "./service.js";
+export declare const SESSION_PROVIDER_NAME = "@pattern-js/mod-identity/session";
+export declare function sessionAuthProvider(svc: () => IdentityService | undefined): AuthProvider;
+//# sourceMappingURL=auth-provider.d.ts.map

package/dist/auth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../src/auth-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAa,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAIpD,eAAO,MAAM,qBAAqB,qCAAqC,CAAC;AAExE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,eAAe,GAAG,SAAS,GAAG,YAAY,CA+BxF"}

package/dist/auth-provider.js

@@ -0,0 +1,47 @@
+/**
+ * @pattern-js/mod-identity — the session AuthProvider (§9).
+ *
+ * The bridge from cookie to principal, run by the engine's provider chain on
+ * every authenticated surface (HTTP routes, app mounts, WS upgrades — they
+ * all call `engine.authenticate`). Returns null fast when the cookie is
+ * absent so other providers (API keys, bearer tokens) get their turn.
+ *
+ * CSRF lives here by design: a cross-site state-changing request simply does
+ * not authenticate, so protected writes 401 without any token machinery.
+ */
+import { parseCookies } from "./cookies.js";
+import { isCrossSiteWrite, isStateChanging, methodOf } from "./csrf.js";
+export const SESSION_PROVIDER_NAME = "@pattern-js/mod-identity/session";
+export function sessionAuthProvider(svc) {
+    return {
+        name: SESSION_PROVIDER_NAME,
+        async authenticate(ctx) {
+            const service = svc();
+            if (!service)
+                return null;
+            const raw = parseCookies(ctx.headers.get("cookie"))[service.options.cookieName];
+            if (!raw)
+                return null;
+            // CSRF: refuse to authenticate cross-site writes (GETs always pass —
+            // the magic-link callback is a cross-site top-level GET by nature).
+            if (isStateChanging(methodOf(ctx.raw)) && isCrossSiteWrite(ctx.headers))
+                return null;
+            const resolved = await service.resolveSessionByToken(raw);
+            if (!resolved)
+                return null;
+            return {
+                kind: "user",
+                id: resolved.user.id,
+                provider: SESSION_PROVIDER_NAME,
+                scopes: resolved.scopes,
+                claims: {
+                    sessionId: resolved.session.id, // WS hosts join session:{id} with this
+                    email: resolved.user.email,
+                    name: resolved.user.name ?? undefined,
+                    roles: resolved.user.roles,
+                },
+            };
+        },
+    };
+}
+//# sourceMappingURL=auth-provider.js.map

package/dist/auth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../src/auth-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAG,kCAAkC,CAAC;AAExE,MAAM,UAAU,mBAAmB,CAAC,GAAsC;IACxE,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,KAAK,CAAC,YAAY,CAAC,GAAG;YACpB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAChF,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAEtB,qEAAqE;YACrE,oEAAoE;YACpE,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAErF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAE3B,OAAO;gBACL,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;gBACpB,QAAQ,EAAE,qBAAqB;gBAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,MAAM,EAAE;oBACN,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,uCAAuC;oBACvE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;oBAC1B,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS;oBACrC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;iBAC3B;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cookies.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @pattern-js/mod-identity — cookie plumbing.
+ *
+ * One cookie, handled by hand: HttpOnly always, SameSite=Lax (Strict would
+ * drop the cookie on the magic-link's top-level GET redirect back into the
+ * app), Path=/, Secure per options.
+ */
+export interface CookieOptions {
+    secure: boolean;
+}
+/** Parse a Cookie request header into a name → value map. */
+export declare function parseCookies(header: string | null | undefined): Record<string, string>;
+/** Serialize the session cookie (Set-Cookie value). */
+export declare function serializeSessionCookie(name: string, value: string, opts: CookieOptions & {
+    maxAgeSeconds: number;
+}): string;
+/** Serialize an immediate-expiry cookie (logout). */
+export declare function clearSessionCookie(name: string, opts: CookieOptions): string;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWtF;AAED,uDAAuD;AACvD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,GAAG;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,GAC9C,MAAM,CAUR;AAED,qDAAqD;AACrD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,CAI5E"}

package/dist/cookies.js

@@ -0,0 +1,44 @@
+/**
+ * @pattern-js/mod-identity — cookie plumbing.
+ *
+ * One cookie, handled by hand: HttpOnly always, SameSite=Lax (Strict would
+ * drop the cookie on the magic-link's top-level GET redirect back into the
+ * app), Path=/, Secure per options.
+ */
+/** Parse a Cookie request header into a name → value map. */
+export function parseCookies(header) {
+    const out = {};
+    if (!header)
+        return out;
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq === -1)
+            continue;
+        const name = part.slice(0, eq).trim();
+        if (!name)
+            continue;
+        out[name] = part.slice(eq + 1).trim();
+    }
+    return out;
+}
+/** Serialize the session cookie (Set-Cookie value). */
+export function serializeSessionCookie(name, value, opts) {
+    const parts = [
+        `${name}=${value}`,
+        "Path=/",
+        "HttpOnly",
+        "SameSite=Lax",
+        `Max-Age=${Math.floor(opts.maxAgeSeconds)}`,
+    ];
+    if (opts.secure)
+        parts.push("Secure");
+    return parts.join("; ");
+}
+/** Serialize an immediate-expiry cookie (logout). */
+export function clearSessionCookie(name, opts) {
+    const parts = [`${name}=`, "Path=/", "HttpOnly", "SameSite=Lax", "Max-Age=0"];
+    if (opts.secure)
+        parts.push("Secure");
+    return parts.join("; ");
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,6DAA6D;AAC7D,MAAM,UAAU,YAAY,CAAC,MAAiC;IAC5D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,sBAAsB,CACpC,IAAY,EACZ,KAAa,EACb,IAA+C;IAE/C,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,KAAK,EAAE;QAClB,QAAQ;QACR,UAAU;QACV,cAAc;QACd,WAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;KAC5C,CAAC;IACF,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAmB;IAClE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/csrf.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @pattern-js/mod-identity — CSRF guard (§9).
+ *
+ * Lives INSIDE the session auth provider: a cross-site state-changing request
+ * simply does not authenticate, so a protected write 401s — no token dance,
+ * no second cookie. Fetch Metadata (Sec-Fetch-Site) is authoritative where
+ * present; the Origin-vs-Host comparison covers older browsers. Requests
+ * without either header (curl, server-to-server) are not browser-CSRF-able
+ * and pass.
+ *
+ * GETs are never blocked — the magic-link callback is by nature a cross-site
+ * top-level GET, and safe methods must not mutate anyway.
+ */
+export declare function isStateChanging(method: string): boolean;
+/** Should this state-changing request be refused authentication? */
+export declare function isCrossSiteWrite(headers: Headers): boolean;
+/** Derive the request method from an AuthContext (HTTP req, WS upgrade, …). */
+export declare function methodOf(raw: unknown): string;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAY1D;AAED,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAG7C"}

package/dist/csrf.js

@@ -0,0 +1,39 @@
+/**
+ * @pattern-js/mod-identity — CSRF guard (§9).
+ *
+ * Lives INSIDE the session auth provider: a cross-site state-changing request
+ * simply does not authenticate, so a protected write 401s — no token dance,
+ * no second cookie. Fetch Metadata (Sec-Fetch-Site) is authoritative where
+ * present; the Origin-vs-Host comparison covers older browsers. Requests
+ * without either header (curl, server-to-server) are not browser-CSRF-able
+ * and pass.
+ *
+ * GETs are never blocked — the magic-link callback is by nature a cross-site
+ * top-level GET, and safe methods must not mutate anyway.
+ */
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+export function isStateChanging(method) {
+    return !SAFE_METHODS.has(method.toUpperCase());
+}
+/** Should this state-changing request be refused authentication? */
+export function isCrossSiteWrite(headers) {
+    const secFetchSite = headers.get("sec-fetch-site");
+    if (secFetchSite) {
+        return !(secFetchSite === "same-origin" || secFetchSite === "same-site" || secFetchSite === "none");
+    }
+    const origin = headers.get("origin");
+    if (!origin)
+        return false; // non-browser client — not CSRF-able
+    try {
+        return new URL(origin).host !== headers.get("host");
+    }
+    catch {
+        return true; // malformed Origin → refuse
+    }
+}
+/** Derive the request method from an AuthContext (HTTP req, WS upgrade, …). */
+export function methodOf(raw) {
+    const m = raw?.method;
+    return typeof m === "string" ? m : "GET";
+}
+//# sourceMappingURL=csrf.js.map

package/dist/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,CAAC,YAAY,KAAK,aAAa,IAAI,YAAY,KAAK,WAAW,IAAI,YAAY,KAAK,MAAM,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,CAAC,qCAAqC;IAChE,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,4BAA4B;IAC3C,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,MAAM,CAAC,GAAI,GAA+C,EAAE,MAAM,CAAC;IACnE,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC3C,CAAC"}

package/dist/deliver.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @pattern-js/mod-identity — token delivery (§ delivery hook).
+ *
+ * Delivery is a hook chain, not a hardcoded channel: `identity.deliverToken`
+ * is invoked with `{ email, url, purpose, delivered: false }` and any
+ * workflow subscribed via `boundary.hook` may deliver (email, SMS, chat …)
+ * and flip `delivered`. If the payload comes back undelivered, the link is
+ * printed to the server console — which is precisely the zero-config dev
+ * login, and the same primitive bootstrap uses.
+ */
+import type { OpContext } from "@pattern-js/core";
+export declare const DELIVER_TOKEN_HOOK = "identity.deliverToken";
+export interface DeliverInput {
+    email: string;
+    /** Path-only callback URL from `issueToken` (e.g. "/auth/token?t=…"). */
+    path: string;
+    purpose: string;
+    /** The request origin (e.g. "http://localhost:3000"), when available — makes the link absolute. */
+    origin?: string | null;
+}
+export interface DeliverResult {
+    delivered: boolean;
+    url: string;
+}
+/** Best-effort absolute URL — `origin` (from the trigger's `url`) + the callback path. */
+export declare function absoluteUrl(path: string, origin?: string | null): string;
+export declare function deliverToken(ctx: OpContext, input: DeliverInput): Promise<DeliverResult>;
+//# sourceMappingURL=deliver.d.ts.map

package/dist/deliver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver.d.ts","sourceRoot":"","sources":["../src/deliver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAExE;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAoB9F"}

package/dist/deliver.js

@@ -0,0 +1,36 @@
+/**
+ * @pattern-js/mod-identity — token delivery (§ delivery hook).
+ *
+ * Delivery is a hook chain, not a hardcoded channel: `identity.deliverToken`
+ * is invoked with `{ email, url, purpose, delivered: false }` and any
+ * workflow subscribed via `boundary.hook` may deliver (email, SMS, chat …)
+ * and flip `delivered`. If the payload comes back undelivered, the link is
+ * printed to the server console — which is precisely the zero-config dev
+ * login, and the same primitive bootstrap uses.
+ */
+export const DELIVER_TOKEN_HOOK = "identity.deliverToken";
+/** Best-effort absolute URL — `origin` (from the trigger's `url`) + the callback path. */
+export function absoluteUrl(path, origin) {
+    return origin ? `${origin.replace(/\/$/, "")}${path}` : path;
+}
+export async function deliverToken(ctx, input) {
+    const url = absoluteUrl(input.path, input.origin);
+    const payload = { email: input.email, url, purpose: input.purpose, delivered: false };
+    let result;
+    try {
+        result = await ctx.services.hooks.invoke(DELIVER_TOKEN_HOOK, payload);
+    }
+    catch (err) {
+        // A broken delivery workflow must never eat the login link.
+        ctx.log("warn", `deliverToken hook failed; falling back to console: ${err.message}`);
+        result = payload;
+    }
+    const delivered = Boolean(result?.delivered);
+    if (!delivered) {
+        console.log(`\n[pattern] ✉ ${input.purpose} link for ${input.email}\n` +
+            `[pattern]   ${url}\n` +
+            `[pattern]   (deliver these yourself by subscribing a workflow to the "${DELIVER_TOKEN_HOOK}" hook)\n`);
+    }
+    return { delivered, url };
+}
+//# sourceMappingURL=deliver.js.map

package/dist/deliver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver.js","sourceRoot":"","sources":["../src/deliver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAgB1D,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAsB;IAC9D,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAc,EAAE,KAAmB;IACpE,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4DAA4D;QAC5D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,sDAAuD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,MAAM,GAAG,OAAO,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAE,MAA8C,EAAE,SAAS,CAAC,CAAC;IACtF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CACT,iBAAiB,KAAK,CAAC,OAAO,aAAa,KAAK,CAAC,KAAK,IAAI;YACxD,eAAe,GAAG,IAAI;YACtB,yEAAyE,kBAAkB,WAAW,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC5B,CAAC"}

package/dist/frontend.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @pattern-js/mod-identity — admin screens (Tier-1 declarative, zero build).
+ *
+ * Users / Invite / Sessions under an "Access" category. Every view and action
+ * names its own dedicated route (see `./admin-routes.ts`) — there is no generic
+ * op invoker; the routes are admin-scope-gated and the ops re-check scopes too.
+ */
+import type { FrontendContribution } from "@pattern-js/core";
+export declare function identityFrontend(): FrontendContribution;
+//# sourceMappingURL=frontend.d.ts.map

package/dist/frontend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend.d.ts","sourceRoot":"","sources":["../src/frontend.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,wBAAgB,gBAAgB,IAAI,oBAAoB,CAiIvD"}

package/dist/frontend.js

@@ -0,0 +1,139 @@
+/**
+ * @pattern-js/mod-identity — admin screens (Tier-1 declarative, zero build).
+ *
+ * Users / Invite / Sessions under an "Access" category. Every view and action
+ * names its own dedicated route (see `./admin-routes.ts`) — there is no generic
+ * op invoker; the routes are admin-scope-gated and the ops re-check scopes too.
+ */
+import { PATHS } from "./admin-routes.js";
+export function identityFrontend() {
+    return {
+        menu: [
+            { category: "Access", label: "Users", icon: "users", path: "/x/identity/users", order: 10 },
+            { category: "Access", label: "Invite", icon: "user-plus", path: "/x/identity/invite", order: 20 },
+            { category: "Access", label: "Sessions", icon: "key-round", path: "/x/identity/sessions", order: 30 },
+        ],
+        pages: [
+            {
+                path: "/x/identity/users",
+                view: {
+                    kind: "table",
+                    route: { method: "GET", path: PATHS.users },
+                    columns: [
+                        { key: "email", label: "Email" },
+                        { key: "name", label: "Name" },
+                        { key: "roles", label: "Roles" },
+                        { key: "disabled", label: "Disabled", format: "badge" },
+                        { key: "created", label: "Created", format: "date" },
+                    ],
+                    rowActions: [
+                        // `path` navigates (tokens filled from the row); result:"show" —
+                        // the minted link is FOR the operator (copyable); the mutations
+                        // stay silent: the refreshed row is the feedback.
+                        { label: "Details", path: "/x/identity/users/:userId", args: { userId: "id" }, icon: "user" },
+                        { label: "Sign-in link", route: { method: "POST", path: PATHS.userLoginLink }, args: { userId: "id" }, icon: "key-round", result: "show" },
+                        { label: "Toggle disabled", route: { method: "POST", path: PATHS.userToggleDisabled }, args: { userId: "id" }, icon: "ban", confirm: true },
+                        { label: "Log out everywhere", route: { method: "POST", path: PATHS.userRevokeSessions }, args: { userId: "id" }, icon: "log-out", confirm: true },
+                    ],
+                },
+            },
+            {
+                // The user details page: profile + run metrics, three declarative views
+                // over dedicated routes — the :userId param fills each route's path.
+                path: "/x/identity/users/:userId",
+                views: [
+                    { title: "Profile", view: { kind: "detail", route: { method: "GET", path: PATHS.user } } },
+                    {
+                        title: "Runs by workflow (recent window)",
+                        view: {
+                            kind: "table",
+                            route: { method: "GET", path: PATHS.userRunStats },
+                            columns: [
+                                { key: "workflow", label: "Workflow" },
+                                { key: "runs", label: "Runs" },
+                                { key: "errors", label: "Errors" },
+                                { key: "avg ms", label: "Avg ms" },
+                                { key: "last run", label: "Last run" },
+                            ],
+                        },
+                    },
+                    {
+                        title: "Sessions",
+                        view: {
+                            kind: "table",
+                            route: { method: "GET", path: PATHS.userSessions },
+                            columns: [
+                                { key: "status", label: "Status", format: "badge" },
+                                { key: "created", label: "Created", format: "date" },
+                                { key: "lastSeen", label: "Last seen", format: "date" },
+                                { key: "userAgent", label: "Device" },
+                            ],
+                            rowActions: [
+                                { label: "Revoke", route: { method: "DELETE", path: PATHS.session }, args: { sessionId: "id" }, icon: "log-out", confirm: true },
+                            ],
+                        },
+                    },
+                ],
+            },
+            {
+                path: "/x/identity/invite",
+                view: {
+                    kind: "form",
+                    schema: {
+                        type: "object",
+                        properties: {
+                            email: { type: "string", description: "Who to invite" },
+                            roles: { type: "string", description: 'Comma-separated roles, e.g. "admin" (empty = plain user)' },
+                        },
+                        required: ["email"],
+                    },
+                    route: { method: "POST", path: PATHS.invites },
+                },
+            },
+            {
+                path: "/x/identity/sessions",
+                view: {
+                    kind: "table",
+                    route: { method: "GET", path: PATHS.sessions },
+                    columns: [
+                        { key: "user", label: "User" },
+                        { key: "status", label: "Status", format: "badge" },
+                        { key: "created", label: "Created", format: "date" },
+                        { key: "lastSeen", label: "Last seen", format: "date" },
+                        { key: "userAgent", label: "Device" },
+                    ],
+                    rowActions: [
+                        { label: "Revoke", route: { method: "DELETE", path: PATHS.session }, args: { sessionId: "id" }, icon: "log-out", confirm: true },
+                    ],
+                },
+            },
+        ],
+        commands: [
+            { id: "identity.invite", label: "Invite user…", group: "Access", icon: "user-plus", path: "/x/identity/invite" },
+            { id: "identity.whoami", label: "Who am I?", group: "Access", icon: "user", route: { method: "GET", path: PATHS.whoami } },
+        ],
+        // Lives on the admin's Settings page (System → Settings), with the other knobs.
+        settings: [
+            {
+                id: "identity",
+                title: "Identity",
+                description: "Who may sign up. Invites and admin-minted sign-in links work in both modes.",
+                route: { method: "GET", path: PATHS.settings },
+                submitRoute: { method: "POST", path: PATHS.settings },
+                fields: [
+                    {
+                        key: "signup",
+                        label: "Sign-ups",
+                        type: "select",
+                        options: [
+                            { value: "invite", label: "Invite-only" },
+                            { value: "open", label: "Open" },
+                        ],
+                        description: "Invite-only: unknown emails get no magic link and can't create accounts.",
+                    },
+                ],
+            },
+        ],
+    };
+}
+//# sourceMappingURL=frontend.js.map

package/dist/frontend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend.js","sourceRoot":"","sources":["../src/frontend.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE1C,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,IAAI,EAAE;YACJ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,EAAE;YAC3F,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,EAAE;YACjG,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,EAAE;SACtG;QACD,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE;oBACJ,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE;oBAC3C,OAAO,EAAE;wBACP,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;wBAChC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;wBAC9B,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;wBAChC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;wBACvD,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;qBACrD;oBACD,UAAU,EAAE;wBACV,iEAAiE;wBACjE,gEAAgE;wBAChE,kDAAkD;wBAClD,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBAC7F,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE;wBAC1I,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;wBAC3I,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;qBACnJ;iBACF;aACF;YACD;gBACE,wEAAwE;gBACxE,qEAAqE;gBACrE,IAAI,EAAE,2BAA2B;gBACjC,KAAK,EAAE;oBACL,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE;oBAC1F;wBACE,KAAK,EAAE,kCAAkC;wBACzC,IAAI,EAAE;4BACJ,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE;4BAClD,OAAO,EAAE;gCACP,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;gCACtC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;gCAC9B,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;gCAClC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;gCAClC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;6BACvC;yBACF;qBACF;oBACD;wBACE,KAAK,EAAE,UAAU;wBACjB,IAAI,EAAE;4BACJ,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE;4BAClD,OAAO,EAAE;gCACP,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;gCACnD,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;gCACpD,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE;gCACvD,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE;6BACtC;4BACD,UAAU,EAAE;gCACV,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;6BACjI;yBACF;qBACF;iBACF;aACF;YACD;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE;wBACN,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE;4BACvD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0DAA0D,EAAE;yBACnG;wBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;qBACpB;oBACD,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE;iBAC/C;aACF;YACD;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE;oBACJ,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE;oBAC9C,OAAO,EAAE;wBACP,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;wBAC9B,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;wBACnD,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;wBACpD,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE;wBACvD,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE;qBACtC;oBACD,UAAU,EAAE;wBACV,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;qBACjI;iBACF;aACF;SACF;QACD,QAAQ,EAAE;YACR,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE;YAChH,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE;SAC3H;QACD,gFAAgF;QAChF,QAAQ,EAAE;YACR;gBACE,EAAE,EAAE,UAAU;gBACd,KAAK,EAAE,UAAU;gBACjB,WAAW,EAAE,6EAA6E;gBAC1F,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE;gBAC9C,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE;gBACrD,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,QAAQ;wBACb,KAAK,EAAE,UAAU;wBACjB,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE;4BACP,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE;4BACzC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;yBACjC;wBACD,WAAW,EAAE,0EAA0E;qBACxF;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC"}