@pattern-js/mod-identity 0.2.0

package/dist/options.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @pattern-js/mod-identity — options & defaults.
+ *
+ * Sensible defaults so `pattern.config.json` can list the mod as a bare
+ * string; custom setups use a local wrapper mod exporting `identityMod({...})`
+ * (same convention as `adminMod`).
+ */
+export interface IdentityOptions {
+    /** URL prefix for the auth routes (login, token callback, …). Default "/auth". */
+    mount?: string;
+    /** Session cookie name. Default "pattern_session". */
+    cookieName?: string;
+    /**
+     * SQLite database path, or "memory" for the in-process store. Default
+     * "./.pattern-data/identity.db" — gitignored; NEVER `.pattern/`, which is
+     * committed workflow storage and must not hold PII.
+     */
+    storage?: string;
+    /**
+     * Role → scopes map, compiled onto the principal at session resolution
+     * (so edits apply on the next request). Default { admin: ["admin"] }.
+     */
+    roles?: Record<string, string[]>;
+    /** Who may sign themselves up. Default "invite" (admin invites; closed). */
+    signup?: "open" | "invite";
+    /** Sliding session lifetime in ms. Default 30 days. */
+    sessionTtlMs?: number;
+    /** Min interval between sliding-touch writes per session. Default 60s. */
+    touchThrottleMs?: number;
+    /** Single-use token lifetime in ms. Default 15 minutes. */
+    tokenTtlMs?: number;
+    /**
+     * Set the cookie's Secure flag. Default false so http://localhost logins
+     * work out of the box — turn it on behind TLS in production.
+     */
+    cookieSecure?: boolean;
+    /** Role(s) granted to the first (bootstrap) user. Default ["admin"]. */
+    bootstrapRoles?: string[];
+}
+export interface ResolvedIdentityOptions {
+    mount: string;
+    cookieName: string;
+    storage: string;
+    roles: Record<string, string[]>;
+    signup: "open" | "invite";
+    sessionTtlMs: number;
+    touchThrottleMs: number;
+    tokenTtlMs: number;
+    cookieSecure: boolean;
+    bootstrapRoles: string[];
+}
+export declare function resolveOptions(options?: IdentityOptions): ResolvedIdentityOptions;
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,eAAe;IAC9B,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACjC,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3B,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,cAAc,CAAC,OAAO,GAAE,eAAoB,GAAG,uBAAuB,CAarF"}

package/dist/options.js

@@ -0,0 +1,22 @@
+/**
+ * @pattern-js/mod-identity — options & defaults.
+ *
+ * Sensible defaults so `pattern.config.json` can list the mod as a bare
+ * string; custom setups use a local wrapper mod exporting `identityMod({...})`
+ * (same convention as `adminMod`).
+ */
+export function resolveOptions(options = {}) {
+    return {
+        mount: (options.mount ?? "/auth").replace(/\/$/, "") || "/auth",
+        cookieName: options.cookieName ?? "pattern_session",
+        storage: options.storage ?? "./.pattern-data/identity.db",
+        roles: options.roles ?? { admin: ["admin"] },
+        signup: options.signup ?? "invite",
+        sessionTtlMs: options.sessionTtlMs ?? 30 * 24 * 60 * 60 * 1000,
+        touchThrottleMs: options.touchThrottleMs ?? 60_000,
+        tokenTtlMs: options.tokenTtlMs ?? 15 * 60 * 1000,
+        cookieSecure: options.cookieSecure ?? false,
+        bootstrapRoles: options.bootstrapRoles ?? ["admin"],
+    };
+}
+//# sourceMappingURL=options.js.map

package/dist/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgDH,MAAM,UAAU,cAAc,CAAC,UAA2B,EAAE;IAC1D,OAAO;QACL,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,OAAO;QAC/D,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,iBAAiB;QACnD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,6BAA6B;QACzD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE;QAC5C,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ;QAClC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QAC9D,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,MAAM;QAClD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;QAC3C,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/dist/pages/bootstrap.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @pattern-js/mod-identity — the bootstrap (first-admin) page.
+ *
+ * Reached via the one-time URL printed to the console on first boot. One
+ * email field; submitting consumes the bootstrap token and creates the
+ * first user with the bootstrap roles + a session.
+ */
+export declare function renderBootstrapPage(opts: {
+    token: string;
+    mount: string;
+    error?: string;
+}): string;
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/pages/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/pages/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAgBlG"}

package/dist/pages/bootstrap.js

@@ -0,0 +1,23 @@
+/**
+ * @pattern-js/mod-identity — the bootstrap (first-admin) page.
+ *
+ * Reached via the one-time URL printed to the console on first boot. One
+ * email field; submitting consumes the bootstrap token and creates the
+ * first user with the bootstrap roles + a session.
+ */
+import { escapeHtml, errorBanner, layout } from "./html.js";
+export function renderBootstrapPage(opts) {
+    return layout("Welcome to Pattern", `<h1>Create the first account</h1>
+<p>This one-time link sets up the owner of this Pattern instance${opts.error ? "" : " — it becomes an admin"}.</p>
+${errorBanner(opts.error)}
+<form method="post" action="${escapeHtml(opts.mount)}/bootstrap">
+<label for="email">Your email</label>
+<input id="email" name="email" type="email" required autocomplete="email" autofocus>
+<label for="name">Name <span style="color:#5d6676">(optional)</span></label>
+<input id="name" name="name" type="text" autocomplete="name">
+<input type="hidden" name="t" value="${escapeHtml(opts.token)}">
+<button type="submit">Create account &amp; sign in</button>
+</form>
+<p class="hint">Lost this link? Restart with an empty user store to mint a new one.</p>`);
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/pages/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/pages/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE5D,MAAM,UAAU,mBAAmB,CAAC,IAAsD;IACxF,OAAO,MAAM,CACX,oBAAoB,EACpB;kEAC8D,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB;EAC1G,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;8BACK,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;;;;;uCAKb,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;;;wFAG2B,CACrF,CAAC;AACJ,CAAC"}

package/dist/pages/html.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @pattern-js/mod-identity — hand-written HTML pages.
+ *
+ * No build step, no React: auth pages are tiny, must work before anything
+ * else does, and follow the admin placeholder's dark-glass aesthetic so the
+ * front door matches the house.
+ */
+export declare function escapeHtml(s: string): string;
+/**
+ * Only relative paths survive as a post-login destination — anything else
+ * (absolute URLs, protocol-relative `//`) is an open-redirect vector.
+ */
+export declare function safeNextPath(next: unknown): string;
+export declare function layout(title: string, body: string): string;
+export declare function errorBanner(code: string | undefined): string;
+//# sourceMappingURL=html.d.ts.map

package/dist/pages/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/pages/html.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAO5C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAGlD;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAkC1D;AASD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAI5D"}

package/dist/pages/html.js

@@ -0,0 +1,72 @@
+/**
+ * @pattern-js/mod-identity — hand-written HTML pages.
+ *
+ * No build step, no React: auth pages are tiny, must work before anything
+ * else does, and follow the admin placeholder's dark-glass aesthetic so the
+ * front door matches the house.
+ */
+export function escapeHtml(s) {
+    return s
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}
+/**
+ * Only relative paths survive as a post-login destination — anything else
+ * (absolute URLs, protocol-relative `//`) is an open-redirect vector.
+ */
+export function safeNextPath(next) {
+    if (typeof next !== "string" || !next.startsWith("/") || next.startsWith("//"))
+        return "/";
+    return next;
+}
+export function layout(title, body) {
+    return `<!doctype html><html><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<style>
+  :root { color-scheme: dark; }
+  body { font: 16px/1.5 system-ui, sans-serif; margin: 0; min-height: 100vh;
+         display: grid; place-items: center; background: #0b0d12; color: #e6e9ef; }
+  .card { width: min(92vw, 420px); padding: 2rem 2.25rem; border-radius: 16px;
+          background: rgba(255,255,255,.04); border: 1px solid rgba(255,255,255,.08);
+          backdrop-filter: blur(12px); }
+  h1 { font-size: 1.25rem; margin: 0 0 .25rem; }
+  p { color: #9aa3b2; font-size: .9rem; margin: .25rem 0 1rem; }
+  label { display: block; font-size: .8rem; color: #9aa3b2; margin: .75rem 0 .25rem; }
+  input { width: 100%; box-sizing: border-box; padding: .6rem .75rem; border-radius: 10px;
+          border: 1px solid rgba(255,255,255,.12); background: rgba(0,0,0,.3);
+          color: #e6e9ef; font: inherit; }
+  input:focus { outline: none; border-color: #7cf; box-shadow: 0 0 0 2px rgba(119,204,255,.2); }
+  button, .btn { display: block; width: 100%; margin-top: 1rem; padding: .65rem .75rem;
+          border-radius: 10px; border: 1px solid rgba(119,204,255,.4); cursor: pointer;
+          background: rgba(119,204,255,.12); color: #7cf; font: inherit; font-weight: 600;
+          text-align: center; text-decoration: none; box-sizing: border-box; }
+  button:hover, .btn:hover { background: rgba(119,204,255,.2); }
+  .error { border: 1px solid rgba(255,99,132,.4); background: rgba(255,99,132,.08);
+           color: #ff8fa3; padding: .6rem .75rem; border-radius: 10px; font-size: .85rem;
+           margin-bottom: 1rem; }
+  .hint { font-size: .78rem; color: #5d6676; margin-top: 1.25rem; }
+  .brand { font-size: .75rem; letter-spacing: .14em; text-transform: uppercase;
+           color: #5d6676; margin-bottom: 1rem; }
+  .method + .method { border-top: 1px solid rgba(255,255,255,.08); margin-top: 1.25rem; padding-top: .5rem; }
+</style></head>
+<body><div class="card"><div class="brand">⌬ Pattern</div>
+${body}
+</div></body></html>`;
+}
+const ERROR_MESSAGES = {
+    "invalid-token": "That link is invalid, expired, or was already used. Request a fresh one.",
+    "signup-closed": "Sign-ups are invite-only. Ask an admin to invite you.",
+    "account-disabled": "This account is disabled.",
+    "invalid-email": "That doesn't look like an email address.",
+};
+export function errorBanner(code) {
+    if (!code)
+        return "";
+    const message = ERROR_MESSAGES[code] ?? "Something went wrong. Try again.";
+    return `<div class="error">${escapeHtml(message)}</div>`;
+}
+//# sourceMappingURL=html.js.map

package/dist/pages/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/pages/html.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,OAAO,CAAC;SACL,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa,EAAE,IAAY;IAChD,OAAO;;SAEA,UAAU,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BxB,IAAI;qBACe,CAAC;AACtB,CAAC;AAED,MAAM,cAAc,GAA2B;IAC7C,eAAe,EAAE,0EAA0E;IAC3F,eAAe,EAAE,uDAAuD;IACxE,kBAAkB,EAAE,2BAA2B;IAC/C,eAAe,EAAE,0CAA0C;CAC5D,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,kCAAkC,CAAC;IAC3E,OAAO,sBAAsB,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;AAC3D,CAAC"}

package/dist/pages/login.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @pattern-js/mod-identity — the login page.
+ *
+ * Rendered from the login-method registry, so it grows a section per
+ * provider mod (magic-link form, OIDC buttons, …) with zero page changes.
+ * `next` survives the round-trip as a hidden field / query param.
+ */
+import type { LoginMethod } from "../service.js";
+export declare function renderLoginPage(opts: {
+    methods: LoginMethod[];
+    next?: unknown;
+    error?: string;
+    notice?: string;
+}): string;
+/** Post-request page ("check your email / console"). */
+export declare function renderSentPage(email: string): string;
+//# sourceMappingURL=login.d.ts.map

package/dist/pages/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/pages/login.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAiBT;AAqBD,wDAAwD;AACxD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOpD"}

package/dist/pages/login.js

@@ -0,0 +1,43 @@
+/**
+ * @pattern-js/mod-identity — the login page.
+ *
+ * Rendered from the login-method registry, so it grows a section per
+ * provider mod (magic-link form, OIDC buttons, …) with zero page changes.
+ * `next` survives the round-trip as a hidden field / query param.
+ */
+import { escapeHtml, errorBanner, layout, safeNextPath } from "./html.js";
+export function renderLoginPage(opts) {
+    const next = safeNextPath(opts.next);
+    const sections = opts.methods.length
+        ? opts.methods.map((m) => renderMethod(m, next)).join("\n")
+        : `<p>No login methods are installed. Add one (e.g. <code>@pattern-js/mod-auth-magic-link</code>) to your mods.</p>`;
+    const notice = opts.notice ? `<p>${escapeHtml(opts.notice)}</p>` : "";
+    return layout("Sign in", `<h1>Sign in</h1>
+<p>to continue${next !== "/" ? ` to <code>${escapeHtml(next)}</code>` : ""}</p>
+${errorBanner(opts.error)}
+${notice}
+${sections}`);
+}
+function renderMethod(method, next) {
+    if (method.kind === "redirect") {
+        const url = `${method.startUrl}${method.startUrl.includes("?") ? "&" : "?"}next=${encodeURIComponent(next)}`;
+        return `<div class="method"><a class="btn" href="${escapeHtml(url)}">${escapeHtml(method.label)}</a></div>`;
+    }
+    const fields = method.fields ?? [{ name: "email", label: "Email", type: "email" }];
+    const inputs = fields
+        .map((f) => `<label for="${escapeHtml(f.name)}">${escapeHtml(f.label)}</label>
+<input id="${escapeHtml(f.name)}" name="${escapeHtml(f.name)}" type="${escapeHtml(f.type ?? "text")}" required autocomplete="${f.type === "email" ? "email" : "on"}">`)
+        .join("\n");
+    return `<div class="method"><form method="post" action="${escapeHtml(method.startUrl)}">
+${inputs}
+<input type="hidden" name="next" value="${escapeHtml(next)}">
+<button type="submit">${escapeHtml(method.label)}</button>
+</form></div>`;
+}
+/** Post-request page ("check your email / console"). */
+export function renderSentPage(email) {
+    return layout("Check your inbox", `<h1>Check your inbox</h1>
+<p>If <strong>${escapeHtml(email)}</strong> has an account (or sign-ups are open), a sign-in link is on its way.</p>
+<p class="hint">No email mod installed? The link was printed to the server console.</p>`);
+}
+//# sourceMappingURL=login.js.map

package/dist/pages/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/pages/login.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE1E,MAAM,UAAU,eAAe,CAAC,IAK/B;IACC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM;QAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3D,CAAC,CAAC,kHAAkH,CAAC;IAEvH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtE,OAAO,MAAM,CACX,SAAS,EACT;gBACY,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;EACxE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;EACvB,MAAM;EACN,QAAQ,EAAE,CACT,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAmB,EAAE,IAAY;IACrD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7G,OAAO,4CAA4C,UAAU,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;IAC9G,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM;SAClB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;aACzD,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,4BAA4B,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CACjK;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,mDAAmD,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;EACrF,MAAM;0CACkC,UAAU,CAAC,IAAI,CAAC;wBAClC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;cAClC,CAAC;AACf,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,MAAM,CACX,kBAAkB,EAClB;gBACY,UAAU,CAAC,KAAK,CAAC;wFACuD,CACrF,CAAC;AACJ,CAAC"}

package/dist/pages/welcome.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @pattern-js/mod-identity — the post-login landing of last resort.
+ *
+ * Logins redirect to `next` → the app's advertised home (AUTH_HOME_URL — the
+ * admin registers its mount) → here. Exists so a headless app's first login
+ * never dead-ends on a 404: you see who you are and where to go next.
+ */
+export declare function renderWelcomePage(opts: {
+    email: string;
+    name?: string | null;
+    mount: string;
+}): string;
+//# sourceMappingURL=welcome.d.ts.map

package/dist/pages/welcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"welcome.d.ts","sourceRoot":"","sources":["../../src/pages/welcome.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAYtG"}

package/dist/pages/welcome.js

@@ -0,0 +1,19 @@
+/**
+ * @pattern-js/mod-identity — the post-login landing of last resort.
+ *
+ * Logins redirect to `next` → the app's advertised home (AUTH_HOME_URL — the
+ * admin registers its mount) → here. Exists so a headless app's first login
+ * never dead-ends on a 404: you see who you are and where to go next.
+ */
+import { escapeHtml, layout } from "./html.js";
+export function renderWelcomePage(opts) {
+    const who = opts.name ? `${opts.name} (${opts.email})` : opts.email;
+    return layout("Signed in", `<h1>You're in ✦</h1>
+<p>Signed in as <strong>${escapeHtml(who)}</strong>.</p>
+<p>This instance has no frontend registered, so there's nowhere to redirect you —
+your session cookie is set and every protected route now answers to you.</p>
+<form method="post" action="${escapeHtml(opts.mount)}/logout"><button type="submit">Sign out</button></form>
+<p class="hint">Apps advertise a post-login home via the <code>AUTH_HOME_URL</code> service
+(the admin mod does this automatically).</p>`);
+}
+//# sourceMappingURL=welcome.js.map

package/dist/pages/welcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"welcome.js","sourceRoot":"","sources":["../../src/pages/welcome.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,UAAU,iBAAiB,CAAC,IAA4D;IAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IACpE,OAAO,MAAM,CACX,WAAW,EACX;0BACsB,UAAU,CAAC,GAAG,CAAC;;;8BAGX,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;;6CAEP,CAC1C,CAAC;AACJ,CAAC"}

package/dist/service-key.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @pattern-js/mod-identity — service access for ops.
+ *
+ * The key itself (`IDENTITY_SERVICE`) lives in core so consumers that only
+ * need presence-detection (the admin's secure-by-default) never import this
+ * package. This module is the typed accessor for code that does.
+ */
+import { IDENTITY_SERVICE, type OpContext } from "@pattern-js/core";
+import type { IdentityService } from "./service.js";
+export { IDENTITY_SERVICE };
+export declare function identityService(ctx: OpContext): IdentityService;
+//# sourceMappingURL=service-key.d.ts.map

package/dist/service-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-key.d.ts","sourceRoot":"","sources":["../src/service-key.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,eAAe,CAI/D"}

package/dist/service-key.js

@@ -0,0 +1,16 @@
+/**
+ * @pattern-js/mod-identity — service access for ops.
+ *
+ * The key itself (`IDENTITY_SERVICE`) lives in core so consumers that only
+ * need presence-detection (the admin's secure-by-default) never import this
+ * package. This module is the typed accessor for code that does.
+ */
+import { IDENTITY_SERVICE } from "@pattern-js/core";
+export { IDENTITY_SERVICE };
+export function identityService(ctx) {
+    const svc = ctx.services[IDENTITY_SERVICE];
+    if (!svc)
+        throw new Error("identity service is not registered (install @pattern-js/mod-identity)");
+    return svc;
+}
+//# sourceMappingURL=service-key.js.map

package/dist/service-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-key.js","sourceRoot":"","sources":["../src/service-key.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAkB,MAAM,kBAAkB,CAAC;AAGpE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAgC,CAAC;IAC1E,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACnG,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/service.d.ts

@@ -0,0 +1,133 @@
+/**
+ * @pattern-js/mod-identity — the identity service (§9).
+ *
+ * Registered on the engine under core's `IDENTITY_SERVICE` key; consumed by
+ * this mod's ops, by provider mods (magic-link, oidc…) and by the admin's
+ * secure-by-default check. Bridges the two meanings of "auth provider":
+ * login methods prove who a human is (interactive flows, registered here);
+ * the session AuthProvider turns the resulting cookie back into a principal
+ * on every request.
+ *
+ * Scopes are compiled from roles **at resolve time**, so editing the role
+ * map applies on the next request — sessions store no scopes.
+ */
+import type { ConnectionRegistry } from "@pattern-js/core";
+import type { ResolvedIdentityOptions } from "./options.js";
+import type { IdentityStores, SessionRow, TokenPurpose, TokenRow, UserRow } from "./store/types.js";
+/** A way to log in, registered by provider mods in their `ready` hook. */
+export interface LoginMethod {
+    id: string;
+    label: string;
+    /** "form" posts fields to startUrl; "redirect" navigates to startUrl. */
+    kind: "form" | "redirect";
+    startUrl: string;
+    /** Form field hint for the login page (default: a single email field). */
+    fields?: Array<{
+        name: string;
+        label: string;
+        type?: string;
+    }>;
+}
+export interface MintedSession {
+    sessionId: string;
+    /** The RAW cookie secret — only ever returned here, stored hashed. */
+    token: string;
+    expiresAt: number;
+}
+export interface ResolvedSession {
+    session: SessionRow;
+    user: UserRow;
+    /** Compiled from the user's roles via the role map. */
+    scopes: string[];
+}
+export interface IssuedToken {
+    /** The RAW single-use secret. */
+    token: string;
+    /** Path-only callback URL (`{mount}/token?t=…[&next=…]`); callers prepend an origin if needed. */
+    path: string;
+    expiresAt: number;
+}
+export interface FindOrCreateInput {
+    provider: string;
+    subject: string;
+    email: string;
+    name?: string;
+    /** True when arriving via invite/bootstrap token or open signup. */
+    allowCreate: boolean;
+    /** Roles granted on creation (invite/bootstrap). */
+    roles?: string[];
+}
+export interface IdentityService {
+    findOrCreateByIdentity(input: FindOrCreateInput): Promise<UserRow | null>;
+    getUser(id: string): Promise<UserRow | null>;
+    /** Lookup by (normalized) email — provider mods gate token issuance on this. */
+    findUserByEmail(email: string): Promise<UserRow | null>;
+    listUsers(): Promise<UserRow[]>;
+    /** CAS-retried. Revokes the user's sessions — privilege changes end sessions. */
+    setRoles(userId: string, roles: string[]): Promise<UserRow>;
+    /** CAS-retried. Disabling also revokes all sessions. */
+    setDisabled(userId: string, disabled: boolean): Promise<UserRow>;
+    mintSession(userId: string, meta?: {
+        userAgent?: string | null;
+        ip?: string | null;
+    }): Promise<MintedSession>;
+    resolveSessionByToken(rawToken: string, now?: number): Promise<ResolvedSession | null>;
+    revokeSession(sessionId: string): Promise<void>;
+    revokeAllForUser(userId: string): Promise<void>;
+    listSessions(userId?: string): Promise<SessionRow[]>;
+    issueToken(input: {
+        purpose: TokenPurpose;
+        email?: string;
+        ttlMs?: number;
+        data?: Record<string, unknown>;
+    }): Promise<IssuedToken>;
+    consumeToken(rawToken: string, purpose?: TokenPurpose): Promise<TokenRow | null>;
+    registerLoginMethod(method: LoginMethod): void;
+    loginMethods(): LoginMethod[];
+    scopesForRoles(roles: string[]): string[];
+    /** The EFFECTIVE signup policy — admin-toggleable at runtime. */
+    getSignup(): Promise<"open" | "invite">;
+    setSignup(mode: "open" | "invite"): Promise<void>;
+    readonly options: ResolvedIdentityOptions;
+}
+export declare class DefaultIdentityService implements IdentityService {
+    private readonly stores;
+    readonly options: ResolvedIdentityOptions;
+    /** The engine's connection registry — revocation closes live WS sockets. */
+    private readonly connections?;
+    private readonly methods;
+    private readonly mutex;
+    constructor(stores: IdentityStores, options: ResolvedIdentityOptions, 
+    /** The engine's connection registry — revocation closes live WS sockets. */
+    connections?: ConnectionRegistry | undefined);
+    findOrCreateByIdentity(input: FindOrCreateInput): Promise<UserRow | null>;
+    getUser(id: string): Promise<UserRow | null>;
+    findUserByEmail(email: string): Promise<UserRow | null>;
+    listUsers(): Promise<UserRow[]>;
+    setRoles(userId: string, roles: string[]): Promise<UserRow>;
+    setDisabled(userId: string, disabled: boolean): Promise<UserRow>;
+    /** Read-modify-write with CAS retry under the per-user mutex. */
+    private casUpdateUser;
+    mintSession(userId: string, meta?: {
+        userAgent?: string | null;
+        ip?: string | null;
+    }): Promise<MintedSession>;
+    resolveSessionByToken(rawToken: string, now?: number): Promise<ResolvedSession | null>;
+    revokeSession(sessionId: string): Promise<void>;
+    revokeAllForUser(userId: string): Promise<void>;
+    private closeSessionSockets;
+    listSessions(userId?: string): Promise<SessionRow[]>;
+    issueToken(input: {
+        purpose: TokenPurpose;
+        email?: string;
+        ttlMs?: number;
+        data?: Record<string, unknown>;
+    }): Promise<IssuedToken>;
+    consumeToken(rawToken: string, purpose?: TokenPurpose): Promise<TokenRow | null>;
+    registerLoginMethod(method: LoginMethod): void;
+    loginMethods(): LoginMethod[];
+    scopesForRoles(roles: string[]): string[];
+    getSignup(): Promise<"open" | "invite">;
+    setSignup(mode: "open" | "invite"): Promise<void>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAKpG,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,uDAAuD;IACvD,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,kGAAkG;IAClG,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,WAAW,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAE9B,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC1E,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC7C,gFAAgF;IAChF,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACxD,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,wDAAwD;IACxD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAGjE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9G,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACvF,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAGrD,UAAU,CAAC,KAAK,EAAE;QAChB,OAAO,EAAE,YAAY,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAGjF,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,YAAY,IAAI,WAAW,EAAE,CAAC;IAG9B,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IAG1C,iEAAiE;IACjE,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC;IACxC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGlD,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;CAC3C;AASD,qBAAa,sBAAuB,YAAW,eAAe;IAK1D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,QAAQ,CAAC,OAAO,EAAE,uBAAuB;IACzC,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAP/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;gBAGvB,MAAM,EAAE,cAAc,EAC9B,OAAO,EAAE,uBAAuB;IACzC,4EAA4E;IAC3D,WAAW,CAAC,EAAE,kBAAkB,YAAA;IAK7C,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAmC/E,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAI5C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAIvD,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAIzB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAO3D,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtE,iEAAiE;IACjE,OAAO,CAAC,aAAa;IAiBf,WAAW,CACf,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAO,GAC3D,OAAO,CAAC,aAAa,CAAC;IAiBnB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAiBlG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/C,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAKvC,mBAAmB;IAMjC,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAM9C,UAAU,CAAC,KAAK,EAAE;QACtB,OAAO,EAAE,YAAY,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,GAAG,OAAO,CAAC,WAAW,CAAC;IAoBlB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAYtF,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAI9C,YAAY,IAAI,WAAW,EAAE;IAM7B,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;IAUnC,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;IAKvC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAIxD"}