@pattern-js/mod-identity 0.4.0 → 0.5.0

package/dist/user-page.js

@@ -0,0 +1,204 @@
+/**
+ * @pattern-js/mod-identity — the Tier-2 "User" details page.
+ *
+ * The operator's view of one person: identity card + the actions that matter
+ * (sign-in link, disable, log out everywhere, delete), a ROLES editor that
+ * knows the configured roles map (checkboxes, not comma syntax) and says out
+ * loud that saving signs the user out everywhere, their sessions and run
+ * stats — and, duck-typed, their subscription when mod-billing is installed
+ * (absent mod, absent panel). Same construction as the billing/email pages:
+ * ESM source over the shared `__PATTERN_ADMIN__` global.
+ */
+export const USER_PAGE_REMOTE = `
+const { React, api, ui } = globalThis.__PATTERN_ADMIN__;
+const { GlassPanel, NeonButton, Badge, Modal } = ui;
+const h = React.createElement;
+const inputCls = "glass w-full rounded-lg px-3 py-2 text-sm";
+
+function ago(v) {
+  var ts = typeof v === "number" ? v : v ? Date.parse(v) : NaN;
+  if (!isFinite(ts)) return "";
+  var s = Math.max(0, (Date.now() - ts) / 1000);
+  if (s < 90) return Math.round(s) + "s ago";
+  if (s < 5400) return Math.round(s / 60) + "m ago";
+  if (s < 129600) return Math.round(s / 3600) + "h ago";
+  return Math.round(s / 86400) + "d ago";
+}
+
+function Row({ label, children }) {
+  return h("div", { className: "flex items-baseline justify-between gap-6 text-sm" },
+    h("span", { className: "text-muted shrink-0 text-xs uppercase tracking-wider" }, label),
+    h("span", { className: "min-w-0 break-all text-right font-mono text-xs" }, children));
+}
+
+function MiniTable({ title, cols, rows, empty, rowAction }) {
+  return h(GlassPanel, { className: "p-6 space-y-3" },
+    h("h3", { className: "font-semibold" }, title),
+    rows.length === 0
+      ? h("p", { className: "text-sm text-muted" }, empty)
+      : h("div", { className: "overflow-x-auto" }, h("table", { className: "w-full text-sm" },
+          h("thead", null, h("tr", { className: "text-left text-xs text-muted" },
+            cols.map((c) => h("th", { key: c.key, className: "py-1 pr-4 font-normal" }, c.label)),
+            rowAction ? h("th", null) : null)),
+          h("tbody", null, rows.map((r, i) =>
+            h("tr", { key: i, className: "border-t border-white/5" },
+              cols.map((c) => h("td", { key: c.key, className: "py-1.5 pr-4 text-xs " + (c.mono ? "font-mono" : "") },
+                c.render ? c.render(r) : String(r[c.key] == null ? "—" : r[c.key]))),
+              rowAction ? h("td", { className: "py-1.5 text-right" },
+                h("button", { className: "text-xs text-muted hover:text-[var(--color-neon-pink)]", onClick: () => rowAction.run(r) }, rowAction.label)) : null))))));
+}
+
+// ── Roles editor: the configured map as checkboxes + free-form extras ────
+function RolesEditor({ user, onSaved }) {
+  const known = user.knownRoles || [];
+  const [roles, setRoles] = React.useState(user.rolesList || []);
+  const [extra, setExtra] = React.useState("");
+  const [confirming, setConfirming] = React.useState(false);
+  const [busy, setBusy] = React.useState(false);
+  const toggle = (r) => setRoles(roles.indexOf(r) >= 0 ? roles.filter((x) => x !== r) : roles.concat(r));
+  const finalRoles = () => roles.concat(extra.split(",").map((s) => s.trim()).filter((s) => s && roles.indexOf(s) < 0));
+  const changed = JSON.stringify(finalRoles().slice().sort()) !== JSON.stringify((user.rolesList || []).slice().sort());
+  function save() {
+    setBusy(true);
+    api.call("POST", "/identity/users/" + encodeURIComponent(user["user id"]) + "/roles", { roles: finalRoles().join(",") })
+      .then(() => { setConfirming(false); setExtra(""); onSaved(); })
+      .finally(() => setBusy(false));
+  }
+  return h(GlassPanel, { className: "p-6 space-y-3" },
+    h("h3", { className: "font-semibold" }, "Roles"),
+    h("p", { className: "text-xs text-muted" },
+      "Roles become scopes on the next request (the identity roles map). Saving REPLACES the set and signs the user out everywhere."),
+    h("div", { className: "space-y-1.5" }, known.map((r) =>
+      h("label", { key: r, className: "flex cursor-pointer items-center gap-2 text-sm" },
+        h("input", { type: "checkbox", checked: roles.indexOf(r) >= 0, onChange: () => toggle(r) }),
+        h("span", { className: "font-mono text-xs" }, r))),
+      known.length === 0 && h("p", { className: "text-xs text-muted" }, "No roles map configured — add roles free-form below.")),
+    h("input", { className: inputCls, value: extra, placeholder: "extra roles, comma-separated (optional)", onChange: (e) => setExtra(e.target.value) }),
+    h(NeonButton, { disabled: !changed || busy, onClick: () => setConfirming(true) }, "Save roles"),
+    h(Modal, { open: confirming, onClose: () => setConfirming(false), title: "Replace roles?" },
+      h("div", { className: "space-y-4" },
+        h("p", { className: "text-sm" },
+          "New set: ", h("span", { className: "font-mono text-xs" }, finalRoles().join(", ") || "(none — plain user)"),
+          ". This is a privilege change: the user is signed out of every session."),
+        h("div", { className: "flex justify-end gap-2" },
+          h(NeonButton, { variant: "ghost", onClick: () => setConfirming(false) }, "Cancel"),
+          h(NeonButton, { variant: "danger", disabled: busy, onClick: save }, busy ? "Saving…" : "Replace roles")))));
+}
+
+// ── The action strip: mint link / disable / log out / delete ─────────────
+function Actions({ user, reload }) {
+  const id = encodeURIComponent(user["user id"]);
+  const [confirm, setConfirm] = React.useState(null); // { label, run, note }
+  const [minted, setMinted] = React.useState(null);
+  const [busy, setBusy] = React.useState(false);
+  const act = (method, path) => api.call(method, path).then(reload);
+  const buttons = [
+    { label: "Sign-in link", run: () => api.call("POST", "/identity/users/" + id + "/login-link").then((r) => setMinted((r && (r.result || r.link || r.copy)) || r)) },
+    { label: user.disabled ? "Enable" : "Disable", confirm: user.disabled ? "Re-enable this account?" : "The user can't sign in (existing sessions end).", run: () => act("POST", "/identity/users/" + id + "/toggle-disabled") },
+    { label: "Log out everywhere", confirm: "Ends every active session for this user.", run: () => act("POST", "/identity/users/" + id + "/revoke-sessions") },
+    { label: "Delete", confirm: "Deletes the account permanently.", danger: true, run: () => api.call("DELETE", "/identity/users/" + id).then(() => history.back()) },
+  ];
+  const fire = (b) => (b.confirm ? setConfirm(b) : b.run());
+  const mintedText = minted && (typeof minted === "string" ? minted : (minted.copy || minted.link || JSON.stringify(minted)));
+  return h("div", { className: "space-y-3" },
+    h("div", { className: "flex flex-wrap gap-2" },
+      buttons.map((b) => h(NeonButton, { key: b.label, variant: b.danger ? "danger" : "ghost", disabled: busy, onClick: () => fire(b) }, b.label))),
+    mintedText && h("div", { className: "flex items-center gap-2" },
+      h("input", { readOnly: true, value: String(mintedText).startsWith("/") ? location.origin + mintedText : mintedText,
+        onFocus: (e) => e.currentTarget.select(), className: "glass min-w-0 flex-1 rounded-lg px-3 py-2 font-mono text-xs" }),
+      h(NeonButton, { onClick: () => { navigator.clipboard && navigator.clipboard.writeText(String(mintedText).startsWith("/") ? location.origin + mintedText : mintedText); } }, "Copy")),
+    h(Modal, { open: confirm !== null, onClose: () => setConfirm(null), title: confirm ? confirm.label : "" },
+      confirm && h("div", { className: "space-y-4" },
+        h("p", { className: "text-sm" }, confirm.confirm),
+        h("div", { className: "flex justify-end gap-2" },
+          h(NeonButton, { variant: "ghost", onClick: () => setConfirm(null) }, "Cancel"),
+          h(NeonButton, { variant: "danger", disabled: busy, onClick: () => { setBusy(true); Promise.resolve(confirm.run()).finally(() => { setBusy(false); setConfirm(null); }); } }, confirm.label)))));
+}
+
+// ── Billing, duck-typed: present ⇒ a panel; absent ⇒ nothing ────────────
+function BillingPanel({ userId }) {
+  const [state, setState] = React.useState({ probed: false, row: null });
+  React.useEffect(() => {
+    api.call("GET", "/billing/api/customers")
+      .then((r) => {
+        const rows = Array.isArray(r) ? r : (r && r.customers) || [];
+        setState({ probed: true, row: rows.find((c) => c.userId === userId) || null });
+      })
+      .catch(() => setState({ probed: false, row: null }));
+  }, [userId]);
+  if (!state.probed) return null;
+  return h(GlassPanel, { className: "p-6 space-y-3" },
+    h("h3", { className: "font-semibold" }, "Billing"),
+    state.row
+      ? h("div", { className: "space-y-2" },
+          h(Row, { label: "Status" }, h(Badge, null, String(state.row.status || "—"))),
+          h(Row, { label: "Entitled" }, state.row.entitled === true || state.row.entitled === "yes" ? "yes" : "no"),
+          h(Row, { label: "Plan" }, String(state.row.priceKeys || "—")),
+          h(Row, { label: "Owns" }, String(state.row.purchased || "—")),
+          h(Row, { label: "Customer" }, String(state.row.customerId || "—")),
+          h(Row, { label: "Updated" }, ago(state.row.updatedAt) || "—"))
+      : h("p", { className: "text-sm text-muted" }, "Nothing yet — this user has never completed a checkout."));
+}
+
+export default function UserPage({ params }) {
+  const userId = (params && params.userId) || decodeURIComponent(location.pathname.split("/").pop() || "");
+  const [user, setUser] = React.useState(null);
+  const [sessions, setSessions] = React.useState([]);
+  const [stats, setStats] = React.useState([]);
+  const [error, setError] = React.useState(false);
+  const id = encodeURIComponent(userId);
+
+  const reload = () => Promise.all([
+    api.call("GET", "/identity/users/" + id).then((r) => setUser((r && r.user) || r)),
+    api.call("GET", "/identity/users/" + id + "/sessions").then((r) => setSessions(Array.isArray(r) ? r : (r && r.sessions) || [])),
+    api.call("GET", "/identity/users/" + id + "/run-stats").then((r) => setStats(Array.isArray(r) ? r : (r && r.stats) || [])).catch(() => {}),
+  ]).catch(() => setError(true));
+  React.useEffect(() => { reload(); }, [userId]);
+
+  if (error) return h(GlassPanel, { className: "p-6 text-sm", style: { color: "var(--color-neon-pink)" } }, "Couldn't load this user.");
+  if (!user) return null;
+
+  const revokeSession = { label: "Revoke", run: (r) => api.call("DELETE", "/identity/sessions/" + encodeURIComponent(r.id)).then(reload) };
+
+  return h("div", { className: "grid gap-6 lg:grid-cols-2 items-start" },
+    h("div", { className: "space-y-6" },
+      h(GlassPanel, { className: "p-6 space-y-3" },
+        h("div", { className: "flex items-center justify-between gap-3" },
+          h("div", null,
+            h("h3", { className: "font-semibold" }, String(user.email || userId)),
+            h("p", { className: "text-xs text-muted mt-0.5" }, String(user.name || ""))),
+          user.disabled ? h(Badge, { hue: 340 }, "disabled") : h(Badge, { hue: 140 }, "active")),
+        h("div", { className: "space-y-2" },
+          h(Row, { label: "Roles" }, String(user.roles || "—")),
+          h(Row, { label: "Scopes" }, String(user.scopes || "—")),
+          h(Row, { label: "Sessions" }, String(user["active sessions"])),
+          h(Row, { label: "Created" }, ago(user.createdAt) || String(user.created || "")),
+          h(Row, { label: "Id" }, String(user["user id"]))),
+        h(Actions, { user, reload })),
+      h(RolesEditor, { key: String(user.roles), user, onSaved: reload })),
+    h("div", { className: "space-y-6" },
+      h(BillingPanel, { userId: user["user id"] }),
+      h(MiniTable, {
+        title: "Sessions", empty: "No sessions.",
+        cols: [
+          { key: "status", label: "Status", render: (r) => h(Badge, null, String(r.status || "—")) },
+          { key: "created", label: "Created", render: (r) => ago(r.created) || "—" },
+          { key: "lastSeen", label: "Last seen", render: (r) => ago(r.lastSeen) || "—" },
+          { key: "userAgent", label: "Device" },
+        ],
+        rows: sessions, rowAction: revokeSession,
+      }),
+      h(MiniTable, {
+        title: "Runs by workflow (recent window)", empty: "No runs in the retained window.",
+        cols: [
+          { key: "workflow", label: "Workflow", mono: true },
+          { key: "runs", label: "Runs" },
+          { key: "errors", label: "Errors" },
+          { key: "avg ms", label: "Avg ms" },
+          { key: "last run", label: "Last run" },
+        ],
+        rows: stats,
+      })));
+}
+`;
+//# sourceMappingURL=user-page.js.map

package/dist/user-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-page.js","sourceRoot":"","sources":["../src/user-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+L/B,CAAC"}

package/dist/workflows.d.ts

@@ -9,6 +9,7 @@
  * (admin-stamped invoke), not routes.
  */
 import type { Workflow } from "@pattern-js/core";
+import type { RateBudget } from "./options.js";
 /** The identity routes under `mount` (default /auth). */
-export declare function endpointWorkflows(mount: string): Workflow[];
+export declare function endpointWorkflows(mount: string, perClient?: RateBudget | false): Workflow[];
 //# sourceMappingURL=workflows.d.ts.map

package/dist/workflows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../src/workflows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAsFjD,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,EAAE,CAY3D"}
+{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../src/workflows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAiG/C,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,GAAE,UAAU,GAAG,KAAkC,GAAG,QAAQ,EAAE,CAavH"}

package/dist/workflows.js

@@ -9,6 +9,14 @@
  * (admin-stamped invoke), not routes.
  */
 import { authOpRoutes } from "./ops.js";
+/** The trigger config: method + path, plus the per-IP budget when the route has one. */
+function triggerConfig(spec) {
+    return {
+        method: spec.method,
+        path: spec.path,
+        ...(spec.rateLimit ? { rateLimit: { max: spec.rateLimit.max, window: spec.rateLimit.window, by: "ip" } } : {}),
+    };
+}
 function endpoint(spec) {
     if (spec.shape === "http") {
         // Auth pages + redirects: decompose the request into the PURE op's discrete
@@ -19,7 +27,7 @@ function endpoint(spec) {
         if (!io)
             throw new Error(`identity route "${spec.id}": no auth I/O for op "${spec.op}"`);
         const nodes = [
-            { id: "in", op: "boundary.http.request", config: { method: spec.method, path: spec.path } },
+            { id: "in", op: "boundary.http.request", config: triggerConfig(spec) },
             { id: "call", op: spec.op },
             { id: "ct", op: "core.const.object", config: { value: { "content-type": "text/html; charset=utf-8" } } },
             { id: "out", op: "boundary.http.response", config: { mode: "buffered" } },
@@ -60,7 +68,7 @@ function endpoint(spec) {
     const out = spec.out ?? "out";
     const query = spec.query ?? [];
     const nodes = [
-        { id: "in", op: "boundary.http.request", config: { method: spec.method, path: spec.path } },
+        { id: "in", op: "boundary.http.request", config: triggerConfig(spec) },
         { id: "call", op: spec.op },
         { id: "status", op: "boundary.http.status" },
         { id: "out", op: "boundary.http.response", config: { mode: "buffered" } },
@@ -81,16 +89,17 @@ function endpoint(spec) {
     return { id: spec.id, name: `Identity · ${spec.method} ${spec.path}`, source: "code", nodes, edges };
 }
 /** The identity routes under `mount` (default /auth). */
-export function endpointWorkflows(mount) {
+export function endpointWorkflows(mount, perClient = { max: 20, window: "15m" }) {
     const specs = [
         { id: "identity.route.login", method: "GET", path: `${mount}/login`, op: "identity.login.page", shape: "http" },
         { id: "identity.route.token", method: "GET", path: `${mount}/token`, op: "identity.token.callback", shape: "http" },
+        { id: "identity.route.code", method: "POST", path: `${mount}/code`, op: "identity.code.callback", shape: "http", rateLimit: perClient },
         { id: "identity.route.logout", method: "POST", path: `${mount}/logout`, op: "identity.logout", shape: "http" },
         { id: "identity.route.whoami", method: "GET", path: `${mount}/whoami`, op: "identity.whoami", shape: "json", out: "whoami" },
         { id: "identity.route.welcome", method: "GET", path: `${mount}/welcome`, op: "identity.welcome.page", shape: "http" },
         { id: "identity.route.invited", method: "GET", path: `${mount}/invited`, op: "identity.invited.page", shape: "http" },
         { id: "identity.route.bootstrap", method: "GET", path: `${mount}/bootstrap`, op: "identity.bootstrap.page", shape: "http" },
-        { id: "identity.route.bootstrap.submit", method: "POST", path: `${mount}/bootstrap`, op: "identity.bootstrap.submit", shape: "http" },
+        { id: "identity.route.bootstrap.submit", method: "POST", path: `${mount}/bootstrap`, op: "identity.bootstrap.submit", shape: "http", rateLimit: perClient },
     ];
     return specs.map(endpoint);
 }

package/dist/workflows.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../src/workflows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAkBxC,SAAS,QAAQ,CAAC,IAAkB;IAClC,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC1B,4EAA4E;QAC5E,mEAAmE;QACnE,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,EAAE,0BAA0B,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACzF,MAAM,KAAK,GAAsB;YAC/B,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE;YAC3F,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YAC3B,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,EAAE,EAAE;YACxG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;SAC1E,CAAC;QACF,MAAM,KAAK,GAAsB,EAAE,CAAC;QACpC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,GAAG,IAAI,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9F,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,GAAG,IAAI,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5F,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;YACjB,KAAK,GAAG,IAAI,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC7F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAChG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAChG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACvG,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAsB;QAC/B,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE;QAC3F,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,sBAAsB,EAAE;QAC5C,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;KAC1E,CAAC;IACF,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9F,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC1F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACvG,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAmB;QAC5B,EAAE,EAAE,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,QAAQ,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE;QAC/G,EAAE,EAAE,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,QAAQ,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE;QACnH,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE;QAC9G,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE;QAC5H,EAAE,EAAE,EAAE,wBAAwB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE;QACrH,EAAE,EAAE,EAAE,wBAAwB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE;QACrH,EAAE,EAAE,EAAE,0BAA0B,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE;QAC3H,EAAE,EAAE,EAAE,iCAAiC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE;KACtI,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../src/workflows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAoBxC,wFAAwF;AACxF,SAAS,aAAa,CAAC,IAAkB;IACvC,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/G,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAkB;IAClC,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC1B,4EAA4E;QAC5E,mEAAmE;QACnE,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,EAAE,0BAA0B,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACzF,MAAM,KAAK,GAAsB;YAC/B,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE;YACtE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YAC3B,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,EAAE,EAAE;YACxG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;SAC1E,CAAC;QACF,MAAM,KAAK,GAAsB,EAAE,CAAC;QACpC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,GAAG,IAAI,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9F,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,GAAG,IAAI,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5F,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;YACjB,KAAK,GAAG,IAAI,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC7F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAChG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAChG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACvG,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAsB;QAC/B,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE;QACtE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,sBAAsB,EAAE;QAC5C,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;KAC1E,CAAC;IACF,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9F,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC1F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACvG,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,YAAgC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IACzG,MAAM,KAAK,GAAmB;QAC5B,EAAE,EAAE,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,QAAQ,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE;QAC/G,EAAE,EAAE,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,QAAQ,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE;QACnH,EAAE,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,OAAO,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE;QACvI,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE;QAC9G,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE;QAC5H,EAAE,EAAE,EAAE,wBAAwB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE;QACrH,EAAE,EAAE,EAAE,wBAAwB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE;QACrH,EAAE,EAAE,EAAE,0BAA0B,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE;QAC3H,EAAE,EAAE,EAAE,iCAAiC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE;KAC5J,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC"}

package/docs/index.md

@@ -40,8 +40,19 @@ Now a user with role `editor` resolves to scopes `["edit","read"]`; gate a
 route with `requireAuth: { scopes: ["edit"] }` and both `admin` (if you also
 grant it `edit`) and `editor` users get through, `viewer` does not. The same
 roles surface on the admin Users screen and are settable there
-(`identity.users.setRoles`, which **ends the user's sessions**, because a
-privilege change must re-login).
+(`identity.users.setRoles`). Scopes resolve live from the user's roles on
+every request, so a **gain** reaches the user's open sessions immediately;
+a **loss** (any role or scope removed) and an elevation to `admin` end the
+user's sessions instead.
+
+**Entitlements from billing (0.5).** Because scopes recompile from roles on
+every request, a paid plan can *be* a scope: `@pattern-js/mod-billing` projects
+subscription status into a role (say `member`) as verified webhooks arrive, and
+your map turns it into scopes (`{ member: ["pro"] }`) — so
+`requireAuth: { scopes: ["pro"] }` gates a route behind an active plan with no
+new enforcement code. The projection only writes on actual entitlement
+*transitions* (a renewal never logs anyone out). See the **Billing** chapter in
+the handbook — the `saas-starter` scaffold wires the whole bridge.
 
 ## Bootstrap on first boot
 
@@ -63,8 +74,8 @@ no special-case admin password anywhere.
 Opaque 256-bit secrets in an `HttpOnly; SameSite=Lax` cookie (`pattern_session`
 by default); only the sha256 is stored. Sliding 30-day expiry with throttled
 touches. Sessions are **revocable**: individually (`identity.sessions.revoke`),
-per user (`identity.users.revokeSessions`), and automatically when a role
-changes or a user is disabled. Set `cookieSecure: true` behind TLS in
+per user (`identity.users.revokeSessions`), and automatically when a user
+loses a role or scope, is elevated to `admin`, or is disabled. Set `cookieSecure: true` behind TLS in
 production. CSRF protection lives *inside* the session provider: a cross-site
 state-changing request doesn't authenticate (so it 401s with no token
 machinery), while GETs always pass; the magic-link callback is a cross-site
@@ -117,11 +128,12 @@ rooms:
 Magic links, invites, and the bootstrap link all print to the **server
 console** until delivery is wired. The packaged way: install
 `@pattern-js/mod-email` + a driver (Resend or SMTP) and create the `default`
-account in admin → System → Email — links then send by email automatically.
+account in admin → Resources → Email — links then send by email automatically.
 Any other channel works through the `identity.deliverToken` hook
-(`payload: { email, url, purpose, delivered }`): send the link by email/SMS/chat
-and return `delivered: true`. No subscriber (or `delivered: false`) falls back
-to the console, which **is** the zero-config dev login. Tokens are single-use, short-TTL (15 min; invites 7 days), sha256 at
+(`payload: { email, url, purpose, delivered, subject, message, code? }`): send
+the link by email/SMS/chat and return `delivered: true`. No subscriber (or
+`delivered: false`) falls back to the console, which **is** the zero-config dev
+login. Tokens are single-use, short-TTL (15 min; invites 7 days), sha256 at
 rest, consumed via CAS so replays fail closed. Purposes: `login`, `invite`
 (carries roles), `bootstrap`. The `/auth/token` callback turns a consumed token
 into a user + session per the **signup policy**: `invite` (default; unknown
@@ -135,9 +147,60 @@ proxy or tunnel the Host header is whatever the hop put there. Unset (dev),
 the request's own origin is used, so localhost links still work with zero
 config.
 
+## Sign-in codes (0.5)
+
+A login token issued with `code: true` (magic-link does this) also carries a
+**6-digit code** bound to the same row — same TTL, same single use. It exists
+for **installed PWAs and standalone web apps**: the emailed link opens in the
+*system browser's* cookie jar, so the session lands in Safari/Chrome while the
+installed app stays signed out. The code closes that gap — the "check your
+inbox" page carries a code form, and `POST /auth/code` `{ email, code, next }`
+consumes the token and sets the cookie **in the browsing context that asked**.
+Whichever of link or code lands first burns both.
+
+A short code can't lean on hash lookup the way 256-bit tokens do, so its
+safety is budgeted instead: verification compares in constant time against
+the email's pending code-bearing tokens, **five wrong guesses burn the token**
+(link included), and failures render identically for unknown emails and wrong
+codes (status 401, no enumeration). The code travels to custom templates as
+`code` on the `identity.deliverToken` payload, is worked into the default
+`message` copy, and prints with the console fallback.
+
+## Rate limits (0.5)
+
+The sign-in surface is public, and every request to it can cost an email. Two
+budgets are on by default:
+
+- **Per address**: at most 5 sign-in emails per address per 15 minutes,
+  counted in the identity store, so a restart or a second instance doesn't
+  reset it. Past it, the request gets the usual "check your email" page and
+  nothing is sent, so the budget reveals nothing about the address. Login
+  providers ask `svc.signInEmailAllowed(email)` before issuing (magic-link
+  does).
+- **Per client IP**: 20 requests per 15 minutes each to `POST {mount}/code`
+  and `POST {mount}/bootstrap`, answered `429` past it (the route's
+  `rateLimit`). Together with the five-guess burn, this keeps code guessing
+  far from useful. Behind a proxy, set `PATTERN_TRUST_PROXY` so the host sees
+  client addresses.
+
+Tune or turn them off in a wrapper mod:
+
+```js
+identityMod({
+  rateLimit: {
+    perAddress: { max: 5, window: "15m" },  // false = off
+    perClient: { max: 20, window: "15m" },  // false = off
+  },
+});
+```
+
+The magic-link form has its own per-IP budget (`magicLinkMod({ rateLimit })`).
+The same bricks are open to your own routes: `rateLimit` on any
+`boundary.http.request`, and `core.flow.throttle` inside a workflow.
+
 ## Invites (0.4)
 
-An invite is a **record**, not just a token: admin → **Access → Invites**
+An invite is a **record**, not just a token: admin → **Administration → Invites**
 sends one (email, roles, and an optional **next path** — where the invitee's
 first login lands, e.g. `/admin` or `/chat`) and lists every invite sent with
 its derived status: `pending` → `accepted` (or `expired` / `revoked`). Revoke
@@ -153,7 +216,7 @@ method.
 
 ## Administering users (0.4)
 
-Access → **Users** is the control room: per row — details, a minted sign-in
+Administration → **Users** is the control room: per row — details, a minted sign-in
 link, **disable / enable** (reversible lock-out; revokes sessions), **log out
 everywhere**, and **delete** (removes the user, their identity links and
 session rows; invites and API tokens keep the id as audit trail). Roles are
@@ -167,7 +230,7 @@ it.
 
 Sessions authenticate humans in browsers; **API tokens** authenticate
 programs — MCP clients on `/mcp/pattern`, CI deploys, scripts against the
-admin API. Mint them in admin → **Access → API tokens**: the raw `pat_…`
+admin API. Mint them in admin → **Administration → API tokens**: the raw `pat_…`
 secret is shown **exactly once** (only its sha256 is stored), and a bearer
 header authenticates it on any route:
 
@@ -220,6 +283,7 @@ workflow storage.
 | --- | --- |
 | `GET /auth/login` | Login page (a section per registered method) |
 | `GET /auth/token?t=…` | Token callback → session cookie → redirect `next` |
+| `POST /auth/code` | Sign-in code callback `{ email, code, next? }` → cookie **here** (the PWA path) |
 | `POST /auth/logout` | Revoke the current session, clear the cookie |
 | `GET /auth/whoami` | The current principal (JSON) |
 | `GET /auth/welcome` | Post-login landing when no home is advertised |

package/docs/ops/identity.code.callback.md

@@ -0,0 +1,17 @@
+The sign-in **code** callback: verify a `{ email, code }` pair against the
+email's pending code-bearing login tokens, consume the matched token, mint a
+session, and redirect to `next` with the cookie set — **in the browsing
+context that posted**. An HTTP-shaped op backing `POST /auth/code`.
+
+This is the installed-PWA path. The emailed magic *link* opens in the system
+browser — a different cookie jar than a standalone-display app — so the link
+signs in the wrong context. The code, typed into the "check your inbox" page
+the user already has open, completes the login exactly where they are. The
+link and the code share one single-use token: whichever lands first burns
+both.
+
+Failure semantics are deliberate: wrong code, unknown email, expired or
+burned token all render the same sent page with the same error and status 401
+(no account enumeration); comparisons are constant-time; and five wrong
+guesses burn the token, link included. Only a **correct** code reaches the
+signup-policy / disabled checks — possessing it proves control of the inbox.

package/docs/ops/identity.token.callback.md

@@ -4,4 +4,6 @@ and redirect to `next` with the cookie set. An HTTP-shaped op backing
 `GET /auth/token`. Provider mods (magic-link, OIDC) issue tokens whose links
 land here; they never mint sessions themselves. Bootstrap tokens are refused
 here (they have their own flow), and with a closed signup an unknown email
-returns to the login page with an error.
+returns to the login page with an error. The same token may also carry a
+short sign-in code consumed by `identity.code.callback` (`POST /auth/code`) —
+one row, one use, whichever path lands first.

package/docs/ops/identity.users.setRoles.md

@@ -1,7 +1,8 @@
-Replace a user's roles (the WHOLE set, not a patch), then **revoke all their
-sessions**: a privilege change forces a re-login, so don't reach for this on a
-hot path expecting the user to stay signed in. New scopes take effect from the
-role→scopes map on their next session. Refused when it would demote the last
+Replace a user's roles (the WHOLE set, not a patch). Scopes resolve live from
+the role→scopes map on every request, so a pure **gain** (a paid plan's role,
+an editor role) takes effect on the user's next request with their sessions
+intact. A **loss** (any role or scope removed) and an elevation to `admin`
+**revoke all their sessions**, which forces a re-login. Refused when it would demote the last
 active admin — an app must always keep someone who can administer it. `roles`
 accepts an array or a comma string; privileged: gate the trigger with the
 `admin` scope. The admin UI edits this from the user's details page.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pattern-js/mod-identity",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Users, sessions, roles and pluggable login methods for Pattern — the optional identity brick. Opaque revocable cookie sessions (CAS-backed, sqlite or in-memory), a single-use token kernel (login/invite/bootstrap), a login page, and admin screens.",
   "keywords": [
     "pattern",
@@ -26,14 +26,14 @@
     "README.md"
   ],
   "dependencies": {
-    "zod": "^4.0.0",
-    "@pattern-js/runtime-node": "0.4.0",
-    "@pattern-js/core": "0.4.0"
+    "zod": "^4.6.7",
+    "@pattern-js/core": "0.5.0",
+    "@pattern-js/runtime-node": "0.5.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "typescript": "^5.6.0",
-    "@pattern-js/runtime-node": "0.4.0"
+    "@pattern-js/runtime-node": "0.5.0"
   },
   "engines": {
     "node": ">=22.5"