@portaidentity/cli 1.7.3 → 1.9.0

package/dist/admin/session-service.d.ts

@@ -0,0 +1,169 @@
+/** Server-bound session verification for the embedded Porta admin UI. */
+import type { StoredCredentials } from '../credential-store.js';
+import type { CliAuthOperationOptions, VerifiedIdentity } from '../auth/types.js';
+import type { LoginInteraction } from '../auth/login-coordinator.js';
+import type { AdminApplicationSession } from './application.js';
+import { createAdminOrganizationOperations } from './organization-service.js';
+import type { AdminOrganizationWorkspaceDomains } from './organization-service.js';
+import { createAdminUserOperations } from './user-service.js';
+import { createAdminApplicationOperations } from './application-service.js';
+import { createAdminClientOperations } from './client-service.js';
+import type { AdminRbacDomains } from './rbac-service.js';
+import { createAdminPortabilityOperations } from './portability-service.js';
+import { createAdminSystemConfigOperations } from './system-config-service.js';
+import type { AdminCapabilities, AdminConnectionState } from './state.js';
+/** Lazy SDK organization-domain input retained until verified UI work requests it. */
+type AdminOrganizationDomainFactory = Parameters<typeof createAdminOrganizationOperations>[0];
+/** Lazy SDK user-domain input retained until verified UI work requests it. */
+type AdminUserDomainFactory = Parameters<typeof createAdminUserOperations>[0];
+/** Lazy SDK application-domain input retained until verified UI work requests it. */
+type AdminApplicationDomainFactory = Parameters<typeof createAdminApplicationOperations>[0];
+/** Lazy SDK client-domain input retained until verified UI work requests it. */
+type AdminClientDomainFactory = Parameters<typeof createAdminClientOperations>[0];
+/** Lazy SDK RBAC domains retained until verified UI work requests them. */
+type AdminRbacDomainFactory = () => AdminRbacDomains;
+/** Lazy SDK export-domain input retained until verified UI work requests it. */
+type AdminExportsDomainFactory = Parameters<typeof createAdminPortabilityOperations>[0];
+/** Lazy SDK import-domain input retained until verified UI work requests it. */
+type AdminImportsDomainFactory = Parameters<typeof createAdminPortabilityOperations>[1];
+/** Lazy SDK configuration domain retained until verified UI work requests it. */
+type AdminConfigDomainFactory = Parameters<typeof createAdminSystemConfigOperations>[0];
+/** Actions offered after authentication is unavailable. */
+declare const UNAUTHENTICATED_ACTIONS: readonly ['authenticate', 'retry', 'quit'];
+/** Inputs for a direct UserInfo verification request. */
+export interface VerifiedUserInfoRequest {
+    /** User-selected Porta server origin. */
+    readonly selectedServer: URL;
+    /** Validated organization slug used to construct the UserInfo path. */
+    readonly orgSlug: string;
+    /** Bearer token issued for the selected server. */
+    readonly accessToken: string;
+    /** Immutable subject established by validated login. */
+    readonly originalSubject: string;
+    /** Optional injected fetch boundary. */
+    readonly fetch?: typeof globalThis.fetch;
+}
+/** Inputs for verifying a stored CLI session. */
+export interface StoredSessionRequest {
+    /** User-selected Porta server origin. */
+    readonly selectedServer: URL;
+    /** Untrusted credential snapshot loaded from local storage. */
+    readonly credentials: StoredCredentials;
+    /** Optional SDK bearer-client construction boundary. */
+    readonly createBearerClient?: (accessToken: string) => unknown;
+    /** Optional token provider used when the stored token is expired. */
+    readonly getAccessToken?: () => Promise<string>;
+    /** Optional injected fetch boundary. */
+    readonly fetch?: typeof globalThis.fetch;
+}
+/** Authenticated live session state. */
+export interface AuthenticatedSession {
+    /** Authenticated discriminator. */
+    readonly status: 'authenticated';
+    /** Subject-matched, allowlisted live identity. */
+    readonly identity: VerifiedIdentity;
+    /** Organization actions derived from the same live UserInfo response. */
+    readonly capabilities: AdminCapabilities;
+}
+/** Allowlisted identity and organization capabilities from one live UserInfo response. */
+export interface VerifiedAdminProfile {
+    /** Subject-matched identity fields safe for display and credential persistence. */
+    readonly identity: VerifiedIdentity;
+    /** Ephemeral organization actions used only by the running application. */
+    readonly capabilities: AdminCapabilities;
+}
+/** Observable result of stored-session verification. */
+export type SessionVerificationResult = AuthenticatedSession | {
+    readonly status: 'unauthenticated';
+    readonly actions?: typeof UNAUTHENTICATED_ACTIONS;
+} | {
+    readonly status: 'unavailable';
+} | {
+    readonly status: 'configuration-failure';
+};
+/** Initial state and operations supplied to one administration application. */
+export interface PreparedAdminSession {
+    /** State rendered while the first live verification begins. */
+    readonly initialState: AdminConnectionState;
+    /** Shared verification and login operations. */
+    readonly session: AdminApplicationSession;
+}
+/**
+ * Creates live verification, authentication, and authorized Admin API operations.
+ *
+ * @param serverInput - Normalized or normalizable Porta server origin.
+ * @param interaction - Browser-login interaction boundary.
+ * @param organizationDomain - Optional organization switcher operations.
+ * @param userDomain - Optional selected-organization user operations.
+ * @param applicationDomain - Optional deployment-global application operations.
+ * @param clientDomain - Optional selected-organization OIDC client operations.
+ * @param rbacDomain - Optional application and user role/permission operations.
+ * @param organizationWorkspaceDomains - Optional organization settings, branding, and 2FA domains.
+ * @param exportsDomain - Optional portability manifest export operations.
+ * @param importsDomain - Optional portability preview and apply operations.
+ * @param configDomain - Optional deployment-global configuration operations.
+ * @returns Initial verification state and lazy server-bound operations.
+ */
+export declare function prepareAdminSession(serverInput: URL, interaction: LoginInteraction, organizationDomain?: AdminOrganizationDomainFactory, userDomain?: AdminUserDomainFactory, applicationDomain?: AdminApplicationDomainFactory, clientDomain?: AdminClientDomainFactory, rbacDomain?: AdminRbacDomainFactory, organizationWorkspaceDomains?: AdminOrganizationWorkspaceDomains, exportsDomain?: AdminExportsDomainFactory, importsDomain?: AdminImportsDomainFactory, configDomain?: AdminConfigDomainFactory): PreparedAdminSession;
+/**
+ * Derives organization actions from untrusted live authorization claims.
+ *
+ * Roles and permissions are validated independently. A malformed claim cannot cancel a valid
+ * capability from the other claim, and no raw claim value is retained.
+ *
+ * @param roles - Untrusted UserInfo role claim.
+ * @param permissions - Untrusted UserInfo permission claim.
+ * @returns Fixed organization and user capability booleans.
+ * @example
+ * ```ts
+ * const capabilities = validateAdminCapabilities([], ['admin:org:read']);
+ * ```
+ */
+export declare function validateAdminCapabilities(roles: unknown, permissions: unknown): AdminCapabilities;
+/**
+ * Fetches and validates live UserInfo with caller-owned cancellation.
+ *
+ * @param request - Server-bound UserInfo request details.
+ * @param options - Caller-owned cancellation signal.
+ * @returns The subject-matched identity and ephemeral organization capabilities.
+ * @throws A fixed authentication error when the response is unavailable or invalid.
+ * @example
+ * ```ts
+ * const profile = await fetchVerifiedUserInfo(request, { signal });
+ * ```
+ */
+export declare function fetchVerifiedUserInfo(request: VerifiedUserInfoRequest, options: CliAuthOperationOptions): Promise<VerifiedAdminProfile>;
+/** Verifies exact server binding and a live subject-matched UserInfo response. */
+export declare function verifyStoredSession(request: StoredSessionRequest, options: CliAuthOperationOptions): Promise<SessionVerificationResult>;
+/** Inputs for an explicit cross-origin credential replacement decision. */
+export interface CredentialReplacementRequest {
+    /** Current serialized profile and normalized server. */
+    readonly current: {
+        readonly server: URL;
+        readonly serialized: string;
+    };
+    /** Fully validated replacement candidate. */
+    readonly replacement: {
+        readonly server: URL;
+        readonly serialized: string;
+        readonly validated?: boolean;
+    };
+    /** UI confirmation boundary. */
+    readonly confirm: (currentServer: URL, nextServer: URL) => Promise<boolean>;
+    /** Atomic persistence boundary. */
+    readonly persist: (serialized: string) => Promise<void> | void;
+}
+/** Preserves the current bytes unless a validated replacement is approved. */
+export declare function confirmCredentialReplacement(request: CredentialReplacementRequest): Promise<{
+    readonly status: 'cancelled';
+    readonly preserved: string;
+} | {
+    readonly status: 'replaced';
+}>;
+/** Classifies an administration response without discarding live identity. */
+export declare function classifyAdminResponse(session: AuthenticatedSession, response: Response): AuthenticatedSession | {
+    readonly status: 'unauthorized';
+    readonly identity: VerifiedIdentity;
+};
+export {};
+//# sourceMappingURL=session-service.d.ts.map

package/dist/admin/session-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-service.d.ts","sourceRoot":"","sources":["../../src/admin/session-service.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAQhE,OAAO,KAAK,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAElF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EACL,iCAAiC,EAElC,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAE1E,sFAAsF;AACtF,KAAK,8BAA8B,GAAG,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F,8EAA8E;AAC9E,KAAK,sBAAsB,GAAG,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9E,qFAAqF;AACrF,KAAK,6BAA6B,GAAG,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5F,gFAAgF;AAChF,KAAK,wBAAwB,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;AAElF,2EAA2E;AAC3E,KAAK,sBAAsB,GAAG,MAAM,gBAAgB,CAAC;AAErD,gFAAgF;AAChF,KAAK,yBAAyB,GAAG,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC,CAAC,CAAC,CAAC;AAExF,gFAAgF;AAChF,KAAK,yBAAyB,GAAG,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC,CAAC,CAAC,CAAC;AAExF,iFAAiF;AACjF,KAAK,wBAAwB,GAAG,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAAC,CAAC,CAAC,CAAC;AAExF,2DAA2D;AAC3D,QAAA,MAAM,uBAAuB,YAAI,cAAc,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAqB3E,yDAAyD;AACzD,MAAM,WAAW,uBAAuB;IACtC,yCAAyC;IACzC,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wCAAwC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC1C;AAED,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,yCAAyC;IACzC,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,wDAAwD;IACxD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/D,qEAAqE;IACrE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,wCAAwC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC1C;AAED,wCAAwC;AACxC,MAAM,WAAW,oBAAoB;IACnC,mCAAmC;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;CAC1C;AAED,0FAA0F;AAC1F,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;CAC1C;AAED,wDAAwD;AACxD,MAAM,MAAM,yBAAyB,GACjC,oBAAoB,GACpB;IAAE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,uBAAuB,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAAC;AAEjD,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;CAC3C;AAmBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,GAAG,EAChB,WAAW,EAAE,gBAAgB,EAC7B,kBAAkB,CAAC,EAAE,8BAA8B,EACnD,UAAU,CAAC,EAAE,sBAAsB,EACnC,iBAAiB,CAAC,EAAE,6BAA6B,EACjD,YAAY,CAAC,EAAE,wBAAwB,EACvC,UAAU,CAAC,EAAE,sBAAsB,EACnC,4BAA4B,CAAC,EAAE,iCAAiC,EAChE,aAAa,CAAC,EAAE,yBAAyB,EACzC,aAAa,CAAC,EAAE,yBAAyB,EACzC,YAAY,CAAC,EAAE,wBAAwB,GACtC,oBAAoB,CAsGtB;AAmBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,GAAG,iBAAiB,CAqDjG;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAsB/B;AAED,kFAAkF;AAClF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,yBAAyB,CAAC,CAgDpC;AAED,2EAA2E;AAC3E,MAAM,WAAW,4BAA4B;IAC3C,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;QACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;KAC9B,CAAC;IACF,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,mCAAmC;IACnC,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAChE;AAED,8EAA8E;AAC9E,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,4BAA4B,GACpC,OAAO,CACR;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAC/F,CASA;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,QAAQ,GACjB,oBAAoB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAEjG"}

package/dist/admin/session-service.js

@@ -0,0 +1,353 @@
+/** Server-bound session verification for the embedded Porta admin UI. */
+import { createCliCredentialPersistence, getCredentialsPath, loadCredentials, saveCredentialsDurably, } from '../credential-store.js';
+import { createCliAuth } from '@portaidentity/sdk/node';
+import { authenticateCliSession } from '../auth/login-coordinator.js';
+import { normalizeServerOrigin } from '../global-options.js';
+import { createAdminOrganizationOperations, createAdminOrganizationWorkspaceOperations, } from './organization-service.js';
+import { createAdminUserOperations } from './user-service.js';
+import { createAdminApplicationOperations } from './application-service.js';
+import { createAdminClientOperations } from './client-service.js';
+import { createAdminRbacOperations } from './rbac-service.js';
+import { createAdminPortabilityOperations } from './portability-service.js';
+import { createAdminSystemConfigOperations } from './system-config-service.js';
+/** Actions offered after authentication is unavailable. */
+const UNAUTHENTICATED_ACTIONS = ['authenticate', 'retry', 'quit'];
+/** Detects ASCII and C1 controls that can alter terminal presentation. */
+function containsTerminalControl(value) {
+    for (const character of value) {
+        const codePoint = character.codePointAt(0) ?? 0;
+        if (codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f))
+            return true;
+    }
+    return false;
+}
+/** Returns a bounded display claim that cannot inject terminal controls. */
+function safeDisplayClaim(value) {
+    return typeof value === 'string' &&
+        value.length > 0 &&
+        value.length <= 256 &&
+        !containsTerminalControl(value)
+        ? value
+        : undefined;
+}
+/** Maps a live verification result to the application state model. */
+function toApplicationState(server, result) {
+    if (result.status === 'authenticated') {
+        return {
+            kind: 'authenticated',
+            server,
+            identity: result.identity,
+            capabilities: result.capabilities,
+        };
+    }
+    return {
+        kind: 'unauthenticated',
+        server,
+        reason: result.status === 'unauthenticated' ? 'unauthenticated' : result.status,
+    };
+}
+/**
+ * Creates live verification, authentication, and authorized Admin API operations.
+ *
+ * @param serverInput - Normalized or normalizable Porta server origin.
+ * @param interaction - Browser-login interaction boundary.
+ * @param organizationDomain - Optional organization switcher operations.
+ * @param userDomain - Optional selected-organization user operations.
+ * @param applicationDomain - Optional deployment-global application operations.
+ * @param clientDomain - Optional selected-organization OIDC client operations.
+ * @param rbacDomain - Optional application and user role/permission operations.
+ * @param organizationWorkspaceDomains - Optional organization settings, branding, and 2FA domains.
+ * @param exportsDomain - Optional portability manifest export operations.
+ * @param importsDomain - Optional portability preview and apply operations.
+ * @param configDomain - Optional deployment-global configuration operations.
+ * @returns Initial verification state and lazy server-bound operations.
+ */
+export function prepareAdminSession(serverInput, interaction, organizationDomain, userDomain, applicationDomain, clientDomain, rbacDomain, organizationWorkspaceDomains, exportsDomain, importsDomain, configDomain) {
+    const server = normalizeServerOrigin(serverInput);
+    /** Verifies the latest credential snapshot against live UserInfo. */
+    const verify = async (signal) => {
+        const credentials = loadCredentials();
+        if (!credentials)
+            return { kind: 'unauthenticated', server };
+        const auth = createCliAuth({
+            credentialsPath: getCredentialsPath(),
+            credentialPersistence: createCliCredentialPersistence({
+                credentialsPath: getCredentialsPath(),
+                lockTimeoutMs: 5_000,
+                signal,
+            }),
+            signal,
+        });
+        const state = toApplicationState(server, await verifyStoredSession({
+            selectedServer: server,
+            credentials,
+            getAccessToken: () => auth.getToken(),
+        }, { signal }));
+        return state;
+    };
+    /** Runs the shared login coordinator and retains cancellation as a distinct result. */
+    const login = async (signal) => {
+        const current = loadCredentials();
+        return authenticateCliSession({
+            server,
+            currentServer: current ? normalizeServerOrigin(current.server) : undefined,
+            persistCredentials: (credentials) => saveCredentialsDurably(credentials, signal),
+        }, interaction, { signal });
+    };
+    /** Authenticates when no prior verified identity needs to be preserved. */
+    const authenticate = async (signal) => {
+        const result = await login(signal);
+        if (result.status !== 'authenticated')
+            return { kind: 'unauthenticated', server };
+        const state = {
+            kind: 'authenticated',
+            server,
+            identity: result.identity,
+            capabilities: result.capabilities,
+        };
+        return state;
+    };
+    /** Reauthenticates without discarding the live identity when the user declines or cancels. */
+    const reauthenticate = async (signal) => {
+        const result = await login(signal);
+        return result.status === 'authenticated'
+            ? {
+                kind: 'authenticated',
+                server,
+                identity: result.identity,
+                capabilities: result.capabilities,
+            }
+            : undefined;
+    };
+    const hasCredentials = loadCredentials() !== null;
+    return {
+        initialState: hasCredentials
+            ? { kind: 'verifying', server, canCancel: true }
+            : { kind: 'unauthenticated', server },
+        session: {
+            verify,
+            authenticate,
+            retry: verify,
+            reauthenticate,
+            ...(organizationDomain
+                ? { organizations: createAdminOrganizationOperations(organizationDomain) }
+                : {}),
+            ...(userDomain ? { users: createAdminUserOperations(userDomain) } : {}),
+            ...(applicationDomain
+                ? { applications: createAdminApplicationOperations(applicationDomain) }
+                : {}),
+            ...(clientDomain ? { clients: createAdminClientOperations(clientDomain) } : {}),
+            ...(rbacDomain ? { rbac: createAdminRbacOperations(rbacDomain) } : {}),
+            ...(organizationWorkspaceDomains
+                ? {
+                    organizationWorkspace: createAdminOrganizationWorkspaceOperations(organizationWorkspaceDomains),
+                }
+                : {}),
+            ...(exportsDomain && importsDomain
+                ? { portability: createAdminPortabilityOperations(exportsDomain, importsDomain) }
+                : {}),
+            ...(configDomain ? { systemConfig: createAdminSystemConfigOperations(configDomain) } : {}),
+        },
+    };
+}
+/** Returns true when every authorization entry is a bounded, control-free slug. */
+function isValidAuthorizationArray(value, maximumLength) {
+    return (Array.isArray(value) &&
+        value.every((entry) => typeof entry === 'string' &&
+            entry.length > 0 &&
+            entry.length <= maximumLength &&
+            !containsTerminalControl(entry)));
+}
+/**
+ * Derives organization actions from untrusted live authorization claims.
+ *
+ * Roles and permissions are validated independently. A malformed claim cannot cancel a valid
+ * capability from the other claim, and no raw claim value is retained.
+ *
+ * @param roles - Untrusted UserInfo role claim.
+ * @param permissions - Untrusted UserInfo permission claim.
+ * @returns Fixed organization and user capability booleans.
+ * @example
+ * ```ts
+ * const capabilities = validateAdminCapabilities([], ['admin:org:read']);
+ * ```
+ */
+export function validateAdminCapabilities(roles, permissions) {
+    const validRoles = isValidAuthorizationArray(roles, 100) ? roles : [];
+    const validPermissions = isValidAuthorizationArray(permissions, 150) ? permissions : [];
+    const isLegacyAdministrator = validRoles.includes('porta-admin');
+    return {
+        canReadConfig: isLegacyAdministrator || validPermissions.includes('admin:config:read'),
+        canUpdateConfig: isLegacyAdministrator || validPermissions.includes('admin:config:update'),
+        canExportData: validPermissions.includes('admin:export:read'),
+        canImportData: validPermissions.includes('admin:import:write'),
+        canReadClaims: isLegacyAdministrator || validPermissions.includes('admin:claim:read'),
+        canCreateClaims: isLegacyAdministrator || validPermissions.includes('admin:claim:create'),
+        canUpdateClaims: isLegacyAdministrator || validPermissions.includes('admin:claim:update'),
+        isSuperAdmin: validRoles.includes('porta-super-admin'),
+        canReadOrganizations: isLegacyAdministrator || validPermissions.includes('admin:org:read'),
+        canCreateOrganizations: isLegacyAdministrator || validPermissions.includes('admin:org:create'),
+        canUpdateOrganizations: isLegacyAdministrator || validPermissions.includes('admin:org:update'),
+        canSuspendOrganizations: isLegacyAdministrator || validPermissions.includes('admin:org:suspend'),
+        canReadUsers: isLegacyAdministrator || validPermissions.includes('admin:user:read'),
+        canCreateUsers: isLegacyAdministrator || validPermissions.includes('admin:user:create'),
+        canInviteUsers: isLegacyAdministrator || validPermissions.includes('admin:user:invite'),
+        canUpdateUsers: isLegacyAdministrator || validPermissions.includes('admin:user:update'),
+        canManageUserLifecycle: isLegacyAdministrator || validPermissions.includes('admin:user:lifecycle'),
+        canDeleteOrganizations: isLegacyAdministrator || validPermissions.includes('admin:org:delete'),
+        canDeleteUsers: isLegacyAdministrator || validPermissions.includes('admin:user:delete'),
+        canReadApplications: isLegacyAdministrator || validPermissions.includes('admin:app:read'),
+        canCreateApplications: isLegacyAdministrator || validPermissions.includes('admin:app:create'),
+        canUpdateApplications: isLegacyAdministrator || validPermissions.includes('admin:app:update'),
+        canDeleteApplications: isLegacyAdministrator || validPermissions.includes('admin:app:delete'),
+        canDeleteModules: isLegacyAdministrator || validPermissions.includes('admin:module:delete'),
+        canReadRoles: isLegacyAdministrator || validPermissions.includes('admin:role:read'),
+        canCreateRoles: isLegacyAdministrator || validPermissions.includes('admin:role:create'),
+        canUpdateRoles: isLegacyAdministrator || validPermissions.includes('admin:role:update'),
+        canDeleteRoles: isLegacyAdministrator || validPermissions.includes('admin:role:delete'),
+        canReadPermissions: isLegacyAdministrator || validPermissions.includes('admin:permission:read'),
+        canCreatePermissions: isLegacyAdministrator || validPermissions.includes('admin:permission:create'),
+        canUpdatePermissions: isLegacyAdministrator || validPermissions.includes('admin:permission:update'),
+        canDeletePermissions: isLegacyAdministrator || validPermissions.includes('admin:permission:delete'),
+        canAssignRoles: isLegacyAdministrator || validPermissions.includes('admin:role:assign'),
+        canReadClients: isLegacyAdministrator || validPermissions.includes('admin:client:read'),
+        canCreateClients: isLegacyAdministrator ||
+            (validPermissions.includes('admin:client:create') &&
+                validPermissions.includes('admin:app:read')),
+        canUpdateClients: isLegacyAdministrator || validPermissions.includes('admin:client:update'),
+        canDeleteClients: isLegacyAdministrator || validPermissions.includes('admin:client:delete'),
+        canRevokeClientSecrets: isLegacyAdministrator || validPermissions.includes('admin:client:revoke'),
+    };
+}
+/**
+ * Returns a safe profile from a subject-matched UserInfo response.
+ *
+ * @param value - Untrusted decoded UserInfo response.
+ * @param originalSubject - Subject established by the verified login.
+ * @returns Allowlisted identity fields and fixed capability booleans.
+ * @throws A fixed authentication error when the subject is missing or does not match.
+ */
+function validateUserInfo(value, originalSubject) {
+    if (!value || typeof value !== 'object')
+        throw new Error('Authentication failed');
+    const candidate = value;
+    const subject = safeDisplayClaim(candidate.sub);
+    if (subject !== originalSubject) {
+        throw new Error('Authentication failed');
+    }
+    return {
+        identity: {
+            sub: subject,
+            email: safeDisplayClaim(candidate.email),
+            name: safeDisplayClaim(candidate.name),
+        },
+        capabilities: validateAdminCapabilities(candidate.roles, candidate.permissions),
+    };
+}
+/**
+ * Fetches and validates live UserInfo with caller-owned cancellation.
+ *
+ * @param request - Server-bound UserInfo request details.
+ * @param options - Caller-owned cancellation signal.
+ * @returns The subject-matched identity and ephemeral organization capabilities.
+ * @throws A fixed authentication error when the response is unavailable or invalid.
+ * @example
+ * ```ts
+ * const profile = await fetchVerifiedUserInfo(request, { signal });
+ * ```
+ */
+export async function fetchVerifiedUserInfo(request, options) {
+    const selected = normalizeServerOrigin(request.selectedServer);
+    if (!/^[a-z0-9][a-z0-9-]{1,98}[a-z0-9]$/.test(request.orgSlug)) {
+        throw new Error('Authentication failed');
+    }
+    const fetcher = request.fetch ?? globalThis.fetch;
+    let response;
+    try {
+        response = await fetcher(`${selected.origin}/${encodeURIComponent(request.orgSlug)}/me`, {
+            headers: { Authorization: `Bearer ${request.accessToken}` },
+            signal: options.signal,
+        });
+    }
+    catch (error) {
+        if (error instanceof DOMException && error.name === 'AbortError')
+            throw error;
+        throw new Error('Authentication failed', { cause: error });
+    }
+    if (!response.ok)
+        throw new Error('Authentication failed');
+    try {
+        return validateUserInfo(await response.json(), request.originalSubject);
+    }
+    catch {
+        throw new Error('Authentication failed');
+    }
+}
+/** Verifies exact server binding and a live subject-matched UserInfo response. */
+export async function verifyStoredSession(request, options) {
+    let selected;
+    let credentialServer;
+    try {
+        selected = normalizeServerOrigin(request.selectedServer);
+        credentialServer = normalizeServerOrigin(request.credentials.server);
+        if (!request.credentials.orgSlug ||
+            !request.credentials.accessToken ||
+            !request.credentials.userInfo?.sub) {
+            return { status: 'configuration-failure' };
+        }
+    }
+    catch {
+        return { status: 'configuration-failure' };
+    }
+    if (selected.origin !== credentialServer.origin)
+        return { status: 'unauthenticated' };
+    let accessToken = request.credentials.accessToken;
+    if (Date.parse(request.credentials.expiresAt) <= Date.now() && request.getAccessToken) {
+        try {
+            accessToken = await request.getAccessToken();
+        }
+        catch {
+            return { status: 'unauthenticated', actions: UNAUTHENTICATED_ACTIONS };
+        }
+    }
+    request.createBearerClient?.(accessToken);
+    const fetcher = request.fetch ?? globalThis.fetch;
+    let response;
+    try {
+        response = await fetcher(`${selected.origin}/${encodeURIComponent(request.credentials.orgSlug)}/me`, { headers: { Authorization: `Bearer ${accessToken}` }, signal: options.signal });
+    }
+    catch (error) {
+        if (error instanceof DOMException && error.name === 'AbortError')
+            throw error;
+        return { status: 'unavailable' };
+    }
+    if (response.status === 401) {
+        return { status: 'unauthenticated', actions: UNAUTHENTICATED_ACTIONS };
+    }
+    if (!response.ok)
+        return { status: 'unavailable' };
+    try {
+        const profile = validateUserInfo(await response.json(), request.credentials.userInfo.sub);
+        return { status: 'authenticated', ...profile };
+    }
+    catch {
+        return { status: 'unauthenticated' };
+    }
+}
+/** Preserves the current bytes unless a validated replacement is approved. */
+export async function confirmCredentialReplacement(request) {
+    const current = normalizeServerOrigin(request.current.server);
+    const replacement = normalizeServerOrigin(request.replacement.server);
+    if (!(await request.confirm(current, replacement))) {
+        return { status: 'cancelled', preserved: request.current.serialized };
+    }
+    if (request.replacement.validated !== true)
+        throw new Error('Authentication failed');
+    await request.persist(request.replacement.serialized);
+    return { status: 'replaced' };
+}
+/** Classifies an administration response without discarding live identity. */
+export function classifyAdminResponse(session, response) {
+    return response.status === 403 ? { status: 'unauthorized', identity: session.identity } : session;
+}
+//# sourceMappingURL=session-service.js.map

package/dist/admin/session-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-service.js","sourceRoot":"","sources":["../../src/admin/session-service.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAGzE,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EACL,iCAAiC,EACjC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AA2B/E,2DAA2D;AAC3D,MAAM,uBAAuB,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAE3E,0EAA0E;AAC1E,SAAS,uBAAuB,CAAC,KAAa;IAC5C,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,CAAC,uBAAuB,CAAC,KAAK,CAAC;QAC/B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AA+DD,sEAAsE;AACtE,SAAS,kBAAkB,CAAC,MAAW,EAAE,MAAiC;IACxE,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,MAAM;YACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;KAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAgB,EAChB,WAA6B,EAC7B,kBAAmD,EACnD,UAAmC,EACnC,iBAAiD,EACjD,YAAuC,EACvC,UAAmC,EACnC,4BAAgE,EAChE,aAAyC,EACzC,aAAyC,EACzC,YAAuC;IAEvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAElD,qEAAqE;IACrE,MAAM,MAAM,GAAG,KAAK,EAAE,MAAmB,EAAiC,EAAE;QAC1E,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,aAAa,CAAC;YACzB,eAAe,EAAE,kBAAkB,EAAE;YACrC,qBAAqB,EAAE,8BAA8B,CAAC;gBACpD,eAAe,EAAE,kBAAkB,EAAE;gBACrC,aAAa,EAAE,KAAK;gBACpB,MAAM;aACP,CAAC;YACF,MAAM;SACP,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,kBAAkB,CAC9B,MAAM,EACN,MAAM,mBAAmB,CACvB;YACE,cAAc,EAAE,MAAM;YACtB,WAAW;YACX,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE;SACtC,EACD,EAAE,MAAM,EAAE,CACX,CACF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,uFAAuF;IACvF,MAAM,KAAK,GAAG,KAAK,EAAE,MAAmB,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAClC,OAAO,sBAAsB,CAC3B;YACE,MAAM;YACN,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1E,kBAAkB,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC;SACjF,EACD,WAAW,EACX,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC,CAAC;IAEF,2EAA2E;IAC3E,MAAM,YAAY,GAAG,KAAK,EAAE,MAAmB,EAAiC,EAAE;QAChF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe;YAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG;YACZ,IAAI,EAAE,eAAe;YACrB,MAAM;YACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;SACzB,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,8FAA8F;IAC9F,MAAM,cAAc,GAAG,KAAK,EAAE,MAAmB,EAA6C,EAAE;QAC9F,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,KAAK,eAAe;YACtC,CAAC,CAAC;gBACE,IAAI,EAAE,eAAe;gBACrB,MAAM;gBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC;YACH,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,eAAe,EAAE,KAAK,IAAI,CAAC;IAClD,OAAO;QACL,YAAY,EAAE,cAAc;YAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;YAChD,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE;QACvC,OAAO,EAAE;YACP,MAAM;YACN,YAAY;YACZ,KAAK,EAAE,MAAM;YACb,cAAc;YACd,GAAG,CAAC,kBAAkB;gBACpB,CAAC,CAAC,EAAE,aAAa,EAAE,iCAAiC,CAAC,kBAAkB,CAAC,EAAE;gBAC1E,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,iBAAiB;gBACnB,CAAC,CAAC,EAAE,YAAY,EAAE,gCAAgC,CAAC,iBAAiB,CAAC,EAAE;gBACvE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,2BAA2B,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,4BAA4B;gBAC9B,CAAC,CAAC;oBACE,qBAAqB,EAAE,0CAA0C,CAC/D,4BAA4B,CAC7B;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,aAAa,IAAI,aAAa;gBAChC,CAAC,CAAC,EAAE,WAAW,EAAE,gCAAgC,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE;gBACjF,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,iCAAiC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,yBAAyB,CAChC,KAAc,EACd,aAAqB;IAErB,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,KAAK,CACT,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,KAAK,CAAC,MAAM,IAAI,aAAa;YAC7B,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAClC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc,EAAE,WAAoB;IAC5E,MAAM,UAAU,GAAG,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,qBAAqB,GAAG,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACjE,OAAO;QACL,aAAa,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACtF,eAAe,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC1F,aAAa,EAAE,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAC7D,aAAa,EAAE,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAC9D,aAAa,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACrF,eAAe,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACzF,eAAe,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACzF,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACtD,oBAAoB,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1F,sBAAsB,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC9F,sBAAsB,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC9F,uBAAuB,EACrB,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACzE,YAAY,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACnF,cAAc,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACvF,cAAc,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACvF,cAAc,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACvF,sBAAsB,EACpB,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAC5E,sBAAsB,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC9F,cAAc,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACvF,mBAAmB,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACzF,qBAAqB,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC7F,qBAAqB,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC7F,qBAAqB,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC7F,gBAAgB,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC3F,YAAY,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACnF,cAAc,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACvF,cAAc,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACvF,cAAc,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACvF,kBAAkB,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QAC/F,oBAAoB,EAClB,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAC/E,oBAAoB,EAClB,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAC/E,oBAAoB,EAClB,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAC/E,cAAc,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACvF,cAAc,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACvF,gBAAgB,EACd,qBAAqB;YACrB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBAC/C,gBAAgB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAChD,gBAAgB,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC3F,gBAAgB,EAAE,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC3F,sBAAsB,EACpB,qBAAqB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,qBAAqB,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,KAAc,EAAE,eAAuB;IAC/D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO;QACL,QAAQ,EAAE;YACR,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC;YACxC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC;SACvC;QACD,YAAY,EAAE,yBAAyB,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC;KAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgC,EAChC,OAAgC;IAEhC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;YACvF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YAC3D,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,KAAK,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA6B,EAC7B,OAAgC;IAEhC,IAAI,QAAa,CAAC;IAClB,IAAI,gBAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzD,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACrE,IACE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO;YAC5B,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW;YAChC,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAClC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAEtF,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;IAClD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QACtF,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,kBAAkB,EAAE,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CACtB,GAAG,QAAQ,CAAC,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAC1E,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAChF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,KAAK,CAAC;QAC9E,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1F,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAkBD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAqC;IAIrC,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,CAAC,SAAS,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrF,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACtD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CACnC,OAA6B,EAC7B,QAAkB;IAElB,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACpG,CAAC"}