@portaidentity/server 1.7.0

package/dist/lib/admin-permissions.js

@@ -0,0 +1,261 @@
+/**
+ * Admin permission constants and role definitions for granular admin access control.
+ *
+ * Replaces the single porta-admin role with a permission-based model where
+ * each admin endpoint requires specific permissions. Five predefined admin
+ * roles group permissions by responsibility area.
+ *
+ * @module admin-permissions
+ * @see 03-granular-admin-roles.md
+ */
+// ============================================================================
+// Permission Constants
+// ============================================================================
+/**
+ * Admin permission slugs following the `module:resource:action` pattern.
+ * Used by admin-auth middleware's `requirePermission()` factory
+ * and route handlers for endpoint-level authorization.
+ *
+ * The `admin` module prefix satisfies the RBAC permission slug validation
+ * requirement of at least 3 colon-separated segments.
+ *
+ * Permissions are seeded into the admin application during `porta init`
+ * and resolved at runtime from the user's assigned admin roles.
+ */
+export const ADMIN_PERMISSIONS = {
+    // Organization management
+    ORG_CREATE: 'admin:org:create',
+    ORG_READ: 'admin:org:read',
+    ORG_UPDATE: 'admin:org:update',
+    ORG_SUSPEND: 'admin:org:suspend',
+    ORG_ARCHIVE: 'admin:org:archive',
+    // Application management
+    APP_CREATE: 'admin:app:create',
+    APP_READ: 'admin:app:read',
+    APP_UPDATE: 'admin:app:update',
+    APP_ARCHIVE: 'admin:app:archive',
+    // Client management
+    CLIENT_CREATE: 'admin:client:create',
+    CLIENT_READ: 'admin:client:read',
+    CLIENT_UPDATE: 'admin:client:update',
+    CLIENT_REVOKE: 'admin:client:revoke',
+    // User management
+    USER_CREATE: 'admin:user:create',
+    USER_READ: 'admin:user:read',
+    USER_UPDATE: 'admin:user:update',
+    USER_SUSPEND: 'admin:user:suspend',
+    USER_ARCHIVE: 'admin:user:archive',
+    USER_INVITE: 'admin:user:invite',
+    USER_2FA: 'admin:user:2fa',
+    // Role management
+    ROLE_CREATE: 'admin:role:create',
+    ROLE_READ: 'admin:role:read',
+    ROLE_UPDATE: 'admin:role:update',
+    ROLE_ARCHIVE: 'admin:role:archive',
+    ROLE_ASSIGN: 'admin:role:assign',
+    // Permission management
+    PERMISSION_CREATE: 'admin:permission:create',
+    PERMISSION_READ: 'admin:permission:read',
+    PERMISSION_ARCHIVE: 'admin:permission:archive',
+    // Custom claims management
+    CLAIM_CREATE: 'admin:claim:create',
+    CLAIM_READ: 'admin:claim:read',
+    CLAIM_UPDATE: 'admin:claim:update',
+    CLAIM_ARCHIVE: 'admin:claim:archive',
+    // System configuration
+    CONFIG_READ: 'admin:config:read',
+    CONFIG_UPDATE: 'admin:config:update',
+    // Signing keys
+    KEY_READ: 'admin:key:read',
+    KEY_GENERATE: 'admin:key:generate',
+    KEY_ROTATE: 'admin:key:rotate',
+    // Audit
+    AUDIT_READ: 'admin:audit:read',
+    // Session management
+    SESSION_READ: 'admin:session:read',
+    SESSION_REVOKE: 'admin:session:revoke',
+    // Dashboard statistics
+    STATS_READ: 'admin:stats:read',
+    // Import/export
+    EXPORT_READ: 'admin:export:read',
+    IMPORT_WRITE: 'admin:import:write',
+};
+/** Array of all admin permission slug values (useful for iteration/validation) */
+export const ALL_ADMIN_PERMISSIONS = Object.values(ADMIN_PERMISSIONS);
+/**
+ * Predefined admin role definitions with their permission sets.
+ *
+ * These roles are seeded during `porta init` into the admin application's
+ * RBAC system. Each role groups permissions by administrative responsibility:
+ *
+ * - **Super Admin** — Full access to all admin operations (all permissions)
+ * - **Org Admin** — Organization lifecycle management and statistics
+ * - **User Admin** — User management, invitations, role assignment, sessions
+ * - **App Admin** — Application/client/RBAC/claims management
+ * - **Auditor** — Read-only access across all resources plus audit log
+ */
+export const ADMIN_ROLE_DEFINITIONS = {
+    SUPER_ADMIN: {
+        slug: 'porta-super-admin',
+        name: 'Super Admin',
+        description: 'Full system access, cannot be deleted',
+        permissions: ALL_ADMIN_PERMISSIONS,
+    },
+    ORG_ADMIN: {
+        slug: 'porta-org-admin',
+        name: 'Organization Admin',
+        description: 'Manage organizations, branding, settings',
+        permissions: [
+            ADMIN_PERMISSIONS.ORG_CREATE,
+            ADMIN_PERMISSIONS.ORG_READ,
+            ADMIN_PERMISSIONS.ORG_UPDATE,
+            ADMIN_PERMISSIONS.ORG_SUSPEND,
+            ADMIN_PERMISSIONS.ORG_ARCHIVE,
+            ADMIN_PERMISSIONS.STATS_READ,
+        ],
+    },
+    USER_ADMIN: {
+        slug: 'porta-user-admin',
+        name: 'User Admin',
+        description: 'Manage users, send invitations, manage roles',
+        permissions: [
+            ADMIN_PERMISSIONS.USER_CREATE,
+            ADMIN_PERMISSIONS.USER_READ,
+            ADMIN_PERMISSIONS.USER_UPDATE,
+            ADMIN_PERMISSIONS.USER_SUSPEND,
+            ADMIN_PERMISSIONS.USER_ARCHIVE,
+            ADMIN_PERMISSIONS.USER_INVITE,
+            ADMIN_PERMISSIONS.USER_2FA,
+            ADMIN_PERMISSIONS.ROLE_ASSIGN,
+            ADMIN_PERMISSIONS.ROLE_READ,
+            ADMIN_PERMISSIONS.CLAIM_READ,
+            ADMIN_PERMISSIONS.SESSION_READ,
+            ADMIN_PERMISSIONS.SESSION_REVOKE,
+        ],
+    },
+    APP_ADMIN: {
+        slug: 'porta-app-admin',
+        name: 'Application Admin',
+        description: 'Manage applications, clients, RBAC definitions',
+        permissions: [
+            ADMIN_PERMISSIONS.APP_CREATE,
+            ADMIN_PERMISSIONS.APP_READ,
+            ADMIN_PERMISSIONS.APP_UPDATE,
+            ADMIN_PERMISSIONS.APP_ARCHIVE,
+            ADMIN_PERMISSIONS.CLIENT_CREATE,
+            ADMIN_PERMISSIONS.CLIENT_READ,
+            ADMIN_PERMISSIONS.CLIENT_UPDATE,
+            ADMIN_PERMISSIONS.CLIENT_REVOKE,
+            ADMIN_PERMISSIONS.ROLE_CREATE,
+            ADMIN_PERMISSIONS.ROLE_READ,
+            ADMIN_PERMISSIONS.ROLE_UPDATE,
+            ADMIN_PERMISSIONS.ROLE_ARCHIVE,
+            ADMIN_PERMISSIONS.PERMISSION_CREATE,
+            ADMIN_PERMISSIONS.PERMISSION_READ,
+            ADMIN_PERMISSIONS.PERMISSION_ARCHIVE,
+            ADMIN_PERMISSIONS.CLAIM_CREATE,
+            ADMIN_PERMISSIONS.CLAIM_READ,
+            ADMIN_PERMISSIONS.CLAIM_UPDATE,
+            ADMIN_PERMISSIONS.CLAIM_ARCHIVE,
+        ],
+    },
+    AUDITOR: {
+        slug: 'porta-auditor',
+        name: 'Auditor',
+        description: 'Read-only access to everything, full audit log access',
+        permissions: [
+            ADMIN_PERMISSIONS.ORG_READ,
+            ADMIN_PERMISSIONS.APP_READ,
+            ADMIN_PERMISSIONS.CLIENT_READ,
+            ADMIN_PERMISSIONS.USER_READ,
+            ADMIN_PERMISSIONS.ROLE_READ,
+            ADMIN_PERMISSIONS.PERMISSION_READ,
+            ADMIN_PERMISSIONS.CLAIM_READ,
+            ADMIN_PERMISSIONS.CONFIG_READ,
+            ADMIN_PERMISSIONS.KEY_READ,
+            ADMIN_PERMISSIONS.AUDIT_READ,
+            ADMIN_PERMISSIONS.SESSION_READ,
+            ADMIN_PERMISSIONS.STATS_READ,
+            ADMIN_PERMISSIONS.EXPORT_READ,
+        ],
+    },
+};
+/** All admin role definition values as an array (for iteration) */
+export const ALL_ADMIN_ROLES = Object.values(ADMIN_ROLE_DEFINITIONS);
+// ============================================================================
+// Legacy Compatibility
+// ============================================================================
+/**
+ * Legacy admin role slug from pre-granular auth.
+ * Users with this role are automatically treated as super-admins
+ * for backward compatibility during the transition period.
+ */
+export const LEGACY_ADMIN_ROLE = 'porta-admin';
+/**
+ * Check if a role slug represents a super-admin role.
+ * Recognizes both the new `porta-super-admin` and legacy `porta-admin` slugs.
+ *
+ * @param roleSlug - The role slug to check
+ * @returns true if the role grants super-admin level access
+ */
+export function isSuperAdminRole(roleSlug) {
+    return (roleSlug === ADMIN_ROLE_DEFINITIONS.SUPER_ADMIN.slug || roleSlug === LEGACY_ADMIN_ROLE);
+}
+/**
+ * Resolve the effective admin role slug, mapping legacy roles to their
+ * modern equivalents.
+ *
+ * @param roleSlug - The role slug to resolve
+ * @returns The effective role slug (legacy porta-admin → porta-super-admin)
+ */
+export function resolveAdminRoleSlug(roleSlug) {
+    if (roleSlug === LEGACY_ADMIN_ROLE) {
+        return ADMIN_ROLE_DEFINITIONS.SUPER_ADMIN.slug;
+    }
+    return roleSlug;
+}
+/**
+ * Get the permission set for an admin role slug.
+ * Returns all permissions for super-admin roles (including legacy).
+ * Returns an empty array for unrecognized role slugs.
+ *
+ * @param roleSlug - The admin role slug to look up
+ * @returns Array of permission slugs granted by this role
+ */
+export function getPermissionsForAdminRole(roleSlug) {
+    // Legacy porta-admin gets all permissions (backward compatible)
+    if (roleSlug === LEGACY_ADMIN_ROLE) {
+        return ALL_ADMIN_PERMISSIONS;
+    }
+    // Find matching role definition
+    const roleDef = ALL_ADMIN_ROLES.find((r) => r.slug === roleSlug);
+    return roleDef ? roleDef.permissions : [];
+}
+/**
+ * Resolve the union of all permissions from multiple admin role slugs.
+ * Deduplicates the result. Handles legacy role mapping automatically.
+ *
+ * @param roleSlugs - Array of admin role slugs assigned to a user
+ * @returns Deduplicated array of all permission slugs
+ */
+export function resolvePermissionsFromRoles(roleSlugs) {
+    const permissionSet = new Set();
+    for (const slug of roleSlugs) {
+        const permissions = getPermissionsForAdminRole(slug);
+        for (const p of permissions) {
+            permissionSet.add(p);
+        }
+    }
+    return [...permissionSet];
+}
+/**
+ * Check if a set of permissions includes all required permissions.
+ *
+ * @param userPermissions - The user's resolved permission set
+ * @param requiredPermissions - The permissions required for an operation
+ * @returns true if all required permissions are present
+ */
+export function hasPermissions(userPermissions, requiredPermissions) {
+    return requiredPermissions.every((p) => userPermissions.includes(p));
+}
+//# sourceMappingURL=admin-permissions.js.map

package/dist/lib/admin-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-permissions.js","sourceRoot":"","sources":["../../src/lib/admin-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,0BAA0B;IAC1B,UAAU,EAAE,kBAAkB;IAC9B,QAAQ,EAAE,gBAAgB;IAC1B,UAAU,EAAE,kBAAkB;IAC9B,WAAW,EAAE,mBAAmB;IAChC,WAAW,EAAE,mBAAmB;IAEhC,yBAAyB;IACzB,UAAU,EAAE,kBAAkB;IAC9B,QAAQ,EAAE,gBAAgB;IAC1B,UAAU,EAAE,kBAAkB;IAC9B,WAAW,EAAE,mBAAmB;IAEhC,oBAAoB;IACpB,aAAa,EAAE,qBAAqB;IACpC,WAAW,EAAE,mBAAmB;IAChC,aAAa,EAAE,qBAAqB;IACpC,aAAa,EAAE,qBAAqB;IAEpC,kBAAkB;IAClB,WAAW,EAAE,mBAAmB;IAChC,SAAS,EAAE,iBAAiB;IAC5B,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,oBAAoB;IAClC,WAAW,EAAE,mBAAmB;IAChC,QAAQ,EAAE,gBAAgB;IAE1B,kBAAkB;IAClB,WAAW,EAAE,mBAAmB;IAChC,SAAS,EAAE,iBAAiB;IAC5B,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,oBAAoB;IAClC,WAAW,EAAE,mBAAmB;IAEhC,wBAAwB;IACxB,iBAAiB,EAAE,yBAAyB;IAC5C,eAAe,EAAE,uBAAuB;IACxC,kBAAkB,EAAE,0BAA0B;IAE9C,2BAA2B;IAC3B,YAAY,EAAE,oBAAoB;IAClC,UAAU,EAAE,kBAAkB;IAC9B,YAAY,EAAE,oBAAoB;IAClC,aAAa,EAAE,qBAAqB;IAEpC,uBAAuB;IACvB,WAAW,EAAE,mBAAmB;IAChC,aAAa,EAAE,qBAAqB;IAEpC,eAAe;IACf,QAAQ,EAAE,gBAAgB;IAC1B,YAAY,EAAE,oBAAoB;IAClC,UAAU,EAAE,kBAAkB;IAE9B,QAAQ;IACR,UAAU,EAAE,kBAAkB;IAE9B,qBAAqB;IACrB,YAAY,EAAE,oBAAoB;IAClC,cAAc,EAAE,sBAAsB;IAEtC,uBAAuB;IACvB,UAAU,EAAE,kBAAkB;IAE9B,gBAAgB;IAChB,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,oBAAoB;CAC1B,CAAC;AAKX,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAA+B,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAqBlG;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAwC;IACzE,WAAW,EAAE;QACX,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,uCAAuC;QACpD,WAAW,EAAE,qBAAqB;KACnC;IACD,SAAS,EAAE;QACT,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,0CAA0C;QACvD,WAAW,EAAE;YACX,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,UAAU;SAC7B;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,8CAA8C;QAC3D,WAAW,EAAE;YACX,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,cAAc;SACjC;KACF;IACD,SAAS,EAAE;QACT,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,gDAAgD;QAC7D,WAAW,EAAE;YACX,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,iBAAiB;YACnC,iBAAiB,CAAC,eAAe;YACjC,iBAAiB,CAAC,kBAAkB;YACpC,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,aAAa;SAChC;KACF;IACD,OAAO,EAAE;QACP,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,uDAAuD;QACpE,WAAW,EAAE;YACX,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,eAAe;YACjC,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;YAC7B,iBAAiB,CAAC,QAAQ;YAC1B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,YAAY;YAC9B,iBAAiB,CAAC,UAAU;YAC5B,iBAAiB,CAAC,WAAW;SAC9B;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,eAAe,GAAmC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAErG,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,CACL,QAAQ,KAAK,sBAAsB,CAAC,WAAW,CAAC,IAAI,IAAI,QAAQ,KAAK,iBAAiB,CACvF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,gEAAgE;IAChE,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAA4B;IACtE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,eAAkC,EAClC,mBAAsC;IAEtC,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC"}

package/dist/lib/audit-log.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Audit-log writers for best-effort events and transaction-bound administrative mutations.
+ *
+ * Most existing callers use the compatibility writer, which keeps historical best-effort
+ * semantics. Administrative data mutations use the transaction-bound writer so their mutation
+ * and durable audit row either commit together or both roll back.
+ *
+ * This module is not specific to organizations and is shared by users, clients, authentication,
+ * and administrative workflows.
+ */
+import type { PoolClient } from 'pg';
+/** Input data for writing an audit log entry */
+export interface AuditLogEntry {
+    organizationId?: string;
+    userId?: string;
+    actorId?: string;
+    eventType: string;
+    eventCategory: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    ipAddress?: string;
+    userAgent?: string;
+}
+/**
+ * Write an audit log entry to the database.
+ *
+ * Compatibility events never change the owning operation's result. Outside a database transaction
+ * they are written immediately; inside one they are deferred until commit. Errors are reduced to a
+ * privacy-safe warning and are never thrown to the caller.
+ *
+ * @param entry - Audit log entry data
+ */
+export declare function writeAuditLog(entry: AuditLogEntry): Promise<void>;
+/**
+ * Persist a business audit row through the caller's open transaction.
+ *
+ * Unlike the compatibility writer above, this function deliberately propagates failures. Covered
+ * administrative mutations must call it before commit so an unavailable durable audit boundary
+ * rolls back the mutation instead of creating an unaudited success.
+ *
+ * @param client - PostgreSQL client which owns the mutation transaction.
+ * @param entry - Closed business audit entry.
+ */
+export declare function writeAuditLogInTransaction(client: PoolClient, entry: AuditLogEntry): Promise<void>;
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/lib/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/lib/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAQrC,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BvE;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/lib/audit-log.js

@@ -0,0 +1,79 @@
+/**
+ * Audit-log writers for best-effort events and transaction-bound administrative mutations.
+ *
+ * Most existing callers use the compatibility writer, which keeps historical best-effort
+ * semantics. Administrative data mutations use the transaction-bound writer so their mutation
+ * and durable audit row either commit together or both roll back.
+ *
+ * This module is not specific to organizations and is shared by users, clients, authentication,
+ * and administrative workflows.
+ */
+import { afterDatabaseCommit, getPool } from './database.js';
+import { logger } from './logger.js';
+// ---------------------------------------------------------------------------
+// Writer
+// ---------------------------------------------------------------------------
+/**
+ * Write an audit log entry to the database.
+ *
+ * Compatibility events never change the owning operation's result. Outside a database transaction
+ * they are written immediately; inside one they are deferred until commit. Errors are reduced to a
+ * privacy-safe warning and are never thrown to the caller.
+ *
+ * @param entry - Audit log entry data
+ */
+export async function writeAuditLog(entry) {
+    await afterDatabaseCommit(async () => {
+        try {
+            const pool = getPool();
+            await pool.query(`INSERT INTO audit_log (
+         organization_id, user_id, actor_id,
+         event_type, event_category, description,
+         metadata, ip_address, user_agent
+       )
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`, [
+                entry.organizationId ?? null,
+                entry.userId ?? null,
+                entry.actorId ?? null,
+                entry.eventType,
+                entry.eventCategory,
+                entry.description ?? null,
+                entry.metadata ? JSON.stringify(entry.metadata) : '{}',
+                entry.ipAddress ?? null,
+                entry.userAgent ?? null,
+            ]);
+        }
+        catch {
+            logger.warn({ event: 'compatibility-audit-write-failed', eventType: entry.eventType }, 'Compatibility audit write failed');
+        }
+    });
+}
+/**
+ * Persist a business audit row through the caller's open transaction.
+ *
+ * Unlike the compatibility writer above, this function deliberately propagates failures. Covered
+ * administrative mutations must call it before commit so an unavailable durable audit boundary
+ * rolls back the mutation instead of creating an unaudited success.
+ *
+ * @param client - PostgreSQL client which owns the mutation transaction.
+ * @param entry - Closed business audit entry.
+ */
+export async function writeAuditLogInTransaction(client, entry) {
+    await client.query(`INSERT INTO audit_log (
+       organization_id, user_id, actor_id,
+       event_type, event_category, description,
+       metadata, ip_address, user_agent
+     )
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`, [
+        entry.organizationId ?? null,
+        entry.userId ?? null,
+        entry.actorId ?? null,
+        entry.eventType,
+        entry.eventCategory,
+        entry.description ?? null,
+        entry.metadata ? JSON.stringify(entry.metadata) : '{}',
+        entry.ipAddress ?? null,
+        entry.userAgent ?? null,
+    ]);
+}
+//# sourceMappingURL=audit-log.js.map

package/dist/lib/audit-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../src/lib/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAmBrC,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB;IACtD,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,KAAK,CACd;;;;;mDAK2C,EAC3C;gBACE,KAAK,CAAC,cAAc,IAAI,IAAI;gBAC5B,KAAK,CAAC,MAAM,IAAI,IAAI;gBACpB,KAAK,CAAC,OAAO,IAAI,IAAI;gBACrB,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,aAAa;gBACnB,KAAK,CAAC,WAAW,IAAI,IAAI;gBACzB,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;gBACtD,KAAK,CAAC,SAAS,IAAI,IAAI;gBACvB,KAAK,CAAC,SAAS,IAAI,IAAI;aACxB,CACF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,kCAAkC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EACzE,kCAAkC,CACnC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAkB,EAClB,KAAoB;IAEpB,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;iDAK6C,EAC7C;QACE,KAAK,CAAC,cAAc,IAAI,IAAI;QAC5B,KAAK,CAAC,MAAM,IAAI,IAAI;QACpB,KAAK,CAAC,OAAO,IAAI,IAAI;QACrB,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,WAAW,IAAI,IAAI;QACzB,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QACtD,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,SAAS,IAAI,IAAI;KACxB,CACF,CAAC;AACJ,CAAC"}

package/dist/lib/branding-assets.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Branding assets service.
+ *
+ * Manages organization logo and favicon image uploads stored as PostgreSQL
+ * bytea. Images are validated for type, size, and content before storage.
+ *
+ * Supported formats: PNG, SVG, ICO, JPEG, WebP
+ * Max file size: 512 KB
+ *
+ * @module branding-assets
+ * @see 06-bulk-operations-branding.md
+ */
+export type AssetType = 'logo' | 'favicon';
+export interface BrandingAsset {
+    id: string;
+    organizationId: string;
+    assetType: AssetType;
+    contentType: string;
+    fileSize: number;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface BrandingAssetWithData extends BrandingAsset {
+    data: Buffer;
+}
+/**
+ * Upload (upsert) a branding asset for an organization.
+ * If an asset of the same type already exists, it is replaced.
+ *
+ * @throws Error if content type is not allowed or file too large
+ */
+export declare function uploadAsset(organizationId: string, assetType: AssetType, contentType: string, data: Buffer): Promise<BrandingAsset>;
+/**
+ * Get a branding asset with its binary data.
+ * Returns null if no asset exists.
+ */
+export declare function getAsset(organizationId: string, assetType: AssetType): Promise<BrandingAssetWithData | null>;
+/**
+ * List branding assets for an organization (metadata only, no binary data).
+ */
+export declare function listAssets(organizationId: string): Promise<BrandingAsset[]>;
+/**
+ * Delete a branding asset.
+ * Returns true if the asset existed and was deleted.
+ */
+export declare function deleteAsset(organizationId: string, assetType: AssetType): Promise<boolean>;
+//# sourceMappingURL=branding-assets.d.ts.map

package/dist/lib/branding-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding-assets.d.ts","sourceRoot":"","sources":["../../src/lib/branding-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3C,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,IAAI,EAAE,MAAM,CAAC;CACd;AAqBD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,CAAC,CA6BxB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAWvC;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAYjF;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,OAAO,CAAC,CAOlB"}

package/dist/lib/branding-assets.js

@@ -0,0 +1,93 @@
+/**
+ * Branding assets service.
+ *
+ * Manages organization logo and favicon image uploads stored as PostgreSQL
+ * bytea. Images are validated for type, size, and content before storage.
+ *
+ * Supported formats: PNG, SVG, ICO, JPEG, WebP
+ * Max file size: 512 KB
+ *
+ * @module branding-assets
+ * @see 06-bulk-operations-branding.md
+ */
+import { getPool } from './database.js';
+// ============================================================================
+// Constants
+// ============================================================================
+const MAX_FILE_SIZE = 524288; // 512 KB
+const ALLOWED_CONTENT_TYPES = new Set([
+    'image/png',
+    'image/svg+xml',
+    'image/x-icon',
+    'image/vnd.microsoft.icon',
+    'image/jpeg',
+    'image/webp',
+]);
+// ============================================================================
+// Service functions
+// ============================================================================
+/**
+ * Upload (upsert) a branding asset for an organization.
+ * If an asset of the same type already exists, it is replaced.
+ *
+ * @throws Error if content type is not allowed or file too large
+ */
+export async function uploadAsset(organizationId, assetType, contentType, data) {
+    if (!ALLOWED_CONTENT_TYPES.has(contentType)) {
+        throw new Error(`Unsupported content type: ${contentType}. Allowed: ${[...ALLOWED_CONTENT_TYPES].join(', ')}`);
+    }
+    if (data.length === 0) {
+        throw new Error('Asset data cannot be empty');
+    }
+    if (data.length > MAX_FILE_SIZE) {
+        throw new Error(`File too large: ${data.length} bytes (max ${MAX_FILE_SIZE})`);
+    }
+    const pool = getPool();
+    const { rows } = await pool.query(`INSERT INTO branding_assets (organization_id, asset_type, content_type, data, file_size)
+     VALUES ($1, $2, $3, $4, $5)
+     ON CONFLICT (organization_id, asset_type) DO UPDATE SET
+       content_type = EXCLUDED.content_type,
+       data = EXCLUDED.data,
+       file_size = EXCLUDED.file_size,
+       updated_at = NOW()
+     RETURNING id, organization_id AS "organizationId", asset_type AS "assetType",
+               content_type AS "contentType", file_size AS "fileSize",
+               created_at AS "createdAt", updated_at AS "updatedAt"`, [organizationId, assetType, contentType, data, data.length]);
+    return rows[0];
+}
+/**
+ * Get a branding asset with its binary data.
+ * Returns null if no asset exists.
+ */
+export async function getAsset(organizationId, assetType) {
+    const pool = getPool();
+    const { rows } = await pool.query(`SELECT id, organization_id AS "organizationId", asset_type AS "assetType",
+            content_type AS "contentType", data, file_size AS "fileSize",
+            created_at AS "createdAt", updated_at AS "updatedAt"
+     FROM branding_assets
+     WHERE organization_id = $1 AND asset_type = $2`, [organizationId, assetType]);
+    return rows[0] ?? null;
+}
+/**
+ * List branding assets for an organization (metadata only, no binary data).
+ */
+export async function listAssets(organizationId) {
+    const pool = getPool();
+    const { rows } = await pool.query(`SELECT id, organization_id AS "organizationId", asset_type AS "assetType",
+            content_type AS "contentType", file_size AS "fileSize",
+            created_at AS "createdAt", updated_at AS "updatedAt"
+     FROM branding_assets
+     WHERE organization_id = $1
+     ORDER BY asset_type`, [organizationId]);
+    return rows;
+}
+/**
+ * Delete a branding asset.
+ * Returns true if the asset existed and was deleted.
+ */
+export async function deleteAsset(organizationId, assetType) {
+    const pool = getPool();
+    const { rowCount } = await pool.query(`DELETE FROM branding_assets WHERE organization_id = $1 AND asset_type = $2`, [organizationId, assetType]);
+    return (rowCount ?? 0) > 0;
+}
+//# sourceMappingURL=branding-assets.js.map

package/dist/lib/branding-assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding-assets.js","sourceRoot":"","sources":["../../src/lib/branding-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAsBxC,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,SAAS;AAEvC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,WAAW;IACX,eAAe;IACf,cAAc;IACd,0BAA0B;IAC1B,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AAEH,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,cAAsB,EACtB,SAAoB,EACpB,WAAmB,EACnB,IAAY;IAEZ,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,cAAc,CAAC,GAAG,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,MAAM,eAAe,aAAa,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;;;;;oEASgE,EAChE,CAAC,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAC5D,CAAC;IAEF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,cAAsB,EACtB,SAAoB;IAEpB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;oDAIgD,EAChD,CAAC,cAAc,EAAE,SAAS,CAAC,CAC5B,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,cAAsB;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;yBAKqB,EACrB,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,cAAsB,EACtB,SAAoB;IAEpB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,4EAA4E,EAC5E,CAAC,cAAc,EAAE,SAAS,CAAC,CAC5B,CAAC;IACF,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/lib/bulk-operations.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Tenant-safe bulk status operations with ordered partial results.
+ *
+ * Whole-request validation completes before the first mutation. Each admitted item then owns one
+ * database transaction containing its lock, transition, update, and durable audit record. Domain
+ * rejections are isolated to that item. Dependency failures stop the operation and mark the
+ * current and remaining items as not attempted.
+ */
+/** Supported entity types for bulk operations. */
+export type BulkEntityType = 'organization' | 'user';
+/** Supported actions across both bulk entity types. */
+export type BulkAction = 'activate' | 'suspend' | 'deactivate' | 'lock' | 'unlock' | 'archive';
+/** Closed public outcome for one requested item. */
+export type BulkItemOutcome = 'succeeded' | 'failed' | 'not_attempted';
+/** Closed public reason for an unsuccessful item. */
+export type BulkItemCode = 'not_found_or_not_authorized' | 'invalid_transition' | 'not_attempted';
+/** Input for a validated bulk status operation. */
+export interface BulkStatusChangeInput {
+    readonly entityType: BulkEntityType;
+    readonly entityIds: readonly string[];
+    readonly action: BulkAction;
+    readonly reason?: string;
+    /** Required tenant scope for user operations. */
+    readonly organizationId?: string;
+    /** Authenticated administrator recorded in each committed audit entry. */
+    readonly actorId?: string;
+}
+/** Public result for one item, preserving the original compatibility fields. */
+export interface BulkItemResult {
+    readonly id: string;
+    readonly success: boolean;
+    readonly outcome: BulkItemOutcome;
+    readonly code: BulkItemCode | null;
+    readonly error?: string;
+    readonly previousStatus?: string;
+    readonly newStatus?: string;
+}
+/** Ordered public summary for one bulk operation. */
+export interface BulkOperationResult {
+    readonly total: number;
+    readonly succeeded: number;
+    readonly failed: number;
+    readonly results: readonly BulkItemResult[];
+    /** Present only when infrastructure stopped processing. */
+    readonly correlationId?: string;
+}
+/**
+ * Execute an ordered partial-result bulk status operation.
+ *
+ * @param input - Fully validated entity, action, scope, and actor input.
+ * @returns Ordered item outcomes. A dependency stop includes one server correlation ID.
+ */
+export declare function bulkStatusChange(input: BulkStatusChangeInput): Promise<BulkOperationResult>;
+//# sourceMappingURL=bulk-operations.d.ts.map

package/dist/lib/bulk-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bulk-operations.d.ts","sourceRoot":"","sources":["../../src/lib/bulk-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,kDAAkD;AAClD,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,MAAM,CAAC;AAErD,uDAAuD;AACvD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/F,oDAAoD;AACpD,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEvE,qDAAqD;AACrD,MAAM,MAAM,YAAY,GAAG,6BAA6B,GAAG,oBAAoB,GAAG,eAAe,CAAC;AAElG,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAuKD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqEjG"}