@portaidentity/server 1.7.0

package/dist/routes/interactions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactions.js","sourceRoot":"","sources":["../../src/routes/interactions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,WAAW,EACX,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAE7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AA2DzF,MAAM,8BAA8B,GAAgD;IAClF,iBAAiB;IACjB,eAAe;IACf,iBAAiB;IACjB,aAAa;IACb,sBAAsB;IACtB,0BAA0B;IAC1B,wBAAwB;IACxB,4BAA4B;IAC5B,cAAc;IACd,cAAc;IACd,aAAa;IACb,sBAAsB;IACtB,UAAU;IACV,2BAA2B;IAC3B,mBAAmB;IACnB,qBAAqB;IACrB,WAAW;IACX,sBAAsB;IACtB,aAAa;CACd,CAAC;AAEF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;GAMG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,iCAAiC,CACxC,MAAe,EACf,GAA8C;IAE9C,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,QAAQ,GACZ,MACD,EAAE,QAAQ,EAAE,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,yBAAyB,CAAC,CAAC;IAClD,wEAAwE;IACxE,MAAM,UAAU,GAAyB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,OAAO,mBAAmB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAiB;IAC7C,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,UAAU,EAAE,GAAG,CAAC,kBAAkB;QAClC,YAAY,EAAE,GAAG,CAAC,oBAAoB,IAAI,SAAS;QACnD,WAAW,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI;QAChD,SAAS,EAAE,GAAG,CAAC,iBAAiB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CACvB,GAAuB,EACvB,MAAc,EACd,SAAiB,EACjB,OAAe;IAEf,OAAO;QACL,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QACtD,MAAM;QACN,SAAS;QACT,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAY,EACZ,QAAgB,EAChB,OAAwB,EACxB,UAAU,GAAG,GAAG,EAChB,QAAQ,GAAsB,UAAU;IAExC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;IACxB,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;IACvB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,GAAuB,EACvB,QAAgB,EAChB,cAAuB;IAEvB,uDAAuD;IACvD,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO;IAEnC,wEAAwE;IACxE,mFAAmF;IACnF,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,QAAQ,EAAE,CAAC,GAAG,CAAC,mBAAmB,cAAc,EAAE,CAAC,CAAC;YAC9E,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBACnD,IAAI,GAAG,EAAE,CAAC;oBACR,GAAG,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC;oBAC7B,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC;AAC/B,CAAC;AAUD;;;;;;;;GAQG;AACH,KAAK,UAAU,qCAAqC,CAClD,cAAsB;IAEtB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,cAAc,GAAG,MAAM,QAAQ,EAAE,CAAC,GAAG,CAAC,mBAAmB,cAAc,EAAE,CAAC,CAAC;IACjF,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,YAAY,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gCAAgC,CACvC,mBAA2B,EAC3B,cAAsB,EACtB,aAAsB,EACtB,yBAAkC,EAClC,YAA0B;IAE1B,IACE,mBAAmB,KAAK,cAAc;QACtC,cAAc,CAAC,MAAM,GAAG,CAAC;QACzB,cAAc,CAAC,MAAM,GAAG,GAAG;QAC3B,OAAO,aAAa,KAAK,QAAQ;QACjC,aAAa,CAAC,MAAM,GAAG,CAAC;QACxB,yBAAyB,KAAK,YAAY,CAAC,EAAE,EAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,EAAE,cAAc,EAAE,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAkB,EAClB,uBAAuB,GAAgD,8BAA8B;IAErG,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAEtD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,gCAAgC,CAAC;oBAC/B,OAAO,EAAE,GAAG,CAAC,GAAG;oBAChB,UAAU,EAAE,8BAA8B;iBAC3C,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,qDAAqD;IACrD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,SAAS,CAAC,GAAyB,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,wDAAwD;IACxD,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,YAAY,CAAC,GAAyB,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,4DAA4D;IAC5D,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,mBAAmB,CAAC,GAAyB,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,oDAAoD;IACpD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,WAAW,CAAC,GAAyB,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,kEAAkE;IAClE,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,cAAc,CAAC,GAAyB,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sDAAsD;IACtD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,gBAAgB,CAAC,GAAyB,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8FAA8F;AAC9F,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,GAAG,CAAC;AAClG,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,SAAS,CAAC,GAAuB,EAAE,QAAkB;IAClE,0EAA0E;IAC1E,8DAA8D;IAC9D,uEAAuE;IACvE,0DAA0D;IAC1D,0EAA0E;IAC1E,YAAY,EAAE,CAAC;IAEf,0EAA0E;IAC1E,+BAA+B;IAC/B,0EAA0E;IAC1E,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,qBAAqB,GAAG,MAAM,qCAAqC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG,qBAAqB;YACnC,CAAC,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,qBAAqB,CAAC,SAAS,CAAC;YACrE,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,OAAO,IAAI,qBAAqB,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,qBAAqB,CAAC,YAAY,CAAC;YAE/C,6EAA6E;YAC7E,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG;oBACb,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE;iBACrC,CAAC;gBAEF,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE;oBAC3D,uBAAuB,EAAE,KAAK;iBAC/B,CAAC,CAAC;gBACH,OAAO,CAAC,oDAAoD;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,+EAA+E;gBAC/E,4CAA4C;gBAC5C,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAC7C,kEAAkE,CACnE,CAAC;gBAEF,MAAM,0BAA0B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;QACH,CAAC;QACD,yDAAyD;IAC3D,CAAC;IAED,0EAA0E;IAC1E,oBAAoB;IACpB,0EAA0E;IAC1E,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACxE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;QAEvC,yDAAyD;QACzD,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,iCAAiC,CAAC,GAAG,EAAE,MAAM,CAAC,SAAmB,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QAE1F,8DAA8D;QAC9D,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,qCAAqC;QACrC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,wEAAwE;QACxE,MAAM,SAAS,GAAG,MAAM,CAAC,UAAgC,CAAC;QAC1D,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,cAAc,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QAEjF,uDAAuD;QACvD,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAEnD,0CAA0C;QAC1C,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE9B,8CAA8C;QAC9C,EAAE;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,4EAA4E;QAC5E,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,OAAO,GACX,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAE3D,kEAAkE;QAClE,gDAAgD;QAChD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAmB,CAAC,CAAC;QAC1E,MAAM,UAAU,GACb,UAAU,EAAE,QAAQ,EAAE,EAAE,WAAsB,IAAK,MAAM,CAAC,SAAoB,CAAC;QAElF,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,mBAAmB;QACnB,MAAM,gBAAgB,GAAG,UAAU;YACjC,CAAC,CAAC,iCAAiC,CAAC,UAAU,EAAE,GAAG,CAAC;YACpD,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAE5B,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAoB;YAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;YACrD,CAAC;YACD,WAAW,EAAE;gBACX,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,MAAM,EAAE,MAAiC;gBACzC,MAAM,EAAE,EAAE,UAAU,EAAE;aACvB;YACD,KAAK,EAAE,SAAS,IAAI,EAAE;YACtB,SAAS;YACT,uDAAuD;YACvD,YAAY;YACZ,aAAa;YACb,WAAW,EAAE,YAAY,IAAI,aAAa;YAC1C,YAAY,EAAE,gBAAgB;SAC/B,CAAC;QAEF,wEAAwE;QACxE,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,6BAA6B,CAAC,CAAC;QAC5E,MAAM,eAAe,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,0BAA0B,CACvC,GAAuB,EACvB,GAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;IACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IAEtC,MAAM,OAAO,GAAoB;QAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACnC,MAAM;QACN,CAAC;QACD,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;KAClB,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,YAAY,CACzB,GAAuB,EACvB,QAAkB,EAClB,YAAyD;IAEzD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,wDAAwD;QACxD,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,oCAAoC;QACpC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,aAAa,CAC7C,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QACF,MAAM,CAAC,GAAG,YAAY,CAAC,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAEhE,mDAAmD;QACnD,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,sCAAsC,CAAC,CAAC;YACtF,MAAM,oBAAoB,CACxB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,CAAC,EACD,MAAM,EACN,KAAK,EACL,CAAC,CAAC,qBAAqB,CAAC,EACxB,GAAG,EACH,YAAY,CACb,CAAC;YACF,OAAO;QACT,CAAC;QAED,+EAA+E;QAC/E,EAAE;QACF,+CAA+C;QAC/C,yEAAyE;QACzE,8DAA8D;QAC9D,2EAA2E;QAC3E,uEAAuE;QACvE,8BAA8B;QAC9B,0EAA0E;QAC1E,EAAE;QACF,0EAA0E;QAC1E,8CAA8C;QAC9C,MAAM,kBAAkB,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAmB,CAAC,CAAC;QAC9F,MAAM,qBAAqB,GAAG,kBAAkB;YAC9C,CAAC,CAAC,iCAAiC,CAAC,kBAAkB,EAAE,GAAG,CAAC;YAC5D,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAE5B,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,mCAAmC,CAAC,CAAC;YAE9F,YAAY,CAAC,aAAa,CAAC;gBACzB,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,SAAS,EAAE,gCAAgC;gBAC3C,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,uDAAuD;gBACpE,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,QAAQ,EAAE;oBACR,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS;oBACtC,eAAe,EAAE,UAAU;oBAC3B,gBAAgB,EAAE,qBAAqB;iBACxC;aACF,CAAC,CAAC;YAEH,MAAM,oBAAoB,CACxB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,CAAC,EACD,MAAM,EACN,KAAK,EACL,CAAC,CAAC,8BAA8B,CAAC,EACjC,GAAG,EACH,YAAY,CACb,CAAC;YACF,OAAO;QACT,CAAC;QAED,2BAA2B;QAC3B,MAAM,YAAY,GAAG,YAAY,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAChF,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,wBAAwB,EAAE,CAAC;QACtE,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAEzF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YAE3D,6BAA6B;YAC7B,YAAY,CAAC,aAAa,CAAC;gBACzB,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,SAAS,EAAE,kBAAkB;gBAC7B,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,2BAA2B;gBACxC,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YAEH,MAAM,oBAAoB,CACxB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,CAAC,EACD,MAAM,EACN,KAAK,EACL,CAAC,CAAC,4BAA4B,CAAC,EAC/B,GAAG,EACH,YAAY,CACb,CAAC;YACF,OAAO;QACT,CAAC;QAED,yFAAyF;QACzF,0FAA0F;QAC1F,2CAA2C;QAC3C,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnF,MAAM,YAAY,GAChB,YAAY,EAAE,MAAM,KAAK,QAAQ,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAC1D,YAAY,EAAE,EAAE,IAAI,IAAI,EACxB,QAAQ,CACT,CAAC;QAEF,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YAE1E,KAAK,YAAY,CAAC,aAAa,CAAC;gBAC9B,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,SAAS,EAAE,4BAA4B;gBACvC,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,yBAAyB;gBACtC,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,QAAQ,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE;aACjF,CAAC,CAAC;YAEH,MAAM,oBAAoB,CACxB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,CAAC,EACD,MAAM,EACN,KAAK,EACL,CAAC,CAAC,qBAAqB,CAAC,EACxB,GAAG,EACH,YAAY,CACb,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC;QAE1B,oDAAoD;QACpD,MAAM,YAAY,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAEhD,gEAAgE;QAChE,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,IAAI,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChF,MAAM,eAAe,GAAG,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAE5D,IAAI,iBAAiB,EAAE,CAAC;YACtB,0EAA0E;YAC1E,MAAM,QAAQ,CAAC,iBAAiB,CAC9B,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,GAAG,EACP;gBACE,SAAS,EAAE;oBACT,gBAAgB,EAAE,IAAI,CAAC,EAAE;oBACzB,MAAM,EAAE,eAAe,IAAI,OAAO;oBAClC,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB;aACF,EACD,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;YAEF,mDAAmD;YACnD,IAAI,eAAe,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;gBAChF,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC/D,gDAAgD;oBAChD,gBAAgB,CACd;wBACE,EAAE,EAAE,IAAI,CAAC,EAAE;wBACX,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;qBAC5B,EACD;wBACE,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,eAAe,EAAE,GAAG,CAAC,eAAe;wBACpC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;wBAC9C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;qBAC7C,EACD,OAAO,EACP,EAAE,EACF,MAAM,CACP,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,6BAA6B,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YAED,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,uBAAuB;gBAClC,aAAa,EAAE,gBAAgB;gBAC/B,WAAW,EAAE,mCAAmC,eAAe,IAAI,gBAAgB,GAAG;gBACtF,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YAEH,wEAAwE;YACxE,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACN,4EAA4E;gBAC5E,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,mBAAmB,CAAC,CAAC;YACnE,CAAC;YACD,OAAO;QACT,CAAC;QAED,4CAA4C;QAC5C,MAAM,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAExC,mCAAmC;QACnC,YAAY,CAAC,aAAa,CAAC;YACzB,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,qBAAqB;YAChC,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,2BAA2B;YACxC,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,sDAAsD;QACtD,MAAM,MAAM,GAAG;YACb,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE;SAC9B,CAAC;QAEF,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE;YAC3D,uBAAuB,EAAE,KAAK;SAC/B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAC9E,MAAM,eAAe,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAuB,EACvB,QAAkB,EAClB,YAAyD;IAEzD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,wDAAwD;QACxD,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,oCAAoC;QACpC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,aAAa,CAC7C,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QACF,MAAM,CAAC,GAAG,YAAY,CAAC,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAEhE,2CAA2C;QAC3C,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,0BAA0B,EAAE,EACrC,gDAAgD,CACjD,CAAC;YACF,MAAM,oBAAoB,CACxB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,CAAC,EACD,MAAM,EACN,KAAK,EACL,CAAC,CAAC,qBAAqB,CAAC,EACxB,GAAG,EACH,YAAY,CACb,CAAC;YACF,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,sBAAsB,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CACvD,WAAW,CAAC,MAAM,CAAC,SAAmB,CACvC,CAAC;QACF,MAAM,yBAAyB,GAAG,sBAAsB;YACtD,CAAC,CAAC,iCAAiC,CAAC,sBAAsB,EAAE,GAAG,CAAC;YAChE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAE5B,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CACT;gBACE,KAAK,EAAE,4BAA4B;gBACnC,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS;aACvC,EACD,0DAA0D,CAC3D,CAAC;YAEF,YAAY,CAAC,aAAa,CAAC;gBACzB,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,SAAS,EAAE,gCAAgC;gBAC3C,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,yDAAyD;gBACtE,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,QAAQ,EAAE;oBACR,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS;oBACtC,eAAe,EAAE,YAAY;oBAC7B,gBAAgB,EAAE,yBAAyB;iBAC5C;aACF,CAAC,CAAC;YAEH,MAAM,oBAAoB,CACxB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,CAAC,EACD,MAAM,EACN,KAAK,EACL,CAAC,CAAC,8BAA8B,CAAC,EACjC,GAAG,EACH,YAAY,CACb,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,iBAAiB,GAAG,gCAAgC,CACxD,GAAG,CAAC,MAAM,CAAC,GAAG,EACd,WAAW,CAAC,GAAG,EACf,WAAW,CAAC,MAAM,CAAC,SAAS,EAC5B,sBAAsB,EAAE,QAAQ,EAAE,CAAC,cAAc,EACjD,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,+BAA+B,CAAC,CAAC;YACzF,MAAM,oBAAoB,CACxB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,CAAC,EACD,MAAM,EACN,KAAK,EACL,CAAC,CAAC,4BAA4B,CAAC,EAC/B,GAAG,EACH,YAAY,CACb,CAAC;YACF,OAAO;QACT,CAAC;QAED,2CAA2C;QAC3C,MAAM,YAAY,GAAG,YAAY,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5E,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,4BAA4B,EAAE,CAAC;QAC1E,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAEzF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YAE3D,YAAY,CAAC,aAAa,CAAC;gBACzB,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,SAAS,EAAE,uBAAuB;gBAClC,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,gCAAgC;gBAC7C,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YAEH,MAAM,oBAAoB,CACxB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,CAAC,EACD,MAAM,EACN,KAAK,EACL,CAAC,CAAC,4BAA4B,CAAC,EAC/B,GAAG,EACH,YAAY,CACb,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,sBAAsB,CAAC;gBACxC,OAAO,EAAE,YAAY;gBACrB,cAAc,EAAE,iBAAiB,CAAC,cAAc;gBAChD,KAAK;gBACL,cAAc,EAAE,iBAAiB,CAAC,cAAc;gBAChD,WAAW,EAAE,aAAa;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACrF,MAAM,oBAAoB,CACxB,GAAG,EACH,QAAQ,EACR,WAAW,EACX,CAAC,EACD,MAAM,EACN,KAAK,EACL,CAAC,CAAC,4BAA4B,CAAC,EAC/B,GAAG,EACH,YAAY,CACb,CAAC;YACF,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,OAAO,GAAoB;YAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;YACrD,CAAC;YACD,KAAK;YACL,QAAQ,EAAE,gBAAgB,WAAW,CAAC,GAAG,EAAE;SAC5C,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAClF,MAAM,eAAe,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,WAAW,CAAC,GAAuB,EAAE,QAAkB;IACpE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACxE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;QAEvC,wDAAwD;QACxD,MAAM,iCAAiC,CAAC,GAAG,EAAE,MAAM,CAAC,SAAmB,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,sCAAsC;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAgC,CAAC;QAC1D,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,cAAc,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QACjF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAEnD,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAmB,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,MAAM,EAAE,CAAC;YACX,kEAAkE;YAClE,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,cAAoC,CAAC;YAC5E,IAAI,WAAW,IAAI,WAAW,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC;gBAC1C,kEAAkE;gBAClE,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAE1F,iEAAiE;gBACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAkC,CAAC;gBAE1D,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAoC,CAAC;oBAC5D,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5C,CAAC;gBACD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;oBAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAqC,CAAC;oBAC7D,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;gBACnC,CAAC;gBACD,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;oBAClC,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAC9C,OAAO,CAAC,qBAAyD,CAClE,EAAE,CAAC;wBACF,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC3D,CAAC;gBACH,CAAC;gBAED,oEAAoE;gBACpE,4EAA4E;gBAC5E,kEAAkE;gBAClE,MAAM,cAAc,GAAI,MAAM,CAAC,KAAgB,IAAI,EAAE,CAAC;gBACtD,IAAI,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC9C,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBACvC,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBAEnC,MAAM,MAAM,GAAG;oBACb,OAAO,EAAE,EAAE,OAAO,EAAE;iBACrB,CAAC;gBAEF,aAAa,CAAC;oBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;oBACtB,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,SAAS;oBACtC,SAAS,EAAE,sBAAsB;oBACjC,aAAa,EAAE,gBAAgB;oBAC/B,WAAW,EAAE,+CAA+C,QAAQ,EAAE;iBACvE,CAAC,CAAC;gBAEH,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE;oBAC3D,uBAAuB,EAAE,IAAI;iBAC9B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9B,MAAM,eAAe,GAAG,CAAE,MAAM,CAAC,KAAgB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpF,MAAM,OAAO,GAAoB;YAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;YACrD,CAAC;YACD,WAAW,EAAE;gBACX,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,MAAM,EAAE,MAAiC;gBACzC,MAAM,EAAE,EAAE,UAAU,EAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,WAAsB,IAAI,QAAQ,EAAE;aAChF;YACD,MAAM,EAAE,eAAe;YACvB,UAAU,EAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,WAAsB,IAAI,QAAQ;SACpE,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAChF,MAAM,eAAe,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,cAAc,CAAC,GAAuB,EAAE,QAAkB;IACvE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,sBAAsB;IAEtD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,wDAAwD;QACxD,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,oBAAoB;QACpB,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,wCAAwC,CAAC,CAAC;YAC1F,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,oBAAoB,CAAC;YAChC,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,oDAAoD;YACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,SAAmB,CAAC;YACxD,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC;gBAC/B,SAAS,EAAE,WAAW,CAAC,OAAO,EAAE,SAAS;gBACzC,QAAQ;aACT,CAAC,CAAC;YAEH,iEAAiE;YACjE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,OAAkC,CAAC;YAEtE,4BAA4B;YAC5B,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAoC,CAAC;gBAC5D,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5C,CAAC;YAED,4BAA4B;YAC5B,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAqC,CAAC;gBAC7D,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;YACnC,CAAC;YAED,gCAAgC;YAChC,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBAClC,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAC9C,OAAO,CAAC,qBAAyD,CAClE,EAAE,CAAC;oBACF,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAED,6EAA6E;YAC7E,MAAM,cAAc,GAAI,WAAW,CAAC,MAAM,CAAC,KAAgB,IAAI,EAAE,CAAC;YAClE,IAAI,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC9C,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YAEnC,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,SAAS;gBACtC,SAAS,EAAE,sBAAsB;gBACjC,aAAa,EAAE,gBAAgB;gBAC/B,WAAW,EAAE,8BAA8B,QAAQ,EAAE;aACtD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG;gBACb,OAAO,EAAE,EAAE,OAAO,EAAE;aACrB,CAAC;YAEF,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE;gBAC3D,uBAAuB,EAAE,IAAI;aAC9B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,eAAe;YACf,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,SAAS;gBACtC,SAAS,EAAE,qBAAqB;gBAChC,aAAa,EAAE,gBAAgB;gBAC/B,WAAW,EAAE,6BAA6B,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE;aACzE,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG;gBACb,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,qBAAqB;aACzC,CAAC;YAEF,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE;gBAC3D,uBAAuB,EAAE,KAAK;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAClF,MAAM,eAAe,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAuB,EAAE,QAAkB;IACzE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,wDAAwD;QACxD,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,SAAS;YACtC,SAAS,EAAE,qBAAqB;YAChC,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,6BAA6B;SAC3C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG;YACb,KAAK,EAAE,eAAe;YACtB,iBAAiB,EAAE,8BAA8B;SAClD,CAAC;QAEF,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE;YAC3D,uBAAuB,EAAE,KAAK;SAC/B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAChF,MAAM,eAAe,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,oBAAoB,CACjC,GAAuB,EACvB,QAAkB,EAClB,WAAuF,EACvF,CAA6D,EAC7D,MAAc,EACd,KAAa,EACb,YAAoB,EACpB,UAAU,GAAG,GAAG,EAChB,YAAY,GAAgD,8BAA8B;IAE1F,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;IACnC,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;IACnD,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAE3C,6DAA6D;IAC7D,0DAA0D;IAC1D,MAAM,QAAQ,GAAI,WAAW,CAAC,MAAM,CAAC,SAAoB,IAAI,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,UAAU,GAAI,UAAU,EAAE,QAAQ,EAAE,EAAE,WAAsB,IAAI,QAAQ,CAAC;IAE/E,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,2BAA2B;IAC3B,MAAM,gBAAgB,GAAG,UAAU;QACjC,CAAC,CAAC,iCAAiC,CAAC,UAAU,EAAE,GAAG,CAAC;QACpD,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAE5B,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAoB;QAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;QACrD,CAAC;QACD,WAAW,EAAE;YACX,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI;YAC/B,MAAM,EAAE,WAAW,CAAC,MAAiC;YACrD,MAAM,EAAE,EAAE,UAAU,EAAE;SACvB;QACD,KAAK;QACL,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;QAC9B,iEAAiE;QACjE,sEAAsE;QACtE,YAAY;QACZ,aAAa;QACb,WAAW,EAAE,YAAY,IAAI,aAAa;QAC1C,YAAY,EAAE,gBAAgB;KAC/B,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;AACrF,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,GAAY,EAAE,QAAgB;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAI,GAAG,CAAC,KAAyC,CAAC,YAAY,CAAC;QACxE,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,IAAI,SAAS,CAAC;QACvC,MAAM,MAAM,GAAG,GAAG;YAChB,CAAC,CAAC,MAAM,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC;YAC5F,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QAEtC,MAAM,OAAO,GAAoB;YAC/B,QAAQ,EAAE,GAAG;gBACX,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC;gBAC3B,CAAC,CAAC;oBACE,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,IAAI;oBAChB,YAAY,EAAE,SAAS;oBACvB,WAAW,EAAE,OAAO;oBACpB,SAAS,EAAE,IAAI;iBAChB;YACL,MAAM;YACN,CAAC;YACD,SAAS;YACT,OAAO;YACP,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC;SAC1B,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC5F,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,mBAAmB,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/routes/invitation.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Invitation acceptance route handlers.
+ *
+ * Handles the flow when a new user clicks the invitation link in their
+ * email to set up their account by choosing a password.
+ *
+ * Route structure:
+ *   GET  /:orgSlug/auth/accept-invite/:token → showAcceptInvite
+ *   POST /:orgSlug/auth/accept-invite/:token → processAcceptInvite
+ *
+ * The tenant resolver middleware runs before these routes, ensuring
+ * ctx.state.organization is populated with the resolved organization.
+ *
+ * Security features:
+ *   - Token is hashed (SHA-256) before DB lookup
+ *   - Token is single-use (marked as used after acceptance)
+ *   - Expired/used tokens show an "invitation expired" page
+ *   - CSRF protection on the POST endpoint
+ *   - Password validation (NIST SP 800-63B compliant)
+ *   - Audit logging for invitation acceptance
+ */
+import Router from '@koa/router';
+/**
+ * Create the invitation auth router.
+ *
+ * Handles invitation acceptance at /:orgSlug/auth/accept-invite/:token.
+ *
+ * @returns Koa router with invitation routes
+ */
+export declare function createInvitationRouter(): Router;
+//# sourceMappingURL=invitation.d.ts.map

package/dist/routes/invitation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitation.d.ts","sourceRoot":"","sources":["../../src/routes/invitation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AA8EjC;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAmB/C"}

package/dist/routes/invitation.js

@@ -0,0 +1,342 @@
+/**
+ * Invitation acceptance route handlers.
+ *
+ * Handles the flow when a new user clicks the invitation link in their
+ * email to set up their account by choosing a password.
+ *
+ * Route structure:
+ *   GET  /:orgSlug/auth/accept-invite/:token → showAcceptInvite
+ *   POST /:orgSlug/auth/accept-invite/:token → processAcceptInvite
+ *
+ * The tenant resolver middleware runs before these routes, ensuring
+ * ctx.state.organization is populated with the resolved organization.
+ *
+ * Security features:
+ *   - Token is hashed (SHA-256) before DB lookup
+ *   - Token is single-use (marked as used after acceptance)
+ *   - Expired/used tokens show an "invitation expired" page
+ *   - CSRF protection on the POST endpoint
+ *   - Password validation (NIST SP 800-63B compliant)
+ *   - Audit logging for invitation acceptance
+ */
+import Router from '@koa/router';
+import { tenantResolver } from '../middleware/tenant-resolver.js';
+import { generateCsrfToken, verifyCsrfToken, setCsrfCookie, getCsrfFromCookie, } from '../auth/csrf.js';
+import { hashToken } from '../auth/tokens.js';
+import { findValidInvitationToken, markTokenUsed } from '../auth/token-repository.js';
+import { getPool } from '../lib/database.js';
+import { resolveLocale, getTranslationFunction } from '../auth/i18n.js';
+import { renderPage } from '../auth/template-engine.js';
+import { setUserPassword, markEmailVerified } from '../users/service.js';
+import { validatePassword } from '../users/password.js';
+import { writeAuditLog } from '../lib/audit-log.js';
+import { logger } from '../lib/logger.js';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Build branding context from organization data.
+ *
+ * @param org - Organization with branding fields
+ * @returns Branding context for templates
+ */
+function buildBrandingFromOrg(org) {
+    return {
+        logoUrl: org.brandingLogoUrl,
+        faviconUrl: org.brandingFaviconUrl,
+        primaryColor: org.brandingPrimaryColor ?? '#3B82F6',
+        companyName: org.brandingCompanyName ?? org.name,
+        customCss: org.brandingCustomCss,
+    };
+}
+/**
+ * Render an HTML page and send it as the response.
+ *
+ * @param ctx - Koa context
+ * @param pageName - Page template name
+ * @param context - Full template context
+ * @param statusCode - HTTP status code (default: 200)
+ */
+async function renderAndRespond(ctx, pageName, context, statusCode = 200) {
+    const html = await renderPage(pageName, context);
+    ctx.status = statusCode;
+    ctx.type = 'text/html';
+    ctx.body = html;
+}
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the invitation auth router.
+ *
+ * Handles invitation acceptance at /:orgSlug/auth/accept-invite/:token.
+ *
+ * @returns Koa router with invitation routes
+ */
+export function createInvitationRouter() {
+    const router = new Router();
+    // Tenant resolver — resolves orgSlug to organization and sets ctx.state.organization.
+    // Applied at route level because this router is mounted directly on the Koa app
+    // (not under the OIDC catch-all router which has its own tenant resolver).
+    const resolve = tenantResolver();
+    // GET /:orgSlug/auth/accept-invite/:token — Show accept invite form
+    router.get('/:orgSlug/auth/accept-invite/:token', resolve, async (ctx) => {
+        await showAcceptInvite(ctx);
+    });
+    // POST /:orgSlug/auth/accept-invite/:token — Process invitation acceptance
+    router.post('/:orgSlug/auth/accept-invite/:token', resolve, async (ctx) => {
+        await processAcceptInvite(ctx);
+    });
+    return router;
+}
+// ---------------------------------------------------------------------------
+// Route handlers
+// ---------------------------------------------------------------------------
+/**
+ * Show the accept-invite form.
+ *
+ * Validates the invitation token before showing the form. If the token
+ * is invalid or expired, renders the "invite-expired" page instead.
+ *
+ * @param ctx - Koa context with organization state
+ */
+async function showAcceptInvite(ctx) {
+    const org = ctx.state.organization;
+    const tokenPlaintext = ctx.params.token;
+    const locale = await resolveLocale(undefined, ctx.get('Accept-Language') || undefined, org.defaultLocale);
+    const t = getTranslationFunction(locale, org.slug);
+    // Validate the invitation token
+    const tokenHash = hashToken(tokenPlaintext);
+    const tokenRecord = await findValidInvitationToken(tokenHash);
+    if (!tokenRecord) {
+        // Token is invalid, expired, or already used — show expired page
+        const csrfToken = generateCsrfToken();
+        setCsrfCookie(ctx, csrfToken);
+        const context = {
+            branding: buildBrandingFromOrg(org),
+            locale,
+            t,
+            csrfToken,
+            orgSlug: org.slug,
+        };
+        await renderAndRespond(ctx, 'invite-expired', context, 400);
+        return;
+    }
+    // Token is valid — show the accept invite form
+    const csrfToken = generateCsrfToken();
+    setCsrfCookie(ctx, csrfToken);
+    const context = {
+        branding: buildBrandingFromOrg(org),
+        locale,
+        t,
+        csrfToken,
+        orgSlug: org.slug,
+        token: tokenPlaintext,
+    };
+    await renderAndRespond(ctx, 'accept-invite', context);
+}
+/**
+ * Process an invitation acceptance form submission.
+ *
+ * 1. Verify CSRF token
+ * 2. Re-validate the invitation token
+ * 3. Validate password and confirm match
+ * 4. Set the user's password
+ * 5. Mark the user's email as verified
+ * 6. Mark the invitation token as used
+ * 7. Audit log the acceptance
+ * 8. Render success page
+ *
+ * @param ctx - Koa context with organization state
+ */
+async function processAcceptInvite(ctx) {
+    const org = ctx.state.organization;
+    const tokenPlaintext = ctx.params.token;
+    const body = ctx.request.body;
+    const password = body.password ?? '';
+    const confirmPassword = body.confirmPassword ?? '';
+    const submittedCsrf = body._csrf ?? '';
+    const storedCsrf = getCsrfFromCookie(ctx) ?? '';
+    const locale = await resolveLocale(undefined, ctx.get('Accept-Language') || undefined, org.defaultLocale);
+    const t = getTranslationFunction(locale, org.slug);
+    // Step 1: Verify CSRF token (cookie vs form field)
+    if (!verifyCsrfToken(storedCsrf, submittedCsrf)) {
+        logger.warn('CSRF token mismatch on accept-invite');
+        await renderInviteFormWithError(ctx, org, locale, t, tokenPlaintext, t('errors.csrf_invalid'), 403);
+        return;
+    }
+    // Step 2: Re-validate the invitation token
+    const tokenHash = hashToken(tokenPlaintext);
+    const tokenRecord = await findValidInvitationToken(tokenHash);
+    if (!tokenRecord) {
+        // Token expired between page load and form submission
+        const csrfToken = generateCsrfToken();
+        setCsrfCookie(ctx, csrfToken);
+        const context = {
+            branding: buildBrandingFromOrg(org),
+            locale,
+            t,
+            csrfToken,
+            orgSlug: org.slug,
+        };
+        await renderAndRespond(ctx, 'invite-expired', context, 400);
+        return;
+    }
+    // Step 3: Validate passwords match
+    if (password !== confirmPassword) {
+        await renderInviteFormWithError(ctx, org, locale, t, tokenPlaintext, t('invitation.error_password_mismatch'));
+        return;
+    }
+    // Step 4: Validate password strength (NIST SP 800-63B)
+    const validation = validatePassword(password);
+    if (!validation.isValid) {
+        await renderInviteFormWithError(ctx, org, locale, t, tokenPlaintext, validation.error);
+        return;
+    }
+    try {
+        // Step 5: Set the user's password
+        await setUserPassword(tokenRecord.userId, password);
+        // Step 6: Mark email as verified (accepting invite proves email ownership)
+        await markEmailVerified(tokenRecord.userId);
+        // Step 7: Mark invitation token as used (single-use)
+        await markTokenUsed('invitation_tokens', tokenRecord.id);
+        // Step 7.5: Apply pre-assigned roles and claims from invitation details
+        await applyPreAssignments(tokenRecord, org.id);
+        // Step 8: Audit log
+        writeAuditLog({
+            organizationId: org.id,
+            userId: tokenRecord.userId,
+            eventType: 'user.invite.accepted',
+            eventCategory: 'authentication',
+            description: 'Invitation accepted — account set up successfully',
+            ipAddress: ctx.ip,
+            metadata: {
+                preAssignedRoles: tokenRecord.details?.roles?.length ?? 0,
+                preAssignedClaims: tokenRecord.details?.claims?.length ?? 0,
+            },
+        });
+        // Step 9: Render success page
+        const csrfToken = generateCsrfToken();
+        setCsrfCookie(ctx, csrfToken);
+        const context = {
+            branding: buildBrandingFromOrg(org),
+            locale,
+            t,
+            csrfToken,
+            orgSlug: org.slug,
+            flash: { success: t('invitation.success') },
+        };
+        await renderAndRespond(ctx, 'invite-success', context);
+    }
+    catch {
+        logger.error({ event: 'invitation-acceptance-failed' }, 'Invitation acceptance processing failed');
+        await renderInviteFormWithError(ctx, org, locale, t, tokenPlaintext, t('errors.generic'));
+    }
+}
+// ---------------------------------------------------------------------------
+// Helper: render invite form with error
+// ---------------------------------------------------------------------------
+/**
+ * Render the accept-invite form with an error flash message.
+ *
+ * @param ctx - Koa context
+ * @param org - Organization for branding
+ * @param locale - Resolved locale
+ * @param t - Translation function
+ * @param token - Invitation token (to re-embed in the form)
+ * @param errorMessage - Error message to display
+ * @param statusCode - HTTP status code (default: 200)
+ */
+async function renderInviteFormWithError(ctx, org, locale, t, token, errorMessage, statusCode = 200) {
+    const csrfToken = generateCsrfToken();
+    setCsrfCookie(ctx, csrfToken);
+    const context = {
+        branding: buildBrandingFromOrg(org),
+        locale,
+        t,
+        csrfToken,
+        orgSlug: org.slug,
+        token,
+        flash: { error: errorMessage },
+    };
+    await renderAndRespond(ctx, 'accept-invite', context, statusCode);
+}
+/**
+ * Apply pre-assigned roles and claims from the invitation token details.
+ *
+ * This runs after the invitation is accepted (password set, email verified,
+ * token marked as used). Pre-assignments are best-effort: if a role or claim
+ * no longer exists (admin deleted it between invitation and acceptance), the
+ * individual assignment is skipped and logged, but does not fail the overall
+ * invitation acceptance.
+ *
+ * Uses parameterized SQL — no string interpolation for security.
+ *
+ * @param tokenRecord - The invitation token record with details
+ * @param orgId - Organization ID for audit logging
+ */
+async function applyPreAssignments(tokenRecord, orgId) {
+    if (!tokenRecord.details)
+        return;
+    const pool = getPool();
+    const userId = tokenRecord.userId;
+    const roles = tokenRecord.details.roles;
+    const claims = tokenRecord.details.claims;
+    // Apply role pre-assignments
+    if (roles?.length) {
+        for (const role of roles) {
+            try {
+                // Verify role still exists before assigning (defensive)
+                const roleCheck = await pool.query(`SELECT id FROM roles WHERE id = $1 AND application_id = $2`, [role.roleId, role.applicationId]);
+                if (roleCheck.rows.length === 0) {
+                    logger.warn({ event: 'invitation-role-unavailable' }, 'Invitation role assignment was skipped');
+                    continue;
+                }
+                // Insert user-role mapping (ON CONFLICT DO NOTHING for idempotency)
+                await pool.query(`INSERT INTO user_roles (user_id, role_id)
+           VALUES ($1, $2)
+           ON CONFLICT (user_id, role_id) DO NOTHING`, [userId, role.roleId]);
+                logger.debug({ event: 'invitation-role-applied' }, 'Invitation role assignment applied');
+            }
+            catch {
+                logger.warn({ event: 'invitation-role-failed' }, 'Invitation role assignment failed');
+            }
+        }
+    }
+    // Apply claim pre-assignments
+    if (claims?.length) {
+        for (const claim of claims) {
+            try {
+                // Verify claim definition still exists
+                const defCheck = await pool.query(`SELECT id FROM claim_definitions WHERE id = $1 AND application_id = $2`, [claim.claimDefinitionId, claim.applicationId]);
+                if (defCheck.rows.length === 0) {
+                    logger.warn({ event: 'invitation-claim-unavailable' }, 'Invitation claim assignment was skipped');
+                    continue;
+                }
+                // Upsert user claim value
+                await pool.query(`INSERT INTO user_claim_values (user_id, claim_definition_id, value)
+           VALUES ($1, $2, $3)
+           ON CONFLICT (user_id, claim_definition_id) DO UPDATE SET value = EXCLUDED.value`, [userId, claim.claimDefinitionId, JSON.stringify(claim.value)]);
+                logger.debug({ event: 'invitation-claim-applied' }, 'Invitation claim assignment applied');
+            }
+            catch {
+                logger.warn({ event: 'invitation-claim-failed' }, 'Invitation claim assignment failed');
+            }
+        }
+    }
+    // Audit log pre-assignment application
+    if ((roles?.length ?? 0) > 0 || (claims?.length ?? 0) > 0) {
+        writeAuditLog({
+            organizationId: orgId,
+            userId,
+            eventType: 'user.invite.pre_assignments_applied',
+            eventCategory: 'authentication',
+            description: `Pre-assignments applied: ${roles?.length ?? 0} roles, ${claims?.length ?? 0} claims`,
+            metadata: {
+                roles: roles?.map((r) => r.roleId) ?? [],
+                claims: claims?.map((c) => c.claimDefinitionId) ?? [],
+            },
+        });
+    }
+}
+//# sourceMappingURL=invitation.js.map

package/dist/routes/invitation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitation.js","sourceRoot":"","sources":["../../src/routes/invitation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEtF,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAe1C,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAiB;IAC7C,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,UAAU,EAAE,GAAG,CAAC,kBAAkB;QAClC,YAAY,EAAE,GAAG,CAAC,oBAAoB,IAAI,SAAS;QACnD,WAAW,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI;QAChD,SAAS,EAAE,GAAG,CAAC,iBAAiB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAY,EACZ,QAAgB,EAChB,OAAwB,EACxB,UAAU,GAAG,GAAG;IAEhB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;IACxB,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;IACvB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAE5B,sFAAsF;IACtF,gFAAgF;IAChF,2EAA2E;IAC3E,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IAEjC,oEAAoE;IACpE,MAAM,CAAC,GAAG,CAAC,qCAAqC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvE,MAAM,gBAAgB,CAAC,GAAkB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,mBAAmB,CAAC,GAAkB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAgB;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;IACnC,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;IACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEnD,gCAAgC;IAChC,MAAM,SAAS,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAE9D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iEAAiE;QACjE,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAoB;YAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;YACN,CAAC;YACD,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,IAAI;SAClB,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,+CAA+C;IAC/C,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAoB;QAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACnC,MAAM;QACN,CAAC;QACD,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,KAAK,EAAE,cAAc;KACtB,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,mBAAmB,CAAC,GAAgB;IACjD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;IACnC,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IACnD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEhD,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;IACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEnD,mDAAmD;IACnD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACpD,MAAM,yBAAyB,CAC7B,GAAG,EACH,GAAG,EACH,MAAM,EACN,CAAC,EACD,cAAc,EACd,CAAC,CAAC,qBAAqB,CAAC,EACxB,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IAED,2CAA2C;IAC3C,MAAM,SAAS,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAE9D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,sDAAsD;QACtD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAoB;YAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;YACN,CAAC;YACD,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,IAAI;SAClB,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,mCAAmC;IACnC,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,yBAAyB,CAC7B,GAAG,EACH,GAAG,EACH,MAAM,EACN,CAAC,EACD,cAAc,EACd,CAAC,CAAC,oCAAoC,CAAC,CACxC,CAAC;QACF,OAAO;IACT,CAAC;IAED,uDAAuD;IACvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,KAAM,CAAC,CAAC;QACxF,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,kCAAkC;QAClC,MAAM,eAAe,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEpD,2EAA2E;QAC3E,MAAM,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAE5C,qDAAqD;QACrD,MAAM,aAAa,CAAC,mBAAmB,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QAEzD,wEAAwE;QACxE,MAAM,mBAAmB,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAE/C,oBAAoB;QACpB,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,sBAAsB;YACjC,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,mDAAmD;YAChE,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,QAAQ,EAAE;gBACR,gBAAgB,EAAG,WAAW,CAAC,OAAO,EAAE,KAA+B,EAAE,MAAM,IAAI,CAAC;gBACpF,iBAAiB,EAAG,WAAW,CAAC,OAAO,EAAE,MAAgC,EAAE,MAAM,IAAI,CAAC;aACvF;SACF,CAAC,CAAC;QAEH,8BAA8B;QAC9B,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAoB;YAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;YACnC,MAAM;YACN,CAAC;YACD,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,oBAAoB,CAAC,EAAE;SAC5C,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,8BAA8B,EAAE,EACzC,yCAAyC,CAC1C,CAAC;QACF,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,KAAK,UAAU,yBAAyB,CACtC,GAAY,EACZ,GAAiB,EACjB,MAAc,EACd,CAA6D,EAC7D,KAAa,EACb,YAAoB,EACpB,UAAU,GAAG,GAAG;IAEhB,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAoB;QAC/B,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACnC,MAAM;QACN,CAAC;QACD,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,KAAK;QACL,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;KAC/B,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACpE,CAAC;AAmBD;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,mBAAmB,CAChC,WAAkC,EAClC,KAAa;IAEb,IAAI,CAAC,WAAW,CAAC,OAAO;QAAE,OAAO;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAClC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAwC,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAA0C,CAAC;IAE9E,6BAA6B;IAC7B,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,wDAAwD;gBACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAChC,4DAA4D,EAC5D,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAClC,CAAC;gBACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAChC,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,6BAA6B,EAAE,EACxC,wCAAwC,CACzC,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,oEAAoE;gBACpE,MAAM,IAAI,CAAC,KAAK,CACd;;qDAE2C,EAC3C,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CACtB,CAAC;gBAEF,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,oCAAoC,CAAC,CAAC;YAC3F,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,mCAAmC,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,uCAAuC;gBACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,wEAAwE,EACxE,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,CAC/C,CAAC;gBACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,8BAA8B,EAAE,EACzC,yCAAyC,CAC1C,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,0BAA0B;gBAC1B,MAAM,IAAI,CAAC,KAAK,CACd;;2FAEiF,EACjF,CAAC,MAAM,EAAE,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC/D,CAAC;gBAEF,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,qCAAqC,CAAC,CAAC;YAC7F,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,oCAAoC,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,aAAa,CAAC;YACZ,cAAc,EAAE,KAAK;YACrB,MAAM;YACN,SAAS,EAAE,qCAAqC;YAChD,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,4BAA4B,KAAK,EAAE,MAAM,IAAI,CAAC,WAAW,MAAM,EAAE,MAAM,IAAI,CAAC,SAAS;YAClG,QAAQ,EAAE;gBACR,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;gBACxC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE;aACtD;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/routes/keys.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Signing key management admin API routes.
+ *
+ * All routes are under `/api/admin/keys` and require admin
+ * authorization with granular permissions.
+ *
+ * Route structure:
+ *   GET    /                  — List all signing keys (status, dates, KID)
+ *   POST   /generate          — Generate a new ES256 key pair
+ *   POST   /rotate            — Rotate: retire current active key + generate new
+ *
+ * Private key material is NEVER returned in API responses. Only metadata
+ * (id, kid, algorithm, status, timestamps) is exposed.
+ *
+ * @module routes/keys
+ */
+import Router from '@koa/router';
+/**
+ * Create the signing key admin API router.
+ *
+ * All routes require admin authorization with granular permissions.
+ * Provides read access to key metadata and operations for generating /
+ * rotating ES256 keys.
+ *
+ * @returns Koa router mounted at /api/admin/keys
+ */
+export declare function createKeysRouter(): Router;
+//# sourceMappingURL=keys.d.ts.map

package/dist/routes/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/routes/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAWjC;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAoFzC"}

package/dist/routes/keys.js

@@ -0,0 +1,91 @@
+/**
+ * Signing key management admin API routes.
+ *
+ * All routes are under `/api/admin/keys` and require admin
+ * authorization with granular permissions.
+ *
+ * Route structure:
+ *   GET    /                  — List all signing keys (status, dates, KID)
+ *   POST   /generate          — Generate a new ES256 key pair
+ *   POST   /rotate            — Rotate: retire current active key + generate new
+ *
+ * Private key material is NEVER returned in API responses. Only metadata
+ * (id, kid, algorithm, status, timestamps) is exposed.
+ *
+ * @module routes/keys
+ */
+import Router from '@koa/router';
+import { requireAdminAuth } from '../middleware/admin-auth.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import { getPool } from '../lib/database.js';
+import { generateES256KeyPair } from '../lib/signing-keys.js';
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the signing key admin API router.
+ *
+ * All routes require admin authorization with granular permissions.
+ * Provides read access to key metadata and operations for generating /
+ * rotating ES256 keys.
+ *
+ * @returns Koa router mounted at /api/admin/keys
+ */
+export function createKeysRouter() {
+    const router = new Router({ prefix: '/api/admin/keys' });
+    // Apply admin auth to all key routes
+    router.use(requireAdminAuth());
+    // ── GET / — List all signing keys ─────────────────────────────────
+    router.get('/', requirePermission(ADMIN_PERMISSIONS.KEY_READ), async (ctx) => {
+        const result = await getPool().query('SELECT id, kid, algorithm, status, created_at, retired_at FROM signing_keys ORDER BY created_at DESC');
+        const data = result.rows.map((r) => ({
+            id: r.id,
+            kid: r.kid,
+            algorithm: r.algorithm,
+            status: r.status,
+            createdAt: r.created_at,
+            retiredAt: r.retired_at,
+        }));
+        ctx.body = { data };
+    });
+    // ── POST /generate — Generate a new ES256 key pair ────────────────
+    router.post('/generate', requirePermission(ADMIN_PERMISSIONS.KEY_GENERATE), async (ctx) => {
+        const keyPair = generateES256KeyPair();
+        const result = await getPool().query(`INSERT INTO signing_keys (kid, algorithm, public_key, private_key, status)
+       VALUES ($1, 'ES256', $2, $3, 'active')
+       RETURNING id, kid`, [keyPair.kid, keyPair.publicKeyPem, keyPair.privateKeyPem]);
+        const row = result.rows[0];
+        ctx.status = 201;
+        ctx.body = {
+            data: {
+                id: row.id,
+                kid: row.kid,
+                message: 'New signing key generated',
+            },
+        };
+    });
+    // ── POST /rotate — Retire active keys + generate new ──────────────
+    router.post('/rotate', requirePermission(ADMIN_PERMISSIONS.KEY_ROTATE), async (ctx) => {
+        const pool = getPool();
+        // Retire all currently active keys
+        const retired = await pool.query(`UPDATE signing_keys SET status = 'retired', retired_at = NOW() WHERE status = 'active'`);
+        // Generate and insert new active key
+        const keyPair = generateES256KeyPair();
+        const result = await pool.query(`INSERT INTO signing_keys (kid, algorithm, public_key, private_key, status)
+       VALUES ($1, 'ES256', $2, $3, 'active')
+       RETURNING id, kid`, [keyPair.kid, keyPair.publicKeyPem, keyPair.privateKeyPem]);
+        const row = result.rows[0];
+        ctx.status = 201;
+        ctx.body = {
+            data: {
+                id: row.id,
+                kid: row.kid,
+                retiredCount: retired.rowCount ?? 0,
+                message: 'Keys rotated — new active key generated',
+            },
+        };
+    });
+    return router;
+}
+//# sourceMappingURL=keys.js.map

package/dist/routes/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/routes/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAEzD,qCAAqC;IACrC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,qEAAqE;IACrE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3E,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC,sGAAsG,CACvG,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAO7B,EAAE,EAAE,CAAC,CAAC;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;SACxB,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxF,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;;yBAEmB,EACnB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,aAAa,CAAC,CAC3D,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAgC,CAAC;QAC1D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG;YACT,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,OAAO,EAAE,2BAA2B;aACrC;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpF,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,mCAAmC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B,wFAAwF,CACzF,CAAC;QAEF,qCAAqC;QACrC,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;yBAEmB,EACnB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,aAAa,CAAC,CAC3D,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAgC,CAAC;QAC1D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG;YACT,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,YAAY,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC;gBACnC,OAAO,EAAE,yCAAyC;aACnD;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/magic-link.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Magic link verification route handler.
+ *
+ * Handles the callback when a user clicks the magic link in their email.
+ * Verifies the token, marks the user's email as verified, records the login,
+ * and creates a short-lived `_ml_session` in Redis. Then redirects to the
+ * interaction login page where the session cookie is detected and either:
+ *   - **Same browser**: OIDC flow completes seamlessly via interactionFinished()
+ *   - **Different browser**: success page shown ("return to original browser")
+ *
+ * Route structure:
+ *   GET /:orgSlug/auth/magic-link/:token → verifyMagicLink
+ *
+ * The tenant resolver middleware runs before this route, ensuring
+ * ctx.state.organization is populated with the resolved organization.
+ *
+ * Security features:
+ *   - Token is hashed (SHA-256) before DB lookup — plaintext never stored
+ *   - Token is single-use (marked as used after verification)
+ *   - Expired/used tokens show a generic error page
+ *   - `_ml_session` is HttpOnly, 5-min TTL, single-use (Redis-backed)
+ *   - Audit logging for all magic link events
+ */
+import Router from '@koa/router';
+import { type InteractionAuthorityProvider } from '../auth/interaction-authority.js';
+import { checkRateLimitStrict } from '../auth/rate-limiter.js';
+/** Dependency boundary for the security-critical callback limit. */
+export interface MagicLinkRouteDependencies {
+    /** Fail-closed counter used before live authority and artifact lookup. */
+    readonly checkCallbackRateLimit: typeof checkRateLimitStrict;
+}
+/**
+ * Create the magic link auth router.
+ *
+ * Handles magic link token verification at /:orgSlug/auth/magic-link/:token. Interaction-bound
+ * callbacks resolve their current client through the provider before durable authority is used.
+ *
+ * @param provider - Provider-owned live interaction model. Omit only for standalone callbacks.
+ * @param dependencies - Fail-closed callback-limiter boundary.
+ * @returns Koa router with magic link routes
+ */
+export declare function createMagicLinkRouter(provider?: InteractionAuthorityProvider, dependencies?: MagicLinkRouteDependencies): Router;
+//# sourceMappingURL=magic-link.d.ts.map

package/dist/routes/magic-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-link.d.ts","sourceRoot":"","sources":["../../src/routes/magic-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAcjC,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AAuBjC,oEAAoE;AACpE,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,oBAAoB,CAAC;CAC9D;AA6CD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,CAAC,EAAE,4BAA4B,EACvC,YAAY,GAAE,0BAAkE,GAC/E,MAAM,CAeR"}