@portaidentity/server 1.7.3 → 1.8.0

package/dist/middleware/health.d.ts

@@ -1,3 +1,20 @@
+/**
+ * Liveness probe handler — GET /health.
+ *
+ * Reports whether the server process can still reach its dependencies. Or
+ * container orchestration uses this as a liveness probe, so every dependency
+ * check is bounded: a hung database or cache must fail the probe quickly
+ * (503) instead of holding the response open.
+ *
+ * Returns 200 + { status: 'healthy', checks } when both backends respond, or
+ * 503 + { status: 'unhealthy', checks } when either is degraded or too slow.
+ */
 import type { Middleware } from 'koa';
+/**
+ * Create the liveness probe middleware.
+ *
+ * Both checks run concurrently under an individual timeout, so one slow
+ * dependency cannot delay the other and a hang cannot keep the probe pending.
+ */
 export declare function healthCheck(): Middleware;
 //# sourceMappingURL=health.d.ts.map

package/dist/middleware/health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/middleware/health.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAItC,wBAAgB,WAAW,IAAI,UAAU,CAgCxC"}
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/middleware/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAKtC;;;;;GAKG;AACH,wBAAgB,WAAW,IAAI,UAAU,CAqBxC"}

package/dist/middleware/health.js

@@ -1,29 +1,33 @@
+/**
+ * Liveness probe handler — GET /health.
+ *
+ * Reports whether the server process can still reach its dependencies. Or
+ * container orchestration uses this as a liveness probe, so every dependency
+ * check is bounded: a hung database or cache must fail the probe quickly
+ * (503) instead of holding the response open.
+ *
+ * Returns 200 + { status: 'healthy', checks } when both backends respond, or
+ * 503 + { status: 'unhealthy', checks } when either is degraded or too slow.
+ */
 import { getPool } from '../lib/database.js';
 import { getRedis } from '../lib/redis.js';
+import { withTimeout } from '../lib/with-timeout.js';
+/**
+ * Create the liveness probe middleware.
+ *
+ * Both checks run concurrently under an individual timeout, so one slow
+ * dependency cannot delay the other and a hang cannot keep the probe pending.
+ */
 export function healthCheck() {
     return async (ctx) => {
         const checks = { server: 'ok' };
-        let healthy = true;
-        // Check PostgreSQL
-        try {
-            const pool = getPool();
-            await pool.query('SELECT 1');
-            checks.database = 'ok';
-        }
-        catch {
-            checks.database = 'error';
-            healthy = false;
-        }
-        // Check Redis
-        try {
-            const redis = getRedis();
-            await redis.ping();
-            checks.redis = 'ok';
-        }
-        catch {
-            checks.redis = 'error';
-            healthy = false;
-        }
+        const [dbResult, redisResult] = await Promise.allSettled([
+            withTimeout(getPool().query('SELECT 1'), 'database'),
+            withTimeout(getRedis().ping(), 'redis'),
+        ]);
+        checks.database = dbResult.status === 'fulfilled' ? 'ok' : 'error';
+        checks.redis = redisResult.status === 'fulfilled' ? 'ok' : 'error';
+        const healthy = dbResult.status === 'fulfilled' && redisResult.status === 'fulfilled';
         ctx.status = healthy ? 200 : 503;
         ctx.body = {
             status: healthy ? 'healthy' : 'unhealthy',

package/dist/middleware/health.js.map

@@ -1 +1 @@
-{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/middleware/health.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAA2B,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxD,IAAI,OAAO,GAAG,IAAI,CAAC;QAEnB,mBAAmB;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC;YAC1B,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QAED,cAAc;QACd,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC;YACvB,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QAED,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACjC,GAAG,CAAC,IAAI,GAAG;YACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;YACzC,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/middleware/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAA2B,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAExD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACvD,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;YACpD,WAAW,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QACnE,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAEnE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC;QAEtF,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACjC,GAAG,CAAC,IAAI,GAAG;YACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;YACzC,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/ready.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ready.d.ts","sourceRoot":"","sources":["../../src/middleware/ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAwBtC;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,UAAU,CA6BzC"}
+{"version":3,"file":"ready.d.ts","sourceRoot":"","sources":["../../src/middleware/ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAMtC;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,UAAU,CA6BzC"}

package/dist/middleware/ready.js

@@ -15,18 +15,7 @@
 import { getPool } from '../lib/database.js';
 import { getRedis } from '../lib/redis.js';
 import { logger } from '../lib/logger.js';
-/** Maximum time (ms) to wait for each backend check before failing. */
-const TIMEOUT_MS = 2000;
-/**
- * Race a promise against a timeout. Rejects with a descriptive error
- * if the promise doesn't resolve within `TIMEOUT_MS`.
- */
-function withTimeout(promise, label) {
-    return Promise.race([
-        promise,
-        new Promise((_, reject) => setTimeout(() => reject(new Error(`${label} timeout after ${TIMEOUT_MS}ms`)), TIMEOUT_MS)),
-    ]);
-}
+import { withTimeout } from '../lib/with-timeout.js';
 /**
  * Create the readiness probe middleware.
  *

package/dist/middleware/ready.js.map

@@ -1 +1 @@
-{"version":3,"file":"ready.js","sourceRoot":"","sources":["../../src/middleware/ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,uEAAuE;AACvE,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB;;;GAGG;AACH,SAAS,WAAW,CAAI,OAAmB,EAAE,KAAa;IACxD,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,OAAO;QACP,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC3B,UAAU,CACR,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,UAAU,IAAI,CAAC,CAAC,EACjE,UAAU,CACX,CACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAoD,EAAE,CAAC;QAEnE,qEAAqE;QACrE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACvD,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE;YACP,QAAQ,CAAC,MAAM,KAAK,WAAW;gBAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAEpD,MAAM,CAAC,KAAK;YACV,WAAW,CAAC,MAAM,KAAK,WAAW;gBAChC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAEvD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAE9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAC7E,CAAC;QAED,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/B,GAAG,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ready.js","sourceRoot":"","sources":["../../src/middleware/ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAoD,EAAE,CAAC;QAEnE,qEAAqE;QACrE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACvD,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE;YACP,QAAQ,CAAC,MAAM,KAAK,WAAW;gBAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAEpD,MAAM,CAAC,KAAK;YACV,WAAW,CAAC,MAAM,KAAK,WAAW;gBAChC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAEvD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAE9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAC7E,CAAC;QAED,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/B,GAAG,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/require-existing-organization.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Organization-existence guard for organization-prefixed administrative routes.
+ *
+ * A route value that is not a canonical UUID, or that names no organization, must produce one
+ * non-enumerating not-found response. Without this guard the identifier reaches the database and a
+ * malformed value surfaces as an internal error instead of a client-visible rejection.
+ *
+ * Place this middleware after `requirePermission(...)` so a caller without the operation's
+ * permission still receives the permission denial before any organization lookup.
+ */
+import type { Middleware } from 'koa';
+/**
+ * Require the organization named in the route path to exist.
+ *
+ * @returns Koa middleware that continues only for an existing organization.
+ */
+export declare function requireExistingOrganization(): Middleware;
+//# sourceMappingURL=require-existing-organization.d.ts.map

package/dist/middleware/require-existing-organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-existing-organization.d.ts","sourceRoot":"","sources":["../../src/middleware/require-existing-organization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAQtC;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,UAAU,CAiBxD"}

package/dist/middleware/require-existing-organization.js

@@ -0,0 +1,38 @@
+/**
+ * Organization-existence guard for organization-prefixed administrative routes.
+ *
+ * A route value that is not a canonical UUID, or that names no organization, must produce one
+ * non-enumerating not-found response. Without this guard the identifier reaches the database and a
+ * malformed value surfaces as an internal error instead of a client-visible rejection.
+ *
+ * Place this middleware after `requirePermission(...)` so a caller without the operation's
+ * permission still receives the permission denial before any organization lookup.
+ */
+import { z } from 'zod';
+import { getOrganizationById } from '../organizations/service.js';
+import { recordSecurityDecision } from '../security/decision-context.js';
+const organizationParamSchema = z.object({ orgId: z.string().uuid() });
+/**
+ * Require the organization named in the route path to exist.
+ *
+ * @returns Koa middleware that continues only for an existing organization.
+ */
+export function requireExistingOrganization() {
+    return async function requireExistingOrganizationMiddleware(ctx, next) {
+        const parsed = organizationParamSchema.safeParse(ctx.params);
+        const organization = parsed.success ? await getOrganizationById(parsed.data.orgId) : null;
+        if (organization === null) {
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'resource',
+                reasonCode: 'resource-not-found',
+                outcome: 'deny',
+                detail: { resourceType: 'organization' },
+            });
+            ctx.status = 404;
+            ctx.body = { error: 'Organization not found' };
+            return;
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=require-existing-organization.js.map

package/dist/middleware/require-existing-organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-existing-organization.js","sourceRoot":"","sources":["../../src/middleware/require-existing-organization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,KAAK,UAAU,qCAAqC,CAAC,GAAG,EAAE,IAAI;QACnE,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,UAAU;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;aACzC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/require-permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-permission.d.ts","sourceRoot":"","sources":["../../src/middleware/require-permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAItC;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,mBAAmB,EAAE,MAAM,EAAE,GAAG,UAAU,CAqC9E"}
+{"version":3,"file":"require-permission.d.ts","sourceRoot":"","sources":["../../src/middleware/require-permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,KAAK,CAAC;AAmC/C;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,mBAAmB,EAAE,MAAM,EAAE,GAAG,UAAU,CAyC9E"}

package/dist/middleware/require-permission.js

@@ -15,7 +15,37 @@
  * @module middleware/require-permission
  */
 import { hasPermissions } from '../lib/admin-permissions.js';
-import { recordSecurityDecision } from '../security/decision-context.js';
+import { recordSecurityDecision, recordSecurityReference } from '../security/decision-context.js';
+/**
+ * Route parameter names, in priority order, that identify the target of an
+ * administrative action. The most specific identifier wins so the recorded
+ * digest names the acted-on resource rather than a generic container.
+ */
+const TARGET_PARAMETER_KEYS = ['userId', 'id', 'key', 'type', 'organizationId'];
+/**
+ * Resolve the target identifier for a denied administrative action.
+ *
+ * Entity routes expose the acted-on resource id in a route parameter. List and
+ * collection routes have none, so the actor's organization is the acted-on
+ * scope. The value is always protected before it reaches any event.
+ *
+ * @param ctx - Request context carrying the matched route parameters.
+ * @returns A raw identifier for privacy-preserving protection, or `undefined`.
+ */
+function denialTargetIdentifier(ctx) {
+    const params = Reflect.get(ctx, 'params');
+    if (params !== undefined) {
+        for (const key of TARGET_PARAMETER_KEYS) {
+            const value = params[key];
+            if (typeof value === 'string' && value.length > 0)
+                return value;
+        }
+    }
+    const organizationId = ctx.state.adminUser?.organizationId;
+    return typeof organizationId === 'string' && organizationId.length > 0
+        ? organizationId
+        : undefined;
+}
 /**
  * Create middleware that requires specific admin permission(s).
  *
@@ -50,6 +80,10 @@ export function requirePermission(...requiredPermissions) {
                 outcome: 'deny',
                 detail: { permissions: requiredPermissions },
             });
+            const target = denialTargetIdentifier(ctx);
+            if (target !== undefined) {
+                recordSecurityReference(ctx, 'resource', target);
+            }
             ctx.status = 403;
             ctx.body = {
                 error: 'Forbidden',

package/dist/middleware/require-permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"require-permission.js","sourceRoot":"","sources":["../../src/middleware/require-permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,mBAA6B;IAChE,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;QAEtC,uDAAuD;QACvD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EAAE,uDAAuD;aACjE,CAAC;YACF,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAC;YACrE,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;aAC7C,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,0CAA0C;aACpD,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"require-permission.js","sourceRoot":"","sources":["../../src/middleware/require-permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAElG;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAU,CAAC;AAEzF;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAC,GAAY;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAwC,CAAC;IACjF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,CAAC;IAC3D,OAAO,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QACpE,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,mBAA6B;IAChE,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;QAEtC,uDAAuD;QACvD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EAAE,uDAAuD;aACjE,CAAC;YACF,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAC;YACrE,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;aAC7C,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,uBAAuB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,CAAC;YACD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,0CAA0C;aACpD,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/require-user-organization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-user-organization.d.ts","sourceRoot":"","sources":["../../src/middleware/require-user-organization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAWtC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,UAAU,CAgCpD"}
+{"version":3,"file":"require-user-organization.d.ts","sourceRoot":"","sources":["../../src/middleware/require-user-organization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAWtC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,UAAU,CAkCpD"}

package/dist/middleware/require-user-organization.js

@@ -6,7 +6,7 @@
  * organization-prefixed API from becoming a cross-tenant object lookup or membership oracle.
  */
 import { z } from 'zod';
-import { getUserById } from '../users/service.js';
+import { findUserById } from '../users/repository.js';
 import { recordSecurityDecision, recordSecurityReference } from '../security/decision-context.js';
 const organizationUserParamsSchema = z.object({
     orgId: z.string().uuid(),
@@ -34,7 +34,9 @@ export function requireUserOrganization() {
             ctx.body = { error: 'User not found' };
             return;
         }
-        const user = await getUserById(parsed.data.userId);
+        // Authorization must use the live row. A cache miss inside a mutation transaction would
+        // otherwise register a post-commit cache write for a user the same request may delete.
+        const user = await findUserById(parsed.data.userId);
         if (user === null || user.organizationId !== parsed.data.orgId) {
             recordSecurityDecision(ctx, {
                 decisionPoint: 'resource',

package/dist/middleware/require-user-organization.js.map

@@ -1 +1 @@
-{"version":3,"file":"require-user-organization.js","sourceRoot":"","sources":["../../src/middleware/require-user-organization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAElG,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC1B,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,KAAK,UAAU,iCAAiC,CAAC,GAAG,EAAE,IAAI;QAC/D,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,UAAU;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;aACjC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YACvC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/D,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,UAAU;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;aACjC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YACvC,OAAO;QACT,CAAC;QAED,uBAAuB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7D,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"require-user-organization.js","sourceRoot":"","sources":["../../src/middleware/require-user-organization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAElG,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC1B,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,KAAK,UAAU,iCAAiC,CAAC,GAAG,EAAE,IAAI;QAC/D,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,UAAU;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;aACjC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YACvC,OAAO;QACT,CAAC;QAED,wFAAwF;QACxF,uFAAuF;QACvF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/D,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,UAAU;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;aACjC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YACvC,OAAO;QACT,CAAC;QAED,uBAAuB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7D,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/security-headers.d.ts

@@ -33,6 +33,8 @@
  *     inject custom branding CSS via `{{{branding.customCss}}}`, hence
  *     `style-src 'unsafe-inline'` is required.  Login pages must never
  *     be embedded in iframes (`frame-ancestors 'none'`).
+ *     The final HTML policy also permits same-origin images, data-backed QR images, and only the
+ *     validated external origins required by effective organization branding.
  *
  *     Note: `form-action` is intentionally omitted.  Chrome enforces
  *     `form-action` on the entire redirect chain of a form submission,
@@ -51,6 +53,12 @@
  *   ensures headers are present even on error responses.
  */
 import type { Middleware } from 'koa';
+declare module 'koa' {
+    interface DefaultState {
+        /** Validated image origins required by the authentication HTML response. */
+        brandingImageSources?: readonly string[];
+    }
+}
 /**
  * Static security headers applied to every response regardless of
  * content type or route.
@@ -79,6 +87,16 @@ export declare const DEFAULT_CSP = "default-src 'none'";
  * `form-action` is intentionally omitted — see module-level doc comment.
  */
 export declare const HTML_CSP = "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; frame-ancestors 'none'";
+/**
+ * Build the authentication-page CSP with only validated image origins.
+ *
+ * Same-origin uploads and data-backed QR images are always permitted for authentication HTML.
+ * Additional external sources must be exact origins accepted by the branding URL validator.
+ *
+ * @param imageSources - Candidate image sources from effective organization branding.
+ * @returns Complete HTML Content-Security-Policy value.
+ */
+export declare function buildHtmlCsp(imageSources?: readonly string[]): string;
 /**
  * HSTS header value — one year, include subdomains.
  * Only emitted when the configured issuer URL uses https.

package/dist/middleware/security-headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/middleware/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAQtC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ,sGACgF,CAAC;AAEtG;;;GAGG;AACH,eAAO,MAAM,UAAU,wCAAwC,CAAC;AAsBhE;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,UAAU,CAqC5C"}
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/middleware/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAItC,OAAO,QAAQ,KAAK,CAAC;IACnB,UAAU,YAAY;QACpB,4EAA4E;QAC5E,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC1C;CACF;AAOD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ,sGACgF,CAAC;AAatG;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,YAAY,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAOzE;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU,wCAAwC,CAAC;AAsBhE;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,UAAU,CAqC5C"}

package/dist/middleware/security-headers.js

@@ -33,6 +33,8 @@
  *     inject custom branding CSS via `{{{branding.customCss}}}`, hence
  *     `style-src 'unsafe-inline'` is required.  Login pages must never
  *     be embedded in iframes (`frame-ancestors 'none'`).
+ *     The final HTML policy also permits same-origin images, data-backed QR images, and only the
+ *     validated external origins required by effective organization branding.
  *
  *     Note: `form-action` is intentionally omitted.  Chrome enforces
  *     `form-action` on the entire redirect chain of a form submission,
@@ -51,6 +53,7 @@
  *   ensures headers are present even on error responses.
  */
 import { config } from '../config/index.js';
+import { validateBrandingImageUrl } from '../organizations/branding-url.js';
 // ---------------------------------------------------------------------------
 // Exported constants — consumed by tests and by other middleware that may
 // need to reference or override specific values.
@@ -89,6 +92,34 @@ export const DEFAULT_CSP = "default-src 'none'";
  * `form-action` is intentionally omitted — see module-level doc comment.
  */
 export const HTML_CSP = "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; frame-ancestors 'none'";
+/** Return one safe external origin, rejecting paths and malformed or disallowed URLs. */
+function validatedExternalImageOrigin(candidate) {
+    try {
+        const validated = validateBrandingImageUrl(candidate);
+        const origin = new URL(validated).origin;
+        return validated === origin ? origin : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build the authentication-page CSP with only validated image origins.
+ *
+ * Same-origin uploads and data-backed QR images are always permitted for authentication HTML.
+ * Additional external sources must be exact origins accepted by the branding URL validator.
+ *
+ * @param imageSources - Candidate image sources from effective organization branding.
+ * @returns Complete HTML Content-Security-Policy value.
+ */
+export function buildHtmlCsp(imageSources = []) {
+    const externalOrigins = imageSources
+        .map(validatedExternalImageOrigin)
+        .filter((origin) => origin !== null)
+        .sort();
+    const sources = ["'self'", 'data:', ...new Set(externalOrigins)];
+    return `${HTML_CSP}; img-src ${sources.join(' ')}`;
+}
 /**
  * HSTS header value — one year, include subdomains.
  * Only emitted when the configured issuer URL uses https.
@@ -152,7 +183,7 @@ export function securityHeaders() {
         // -----------------------------------------------------------------------
         const contentType = ctx.response.get('Content-Type') || '';
         if (contentType.includes('text/html')) {
-            ctx.set('Content-Security-Policy', HTML_CSP);
+            ctx.set('Content-Security-Policy', buildHtmlCsp(ctx.state?.brandingImageSources));
         }
     };
 }

package/dist/middleware/security-headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/middleware/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,8EAA8E;AAC9E,0EAA0E;AAC1E,iDAAiD;AACjD,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACrF,wBAAwB,EAAE,SAAS;IACnC,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,iCAAiC;IACpD,kBAAkB,EAAE,GAAG;IACvB,oBAAoB,EAAE,sDAAsD;CAC7E,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,QAAQ,GACnB,mGAAmG,CAAC;AAEtG;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,qCAAqC,CAAC;AAEhE,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAElC,OAAO,KAAK,UAAU,yBAAyB,CAAC,GAAG,EAAE,IAAI;QACvD,0EAA0E;QAC1E,iEAAiE;QACjE,kEAAkE;QAClE,6DAA6D;QAC7D,0EAA0E;QAC1E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;QAED,gEAAgE;QAChE,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;QAEhD,8CAA8C;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,UAAU,CAAC,CAAC;QACnD,CAAC;QAED,0EAA0E;QAC1E,wDAAwD;QACxD,0EAA0E;QAC1E,MAAM,IAAI,EAAE,CAAC;QAEb,0EAA0E;QAC1E,2CAA2C;QAC3C,sEAAsE;QACtE,mEAAmE;QACnE,kDAAkD;QAClD,0EAA0E;QAC1E,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/middleware/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAS5E,8EAA8E;AAC9E,0EAA0E;AAC1E,iDAAiD;AACjD,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACrF,wBAAwB,EAAE,SAAS;IACnC,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,iCAAiC;IACpD,kBAAkB,EAAE,GAAG;IACvB,oBAAoB,EAAE,sDAAsD;CAC7E,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,QAAQ,GACnB,mGAAmG,CAAC;AAEtG,yFAAyF;AACzF,SAAS,4BAA4B,CAAC,SAAiB;IACrD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QACzC,OAAO,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,YAAY,GAAsB,EAAE;IAC/D,MAAM,eAAe,GAAG,YAAY;SACjC,GAAG,CAAC,4BAA4B,CAAC;SACjC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC;SACrD,IAAI,EAAE,CAAC;IACV,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,OAAO,GAAG,QAAQ,aAAa,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,qCAAqC,CAAC;AAEhE,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAElC,OAAO,KAAK,UAAU,yBAAyB,CAAC,GAAG,EAAE,IAAI;QACvD,0EAA0E;QAC1E,iEAAiE;QACjE,kEAAkE;QAClE,6DAA6D;QAC7D,0EAA0E;QAC1E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;QAED,gEAAgE;QAChE,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;QAEhD,8CAA8C;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,UAAU,CAAC,CAAC;QACnD,CAAC;QAED,0EAA0E;QAC1E,wDAAwD;QACxD,0EAA0E;QAC1E,MAAM,IAAI,EAAE,CAAC;QAEb,0EAA0E;QAC1E,2CAA2C;QAC3C,sEAAsE;QACtE,mEAAmE;QACnE,kDAAkD;QAClD,0EAA0E;QAC1E,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/tenant-resolver.d.ts

@@ -14,14 +14,13 @@
  *   3. If cache miss, query DB: findOrganizationBySlug(orgSlug)
  *   4. If found from DB, cache it: cacheOrganization(org)
  *   5. Validate status:
- *      - archived → 404 "Organization not found"
  *      - suspended → 403 "Organization is suspended"
  *      - active → continue
  *   6. Set ctx.state.organization (full Organization object)
  *   7. Set ctx.state.issuer
  *
  * Returns:
- *   - 404 if organization not found or archived
+ *   - 404 if organization is not found
  *   - 403 if organization is suspended
  */
 import type { Middleware } from 'koa';

package/dist/middleware/tenant-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-resolver.d.ts","sourceRoot":"","sources":["../../src/middleware/tenant-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAStC;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAyC3C"}
+{"version":3,"file":"tenant-resolver.d.ts","sourceRoot":"","sources":["../../src/middleware/tenant-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAStC;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAqC3C"}

package/dist/middleware/tenant-resolver.js

@@ -14,14 +14,13 @@
  *   3. If cache miss, query DB: findOrganizationBySlug(orgSlug)
  *   4. If found from DB, cache it: cacheOrganization(org)
  *   5. Validate status:
- *      - archived → 404 "Organization not found"
  *      - suspended → 403 "Organization is suspended"
  *      - active → continue
  *   6. Set ctx.state.organization (full Organization object)
  *   7. Set ctx.state.issuer
  *
  * Returns:
- *   - 404 if organization not found or archived
+ *   - 404 if organization is not found
  *   - 403 if organization is suspended
  */
 import { config } from '../config/index.js';
@@ -56,9 +55,6 @@ export function tenantResolver() {
             return ctx.throw(404, 'Organization not found');
         }
         // 5. Status-dependent responses
-        if (org.status === 'archived') {
-            return ctx.throw(404, 'Organization not found');
-        }
         if (org.status === 'suspended') {
             return ctx.throw(403, 'Organization is suspended');
         }

package/dist/middleware/tenant-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-resolver.js","sourceRoot":"","sources":["../../src/middleware/tenant-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAGxE;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;QAEpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC3C,CAAC;QAED,2BAA2B;QAC3B,IAAI,GAAG,GAAwB,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAE1E,wDAAwD;QACxD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAE5C,8CAA8C;YAC9C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAClD,CAAC;QAED,gCAAgC;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;QACrD,CAAC;QAED,oEAAoE;QACpE,GAAG,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC;QAC7B,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAEzD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tenant-resolver.js","sourceRoot":"","sources":["../../src/middleware/tenant-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAGxE;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;QAEpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC3C,CAAC;QAED,2BAA2B;QAC3B,IAAI,GAAG,GAAwB,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAE1E,wDAAwD;QACxD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAE5C,8CAA8C;YAC9C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAClD,CAAC;QAED,gCAAgC;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;QACrD,CAAC;QAED,oEAAoE;QACpE,GAAG,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC;QAC7B,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAEzD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/token-rate-limiter.d.ts

@@ -1,23 +1,26 @@
 /**
  * Token and introspection endpoint rate limiter middleware.
  *
- * Protects the OAuth token endpoint (`POST /:orgSlug/oidc/token`) and
- * token introspection endpoint (`POST /:orgSlug/oidc/token/introspection`)
+ * Protects the OAuth token endpoint (`POST /:orgSlug/token`) and
+ * token introspection endpoint (`POST /:orgSlug/token/introspection`)
  * against abuse: client-credentials flooding, authorization-code
  * brute-forcing, token enumeration, and general endpoint spam.
  *
- * Rate limiting is per-IP + per-client_id composite key.  If `client_id`
- * is not present in the request body (e.g. `client_secret_basic` auth
- * sends credentials in the `Authorization` header), the key falls back
- * to `unknown` — all such requests from the same IP share one counter.
+ * Rate limiting is per-IP + per-client_id composite key. The client
+ * identifier is read from the parsed body or from HTTP Basic credentials;
+ * when neither is present (unauthenticated spam) the key falls back to
+ * `unknown`. Because that identifier is unauthenticated and caller-controlled,
+ * an aggregate per-IP counter runs alongside it, so one address cannot flood
+ * the endpoint by varying the client identifier.
  *
  * Reuses the existing `checkRateLimit()` infrastructure from
  * `src/auth/rate-limiter.ts` which provides Redis INCR+EXPIRE sliding
  * window and graceful degradation on Redis failure.
  *
- * Placement: mount as global middleware **before** the OIDC provider
- * router in `src/server.ts`.  The path regex ensures only matching
- * requests are rate-limited — all other paths pass through untouched.
+ * Placement: mounted on the OIDC router **after** the request body parser so
+ * the client identifier is available, and before the provider callback. The
+ * path regex ensures only the token and introspection endpoints are limited —
+ * every other path passes through untouched.
  *
  * @module middleware/token-rate-limiter
  */
@@ -26,22 +29,32 @@ import type { RateLimitConfig } from '../auth/rate-limiter.js';
 /**
  * Regex matching the OIDC token endpoint path.
  *
- * Pattern: `/<orgSlug>/oidc/token` where orgSlug starts with a
+ * Pattern: `/<orgSlug>/token` where orgSlug starts with a
  * lowercase alphanumeric character followed by zero or more lowercase
  * alphanumeric or hyphen characters.
  *
- * Matches:  `/acme/oidc/token`, `/my-org/oidc/token`
- * Rejects:  `/api/admin/something`, `/acme/oidc/token/extra`
+ * Matches:  `/acme/token`, `/my-org/token`
+ * Rejects:  `/api/admin/something`, `/acme/token/extra`
  */
 export declare const TOKEN_PATH_REGEX: RegExp;
 /**
- * Rate limit configuration for the token endpoint.
+ * Rate limit configuration for the token endpoint, per client.
  *
  * 30 requests per 5-minute window — generous enough for legitimate
  * applications (SPAs refreshing tokens, server-side token exchanges)
  * while catching automated abuse.
  */
 export declare const TOKEN_RATE_LIMIT: RateLimitConfig;
+/**
+ * Aggregate token limit for one client address.
+ *
+ * The per-client key comes from an unauthenticated value, so a caller can vary
+ * the client identifier to open a fresh counter for every request. This
+ * aggregate bounds the total token traffic from one address, so the endpoint
+ * cannot be flooded with junk requests, while many legitimate clients behind
+ * one address still receive their own per-client budgets.
+ */
+export declare const TOKEN_IP_RATE_LIMIT: RateLimitConfig;
 /**
  * Create the token endpoint rate limiter middleware.
  *
@@ -56,11 +69,11 @@ export declare function tokenRateLimiter(): Middleware;
 /**
  * Regex matching the OIDC token introspection endpoint path.
  *
- * Pattern: `/<orgSlug>/oidc/token/introspection` where orgSlug uses
+ * Pattern: `/<orgSlug>/token/introspection` where orgSlug uses
  * the same slug format as TOKEN_PATH_REGEX.
  *
- * Matches:  `/acme/oidc/token/introspection`, `/my-org/oidc/token/introspection`
- * Rejects:  `/acme/oidc/token`, `/api/admin/introspection`
+ * Matches:  `/acme/token/introspection`, `/my-org/token/introspection`
+ * Rejects:  `/acme/token`, `/api/admin/introspection`
  */
 export declare const INTROSPECTION_PATH_REGEX: RegExp;
 /**
@@ -72,6 +85,14 @@ export declare const INTROSPECTION_PATH_REGEX: RegExp;
  * while still preventing token enumeration attacks.
  */
 export declare const INTROSPECTION_RATE_LIMIT: RateLimitConfig;
+/**
+ * Aggregate introspection limit for one client address.
+ *
+ * As on the token endpoint, the per-client key comes from an unauthenticated
+ * value and can be varied per request, so this aggregate bounds the total
+ * introspection traffic from one address independently of the client value.
+ */
+export declare const INTROSPECTION_IP_RATE_LIMIT: RateLimitConfig;
 /**
  * Create the introspection endpoint rate limiter middleware.
  *

package/dist/middleware/token-rate-limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/middleware/token-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAO/D;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,QAAwC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAG9B,CAAC;AAMF;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAwD7C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAuD,CAAC;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,EAAE,eAGtC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,IAAI,UAAU,CAqDrD"}
+{"version":3,"file":"token-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/middleware/token-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,KAAK,CAAC;AAE/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAO/D;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,QAAkC,CAAC;AA2ChE;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAG9B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,eAGjC,CAAC;AAgCF;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAoD7C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAiD,CAAC;AAEvF;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,EAAE,eAGtC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,eAGzC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,IAAI,UAAU,CA0DrD"}