@rayspec/auth-core 1.5.0

package/dist/errors.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Error envelope + the CLOSED ErrorCode enum.
+ *
+ * Every non-2xx response is `{ error: { code, message, requestId, details? } }` with a code from
+ * the closed enum below. A 404 for a cross-tenant/missing resource carries NO existence leak (the
+ * message is uniform). The HTTP status for each code is fixed by STATUS_BY_CODE.
+ */
+import { z } from 'zod';
+/** The CLOSED set of error codes the API can return. */
+export declare const ErrorCode: z.ZodEnum<{
+    VALIDATION_ERROR: "VALIDATION_ERROR";
+    UNAUTHENTICATED: "UNAUTHENTICATED";
+    FORBIDDEN: "FORBIDDEN";
+    NOT_FOUND: "NOT_FOUND";
+    CONFLICT: "CONFLICT";
+    IDEMPOTENCY_CONFLICT: "IDEMPOTENCY_CONFLICT";
+    PAYLOAD_TOO_LARGE: "PAYLOAD_TOO_LARGE";
+    RATE_LIMITED: "RATE_LIMITED";
+    INTERNAL: "INTERNAL";
+    UPSTREAM_ERROR: "UPSTREAM_ERROR";
+    NOT_IMPLEMENTED: "NOT_IMPLEMENTED";
+    GATEWAY_TIMEOUT: "GATEWAY_TIMEOUT";
+}>;
+export type ErrorCode = z.infer<typeof ErrorCode>;
+/** Fixed HTTP status per error code. */
+export declare const STATUS_BY_CODE: Record<ErrorCode, number>;
+/** The wire error envelope. */
+export declare const ErrorEnvelope: z.ZodObject<{
+    error: z.ZodObject<{
+        code: z.ZodEnum<{
+            VALIDATION_ERROR: "VALIDATION_ERROR";
+            UNAUTHENTICATED: "UNAUTHENTICATED";
+            FORBIDDEN: "FORBIDDEN";
+            NOT_FOUND: "NOT_FOUND";
+            CONFLICT: "CONFLICT";
+            IDEMPOTENCY_CONFLICT: "IDEMPOTENCY_CONFLICT";
+            PAYLOAD_TOO_LARGE: "PAYLOAD_TOO_LARGE";
+            RATE_LIMITED: "RATE_LIMITED";
+            INTERNAL: "INTERNAL";
+            UPSTREAM_ERROR: "UPSTREAM_ERROR";
+            NOT_IMPLEMENTED: "NOT_IMPLEMENTED";
+            GATEWAY_TIMEOUT: "GATEWAY_TIMEOUT";
+        }>;
+        message: z.ZodString;
+        requestId: z.ZodString;
+        details: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ErrorEnvelope = z.infer<typeof ErrorEnvelope>;
+/**
+ * A typed application error carrying an ErrorCode. Handlers/services throw this; the app's error
+ * handler maps it to the envelope + the fixed status. A generic 401/404 deliberately uses a
+ * uniform message so neither credential validity nor cross-tenant existence leaks.
+ */
+export declare class ApiError extends Error {
+    readonly code: ErrorCode;
+    readonly details?: unknown;
+    constructor(code: ErrorCode, message: string, details?: unknown);
+}
+/** Uniform 401 — never reveals whether the user/credential existed. */
+export declare function unauthenticated(): ApiError;
+/** Uniform 404 — never reveals whether the resource exists in another tenant. */
+export declare function notFound(): ApiError;
+/**
+ * 403 — authenticated but not permitted. `details` is included in the envelope ONLY when the caller
+ * supplies it (an authenticated scope/permission gap names the missing permission — see
+ * requirePermission); a 401/404 stays bare (uniform, no info leak) and existing callers that pass no
+ * `details` are byte-for-byte unchanged.
+ */
+export declare function forbidden(message?: string, details?: Record<string, unknown>): ApiError;
+/**
+ * The codes that may carry `details` out to the client — the ones whose `details` echoes
+ * caller-supplied INPUT context and leaks nothing about existence or credentials:
+ *   - VALIDATION_ERROR — the Zod issue set (a shape/validation echo of the caller's own body);
+ *   - FORBIDDEN — the named missing permission for an AUTHENTICATED scope/role gap;
+ *   - RATE_LIMITED — the retry hint (`retryAfterMs`);
+ *   - GATEWAY_TIMEOUT — the neutral run error class (`errorClass`).
+ * Every other code — notably the existence-leak-sensitive UNAUTHENTICATED (401) / NOT_FOUND (404) —
+ * MUST NOT emit `details`, so the envelope strips it structurally below regardless of what a caller
+ * passes. This makes the "a bare 401/404 leaks nothing" invariant STRUCTURAL at the one chokepoint
+ * every response flows through, not a per-call-site convention. It is behavior-preserving today: no
+ * code outside this set is ever thrown with a `details` payload.
+ */
+export declare const DETAILS_ALLOWED: ReadonlySet<ErrorCode>;
+/** Build the wire envelope for a code + message + requestId. Strips `details` for non-allowlisted codes. */
+export declare function errorEnvelope(code: ErrorCode, message: string, requestId: string, details?: unknown): ErrorEnvelope;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wDAAwD;AACxD,eAAO,MAAM,SAAS;;;;;;;;;;;;;EAapB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,wCAAwC;AACxC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAapD,CAAC;AAEF,+BAA+B;AAC/B,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;iBAOxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;GAIG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBACf,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAMhE;AAED,uEAAuE;AACvE,wBAAgB,eAAe,IAAI,QAAQ,CAE1C;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,IAAI,QAAQ,CAEnC;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,SAAe,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,CAE7F;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,SAAS,CAKjD,CAAC;AAEH,4GAA4G;AAC5G,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,GAChB,aAAa,CAGf"}

package/dist/errors.js

@@ -0,0 +1,104 @@
+/**
+ * Error envelope + the CLOSED ErrorCode enum.
+ *
+ * Every non-2xx response is `{ error: { code, message, requestId, details? } }` with a code from
+ * the closed enum below. A 404 for a cross-tenant/missing resource carries NO existence leak (the
+ * message is uniform). The HTTP status for each code is fixed by STATUS_BY_CODE.
+ */
+import { z } from 'zod';
+/** The CLOSED set of error codes the API can return. */
+export const ErrorCode = z.enum([
+    'VALIDATION_ERROR', // 400 — Zod / shape validation failed (defaultHook)
+    'UNAUTHENTICATED', // 401 — missing/invalid credential (uniform, no enumeration)
+    'FORBIDDEN', // 403 — authenticated but not permitted (live authz deny)
+    'NOT_FOUND', // 404 — missing OR cross-tenant (no existence leak)
+    'CONFLICT', // 409 — uniqueness / state conflict
+    'IDEMPOTENCY_CONFLICT', // 409 — same Idempotency-Key, different body
+    'PAYLOAD_TOO_LARGE', // 413 — request body exceeds the configured byte cap (rejected pre-side-effect)
+    'RATE_LIMITED', // 429 — rate limit / anti-DoS lock
+    'INTERNAL', // 500 — unexpected server error
+    'UPSTREAM_ERROR', // 502 — an upstream provider 5xx surfaced on a live run
+    'NOT_IMPLEMENTED', // 501 — reserved seam (WorkOS SSO stub)
+    'GATEWAY_TIMEOUT', // 504 — a held in-request run exceeded its wall-clock timeout
+]);
+/** Fixed HTTP status per error code. */
+export const STATUS_BY_CODE = {
+    VALIDATION_ERROR: 400,
+    UNAUTHENTICATED: 401,
+    FORBIDDEN: 403,
+    NOT_FOUND: 404,
+    CONFLICT: 409,
+    IDEMPOTENCY_CONFLICT: 409,
+    PAYLOAD_TOO_LARGE: 413,
+    RATE_LIMITED: 429,
+    INTERNAL: 500,
+    UPSTREAM_ERROR: 502,
+    NOT_IMPLEMENTED: 501,
+    GATEWAY_TIMEOUT: 504,
+};
+/** The wire error envelope. */
+export const ErrorEnvelope = z.object({
+    error: z.object({
+        code: ErrorCode,
+        message: z.string(),
+        requestId: z.string(),
+        details: z.unknown().optional(),
+    }),
+});
+/**
+ * A typed application error carrying an ErrorCode. Handlers/services throw this; the app's error
+ * handler maps it to the envelope + the fixed status. A generic 401/404 deliberately uses a
+ * uniform message so neither credential validity nor cross-tenant existence leaks.
+ */
+export class ApiError extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.name = 'ApiError';
+        this.code = code;
+        this.details = details;
+    }
+}
+/** Uniform 401 — never reveals whether the user/credential existed. */
+export function unauthenticated() {
+    return new ApiError('UNAUTHENTICATED', 'Authentication failed.');
+}
+/** Uniform 404 — never reveals whether the resource exists in another tenant. */
+export function notFound() {
+    return new ApiError('NOT_FOUND', 'Not found.');
+}
+/**
+ * 403 — authenticated but not permitted. `details` is included in the envelope ONLY when the caller
+ * supplies it (an authenticated scope/permission gap names the missing permission — see
+ * requirePermission); a 401/404 stays bare (uniform, no info leak) and existing callers that pass no
+ * `details` are byte-for-byte unchanged.
+ */
+export function forbidden(message = 'Forbidden.', details) {
+    return new ApiError('FORBIDDEN', message, details);
+}
+/**
+ * The codes that may carry `details` out to the client — the ones whose `details` echoes
+ * caller-supplied INPUT context and leaks nothing about existence or credentials:
+ *   - VALIDATION_ERROR — the Zod issue set (a shape/validation echo of the caller's own body);
+ *   - FORBIDDEN — the named missing permission for an AUTHENTICATED scope/role gap;
+ *   - RATE_LIMITED — the retry hint (`retryAfterMs`);
+ *   - GATEWAY_TIMEOUT — the neutral run error class (`errorClass`).
+ * Every other code — notably the existence-leak-sensitive UNAUTHENTICATED (401) / NOT_FOUND (404) —
+ * MUST NOT emit `details`, so the envelope strips it structurally below regardless of what a caller
+ * passes. This makes the "a bare 401/404 leaks nothing" invariant STRUCTURAL at the one chokepoint
+ * every response flows through, not a per-call-site convention. It is behavior-preserving today: no
+ * code outside this set is ever thrown with a `details` payload.
+ */
+export const DETAILS_ALLOWED = new Set([
+    'VALIDATION_ERROR',
+    'FORBIDDEN',
+    'RATE_LIMITED',
+    'GATEWAY_TIMEOUT',
+]);
+/** Build the wire envelope for a code + message + requestId. Strips `details` for non-allowlisted codes. */
+export function errorEnvelope(code, message, requestId, details) {
+    const emitDetails = details !== undefined && DETAILS_ALLOWED.has(code);
+    return { error: { code, message, requestId, ...(emitDetails ? { details } : {}) } };
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wDAAwD;AACxD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9B,kBAAkB,EAAE,oDAAoD;IACxE,iBAAiB,EAAE,6DAA6D;IAChF,WAAW,EAAE,0DAA0D;IACvE,WAAW,EAAE,oDAAoD;IACjE,UAAU,EAAE,oCAAoC;IAChD,sBAAsB,EAAE,6CAA6C;IACrE,mBAAmB,EAAE,gFAAgF;IACrG,cAAc,EAAE,mCAAmC;IACnD,UAAU,EAAE,gCAAgC;IAC5C,gBAAgB,EAAE,wDAAwD;IAC1E,iBAAiB,EAAE,wCAAwC;IAC3D,iBAAiB,EAAE,8DAA8D;CAClF,CAAC,CAAC;AAGH,wCAAwC;AACxC,MAAM,CAAC,MAAM,cAAc,GAA8B;IACvD,gBAAgB,EAAE,GAAG;IACrB,eAAe,EAAE,GAAG;IACpB,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,GAAG;IACb,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;IACtB,YAAY,EAAE,GAAG;IACjB,QAAQ,EAAE,GAAG;IACb,cAAc,EAAE,GAAG;IACnB,eAAe,EAAE,GAAG;IACpB,eAAe,EAAE,GAAG;CACrB,CAAC;AAEF,+BAA+B;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACH,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAY;IAChB,OAAO,CAAW;IAC3B,YAAY,IAAe,EAAE,OAAe,EAAE,OAAiB;QAC7D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;AACnE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,QAAQ;IACtB,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAO,GAAG,YAAY,EAAE,OAAiC;IACjF,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAA2B,IAAI,GAAG,CAAY;IACxE,kBAAkB;IAClB,WAAW;IACX,cAAc;IACd,iBAAiB;CAClB,CAAC,CAAC;AAEH,4GAA4G;AAC5G,MAAM,UAAU,aAAa,CAC3B,IAAe,EACf,OAAe,EACf,SAAiB,EACjB,OAAiB;IAEjB,MAAM,WAAW,GAAG,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;AACtF,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+export * from './api-key.js';
+export * from './audit.js';
+export * from './authz.js';
+export * from './config.js';
+export * from './deferrals.js';
+export * from './dto.js';
+export * from './email.js';
+export * from './errors.js';
+export * from './invite.js';
+export * from './password.js';
+export * from './rate-limit.js';
+export * from './session.js';
+export * from './tokens.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,14 @@
+export * from './api-key.js';
+export * from './audit.js';
+export * from './authz.js';
+export * from './config.js';
+export * from './deferrals.js';
+export * from './dto.js';
+export * from './email.js';
+export * from './errors.js';
+export * from './invite.js';
+export * from './password.js';
+export * from './rate-limit.js';
+export * from './session.js';
+export * from './tokens.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/invite.d.ts

@@ -0,0 +1,18 @@
+export interface MintedInviteToken {
+    /** The full plaintext invite token shown to the owner ONCE (conveyed out-of-band). Never stored. */
+    token: string;
+    /** The HMAC hash to persist (`invites.token_hash`). */
+    hash: string;
+}
+/**
+ * HMAC-SHA256 an invite token with the boot-required pepper (+ the `invite:` domain prefix); returns a
+ * lowercase hex digest. Deterministic, so the redeem path recomputes it and looks the invite up by an
+ * exact `token_hash` equality on the unique index.
+ */
+export declare function hashInviteToken(token: string, pepper?: string): string;
+/**
+ * Mint a new invite token: 32 bytes (256-bit) of CSPRNG, base64url-encoded (URL-safe). Returns the
+ * one-time plaintext token + the HMAC hash to store. The plaintext is shown EXACTLY ONCE at issue.
+ */
+export declare function mintInviteToken(pepper?: string): MintedInviteToken;
+//# sourceMappingURL=invite.d.ts.map

package/dist/invite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.d.ts","sourceRoot":"","sources":["../src/invite.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,iBAAiB;IAChC,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,MAA0B,GAAG,MAAM,CAEzF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,GAAE,MAA0B,GAAG,iBAAiB,CAGrF"}

package/dist/invite.js

@@ -0,0 +1,33 @@
+/**
+ * Invite-token primitive — the opaque out-of-band org-invite token + its HMAC storage hash.
+ *
+ * An invite token is a high-entropy (256-bit) bearer credential the org owner conveys OUT-OF-BAND to
+ * the invitee (core has no outbound mail). Only its HMAC-SHA256-with-pepper hash is persisted (never
+ * the plaintext); the redeem path recomputes the HMAC and looks the invite up by `token_hash` (a
+ * unique index) — the same "store a hash, resolve a bearer credential by its hash" pattern as the
+ * api-key + session paths. HMAC (not argon2id) is sound here: the token is machine-generated
+ * high-entropy, so a slow password KDF is unnecessary and the hot redeem path stays fast.
+ *
+ * The pepper is the shared server HMAC secret (`RAYSPEC_API_KEY_PEPPER`, boot-required). A DOMAIN
+ * PREFIX (`invite:`) is folded into the HMAC so an invite-token hash can never collide with an
+ * api-key hash even under the same pepper (domain separation).
+ */
+import { createHmac, randomBytes } from 'node:crypto';
+import { getApiKeyPepper } from './api-key.js';
+/**
+ * HMAC-SHA256 an invite token with the boot-required pepper (+ the `invite:` domain prefix); returns a
+ * lowercase hex digest. Deterministic, so the redeem path recomputes it and looks the invite up by an
+ * exact `token_hash` equality on the unique index.
+ */
+export function hashInviteToken(token, pepper = getApiKeyPepper()) {
+    return createHmac('sha256', pepper).update(`invite:${token}`).digest('hex');
+}
+/**
+ * Mint a new invite token: 32 bytes (256-bit) of CSPRNG, base64url-encoded (URL-safe). Returns the
+ * one-time plaintext token + the HMAC hash to store. The plaintext is shown EXACTLY ONCE at issue.
+ */
+export function mintInviteToken(pepper = getApiKeyPepper()) {
+    const token = randomBytes(32).toString('base64url'); // 256-bit, URL-safe
+    return { token, hash: hashInviteToken(token, pepper) };
+}
+//# sourceMappingURL=invite.js.map

package/dist/invite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.js","sourceRoot":"","sources":["../src/invite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAS/C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,SAAiB,eAAe,EAAE;IAC/E,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB,eAAe,EAAE;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB;IACzE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AACzD,CAAC"}

package/dist/password.d.ts

@@ -0,0 +1,17 @@
+/** OWASP-2024 argon2id parameters. Bump these to strengthen; old hashes still verify. */
+export declare const ARGON2ID_PARAMS: {
+    readonly type: 2;
+    readonly memoryCost: 19456;
+    readonly timeCost: 2;
+    readonly parallelism: 1;
+};
+/** Hash a plaintext password with argon2id (params embedded in the returned encoded hash). */
+export declare function hashPassword(plaintext: string): Promise<string>;
+/** Verify a plaintext password against an argon2id-encoded hash. Never throws on a mismatch. */
+export declare function verifyPassword(hash: string, plaintext: string): Promise<boolean>;
+/**
+ * Upgrade-on-login helper: true when `hash` was produced with weaker params than the current
+ * ARGON2ID_PARAMS, so the caller should transparently re-hash the (just-verified) password.
+ */
+export declare function needsRehash(hash: string): boolean;
+//# sourceMappingURL=password.d.ts.map

package/dist/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAcA,yFAAyF;AACzF,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAEX,8FAA8F;AAC9F,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE;AAED,gGAAgG;AAChG,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOtF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMjD"}

package/dist/password.js

@@ -0,0 +1,46 @@
+/**
+ * Password hashing primitive — argon2id, isolated behind hashPassword/verifyPassword so no
+ * call site touches the argon2 API directly (argon2id for low-entropy
+ * passwords). Verified live (doc-first, 2026-06-22) against argon2 0.44.0:
+ *   - argon2.argon2id === 2; hash(pw, {type, memoryCost, timeCost, parallelism}) returns an
+ *     encoded string with the params embedded ($argon2id$v=19$m=19456,t=2,p=1$...);
+ *   - verify(hash, pw) → boolean; needsRehash(hash, params) → true when params increased.
+ *
+ * Params are OWASP Password Storage Cheat Sheet (2024): argon2id, m=19 MiB, t=2, p=1.
+ * Because the params live INSIDE the hash, raising ARGON2ID_PARAMS later lets verify() keep
+ * accepting old hashes while needsRehash() flags them for an upgrade-on-login re-hash.
+ */
+import argon2 from 'argon2';
+/** OWASP-2024 argon2id parameters. Bump these to strengthen; old hashes still verify. */
+export const ARGON2ID_PARAMS = {
+    type: argon2.argon2id,
+    memoryCost: 19456, // 19 MiB, in KiB
+    timeCost: 2,
+    parallelism: 1,
+};
+/** Hash a plaintext password with argon2id (params embedded in the returned encoded hash). */
+export async function hashPassword(plaintext) {
+    return argon2.hash(plaintext, ARGON2ID_PARAMS);
+}
+/** Verify a plaintext password against an argon2id-encoded hash. Never throws on a mismatch. */
+export async function verifyPassword(hash, plaintext) {
+    try {
+        return await argon2.verify(hash, plaintext);
+    }
+    catch {
+        // A malformed/unrecognized hash is a verification failure, not a crash.
+        return false;
+    }
+}
+/**
+ * Upgrade-on-login helper: true when `hash` was produced with weaker params than the current
+ * ARGON2ID_PARAMS, so the caller should transparently re-hash the (just-verified) password.
+ */
+export function needsRehash(hash) {
+    return argon2.needsRehash(hash, {
+        memoryCost: ARGON2ID_PARAMS.memoryCost,
+        timeCost: ARGON2ID_PARAMS.timeCost,
+        parallelism: ARGON2ID_PARAMS.parallelism,
+    });
+}
+//# sourceMappingURL=password.js.map

package/dist/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC,QAAQ;IACrB,UAAU,EAAE,KAAK,EAAE,iBAAiB;IACpC,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE,CAAC;CACN,CAAC;AAEX,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;AACjD,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,SAAiB;IAClE,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QAC9B,UAAU,EAAE,eAAe,CAAC,UAAU;QACtC,QAAQ,EAAE,eAAe,CAAC,QAAQ;QAClC,WAAW,EAAE,eAAe,CAAC,WAAW;KACzC,CAAC,CAAC;AACL,CAAC"}

package/dist/rate-limit.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Rate limiter: credential-stuffing + argon2id-DoS + the refresh-reuse
+ * anti-DoS lock. In-process fixed-window counter NOW, behind a pluggable interface so a
+ * Redis/Postgres store can replace it later without touching call sites (deployment topology is
+ * not yet pinned — Open decisions).
+ */
+/** The store contract — swap in Redis/Postgres later. */
+export interface RateLimitStore {
+    /** Increment the counter for `key`, returning the new count. The window resets after windowMs. */
+    hit(key: string, windowMs: number): {
+        count: number;
+        resetAt: number;
+    };
+    /** Force a temporary lock for `key` until now+ms (the refresh-reuse anti-DoS lock). */
+    lock(key: string, ms: number): void;
+    /** True if `key` is currently locked. */
+    isLocked(key: string): boolean;
+    /** Reset a key (e.g. on a successful login). */
+    reset(key: string): void;
+}
+/**
+ * The default hard cap on the number of tracked (window / lock) keys. Bounds the store's memory so a
+ * flood of distinct keys (high-cardinality traffic) cannot grow it without limit — the OOM vector a
+ * never-pruned per-key Map otherwise carried. 100k keys is far above any single node's legitimate
+ * concurrent-source cardinality yet a trivial memory footprint.
+ */
+export declare const DEFAULT_MAX_RATE_LIMIT_ENTRIES = 100000;
+/**
+ * In-process store. NOT shared across processes — fine for single-node. BOUNDED + SELF-PRUNING: each
+ * time a new/expired window (or a lock) is (re)inserted at or above the cap, expired entries are swept
+ * and, if still full, the oldest are evicted — so the maps never exceed `maxEntries`. The clock is
+ * injectable (defaults to `Date.now`) so the expiry paths are deterministically testable.
+ */
+export declare class InMemoryRateLimitStore implements RateLimitStore {
+    private readonly windows;
+    private readonly locks;
+    private readonly maxEntries;
+    private readonly now;
+    constructor(maxEntries?: number, now?: () => number);
+    hit(key: string, windowMs: number): {
+        count: number;
+        resetAt: number;
+    };
+    lock(key: string, ms: number): void;
+    isLocked(key: string): boolean;
+    reset(key: string): void;
+    /** Clear ALL windows + locks (test isolation; not used on the hot path). */
+    clearAll(): void;
+    /** The number of tracked windows (observability + makes the max-size bound assertable). */
+    size(): number;
+    /**
+     * Bound `map` to `maxEntries`: a no-op until it reaches the cap, then sweep every entry whose
+     * `expiryOf(value) <= now` and — if still at/over the cap (all live) — evict the OLDEST-inserted
+     * (a Map iterates in insertion order, so the front is the oldest) until it is under the cap. Called
+     * only on the (re)insert path, so the steady-state hot path (incrementing a live counter) pays
+     * nothing.
+     */
+    private prune;
+}
+/** A named limit policy. */
+export interface RateLimitPolicy {
+    /** Max hits allowed within the window. */
+    max: number;
+    /** Window length in ms. */
+    windowMs: number;
+}
+/** Default per-route policies (tuneable). Keyed by a logical bucket name. */
+export declare const DEFAULT_POLICIES: Record<string, RateLimitPolicy>;
+/** Duration of the refresh-reuse anti-DoS lock (a stale token cannot be a repeatable DoS). */
+export declare const REUSE_LOCK_MS: number;
+/**
+ * The limiter facade used by the HTTP layer. `check(bucket, id)` returns whether the call is
+ * allowed; `lockSource`/`isLocked` back the refresh-reuse anti-DoS lock.
+ */
+export declare class RateLimiter {
+    private readonly store;
+    private readonly policies;
+    constructor(store?: RateLimitStore, policies?: Record<string, RateLimitPolicy>);
+    /** True if this (bucket,id) is within its rate budget AND not locked. */
+    check(bucket: string, id: string): {
+        allowed: boolean;
+        retryAfterMs: number;
+    };
+    /** Lock a source bucket (the refresh-reuse anti-DoS per-source lock). */
+    lockSource(bucket: string, id: string, ms?: number): void;
+    /** True if a source bucket is locked. */
+    isLocked(bucket: string, id: string): boolean;
+    /** Reset a bucket (e.g. on a successful authentication). */
+    reset(bucket: string, id: string): void;
+    /** Clear ALL state (test isolation). No-op if the store does not support it. */
+    clearAll(): void;
+}
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,kGAAkG;IAClG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,uFAAuF;IACvF,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,yCAAyC;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,gDAAgD;IAChD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAEtD;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,cAAc;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyD;IACjF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,UAAU,GAAE,MAAuC,EAAE,GAAG,GAAE,MAAM,MAAiB;IAK7F,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IActE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAMnC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAU9B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKxB,4EAA4E;IAC5E,QAAQ,IAAI,IAAI;IAKhB,2FAA2F;IAC3F,IAAI,IAAI,MAAM;IAId;;;;;;OAMG;IACH,OAAO,CAAC,KAAK;CAWd;AAED,4BAA4B;AAC5B,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAkB5D,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,aAAa,QAAa,CAAC;AAExC;;;GAGG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;gBAE/C,KAAK,GAAE,cAA6C,EAAE,QAAQ,kCAAmB;IAK7F,yEAAyE;IACzE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE;IAW7E,yEAAyE;IACzE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAgB,GAAG,IAAI;IAIhE,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAI7C,4DAA4D;IAC5D,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAIvC,gFAAgF;IAChF,QAAQ,IAAI,IAAI;CAGjB"}

package/dist/rate-limit.js

@@ -0,0 +1,156 @@
+/**
+ * Rate limiter: credential-stuffing + argon2id-DoS + the refresh-reuse
+ * anti-DoS lock. In-process fixed-window counter NOW, behind a pluggable interface so a
+ * Redis/Postgres store can replace it later without touching call sites (deployment topology is
+ * not yet pinned — Open decisions).
+ */
+/**
+ * The default hard cap on the number of tracked (window / lock) keys. Bounds the store's memory so a
+ * flood of distinct keys (high-cardinality traffic) cannot grow it without limit — the OOM vector a
+ * never-pruned per-key Map otherwise carried. 100k keys is far above any single node's legitimate
+ * concurrent-source cardinality yet a trivial memory footprint.
+ */
+export const DEFAULT_MAX_RATE_LIMIT_ENTRIES = 100_000;
+/**
+ * In-process store. NOT shared across processes — fine for single-node. BOUNDED + SELF-PRUNING: each
+ * time a new/expired window (or a lock) is (re)inserted at or above the cap, expired entries are swept
+ * and, if still full, the oldest are evicted — so the maps never exceed `maxEntries`. The clock is
+ * injectable (defaults to `Date.now`) so the expiry paths are deterministically testable.
+ */
+export class InMemoryRateLimitStore {
+    windows = new Map();
+    locks = new Map();
+    maxEntries;
+    now;
+    constructor(maxEntries = DEFAULT_MAX_RATE_LIMIT_ENTRIES, now = Date.now) {
+        this.maxEntries = Math.max(1, maxEntries);
+        this.now = now;
+    }
+    hit(key, windowMs) {
+        const now = this.now();
+        const cur = this.windows.get(key);
+        if (!cur || cur.resetAt <= now) {
+            // A NEW or expired key is about to (re)enter the map — the only growth path — so bound it here.
+            this.prune(this.windows, now, (v) => v.resetAt);
+            const fresh = { count: 1, resetAt: now + windowMs };
+            this.windows.set(key, fresh);
+            return fresh;
+        }
+        cur.count += 1;
+        return cur;
+    }
+    lock(key, ms) {
+        const now = this.now();
+        this.prune(this.locks, now, (until) => until);
+        this.locks.set(key, now + ms);
+    }
+    isLocked(key) {
+        const until = this.locks.get(key);
+        if (until === undefined)
+            return false;
+        if (until <= this.now()) {
+            this.locks.delete(key);
+            return false;
+        }
+        return true;
+    }
+    reset(key) {
+        this.windows.delete(key);
+        this.locks.delete(key);
+    }
+    /** Clear ALL windows + locks (test isolation; not used on the hot path). */
+    clearAll() {
+        this.windows.clear();
+        this.locks.clear();
+    }
+    /** The number of tracked windows (observability + makes the max-size bound assertable). */
+    size() {
+        return this.windows.size;
+    }
+    /**
+     * Bound `map` to `maxEntries`: a no-op until it reaches the cap, then sweep every entry whose
+     * `expiryOf(value) <= now` and — if still at/over the cap (all live) — evict the OLDEST-inserted
+     * (a Map iterates in insertion order, so the front is the oldest) until it is under the cap. Called
+     * only on the (re)insert path, so the steady-state hot path (incrementing a live counter) pays
+     * nothing.
+     */
+    prune(map, now, expiryOf) {
+        if (map.size < this.maxEntries)
+            return;
+        for (const [k, v] of map) {
+            if (expiryOf(v) <= now)
+                map.delete(k);
+        }
+        while (map.size >= this.maxEntries) {
+            const oldest = map.keys().next().value;
+            if (oldest === undefined)
+                break;
+            map.delete(oldest);
+        }
+    }
+}
+/** Default per-route policies (tuneable). Keyed by a logical bucket name. */
+export const DEFAULT_POLICIES = {
+    login: { max: 10, windowMs: 60_000 },
+    register: { max: 5, windowMs: 60_000 },
+    refresh: { max: 30, windowMs: 60_000 },
+    'oauth-token': { max: 30, windowMs: 60_000 },
+    // Session reprocess mints a FRESH durable run each call (dedup is deliberately bypassed), so an
+    // unthrottled caller can re-drive the same session's workflow without bound — a cost-DoS. Cap the
+    // reprocesses of one (tenant, session) per window; the route keys the bucket by `${tenant}:${session}`.
+    reprocess: { max: 5, windowMs: 60_000 },
+    // A manual trigger fire dispatches a declared action (agent run / handler). Within one firing-instant
+    // bucket a re-fire dedups, but distinct instants each dispatch — so an unthrottled caller could fire a
+    // named trigger repeatedly (a cost-DoS). Cap the fires of one (tenant, trigger) per window; the route
+    // keys the bucket by `${tenant}:${name}`.
+    'trigger-fire': { max: 30, windowMs: 60_000 },
+    // The invite-accept endpoint is UNAUTHENTICATED (a token bearer redeems) and can PROVISION an
+    // account, so throttle it per source IP to bound token-probing / account-creation abuse. The token
+    // is 256-bit (brute-force is infeasible regardless), but a per-source cap is cheap defense-in-depth.
+    'invite-accept': { max: 10, windowMs: 60_000 },
+};
+/** Duration of the refresh-reuse anti-DoS lock (a stale token cannot be a repeatable DoS). */
+export const REUSE_LOCK_MS = 5 * 60_000;
+/**
+ * The limiter facade used by the HTTP layer. `check(bucket, id)` returns whether the call is
+ * allowed; `lockSource`/`isLocked` back the refresh-reuse anti-DoS lock.
+ */
+export class RateLimiter {
+    store;
+    policies;
+    constructor(store = new InMemoryRateLimitStore(), policies = DEFAULT_POLICIES) {
+        this.store = store;
+        this.policies = policies;
+    }
+    /** True if this (bucket,id) is within its rate budget AND not locked. */
+    check(bucket, id) {
+        const key = `${bucket}:${id}`;
+        if (this.store.isLocked(key))
+            return { allowed: false, retryAfterMs: REUSE_LOCK_MS };
+        const policy = this.policies[bucket];
+        if (!policy)
+            return { allowed: true, retryAfterMs: 0 };
+        const { count, resetAt } = this.store.hit(key, policy.windowMs);
+        if (count > policy.max)
+            return { allowed: false, retryAfterMs: Math.max(0, resetAt - Date.now()) };
+        return { allowed: true, retryAfterMs: 0 };
+    }
+    /** Lock a source bucket (the refresh-reuse anti-DoS per-source lock). */
+    lockSource(bucket, id, ms = REUSE_LOCK_MS) {
+        this.store.lock(`${bucket}:${id}`, ms);
+    }
+    /** True if a source bucket is locked. */
+    isLocked(bucket, id) {
+        return this.store.isLocked(`${bucket}:${id}`);
+    }
+    /** Reset a bucket (e.g. on a successful authentication). */
+    reset(bucket, id) {
+        this.store.reset(`${bucket}:${id}`);
+    }
+    /** Clear ALL state (test isolation). No-op if the store does not support it. */
+    clearAll() {
+        if (this.store instanceof InMemoryRateLimitStore)
+            this.store.clearAll();
+    }
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAcH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IAChB,OAAO,GAAG,IAAI,GAAG,EAA8C,CAAC;IAChE,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClC,UAAU,CAAS;IACnB,GAAG,CAAe;IAEnC,YAAY,aAAqB,8BAA8B,EAAE,MAAoB,IAAI,CAAC,GAAG;QAC3F,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,QAAgB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/B,gGAAgG;YAChG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;YACpD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QACf,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC,GAAW,EAAE,EAAU;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAW;QACf,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,4EAA4E;IAC5E,QAAQ;QACN,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,2FAA2F;IAC3F,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAI,GAAmB,EAAE,GAAW,EAAE,QAA8B;QAC/E,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU;YAAE,OAAO;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;YACzB,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG;gBAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACvC,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAUD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAoC;IAC/D,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;IACpC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;IACtC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;IACtC,aAAa,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC5C,gGAAgG;IAChG,kGAAkG;IAClG,wGAAwG;IACxG,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;IACvC,sGAAsG;IACtG,uGAAuG;IACvG,sGAAsG;IACtG,0CAA0C;IAC1C,cAAc,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,8FAA8F;IAC9F,mGAAmG;IACnG,qGAAqG;IACrG,eAAe,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;CAC/C,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC;AAExC;;;GAGG;AACH,MAAM,OAAO,WAAW;IACL,KAAK,CAAiB;IACtB,QAAQ,CAAkC;IAE3D,YAAY,QAAwB,IAAI,sBAAsB,EAAE,EAAE,QAAQ,GAAG,gBAAgB;QAC3F,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,MAAc,EAAE,EAAU;QAC9B,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,EAAE,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,yEAAyE;IACzE,UAAU,CAAC,MAAc,EAAE,EAAU,EAAE,EAAE,GAAG,aAAa;QACvD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,yCAAyC;IACzC,QAAQ,CAAC,MAAc,EAAE,EAAU;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,MAAc,EAAE,EAAU;QAC9B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,gFAAgF;IAChF,QAAQ;QACN,IAAI,IAAI,CAAC,KAAK,YAAY,sBAAsB;YAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1E,CAAC;CACF"}