@sema-ai/registry-core 0.10.3

package/dist/api/auth.js

@@ -0,0 +1,204 @@
+/**
+ * `api/auth` — the /api/v1/auth/* WIRE CONTRACT (REGISTRY-REBUILD-DESIGN §2.1/§2.2, M1 shipped in
+ * sema-registry; this file freezes the shipped shapes so registry, orchestrator, service and the sema
+ * shell import ONE source of truth — design §3 "契约先行").
+ *
+ * The flow is RFC 8628 (OAuth 2.0 Device Authorization Grant) + a rotating opaque refresh token:
+ *
+ *   1. client  POST /api/v1/auth/device/code            → DeviceCodeResponse (device_code + user_code)
+ *   2. user    opens verification_uri (/activate) in ANY logged-in browser, approves the user_code
+ *              (GET/POST /api/v1/auth/device/approve — session-cookie-gated, consent screen)
+ *   3. client  POLLS POST /api/v1/auth/device/token every `interval` seconds
+ *              → 400 OAuthErrorResponse (authorization_pending / slow_down / expired_token / access_denied)
+ *              → 200 TokenGrantResponse exactly ONCE (the handshake row is consumed atomically)
+ *   4. client  silently renews via POST /api/v1/auth/token/refresh (refresh rotation: the presented
+ *              refresh token is single-use; a replay answers invalid_grant)
+ *   5. client  POST /api/v1/auth/logout revokes the refresh grant (RFC 7009 discipline: always 200 ok,
+ *              no token-existence disclosure)
+ *
+ * WIRE CASING: these are OAuth-standard endpoints — fields are snake_case ON THE WIRE (access_token,
+ * device_code, …), deliberately breaking this package's camelCase habit. Do not "fix" it.
+ *
+ * SECRET DISCIPLINE (registry side, informational for consumers): device_code and refresh_token are
+ * ≥256-bit opaque strings persisted ONLY as SHA-256 hashes; access_token is the standard issueSsoToken
+ * RS256 JWT (1h) — see `api/auth-bridge` for how a worker verifies it.
+ *
+ * Pure zod contract — zero IO, browser-safe, same rules as the rest of this package.
+ */
+import { z } from "zod";
+// ── endpoint paths + protocol constants (shipped values) ─────────────────────────────────────────────────
+/** The five auth endpoints, relative to the registry origin. */
+export const AUTH_V1_PATHS = {
+    deviceCode: "/api/v1/auth/device/code",
+    deviceToken: "/api/v1/auth/device/token",
+    deviceApprove: "/api/v1/auth/device/approve",
+    tokenRefresh: "/api/v1/auth/token/refresh",
+    logout: "/api/v1/auth/logout",
+};
+/** The RFC 8628 grant_type the device token endpoint requires. */
+export const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+/** Minimum seconds between token-endpoint polls (RFC 8628 `interval`); polling faster → `slow_down`. */
+export const DEVICE_POLL_INTERVAL_SECONDS = 5;
+/** Device-code handshake lifetime (seconds) — the user has 15 minutes to open /activate and approve. */
+export const DEVICE_CODE_TTL_SECONDS = 15 * 60;
+/** Access-token (RS256 JWT) lifetime in seconds — 1h, re-minted via refresh. */
+export const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
+/** Refresh-grant lifetime (seconds) — 30d SLIDING: every rotation opens a fresh 30d window. */
+export const REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
+// ── OAuth error envelope (RFC 6749 §5.2 / RFC 8628 §3.5) ─────────────────────────────────────────────────
+/** Every error code the /api/v1/auth/* endpoints answer (HTTP 400 unless noted). */
+export const OAUTH_ERROR_CODES = [
+    /** device/token: the user has not approved (or denied) the handshake yet — keep polling. */
+    "authorization_pending",
+    /** device/token: polling faster than `interval` — RFC 8628 §3.5: ADD 5 seconds to the interval. */
+    "slow_down",
+    /** device/token: handshake expired, unknown, or already exchanged — restart the flow.
+     *  (Deliberately covers "never existed": the server does not disclose handshake existence.) */
+    "expired_token",
+    /** device/token: the user explicitly denied the handshake — stop polling, do not restart silently. */
+    "access_denied",
+    /** any endpoint: malformed body / missing required field / wrong content type. */
+    "invalid_request",
+    /** device/token: grant_type is not DEVICE_GRANT_TYPE. */
+    "unsupported_grant_type",
+    /** token/refresh + device/approve: unknown / expired / revoked / replayed token or code — no detail. */
+    "invalid_grant",
+    /** SSO not configured on the registry (HTTP 503) — a deployment problem, not a client one. */
+    "server_error",
+];
+/** The uniform error body. `error_description` is HUMAN diagnostic text — clients branch on `error` only. */
+export const OAuthErrorResponse = z
+    .object({
+    error: z.enum(OAUTH_ERROR_CODES),
+    error_description: z.string().optional(),
+})
+    .passthrough();
+// ── POST /api/v1/auth/device/code ────────────────────────────────────────────────────────────────────────
+/** Unauthenticated by design (the client has no credentials yet). `client_name` is a NON-secret display
+ *  hint for the consent screen ("sema CLI on macOS"); absent → the server falls back to the User-Agent.
+ *  Body may be JSON or form-encoded; an empty body is legal. */
+export const DeviceCodeRequest = z
+    .object({
+    client_name: z.string().max(200).optional(),
+})
+    .passthrough();
+/** RFC 8628 §3.2 device-authorization response. `device_code` is the client's polling secret (keep it in
+ *  memory, never log it); `user_code` is the short human code ("XXXX-XXXX") the user approves. */
+export const DeviceCodeResponse = z
+    .object({
+    /** ≥256-bit opaque polling secret — returned ONCE, hash-persisted server-side. */
+    device_code: z.string().min(1),
+    /** Human approval code, canonical shape "XXXX-XXXX" (base-20 alphabet: no vowels, no 0/O/1/I). */
+    user_code: z.string().min(1),
+    /** The /activate page the user opens (any device, any logged-in browser). */
+    verification_uri: z.string().min(1),
+    /** verification_uri with ?user_code= pre-filled — one-click / QR path. */
+    verification_uri_complete: z.string().min(1),
+    /** Seconds until the handshake expires (DEVICE_CODE_TTL_SECONDS). */
+    expires_in: z.number().int().positive(),
+    /** Minimum seconds between polls (DEVICE_POLL_INTERVAL_SECONDS). */
+    interval: z.number().int().positive(),
+})
+    .passthrough();
+// ── POST /api/v1/auth/device/token (the poll) ────────────────────────────────────────────────────────────
+/** RFC 8628 §3.4 token request. Form or JSON. */
+export const DeviceTokenRequest = z
+    .object({
+    grant_type: z.literal(DEVICE_GRANT_TYPE),
+    device_code: z.string().min(1),
+})
+    .passthrough();
+/** The ONE token success shape — shared by device/token AND token/refresh (both mint through the same
+ *  exit: access = issueSsoToken RS256 JWT, refresh = fresh opaque rotating grant). */
+export const TokenGrantResponse = z
+    .object({
+    /** RS256 JWT — claims: sub (principal), iss, iat, exp, role; optional aud. Verify per api/auth-bridge. */
+    access_token: z.string().min(1),
+    /** NEW opaque rotating refresh token — replaces any previous one the client held. Store 0600/keychain. */
+    refresh_token: z.string().min(1),
+    token_type: z.literal("Bearer"),
+    /** Access-token lifetime in seconds (ACCESS_TOKEN_TTL_SECONDS). */
+    expires_in: z.number().int().positive(),
+})
+    .passthrough();
+// ── POST /api/v1/auth/token/refresh ──────────────────────────────────────────────────────────────────────
+/** Rotation is STRICT single-use: success revokes the presented grant and returns a NEW refresh_token;
+ *  a replayed (or raced) old token answers `invalid_grant`. Clients MUST persist the new token before
+ *  discarding the old request state. */
+export const TokenRefreshRequest = z
+    .object({
+    refresh_token: z.string().min(1),
+})
+    .passthrough();
+// success = TokenGrantResponse; failure = OAuthErrorResponse (invalid_grant | invalid_request)
+// ── POST /api/v1/auth/logout ─────────────────────────────────────────────────────────────────────────────
+/** Revoke the refresh grant. The already-minted access JWT stays valid until its 1h exp — revocation kills
+ *  the RENEWAL path, which is the durable one. */
+export const LogoutRequest = z
+    .object({
+    refresh_token: z.string().min(1),
+})
+    .passthrough();
+/** Always `{ok:true}` with HTTP 200 whether or not the token matched a live grant (RFC 7009: a revocation
+ *  endpoint never discloses token existence). 400 only for a malformed request. */
+export const LogoutResponse = z.object({ ok: z.literal(true) }).passthrough();
+// ── GET/POST /api/v1/auth/device/approve (the /activate consent action — session-cookie-gated) ───────────
+/** Handshake states a consent-screen lookup can see. (`approved` rows vanish once exchanged/consumed.)
+ *  `denied` is contract-reserved for an explicit deny button (pairs with the `access_denied` poll error);
+ *  the shipped M1 store carries pending|approved only — adding deny later is implementation, not schema. */
+export const DEVICE_AUTH_STATUSES = ["pending", "approved", "denied"];
+/** GET ?user_code=XXXX-XXXX — the consent screen's lookup, WITHOUT approving. 401 when not signed in;
+ *  invalid_grant for an unknown/expired code. */
+export const DeviceApproveLookupResponse = z
+    .object({
+    user_code: z.string().min(1),
+    status: z.enum(DEVICE_AUTH_STATUSES),
+    /** The client_name/User-Agent display hint from device/code — null when the client sent none. */
+    client: z.string().nullable(),
+    /** Handshake expiry, epoch MILLISECONDS. */
+    expires_at: z.number(),
+})
+    .passthrough();
+/** POST body (JSON ONLY — the JSON content type is part of the cross-site-request defence; a cross-site
+ *  form cannot send application/json without a CORS preflight). The approving identity comes from the
+ *  session cookie exclusively — NEVER from this body. */
+export const DeviceApproveRequest = z
+    .object({
+    /** Case-insensitive; dashes/spaces optional — see normalizeUserCode. */
+    user_code: z.string().min(1),
+})
+    .passthrough();
+export const DeviceApproveResponse = z
+    .object({
+    ok: z.literal(true),
+    user_code: z.string().min(1),
+})
+    .passthrough();
+// ── pure client-side helpers ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Canonicalize a human-typed user code to the wire shape "XXXX-XXXX": uppercase, dashes/spaces optional.
+ * null = not a plausible code (wrong length/charset after stripping separators). Same normalization the
+ * server applies — run it client-side for instant feedback.
+ */
+export function normalizeUserCode(input) {
+    if (typeof input !== "string")
+        return null;
+    const raw = input.toUpperCase().replace(/[\s-]/g, "");
+    if (!/^[A-Z0-9]{8}$/.test(raw))
+        return null;
+    return `${raw.slice(0, 4)}-${raw.slice(4)}`;
+}
+/**
+ * The RFC 8628 §3.5 poll-loop step: what interval to poll with next, and whether to keep going.
+ * - authorization_pending → keep polling at the current interval
+ * - slow_down             → keep polling, interval + 5s (the RFC-mandated increment)
+ * - anything else         → stop (expired_token/access_denied = terminal; invalid_* = client bug)
+ */
+export function nextPollInterval(currentIntervalSeconds, error) {
+    if (error === "authorization_pending")
+        return { continue: true, intervalSeconds: currentIntervalSeconds };
+    if (error === "slow_down")
+        return { continue: true, intervalSeconds: currentIntervalSeconds + 5 };
+    return { continue: false, intervalSeconds: currentIntervalSeconds };
+}
+//# sourceMappingURL=auth.js.map

package/dist/api/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4GAA4G;AAE5G,gEAAgE;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,UAAU,EAAE,0BAA0B;IACtC,WAAW,EAAE,2BAA2B;IACxC,aAAa,EAAE,6BAA6B;IAC5C,YAAY,EAAE,4BAA4B;IAC1C,MAAM,EAAE,qBAAqB;CACrB,CAAC;AAEX,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AAChF,wGAAwG;AACxG,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAC9C,wGAAwG;AACxG,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC;AAC/C,gFAAgF;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAChD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE3D,4GAA4G;AAE5G,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,4FAA4F;IAC5F,uBAAuB;IACvB,mGAAmG;IACnG,WAAW;IACX;mGAC+F;IAC/F,eAAe;IACf,sGAAsG;IACtG,eAAe;IACf,kFAAkF;IAClF,iBAAiB;IACjB,yDAAyD;IACzD,wBAAwB;IACxB,wGAAwG;IACxG,eAAe;IACf,8FAA8F;IAC9F,cAAc;CACN,CAAC;AAGX,6GAA6G;AAC7G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAChC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB,4GAA4G;AAE5G;;gEAEgE;AAChE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB;kGACkG;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,kGAAkG;IAClG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,6EAA6E;IAC7E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,0EAA0E;IAC1E,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,qEAAqE;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB,4GAA4G;AAE5G,iDAAiD;AACjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB;sFACsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,0GAA0G;IAC1G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,0GAA0G;IAC1G,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,mEAAmE;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB,4GAA4G;AAE5G;;wCAEwC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,+FAA+F;AAE/F,4GAA4G;AAE5G;kDACkD;AAClD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB;mFACmF;AACnF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAG9E,4GAA4G;AAE5G;;4GAE4G;AAC5G,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAC;AAG/E;iDACiD;AACjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACpC,iGAAiG;IACjG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,4CAA4C;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB;;yDAEyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,wEAAwE;IACxE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB,4GAA4G;AAE5G;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,sBAA8B,EAC9B,KAAqB;IAErB,IAAI,KAAK,KAAK,uBAAuB;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC;IAC1G,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,sBAAsB,GAAG,CAAC,EAAE,CAAC;IAClG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC;AACtE,CAAC"}

package/dist/api/scopes.d.ts

@@ -0,0 +1,353 @@
+/**
+ * `api/scopes` — the MULTI-TENANT SCOPE wire contract for the registry (/api/v1/scopes* +
+ * /api/v1/auth/scope). Frozen here so sema-registry (the implementation), the orchestrator, workers and
+ * the sema shell import ONE source of truth — same "契约先行" discipline as `api/auth`.
+ *
+ * THE SCOPE MODEL (normative — the registry implements EXACTLY this):
+ *
+ *  - A **scope** is a tenant boundary: `{id, name, createdAt}`. `id` is a slug (SCOPE_ID_REGEX).
+ *    The reserved id `"global"` (GLOBAL_SCOPE) is the DEFAULT scope: it always exists, is never
+ *    created via the API (ScopeCreateRequest rejects it) and is never deleted.
+ *  - **Membership** is per-scope: `{scopeId, principal, role}` where role is the existing 4-level
+ *    RBAC ladder (viewer < editor < publisher < admin). The SAME principal may be `editor` in scope A
+ *    and `viewer` in scope B.
+ *  - The **instance-level** `users.role` is unchanged and orthogonal: an instance `admin` administers
+ *    ALL scopes — inside any scope their effective role is always `"admin"` (see effectiveScopeRole).
+ *  - The **access JWT** gains an OPTIONAL `scope` claim (SCOPE_CLAIM) binding the token to its active
+ *    scope. A token WITHOUT the claim means `"global"` (tokenScopeOf) — full backward compatibility:
+ *    every pre-scope token keeps working, scoped to global. The refresh token is NOT scope-bound;
+ *    refresh re-mints per resolveTokenScope, and the client re-switches if it wants another scope.
+ *
+ * ENDPOINTS (paths in SCOPES_V1_PATHS / scopeMembersPath):
+ *
+ *   GET    /api/v1/scopes                → ScopesListResponse {scopes:[{id,name,role}]} — the CALLER's
+ *          scopes with their per-scope effective role (instance admin sees ALL scopes, role "admin").
+ *   POST   /api/v1/auth/scope            → switch active scope: ScopeSwitchRequest {scope} →
+ *          ScopeSwitchResponse {access_token, token_type:"Bearer", expires_in, scope, role}; errors are
+ *          OAuth-style OAuthErrorResponse (`invalid_request` = malformed / unknown scope shape,
+ *          `access_denied` = caller is not a member and not an instance admin — canSwitchScope).
+ *          Auth: a valid access token (any scope). Mints a NEW access token bound to `scope`; the
+ *          caller's refresh grant is untouched.
+ *   POST   /api/v1/scopes                → create a scope (instance admin only): ScopeCreateRequest
+ *          {id,name} → ScopeCreateResponse (the created Scope).
+ *   PUT    /api/v1/scopes/{id}/members   → upsert a member (instance admin only): ScopeMemberUpsertRequest
+ *          {principal, role} → ScopeMemberUpsertResponse (the stored membership row).
+ *   DELETE /api/v1/scopes/{id}/members   → remove a member (instance admin only): ScopeMemberDeleteRequest
+ *          {principal} → ScopeMemberDeleteResponse {ok:true} (idempotent — removing a non-member is 200).
+ *
+ * WIRE CASING: /api/v1/auth/scope is part of the OAuth face — snake_case on the wire (access_token,
+ * expires_in), matching `api/auth`. The /api/v1/scopes management face uses this package's camelCase
+ * (createdAt, scopeId) — it is a registry management API, not an OAuth endpoint.
+ *
+ * Pure zod contract + pure decision functions — zero IO, browser-safe. The decision functions
+ * (resolveTokenScope / canSwitchScope / effectiveScopeRole) are THE semantics: the registry
+ * implementation imports and calls these — it must not re-implement them.
+ */
+import { z } from "zod";
+import { type UserRole } from "../config-fns.js";
+/** The reserved default scope. Always exists; every token without a `scope` claim lives here. */
+export declare const GLOBAL_SCOPE = "global";
+/** Scope ids that can never be created (or deleted) through the API. */
+export declare const RESERVED_SCOPE_IDS: readonly ["global"];
+/** Slug shape for scope ids: lowercase alphanumeric + inner dashes, 1–64 chars, no leading/trailing dash. */
+export declare const SCOPE_ID_REGEX: RegExp;
+/** The scope endpoints, relative to the registry origin. `members` needs the scope id — use scopeMembersPath. */
+export declare const SCOPES_V1_PATHS: {
+    /** GET (list) + POST (create). */
+    readonly scopes: "/api/v1/scopes";
+    /** POST — mint a new access token bound to another scope. */
+    readonly authScope: "/api/v1/auth/scope";
+};
+/** The JWT claim carrying the token's active scope. OPTIONAL — absent means GLOBAL_SCOPE (tokenScopeOf). */
+export declare const SCOPE_CLAIM = "scope";
+/** `/api/v1/scopes/{id}/members` for PUT (upsert) and DELETE (remove). */
+export declare function scopeMembersPath(scopeId: string): string;
+/** True for ids the API refuses to create/delete ("global"). */
+export declare function isReservedScopeId(id: string): boolean;
+/** A scope id on the wire — slug-validated. (The reserved "global" IS a valid ScopeId: it exists as an
+ *  entity everywhere except the create endpoint.) */
+export declare const ScopeId: z.ZodString;
+export type ScopeId = z.infer<typeof ScopeId>;
+/** The per-scope role ladder = the existing instance RBAC ladder (viewer < editor < publisher < admin). */
+export declare const ScopeRole: z.ZodEnum<[UserRole, ...UserRole[]]>;
+export type ScopeRole = UserRole;
+/** The scope entity. */
+export declare const Scope: z.ZodObject<{
+    id: z.ZodString;
+    /** Human display name (non-unique, non-secret). */
+    name: z.ZodString;
+    /** Creation time, epoch MILLISECONDS. The reserved "global" scope reports its provisioning time. */
+    createdAt: z.ZodNumber;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    id: z.ZodString;
+    /** Human display name (non-unique, non-secret). */
+    name: z.ZodString;
+    /** Creation time, epoch MILLISECONDS. The reserved "global" scope reports its provisioning time. */
+    createdAt: z.ZodNumber;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    id: z.ZodString;
+    /** Human display name (non-unique, non-secret). */
+    name: z.ZodString;
+    /** Creation time, epoch MILLISECONDS. The reserved "global" scope reports its provisioning time. */
+    createdAt: z.ZodNumber;
+}, z.ZodTypeAny, "passthrough">>;
+export type Scope = z.infer<typeof Scope>;
+/** One membership row: `principal` holds `role` inside `scopeId`. Per-scope — the same principal may
+ *  hold different roles in different scopes. */
+export declare const ScopeMember: z.ZodObject<{
+    scopeId: z.ZodString;
+    /** The user identity — same principal string the JWT `sub` / x-agent-principal pipeline uses. */
+    principal: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    scopeId: z.ZodString;
+    /** The user identity — same principal string the JWT `sub` / x-agent-principal pipeline uses. */
+    principal: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    scopeId: z.ZodString;
+    /** The user identity — same principal string the JWT `sub` / x-agent-principal pipeline uses. */
+    principal: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, z.ZodTypeAny, "passthrough">>;
+export type ScopeMember = z.infer<typeof ScopeMember>;
+/** One list entry: a scope the caller can act in, with the caller's EFFECTIVE role there
+ *  (effectiveScopeRole — instance admins list every scope with role "admin"). */
+export declare const ScopeListEntry: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    id: z.ZodString;
+    name: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    id: z.ZodString;
+    name: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, z.ZodTypeAny, "passthrough">>;
+export type ScopeListEntry = z.infer<typeof ScopeListEntry>;
+export declare const ScopesListResponse: z.ZodObject<{
+    scopes: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        id: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        id: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+    }, z.ZodTypeAny, "passthrough">>, "many">;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    scopes: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        id: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        id: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+    }, z.ZodTypeAny, "passthrough">>, "many">;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    scopes: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        id: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        id: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+    }, z.ZodTypeAny, "passthrough">>, "many">;
+}, z.ZodTypeAny, "passthrough">>;
+export type ScopesListResponse = z.infer<typeof ScopesListResponse>;
+/** Request: the target scope. Errors: `invalid_request` (malformed), `access_denied` (not a member and
+ *  not an instance admin — canSwitchScope false). */
+export declare const ScopeSwitchRequest: z.ZodObject<{
+    scope: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    scope: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    scope: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>;
+export type ScopeSwitchRequest = z.infer<typeof ScopeSwitchRequest>;
+/** A fresh access token bound to the requested scope (`scope` claim = `scope` field below). The refresh
+ *  grant is untouched — this endpoint never returns a refresh_token. `role` = the caller's effective role
+ *  inside the new scope (effectiveScopeRole). */
+export declare const ScopeSwitchResponse: z.ZodObject<{
+    /** RS256 JWT with the `scope` claim set — verify per api/auth-bridge; VerifiedIdentity.scope carries it. */
+    access_token: z.ZodString;
+    token_type: z.ZodLiteral<"Bearer">;
+    /** Access-token lifetime in seconds (ACCESS_TOKEN_TTL_SECONDS — same mint as api/auth). */
+    expires_in: z.ZodNumber;
+    scope: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** RS256 JWT with the `scope` claim set — verify per api/auth-bridge; VerifiedIdentity.scope carries it. */
+    access_token: z.ZodString;
+    token_type: z.ZodLiteral<"Bearer">;
+    /** Access-token lifetime in seconds (ACCESS_TOKEN_TTL_SECONDS — same mint as api/auth). */
+    expires_in: z.ZodNumber;
+    scope: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** RS256 JWT with the `scope` claim set — verify per api/auth-bridge; VerifiedIdentity.scope carries it. */
+    access_token: z.ZodString;
+    token_type: z.ZodLiteral<"Bearer">;
+    /** Access-token lifetime in seconds (ACCESS_TOKEN_TTL_SECONDS — same mint as api/auth). */
+    expires_in: z.ZodNumber;
+    scope: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, z.ZodTypeAny, "passthrough">>;
+export type ScopeSwitchResponse = z.infer<typeof ScopeSwitchResponse>;
+/** Re-exported convenience: the switch endpoint mints through the SAME exit as api/auth (1h JWT). */
+export declare const SCOPE_SWITCH_TOKEN_TTL_SECONDS: number;
+/** Reserved ids ("global") are rejected AT THE SCHEMA — the default scope pre-exists and is not creatable. */
+export declare const ScopeCreateRequest: z.ZodObject<{
+    id: z.ZodEffects<z.ZodString, string, string>;
+    name: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    id: z.ZodEffects<z.ZodString, string, string>;
+    name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    id: z.ZodEffects<z.ZodString, string, string>;
+    name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>;
+export type ScopeCreateRequest = z.infer<typeof ScopeCreateRequest>;
+/** The created scope, as stored. */
+export declare const ScopeCreateResponse: z.ZodObject<{
+    id: z.ZodString;
+    /** Human display name (non-unique, non-secret). */
+    name: z.ZodString;
+    /** Creation time, epoch MILLISECONDS. The reserved "global" scope reports its provisioning time. */
+    createdAt: z.ZodNumber;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    id: z.ZodString;
+    /** Human display name (non-unique, non-secret). */
+    name: z.ZodString;
+    /** Creation time, epoch MILLISECONDS. The reserved "global" scope reports its provisioning time. */
+    createdAt: z.ZodNumber;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    id: z.ZodString;
+    /** Human display name (non-unique, non-secret). */
+    name: z.ZodString;
+    /** Creation time, epoch MILLISECONDS. The reserved "global" scope reports its provisioning time. */
+    createdAt: z.ZodNumber;
+}, z.ZodTypeAny, "passthrough">>;
+export type ScopeCreateResponse = Scope;
+/** PUT body — upsert: sets `principal`'s role in the path scope, creating or replacing the row. */
+export declare const ScopeMemberUpsertRequest: z.ZodObject<{
+    principal: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    principal: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    principal: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, z.ZodTypeAny, "passthrough">>;
+export type ScopeMemberUpsertRequest = z.infer<typeof ScopeMemberUpsertRequest>;
+/** The stored membership row (scopeId echoes the path). */
+export declare const ScopeMemberUpsertResponse: z.ZodObject<{
+    scopeId: z.ZodString;
+    /** The user identity — same principal string the JWT `sub` / x-agent-principal pipeline uses. */
+    principal: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    scopeId: z.ZodString;
+    /** The user identity — same principal string the JWT `sub` / x-agent-principal pipeline uses. */
+    principal: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    scopeId: z.ZodString;
+    /** The user identity — same principal string the JWT `sub` / x-agent-principal pipeline uses. */
+    principal: z.ZodString;
+    role: z.ZodEnum<[UserRole, ...UserRole[]]>;
+}, z.ZodTypeAny, "passthrough">>;
+export type ScopeMemberUpsertResponse = ScopeMember;
+/** DELETE body — remove `principal` from the path scope. */
+export declare const ScopeMemberDeleteRequest: z.ZodObject<{
+    principal: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    principal: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    principal: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>;
+export type ScopeMemberDeleteRequest = z.infer<typeof ScopeMemberDeleteRequest>;
+/** Idempotent: `{ok:true}` whether or not the principal was a member (no membership disclosure beyond
+ *  what the admin caller already sees). */
+export declare const ScopeMemberDeleteResponse: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    ok: z.ZodLiteral<true>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    ok: z.ZodLiteral<true>;
+}, z.ZodTypeAny, "passthrough">>;
+export type ScopeMemberDeleteResponse = z.infer<typeof ScopeMemberDeleteResponse>;
+/** A membership as the decision functions see it (a projection of ScopeMember). */
+export interface ScopeMembershipInput {
+    scopeId: string;
+    role: UserRole;
+}
+/** What token minting resolved: the scope to stamp into the `scope` claim + the `role` claim value. */
+export interface ResolvedTokenScope {
+    scope: string;
+    role: string;
+}
+/**
+ * THE instance-admin override rule, in one place:
+ *
+ *   **An instance `admin`'s effective role inside ANY scope is always `"admin"`** — regardless of whether
+ *   they hold a membership there or what that membership says. For everyone else the effective role is
+ *   exactly their membership role (`membershipRole`), and `undefined` when they have no membership.
+ *
+ * `instanceRole` is the instance-level users.role string; only the exact value `"admin"` triggers the
+ * override (publisher/editor/viewer at instance level grant NO cross-scope power).
+ */
+export declare function effectiveScopeRole(membershipRole: UserRole | undefined, instanceRole: string): UserRole | undefined;
+/**
+ * THE token-minting scope decision — which scope (and role claim) a fresh access token binds to, given
+ * the principal's scope memberships and instance role. Deterministic; the registry (Node/Next) imports
+ * and calls this at every mint (device-flow grant AND refresh). NORMATIVE RULES (verbatim, 任务书拍定):
+ *
+ *   1. **唯一成员 scope** — exactly one membership → bind that scope, role = that membership's effective
+ *      role (effectiveScopeRole: instance admin ⇒ "admin").
+ *   2. **多个含 global** — multiple memberships, one of them "global" → bind "global", role = the global
+ *      membership's effective role.
+ *   3. **多个不含 global** — multiple memberships, none "global" → bind the scope whose id is FIRST in
+ *      lexicographic (UTF-16 code-unit) order — deterministic, no wall-clock/insertion-order dependence;
+ *      role = that membership's effective role.
+ *   4. **零成员** — no memberships → `{scope: "global", role: instanceRole}` (the instance role IS the
+ *      role claim, exactly as pre-scope tokens behaved — full backward compatibility).
+ *
+ * Duplicate scopeIds in the input: the entry that sorts first (by scopeId, then by role string) wins —
+ * callers should not pass duplicates, but the function stays deterministic if they do.
+ */
+export declare function resolveTokenScope(memberships: readonly ScopeMembershipInput[], instanceRole: string): ResolvedTokenScope;
+/**
+ * THE scope-switch authorization decision (POST /api/v1/auth/scope): allowed ⇔ the caller is a MEMBER of
+ * `targetScope` (any role) OR an instance `admin` (who may enter any scope, including ones they are not
+ * a member of — their effective role there is "admin" per effectiveScopeRole). Everyone else →
+ * `access_denied`. Note: "global" gets NO special-case here — a multi-scope user without a global
+ * membership cannot switch to global (their default mint never lands there either, rule 3 above).
+ */
+export declare function canSwitchScope(memberships: readonly ScopeMembershipInput[], instanceRole: string, targetScope: string): boolean;
+/**
+ * Read the active scope off verified JWT claims: a non-empty string `scope` claim, else GLOBAL_SCOPE.
+ * This is the ONE place the "missing claim = global" backward-compat rule lives — workers and the
+ * registry both call this instead of defaulting ad hoc.
+ */
+export declare function tokenScopeOf(claims: {
+    scope?: unknown;
+}): string;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/api/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/api/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAK7D,iGAAiG;AACjG,eAAO,MAAM,YAAY,WAAW,CAAC;AAErC,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,qBAA0B,CAAC;AAE1D,6GAA6G;AAC7G,eAAO,MAAM,cAAc,QAA2C,CAAC;AAEvE,iHAAiH;AACjH,eAAO,MAAM,eAAe;IAC1B,kCAAkC;;IAElC,6DAA6D;;CAErD,CAAC;AAEX,4GAA4G;AAC5G,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAErD;AAID;qDACqD;AACrD,eAAO,MAAM,OAAO,aAAmG,CAAC;AACxH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,2GAA2G;AAC3G,eAAO,MAAM,SAAS,sCAAkD,CAAC;AACzE,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC;AAEjC,wBAAwB;AACxB,eAAO,MAAM,KAAK;;IAGd,mDAAmD;;IAEnD,oGAAoG;;;;IAFpG,mDAAmD;;IAEnD,oGAAoG;;;;IAFpG,mDAAmD;;IAEnD,oGAAoG;;gCAGxF,CAAC;AACjB,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAE1C;gDACgD;AAChD,eAAO,MAAM,WAAW;;IAGpB,iGAAiG;;;;;IAAjG,iGAAiG;;;;;IAAjG,iGAAiG;;;gCAIrF,CAAC;AACjB,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAItD;iFACiF;AACjF,eAAO,MAAM,cAAc;;;;;;;;;;;;gCAMX,CAAC;AACjB,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAA8D,CAAC;AAC9F,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE;qDACqD;AACrD,eAAO,MAAM,kBAAkB;;;;;;gCAIf,CAAC;AACjB,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;iDAEiD;AACjD,eAAO,MAAM,mBAAmB;IAE5B,4GAA4G;;;IAG5G,2FAA2F;;;;;IAH3F,4GAA4G;;;IAG5G,2FAA2F;;;;;IAH3F,4GAA4G;;;IAG5G,2FAA2F;;;;gCAK/E,CAAC;AACjB,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,qGAAqG;AACrG,eAAO,MAAM,8BAA8B,QAA2B,CAAC;AAIvE,8GAA8G;AAC9G,eAAO,MAAM,kBAAkB;;;;;;;;;gCAKf,CAAC;AACjB,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,oCAAoC;AACpC,eAAO,MAAM,mBAAmB;;IA9E5B,mDAAmD;;IAEnD,oGAAoG;;;;IAFpG,mDAAmD;;IAEnD,oGAAoG;;;;IAFpG,mDAAmD;;IAEnD,oGAAoG;;gCA4EhE,CAAC;AACzC,MAAM,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAIxC,mGAAmG;AACnG,eAAO,MAAM,wBAAwB;;;;;;;;;gCAKrB,CAAC;AACjB,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,2DAA2D;AAC3D,eAAO,MAAM,yBAAyB;;IAhFlC,iGAAiG;;;;;IAAjG,iGAAiG;;;;;IAAjG,iGAAiG;;;gCAgFjD,CAAC;AACrD,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAEpD,4DAA4D;AAC5D,eAAO,MAAM,wBAAwB;;;;;;gCAIrB,CAAC;AACjB,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;2CAC2C;AAC3C,eAAO,MAAM,yBAAyB;;;;;;gCAAkD,CAAC;AACzF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAIlF,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,uGAAuG;AACvG,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,QAAQ,GAAG,SAAS,EACpC,YAAY,EAAE,MAAM,GACnB,QAAQ,GAAG,SAAS,CAGtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,YAAY,EAAE,MAAM,GACnB,kBAAkB,CAcpB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAGT;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAEhE"}