@sixb/core 0.0.1

package/dist/auth/strategy.js.map

@@ -0,0 +1,9 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [
+  ],
+  "mappings": "",
+  "debugId": "4DB4B0F784B2311464756E2164756E21",
+  "names": []
+}

package/dist/auth/types.d.ts

@@ -0,0 +1,460 @@
+import type { GroupDefinition, GroupReference, MembershipOperation } from "../security";
+import type { AccessTokenRecord, AuthStorage, CompleteAuthSessionInput, CompleteSignInResult, InvitationRecord, InvitationStatus, ServiceAccountGroupMembershipRecord, ServiceAccountRecord, SessionRecord, UserRecord } from "../storage/auth";
+import type { AuthSessionAudience, AuthSessionAudienceOptions } from "./audience";
+export type Principal = {
+    readonly type: "user";
+    readonly id: string;
+} | {
+    readonly type: "serviceAccount";
+    readonly id: string;
+} | {
+    readonly type: "system";
+    readonly id: string;
+};
+/**
+ * The canonical principal for system-originated writes (runs triggered without a caller,
+ * worker fallbacks, decode-time defaults). Import this everywhere instead of inlining a
+ * `{ type: "system", id: "system" }` literal so the system identity never forks.
+ */
+export declare const SYSTEM_PRINCIPAL: Principal;
+/** Structural equality for principals (same type and id). */
+export declare function principalsEqual(left: Principal, right: Principal): boolean;
+export interface SecurityContext {
+    readonly principal: Principal;
+    readonly sessionId?: string;
+    readonly projectId: string;
+    readonly correlationId: string;
+}
+export type AuthStrategyKind = "magicLink" | "oidc" | "dev" | "disabled";
+export interface AuthStrategy {
+    readonly id: string;
+    readonly kind: AuthStrategyKind;
+    readonly developmentOnly?: boolean;
+    readonly disabled?: boolean;
+    readonly allowDisabledInProduction?: boolean;
+}
+export interface InvitationRecipientInput {
+    readonly projectId: string;
+    readonly authStorage: AuthStorage;
+    readonly email: string;
+    readonly now?: Date;
+}
+export type InvitationRecipientStatus = "allowed" | "invalid_email" | "disallowed_domain" | "suspended_user" | "rate_limited";
+export interface InvitationRecipientResult {
+    readonly status: InvitationRecipientStatus;
+    readonly email?: string;
+}
+export interface InvitationDeliveryInput {
+    readonly projectId: string;
+    readonly authStorage: AuthStorage;
+    readonly invitation: InvitationRecord;
+    readonly audience: AuthSessionAudience;
+    readonly returnTo: string;
+    readonly requestOrigin: string;
+    readonly now?: Date;
+}
+export type AuthEmailDeliveryStatus = "sent" | "skipped" | "rate_limited";
+export type InviteDeliveryStatus = AuthEmailDeliveryStatus | "not_supported";
+export interface InviteDeliveryResult {
+    readonly status: InviteDeliveryStatus;
+}
+export interface InvitationDeliveryAuthStrategy extends AuthStrategy {
+    validateInvitationRecipient?(input: InvitationRecipientInput): Promise<InvitationRecipientResult>;
+    deliverInvitation(input: InvitationDeliveryInput): Promise<InviteDeliveryResult>;
+}
+export interface MagicLinkRequestInput {
+    readonly projectId: string;
+    readonly authStorage: AuthStorage;
+    readonly email: string;
+    readonly audience: AuthSessionAudience;
+    readonly returnTo: string;
+    readonly requestOrigin: string;
+    /**
+     * Opaque hash the strategy appends to the callback URL as the `requester`
+     * query param. The server keeps the preimage in a cookie on the requesting
+     * browser so the callback can sign that same browser in without the extra
+     * confirmation click. Omitted for deliveries with no requesting browser
+     * (invitations).
+     */
+    readonly requesterHash?: string;
+    readonly now?: Date;
+}
+export type MagicLinkRequestStatus = AuthEmailDeliveryStatus;
+export interface MagicLinkRequestResult {
+    readonly status: MagicLinkRequestStatus;
+}
+export type AuthInvitationRecipientInput = InvitationRecipientInput;
+export type AuthInvitationRecipientStatus = InvitationRecipientStatus;
+export type AuthInvitationRecipientResult = InvitationRecipientResult;
+export type MagicLinkInvitationRecipientInput = InvitationRecipientInput;
+export type MagicLinkInvitationRecipientStatus = InvitationRecipientStatus;
+export type MagicLinkInvitationRecipientResult = InvitationRecipientResult;
+export interface MagicLinkCallbackInput {
+    readonly projectId: string;
+    readonly authStorage: AuthStorage;
+    readonly magicLinkId: string;
+    readonly token: string;
+    readonly session: CompleteAuthSessionInput;
+    readonly now?: Date;
+}
+export interface MagicLinkCallbackResult extends CompleteSignInResult {
+    readonly audience: AuthSessionAudience;
+    readonly returnTo: string;
+}
+export interface MagicLinkPeekInput {
+    readonly projectId: string;
+    readonly authStorage: AuthStorage;
+    readonly magicLinkId: string;
+    readonly token: string;
+    readonly now?: Date;
+}
+export interface MagicLinkPeekResult {
+    readonly email: string;
+}
+export interface MagicLinkAuthStrategy extends InvitationDeliveryAuthStrategy {
+    readonly kind: "magicLink";
+    readonly bootstrapGroupIds?: readonly string[];
+    /**
+     * How long issued links stay valid (ms). Lets the server align dependent
+     * lifetimes (e.g. the same-device pending cookie) with the configured TTL.
+     */
+    readonly magicLinkTtlMs?: number;
+    validateInvitationRecipient?(input: MagicLinkInvitationRecipientInput): Promise<MagicLinkInvitationRecipientResult>;
+    requestMagicLink(input: MagicLinkRequestInput): Promise<MagicLinkRequestResult>;
+    /**
+     * Read-only validity check for a link the user has not confirmed yet. Must
+     * never consume the token, and must apply the same rules that would make
+     * {@link completeMagicLinkSignIn} fail (including token verification), so a
+     * link that peeks as valid only fails to complete when raced. Returns null
+     * for links that cannot complete sign-in.
+     */
+    peekMagicLink?(input: MagicLinkPeekInput): Promise<MagicLinkPeekResult | null>;
+    completeMagicLinkSignIn(input: MagicLinkCallbackInput): Promise<MagicLinkCallbackResult>;
+}
+export interface OidcStartSignInInput {
+    readonly projectId: string;
+    readonly authStorage: AuthStorage;
+    readonly audience: AuthSessionAudience;
+    readonly returnTo: string;
+    readonly requestOrigin: string;
+    readonly now?: Date;
+}
+export interface OidcStartSignInResult {
+    readonly redirectTo: string;
+}
+export interface OidcCallbackInput {
+    readonly projectId: string;
+    readonly authStorage: AuthStorage;
+    readonly requestUrl: string;
+    readonly requestOrigin: string;
+    readonly session: CompleteAuthSessionInput;
+    readonly now?: Date;
+}
+export interface OidcCallbackResult extends CompleteSignInResult {
+    readonly audience: AuthSessionAudience;
+    readonly returnTo: string;
+}
+export interface OidcAuthStrategy extends InvitationDeliveryAuthStrategy {
+    readonly kind: "oidc";
+    readonly bootstrapGroupIds?: readonly string[];
+    startOidcSignIn(input: OidcStartSignInInput): Promise<OidcStartSignInResult>;
+    completeOidcSignIn(input: OidcCallbackInput): Promise<OidcCallbackResult>;
+}
+export interface InviteUserInput {
+    readonly email: string;
+    readonly groups?: readonly GroupDefinition[];
+    readonly groupIds?: readonly string[];
+    readonly expiresAt?: Date;
+    readonly returnTo?: string;
+}
+export interface InviteUserResult {
+    readonly invitation: InvitationRecord;
+    readonly delivery: InviteDeliveryResult;
+}
+export interface ListInvitationsInput {
+    readonly email?: string;
+    readonly statuses?: readonly InvitationStatus[];
+    readonly limit?: number;
+    readonly offset?: number;
+    readonly order?: "asc" | "desc";
+}
+export interface ListInvitationsResult {
+    readonly invitations: readonly InvitationRecord[];
+    readonly hasMore: boolean;
+    readonly total: number;
+}
+export interface InvitationGroupOption {
+    readonly id: string;
+    readonly label?: string;
+    readonly description?: string;
+}
+export type CreateInvitationCapability = {
+    readonly state: "enabled";
+} | {
+    readonly state: "disabled";
+    readonly reason: "missing_membership_policy" | "invitation_delivery_not_supported";
+};
+export interface GetInvitationOptionsResult {
+    readonly groups: readonly InvitationGroupOption[];
+    readonly canInviteWithoutGroups: boolean;
+    readonly capabilities: {
+        readonly createInvitation: CreateInvitationCapability;
+    };
+}
+/**
+ * Which membership operations the caller holds at least one policy for. Coarse,
+ * caller-wide capabilities used to gate top-level UI affordances; per-target
+ * checks (scope over a member's current groups, self-protection) are finer.
+ */
+export interface MembershipOperationCapabilities {
+    readonly invite: boolean;
+    readonly assignGroups: boolean;
+    readonly suspend: boolean;
+}
+export interface GetMembershipOptionsResult {
+    /** Groups the caller may assign to a member (the `assignGroups` scope). */
+    readonly groups: readonly InvitationGroupOption[];
+    readonly capabilities: MembershipOperationCapabilities;
+}
+/**
+ * What a caller's membership policies let it do — the answer to "may this principal invite?".
+ *
+ * Resolved from group ids alone, with no HTTP request involved, so project code and tests can ask the
+ * question the same way the member-admin routes do.
+ */
+export interface MembershipCapabilities {
+    /** True when at least one policy grants the operation, ignoring which groups it covers. */
+    readonly holds: MembershipOperationCapabilities;
+    /** Group ids the caller may assign to a member. */
+    readonly assignableGroupIds: readonly string[];
+    /**
+     * Whether the caller's policy scope reaches a member currently holding exactly `memberGroups`.
+     *
+     * Pass definitions when your code knows the groups (`covers("suspend", [teamMembers])`) and ids when
+     * they came from a session or a member's stored memberships. An empty list asks the group-less case —
+     * inviting someone who joins no group — which any holder of the operation may do.
+     *
+     * Coverage is not authorization. It is the group boundary the membership policies draw, which is what
+     * a UI needs to decide whether to offer a control for a given member. The operation itself applies
+     * rules this question cannot see: `suspendMember` refuses the current user, `assignGroups` also checks
+     * the groups being assigned against `assignableGroupIds`, and a member's status can rule it out. Ask
+     * the runtime method for the decision; ask this for the boundary.
+     */
+    covers(operation: MembershipOperation, memberGroups: readonly GroupReference[]): boolean;
+}
+export interface ListMembersInput {
+    readonly limit?: number;
+    readonly offset?: number;
+    readonly order?: "asc" | "desc";
+}
+/** Per-target actions the caller may take on a member, after self-protection. */
+export interface MemberCapabilities {
+    readonly assignGroups: boolean;
+    readonly suspend: boolean;
+    readonly reactivate: boolean;
+}
+export interface MemberSummary {
+    readonly user: UserRecord;
+    readonly groupIds: readonly string[];
+    readonly capabilities: MemberCapabilities;
+}
+export interface ListMembersResult {
+    readonly members: readonly MemberSummary[];
+    readonly hasMore: boolean;
+    readonly total: number;
+}
+export interface UpdateMemberGroupsInput {
+    readonly userId: string;
+    /** The desired full set of groups; additions and removals are derived from it. */
+    readonly groupIds: readonly string[];
+}
+export interface UpdateMemberGroupsResult {
+    readonly user: UserRecord;
+    readonly groupIds: readonly string[];
+}
+export interface SuspendMemberInput {
+    readonly userId: string;
+}
+export interface SuspendMemberResult {
+    readonly user: UserRecord;
+    readonly groupIds: readonly string[];
+}
+export interface ReactivateMemberInput {
+    readonly userId: string;
+}
+export interface ReactivateMemberResult {
+    readonly user: UserRecord;
+    readonly groupIds: readonly string[];
+}
+export type AuthCredentialSource = "session" | "accessToken" | "any";
+export interface AuthSessionResolutionOptions extends AuthSessionAudienceOptions {
+    readonly credentialSource?: AuthCredentialSource;
+    /** Marks this request as eligible to renew a near-expiry browser session. */
+    readonly sessionActivity?: "foreground";
+}
+export interface InviteUserOptions extends AuthSessionAudienceOptions {
+    readonly delivery?: {
+        readonly audience?: AuthSessionAudience;
+        readonly requestOrigin?: string;
+        readonly returnTo?: string;
+    };
+}
+export interface RevokeInvitationInput {
+    readonly invitationId: string;
+}
+export interface RevokeInvitationResult {
+    readonly invitation: InvitationRecord;
+}
+export interface CreatePersonalAccessTokenInput {
+    readonly name: string;
+    readonly expiresAt: Date;
+    readonly groupIds?: readonly string[];
+}
+export interface CreateServiceAccountInput {
+    readonly id?: string;
+    readonly name: string;
+    readonly description?: string;
+    readonly groupIds?: readonly string[];
+}
+export interface CreateServiceAccountResult {
+    readonly serviceAccount: ServiceAccountRecord;
+    readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[];
+}
+export interface CreateServiceAccountAccessTokenInput {
+    readonly serviceAccountId: string;
+    readonly name: string;
+    readonly expiresAt: Date;
+    readonly groupIds?: readonly string[];
+}
+export interface CreateAccessTokenResult {
+    readonly accessToken: AccessTokenRecord;
+    readonly tokenValue: string;
+}
+export interface CreateServiceAccountAccessTokenResult extends CreateAccessTokenResult {
+    readonly serviceAccount: ServiceAccountRecord;
+}
+export interface ServiceAccountWithGroups {
+    readonly serviceAccount: ServiceAccountRecord;
+    readonly groupIds: readonly string[];
+}
+export interface ListServiceAccountsResult {
+    readonly serviceAccounts: readonly ServiceAccountWithGroups[];
+}
+export interface ListPersonalAccessTokensResult {
+    readonly accessTokens: readonly AccessTokenRecord[];
+}
+export interface ListServiceAccountAccessTokensInput {
+    readonly serviceAccountId: string;
+}
+export interface ListServiceAccountAccessTokensResult {
+    readonly serviceAccount: ServiceAccountRecord;
+    readonly accessTokens: readonly AccessTokenRecord[];
+}
+export interface DisableServiceAccountInput {
+    readonly serviceAccountId: string;
+}
+export interface DisableServiceAccountResult {
+    readonly serviceAccount: ServiceAccountRecord;
+    readonly groupIds: readonly string[];
+}
+export interface RevokePersonalAccessTokenInput {
+    readonly tokenId: string;
+}
+export interface RevokeServiceAccountAccessTokenInput {
+    readonly serviceAccountId: string;
+    readonly tokenId: string;
+}
+export interface RevokeAccessTokenResult {
+    readonly accessToken: AccessTokenRecord;
+}
+export interface RevokeServiceAccountAccessTokenResult {
+    readonly serviceAccount: ServiceAccountRecord;
+    readonly accessToken: AccessTokenRecord;
+}
+export interface AuthSessionOptions {
+    /** How long a browser session may remain idle before it expires. Defaults to 30 days. */
+    readonly idleTimeoutMs?: number;
+    /** How close to idle expiry a foreground request must be before renewal. Defaults to 7 days. */
+    readonly renewalWindowMs?: number;
+    /**
+     * Optional maximum lifetime that foreground activity cannot extend. Captured when the session
+     * is created, so later configuration changes affect only newly issued sessions. Disabled by
+     * default.
+     */
+    readonly absoluteTimeoutMs?: number;
+    /**
+     * How long (ms) a resolved session is cached in-process before it is re-validated
+     * against storage. Collapses the per-request auth reads (session + user + memberships)
+     * during request bursts so they cannot starve the storage pool. Set to 0 to disable.
+     * Defaults to {@link DEFAULT_AUTH_SESSION_CACHE_TTL_MS}.
+     */
+    readonly cacheTtlMs?: number;
+}
+export interface ResolvedAuthSessionOptions {
+    readonly idleTimeoutMs: number;
+    readonly renewalWindowMs: number;
+    readonly absoluteTimeoutMs?: number;
+    readonly cacheTtlMs: number;
+}
+export interface AuthCookieOptions {
+    readonly sessionCookieName?: string;
+    readonly csrfCookieName?: string;
+    readonly cookieDomain?: string;
+    readonly secure?: boolean | "auto";
+    readonly sameSite?: "strict";
+    readonly csrfHttpOnly?: boolean;
+}
+export type SixbAuthConfig = AuthStrategy | {
+    readonly strategy: AuthStrategy;
+    readonly session?: AuthSessionOptions;
+    readonly cookies?: AuthCookieOptions;
+};
+export type AuthSessionFailureReason = "auth_disabled" | "missing_credentials" | "missing_cookie" | "missing_access_token" | "invalid_cookie" | "invalid_access_token" | "invalid_session" | "missing_user" | "missing_service_account" | "suspended_service_account" | "suspended_user";
+export interface UnauthenticatedAuthSession {
+    readonly authenticated: false;
+    readonly reason: AuthSessionFailureReason;
+}
+export interface AuthenticatedAuthSession {
+    readonly authenticated: true;
+    readonly credentialSource: "session";
+    readonly principal: Extract<Principal, {
+        readonly type: "user";
+    }>;
+    readonly user: UserRecord;
+    readonly session: SessionRecord;
+    readonly groupIds: readonly string[];
+    /** Internal response hint: the rolling session deadline advanced during this request. */
+    readonly sessionRenewed?: true;
+}
+export interface AuthenticatedUserAccessTokenSession {
+    readonly authenticated: true;
+    readonly credentialSource: "accessToken";
+    readonly principal: Extract<Principal, {
+        readonly type: "user";
+    }>;
+    readonly user: UserRecord;
+    readonly accessToken: AccessTokenRecord;
+    readonly groupIds: readonly string[];
+}
+export interface AuthenticatedServiceAccountAccessTokenSession {
+    readonly authenticated: true;
+    readonly credentialSource: "accessToken";
+    readonly principal: Extract<Principal, {
+        readonly type: "serviceAccount";
+    }>;
+    readonly serviceAccount: ServiceAccountRecord;
+    readonly accessToken: AccessTokenRecord;
+    readonly groupIds: readonly string[];
+}
+export type AuthSessionResult = UnauthenticatedAuthSession | AuthenticatedAuthSession;
+export type AuthenticatedUserRequestSession = AuthenticatedAuthSession | AuthenticatedUserAccessTokenSession;
+export type AuthenticatedRequestAuthSession = AuthenticatedUserRequestSession | AuthenticatedServiceAccountAccessTokenSession;
+export type AuthRequestResult = UnauthenticatedAuthSession | AuthenticatedRequestAuthSession;
+export interface ResolvedAuthConfig {
+    readonly strategy: AuthStrategy | null;
+    readonly session: ResolvedAuthSessionOptions;
+    readonly cookies: Required<Omit<AuthCookieOptions, "cookieDomain">> & {
+        readonly domain?: string;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACvF,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EACX,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,mCAAmC,EACnC,oBAAoB,EACpB,aAAa,EACb,UAAU,EACX,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAEjF,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAA4C,CAAA;AAE3E,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAE1E;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,CAAA;AAExE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;CAC7C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,MAAM,yBAAyB,GACjC,SAAS,GACT,eAAe,GACf,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,CAAA;AAElB,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAA;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,SAAS,GAAG,cAAc,CAAA;AAEzE,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,GAAG,eAAe,CAAA;AAE5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CACtC;AAED,MAAM,WAAW,8BAA+B,SAAQ,YAAY;IAClE,2BAA2B,CAAC,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACjG,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,CAAA;AAE5D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACxC;AAED,MAAM,MAAM,4BAA4B,GAAG,wBAAwB,CAAA;AAEnE,MAAM,MAAM,6BAA6B,GAAG,yBAAyB,CAAA;AAErE,MAAM,MAAM,6BAA6B,GAAG,yBAAyB,CAAA;AAErE,MAAM,MAAM,iCAAiC,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kCAAkC,GAAG,yBAAyB,CAAA;AAE1E,MAAM,MAAM,kCAAkC,GAAG,yBAAyB,CAAA;AAE1E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,uBAAwB,SAAQ,oBAAoB;IACnE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,qBAAsB,SAAQ,8BAA8B;IAC3E,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,2BAA2B,CAAC,CAC1B,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,kCAAkC,CAAC,CAAA;IAC9C,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC/E;;;;;;OAMG;IACH,aAAa,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IAC9E,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;CACzF;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAiB,SAAQ,8BAA8B;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;IAC5E,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAC1E;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;CACxC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACjD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,2BAA2B,GAAG,mCAAmC,CAAA;CACnF,CAAA;AAEL,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAA;IACjD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAA;IACxC,QAAQ,CAAC,YAAY,EAAE;QACrB,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAA;KACtD,CAAA;CACF;AAED;;;;GAIG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAA;IACjD,QAAQ,CAAC,YAAY,EAAE,+BAA+B,CAAA;CACvD;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAA;IAC/C,mDAAmD;IACnD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,SAAS,EAAE,mBAAmB,EAAE,YAAY,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAA;CACzF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;CAChC;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAA;CAC1C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,aAAa,GAAG,KAAK,CAAA;AAEpE,MAAM,WAAW,4BAA6B,SAAQ,0BAA0B;IAC9E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IAChD,6EAA6E;IAC7E,QAAQ,CAAC,eAAe,CAAC,EAAE,YAAY,CAAA;CACxC;AAED,MAAM,WAAW,iBAAkB,SAAQ,0BAA0B;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;QACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;QAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;CACF;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;CACtC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,mCAAmC,EAAE,CAAA;CAC1E;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,qCAAsC,SAAQ,uBAAuB;IACpF,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;CAC9C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,EAAE,SAAS,wBAAwB,EAAE,CAAA;CAC9D;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACpD;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACpD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;CACxC;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAChC;AAED,MAAM,MAAM,cAAc,GACtB,YAAY,GACZ;IACE,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAA;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CACrC,CAAA;AAEL,MAAM,MAAM,wBAAwB,GAChC,eAAe,GACf,qBAAqB,GACrB,gBAAgB,GAChB,sBAAsB,GACtB,gBAAgB,GAChB,sBAAsB,GACtB,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,2BAA2B,GAC3B,gBAAgB,CAAA;AAEpB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,yFAAyF;IACzF,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAA;IAC3E,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,CAAA;AAErF,MAAM,MAAM,+BAA+B,GACvC,wBAAwB,GACxB,mCAAmC,CAAA;AAEvC,MAAM,MAAM,+BAA+B,GACvC,+BAA+B,GAC/B,6CAA6C,CAAA;AAEjD,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,+BAA+B,CAAA;AAE5F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,GAAG;QACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;CACF"}

package/dist/auth/validation.d.ts

@@ -0,0 +1,26 @@
+import type { AuthStrategy, InvitationDeliveryAuthStrategy, MagicLinkAuthStrategy, OidcAuthStrategy, ResolvedAuthConfig, SixbAuthConfig } from "./types";
+export declare const DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS: number;
+export declare const DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS: number;
+export declare const DEFAULT_AUTH_INVITATION_TTL_MS: number;
+export declare const MAX_AUTH_INVITATION_TTL_MS: number;
+/**
+ * Default in-process session cache window. Short enough that a revoked session lingers
+ * only briefly, long enough to collapse a burst of requests to a single auth resolution.
+ */
+export declare const DEFAULT_AUTH_SESSION_CACHE_TTL_MS = 5000;
+export { resolveAuthSessionAudience } from "./audience";
+export declare function resolveAuthConfig(config: SixbAuthConfig | undefined): ResolvedAuthConfig;
+export declare function resolveInvitationExpiresAt(value: Date | undefined, now: Date): Date;
+export declare function sanitizeReturnTo(value: string | undefined): string;
+export declare function assertNonEmpty(value: string, label: string): string;
+export declare function normalizePagination(input: {
+    readonly limit?: number;
+    readonly offset?: number;
+}): {
+    readonly limit?: number;
+    readonly offset: number;
+};
+export declare function isMagicLinkAuthStrategy(strategy: AuthStrategy | null): strategy is MagicLinkAuthStrategy;
+export declare function isInvitationDeliveryAuthStrategy(strategy: AuthStrategy | null): strategy is InvitationDeliveryAuthStrategy;
+export declare function isOidcAuthStrategy(strategy: AuthStrategy | null): strategy is OidcAuthStrategy;
+//# sourceMappingURL=validation.d.ts.map

package/dist/auth/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/auth/validation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,YAAY,EACZ,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACf,MAAM,SAAS,CAAA;AAIhB,eAAO,MAAM,oCAAoC,QAAW,CAAA;AAC5D,eAAO,MAAM,sCAAsC,QAAU,CAAA;AAC7D,eAAO,MAAM,8BAA8B,QAAU,CAAA;AACrD,eAAO,MAAM,0BAA0B,QAAW,CAAA;AAClD;;;GAGG;AACH,eAAO,MAAM,iCAAiC,OAAQ,CAAA;AAEtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAEvD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,kBAAkB,CAiBxF;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,IAAI,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CA4BnF;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAelE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMnE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACjG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAmBA;AAkED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAC5B,QAAQ,IAAI,qBAAqB,CAcnC;AAED,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,YAAY,GAAG,IAAI,GAC5B,QAAQ,IAAI,8BAA8B,CAU5C;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAAG,QAAQ,IAAI,gBAAgB,CAc9F"}

package/dist/authorization/application-access.d.ts

@@ -0,0 +1,18 @@
+import type { AuthSessionAudience } from "../auth/audience";
+import type { AuthorizationContext, ResolvedRole } from "./types";
+/** Whether declaring roles has enabled an allowlist for an application. */
+export declare function isApplicationAccessControlled(roles: readonly ResolvedRole[], audience: AuthSessionAudience): boolean;
+/**
+ * Whether this principal may open this application.
+ *
+ * KNOWN LIMITATION (0.1.x): application access is the one capability that is **not** deny-by-default.
+ * While no role mentions an application, every authenticated principal may open it; the allowlist only
+ * switches on once some role grants it. Every other capability — `view`, `apply`, `run`, `observe` —
+ * denies unless granted, so this is the single asymmetry in the model.
+ *
+ * It is deliberate for now: flipping it would lock every project out of Atlas until it declares a role,
+ * including projects with no security definitions at all. Closing it means shipping a default grant with
+ * the scaffold first, and it is a breaking change for any project relying on the open default.
+ */
+export declare function canAccessApplication(authorization: AuthorizationContext, roles: readonly ResolvedRole[], audience: AuthSessionAudience): boolean;
+//# sourceMappingURL=application-access.d.ts.map

package/dist/authorization/application-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-access.d.ts","sourceRoot":"","sources":["../../src/authorization/application-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEjE,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAET;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,oBAAoB,EACnC,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAKT"}

package/dist/authorization/decision.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Authorization decisions for the core data path.
+ *
+ * `evaluate` is the single place that maps a request to the resolved grant
+ * index. `can` (boolean) and `assertAuthorized` (throw) are the two ways to
+ * consume a decision; every enforcement site goes through one of them.
+ *
+ * A missing authorization context means a privileged caller (raw `sixb`,
+ * syncs, workers, tests) — everything is allowed. Scoped contexts are
+ * default-deny: a request without a covering grant is denied.
+ *
+ * SECURITY — this makes "privileged" the silent default: any caller that
+ * reaches a leaf without an authorization context bypasses all grant checks.
+ * That is intended for internal callers, but it means HTTP routes serving
+ * authenticated principals must go through the scoped runtime (`sixb.as(ctx)`),
+ * never the raw runtime. See `RequestAuthState` in the server for the rule.
+ */
+import type { AuthSessionAudience } from "../auth/audience";
+import type { AuthorizationContext } from "./types";
+/** Something a principal may attempt, paired with the resource it targets. */
+export type AuthzRequest = {
+    readonly kind: "application.access";
+    readonly audience: AuthSessionAudience;
+} | {
+    readonly kind: "object.view";
+    readonly objectTypeId: string;
+} | {
+    readonly kind: "dataset.view";
+    readonly datasetId: string;
+} | {
+    readonly kind: "object.edit";
+    readonly objectTypeId: string;
+} | {
+    readonly kind: "telemetry.append";
+    readonly objectTypeId: string;
+} | {
+    readonly kind: "action.apply";
+    readonly actionId: string;
+} | {
+    readonly kind: "workflow.run";
+    readonly workflowId: string;
+} | {
+    readonly kind: "sync.run";
+    readonly syncId: string;
+} | {
+    readonly kind: "pipeline.run";
+    readonly pipelineId: string;
+} | {
+    readonly kind: "agent.run";
+    readonly agentId: string;
+} | {
+    readonly kind: "logs.observe";
+} | {
+    readonly kind: "object.query";
+    readonly touchedObjectTypeIds: readonly string[];
+};
+export interface AuthzDecision {
+    readonly allowed: boolean;
+    /** Grant keys the request needs, e.g. `view:object:quote`. */
+    readonly requirements: readonly string[];
+    /** Required keys the principal lacks; empty when allowed. */
+    readonly missing: readonly string[];
+}
+interface AuthorizedRuntime {
+    readonly authorization?: AuthorizationContext;
+}
+/** Resolve a request against a principal's grants. Never throws. */
+export declare function evaluate(authorization: AuthorizationContext | null | undefined, request: AuthzRequest): AuthzDecision;
+export declare function isAllowed(authorization: AuthorizationContext | null | undefined, request: AuthzRequest): boolean;
+export declare function assertAuthorized(runtime: AuthorizedRuntime, request: AuthzRequest): void;
+/**
+ * Assert a principal may write objects of this type.
+ *
+ * Requires `view:object` as well as `edit:object`, and that is not belt-and-braces: an upsert
+ * returns the *merged* row, which the Materializer reconciles against source authority, so the
+ * response can carry properties the caller never sent. Granting the write without the read would
+ * leak them.
+ *
+ * The pairing is asserted here rather than implied during resolution: `resolveRoleGrants` has no
+ * notion of one grant entailing another, and giving it one would put ids in the resolved index that
+ * no role granted — an index that no longer answers "what was actually granted".
+ *
+ * Telemetry append is deliberately *not* paired this way; see {@link assertCanAppendTelemetry}.
+ */
+export declare function assertCanEdit(runtime: AuthorizedRuntime, objectTypeId: string): void;
+/**
+ * Assert a principal may append telemetry points to objects of this type.
+ *
+ * No `view:object` requirement, unlike {@link assertCanEdit}: an append answers with no object
+ * state, so there is nothing to leak. That is what makes a write-only principal — a device, an
+ * ingestion service — expressible at all, and it is the reason telemetry has its own grant.
+ */
+export declare function assertCanAppendTelemetry(runtime: AuthorizedRuntime, objectTypeId: string): void;
+/**
+ * Fail closed for operations that have no grant semantics yet.
+ *
+ * One caller left — `listLinks`, whose rows reveal target types that no read grant covers. Object,
+ * link, and telemetry writes moved to {@link assertCanEdit} / {@link assertCanAppendTelemetry}.
+ * Keeps unsupported surfaces denied even if a scoped runtime context reaches a code path the scoped
+ * SDK does not expose.
+ */
+export declare function assertPrivileged(runtime: AuthorizedRuntime, operation: string): void;
+export {};
+//# sourceMappingURL=decision.d.ts.map

package/dist/authorization/decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAG3D,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,SAAS,CAAA;AAE/D,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C;AAiDD,oEAAoE;AACpE,wBAAgB,QAAQ,CACtB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,aAAa,CAOf;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAUxF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAGpF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/F;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASpF"}