@synoikia/core 0.7.0 → 0.8.1

package/dist/auth/sessions.js

@@ -1,5 +1,6 @@
 import { createHmac } from 'node:crypto';
 import { and, eq, gt, lt, ne } from 'drizzle-orm';
+import { writeAudit } from '../audit.js';
 import { sessions, users } from '../db/schema.js';
 import { randomToken } from './tokens.js';
 const TOUCH_EVERY_MS = 60_000;
@@ -7,6 +8,8 @@ export class SessionService {
     db;
     pepper;
     now;
+    /** When each MCP-port session last proved TOTP (design §5.3); in memory, so a restart asks again. */
+    totpProofs = new Map();
     constructor(db, pepper, now = () => new Date()) {
         this.db = db;
         this.pepper = pepper;
@@ -92,6 +95,36 @@ export class SessionService {
             .where(and(eq(sessions.userId, userId), eq(sessions.kind, kind)))
             .run().changes;
     }
+    /** The user signs out every approval browser at once (Profile page, design §5.3). */
+    revokeApprovalBrowsers(userId) {
+        return this.db.transaction((tx) => {
+            const count = tx
+                .delete(sessions)
+                .where(and(eq(sessions.userId, userId), eq(sessions.kind, 'approval_ui')))
+                .run().changes;
+            writeAudit(tx, {
+                kind: 'auth',
+                decision: 'approval_sessions_revoked',
+                actorKind: 'user',
+                actorId: userId,
+                detail: { count },
+            });
+            return count;
+        });
+    }
+    /** Proofs older than `maxAgeMs` are dropped on the way. */
+    recordTotpProof(idHash, maxAgeMs) {
+        const now = this.now().getTime();
+        for (const [k, at] of this.totpProofs)
+            if (now - at > maxAgeMs)
+                this.totpProofs.delete(k);
+        this.totpProofs.set(idHash, now);
+    }
+    /** Milliseconds since this session last proved TOTP, or Infinity if it never did. */
+    sinceTotpProof(idHash) {
+        const at = this.totpProofs.get(idHash);
+        return at === undefined ? Infinity : this.now().getTime() - at;
+    }
     purgeExpired() {
         return this.db.delete(sessions).where(lt(sessions.expiresAt, this.now())).run().changes;
     }

package/dist/auth/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAoB1C,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,OAAO,cAAc;IAEN;IACA;IACA;IAHnB,YACmB,EAAM,EACN,MAAc,EACd,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAFlC,OAAE,GAAF,EAAE,CAAI;QACN,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,MAAM,CAAC,GAAW;QAChB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CACJ,MAAc,EACd,IAAiB,EACjB,MAAqB,EACrB,OAA4C,EAAE;QAE9C,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC;YACN,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACxB,MAAM;YACN,IAAI;YACJ,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;YACtD,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;SACjD,CAAC;aACD,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sGAAsG;IACtG,QAAQ,CAAC,GAAuB,EAAE,IAAiB,EAAE,MAAqB;QACxE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aAC1C,IAAI,CAAC,QAAQ,CAAC;aACd,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC/C,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3E,sFAAsF;QACtF,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QACzE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,WAAW,IAAI,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC;YACzF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;YAC5D,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;iBAClC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBAClC,GAAG,EAAE,CAAC;QACX,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,CAAC,GAAuB;QAC5B,IAAI,GAAG;YACL,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;iBAC5C,GAAG,EAAE,CAAC;IACb,CAAC;IAED,0GAA0G;IAC1G,UAAU,CAAC,MAAc,EAAE,OAAgB;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,QAAQ,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;aAClE,GAAG,EAAE,CAAC;IACX,CAAC;IAED,uGAAuG;IACvG,QAAQ,CAAC,MAAc,EAAE,IAAiB;QACxC,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;aACzG,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;aACpG,GAAG,EAAE,CAAC;IACX,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,IAAiB;QAC1C,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC,QAAQ,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC,OAAO,CAAC;IACnB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IAC1F,CAAC;CACF"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAoB1C,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,OAAO,cAAc;IAKN;IACA;IACA;IANnB,qGAAqG;IACpF,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD,YACmB,EAAM,EACN,MAAc,EACd,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAFlC,OAAE,GAAF,EAAE,CAAI;QACN,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,MAAM,CAAC,GAAW;QAChB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CACJ,MAAc,EACd,IAAiB,EACjB,MAAqB,EACrB,OAA4C,EAAE;QAE9C,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC;YACN,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACxB,MAAM;YACN,IAAI;YACJ,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;YACtD,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;SACjD,CAAC;aACD,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sGAAsG;IACtG,QAAQ,CAAC,GAAuB,EAAE,IAAiB,EAAE,MAAqB;QACxE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aAC1C,IAAI,CAAC,QAAQ,CAAC;aACd,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC/C,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3E,sFAAsF;QACtF,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QACzE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,WAAW,IAAI,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC;YACzF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;YAC5D,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;iBAClC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBAClC,GAAG,EAAE,CAAC;QACX,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,CAAC,GAAuB;QAC5B,IAAI,GAAG;YACL,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;iBAC5C,GAAG,EAAE,CAAC;IACb,CAAC;IAED,0GAA0G;IAC1G,UAAU,CAAC,MAAc,EAAE,OAAgB;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,QAAQ,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;aAClE,GAAG,EAAE,CAAC;IACX,CAAC;IAED,uGAAuG;IACvG,QAAQ,CAAC,MAAc,EAAE,IAAiB;QACxC,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;aACzG,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;aACpG,GAAG,EAAE,CAAC;IACX,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,IAAiB;QAC1C,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC,QAAQ,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC,OAAO,CAAC;IACnB,CAAC;IAED,qFAAqF;IACrF,sBAAsB,CAAC,MAAc;QACnC,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,EAAE;iBACb,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;iBACzE,GAAG,EAAE,CAAC,OAAO,CAAC;YACjB,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,2BAA2B;gBACrC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,KAAK,EAAE;aAClB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,eAAe,CAAC,MAAc,EAAE,QAAgB;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,GAAG,GAAG,EAAE,GAAG,QAAQ;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,qFAAqF;IACrF,cAAc,CAAC,MAAc;QAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;IACjE,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IAC1F,CAAC;CACF"}

package/dist/auth/users.d.ts

@@ -1,6 +1,9 @@
+import type { LevelTarget, LevelView } from '../catalog/role-levels.js';
 import type { SecretBox } from '../crypto/index.js';
 import type { Db } from '../db/index.js';
 import { users } from '../db/schema.js';
+import type { AccessLevel } from '../gate/access.js';
+import type { PublicRole } from './roles.js';
 export type UserRow = typeof users.$inferSelect;
 export interface PublicUser {
     id: string;
@@ -11,25 +14,49 @@ export interface PublicUser {
     disabled: boolean;
     createdAt: Date;
     lastLoginAt: Date | null;
+    role: PublicRole;
 }
-export declare const toPublicUser: (u: UserRow) => PublicUser;
+/** How a user came to exist without an admin creating them (design §6.5). */
+export type RegistrationSource = 'oidc' | 'external' | 'signup';
 export declare class UserService {
     private readonly db;
     private readonly box;
     constructor(db: Db, box: SecretBox);
     count(): number;
     list(): PublicUser[];
+    /** A user's role; a dangling role id (none can be made through the API) reads as no access. */
+    roleOf(u: UserRow): PublicRole;
+    toPublic(u: UserRow): PublicUser;
+    isAdmin(u: UserRow): boolean;
     get(id: string): UserRow;
     byUsername(username: string): UserRow | undefined;
+    /** The user a proxy-named identity is (design §6.2): only one an admin made or that `external` mode
+     * registered, so nobody can claim a proxy identity by signing up or through OIDC first. */
+    byExternalIdentity(identity: string): UserRow | undefined;
+    /** Case-insensitive match. */
+    byUsernameInsensitive(username: string): UserRow | undefined;
     byOidc(issuer: string, subject: string): UserRow | undefined;
     create(input: {
         username: string;
         password?: string;
+        roleId?: string;
     }, actor?: {
         userId?: string;
     }, opts?: {
         onlyIfFirst?: boolean;
+        source?: RegistrationSource;
     }): Promise<PublicUser>;
+    /** Self-registration (design §6.5): only while an admin has set a default role, which the user gets. */
+    register(input: {
+        username: string;
+        password?: string;
+    }, source: RegistrationSource): Promise<PublicUser>;
+    registrationOpen(): boolean;
+    /** Enabled admins other than `except`: someone must always be left to administer the server. */
+    private otherAdmins;
+    setRole(userId: string, roleId: string, actor?: {
+        userId?: string;
+    }): void;
     /** First-run setup: only while no users exist (design §6.1). */
     setupFirstUser(username: string, password: string): Promise<PublicUser>;
     /** `ADMIN_BOOTSTRAP_*`: create the first user on boot if none exist; ignored afterwards. */
@@ -42,7 +69,10 @@ export declare class UserService {
     setDisabled(userId: string, disabled: boolean, actor?: {
         userId?: string;
     }): void;
-    markLogin(userId: string): void;
+    /** A successful sign-in on any surface; `detail` says how and where. */
+    recordLogin(userId: string, detail: Record<string, unknown>): void;
+    /** Local-password users must have TOTP when the admin requires it (OIDC-only users rely on the IdP). */
+    mustEnrollTotp(u: UserRow): boolean;
     private totpSecret;
     /** Starts (or restarts) enrollment. TOTP stays off until `confirmTotp` succeeds. */
     beginTotp(userId: string): {
@@ -58,9 +88,24 @@ export declare class UserService {
     verifyTotpCode(userId: string, code: string): boolean;
     /** Second factor: a TOTP code (replay-protected) or a single-use recovery code. */
     verifySecondFactor(userId: string, code: string): 'totp' | 'recovery' | null;
+    /** Turning TOTP off needs a current code, so a hijacked session alone can't remove it. False on a wrong code. */
+    disableOwnTotp(u: UserRow, code: string): boolean;
     linkOidc(userId: string, issuer: string, subject: string): void;
     unlinkOidc(userId: string, actor?: {
         userId?: string;
     }): void;
+    unlinkOwnOidc(u: UserRow): void;
+    /** While local login is off, refuse any change that would leave no enabled user linked to SSO (§6.1). */
+    assertSsoRemains(change: {
+        oidcOff?: boolean;
+        losingUser?: string;
+    }): void;
     hasOidcLinkedUser(except?: string): boolean;
+    /** An endpoint of the user's role; any other answers 404, as if it didn't exist. */
+    ownEndpoint(u: UserRow, instanceId: string): string;
+    hasEndpoint(u: UserRow, instanceId: string): boolean;
+    assertAllowed(u: UserRow, cap: 'canSetOwnLevels' | 'canManageOwnRules'): void;
+    /** The user's levels on an endpoint; a non-admin sees only what they can call. */
+    levels(u: UserRow, instanceId: string): LevelView;
+    setOwnLevel(u: UserRow, instanceId: string, target: LevelTarget, level: AccessLevel | null): LevelView;
 }

package/dist/auth/users.js

@@ -1,19 +1,23 @@
 import { randomUUID } from 'node:crypto';
 import { hash, verify } from '@node-rs/argon2';
-import { and, asc, count, eq } from 'drizzle-orm';
+import { and, asc, count, eq, ne, sql } from 'drizzle-orm';
 import { writeAudit } from '../audit.js';
+import { levelView, roleHasInstance, setOwnLevel } from '../catalog/role-levels.js';
 import { aad } from '../crypto/index.js';
-import { users } from '../db/schema.js';
-import { ConflictError, NotFoundError, ValidationError } from '../errors.js';
+import { roles, users } from '../db/schema.js';
+import { ConflictError, ForbiddenError, NotFoundError, ValidationError } from '../errors.js';
+import { ADMIN_ROLE_ID } from '../gate/access.js';
+import { getSettings } from '../settings.js';
+import { toPublicRole } from './roles.js';
 import { randomToken, sha256 } from './tokens.js';
 import { generateTotpSecret, otpauthUri, verifyTotp } from './totp.js';
-/** Portal accounts (design §6.1): argon2id passwords, optional TOTP with recovery codes and OIDC link;
- * no roles. */
+/** Portal accounts (design §6.1): argon2id passwords, optional TOTP with recovery codes and OIDC link,
+ * and one role each (design §6.4). */
 // argon2id, m = 64 MiB, t = 3, p = 1 (design §6.1). @node-rs/argon2 defaults to argon2id.
 const ARGON = { memoryCost: 65536, timeCost: 3, parallelism: 1 };
-const USERNAME = /^[a-zA-Z0-9._@-]{2,64}$/;
+const USERNAME = /^[a-zA-Z0-9._@:-]{2,64}$/;
 const RECOVERY_CODES = 10;
-export const toPublicUser = (u) => ({
+const toPublicUser = (u, role) => ({
     id: u.id,
     username: u.username,
     totpEnabled: u.totpEnabled,
@@ -22,6 +26,7 @@ export const toPublicUser = (u) => ({
     disabled: u.disabled,
     createdAt: u.createdAt,
     lastLoginAt: u.lastLoginAt,
+    role,
 });
 function checkPasswordPolicy(password) {
     if (typeof password !== 'string' || password.length < 12) {
@@ -43,7 +48,32 @@ export class UserService {
         return this.db.select({ n: count() }).from(users).get()?.n ?? 0;
     }
     list() {
-        return this.db.select().from(users).orderBy(asc(users.username)).all().map(toPublicUser);
+        return this.db
+            .select()
+            .from(users)
+            .orderBy(asc(users.username))
+            .all()
+            .map((u) => this.toPublic(u));
+    }
+    /** A user's role; a dangling role id (none can be made through the API) reads as no access. */
+    roleOf(u) {
+        const role = this.db.select().from(roles).where(eq(roles.id, u.roleId)).get();
+        return role
+            ? toPublicRole(role)
+            : {
+                id: u.roleId,
+                name: 'Unknown',
+                isAdmin: false,
+                canSetOwnLevels: false,
+                canManageOwnRules: false,
+                canSeeStatus: false,
+            };
+    }
+    toPublic(u) {
+        return toPublicUser(u, this.roleOf(u));
+    }
+    isAdmin(u) {
+        return u.roleId === ADMIN_ROLE_ID;
     }
     get(id) {
         const u = this.db.select().from(users).where(eq(users.id, id)).get();
@@ -54,6 +84,21 @@ export class UserService {
     byUsername(username) {
         return this.db.select().from(users).where(eq(users.username, username)).get();
     }
+    /** The user a proxy-named identity is (design §6.2): only one an admin made or that `external` mode
+     * registered, so nobody can claim a proxy identity by signing up or through OIDC first. */
+    byExternalIdentity(identity) {
+        const found = this.byUsernameInsensitive(identity);
+        return found && (found.registeredVia === null || found.registeredVia === 'external') ? found : undefined;
+    }
+    /** Case-insensitive match. */
+    byUsernameInsensitive(username) {
+        return this.db
+            .select()
+            .from(users)
+            .where(sql `lower(${users.username}) = lower(${username})`)
+            .orderBy(asc(users.createdAt))
+            .get();
+    }
     byOidc(issuer, subject) {
         return this.db
             .select()
@@ -62,11 +107,15 @@ export class UserService {
             .get();
     }
     async create(input, actor = {}, opts = {}) {
+        const roleId = input.roleId ?? ADMIN_ROLE_ID;
+        if (!this.db.select({ id: roles.id }).from(roles).where(eq(roles.id, roleId)).get())
+            throw new ValidationError('unknown_role', 'No such role');
         const username = input.username.trim();
         if (!USERNAME.test(username)) {
             throw new ValidationError('invalid_username', 'Usernames are 2–64 letters, digits, dots, dashes, underscores or @');
         }
-        if (this.byUsername(username))
+        // Unique regardless of case: proxy identities match names that way (design §6.2).
+        if (this.byUsernameInsensitive(username))
             throw new ConflictError('username_taken', 'That username is taken');
         if (input.password !== undefined)
             checkPasswordPolicy(input.password);
@@ -75,24 +124,71 @@ export class UserService {
             username,
             passwordHash: input.password ? await hash(input.password, ARGON) : null,
             createdAt: new Date(),
+            roleId,
+            registeredVia: opts.source ?? null,
         };
         this.db.transaction((tx) => {
             // Re-checked after the (slow) hash, in the same transaction as the insert: of two concurrent
             // first-run setups only one creates a user.
             if (opts.onlyIfFirst && (tx.select({ n: count() }).from(users).get()?.n ?? 0) > 0)
                 throw new ConflictError('setup_done', 'Setup has already been completed');
-            if (tx.select({ id: users.id }).from(users).where(eq(users.username, username)).get())
+            if (tx
+                .select({ id: users.id })
+                .from(users)
+                .where(sql `lower(${users.username}) = lower(${username})`)
+                .get())
                 throw new ConflictError('username_taken', 'That username is taken');
             tx.insert(users).values(row).run();
             writeAudit(tx, {
                 kind: 'auth',
-                decision: 'user_created',
+                decision: opts.source ? 'user_registered' : 'user_created',
                 actorKind: actor.userId ? 'user' : 'system',
                 actorId: actor.userId,
-                detail: { username },
+                detail: { username, roleId, ...(opts.source ? { source: opts.source } : {}) },
+            });
+        });
+        return this.toPublic(this.get(row.id));
+    }
+    /** Self-registration (design §6.5): only while an admin has set a default role, which the user gets. */
+    async register(input, source) {
+        const roleId = getSettings(this.db, 'security').defaultRoleId;
+        if (!roleId)
+            throw new ConflictError('registration_closed', 'This server does not accept new accounts');
+        // `:` names Cloudflare service tokens (`service:<id>`); only the proxy may bring such a name.
+        if (source !== 'external' && input.username.includes(':'))
+            throw new ValidationError('invalid_username', 'Usernames are 2–64 letters, digits, dots, dashes, underscores or @');
+        return this.create({ ...input, roleId }, {}, { source });
+    }
+    registrationOpen() {
+        const roleId = getSettings(this.db, 'security').defaultRoleId;
+        return !!roleId && !!this.db.select({ id: roles.id }).from(roles).where(eq(roles.id, roleId)).get();
+    }
+    /** Enabled admins other than `except`: someone must always be left to administer the server. */
+    otherAdmins(except) {
+        return (this.db
+            .select({ n: count() })
+            .from(users)
+            .where(and(eq(users.roleId, ADMIN_ROLE_ID), eq(users.disabled, false), ne(users.id, except)))
+            .get()?.n ?? 0);
+    }
+    setRole(userId, roleId, actor = {}) {
+        const user = this.get(userId);
+        if (!this.db.select({ id: roles.id }).from(roles).where(eq(roles.id, roleId)).get())
+            throw new ValidationError('unknown_role', 'No such role');
+        if (user.roleId === roleId)
+            return;
+        if (user.roleId === ADMIN_ROLE_ID && !user.disabled && this.otherAdmins(userId) === 0)
+            throw new ConflictError('last_admin', 'You cannot remove the last enabled admin');
+        this.db.transaction((tx) => {
+            tx.update(users).set({ roleId }).where(eq(users.id, userId)).run();
+            writeAudit(tx, {
+                kind: 'auth',
+                decision: 'user_role_changed',
+                actorKind: 'user',
+                actorId: actor.userId,
+                detail: { username: user.username, from: user.roleId, to: roleId },
             });
         });
-        return toPublicUser(this.get(row.id));
     }
     /** First-run setup: only while no users exist (design §6.1). */
     async setupFirstUser(username, password) {
@@ -145,6 +241,8 @@ export class UserService {
             if (active.length === 1 && active[0].id === userId) {
                 throw new ConflictError('last_user', 'You cannot disable the last active user');
             }
+            if (user.roleId === ADMIN_ROLE_ID && !user.disabled && this.otherAdmins(userId) === 0)
+                throw new ConflictError('last_admin', 'You cannot disable the last enabled admin');
         }
         this.db.transaction((tx) => {
             tx.update(users).set({ disabled }).where(eq(users.id, userId)).run();
@@ -157,8 +255,16 @@ export class UserService {
             });
         });
     }
-    markLogin(userId) {
-        this.db.update(users).set({ lastLoginAt: new Date() }).where(eq(users.id, userId)).run();
+    /** A successful sign-in on any surface; `detail` says how and where. */
+    recordLogin(userId, detail) {
+        this.db.transaction((tx) => {
+            tx.update(users).set({ lastLoginAt: new Date() }).where(eq(users.id, userId)).run();
+            writeAudit(tx, { kind: 'auth', decision: 'login', actorKind: 'user', actorId: userId, detail });
+        });
+    }
+    /** Local-password users must have TOTP when the admin requires it (OIDC-only users rely on the IdP). */
+    mustEnrollTotp(u) {
+        return getSettings(this.db, 'security').requireTotp && !!u.passwordHash && !u.totpEnabled;
     }
     // ── TOTP ─────────────────────────────────────────────────────────────────────────────────────────
     totpSecret(user) {
@@ -258,6 +364,16 @@ export class UserService {
         }
         return null;
     }
+    /** Turning TOTP off needs a current code, so a hijacked session alone can't remove it. False on a wrong code. */
+    disableOwnTotp(u, code) {
+        if (getSettings(this.db, 'security').requireTotp && u.passwordHash) {
+            throw new ConflictError('totp_required', 'Two-factor authentication is required on this server');
+        }
+        if (!this.verifySecondFactor(u.id, code))
+            return false;
+        this.resetTotp(u.id);
+        return true;
+    }
     // ── OIDC links ───────────────────────────────────────────────────────────────────────────────────
     linkOidc(userId, issuer, subject) {
         const existing = this.byOidc(issuer, subject);
@@ -280,6 +396,20 @@ export class UserService {
             writeAudit(tx, { kind: 'auth', decision: 'oidc_unlinked', actorKind: 'user', actorId: actor.userId ?? userId });
         });
     }
+    unlinkOwnOidc(u) {
+        if (!u.passwordHash)
+            throw new ConflictError('last_login_method', 'Set a password before unlinking single sign-on');
+        this.assertSsoRemains({ losingUser: u.id });
+        this.unlinkOidc(u.id);
+    }
+    /** While local login is off, refuse any change that would leave no enabled user linked to SSO (§6.1). */
+    assertSsoRemains(change) {
+        if (!getSettings(this.db, 'security').disableLocalLogin)
+            return;
+        if (change.oidcOff || !this.hasOidcLinkedUser(change.losingUser)) {
+            throw new ConflictError('local_login_disabled', 'Local login is disabled, so this would lock everyone out. Re-enable local login first.');
+        }
+    }
     hasOidcLinkedUser(except) {
         return this.db
             .select()
@@ -287,5 +417,28 @@ export class UserService {
             .all()
             .some((u) => !!u.oidcSubject && !u.disabled && u.id !== except);
     }
+    // ── the user's own endpoints (design §6.4) ──
+    /** An endpoint of the user's role; any other answers 404, as if it didn't exist. */
+    ownEndpoint(u, instanceId) {
+        if (!this.hasEndpoint(u, instanceId))
+            throw new NotFoundError('instance_not_found', 'No such endpoint');
+        return instanceId;
+    }
+    hasEndpoint(u, instanceId) {
+        return roleHasInstance(this.db, u.roleId, instanceId);
+    }
+    assertAllowed(u, cap) {
+        if (!this.roleOf(u)[cap])
+            throw new ForbiddenError('forbidden', 'Your role does not allow this');
+    }
+    /** The user's levels on an endpoint; a non-admin sees only what they can call. */
+    levels(u, instanceId) {
+        const who = { roleId: u.roleId, userId: u.id };
+        return levelView(this.db, instanceId, who, { reachableOnly: !this.roleOf(u).isAdmin });
+    }
+    setOwnLevel(u, instanceId, target, level) {
+        setOwnLevel(this.db, u.id, instanceId, target, level);
+        return this.levels(u, instanceId);
+    }
 }
 //# sourceMappingURL=users.js.map

package/dist/auth/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/auth/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGzC,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvE;eACe;AAEf,0FAA0F;AAC1F,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AACjE,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAC3C,MAAM,cAAc,GAAG,EAAE,CAAC;AAe1B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAU,EAAc,EAAE,CAAC,CAAC;IACvD,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW;IAC3B,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,WAAW,EAAE,CAAC,CAAC,WAAW;CAC3B,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;AACjG,CAAC;AAED,qGAAqG;AACrG,IAAI,SAAsC,CAAC;AAE3C,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,EAAM,EACN,GAAc;QADd,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAAW;IAC9B,CAAC;IAEJ,KAAK;QACH,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3F,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACrE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,OAAe;QACpC,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAA8C,EAC9C,QAA6B,EAAE,EAC/B,OAAkC,EAAE;QAEpC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;QACnG,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG;YACV,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YACvE,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,6FAA6F;YAC7F,4CAA4C;YAC5C,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;gBAC/E,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;YAC5E,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE;gBACnF,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;YACtE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACnC,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC3C,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE;aACrB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACrD,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,SAAS,CAAC,QAAiB,EAAE,QAAiB;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,gBAAgB,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzC,SAAS,KAAK,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,CAAC,MAAM,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,QAAgB,EAAE,OAAuD,EAAE;QAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5D,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QACD,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACzE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,kBAAkB;gBAC5B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM;gBAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,QAAiB,EAAE,QAA6B,EAAE;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;gBACrD,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3F,CAAC;IAED,oGAAoG;IAE5F,UAAU,CAAC,IAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzG,CAAC;IAED,oFAAoF;IACpF,SAAS,CAAC,MAAc;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;aAC7G,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,oGAAoG;IACpG,WAAW,CAAC,MAAc,EAAE,IAAY;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,CACxD,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAC/D,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;iBACpF,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,CAAC,MAAc,EAAE,QAA6B,EAAE;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;iBAC7F,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM;gBAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6GAA6G;IAC7G,cAAc,CAAC,MAAc,EAAE,IAAY;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mFAAmF;IACnF,kBAAkB,CAAC,MAAc,EAAE,IAAY;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC/C,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;iBACjE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBAClB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE;aAC5C,CAAC,CAAC;YACH,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oGAAoG;IAEpG,QAAQ,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,MAAM;YACpC,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrG,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,aAAa;gBACvB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,QAA6B,EAAE;QACxD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAChG,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QAClH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB,CAAC,MAAe;QAC/B,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/auth/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAEpF,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvE;sCACsC;AAEtC,0FAA0F;AAC1F,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AACjE,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAC5C,MAAM,cAAc,GAAG,EAAE,CAAC;AAmB1B,MAAM,YAAY,GAAG,CAAC,CAAU,EAAE,IAAgB,EAAc,EAAE,CAAC,CAAC;IAClE,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW;IAC3B,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,IAAI;CACL,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;AACjG,CAAC;AAED,qGAAqG;AACrG,IAAI,SAAsC,CAAC;AAE3C,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,EAAM,EACN,GAAc;QADd,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAAW;IAC9B,CAAC;IAEJ,KAAK;QACH,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;aAC5B,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,+FAA+F;IAC/F,MAAM,CAAC,CAAU;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9E,OAAO,IAAI;YACT,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;YACpB,CAAC,CAAC;gBACE,EAAE,EAAE,CAAC,CAAC,MAAM;gBACZ,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,KAAK;gBACd,eAAe,EAAE,KAAK;gBACtB,iBAAiB,EAAE,KAAK;gBACxB,YAAY,EAAE,KAAK;aACpB,CAAC;IACR,CAAC;IAED,QAAQ,CAAC,CAAU;QACjB,OAAO,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,CAAU;QAChB,OAAO,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC;IACpC,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACrE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAChF,CAAC;IAED;+FAC2F;IAC3F,kBAAkB,CAAC,QAAgB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,CAAC;IAED,8BAA8B;IAC9B,qBAAqB,CAAC,QAAgB;QACpC,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,GAAG,CAAA,SAAS,KAAK,CAAC,QAAQ,aAAa,QAAQ,GAAG,CAAC;aACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;aAC7B,GAAG,EAAE,CAAC;IACX,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,OAAe;QACpC,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAA+D,EAC/D,QAA6B,EAAE,EAC/B,OAA+D,EAAE;QAEjE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE;YACjF,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,kFAAkF;QAClF,IAAI,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;QAC9G,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG;YACV,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YACvE,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,MAAM;YACN,aAAa,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SACnC,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,6FAA6F;YAC7F,4CAA4C;YAC5C,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;gBAC/E,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;YAC5E,IACE,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;iBACxB,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CAAC,GAAG,CAAA,SAAS,KAAK,CAAC,QAAQ,aAAa,QAAQ,GAAG,CAAC;iBACzD,GAAG,EAAE;gBAER,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;YACtE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACnC,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc;gBAC1D,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC3C,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aAC9E,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,QAAQ,CAAC,KAA8C,EAAE,MAA0B;QACvF,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,aAAa,CAAC;QAC9D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;QACxG,8FAA8F;QAC9F,IAAI,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,gBAAgB;QACd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,aAAa,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACtG,CAAC;IAED,gGAAgG;IACxF,WAAW,CAAC,MAAc;QAChC,OAAO,CACL,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;aACtB,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;aAC5F,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CACjB,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,QAA6B,EAAE;QACrE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE;YACjF,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;YACnF,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,0CAA0C,CAAC,CAAC;QACpF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACnE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,mBAAmB;gBAC7B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE;aACnE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACrD,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,SAAS,CAAC,QAAiB,EAAE,QAAiB;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,gBAAgB,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzC,SAAS,KAAK,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,CAAC,MAAM,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,QAAgB,EAAE,OAAuD,EAAE;QAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5D,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QACD,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACzE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,kBAAkB;gBAC5B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM;gBAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,QAAiB,EAAE,QAA6B,EAAE;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;gBACnF,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,2CAA2C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;gBACrD,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,WAAW,CAAC,MAAc,EAAE,MAA+B;QACzD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACpF,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClG,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wGAAwG;IACxG,cAAc,CAAC,CAAU;QACvB,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IAC5F,CAAC;IAED,oGAAoG;IAE5F,UAAU,CAAC,IAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzG,CAAC;IAED,oFAAoF;IACpF,SAAS,CAAC,MAAc;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;aAC7G,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,oGAAoG;IACpG,WAAW,CAAC,MAAc,EAAE,IAAY;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,CACxD,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAC/D,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;iBACpF,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,CAAC,MAAc,EAAE,QAA6B,EAAE;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;iBAC7F,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM;gBAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6GAA6G;IAC7G,cAAc,CAAC,MAAc,EAAE,IAAY;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mFAAmF;IACnF,kBAAkB,CAAC,MAAc,EAAE,IAAY;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC/C,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;iBACjE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBAClB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE;aAC5C,CAAC,CAAC;YACH,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iHAAiH;IACjH,cAAc,CAAC,CAAU,EAAE,IAAY;QACrC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YACnE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oGAAoG;IAEpG,QAAQ,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,MAAM;YACpC,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrG,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,aAAa;gBACvB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,QAA6B,EAAE;QACxD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAChG,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QAClH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,CAAU;QACtB,IAAI,CAAC,CAAC,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,gDAAgD,CAAC,CAAC;QACpH,IAAI,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;IAED,yGAAyG;IACzG,gBAAgB,CAAC,MAAkD;QACjE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,iBAAiB;YAAE,OAAO;QAChE,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,wFAAwF,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,MAAe;QAC/B,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,+CAA+C;IAE/C,oFAAoF;IACpF,WAAW,CAAC,CAAU,EAAE,UAAkB;QACxC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,UAAU,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QACxG,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,WAAW,CAAC,CAAU,EAAE,UAAkB;QACxC,OAAO,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IAED,aAAa,CAAC,CAAU,EAAE,GAA4C;QACpE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;IACnG,CAAC;IAED,kFAAkF;IAClF,MAAM,CAAC,CAAU,EAAE,UAAkB;QACnC,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,WAAW,CAAC,CAAU,EAAE,UAAkB,EAAE,MAAmB,EAAE,KAAyB;QACxF,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/catalog/groups.d.ts

@@ -11,6 +11,8 @@ export declare const accessInput: (op: OperationRow) => {
     levelOverride: "none" | "read" | "ask" | "write" | null;
     writeAcknowledged: boolean;
 };
+/** What the upstream API says the operation does, when it says. */
+export declare const describeOf: (op: OperationRow) => string | null;
 export interface GroupSummary {
     key: string;
     label: string;
@@ -25,6 +27,57 @@ export interface GroupSummary {
     };
 }
 export declare function listGroups(db: DbLike, instanceId: string): GroupSummary[];
+/** Filters from the operations list's query string; `'1'` turns a switch on. */
+export interface OperationFilter {
+    stale?: string;
+    group?: string;
+    reason?: string;
+    needsReview?: string;
+    q?: string;
+}
+/** An endpoint's operations with their group, level in force and reachability. */
+export declare function listOperations(db: DbLike, instanceId: string, filter?: OperationFilter): {
+    group: string | null;
+    level: "none" | "read" | "ask" | "write";
+    allowedLevels: ("none" | "read" | "ask" | "write")[];
+    description: string | null;
+    reachable: boolean;
+    mode: import("../gate/access.js").AccessMode | null;
+    pendingReview: boolean;
+    reason: import("../gate/access.js").AccessReason | null;
+    id: string;
+    instanceId: string;
+    key: string;
+    displayName: string | null;
+    kind: string;
+    pluginGroup: string;
+    groupId: string;
+    tag: string | null;
+    classification: "read" | "write";
+    classificationSource: "locked" | "override" | "inferred";
+    inferredClassification: "read" | "write";
+    inferredReason: string;
+    locked: boolean;
+    levelOverride: "none" | "read" | "ask" | "write" | null;
+    writeAcknowledged: boolean;
+    acknowledgedAt: Date | null;
+    acknowledgedBy: string | null;
+    typedConfirmation: boolean;
+    attestationRequired: boolean;
+    attestationWaived: boolean;
+    needsReview: boolean;
+    matchProfile: string | null;
+    paramsSchema: unknown;
+    sensitiveParams: string[] | null;
+    sensitiveResult: "whole" | {
+        keys: string[];
+        deep?: boolean | undefined;
+    } | null;
+    docs: unknown;
+    firstSeenAt: Date;
+    lastSeenAt: Date;
+    stale: boolean;
+}[];
 /** Access decision for one operation key; unknown or stale operations are unreachable. */
 export declare function resolveAccess(db: DbLike, instanceId: string, key: string, principal?: AccessPrincipal): AccessDecision | {
     reachable: false;
@@ -45,6 +98,13 @@ export declare function applyBulkLevel(db: Db, instanceId: string, level: string
     label: string;
     from: AccessLevel;
 }[];
+/** Renames, then sets the level of, one group; each change is its own audited write. */
+export declare function updateGroup(db: Db, instanceId: string, key: string, patch: {
+    label?: string;
+    level?: string;
+}, opts?: {
+    actor?: Actor;
+}): GroupSummary | null;
 export declare function renameGroup(db: Db, instanceId: string, key: string, label: string, opts?: {
     actor?: Actor;
 }): void;
@@ -65,9 +125,9 @@ export interface OperationPatch {
     attestationRequired?: boolean;
 }
 /** Per-operation level and acknowledgement. The level must fit the operation's kind; locked refuses
- * `write` (409). Setting a write to `write` acknowledges it. */
+ * `write` (409). Setting a write to `write` acknowledges it. Returns the operation as stored. */
 export declare function updateOperation(db: Db, instanceId: string, opId: string, patch: OperationPatch, opts?: {
     actor?: Actor;
     now?: Date;
-}): void;
+}): OperationRow;
 export {};