@tumbaland/backend-core 1.29.0 → 1.31.0

package/dist/apiKeys/ApiKey.d.ts

@@ -0,0 +1,51 @@
+import mongoose, { Document } from 'mongoose';
+import type { ApiKeyScope } from './types';
+/**
+ * One API key. Lives in backend-core rather than auth-service because both
+ * halves need it: auth-service issues and revokes keys, and every other service
+ * verifies them on the way in. All services share one database, so the model is
+ * shared rather than the lookup going over HTTP on every request.
+ */
+export interface IApiKey extends Document {
+    userId: string;
+    /**
+     * The owner's identity as it stood when the key was issued.
+     *
+     * Snapshotted so verifying a key stays a single indexed read. Every
+     * authenticated request would otherwise need a second query into the users
+     * collection to fill in a `UserPayload`, to serve fields almost no handler
+     * reads. The cost is that a later rename shows the old name on requests made
+     * with this key, which is a fair price and easy to reason about.
+     */
+    userEmail: string;
+    userName: string;
+    /** what the user called it — "Claude Code", "home assistant" */
+    name: string;
+    /** the public half of the token; unique, and what a presented key is looked up by */
+    keyId: string;
+    /** SHA-256 of the secret half — what verification actually compares against */
+    hash: string;
+    /** the whole token, encrypted, so the owner can read it back later */
+    sealedCiphertext: string;
+    sealedIv: string;
+    sealedTag: string;
+    scopes: ApiKeyScope[];
+    /** the tenant this key acts in; null means the user's own non-group data */
+    groupId: string | null;
+    lastUsedAt?: Date;
+    expiresAt?: Date;
+    revokedAt?: Date;
+    /** reveals are counted and timestamped — reading back a key is worth an audit trail */
+    revealCount: number;
+    lastRevealedAt?: Date;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare const ApiKey: mongoose.Model<IApiKey, {}, {}, {}, mongoose.Document<unknown, {}, IApiKey, {}, mongoose.DefaultSchemaOptions> & IApiKey & Required<{
+    _id: mongoose.Types.ObjectId;
+}> & {
+    __v: number;
+} & {
+    id: string;
+}, any, IApiKey>;
+//# sourceMappingURL=ApiKey.d.ts.map

package/dist/apiKeys/ApiKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKey.d.ts","sourceRoot":"","sources":["../../src/apiKeys/ApiKey.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,EAAE,EAAE,QAAQ,EAAU,MAAM,UAAU,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,WAAW,OAAQ,SAAQ,QAAQ;IACvC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,uFAAuF;IACvF,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AA6BD,eAAO,MAAM,MAAM;;;;;;gBAEgC,CAAC"}

package/dist/apiKeys/ApiKey.js

@@ -0,0 +1,63 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKey = void 0;
+const mongoose_1 = __importStar(require("mongoose"));
+const ApiKeySchema = new mongoose_1.Schema({
+    userId: { type: String, required: true, index: true },
+    userEmail: { type: String, required: true },
+    userName: { type: String, required: true, default: '' },
+    name: { type: String, required: true, trim: true, maxlength: 60 },
+    keyId: { type: String, required: true, unique: true, index: true },
+    hash: { type: String, required: true },
+    sealedCiphertext: { type: String, required: true },
+    sealedIv: { type: String, required: true },
+    sealedTag: { type: String, required: true },
+    scopes: { type: [String], default: [] },
+    // Explicitly nullable rather than optional: "personal scope" is a decision the
+    // creator made, and it must not be indistinguishable from a field nobody set.
+    groupId: { type: String, default: null },
+    lastUsedAt: { type: Date },
+    expiresAt: { type: Date },
+    revokedAt: { type: Date },
+    revealCount: { type: Number, default: 0 },
+    lastRevealedAt: { type: Date }
+}, { timestamps: true, collection: 'api_keys' });
+// Every listing is one user's keys, newest first.
+ApiKeySchema.index({ userId: 1, createdAt: -1 });
+exports.ApiKey = mongoose_1.default.models.ApiKey
+    ? mongoose_1.default.models.ApiKey
+    : mongoose_1.default.model('ApiKey', ApiKeySchema);
+//# sourceMappingURL=ApiKey.js.map

package/dist/apiKeys/ApiKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKey.js","sourceRoot":"","sources":["../../src/apiKeys/ApiKey.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qDAAsD;AA6CtD,MAAM,YAAY,GAAG,IAAI,iBAAM,CAC7B;IACE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;IACrD,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC3C,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;IACvD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;IACjE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;IAClE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACtC,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAClD,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC1C,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC3C,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;IACvC,+EAA+E;IAC/E,8EAA8E;IAC9E,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;IACxC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IACzB,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IACzB,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;IACzC,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;CAC/B,EACD,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAC7C,CAAC;AAEF,kDAAkD;AAClD,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AAEpC,QAAA,MAAM,GAAG,kBAAQ,CAAC,MAAM,CAAC,MAAM;IAC1C,CAAC,CAAE,kBAAQ,CAAC,MAAM,CAAC,MAAkC;IACrD,CAAC,CAAC,kBAAQ,CAAC,KAAK,CAAU,QAAQ,EAAE,YAAY,CAAC,CAAC"}

package/dist/apiKeys/crypto.d.ts

@@ -0,0 +1,61 @@
+export interface GeneratedKey {
+    /** the whole key, shown to the user and never stored in this form */
+    token: string;
+    /** the public half, indexed for lookup */
+    id: string;
+    /** SHA-256 of the secret half, for verification */
+    hash: string;
+}
+/** Test seam: the derived key is cached for the life of the process. */
+export declare const resetEncryptionKeyCache: () => void;
+/**
+ * Whether keys can be issued and revealed at all.
+ *
+ * Only the reversible copy needs the secret — verification runs off the digest —
+ * so a service that merely accepts keys works without it. That asymmetry is easy
+ * to get wrong in a deployment, so callers can ask rather than discovering it
+ * through a 500 on someone's first key.
+ */
+export declare const isEncryptionConfigured: () => boolean;
+export declare const sha256: (value: string) => string;
+export declare const generateKey: () => GeneratedKey;
+export interface ParsedKey {
+    id: string;
+    secret: string;
+}
+/**
+ * Split a presented key into its public id and its secret half.
+ *
+ * Returns null rather than throwing: an unparseable token is an ordinary failed
+ * authentication, not an exceptional condition, and the caller answers both the
+ * same way.
+ */
+export declare const parseKey: (token: unknown) => ParsedKey | null;
+/** True when a token even looks like one of ours — lets the caller skip a JWT parse. */
+export declare const looksLikeApiKey: (token: unknown) => boolean;
+/** Constant-time digest comparison, so a wrong key leaks nothing through timing. */
+export declare const secretMatches: (secret: string, expectedHash: string) => boolean;
+export interface SealedSecret {
+    ciphertext: string;
+    iv: string;
+    tag: string;
+}
+/**
+ * Encrypt the key so it can be shown again later.
+ *
+ * Storing a recoverable copy is weaker than hashing alone: whoever holds both
+ * the database and `API_KEY_ENCRYPTION_SECRET` can mint the plaintext. It buys
+ * the ability to re-read a key you have lost, which the product wants. The
+ * secret lives outside the database precisely so that a dump, a backup, or a
+ * read-only replica is not on its own enough.
+ */
+export declare const encryptSecret: (token: string) => SealedSecret;
+/**
+ * Recover a stored key. Throws when the ciphertext has been tampered with —
+ * GCM authenticates, so a modified record fails loudly instead of returning
+ * plausible rubbish.
+ */
+export declare const decryptSecret: (sealed: SealedSecret) => string;
+/** What the UI shows in a list: enough to tell two keys apart, not enough to use one. */
+export declare const displayPrefix: (id: string) => string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/apiKeys/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/apiKeys/crypto.ts"],"names":[],"mappings":"AAiCA,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;CACd;AAWD,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,QAAO,IAE1C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,QAAO,OACM,CAAC;AAEjD,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,MACmB,CAAC;AAE3D,eAAO,MAAM,WAAW,QAAO,YAS9B,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,GAAI,OAAO,OAAO,KAAG,SAAS,GAAG,IAYrD,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,GAAI,OAAO,OAAO,KAAG,OACgB,CAAC;AAElE,oFAAoF;AACpF,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,EAAE,cAAc,MAAM,KAAG,OAKpE,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,YAU7C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,YAAY,KAAG,MAQpD,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,aAAa,GAAI,IAAI,MAAM,KAAG,MAA+B,CAAC"}

package/dist/apiKeys/crypto.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.displayPrefix = exports.decryptSecret = exports.encryptSecret = exports.secretMatches = exports.looksLikeApiKey = exports.parseKey = exports.generateKey = exports.sha256 = exports.isEncryptionConfigured = exports.resetEncryptionKeyCache = void 0;
+const crypto_1 = require("crypto");
+const env_1 = require("../config/env");
+/**
+ * Key material and the two different things we do with it.
+ *
+ * A presented key is checked against a SHA-256 digest — fast, because it runs on
+ * every authenticated request. Plain SHA-256 rather than bcrypt is right here
+ * and wrong for passwords: the secret is 32 bytes from a CSPRNG, so there is no
+ * dictionary to attack and nothing for a slow hash to buy.
+ *
+ * Separately, the key is stored encrypted so the owner can look it up again
+ * later. That is a deliberate trade — see `encryptSecret` — and the reason the
+ * digest is kept as well: verification never touches the reversible copy.
+ */
+/** `tmb_live_<id>_<secret>` — the prefix makes a leaked key greppable in logs. */
+const KEY_PREFIX = 'tmb_live';
+const ID_BYTES = 6; // 12 hex chars, the public half
+const SECRET_BYTES = 32;
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+/** Fixed: the input is a high-entropy env secret, not a password, so a per-record salt buys nothing. */
+const KDF_SALT = 'tumbaland/api-key/v1';
+/** Derive the AES key once per process; scrypt is deliberately slow. */
+let cachedKey = null;
+function encryptionKey() {
+    if (!cachedKey) {
+        cachedKey = (0, crypto_1.scryptSync)((0, env_1.requireEnv)('API_KEY_ENCRYPTION_SECRET'), KDF_SALT, 32);
+    }
+    return cachedKey;
+}
+/** Test seam: the derived key is cached for the life of the process. */
+const resetEncryptionKeyCache = () => {
+    cachedKey = null;
+};
+exports.resetEncryptionKeyCache = resetEncryptionKeyCache;
+/**
+ * Whether keys can be issued and revealed at all.
+ *
+ * Only the reversible copy needs the secret — verification runs off the digest —
+ * so a service that merely accepts keys works without it. That asymmetry is easy
+ * to get wrong in a deployment, so callers can ask rather than discovering it
+ * through a 500 on someone's first key.
+ */
+const isEncryptionConfigured = () => Boolean(process.env.API_KEY_ENCRYPTION_SECRET);
+exports.isEncryptionConfigured = isEncryptionConfigured;
+const sha256 = (value) => (0, crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex');
+exports.sha256 = sha256;
+const generateKey = () => {
+    const id = (0, crypto_1.randomBytes)(ID_BYTES).toString('hex');
+    const secret = (0, crypto_1.randomBytes)(SECRET_BYTES).toString('base64url');
+    return {
+        token: `${KEY_PREFIX}_${id}_${secret}`,
+        id,
+        hash: (0, exports.sha256)(secret)
+    };
+};
+exports.generateKey = generateKey;
+/**
+ * Split a presented key into its public id and its secret half.
+ *
+ * Returns null rather than throwing: an unparseable token is an ordinary failed
+ * authentication, not an exceptional condition, and the caller answers both the
+ * same way.
+ */
+const parseKey = (token) => {
+    if (typeof token !== 'string')
+        return null;
+    // Matched positionally rather than split on '_': the base64url alphabet
+    // includes '_', so a secret can contain any number of them and splitting
+    // would reject roughly a third of otherwise valid keys. The id is
+    // fixed-width, so everything after it is the secret.
+    const match = token.match(/^tmb_live_([0-9a-f]{12})_(.+)$/);
+    if (!match)
+        return null;
+    if (match[2].length < 16)
+        return null;
+    return { id: match[1], secret: match[2] };
+};
+exports.parseKey = parseKey;
+/** True when a token even looks like one of ours — lets the caller skip a JWT parse. */
+const looksLikeApiKey = (token) => typeof token === 'string' && token.startsWith(`${KEY_PREFIX}_`);
+exports.looksLikeApiKey = looksLikeApiKey;
+/** Constant-time digest comparison, so a wrong key leaks nothing through timing. */
+const secretMatches = (secret, expectedHash) => {
+    const presented = Buffer.from((0, exports.sha256)(secret), 'hex');
+    const expected = Buffer.from(expectedHash, 'hex');
+    if (presented.length !== expected.length)
+        return false;
+    return (0, crypto_1.timingSafeEqual)(presented, expected);
+};
+exports.secretMatches = secretMatches;
+/**
+ * Encrypt the key so it can be shown again later.
+ *
+ * Storing a recoverable copy is weaker than hashing alone: whoever holds both
+ * the database and `API_KEY_ENCRYPTION_SECRET` can mint the plaintext. It buys
+ * the ability to re-read a key you have lost, which the product wants. The
+ * secret lives outside the database precisely so that a dump, a backup, or a
+ * read-only replica is not on its own enough.
+ */
+const encryptSecret = (token) => {
+    const iv = (0, crypto_1.randomBytes)(IV_BYTES);
+    const cipher = (0, crypto_1.createCipheriv)(ALGORITHM, encryptionKey(), iv);
+    const ciphertext = Buffer.concat([cipher.update(token, 'utf8'), cipher.final()]);
+    return {
+        ciphertext: ciphertext.toString('base64'),
+        iv: iv.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64')
+    };
+};
+exports.encryptSecret = encryptSecret;
+/**
+ * Recover a stored key. Throws when the ciphertext has been tampered with —
+ * GCM authenticates, so a modified record fails loudly instead of returning
+ * plausible rubbish.
+ */
+const decryptSecret = (sealed) => {
+    const decipher = (0, crypto_1.createDecipheriv)(ALGORITHM, encryptionKey(), Buffer.from(sealed.iv, 'base64'));
+    decipher.setAuthTag(Buffer.from(sealed.tag, 'base64'));
+    return Buffer.concat([
+        decipher.update(Buffer.from(sealed.ciphertext, 'base64')),
+        decipher.final()
+    ]).toString('utf8');
+};
+exports.decryptSecret = decryptSecret;
+/** What the UI shows in a list: enough to tell two keys apart, not enough to use one. */
+const displayPrefix = (id) => `${KEY_PREFIX}_${id}`;
+exports.displayPrefix = displayPrefix;
+//# sourceMappingURL=crypto.js.map

package/dist/apiKeys/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/apiKeys/crypto.ts"],"names":[],"mappings":";;;AAAA,mCAOgB;AAChB,uCAA2C;AAE3C;;;;;;;;;;;GAWG;AAEH,kFAAkF;AAClF,MAAM,UAAU,GAAG,UAAU,CAAC;AAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,gCAAgC;AACpD,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,wGAAwG;AACxG,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAWxC,wEAAwE;AACxE,IAAI,SAAS,GAAkB,IAAI,CAAC;AACpC,SAAS,aAAa;IACpB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAA,mBAAU,EAAC,IAAA,gBAAU,EAAC,2BAA2B,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wEAAwE;AACjE,MAAM,uBAAuB,GAAG,GAAS,EAAE;IAChD,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC,CAAC;AAFW,QAAA,uBAAuB,2BAElC;AAEF;;;;;;;GAOG;AACI,MAAM,sBAAsB,GAAG,GAAY,EAAE,CAClD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AADpC,QAAA,sBAAsB,0BACc;AAE1C,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAC9C,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAD9C,QAAA,MAAM,UACwC;AAEpD,MAAM,WAAW,GAAG,GAAiB,EAAE;IAC5C,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE/D,OAAO;QACL,KAAK,EAAE,GAAG,UAAU,IAAI,EAAE,IAAI,MAAM,EAAE;QACtC,EAAE;QACF,IAAI,EAAE,IAAA,cAAM,EAAC,MAAM,CAAC;KACrB,CAAC;AACJ,CAAC,CAAC;AATW,QAAA,WAAW,eAStB;AAOF;;;;;;GAMG;AACI,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoB,EAAE;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3C,wEAAwE;IACxE,yEAAyE;IACzE,kEAAkE;IAClE,qDAAqD;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAEtC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC,CAAC;AAZW,QAAA,QAAQ,YAYnB;AAEF,wFAAwF;AACjF,MAAM,eAAe,GAAG,CAAC,KAAc,EAAW,EAAE,CACzD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;AADrD,QAAA,eAAe,mBACsC;AAElE,oFAAoF;AAC7E,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,YAAoB,EAAW,EAAE;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,cAAM,EAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,IAAA,wBAAe,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC,CAAC;AALW,QAAA,aAAa,iBAKxB;AAQF;;;;;;;;GAQG;AACI,MAAM,aAAa,GAAG,CAAC,KAAa,EAAgB,EAAE;IAC3D,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEjF,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC,CAAC;AAVW,QAAA,aAAa,iBAUxB;AAEF;;;;GAIG;AACI,MAAM,aAAa,GAAG,CAAC,MAAoB,EAAU,EAAE;IAC5D,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAAC,SAAS,EAAE,aAAa,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEvD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACzD,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC,CAAC;AARW,QAAA,aAAa,iBAQxB;AAEF,yFAAyF;AAClF,MAAM,aAAa,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,GAAG,UAAU,IAAI,EAAE,EAAE,CAAC;AAA9D,QAAA,aAAa,iBAAiD"}

package/dist/apiKeys/index.d.ts

@@ -0,0 +1,10 @@
+export { ApiKey } from './ApiKey';
+export type { IApiKey } from './ApiKey';
+export { createApiKey, listApiKeys, revealApiKey, revokeApiKey, deleteApiKey, verifyApiKey } from './service';
+export type { CreateApiKeyInput, CreatedApiKey } from './service';
+export { authenticateAgent, requireScope, denyApiKeys } from './middleware';
+export type { ApiKeyContext } from './middleware';
+export { API_KEY_SCOPES, isApiKeyScope } from './types';
+export type { ApiKeyScope, ApiKeySummary, ApiKeyVerification, ApiKeyRejection } from './types';
+export { looksLikeApiKey, displayPrefix, isEncryptionConfigured, resetEncryptionKeyCache } from './crypto';
+//# sourceMappingURL=index.d.ts.map

package/dist/apiKeys/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/apiKeys/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EACL,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACb,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxD,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,UAAU,CAAC"}

package/dist/apiKeys/index.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetEncryptionKeyCache = exports.isEncryptionConfigured = exports.displayPrefix = exports.looksLikeApiKey = exports.isApiKeyScope = exports.API_KEY_SCOPES = exports.denyApiKeys = exports.requireScope = exports.authenticateAgent = exports.verifyApiKey = exports.deleteApiKey = exports.revokeApiKey = exports.revealApiKey = exports.listApiKeys = exports.createApiKey = exports.ApiKey = void 0;
+var ApiKey_1 = require("./ApiKey");
+Object.defineProperty(exports, "ApiKey", { enumerable: true, get: function () { return ApiKey_1.ApiKey; } });
+var service_1 = require("./service");
+Object.defineProperty(exports, "createApiKey", { enumerable: true, get: function () { return service_1.createApiKey; } });
+Object.defineProperty(exports, "listApiKeys", { enumerable: true, get: function () { return service_1.listApiKeys; } });
+Object.defineProperty(exports, "revealApiKey", { enumerable: true, get: function () { return service_1.revealApiKey; } });
+Object.defineProperty(exports, "revokeApiKey", { enumerable: true, get: function () { return service_1.revokeApiKey; } });
+Object.defineProperty(exports, "deleteApiKey", { enumerable: true, get: function () { return service_1.deleteApiKey; } });
+Object.defineProperty(exports, "verifyApiKey", { enumerable: true, get: function () { return service_1.verifyApiKey; } });
+var middleware_1 = require("./middleware");
+Object.defineProperty(exports, "authenticateAgent", { enumerable: true, get: function () { return middleware_1.authenticateAgent; } });
+Object.defineProperty(exports, "requireScope", { enumerable: true, get: function () { return middleware_1.requireScope; } });
+Object.defineProperty(exports, "denyApiKeys", { enumerable: true, get: function () { return middleware_1.denyApiKeys; } });
+var types_1 = require("./types");
+Object.defineProperty(exports, "API_KEY_SCOPES", { enumerable: true, get: function () { return types_1.API_KEY_SCOPES; } });
+Object.defineProperty(exports, "isApiKeyScope", { enumerable: true, get: function () { return types_1.isApiKeyScope; } });
+var crypto_1 = require("./crypto");
+Object.defineProperty(exports, "looksLikeApiKey", { enumerable: true, get: function () { return crypto_1.looksLikeApiKey; } });
+Object.defineProperty(exports, "displayPrefix", { enumerable: true, get: function () { return crypto_1.displayPrefix; } });
+Object.defineProperty(exports, "isEncryptionConfigured", { enumerable: true, get: function () { return crypto_1.isEncryptionConfigured; } });
+Object.defineProperty(exports, "resetEncryptionKeyCache", { enumerable: true, get: function () { return crypto_1.resetEncryptionKeyCache; } });
+//# sourceMappingURL=index.js.map

package/dist/apiKeys/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/apiKeys/index.ts"],"names":[],"mappings":";;;AAAA,mCAAkC;AAAzB,gGAAA,MAAM,OAAA;AAEf,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,uGAAA,YAAY,OAAA;AACZ,uGAAA,YAAY,OAAA;AACZ,uGAAA,YAAY,OAAA;AAGd,2CAA4E;AAAnE,+GAAA,iBAAiB,OAAA;AAAE,0GAAA,YAAY,OAAA;AAAE,yGAAA,WAAW,OAAA;AAErD,iCAAwD;AAA/C,uGAAA,cAAc,OAAA;AAAE,sGAAA,aAAa,OAAA;AAEtC,mCAKkB;AAJhB,yGAAA,eAAe,OAAA;AACf,uGAAA,aAAa,OAAA;AACb,gHAAA,sBAAsB,OAAA;AACtB,iHAAA,uBAAuB,OAAA"}

package/dist/apiKeys/middleware.d.ts

@@ -0,0 +1,54 @@
+import { RequestHandler } from 'express';
+import type { ApiKeyScope } from './types';
+/**
+ * Request-scoped facts about the key a request arrived on. Absent on ordinary
+ * session requests, which is itself the signal a handler needs: `req.apiKey`
+ * being set means software is acting, not a person.
+ */
+export interface ApiKeyContext {
+    keyId: string;
+    scopes: ApiKeyScope[];
+    /** the tenant this key is pinned to; null means the owner's personal data */
+    groupId: string | null;
+}
+declare global {
+    namespace Express {
+        interface Request {
+            apiKey?: ApiKeyContext;
+        }
+    }
+}
+/**
+ * Authenticate a request that software may legitimately be making.
+ *
+ * Accepts either an ordinary session — a person at a keyboard, who keeps the
+ * full run of their own account — or an API key carrying every one of
+ * `requiredScopes`.
+ *
+ * This is deliberately *not* what `authenticateToken` became. Keys stay refused
+ * everywhere by default, and a route opts in by naming the scopes it needs; the
+ * alternative, teaching the existing middleware about keys, would have silently
+ * opened every route in every service at once, account deletion included.
+ */
+export declare const authenticateAgent: (...requiredScopes: ApiKeyScope[]) => RequestHandler;
+/**
+ * Require a scope on a route already behind `authenticateAgent`.
+ *
+ * Splitting authentication from authorization lets one `router.use` cover a
+ * whole router while each route still states what it needs — so a read-only key
+ * reaches the GETs and stops at the POSTs, instead of being turned away at the
+ * door for lacking a scope half the router never uses.
+ *
+ * A session passes unconditionally: scopes narrow what software may do on a
+ * person's behalf, not what the person may do themselves.
+ */
+export declare const requireScope: (...requiredScopes: ApiKeyScope[]) => RequestHandler;
+/**
+ * Refuse API keys on a route that a session may still use.
+ *
+ * For the handful of operations that should stay a person's to perform — key
+ * management itself, most obviously, since a key that can mint keys is a key
+ * that cannot be revoked.
+ */
+export declare const denyApiKeys: RequestHandler;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/apiKeys/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/apiKeys/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAO1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,MAAM,CAAC,EAAE,aAAa,CAAC;SACxB;KACF;CACF;AA0DD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,GAAG,gBAAgB,WAAW,EAAE,KAAG,cA4DlE,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,GAAI,GAAG,gBAAgB,WAAW,EAAE,KAAG,cAiB7D,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,cASzB,CAAC"}

package/dist/apiKeys/middleware.js

@@ -0,0 +1,174 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.denyApiKeys = exports.requireScope = exports.authenticateAgent = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const env_1 = require("../config/env");
+const logger_1 = __importDefault(require("../logging/logger"));
+const crypto_1 = require("./crypto");
+const service_1 = require("./service");
+/** Both auth paths read the token from the same two places. */
+const extractToken = (req) => req.cookies?.access_token || req.headers.authorization?.replace('Bearer ', '');
+const unauthorized = (res) => {
+    res.status(401).json({ success: false, message: 'Invalid or expired credentials' });
+};
+/**
+ * The tenant a request is asking to act in, wherever it named one.
+ *
+ * Handlers read `groupId` from either the query string or the body depending on
+ * the verb, so both are checked — a pin that only covered one of them would be
+ * no pin at all.
+ */
+const requestedGroupId = (req) => {
+    const fromQuery = req.query?.groupId;
+    if (typeof fromQuery === 'string' && fromQuery.length > 0)
+        return fromQuery;
+    const fromBody = req.body?.groupId;
+    if (typeof fromBody === 'string' && fromBody.length > 0)
+        return fromBody;
+    return undefined;
+};
+/**
+ * Hold a key to the tenant it was issued for.
+ *
+ * Two things happen here, and the second is the one that makes keys pleasant to
+ * use. A request that names a *different* tenant is refused outright — the pin
+ * is the whole reason a key is safe to hand to an agent. A request that names
+ * none has the pinned tenant written in for it, so the agent never has to know a
+ * group id exists, and a handler's `if (groupId) ... else personal` branch lands
+ * where the key's owner intended.
+ */
+const applyTenantPin = (req, groupId) => {
+    const requested = requestedGroupId(req);
+    if (requested !== undefined && requested !== groupId)
+        return false;
+    if (groupId !== null && requested === undefined) {
+        // Express 5 makes req.query a getter, so it is redefined rather than assigned.
+        Object.defineProperty(req, 'query', {
+            value: { ...req.query, groupId },
+            writable: true,
+            configurable: true,
+            enumerable: true
+        });
+        if (req.body && typeof req.body === 'object') {
+            req.body.groupId = groupId;
+        }
+    }
+    return true;
+};
+/**
+ * Authenticate a request that software may legitimately be making.
+ *
+ * Accepts either an ordinary session — a person at a keyboard, who keeps the
+ * full run of their own account — or an API key carrying every one of
+ * `requiredScopes`.
+ *
+ * This is deliberately *not* what `authenticateToken` became. Keys stay refused
+ * everywhere by default, and a route opts in by naming the scopes it needs; the
+ * alternative, teaching the existing middleware about keys, would have silently
+ * opened every route in every service at once, account deletion included.
+ */
+const authenticateAgent = (...requiredScopes) => async function authenticateAgentHandler(req, res, next) {
+    const token = extractToken(req);
+    if (!token) {
+        res.status(401).json({ success: false, message: 'Access token required' });
+        return;
+    }
+    if (!(0, crypto_1.looksLikeApiKey)(token)) {
+        try {
+            const user = jsonwebtoken_1.default.verify(token, (0, env_1.requireEnv)('JWT_SECRET'));
+            req.user = user;
+            req.userGroups = user.groups ?? [];
+            next();
+        }
+        catch {
+            unauthorized(res);
+        }
+        return;
+    }
+    const result = await (0, service_1.verifyApiKey)(token);
+    if (!result.ok) {
+        // The client is told only that the credentials failed; which of the five
+        // ways it failed is a detail that would help someone guessing.
+        logger_1.default.warn('API key rejected', { rejection: result.rejection, path: req.path });
+        unauthorized(res);
+        return;
+    }
+    const scopes = result.scopes ?? [];
+    const missing = requiredScopes.filter((scope) => !scopes.includes(scope));
+    if (missing.length > 0) {
+        res.status(403).json({
+            success: false,
+            message: `API key is missing required scope: ${missing.join(', ')}`
+        });
+        return;
+    }
+    const groupId = result.groupId ?? null;
+    if (!applyTenantPin(req, groupId)) {
+        res.status(403).json({
+            success: false,
+            message: 'API key is not permitted to act in the requested group'
+        });
+        return;
+    }
+    req.user = {
+        id: result.userId,
+        email: result.userEmail ?? '',
+        name: result.userName ?? ''
+    };
+    // Only the pinned group, never the owner's full membership: this is what
+    // stops a key reaching a group it was not issued for through any handler
+    // that consults `userGroups` instead of the `groupId` parameter.
+    req.userGroups = groupId ? [groupId] : [];
+    req.apiKey = { keyId: result.keyId, scopes, groupId };
+    next();
+};
+exports.authenticateAgent = authenticateAgent;
+/**
+ * Require a scope on a route already behind `authenticateAgent`.
+ *
+ * Splitting authentication from authorization lets one `router.use` cover a
+ * whole router while each route still states what it needs — so a read-only key
+ * reaches the GETs and stops at the POSTs, instead of being turned away at the
+ * door for lacking a scope half the router never uses.
+ *
+ * A session passes unconditionally: scopes narrow what software may do on a
+ * person's behalf, not what the person may do themselves.
+ */
+const requireScope = (...requiredScopes) => function requireScopeHandler(req, res, next) {
+    if (!req.apiKey) {
+        next();
+        return;
+    }
+    const missing = requiredScopes.filter((scope) => !req.apiKey.scopes.includes(scope));
+    if (missing.length > 0) {
+        res.status(403).json({
+            success: false,
+            message: `API key is missing required scope: ${missing.join(', ')}`
+        });
+        return;
+    }
+    next();
+};
+exports.requireScope = requireScope;
+/**
+ * Refuse API keys on a route that a session may still use.
+ *
+ * For the handful of operations that should stay a person's to perform — key
+ * management itself, most obviously, since a key that can mint keys is a key
+ * that cannot be revoked.
+ */
+const denyApiKeys = (req, res, next) => {
+    if (req.apiKey) {
+        res.status(403).json({
+            success: false,
+            message: 'This operation requires an interactive session, not an API key'
+        });
+        return;
+    }
+    next();
+};
+exports.denyApiKeys = denyApiKeys;
+//# sourceMappingURL=middleware.js.map

package/dist/apiKeys/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/apiKeys/middleware.ts"],"names":[],"mappings":";;;;;;AACA,gEAA+B;AAC/B,uCAA2C;AAC3C,+DAAuC;AAEvC,qCAA2C;AAC3C,uCAAyC;AAuBzC,+DAA+D;AAC/D,MAAM,YAAY,GAAG,CAAC,GAAY,EAAsB,EAAE,CACxD,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAEjF,MAAM,YAAY,GAAG,CAAC,GAAa,EAAQ,EAAE;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;AACtF,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAsB,EAAE;IAC5D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5E,MAAM,QAAQ,GAAI,GAAG,CAAC,IAA4C,EAAE,OAAO,CAAC;IAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEzE,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,CAAC,GAAY,EAAE,OAAsB,EAAW,EAAE;IACvE,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAEnE,IAAI,OAAO,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAChD,+EAA+E;QAC/E,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE;YAClC,KAAK,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE;YAChC,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAgC,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACI,MAAM,iBAAiB,GAAG,CAAC,GAAG,cAA6B,EAAkB,EAAE,CACpF,KAAK,UAAU,wBAAwB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAA,wBAAe,EAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAgB,CAAC;YACxE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,sBAAY,EAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,yEAAyE;QACzE,+DAA+D;QAC/D,gBAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACpE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;IACvC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,wDAAwD;SAClE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,GAAG;QACT,EAAE,EAAE,MAAM,CAAC,MAAO;QAClB,KAAK,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;KAC5B,CAAC;IACF,yEAAyE;IACzE,yEAAyE;IACzE,iEAAiE;IACjE,GAAG,CAAC,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,GAAG,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAEvD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AA5DS,QAAA,iBAAiB,qBA4D1B;AAEJ;;;;;;;;;;GAUG;AACI,MAAM,YAAY,GAAG,CAAC,GAAG,cAA6B,EAAkB,EAAE,CAC/E,SAAS,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;IACzC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACpE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAjBS,QAAA,YAAY,gBAiBrB;AAEJ;;;;;;GAMG;AACI,MAAM,WAAW,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC5D,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AATW,QAAA,WAAW,eAStB"}