@venturekit/auth 0.0.0-dev.20260701113915 → 0.0.0-dev.20260704225856

package/dist/index.d.ts

@@ -6,7 +6,8 @@
 export * from './types/index.js';
 export { createCognitoConfig, DEFAULT_COGNITO_CONFIG, buildUserPoolConfig, } from './cognito/index.js';
 export type { UserPoolOutputs, UserPoolInfraConfig } from './cognito/user-pool.js';
-export { hasScope, hasAnyScope, hasAllScopes, getScopesForRoles, validateRolesConfig, } from './roles/index.js';
+export { hasScope, hasAnyScope, hasAllScopes, getScopesForRoles, validateRolesConfig, listRoleScopes, getRoleScopes, setRoleScopes, grantScopeToRole, revokeScopeFromRole, createRoleScopesResolver, } from './roles/index.js';
+export type { Querier, RoleScopeRow, RoleScopesLookup, RoleScopesResolver, RoleScopesResolverOptions, } from './roles/index.js';
 export { decodeTokenUnsafe, decodeToken, // deprecated alias of decodeTokenUnsafe
 verifyAndDecode, extractUserFromToken, isTokenExpired, getTokenExpiry, } from './session/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGnF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,iBAAiB,EACjB,WAAW,EAAE,wCAAwC;AACrD,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGnF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EAInB,cAAc,EACd,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,OAAO,EACP,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,iBAAiB,EACjB,WAAW,EAAE,wCAAwC;AACrD,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -8,7 +8,11 @@ export * from './types/index.js';
 // Cognito
 export { createCognitoConfig, DEFAULT_COGNITO_CONFIG, buildUserPoolConfig, } from './cognito/index.js';
 // Roles
-export { hasScope, hasAnyScope, hasAllScopes, getScopesForRoles, validateRolesConfig, } from './roles/index.js';
+export { hasScope, hasAnyScope, hasAllScopes, getScopesForRoles, validateRolesConfig, 
+// DB-backed role → scopes mapping (vk_role_scopes: structure ships
+// with this package's migrations, rows owned by the app; cached
+// resolver for scope-granting middleware + CRUD for management UIs)
+listRoleScopes, getRoleScopes, setRoleScopes, grantScopeToRole, revokeScopeFromRole, createRoleScopesResolver, } from './roles/index.js';
 // Session
 export { decodeTokenUnsafe, decodeToken, // deprecated alias of decodeTokenUnsafe
 verifyAndDecode, extractUserFromToken, isTokenExpired, getTokenExpiry, } from './session/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAG5B,QAAQ;AACR,OAAO,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,UAAU;AACV,OAAO,EACL,iBAAiB,EACjB,WAAW,EAAE,wCAAwC;AACrD,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAG5B,QAAQ;AACR,OAAO,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB;AACnB,mEAAmE;AACnE,gEAAgE;AAChE,oEAAoE;AACpE,cAAc,EACd,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAS1B,UAAU;AACV,OAAO,EACL,iBAAiB,EACjB,WAAW,EAAE,wCAAwC;AACrD,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,oBAAoB,CAAC"}

package/dist/migrations/vk_auth_003_role_scopes.sql

@@ -0,0 +1,43 @@
+-- @venturekit/auth — role → scopes mapping.
+--
+-- The DB is the SOURCE OF TRUTH for which scopes each role grants.
+-- VentureKit ships the STRUCTURE (this migration, applied automatically
+-- with every other package migration); the consuming app ships DATA
+-- migrations to seed its own taxonomy, e.g.:
+--
+--   INSERT INTO vk_role_scopes (role, scope) VALUES
+--     ('member',    'member.verified'),
+--     ('moderator', 'member.verified'),
+--     ('moderator', 'moderation.reports.read')
+--   ON CONFLICT DO NOTHING;
+--
+-- Lives in @venturekit/auth — NOT in a pro package — because a role →
+-- scopes matrix is baseline authorization for ANY app: single-tenant
+-- apps key it by their global user role; multi-tenant apps feed it to
+-- `@venturekit-pro/tenancy`'s scopes middleware
+-- (`createTenantUserScopesMiddleware({ scopesByRole: resolver.lookup })`).
+--
+-- At runtime the mapping is read through `createRoleScopesResolver()`
+-- (cached, TTL-refreshed). Mutations go through `setRoleScopes` /
+-- `grantScopeToRole` / `revokeScopeFromRole`, so apps can build
+-- management UIs on top — changes propagate to warm instances within
+-- the resolver's TTL.
+--
+-- Deliberately GLOBAL (no tenant column): the mapping is the app's
+-- authorization POLICY, not tenant data. Per-tenant overrides, if ever
+-- needed, belong in a separate overlay table so the hot path stays a
+-- single cached full-table read.
+
+CREATE TABLE IF NOT EXISTS vk_role_scopes (
+  role        text        NOT NULL,
+  scope       text        NOT NULL,
+  created_at  timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (role, scope)
+);
+
+COMMENT ON TABLE vk_role_scopes IS
+  'Role → scope grants. Structure owned by @venturekit/auth; rows owned by the consuming app (seed via app migrations, manage via the role-scopes helpers).';
+
+-- Scope grants are read by role on every request that misses the
+-- resolver cache; the PK already serves (role, scope) lookups and
+-- role-prefix scans.

package/dist/roles/index.d.ts

@@ -1,8 +1,12 @@
 /**
  * Roles
  *
- * Utilities for managing roles and scopes.
+ * Utilities for managing roles and scopes — the static config helpers
+ * below, plus the DB-backed `vk_role_scopes` mapping (CRUD + cached
+ * resolver) in ./role-scopes.ts.
  */
+export { listRoleScopes, getRoleScopes, setRoleScopes, grantScopeToRole, revokeScopeFromRole, createRoleScopesResolver, } from './role-scopes.js';
+export type { Querier, RoleScopeRow, RoleScopesLookup, RoleScopesResolver, RoleScopesResolverOptions, } from './role-scopes.js';
 import type { RolesConfig } from '../types/index.js';
 /**
  * Check if user roles grant a specific scope

package/dist/roles/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAQ,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,QAAQ,CACtB,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,GAClB,OAAO,CAQT;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,WAAW,GAClB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,WAAW,GAClB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,WAAW,GAClB,MAAM,EAAE,CAWV;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAejE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,OAAO,EACP,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAQ,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,QAAQ,CACtB,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,GAClB,OAAO,CAQT;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,WAAW,GAClB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,WAAW,GAClB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,WAAW,GAClB,MAAM,EAAE,CAWV;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAejE"}

package/dist/roles/index.js

@@ -1,8 +1,11 @@
 /**
  * Roles
  *
- * Utilities for managing roles and scopes.
+ * Utilities for managing roles and scopes — the static config helpers
+ * below, plus the DB-backed `vk_role_scopes` mapping (CRUD + cached
+ * resolver) in ./role-scopes.ts.
  */
+export { listRoleScopes, getRoleScopes, setRoleScopes, grantScopeToRole, revokeScopeFromRole, createRoleScopesResolver, } from './role-scopes.js';
 /**
  * Check if user roles grant a specific scope
  */

package/dist/roles/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,UAAU,QAAQ,CACtB,SAAmB,EACnB,KAAa,EACb,MAAmB;IAEnB,6BAA6B;IAC7B,IAAI,MAAM,CAAC,cAAc,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,SAAmB,EACnB,MAAgB,EAChB,MAAmB;IAEnB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAmB,EACnB,MAAgB,EAChB,MAAmB;IAEnB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAmB,EACnB,MAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjE,4BAA4B;IAC5B,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,WAAW,kBAAkB,CAAC,CAAC;IACrE,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,cAAc,kBAAkB,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAW1B;;GAEG;AACH,MAAM,UAAU,QAAQ,CACtB,SAAmB,EACnB,KAAa,EACb,MAAmB;IAEnB,6BAA6B;IAC7B,IAAI,MAAM,CAAC,cAAc,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,SAAmB,EACnB,MAAgB,EAChB,MAAmB;IAEnB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAmB,EACnB,MAAgB,EAChB,MAAmB;IAEnB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAmB,EACnB,MAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjE,4BAA4B;IAC5B,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,WAAW,kBAAkB,CAAC,CAAC;IACrE,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,cAAc,kBAAkB,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/roles/role-scopes.d.ts

@@ -0,0 +1,92 @@
+/**
+ * DB-backed role → scopes mapping over `vk_role_scopes`.
+ *
+ * The table structure ships with this package
+ * (`migrations/vk_auth_003_role_scopes.sql`); the ROWS are the
+ * consuming app's authorization policy — seeded by an app data
+ * migration and mutable at runtime through the helpers here, so apps
+ * can put a management UI on top without redeploying to change what a
+ * role may do.
+ *
+ * Sits in `@venturekit/auth` (not a pro package) because a role →
+ * scopes matrix is baseline authorization for ANY app:
+ *   - single-tenant apps resolve their global user role through
+ *     {@link createRoleScopesResolver} and grant the result;
+ *   - multi-tenant apps pass `resolver.lookup` straight to
+ *     `@venturekit-pro/tenancy`'s
+ *     `createTenantUserScopesMiddleware({ scopesByRole })`.
+ *
+ * Reading on the hot path goes through the resolver: one full-table
+ * read, cached per process with a TTL (default 30s).
+ *
+ * **Consistency model.** Mutations are visible to the mutating
+ * instance immediately when it calls `resolver.invalidate()`, and to
+ * every other warm instance within one TTL — scope-mapping changes
+ * are rare and tolerate seconds of convergence.
+ *
+ * All helpers take a caller-supplied {@link Querier} — no hard
+ * dependency on `@venturekit/data`.
+ */
+/**
+ * Minimal query interface — same shape as `@venturekit/data`'s `query`
+ * and the Queriers used across the workspace. Declared locally so this
+ * package carries no data-layer dependency.
+ */
+export type Querier = <T = Record<string, unknown>[]>(sql: string, params?: unknown[]) => Promise<T>;
+/** One `vk_role_scopes` row. */
+export interface RoleScopeRow {
+    role: string;
+    scope: string;
+}
+/**
+ * Lookup signature scope-granting middleware consumes. Returning `[]`
+ * (unknown role) grants nothing — fail-closed.
+ */
+export type RoleScopesLookup = (role: string) => Promise<readonly string[]> | readonly string[];
+/** The full mapping, `{ role: [scope, …] }`, scopes sorted. */
+export declare function listRoleScopes(querier: Querier): Promise<Record<string, string[]>>;
+/** Scopes granted by one role (empty array when the role is unknown). */
+export declare function getRoleScopes(querier: Querier, role: string): Promise<string[]>;
+/**
+ * Replace a role's scope set atomically (single statement — a request
+ * racing the change sees either the old or the new complete set,
+ * never a partial one). An empty `scopes` array removes the role.
+ */
+export declare function setRoleScopes(querier: Querier, role: string, scopes: readonly string[]): Promise<void>;
+/** Add one grant. Idempotent. */
+export declare function grantScopeToRole(querier: Querier, role: string, scope: string): Promise<void>;
+/** Remove one grant. Idempotent. */
+export declare function revokeScopeFromRole(querier: Querier, role: string, scope: string): Promise<void>;
+export interface RoleScopesResolverOptions {
+    /** How the resolver reaches the DB. */
+    querier: Querier;
+    /**
+     * Cache lifetime, ms. Default 30 000. Governs how fast a mapping
+     * change propagates to OTHER warm instances (the mutating instance
+     * calls `invalidate()` and sees it immediately).
+     */
+    ttlMs?: number;
+}
+export interface RoleScopesResolver {
+    /**
+     * `(role) => scopes`. Pass as `scopesByRole` to tenancy's
+     * `createTenantUserScopesMiddleware`, or call directly from custom
+     * scope-granting middleware.
+     */
+    lookup: RoleScopesLookup;
+    /** Drop the cache — the next lookup reloads from the DB. */
+    invalidate(): void;
+}
+/**
+ * Build the cached mapping resolver.
+ *
+ * Failure semantics:
+ *   - load fails and a previous snapshot exists → serve the stale
+ *     snapshot (authorization availability beats freshness; the next
+ *     lookup retries the load);
+ *   - load fails with NO snapshot (cold start during a DB outage) →
+ *     the error propagates, failing the request loudly rather than
+ *     silently granting nothing to everyone.
+ */
+export declare function createRoleScopesResolver(options: RoleScopesResolverOptions): RoleScopesResolver;
+//# sourceMappingURL=role-scopes.d.ts.map

package/dist/roles/role-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-scopes.d.ts","sourceRoot":"","sources":["../../src/roles/role-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAClD,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,OAAO,EAAE,KACf,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GAAG,SAAS,MAAM,EAAE,CAAC;AAIpD,+DAA+D;AAC/D,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CASnC;AAED,yEAAyE;AACzE,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,EAAE,CAAC,CAMnB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,iCAAiC;AACjC,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,oCAAoC;AACpC,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAKf;AAID,MAAM,WAAW,yBAAyB;IACxC,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,MAAM,EAAE,gBAAgB,CAAC;IACzB,4DAA4D;IAC5D,UAAU,IAAI,IAAI,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,kBAAkB,CAyCpB"}

package/dist/roles/role-scopes.js

@@ -0,0 +1,122 @@
+/**
+ * DB-backed role → scopes mapping over `vk_role_scopes`.
+ *
+ * The table structure ships with this package
+ * (`migrations/vk_auth_003_role_scopes.sql`); the ROWS are the
+ * consuming app's authorization policy — seeded by an app data
+ * migration and mutable at runtime through the helpers here, so apps
+ * can put a management UI on top without redeploying to change what a
+ * role may do.
+ *
+ * Sits in `@venturekit/auth` (not a pro package) because a role →
+ * scopes matrix is baseline authorization for ANY app:
+ *   - single-tenant apps resolve their global user role through
+ *     {@link createRoleScopesResolver} and grant the result;
+ *   - multi-tenant apps pass `resolver.lookup` straight to
+ *     `@venturekit-pro/tenancy`'s
+ *     `createTenantUserScopesMiddleware({ scopesByRole })`.
+ *
+ * Reading on the hot path goes through the resolver: one full-table
+ * read, cached per process with a TTL (default 30s).
+ *
+ * **Consistency model.** Mutations are visible to the mutating
+ * instance immediately when it calls `resolver.invalidate()`, and to
+ * every other warm instance within one TTL — scope-mapping changes
+ * are rare and tolerate seconds of convergence.
+ *
+ * All helpers take a caller-supplied {@link Querier} — no hard
+ * dependency on `@venturekit/data`.
+ */
+/* ─── CRUD ──────────────────────────────────────────────────────── */
+/** The full mapping, `{ role: [scope, …] }`, scopes sorted. */
+export async function listRoleScopes(querier) {
+    const rows = await querier(`SELECT role, scope FROM vk_role_scopes ORDER BY role, scope`);
+    const out = {};
+    for (const { role, scope } of rows) {
+        (out[role] ??= []).push(scope);
+    }
+    return out;
+}
+/** Scopes granted by one role (empty array when the role is unknown). */
+export async function getRoleScopes(querier, role) {
+    const rows = await querier(`SELECT scope FROM vk_role_scopes WHERE role = $1 ORDER BY scope`, [role]);
+    return rows.map((r) => r.scope);
+}
+/**
+ * Replace a role's scope set atomically (single statement — a request
+ * racing the change sees either the old or the new complete set,
+ * never a partial one). An empty `scopes` array removes the role.
+ */
+export async function setRoleScopes(querier, role, scopes) {
+    await querier(`WITH removed AS (
+       DELETE FROM vk_role_scopes WHERE role = $1
+     )
+     INSERT INTO vk_role_scopes (role, scope)
+     SELECT $1, s FROM unnest($2::text[]) AS s
+     ON CONFLICT DO NOTHING`, [role, [...scopes]]);
+}
+/** Add one grant. Idempotent. */
+export async function grantScopeToRole(querier, role, scope) {
+    await querier(`INSERT INTO vk_role_scopes (role, scope)
+     VALUES ($1, $2)
+     ON CONFLICT DO NOTHING`, [role, scope]);
+}
+/** Remove one grant. Idempotent. */
+export async function revokeScopeFromRole(querier, role, scope) {
+    await querier(`DELETE FROM vk_role_scopes WHERE role = $1 AND scope = $2`, [
+        role,
+        scope,
+    ]);
+}
+/**
+ * Build the cached mapping resolver.
+ *
+ * Failure semantics:
+ *   - load fails and a previous snapshot exists → serve the stale
+ *     snapshot (authorization availability beats freshness; the next
+ *     lookup retries the load);
+ *   - load fails with NO snapshot (cold start during a DB outage) →
+ *     the error propagates, failing the request loudly rather than
+ *     silently granting nothing to everyone.
+ */
+export function createRoleScopesResolver(options) {
+    const ttlMs = options.ttlMs ?? 30_000;
+    let snapshot = null;
+    let loadedAt = 0;
+    let inflight = null;
+    const load = () => {
+        inflight ??= listRoleScopes(options.querier)
+            .then((mapping) => {
+            snapshot = mapping;
+            loadedAt = Date.now();
+            return mapping;
+        })
+            .finally(() => {
+            inflight = null;
+        });
+        return inflight;
+    };
+    const lookup = async (role) => {
+        if (!snapshot || Date.now() - loadedAt >= ttlMs) {
+            try {
+                await load();
+            }
+            catch (err) {
+                if (!snapshot)
+                    throw err;
+                // Stale-but-present beats down: keep serving the last good
+                // snapshot; a later lookup retries.
+                loadedAt = Date.now();
+            }
+        }
+        return snapshot?.[role] ?? [];
+    };
+    return {
+        lookup,
+        invalidate() {
+            snapshot = null;
+            loadedAt = 0;
+        },
+    };
+}
+//# sourceMappingURL=role-scopes.js.map

package/dist/roles/role-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-scopes.js","sourceRoot":"","sources":["../../src/roles/role-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA0BH,uEAAuE;AAEvE,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,6DAA6D,CAC9D,CAAC;IACF,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QACnC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,iEAAiE,EACjE,CAAC,IAAI,CAAC,CACP,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,IAAY,EACZ,MAAyB;IAEzB,MAAM,OAAO,CACX;;;;;4BAKwB,EACxB,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CACpB,CAAC;AACJ,CAAC;AAED,iCAAiC;AACjC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,IAAY,EACZ,KAAa;IAEb,MAAM,OAAO,CACX;;4BAEwB,EACxB,CAAC,IAAI,EAAE,KAAK,CAAC,CACd,CAAC;AACJ,CAAC;AAED,oCAAoC;AACpC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,IAAY,EACZ,KAAa;IAEb,MAAM,OAAO,CAAC,2DAA2D,EAAE;QACzE,IAAI;QACJ,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AA0BD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAkC;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IAEtC,IAAI,QAAQ,GAAoC,IAAI,CAAC;IACrD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAA6C,IAAI,CAAC;IAE9D,MAAM,IAAI,GAAG,GAAsC,EAAE;QACnD,QAAQ,KAAK,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;aACzC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,QAAQ,GAAG,OAAO,CAAC;YACnB,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QACL,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAqB,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9C,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,IAAI,EAAE,CAAC;YACf,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ;oBAAE,MAAM,GAAG,CAAC;gBACzB,2DAA2D;gBAC3D,oCAAoC;gBACpC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,UAAU;YACR,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/cookies.d.ts

@@ -16,11 +16,15 @@
  *     so it never leaks to non-auth handlers.
  *   - `Path=/` for the id/access tokens, `Path=/auth` for refresh.
  *
- * The cookies are **host-only** (no `Domain` attribute) so they're
- * scoped to the host the response came from. The browser sends them on
- * every request to that host, including cross-origin XHR from a sibling
- * subdomain when `credentials: 'include'` is used and both hosts share
- * the same registrable domain.
+ * The cookies are **host-only** (no `Domain` attribute) by default, so
+ * they're scoped to the host the response came from. The browser sends
+ * them on every request to that host, including cross-origin XHR from a
+ * sibling subdomain when `credentials: 'include'` is used and both hosts
+ * share the same registrable domain. Apps that need the session to
+ * survive host changes — `www.` ↔ apex on a white-label domain, or
+ * cross-subdomain navigation in dev — pass {@link CookieOptions.domain}
+ * (usually computed per request with {@link resolveCookieDomain}) and
+ * every cookie gains a `Domain=` attribute.
  */
 export declare const ID_TOKEN_COOKIE = "vk_id_token";
 export declare const ACCESS_TOKEN_COOKIE = "vk_access_token";
@@ -42,12 +46,32 @@ export interface CookieOptions {
     /**
      * Path scope for the refresh cookie. Defaults to `/auth`. The refresh
      * token is never sent on requests outside this prefix.
+     *
+     * Set this to the auth prefix **as the browser sees it**: an SPA that
+     * reaches the API through a same-origin `/api` proxy must use
+     * `/api/auth`, otherwise the browser never attaches the refresh
+     * cookie to `/api/auth/refresh` and the session dies when the id
+     * token expires.
      */
     refreshPath?: string;
     /**
      * Lifetime of the refresh cookie in seconds. Defaults to 30 days.
      */
     refreshMaxAgeSeconds?: number;
+    /**
+     * Emit a `Domain=` attribute on every cookie. Omit (default) for
+     * host-only cookies.
+     *
+     * Needed whenever the session must survive a host change: pinning to
+     * the apex so `www.example.com` and `example.com` share the session,
+     * or cross-subdomain navigation on a multi-tenant platform. Compute
+     * it per request with {@link resolveCookieDomain}.
+     *
+     * Clears MUST use the same domain as the set: a browser only deletes
+     * a cookie when the clear's Domain + Path match the original, so pass
+     * the same options to {@link buildClearSessionCookies}.
+     */
+    domain?: string;
 }
 /**
  * Default value for the cookie `Secure` flag.
@@ -105,6 +129,14 @@ export interface OAuthStateCookieOptions {
      * sub-second TTLs.
      */
     maxAgeSeconds?: number;
+    /**
+     * Emit a `Domain=` attribute. Omit (default) for a host-only cookie —
+     * the start and callback requests normally hit the same browser
+     * origin, so host-only is almost always right. Accepted so callers
+     * threading one {@link CookieOptions} bag through a whole auth flow
+     * don't need a special case.
+     */
+    domain?: string;
 }
 /**
  * Build the `Set-Cookie` header value pinning the OAuth CSRF `state`
@@ -136,7 +168,46 @@ export declare function buildOAuthStateCookie(provider: string, value: string, o
  * by {@link buildOAuthStateCookie}. Emit at the end of the callback
  * flow so a stale `state` can't be replayed.
  */
-export declare function clearOAuthStateCookie(provider: string, options?: Pick<OAuthStateCookieOptions, 'secure' | 'path'>): string;
+export declare function clearOAuthStateCookie(provider: string, options?: Pick<OAuthStateCookieOptions, 'secure' | 'path' | 'domain'>): string;
+export interface CookieDomainOptions {
+    /**
+     * The platform's own registrable domain (e.g. `example.com` for a
+     * platform serving tenants on `<slug>.example.com`). Hosts equal to
+     * it or ending in `.<platformApex>` are treated as platform hosts;
+     * anything else is a white-label custom domain.
+     */
+    platformApex: string;
+    /**
+     * What to do for platform hosts:
+     *   - `false` (default) — return `undefined`, i.e. host-only cookies.
+     *     Right for prod multi-tenant platforms where each tenant
+     *     subdomain is its own session boundary.
+     *   - `true` — return the platform apex so the session is shared
+     *     across every platform subdomain. Typical for dev, where the
+     *     login page and the tenant SPA live on different subdomains of
+     *     the same wildcard /etc/hosts entry.
+     * Custom domains are always pinned to their own apex regardless.
+     */
+    pinPlatform?: boolean;
+}
+/**
+ * Compute the {@link CookieOptions.domain} value for a request host on
+ * a white-label multi-tenant platform.
+ *
+ * Decision table (`platformApex: 'example.com'`):
+ *   - `app.example.com` → `undefined` (host-only) — or `example.com`
+ *     with `pinPlatform: true`.
+ *   - `www.acme.io` / `acme.io` (custom domain) → `acme.io`, so the
+ *     `www.` and bare hosts share the session.
+ *   - `''` → `undefined`.
+ *
+ * Ports are stripped (`app.example.com:3000` → platform host), and
+ * matching is case-insensitive. Pass the BROWSER-facing host — behind
+ * a same-origin SPA proxy that's the `origin`/`referer` host, not the
+ * Lambda's `host` header (see `getRequestHost` in
+ * `@venturekit/runtime`).
+ */
+export declare function resolveCookieDomain(requestHost: string, options: CookieDomainOptions): string | undefined;
 /**
  * Read a single cookie out of a `Cookie:` header value. Returns `null`
  * when the cookie is absent. Permissive: duplicates take the last

package/dist/server/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/server/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAIvD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAQD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAoCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,OAAO,CAAC,EAAE,aAAa,GACtB,MAAM,EAAE,CAqBV;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,EAAE,CAY1E;AAUD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,uBAAuB,GAChC,MAAM,CAWR;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,QAAQ,GAAG,MAAM,CAAC,GACzD,MAAM,CAQR;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAC1C,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAef"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/server/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAIvD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,OAAO,CAAC,EAAE,aAAa,GACtB,MAAM,EAAE,CA0BV;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,EAAE,CAY1E;AAUD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,uBAAuB,GAChC,MAAM,CAYR;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC,GACpE,MAAM,CAYR;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mBAAmB,GAC3B,MAAM,GAAG,SAAS,CAUpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAC1C,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAef"}

package/dist/server/cookies.js

@@ -16,11 +16,15 @@
  *     so it never leaks to non-auth handlers.
  *   - `Path=/` for the id/access tokens, `Path=/auth` for refresh.
  *
- * The cookies are **host-only** (no `Domain` attribute) so they're
- * scoped to the host the response came from. The browser sends them on
- * every request to that host, including cross-origin XHR from a sibling
- * subdomain when `credentials: 'include'` is used and both hosts share
- * the same registrable domain.
+ * The cookies are **host-only** (no `Domain` attribute) by default, so
+ * they're scoped to the host the response came from. The browser sends
+ * them on every request to that host, including cross-origin XHR from a
+ * sibling subdomain when `credentials: 'include'` is used and both hosts
+ * share the same registrable domain. Apps that need the session to
+ * survive host changes — `www.` ↔ apex on a white-label domain, or
+ * cross-subdomain navigation in dev — pass {@link CookieOptions.domain}
+ * (usually computed per request with {@link resolveCookieDomain}) and
+ * every cookie gains a `Domain=` attribute.
  */
 export const ID_TOKEN_COOKIE = 'vk_id_token';
 export const ACCESS_TOKEN_COOKIE = 'vk_access_token';
@@ -46,11 +50,14 @@ function resolve(opts) {
         secure: opts?.secure ?? defaultSecure(),
         refreshPath: opts?.refreshPath ?? '/auth',
         refreshMaxAgeSeconds: opts?.refreshMaxAgeSeconds ?? REFRESH_MAX_AGE_SECONDS,
+        domain: opts?.domain,
     };
 }
 function buildSetCookie(name, value, attrs, secure) {
     const parts = [`${name}=${encodeURIComponent(value)}`];
     parts.push(`Path=${attrs.path ?? '/'}`);
+    if (attrs.domain)
+        parts.push(`Domain=${attrs.domain}`);
     parts.push(`SameSite=${attrs.sameSite ?? 'Lax'}`);
     parts.push('HttpOnly');
     if (secure)
@@ -71,16 +78,17 @@ function buildSetCookie(name, value, attrs, secure) {
  * `REFRESH_TOKEN_AUTH` doesn't rotate the refresh token).
  */
 export function buildSessionCookies(tokens, options) {
-    const { secure, refreshPath, refreshMaxAgeSeconds } = resolve(options);
+    const { secure, refreshPath, refreshMaxAgeSeconds, domain } = resolve(options);
     const accessMaxAge = Math.max(60, Math.min(tokens.expiresIn, 3600));
     const headers = [];
-    headers.push(buildSetCookie(ID_TOKEN_COOKIE, tokens.idToken, { maxAge: accessMaxAge }, secure));
-    headers.push(buildSetCookie(ACCESS_TOKEN_COOKIE, tokens.accessToken, { maxAge: accessMaxAge }, secure));
+    headers.push(buildSetCookie(ID_TOKEN_COOKIE, tokens.idToken, { maxAge: accessMaxAge, ...(domain ? { domain } : {}) }, secure));
+    headers.push(buildSetCookie(ACCESS_TOKEN_COOKIE, tokens.accessToken, { maxAge: accessMaxAge, ...(domain ? { domain } : {}) }, secure));
     if (tokens.refreshToken) {
         headers.push(buildSetCookie(REFRESH_TOKEN_COOKIE, tokens.refreshToken, {
             path: refreshPath,
             maxAge: refreshMaxAgeSeconds,
             sameSite: 'Strict',
+            ...(domain ? { domain } : {}),
         }, secure));
     }
     return headers;
@@ -91,11 +99,11 @@ export function buildSessionCookies(tokens, options) {
  * terminally so the next attempt goes straight to sign-in.
  */
 export function buildClearSessionCookies(options) {
-    const { secure, refreshPath } = resolve(options);
+    const { secure, refreshPath, domain } = resolve(options);
     return [
-        buildSetCookie(ID_TOKEN_COOKIE, '', { maxAge: 0 }, secure),
-        buildSetCookie(ACCESS_TOKEN_COOKIE, '', { maxAge: 0 }, secure),
-        buildSetCookie(REFRESH_TOKEN_COOKIE, '', { path: refreshPath, maxAge: 0, sameSite: 'Strict' }, secure),
+        buildSetCookie(ID_TOKEN_COOKIE, '', { maxAge: 0, ...(domain ? { domain } : {}) }, secure),
+        buildSetCookie(ACCESS_TOKEN_COOKIE, '', { maxAge: 0, ...(domain ? { domain } : {}) }, secure),
+        buildSetCookie(REFRESH_TOKEN_COOKIE, '', { path: refreshPath, maxAge: 0, sameSite: 'Strict', ...(domain ? { domain } : {}) }, secure),
     ];
 }
 /**
@@ -144,6 +152,7 @@ export function buildOAuthStateCookie(provider, value, options) {
     return buildSetCookie(oauthStateCookieName(provider), value, {
         path: options?.path ?? '/auth',
         maxAge: options?.maxAgeSeconds ?? OAUTH_STATE_MAX_AGE_SECONDS,
+        ...(options?.domain ? { domain: options.domain } : {}),
     }, secure);
 }
 /**
@@ -153,7 +162,40 @@ export function buildOAuthStateCookie(provider, value, options) {
  */
 export function clearOAuthStateCookie(provider, options) {
     const secure = options?.secure ?? defaultSecure();
-    return buildSetCookie(oauthStateCookieName(provider), '', { path: options?.path ?? '/auth', maxAge: 0 }, secure);
+    return buildSetCookie(oauthStateCookieName(provider), '', {
+        path: options?.path ?? '/auth',
+        maxAge: 0,
+        ...(options?.domain ? { domain: options.domain } : {}),
+    }, secure);
+}
+/**
+ * Compute the {@link CookieOptions.domain} value for a request host on
+ * a white-label multi-tenant platform.
+ *
+ * Decision table (`platformApex: 'example.com'`):
+ *   - `app.example.com` → `undefined` (host-only) — or `example.com`
+ *     with `pinPlatform: true`.
+ *   - `www.acme.io` / `acme.io` (custom domain) → `acme.io`, so the
+ *     `www.` and bare hosts share the session.
+ *   - `''` → `undefined`.
+ *
+ * Ports are stripped (`app.example.com:3000` → platform host), and
+ * matching is case-insensitive. Pass the BROWSER-facing host — behind
+ * a same-origin SPA proxy that's the `origin`/`referer` host, not the
+ * Lambda's `host` header (see `getRequestHost` in
+ * `@venturekit/runtime`).
+ */
+export function resolveCookieDomain(requestHost, options) {
+    const host = requestHost.replace(/:\d+$/, '').toLowerCase();
+    if (!host)
+        return undefined;
+    const apex = options.platformApex.toLowerCase();
+    if (host === apex || host.endsWith(`.${apex}`)) {
+        return options.pinPlatform ? apex : undefined;
+    }
+    // Custom (white-label) domain — pin to the apex so `www.` and the
+    // bare domain share the session.
+    return host.replace(/^www\./, '');
 }
 /**
  * Read a single cookie out of a `Cookie:` header value. Returns `null`

package/dist/server/cookies.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/server/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AAkC7D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,IAAoB;IACnC,OAAO;QACL,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,aAAa,EAAE;QACvC,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,OAAO;QACzC,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,IAAI,uBAAuB;KAC5E,CAAC;AACJ,CAAC;AAWD,SAAS,cAAc,CACrB,IAAY,EACZ,KAAa,EACb,KAAkB,EAClB,MAAe;IAEf,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAqB,EACrB,OAAuB;IAEvB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAChG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACxG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CACV,cAAc,CACZ,oBAAoB,EACpB,MAAM,CAAC,YAAY,EACnB;YACE,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,oBAAoB;YAC5B,QAAQ,EAAE,QAAQ;SACnB,EACD,MAAM,CACP,CACF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAuB;IAC9D,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO;QACL,cAAc,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC;QAC1D,cAAc,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC;QAC9D,cAAc,CACZ,oBAAoB,EACpB,EAAE,EACF,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EACpD,MAAM,CACP;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,kBAAkB,QAAQ,EAAE,CAAC;AACtC,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,KAAa,EACb,OAAiC;IAEjC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,CAAC;IAClD,OAAO,cAAc,CACnB,oBAAoB,CAAC,QAAQ,CAAC,EAC9B,KAAK,EACL;QACE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,OAAO;QAC9B,MAAM,EAAE,OAAO,EAAE,aAAa,IAAI,2BAA2B;KAC9D,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,OAA0D;IAE1D,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,CAAC;IAClD,OAAO,cAAc,CACnB,oBAAoB,CAAC,QAAQ,CAAC,EAC9B,EAAE,EACF,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,EAC7C,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,eAA0C,EAC1C,IAAY;IAEZ,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;IAC1B,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/server/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AAuD7D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,IAAoB;IACnC,OAAO;QACL,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,aAAa,EAAE;QACvC,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,OAAO;QACzC,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,IAAI,uBAAuB;QAC3E,MAAM,EAAE,IAAI,EAAE,MAAM;KACrB,CAAC;AACJ,CAAC;AAaD,SAAS,cAAc,CACrB,IAAY,EACZ,KAAa,EACb,KAAkB,EAClB,MAAe;IAEf,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAqB,EACrB,OAAuB;IAEvB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,OAAO,CAAC,IAAI,CACV,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CACjH,CAAC;IACF,OAAO,CAAC,IAAI,CACV,cAAc,CAAC,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CACzH,CAAC;IACF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CACV,cAAc,CACZ,oBAAoB,EACpB,MAAM,CAAC,YAAY,EACnB;YACE,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,oBAAoB;YAC5B,QAAQ,EAAE,QAAQ;YAClB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,EACD,MAAM,CACP,CACF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAuB;IAC9D,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO;QACL,cAAc,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC;QACzF,cAAc,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC;QAC7F,cAAc,CACZ,oBAAoB,EACpB,EAAE,EACF,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACnF,MAAM,CACP;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,kBAAkB,QAAQ,EAAE,CAAC;AACtC,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,KAAa,EACb,OAAiC;IAEjC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,CAAC;IAClD,OAAO,cAAc,CACnB,oBAAoB,CAAC,QAAQ,CAAC,EAC9B,KAAK,EACL;QACE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,OAAO;QAC9B,MAAM,EAAE,OAAO,EAAE,aAAa,IAAI,2BAA2B;QAC7D,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,OAAqE;IAErE,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,CAAC;IAClD,OAAO,cAAc,CACnB,oBAAoB,CAAC,QAAQ,CAAC,EAC9B,EAAE,EACF;QACE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,OAAO;QAC9B,MAAM,EAAE,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAwBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,OAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC;IACD,kEAAkE;IAClE,iCAAiC;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,eAA0C,EAC1C,IAAY;IAEZ,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;IAC1B,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}