@voyant-travel/auth 0.128.2 → 0.129.0

package/dist/api-token-create.d.ts

@@ -13,4 +13,3 @@ export declare class ApiTokenValidationError extends Error {
  * Throws {@link ApiTokenValidationError} (→ 400) on any invalid input.
  */
 export declare function buildApiTokenCreateBody(body: Record<string, unknown>, accessCatalog?: AccessCatalog): Record<string, unknown>;
-//# sourceMappingURL=api-token-create.d.ts.map

package/dist/api-token-create.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-create.js","sourceRoot":"","sources":["../src/api-token-create.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,EAEjB,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAA;AAEtC,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU;IACV,MAAM;IACN,WAAW;IACX,WAAW;IACX,QAAQ;IACR,gBAAgB;IAChB,UAAU;IACV,aAAa;CACL,CAAA;AAEV,oDAAoD;AACpD,MAAM,UAAU,UAAU,CACxB,IAA6B,EAC7B,MAAyB;IAEzB,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,kGAAkG;AAClG,MAAM,OAAO,uBAAwB,SAAQ,KAAK;CAAG;AAErD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CACvB,IAAuB,EACvB,KAAoC;IAEpC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAA;IACpF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA6B,EAC7B,aAA6B;IAE7B,MAAM,qBAAqB,GAAG,aAAa,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;IACxD,MAAM,QAAQ,GAA4B,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;QACtE,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE;QACxB,CAAC,CAAC,EAAE,CAAA;IAEN,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;IACrF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,CACvD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,iBAAiB,IAAI,SAAS,CAAC,EAAE,KAAK,SAAS,CAClF,CAAA;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO;iBAC/C,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,iBAAiB,CAAC;iBAC3D,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;iBAChC,IAAI,EAAE,CAAA;YACT,MAAM,IAAI,uBAAuB,CAC/B,yBAAyB,SAAS,qBAAqB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAClF,CAAA;QACH,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,gBAAgB,CACnC,8BAA8B,CAAC,cAAc,CAAC,MAAM,CAAC,EACrD,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,WAAiC,CAAC,CAAC,CAAC,SAAS,CAC1F,CAAA;QACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpC,QAAQ,CAAC,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAA;QAC7C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,sBAAsB,CAAC,MAAM,CAAC,WAAgC,EAAE,qBAAqB,CAAC,CAAA;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAClD,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,IACE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ;YACrC,CAAE,iBAAuC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACrE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7F,CAAA;QACH,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC5B,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"api-token-create.js","sourceRoot":"","sources":["../src/api-token-create.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,EAEjB,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAA;AAEtC,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU;IACV,MAAM;IACN,WAAW;IACX,WAAW;IACX,QAAQ;IACR,gBAAgB;IAChB,UAAU;IACV,aAAa;CACL,CAAA;AAEV,oDAAoD;AACpD,MAAM,UAAU,UAAU,CACxB,IAA6B,EAC7B,MAAyB;IAEzB,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,kGAAkG;AAClG,MAAM,OAAO,uBAAwB,SAAQ,KAAK;CAAG;AAErD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CACvB,IAAuB,EACvB,KAAoC;IAEpC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAA;IACpF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA6B,EAC7B,aAA6B;IAE7B,MAAM,qBAAqB,GAAG,aAAa,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;IACxD,MAAM,QAAQ,GAA4B,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;QACtE,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE;QACxB,CAAC,CAAC,EAAE,CAAA;IAEN,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;IACrF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,CACvD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,iBAAiB,IAAI,SAAS,CAAC,EAAE,KAAK,SAAS,CAClF,CAAA;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO;iBAC/C,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,iBAAiB,CAAC;iBAC3D,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;iBAChC,IAAI,EAAE,CAAA;YACT,MAAM,IAAI,uBAAuB,CAC/B,yBAAyB,SAAS,qBAAqB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAClF,CAAA;QACH,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,gBAAgB,CACnC,8BAA8B,CAAC,cAAc,CAAC,MAAM,CAAC,EACrD,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,WAAiC,CAAC,CAAC,CAAC,SAAS,CAC1F,CAAA;QACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpC,QAAQ,CAAC,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAA;QAC7C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,sBAAsB,CAAC,MAAM,CAAC,WAAgC,EAAE,qBAAqB,CAAC,CAAA;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAClD,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,IACE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ;YACrC,CAAE,iBAAuC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACrE,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7F,CAAA;QACH,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC5B,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC","sourcesContent":["import {\n  type AccessCatalog,\n  API_KEY_AUDIENCES,\n  type ApiKeyPermissions,\n  assertKnownPermissions,\n  permissionStringsToPermissions,\n  UnknownApiKeyPermissionError,\n} from \"@voyant-travel/types/api-keys\"\n\n/** Fields accepted on a create-API-token request body (allowlist). */\nexport const API_TOKEN_CREATE_FIELDS = [\n  \"configId\",\n  \"name\",\n  \"expiresIn\",\n  \"remaining\",\n  \"prefix\",\n  \"organizationId\",\n  \"metadata\",\n  \"permissions\",\n] as const\n\n/** Pick an allowlisted subset of a request body. */\nexport function pickFields(\n  body: Record<string, unknown>,\n  fields: readonly string[],\n): Record<string, unknown> {\n  const next: Record<string, unknown> = {}\n  for (const field of fields) {\n    if (body[field] !== undefined) next[field] = body[field]\n  }\n  return next\n}\n\n/** Thrown when a create body carries an invalid grant preset, permission, or audience (→ 400). */\nexport class ApiTokenValidationError extends Error {}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\n/** Union two permission maps (used to layer explicit permissions over a preset's). */\nfunction mergePermissions(\n  base: ApiKeyPermissions,\n  extra: ApiKeyPermissions | undefined,\n): ApiKeyPermissions {\n  const out: ApiKeyPermissions = {}\n  for (const [resource, actions] of Object.entries(base)) out[resource] = [...actions]\n  if (extra) {\n    for (const [resource, actions] of Object.entries(extra)) {\n      out[resource] = Array.from(new Set([...(out[resource] ?? []), ...actions]))\n    }\n  }\n  return out\n}\n\n/**\n * Build the `createApiKey` body from a request body: resolve an optional\n * `grantPreset` (permissions subset + audience), validate all permission strings\n * against the known resource/action taxonomy, and validate the grant audience.\n * Throws {@link ApiTokenValidationError} (→ 400) on any invalid input.\n */\nexport function buildApiTokenCreateBody(\n  body: Record<string, unknown>,\n  accessCatalog?: AccessCatalog,\n): Record<string, unknown> {\n  const selectedAccessCatalog = accessCatalog ?? { resources: [], presets: [] }\n  const fields = pickFields(body, API_TOKEN_CREATE_FIELDS)\n  const metadata: Record<string, unknown> = isPlainObject(fields.metadata)\n    ? { ...fields.metadata }\n    : {}\n\n  const presetKey = typeof body.grantPreset === \"string\" ? body.grantPreset : undefined\n  if (presetKey !== undefined) {\n    const selectedPreset = selectedAccessCatalog.presets.find(\n      (candidate) => candidate.kind === \"api-token-grant\" && candidate.id === presetKey,\n    )\n    if (!selectedPreset) {\n      const knownPresets = selectedAccessCatalog.presets\n        .filter((candidate) => candidate.kind === \"api-token-grant\")\n        .map((candidate) => candidate.id)\n        .sort()\n      throw new ApiTokenValidationError(\n        `Unknown grant preset \"${presetKey}\". Known presets: ${knownPresets.join(\", \")}.`,\n      )\n    }\n    fields.permissions = mergePermissions(\n      permissionStringsToPermissions(selectedPreset.grants),\n      isPlainObject(fields.permissions) ? (fields.permissions as ApiKeyPermissions) : undefined,\n    )\n    if (metadata.audience === undefined) {\n      metadata.audience = selectedPreset.audience\n    }\n  }\n\n  if (fields.permissions !== undefined) {\n    try {\n      assertKnownPermissions(fields.permissions as ApiKeyPermissions, selectedAccessCatalog)\n    } catch (error) {\n      if (error instanceof UnknownApiKeyPermissionError) {\n        throw new ApiTokenValidationError(error.message)\n      }\n      throw error\n    }\n  }\n\n  if (metadata.audience !== undefined) {\n    if (\n      typeof metadata.audience !== \"string\" ||\n      !(API_KEY_AUDIENCES as readonly string[]).includes(metadata.audience)\n    ) {\n      throw new ApiTokenValidationError(\n        `Invalid audience \"${String(metadata.audience)}\". Allowed: ${API_KEY_AUDIENCES.join(\", \")}.`,\n      )\n    }\n    fields.metadata = metadata\n  }\n\n  return fields\n}\n"]}

package/dist/api-token-rotation.d.ts

@@ -51,4 +51,3 @@ export declare function rotateApiTokenSecret({ keyId, body, userId, options, aut
     expiresAt: Date | null;
 }>;
 export {};
-//# sourceMappingURL=api-token-rotation.d.ts.map

package/dist/api-token-rotation.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-rotation.js","sourceRoot":"","sources":["../src/api-token-rotation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAqB,MAAM,8BAA8B,CAAA;AAC7E,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAEhC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AACtC,MAAM,uBAAuB,GAAG,EAAE,CAAA;AAClC,MAAM,yBAAyB,GAAG,sDAAsD,CAAA;AA4DxF,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC9D,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;AACpD,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,IAAI,MAAM,GAAG,MAAM,CAAA;IAEnB,OAAO,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,uBAAuB,CAAC,CAAA;QACrD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAE7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,IAAI,GAAG;gBAAE,SAAQ;YACzB,MAAM,IAAI,yBAAyB,CAAC,IAAI,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;YAC5E,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB;gBAAE,MAAK;QACrE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAgC,CAAA;IAC/F,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEvE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAA;QAC3C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,IAAI,CAAA;IACV,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAiB,EAAE,SAAe,EAAE,aAA4B;IAC9F,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC9C,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IACnD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IACvD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC3D,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACvF,CAAC,CAAC,EAAE,CAAA;IAEN,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE;YACN,GAAG,MAAM;YACT,QAAQ,EAAE;gBACR,GAAG,QAAQ;gBACX,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC;gBACtD,aAAa,EAAE,SAAS,CAAC,WAAW,EAAE;gBACtC,cAAc,EAAE,aAAa;oBAC3B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACtE,CAAC,CAAC,cAAc;aACnB;SACF;KACF,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAwB,EAAE,GAAY;IAClE,OAAO;QACL,GAAG,GAAG;QACN,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvC,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC;KAC9C,CAAA;AACH,CAAC;AAED,SAAS,kCAAkC,CAAC,EAAsB;IAChE,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC3F,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ;YACxC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,WAAW,CAAC;iBACnB,GAAG,CAAC;gBACH,GAAG,EAAE,QAAQ,CAAC,OAAO;gBACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;iBAChC,SAAS,EAAE,CAAA;YACd,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,KAAK,EACL,IAAI,EACJ,MAAM,EACN,OAAO,EACP,SAAS,GACgB;IACzB,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa;QACrB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAE3E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,EAAE;YAC7E,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,SAAS,CAAC;QACd,KAAK;QACL,MAAM;QACN,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,uBAAuB,CAAA;IACzD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,IAAI,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAA;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/E,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,oBAAoB,CAAC,KAAK,EAAE;QAC9D,OAAO,EAAE,MAAM,eAAe,CAAC,GAAG,CAAC;QACnC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1B,SAAS,EAAE,GAAG;QACd,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;KACnC,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AAC3C,CAAC"}
+{"version":3,"file":"api-token-rotation.js","sourceRoot":"","sources":["../src/api-token-rotation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAqB,MAAM,8BAA8B,CAAA;AAC7E,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAEhC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AACtC,MAAM,uBAAuB,GAAG,EAAE,CAAA;AAClC,MAAM,yBAAyB,GAAG,sDAAsD,CAAA;AA4DxF,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC9D,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;AACpD,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,IAAI,MAAM,GAAG,MAAM,CAAA;IAEnB,OAAO,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,uBAAuB,CAAC,CAAA;QACrD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAE7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,IAAI,GAAG;gBAAE,SAAQ;YACzB,MAAM,IAAI,yBAAyB,CAAC,IAAI,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;YAC5E,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB;gBAAE,MAAK;QACrE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAgC,CAAA;IAC/F,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEvE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAA;QAC3C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,IAAI,CAAA;IACV,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAiB,EAAE,SAAe,EAAE,aAA4B;IAC9F,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC9C,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IACnD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IACvD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC3D,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACvF,CAAC,CAAC,EAAE,CAAA;IAEN,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE;YACN,GAAG,MAAM;YACT,QAAQ,EAAE;gBACR,GAAG,QAAQ;gBACX,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC;gBACtD,aAAa,EAAE,SAAS,CAAC,WAAW,EAAE;gBACtC,cAAc,EAAE,aAAa;oBAC3B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACtE,CAAC,CAAC,cAAc;aACnB;SACF;KACF,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAwB,EAAE,GAAY;IAClE,OAAO;QACL,GAAG,GAAG;QACN,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvC,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC;KAC9C,CAAA;AACH,CAAC;AAED,SAAS,kCAAkC,CAAC,EAAsB;IAChE,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC3F,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ;YACxC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,WAAW,CAAC;iBACnB,GAAG,CAAC;gBACH,GAAG,EAAE,QAAQ,CAAC,OAAO;gBACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;iBAChC,SAAS,EAAE,CAAA;YACd,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,KAAK,EACL,IAAI,EACJ,MAAM,EACN,OAAO,EACP,SAAS,GACgB;IACzB,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa;QACrB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAE3E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,EAAE;YAC7E,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,SAAS,CAAC;QACd,KAAK;QACL,MAAM;QACN,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,uBAAuB,CAAA;IACzD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,IAAI,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAA;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/E,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,oBAAoB,CAAC,KAAK,EAAE;QAC9D,OAAO,EAAE,MAAM,eAAe,CAAC,GAAG,CAAC;QACnC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1B,SAAS,EAAE,GAAG;QACd,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;KACnC,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AAC3C,CAAC","sourcesContent":["import type { getDb } from \"@voyant-travel/db\"\nimport { apikeyTable, type SelectApikey } from \"@voyant-travel/db/schema/iam\"\nimport { eq } from \"drizzle-orm\"\n\nconst API_TOKEN_SECRET_PREFIX = \"voy_\"\nconst API_TOKEN_SECRET_LENGTH = 64\nconst API_TOKEN_SECRET_ALPHABET = \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\"\n\ntype ApiTokenRotationRow = Pick<\n  SelectApikey,\n  | \"id\"\n  | \"configId\"\n  | \"name\"\n  | \"start\"\n  | \"prefix\"\n  | \"referenceId\"\n  | \"enabled\"\n  | \"rateLimitEnabled\"\n  | \"rateLimitTimeWindow\"\n  | \"rateLimitMax\"\n  | \"requestCount\"\n  | \"remaining\"\n  | \"lastRequest\"\n  | \"createdAt\"\n  | \"updatedAt\"\n  | \"expiresAt\"\n  | \"permissions\"\n  | \"metadata\"\n>\n\ninterface ApiTokenSecretRotation {\n  keyHash: string\n  start: string\n  updatedAt: Date\n  metadata: string | null\n}\n\ntype ApiTokenRotationDb = Pick<ReturnType<typeof getDb>, \"select\" | \"update\">\n\nexport interface ApiTokenRotationStore {\n  getApiToken(keyId: string): Promise<ApiTokenRotationRow | null>\n  rotateApiTokenSecret(\n    keyId: string,\n    rotation: ApiTokenSecretRotation,\n  ): Promise<ApiTokenRotationRow | null>\n}\n\nexport interface ApiTokenRotationOptions {\n  db?: ApiTokenRotationDb\n  rotationStore?: ApiTokenRotationStore\n  generateApiTokenSecret?: (prefix: string) => string\n}\n\ninterface RotateApiTokenSecretArgs {\n  keyId: string\n  body: Record<string, unknown>\n  userId: string\n  options: ApiTokenRotationOptions\n  authorize: (input: {\n    keyId: string\n    configId?: string\n    enabled: boolean\n    userId: string\n  }) => Promise<void>\n}\n\nfunction encodeBase64Url(bytes: Uint8Array): string {\n  let binary = \"\"\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte)\n  }\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\")\n}\n\nasync function sha256Base64Url(input: string): Promise<string> {\n  const data = new TextEncoder().encode(input)\n  const hashBuffer = await crypto.subtle.digest(\"SHA-256\", data)\n  return encodeBase64Url(new Uint8Array(hashBuffer))\n}\n\nfunction generateApiTokenSecret(prefix: string): string {\n  let secret = prefix\n\n  while (secret.length < prefix.length + API_TOKEN_SECRET_LENGTH) {\n    const bytes = new Uint8Array(API_TOKEN_SECRET_LENGTH)\n    crypto.getRandomValues(bytes)\n\n    for (const byte of bytes) {\n      if (byte >= 208) continue\n      secret += API_TOKEN_SECRET_ALPHABET[byte % API_TOKEN_SECRET_ALPHABET.length]\n      if (secret.length >= prefix.length + API_TOKEN_SECRET_LENGTH) break\n    }\n  }\n\n  return secret\n}\n\nfunction parseJsonObject(value: unknown): Record<string, unknown> | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === \"object\" && !Array.isArray(value)) return value as Record<string, unknown>\n  if (typeof value !== \"string\" || value.trim().length === 0) return null\n\n  try {\n    const parsed = JSON.parse(value) as unknown\n    return typeof parsed === \"object\" && parsed !== null && !Array.isArray(parsed)\n      ? (parsed as Record<string, unknown>)\n      : null\n  } catch {\n    return null\n  }\n}\n\nfunction appendRotationMetadata(metadata: unknown, rotatedAt: Date, previousStart: string | null) {\n  const parsed = parseJsonObject(metadata) ?? {}\n  const voyant = parseJsonObject(parsed.voyant) ?? {}\n  const apiToken = parseJsonObject(voyant.apiToken) ?? {}\n  const previousStarts = Array.isArray(apiToken.previousStarts)\n    ? apiToken.previousStarts.filter((value): value is string => typeof value === \"string\")\n    : []\n\n  return {\n    ...parsed,\n    voyant: {\n      ...voyant,\n      apiToken: {\n        ...apiToken,\n        rotationCount: Number(apiToken.rotationCount ?? 0) + 1,\n        lastRotatedAt: rotatedAt.toISOString(),\n        previousStarts: previousStart\n          ? Array.from(new Set([previousStart, ...previousStarts])).slice(0, 10)\n          : previousStarts,\n      },\n    },\n  }\n}\n\nfunction serializeApiTokenRow(row: ApiTokenRotationRow, key?: string) {\n  return {\n    ...row,\n    ...(key ? { key } : {}),\n    metadata: parseJsonObject(row.metadata),\n    permissions: parseJsonObject(row.permissions),\n  }\n}\n\nfunction createDrizzleApiTokenRotationStore(db: ApiTokenRotationDb): ApiTokenRotationStore {\n  return {\n    async getApiToken(keyId) {\n      const [row] = await db.select().from(apikeyTable).where(eq(apikeyTable.id, keyId)).limit(1)\n      return row ?? null\n    },\n    async rotateApiTokenSecret(keyId, rotation) {\n      const [row] = await db\n        .update(apikeyTable)\n        .set({\n          key: rotation.keyHash,\n          start: rotation.start,\n          updatedAt: rotation.updatedAt,\n          metadata: rotation.metadata,\n        })\n        .where(eq(apikeyTable.id, keyId))\n        .returning()\n      return row ?? null\n    },\n  }\n}\n\nexport async function rotateApiTokenSecret({\n  keyId,\n  body,\n  userId,\n  options,\n  authorize,\n}: RotateApiTokenSecretArgs) {\n  const rotationStore =\n    options.rotationStore ??\n    (options.db ? createDrizzleApiTokenRotationStore(options.db) : undefined)\n\n  if (!rotationStore) {\n    throw Object.assign(new Error(\"API token rotation requires a rotation store\"), {\n      status: 500,\n    })\n  }\n\n  const existing = await rotationStore.getApiToken(keyId)\n  if (!existing) {\n    throw Object.assign(new Error(\"API token not found\"), { status: 404 })\n  }\n\n  await authorize({\n    keyId,\n    userId,\n    enabled: existing.enabled,\n    configId: typeof body.configId === \"string\" ? body.configId : undefined,\n  })\n\n  const prefix = existing.prefix ?? API_TOKEN_SECRET_PREFIX\n  const key = (options.generateApiTokenSecret ?? generateApiTokenSecret)(prefix)\n  const now = new Date()\n  const metadata = appendRotationMetadata(existing.metadata, now, existing.start)\n  const updated = await rotationStore.rotateApiTokenSecret(keyId, {\n    keyHash: await sha256Base64Url(key),\n    start: key.substring(0, 6),\n    updatedAt: now,\n    metadata: JSON.stringify(metadata),\n  })\n\n  if (!updated) {\n    throw Object.assign(new Error(\"API token not found\"), { status: 404 })\n  }\n\n  return serializeApiTokenRow(updated, key)\n}\n"]}

package/dist/auth-facades.d.ts

@@ -99,4 +99,3 @@ export declare function handleOrganizationMembersRequest(request: Request, auth:
 export declare function handleApiTokenManagementRequest(request: Request, auth: {
     api: unknown;
 }, options?: HandleApiTokenManagementRequestOptions): Promise<Response | null>;
-//# sourceMappingURL=auth-facades.d.ts.map

package/dist/auth-facades.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-facades.js","sourceRoot":"","sources":["../src/auth-facades.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAEhF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACpG,OAAO,EAGL,oBAAoB,GACrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAGL,wBAAwB,GACzB,MAAM,gBAAgB,CAAA;AAuFvB,MAAM,sBAAsB,GAAG;IAC7B,UAAU;IACV,gBAAgB;IAChB,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,eAAe;CACP,CAAA;AAEV,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,MAAM;IACN,SAAS;IACT,WAAW;IACX,UAAU;IACV,aAAa;CACL,CAAA;AAIV,SAAS,4BAA4B,CAAC,MAA0B;IAC9D,IACE,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG,EACd,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,SAAS,GAAG,KAAmE,CAAA;IACrF,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,CAAA;IACrF,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,IAAI,0BAA0B,EAAE,EAAE,MAAM,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,OAAqB;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAiB;IACzC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC1F,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;IAC5D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;IAE3D,IAAI,cAAc,KAAK,GAAG,cAAc,aAAa,EAAE,CAAC;QACtD,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,cAAc,cAAc,CAAC,EAAE,CAAC;QAC/D,OAAO,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;IACpD,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB,EAAE,QAAgB;IAClE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;IAE3D,OAAO,cAAc,KAAK,GAAG,cAAc,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAgB,EAAE,QAAgB;IACvE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;IAE3D,OAAO,cAAc,KAAK,GAAG,cAAc,4BAA4B,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAA;AAClG,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,KAAK,GAA4B,EAAE,CAAA;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAA;IAEhD,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,KAAK,KAAK,IAAI;YAAE,SAAQ;QAC5B,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC1E,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,IAA6B;IAE7B,MAAM,KAAK,GAAkD,EAAE,CAAA;IAE/D,KAAK,MAAM,KAAK,IAAI;QAClB,WAAW;QACX,UAAU;QACV,QAAQ;QACR,UAAU;QACV,mBAAmB;KACX,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACzB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QAEjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,SAAS,GACb,KAAK,KAAK,QAAQ;YAChB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,KAAK,KAAK,UAAU;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,KAAK,KAAK,mBAAmB;oBAC7B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,GAAG,CAAA;QACb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC1D,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,YAAY,SAAS,sBAAsB,CAAC,EAAE;gBAClF,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;IACtB,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;IAC1C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5E,CAAC,CAAE,MAAkC;QACrC,CAAC,CAAC,EAAE,CAAA;AACR,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAkC,EAAE,OAAgB;IACxF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,IAAkC,EAAE,OAAgB;IAC9F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,IAAkC,EAClC,OAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAgB;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAA;IAChD,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAA;IAC3D,OAAO;QACL,cAAc,EAAE,cAAc,IAAI,SAAS;KAC5C,CAAA;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,SAA2C;IAC3E,IAAI,SAAS,YAAY,IAAI;QAAE,OAAO,SAAS,CAAC,WAAW,EAAE,CAAA;IAC7D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3E,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;AAClC,CAAC;AAED,KAAK,UAAU,kCAAkC,CAC/C,EAA4B,EAC5B,KAAmC;IAEnC,IAAI,KAAK,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC,cAAc,CAAA;IACrD,IAAI,KAAK,CAAC,oBAAoB;QAAE,OAAO,KAAK,CAAC,oBAAoB,CAAA;IAEjE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,oBAAoB,EAAE,WAAW,CAAC,oBAAoB,EAAE,CAAC;aAClE,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;aAC1C,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,OAAO,EAAE,oBAAoB;YAAE,OAAO,OAAO,CAAC,oBAAoB,CAAA;IACxE,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC;SACrD,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,UAAU,EAAE,cAAc,IAAI,IAAI,CAAA;AAC3C,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,EAA4B,EAC5B,KAAmC;IAEnC,MAAM,cAAc,GAAG,MAAM,kCAAkC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAC1E,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,CAAA;IAE9B,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,EAAE;SAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;SAC7B,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;SAC9F,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,WAAW,EAAE,QAAQ,CAAC,EAAE;QACxB,SAAS,EAAE,QAAQ,CAAC,KAAK;QACzB,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,SAAS,EAAE,QAAQ,CAAC,KAAK;KAC1B,CAAC;SACD,IAAI,CAAC,UAAU,CAAC;SAChB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;SACvD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SACpD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IAErC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC;QAClD,IAAI,EAAE;YACJ,EAAE,EAAE,GAAG,CAAC,WAAW;YACnB,KAAK,EAAE,GAAG,CAAC,SAAS;YACpB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,KAAK,EAAE,GAAG,CAAC,SAAS;SACrB;KACF,CAAC,CAAC,CAAA;AACL,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,IAAsB,EACtB,OAA2C;IAE3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAA;IACjG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAE9B,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QAE3C,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAChD,EAAE,GAAG,EAAE,IAAI,CAAC,GAA0B,EAAE,EACxC,OAAO,CAAC,OAAO,CAChB,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE;YACpF,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,GAAG,iBAAiB,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAgB,EAChB,IAAsB,EACtB,OAAgD;IAEhD,MAAM,IAAI,GAAG,6BAA6B,CACxC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAC7B,OAAO,CAAC,QAAQ,IAAI,OAAO,CAC5B,CAAA;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAE9B,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;QAE9D,MAAM,OAAO,GAAG,MAAM,iCAAiC,CACrD,EAAE,GAAG,EAAE,IAAI,CAAC,GAA0B,EAAE,EACxC,OAAO,CAAC,OAAO,CAChB,CAAA;QACD,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,uBAAuB,IAAI,6BAA6B,CAAC,CACtF,OAAO,CAAC,EAAE,EACV;YACE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE;YAC9B,oBAAoB,EAAE,OAAO,CAAC,OAAO,EAAE,oBAAoB;YAC3D,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAA;QAED,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAgB,EAChB,IAAsB,EACtB,UAAkD,EAAE;IAEpD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAA;IAC3F,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAA0B,CAAA;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAEtD,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC;oBACnC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC;oBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAA;gBACF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;YAC7B,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;gBAC5C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;gBACtE,IAAI,UAAmC,CAAA;gBACvC,IAAI,CAAC;oBACH,UAAU,GAAG,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;gBACnE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;wBAC7C,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;oBACpD,CAAC;oBACD,MAAM,KAAK,CAAA;gBACb,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC;oBACpC,IAAI,EAAE;wBACJ,GAAG,UAAU;wBACb,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;qBACxB;iBACF,CAAC,CAAA;gBACF,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAClC,CAAC;YAED,OAAO,gBAAgB,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;QAC1C,CAAC;QAED,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAEhE,MAAM,KAAK,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;YAChD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;YACtE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;gBACxC,KAAK;gBACL,IAAI;gBACJ,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,OAAO;gBACP,SAAS,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;oBACxD,MAAM,GAAG,CAAC,YAAY,CAAC;wBACrB,IAAI,EAAE;4BACJ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACjC,KAAK;4BACL,OAAO;4BACP,MAAM;yBACP;qBACF,CAAC,CAAA;gBACJ,CAAC;aACF,CAAC,CAAA;YAEF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;YAE7C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;gBAC5C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;gBACtE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC;oBACpC,IAAI,EAAE;wBACJ,GAAG,UAAU,CAAC,IAAI,EAAE,uBAAuB,CAAC;wBAC5C,KAAK;wBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;qBACxB;iBACF,CAAC,CAAA;gBACF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;YAC7B,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;gBAC5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC;oBACpC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE;oBAClD,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAA;gBACF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;YAC7B,CAAC;YAED,OAAO,gBAAgB,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth-facades.js","sourceRoot":"","sources":["../src/auth-facades.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAEhF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACpG,OAAO,EAGL,oBAAoB,GACrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAGL,wBAAwB,GACzB,MAAM,gBAAgB,CAAA;AAuFvB,MAAM,sBAAsB,GAAG;IAC7B,UAAU;IACV,gBAAgB;IAChB,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,eAAe;CACP,CAAA;AAEV,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,MAAM;IACN,SAAS;IACT,WAAW;IACX,UAAU;IACV,aAAa;CACL,CAAA;AAIV,SAAS,4BAA4B,CAAC,MAA0B;IAC9D,IACE,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG,EACd,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,SAAS,GAAG,KAAmE,CAAA;IACrF,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,CAAA;IACrF,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,IAAI,0BAA0B,EAAE,EAAE,MAAM,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,OAAqB;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAiB;IACzC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC1F,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;IAC5D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;IAE3D,IAAI,cAAc,KAAK,GAAG,cAAc,aAAa,EAAE,CAAC;QACtD,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,cAAc,cAAc,CAAC,EAAE,CAAC;QAC/D,OAAO,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;IACpD,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB,EAAE,QAAgB;IAClE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;IAE3D,OAAO,cAAc,KAAK,GAAG,cAAc,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAgB,EAAE,QAAgB;IACvE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;IAE3D,OAAO,cAAc,KAAK,GAAG,cAAc,4BAA4B,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAA;AAClG,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,KAAK,GAA4B,EAAE,CAAA;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAA;IAEhD,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,KAAK,KAAK,IAAI;YAAE,SAAQ;QAC5B,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC1E,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,IAA6B;IAE7B,MAAM,KAAK,GAAkD,EAAE,CAAA;IAE/D,KAAK,MAAM,KAAK,IAAI;QAClB,WAAW;QACX,UAAU;QACV,QAAQ;QACR,UAAU;QACV,mBAAmB;KACX,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACzB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QAEjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,SAAS,GACb,KAAK,KAAK,QAAQ;YAChB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,KAAK,KAAK,UAAU;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,KAAK,KAAK,mBAAmB;oBAC7B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,GAAG,CAAA;QACb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC1D,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,YAAY,SAAS,sBAAsB,CAAC,EAAE;gBAClF,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;IACtB,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;IAC1C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5E,CAAC,CAAE,MAAkC;QACrC,CAAC,CAAC,EAAE,CAAA;AACR,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAkC,EAAE,OAAgB;IACxF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,IAAkC,EAAE,OAAgB;IAC9F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,IAAkC,EAClC,OAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAgB;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAA;IAChD,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAA;IAC3D,OAAO;QACL,cAAc,EAAE,cAAc,IAAI,SAAS;KAC5C,CAAA;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,SAA2C;IAC3E,IAAI,SAAS,YAAY,IAAI;QAAE,OAAO,SAAS,CAAC,WAAW,EAAE,CAAA;IAC7D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3E,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;AAClC,CAAC;AAED,KAAK,UAAU,kCAAkC,CAC/C,EAA4B,EAC5B,KAAmC;IAEnC,IAAI,KAAK,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC,cAAc,CAAA;IACrD,IAAI,KAAK,CAAC,oBAAoB;QAAE,OAAO,KAAK,CAAC,oBAAoB,CAAA;IAEjE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,oBAAoB,EAAE,WAAW,CAAC,oBAAoB,EAAE,CAAC;aAClE,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;aAC1C,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,OAAO,EAAE,oBAAoB;YAAE,OAAO,OAAO,CAAC,oBAAoB,CAAA;IACxE,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC;SACrD,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,UAAU,EAAE,cAAc,IAAI,IAAI,CAAA;AAC3C,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,EAA4B,EAC5B,KAAmC;IAEnC,MAAM,cAAc,GAAG,MAAM,kCAAkC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAC1E,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,CAAA;IAE9B,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,EAAE;SAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;SAC7B,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;SAC9F,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,WAAW,EAAE,QAAQ,CAAC,EAAE;QACxB,SAAS,EAAE,QAAQ,CAAC,KAAK;QACzB,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,SAAS,EAAE,QAAQ,CAAC,KAAK;KAC1B,CAAC;SACD,IAAI,CAAC,UAAU,CAAC;SAChB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;SACvD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;SACpD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IAErC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC;QAClD,IAAI,EAAE;YACJ,EAAE,EAAE,GAAG,CAAC,WAAW;YACnB,KAAK,EAAE,GAAG,CAAC,SAAS;YACpB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,KAAK,EAAE,GAAG,CAAC,SAAS;SACrB;KACF,CAAC,CAAC,CAAA;AACL,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,IAAsB,EACtB,OAA2C;IAE3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAA;IACjG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAE9B,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QAE3C,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAChD,EAAE,GAAG,EAAE,IAAI,CAAC,GAA0B,EAAE,EACxC,OAAO,CAAC,OAAO,CAChB,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE;YACpF,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,GAAG,iBAAiB,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAgB,EAChB,IAAsB,EACtB,OAAgD;IAEhD,MAAM,IAAI,GAAG,6BAA6B,CACxC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAC7B,OAAO,CAAC,QAAQ,IAAI,OAAO,CAC5B,CAAA;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAE9B,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;QAE9D,MAAM,OAAO,GAAG,MAAM,iCAAiC,CACrD,EAAE,GAAG,EAAE,IAAI,CAAC,GAA0B,EAAE,EACxC,OAAO,CAAC,OAAO,CAChB,CAAA;QACD,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,uBAAuB,IAAI,6BAA6B,CAAC,CACtF,OAAO,CAAC,EAAE,EACV;YACE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE;YAC9B,oBAAoB,EAAE,OAAO,CAAC,OAAO,EAAE,oBAAoB;YAC3D,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CACF,CAAA;QAED,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAgB,EAChB,IAAsB,EACtB,UAAkD,EAAE;IAEpD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAA;IAC3F,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAA0B,CAAA;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAEtD,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC;oBACnC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC;oBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAA;gBACF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;YAC7B,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;gBAC5C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;gBACtE,IAAI,UAAmC,CAAA;gBACvC,IAAI,CAAC;oBACH,UAAU,GAAG,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;gBACnE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;wBAC7C,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;oBACpD,CAAC;oBACD,MAAM,KAAK,CAAA;gBACb,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC;oBACpC,IAAI,EAAE;wBACJ,GAAG,UAAU;wBACb,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;qBACxB;iBACF,CAAC,CAAA;gBACF,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAClC,CAAC;YAED,OAAO,gBAAgB,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;QAC1C,CAAC;QAED,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;YAEhE,MAAM,KAAK,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;YAChD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;YACtE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;gBACxC,KAAK;gBACL,IAAI;gBACJ,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,OAAO;gBACP,SAAS,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;oBACxD,MAAM,GAAG,CAAC,YAAY,CAAC;wBACrB,IAAI,EAAE;4BACJ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACjC,KAAK;4BACL,OAAO;4BACP,MAAM;yBACP;qBACF,CAAC,CAAA;gBACJ,CAAC;aACF,CAAC,CAAA;YAEF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;YAE7C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;gBAC5C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;gBACtE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC;oBACpC,IAAI,EAAE;wBACJ,GAAG,UAAU,CAAC,IAAI,EAAE,uBAAuB,CAAC;wBAC5C,KAAK;wBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;qBACxB;iBACF,CAAC,CAAA;gBACF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;YAC7B,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;gBAC5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC;oBACpC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE;oBAClD,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAA;gBACF,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;YAC7B,CAAC;YAED,OAAO,gBAAgB,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;AACH,CAAC","sourcesContent":["import type { getDb } from \"@voyant-travel/db\"\nimport { authMember, authSession, authUser } from \"@voyant-travel/db/schema/iam\"\nimport type { AccessCatalog } from \"@voyant-travel/types/api-keys\"\nimport { and, asc, eq } from \"drizzle-orm\"\n\nimport { ApiTokenValidationError, buildApiTokenCreateBody, pickFields } from \"./api-token-create.js\"\nimport {\n  type ApiTokenRotationOptions,\n  type ApiTokenRotationStore,\n  rotateApiTokenSecret,\n} from \"./api-token-rotation.js\"\nimport {\n  type CurrentUser,\n  type UpdateCurrentUserProfileInput,\n  updateCurrentUserProfile,\n} from \"./workspace.js\"\n\ntype BetterAuthApiKeySession = {\n  user: {\n    id: string\n  }\n  session?: {\n    id?: string\n    activeOrganizationId?: string | null\n  }\n}\n\ntype BetterAuthApiKeyApi = {\n  getSession: (args: { headers: Headers }) => Promise<BetterAuthApiKeySession | null>\n  listApiKeys: (args: { query?: Record<string, unknown>; headers: Headers }) => Promise<unknown>\n  createApiKey: (args: { body: Record<string, unknown>; headers?: Headers }) => Promise<unknown>\n  updateApiKey: (args: { body: Record<string, unknown>; headers?: Headers }) => Promise<unknown>\n  deleteApiKey: (args: { body: Record<string, unknown>; headers: Headers }) => Promise<unknown>\n}\n\nexport type BetterAuthApiTokenManagement = {\n  api: BetterAuthApiKeyApi\n}\n\nexport interface HandleApiTokenManagementRequestOptions extends ApiTokenRotationOptions {\n  /**\n   * Auth route mount path. Voyant operator APIs mount Better Auth under\n   * `/auth`, which makes the facade routes `/auth/api-tokens`.\n   */\n  basePath?: string\n  accessCatalog?: AccessCatalog\n}\n\nexport interface HandleAccountProfileRequestOptions {\n  /**\n   * Auth route mount path. Voyant operator APIs mount Better Auth under\n   * `/auth`, which makes the account profile route `/auth/me`.\n   */\n  basePath?: string\n  db: ReturnType<typeof getDb>\n  updateProfile?: AccountProfileUpdateHandler\n}\n\nexport type AccountProfileUpdateHandler = (\n  db: ReturnType<typeof getDb>,\n  input: UpdateCurrentUserProfileInput,\n) => Promise<CurrentUser | null>\n\nexport interface OrganizationMembersListInput {\n  userId: string\n  organizationId?: string\n  activeOrganizationId?: string | null\n  sessionId?: string\n}\n\nexport type OrganizationMemberRecord = {\n  id: string\n  userId: string\n  organizationId: string\n  role: string\n  createdAt: string\n  user: {\n    id: string\n    email: string | null\n    name?: string | null\n    image?: string | null\n  }\n}\n\nexport type OrganizationMembersListHandler = (\n  db: ReturnType<typeof getDb>,\n  input: OrganizationMembersListInput,\n) => Promise<OrganizationMemberRecord[]>\n\nexport interface HandleOrganizationMembersRequestOptions {\n  /**\n   * Auth route mount path. Voyant operator APIs mount Better Auth under\n   * `/auth`, which makes the organization member route\n   * `/auth/organization/list-members`.\n   */\n  basePath?: string\n  db: ReturnType<typeof getDb>\n  listOrganizationMembers?: OrganizationMembersListHandler\n}\n\ntype ApiTokenErrorStatus = 400 | 401 | 403 | 404 | 405 | 429 | 500\n\nconst API_TOKEN_QUERY_FIELDS = [\n  \"configId\",\n  \"organizationId\",\n  \"limit\",\n  \"offset\",\n  \"sortBy\",\n  \"sortDirection\",\n] as const\n\nconst API_TOKEN_UPDATE_FIELDS = [\n  \"configId\",\n  \"name\",\n  \"enabled\",\n  \"expiresIn\",\n  \"metadata\",\n  \"permissions\",\n] as const\n\nexport type { ApiTokenRotationStore }\n\nfunction normalizeApiTokenErrorStatus(status: number | undefined): ApiTokenErrorStatus {\n  if (\n    status === 401 ||\n    status === 403 ||\n    status === 404 ||\n    status === 405 ||\n    status === 429 ||\n    status === 500\n  ) {\n    return status\n  }\n  return 400\n}\n\nfunction authApiErrorResponse(error: unknown): Response {\n  const candidate = error as { status?: number; statusCode?: number; message?: string }\n  const status = normalizeApiTokenErrorStatus(candidate.status ?? candidate.statusCode)\n  return jsonResponse({ error: candidate.message ?? \"API token request failed\" }, status)\n}\n\nfunction jsonResponse(body: unknown, status = 200, headers?: HeadersInit): Response {\n  return Response.json(body, { status, headers })\n}\n\nfunction methodNotAllowed(allowed: string[]): Response {\n  return jsonResponse({ error: \"Method not allowed\" }, 405, { Allow: allowed.join(\", \") })\n}\n\nfunction apiTokenFacadePath(pathname: string, basePath: string): string | null {\n  const trimmedBase = basePath.replace(/^\\/+|\\/+$/g, \"\")\n  const normalizedBase = trimmedBase ? `/${trimmedBase}` : \"\"\n  const normalizedPath = pathname.replace(/\\/+$/g, \"\") || \"/\"\n\n  if (normalizedPath === `${normalizedBase}/api-tokens`) {\n    return \"/api-tokens\"\n  }\n\n  if (normalizedPath.startsWith(`${normalizedBase}/api-tokens/`)) {\n    return normalizedPath.slice(normalizedBase.length)\n  }\n\n  return null\n}\n\nfunction accountProfileFacadePath(pathname: string, basePath: string): string | null {\n  const trimmedBase = basePath.replace(/^\\/+|\\/+$/g, \"\")\n  const normalizedBase = trimmedBase ? `/${trimmedBase}` : \"\"\n  const normalizedPath = pathname.replace(/\\/+$/g, \"\") || \"/\"\n\n  return normalizedPath === `${normalizedBase}/me` ? \"/me\" : null\n}\n\nfunction organizationMembersFacadePath(pathname: string, basePath: string): string | null {\n  const trimmedBase = basePath.replace(/^\\/+|\\/+$/g, \"\")\n  const normalizedBase = trimmedBase ? `/${trimmedBase}` : \"\"\n  const normalizedPath = pathname.replace(/\\/+$/g, \"\") || \"/\"\n\n  return normalizedPath === `${normalizedBase}/organization/list-members` ? \"/list-members\" : null\n}\n\nfunction readApiKeyQuery(request: Request): Record<string, unknown> {\n  const query: Record<string, unknown> = {}\n  const params = new URL(request.url).searchParams\n\n  for (const key of API_TOKEN_QUERY_FIELDS) {\n    const value = params.get(key)\n    if (value === null) continue\n    query[key] = key === \"limit\" || key === \"offset\" ? Number(value) : value\n  }\n\n  return query\n}\n\nfunction readProfileUpdate(\n  body: Record<string, unknown>,\n): Omit<UpdateCurrentUserProfileInput, \"userId\"> {\n  const input: Omit<UpdateCurrentUserProfileInput, \"userId\"> = {}\n\n  for (const field of [\n    \"firstName\",\n    \"lastName\",\n    \"locale\",\n    \"timezone\",\n    \"profilePictureUrl\",\n  ] as const) {\n    const value = body[field]\n    if (value === undefined) continue\n\n    if (value !== null && typeof value !== \"string\") {\n      throw Object.assign(new Error(`${field} must be a string or null`), { status: 400 })\n    }\n\n    const maxLength =\n      field === \"locale\"\n        ? 10\n        : field === \"timezone\"\n          ? 64\n          : field === \"profilePictureUrl\"\n            ? 2048\n            : 200\n    if (typeof value === \"string\" && value.length > maxLength) {\n      throw Object.assign(new Error(`${field} must be ${maxLength} characters or fewer`), {\n        status: 400,\n      })\n    }\n\n    input[field] = value\n  }\n\n  return input\n}\n\nasync function readOptionalJson(request: Request): Promise<Record<string, unknown>> {\n  const text = await request.text()\n  if (!text) return {}\n\n  const parsed = JSON.parse(text) as unknown\n  return typeof parsed === \"object\" && parsed !== null && !Array.isArray(parsed)\n    ? (parsed as Record<string, unknown>)\n    : {}\n}\n\nasync function requireApiTokenSession(auth: BetterAuthApiTokenManagement, headers: Headers) {\n  const session = await auth.api.getSession({ headers })\n  if (!session) {\n    throw Object.assign(new Error(\"Unauthorized\"), { status: 401 })\n  }\n  return session\n}\n\nasync function requireAccountProfileSession(auth: BetterAuthApiTokenManagement, headers: Headers) {\n  const session = await auth.api.getSession({ headers })\n  if (!session) {\n    throw Object.assign(new Error(\"Unauthorized\"), { status: 401 })\n  }\n  return session\n}\n\nasync function requireOrganizationMembersSession(\n  auth: BetterAuthApiTokenManagement,\n  headers: Headers,\n) {\n  const session = await auth.api.getSession({ headers })\n  if (!session) {\n    throw Object.assign(new Error(\"Unauthorized\"), { status: 401 })\n  }\n  return session\n}\n\nfunction readOrganizationMembersQuery(request: Request) {\n  const params = new URL(request.url).searchParams\n  const organizationId = params.get(\"organizationId\")?.trim()\n  return {\n    organizationId: organizationId || undefined,\n  }\n}\n\nfunction serializeMemberCreatedAt(createdAt: Date | string | null | undefined): string {\n  if (createdAt instanceof Date) return createdAt.toISOString()\n  if (typeof createdAt === \"string\" && createdAt.length > 0) return createdAt\n  return new Date(0).toISOString()\n}\n\nasync function resolveOrganizationIdForMemberList(\n  db: ReturnType<typeof getDb>,\n  input: OrganizationMembersListInput,\n): Promise<string | null> {\n  if (input.organizationId) return input.organizationId\n  if (input.activeOrganizationId) return input.activeOrganizationId\n\n  if (input.sessionId) {\n    const [session] = await db\n      .select({ activeOrganizationId: authSession.activeOrganizationId })\n      .from(authSession)\n      .where(eq(authSession.id, input.sessionId))\n      .limit(1)\n    if (session?.activeOrganizationId) return session.activeOrganizationId\n  }\n\n  const [membership] = await db\n    .select({ organizationId: authMember.organizationId })\n    .from(authMember)\n    .where(eq(authMember.userId, input.userId))\n    .limit(1)\n\n  return membership?.organizationId ?? null\n}\n\nasync function listOrganizationMembersFromDb(\n  db: ReturnType<typeof getDb>,\n  input: OrganizationMembersListInput,\n): Promise<OrganizationMemberRecord[]> {\n  const organizationId = await resolveOrganizationIdForMemberList(db, input)\n  if (!organizationId) return []\n\n  const [currentMember] = await db\n    .select({ id: authMember.id })\n    .from(authMember)\n    .where(and(eq(authMember.organizationId, organizationId), eq(authMember.userId, input.userId)))\n    .limit(1)\n\n  if (!currentMember) {\n    throw Object.assign(new Error(\"Forbidden\"), { status: 403 })\n  }\n\n  const rows = await db\n    .select({\n      id: authMember.id,\n      userId: authMember.userId,\n      organizationId: authMember.organizationId,\n      role: authMember.role,\n      createdAt: authMember.createdAt,\n      userIdValue: authUser.id,\n      userEmail: authUser.email,\n      userName: authUser.name,\n      userImage: authUser.image,\n    })\n    .from(authMember)\n    .innerJoin(authUser, eq(authUser.id, authMember.userId))\n    .where(eq(authMember.organizationId, organizationId))\n    .orderBy(asc(authMember.createdAt))\n\n  return rows.map((row) => ({\n    id: row.id,\n    userId: row.userId,\n    organizationId: row.organizationId,\n    role: row.role,\n    createdAt: serializeMemberCreatedAt(row.createdAt),\n    user: {\n      id: row.userIdValue,\n      email: row.userEmail,\n      name: row.userName,\n      image: row.userImage,\n    },\n  }))\n}\n\n/** Handles Voyant's stable `PATCH /auth/me` account-profile facade. */\nexport async function handleAccountProfileRequest(\n  request: Request,\n  auth: { api: unknown },\n  options: HandleAccountProfileRequestOptions,\n): Promise<Response | null> {\n  const path = accountProfileFacadePath(new URL(request.url).pathname, options.basePath ?? \"/auth\")\n  if (path === null) return null\n\n  try {\n    if (request.method !== \"PATCH\") return null\n\n    const session = await requireAccountProfileSession(\n      { api: auth.api as BetterAuthApiKeyApi },\n      request.headers,\n    )\n    const body = await readOptionalJson(request)\n    const profile = await (options.updateProfile ?? updateCurrentUserProfile)(options.db, {\n      userId: session.user.id,\n      ...readProfileUpdate(body),\n    })\n\n    if (!profile) {\n      return jsonResponse({ error: \"User not found\" }, 404)\n    }\n\n    return jsonResponse(profile)\n  } catch (error) {\n    return authApiErrorResponse(error)\n  }\n}\n\n/** Handles Voyant's stable `GET /auth/organization/list-members` facade. */\nexport async function handleOrganizationMembersRequest(\n  request: Request,\n  auth: { api: unknown },\n  options: HandleOrganizationMembersRequestOptions,\n): Promise<Response | null> {\n  const path = organizationMembersFacadePath(\n    new URL(request.url).pathname,\n    options.basePath ?? \"/auth\",\n  )\n  if (path === null) return null\n\n  try {\n    if (request.method !== \"GET\") return methodNotAllowed([\"GET\"])\n\n    const session = await requireOrganizationMembersSession(\n      { api: auth.api as BetterAuthApiKeyApi },\n      request.headers,\n    )\n    const query = readOrganizationMembersQuery(request)\n    const members = await (options.listOrganizationMembers ?? listOrganizationMembersFromDb)(\n      options.db,\n      {\n        userId: session.user.id,\n        sessionId: session.session?.id,\n        activeOrganizationId: session.session?.activeOrganizationId,\n        organizationId: query.organizationId,\n      },\n    )\n\n    return jsonResponse({ members })\n  } catch (error) {\n    return authApiErrorResponse(error)\n  }\n}\n\n/**\n * Handles Voyant's stable `/auth/api-tokens` management facade, including\n * create, list, update, delete, and secret rotation.\n */\nexport async function handleApiTokenManagementRequest(\n  request: Request,\n  auth: { api: unknown },\n  options: HandleApiTokenManagementRequestOptions = {},\n): Promise<Response | null> {\n  const path = apiTokenFacadePath(new URL(request.url).pathname, options.basePath ?? \"/auth\")\n  if (path === null) return null\n\n  const api = auth.api as BetterAuthApiKeyApi\n  const rotateMatch = path.match(/^\\/api-tokens\\/([^/]+)\\/rotate$/)\n  const keyMatch = path.match(/^\\/api-tokens\\/([^/]+)$/)\n\n  try {\n    if (path === \"/api-tokens\") {\n      if (request.method === \"GET\") {\n        const result = await api.listApiKeys({\n          query: readApiKeyQuery(request),\n          headers: request.headers,\n        })\n        return jsonResponse(result)\n      }\n\n      if (request.method === \"POST\") {\n        const body = await readOptionalJson(request)\n        const session = await requireApiTokenSession({ api }, request.headers)\n        let createBody: Record<string, unknown>\n        try {\n          createBody = buildApiTokenCreateBody(body, options.accessCatalog)\n        } catch (error) {\n          if (error instanceof ApiTokenValidationError) {\n            return jsonResponse({ error: error.message }, 400)\n          }\n          throw error\n        }\n        const result = await api.createApiKey({\n          body: {\n            ...createBody,\n            userId: session.user.id,\n          },\n        })\n        return jsonResponse(result, 201)\n      }\n\n      return methodNotAllowed([\"GET\", \"POST\"])\n    }\n\n    if (rotateMatch?.[1]) {\n      if (request.method !== \"POST\") return methodNotAllowed([\"POST\"])\n\n      const keyId = decodeURIComponent(rotateMatch[1])\n      const body = await readOptionalJson(request)\n      const session = await requireApiTokenSession({ api }, request.headers)\n      const result = await rotateApiTokenSecret({\n        keyId,\n        body,\n        userId: session.user.id,\n        options,\n        authorize: async ({ configId, enabled, keyId, userId }) => {\n          await api.updateApiKey({\n            body: {\n              ...(configId ? { configId } : {}),\n              keyId,\n              enabled,\n              userId,\n            },\n          })\n        },\n      })\n\n      return jsonResponse(result)\n    }\n\n    if (keyMatch?.[1]) {\n      const keyId = decodeURIComponent(keyMatch[1])\n\n      if (request.method === \"POST\") {\n        const body = await readOptionalJson(request)\n        const session = await requireApiTokenSession({ api }, request.headers)\n        const result = await api.updateApiKey({\n          body: {\n            ...pickFields(body, API_TOKEN_UPDATE_FIELDS),\n            keyId,\n            userId: session.user.id,\n          },\n        })\n        return jsonResponse(result)\n      }\n\n      if (request.method === \"DELETE\") {\n        const body = await readOptionalJson(request)\n        const result = await api.deleteApiKey({\n          body: { ...pickFields(body, [\"configId\"]), keyId },\n          headers: request.headers,\n        })\n        return jsonResponse(result)\n      }\n\n      return methodNotAllowed([\"POST\", \"DELETE\"])\n    }\n\n    return jsonResponse({ error: \"Not found\" }, 404)\n  } catch (error) {\n    return authApiErrorResponse(error)\n  }\n}\n"]}

package/dist/backend.d.ts

@@ -7,4 +7,3 @@ export declare function verifyToken(token: string, options: VerifyTokenOptions):
     sid?: string;
 }>;
 export declare function createApiTokenFromUserId(userId: string, secret: string): Promise<string>;
-//# sourceMappingURL=backend.d.ts.map

package/dist/backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAA;AAO5F,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,OAA2B;IAK3B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,SAAS;KACtB,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAc,EAAE,MAAc;IAC3E,OAAO,iBAAiB,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;AAC/D,CAAC"}
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAA;AAO5F,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,OAA2B;IAK3B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,SAAS;KACtB,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAc,EAAE,MAAc;IAC3E,OAAO,iBAAiB,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;AAC/D,CAAC","sourcesContent":["import { signSessionClaims, verifySessionClaims } from \"@voyant-travel/utils/session-claims\"\n\nexport type VerifyTokenOptions = {\n  secretKey: string\n  clockSkewInMs?: number\n}\n\nexport async function verifyToken(\n  token: string,\n  options: VerifyTokenOptions,\n): Promise<{\n  sub: string\n  sid?: string\n}> {\n  const claims = await verifySessionClaims(token, options.secretKey)\n  if (!claims) {\n    throw new Error(\"Invalid or expired token\")\n  }\n\n  return {\n    sub: claims.userId,\n    sid: claims.sessionId,\n  }\n}\n\nexport async function createApiTokenFromUserId(userId: string, secret: string): Promise<string> {\n  return signSessionClaims(userId, `session:${userId}`, secret)\n}\n"]}

package/dist/cloud-admin-session-public.d.ts

@@ -64,4 +64,3 @@ export type VoyantCloudAdminUserRevalidationResult = {
     reason?: string;
 };
 export declare function revalidateVoyantCloudAdminAuthUser(input: VoyantCloudAdminUserRevalidationInput): Promise<VoyantCloudAdminUserRevalidationResult>;
-//# sourceMappingURL=cloud-admin-session-public.d.ts.map

package/dist/cloud-admin-session-public.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-admin-session-public.js","sourceRoot":"","sources":["../src/cloud-admin-session-public.ts"],"names":[],"mappings":""}
+{"version":3,"file":"cloud-admin-session-public.js","sourceRoot":"","sources":["../src/cloud-admin-session-public.ts"],"names":[],"mappings":"","sourcesContent":["import type { getDb } from \"@voyant-travel/db\"\nimport type { BetterAuthPlugin } from \"better-auth/types\"\n\nimport type {\n  CloudAdminAssertion,\n  CloudAdminAuthExchangeConfig,\n  CloudAdminAuthRevalidateConfig,\n} from \"./cloud-broker.js\"\n\nexport type CloudAdminProvisionedUser = {\n  id: string\n  name: string\n  email: string\n  emailVerified: boolean\n  image?: string | null\n  createdAt: Date\n  updatedAt: Date\n}\n\nexport type CloudAdminUserProvisioningInput = {\n  db: ReturnType<typeof getDb>\n  assertion: CloudAdminAssertion\n  user: CloudAdminProvisionedUser\n  isNewUser: boolean\n  provider: {\n    providerId: \"voyant-cloud\"\n    providerAccountId: string\n  }\n}\n\nexport type CloudAdminUserProvisioningHandler = (\n  input: CloudAdminUserProvisioningInput,\n) => Promise<void> | void\n\nexport interface VoyantCloudAdminAuthPluginOptions {\n  db: ReturnType<typeof getDb>\n  cookieSecret: string\n  exchange: CloudAdminAuthExchangeConfig\n  fetch?: typeof fetch\n  revalidateAfterSeconds?: number\n  onUserProvisioning?: CloudAdminUserProvisioningHandler\n}\n\nexport declare function createVoyantCloudAdminAuthPlugin(\n  options: VoyantCloudAdminAuthPluginOptions,\n): BetterAuthPlugin\n\nexport type VoyantCloudAdminSessionRevalidationInput = {\n  db: ReturnType<typeof getDb>\n  sessionId: string\n  config: CloudAdminAuthRevalidateConfig\n  fetch?: typeof fetch\n  now?: Date\n  revalidateAfterSeconds?: number\n}\n\nexport type VoyantCloudAdminSessionRevalidationResult =\n  | {\n      ok: true\n      status: \"active\" | \"cached\"\n    }\n  | {\n      ok: false\n      status: \"revoked\"\n      reason?: string\n    }\n\nexport declare function revalidateVoyantCloudAdminAuthSession(\n  input: VoyantCloudAdminSessionRevalidationInput,\n): Promise<VoyantCloudAdminSessionRevalidationResult>\n\nexport type VoyantCloudAdminUserRevalidationInput = {\n  db: ReturnType<typeof getDb>\n  userId: string\n  config: CloudAdminAuthRevalidateConfig\n  fetch?: typeof fetch\n  now?: Date\n  revalidateAfterSeconds?: number\n}\n\nexport type VoyantCloudAdminUserRevalidationResult =\n  | {\n      ok: true\n      status: \"active\" | \"cached\"\n    }\n  | {\n      ok: false\n      status: \"revoked\"\n      reason?: string\n    }\n\nexport declare function revalidateVoyantCloudAdminAuthUser(\n  input: VoyantCloudAdminUserRevalidationInput,\n): Promise<VoyantCloudAdminUserRevalidationResult>\n"]}

package/dist/cloud-admin-session-revalidation-store.d.ts

@@ -14,4 +14,3 @@ export declare function markCloudAuthUserRevalidated(db: ReturnType<typeof getDb
     userId: string;
     now: Date;
 }): Promise<void>;
-//# sourceMappingURL=cloud-admin-session-revalidation-store.d.ts.map

package/dist/cloud-admin-session-revalidation-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-admin-session-revalidation-store.js","sourceRoot":"","sources":["../src/cloud-admin-session-revalidation-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAEhC,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,EAA4B,EAC5B,KAKC;IAED,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAA;IAC3F,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE;aACC,MAAM,CAAC,qBAAqB,CAAC;aAC7B,GAAG,CAAC;YACH,iBAAiB,EAAE,KAAK,CAAC,GAAG;YAC5B,eAAe;YACf,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,EAAE;aACC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,iBAAiB,EAAE,KAAK,CAAC,GAAG;YAC5B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACtD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAA4B,EAC5B,KAIC;IAED,MAAM,OAAO,GAA4B;QACvC,EAAE;aACC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,iBAAiB,EAAE,KAAK,CAAC,GAAG;YAC5B,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,EAAE;aACC,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC;YACH,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACpD,CAAA;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CACV,EAAE;aACC,MAAM,CAAC,qBAAqB,CAAC;aAC7B,GAAG,CAAC;YACH,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAC/D,CAAA;IACH,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAA4B,EAC5B,KAGC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,kBAAkB,CAAC;SAC1B,GAAG,CAAC;QACH,iBAAiB,EAAE,KAAK,CAAC,GAAG;QAC5B,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,KAAK,CAAC,GAAG;KACrB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;AACvD,CAAC"}
+{"version":3,"file":"cloud-admin-session-revalidation-store.js","sourceRoot":"","sources":["../src/cloud-admin-session-revalidation-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAEhC,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,EAA4B,EAC5B,KAKC;IAED,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAA;IAC3F,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE;aACC,MAAM,CAAC,qBAAqB,CAAC;aAC7B,GAAG,CAAC;YACH,iBAAiB,EAAE,KAAK,CAAC,GAAG;YAC5B,eAAe;YACf,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,EAAE;aACC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,iBAAiB,EAAE,KAAK,CAAC,GAAG;YAC5B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACtD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAA4B,EAC5B,KAIC;IAED,MAAM,OAAO,GAA4B;QACvC,EAAE;aACC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,iBAAiB,EAAE,KAAK,CAAC,GAAG;YAC5B,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,EAAE;aACC,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC;YACH,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACpD,CAAA;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CACV,EAAE;aACC,MAAM,CAAC,qBAAqB,CAAC;aAC7B,GAAG,CAAC;YACH,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAC/D,CAAA;IACH,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAA4B,EAC5B,KAGC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,kBAAkB,CAAC;SAC1B,GAAG,CAAC;QACH,iBAAiB,EAAE,KAAK,CAAC,GAAG;QAC5B,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,KAAK,CAAC,GAAG;KACrB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;AACvD,CAAC","sourcesContent":["import type { getDb } from \"@voyant-travel/db\"\nimport {\n  apikeyTable,\n  cloudAuthSessionLinks,\n  cloudAuthUserLinks,\n} from \"@voyant-travel/db/schema/iam\"\nimport { eq } from \"drizzle-orm\"\n\nexport async function markCloudAuthSessionRevalidated(\n  db: ReturnType<typeof getDb>,\n  input: {\n    sessionId: string\n    userId: string\n    now: Date\n    revalidateAfterSeconds: number\n  },\n): Promise<void> {\n  const revalidateAfter = new Date(input.now.getTime() + input.revalidateAfterSeconds * 1000)\n  await Promise.all([\n    db\n      .update(cloudAuthSessionLinks)\n      .set({\n        lastRevalidatedAt: input.now,\n        revalidateAfter,\n        revokedAt: null,\n        updatedAt: input.now,\n      })\n      .where(eq(cloudAuthSessionLinks.sessionId, input.sessionId)),\n    db\n      .update(cloudAuthUserLinks)\n      .set({\n        lastRevalidatedAt: input.now,\n        revokedAt: null,\n        updatedAt: input.now,\n      })\n      .where(eq(cloudAuthUserLinks.userId, input.userId)),\n  ])\n}\n\nexport async function revokeCloudAuthUserAccess(\n  db: ReturnType<typeof getDb>,\n  input: {\n    sessionId?: string\n    userId: string\n    now: Date\n  },\n): Promise<void> {\n  const updates: Array<Promise<unknown>> = [\n    db\n      .update(cloudAuthUserLinks)\n      .set({\n        revokedAt: input.now,\n        lastRevalidatedAt: input.now,\n        updatedAt: input.now,\n      })\n      .where(eq(cloudAuthUserLinks.userId, input.userId)),\n    db\n      .update(apikeyTable)\n      .set({\n        enabled: false,\n        updatedAt: input.now,\n      })\n      .where(eq(apikeyTable.referenceId, input.userId)),\n  ]\n\n  if (input.sessionId) {\n    updates.push(\n      db\n        .update(cloudAuthSessionLinks)\n        .set({\n          revokedAt: input.now,\n          updatedAt: input.now,\n        })\n        .where(eq(cloudAuthSessionLinks.sessionId, input.sessionId)),\n    )\n  }\n\n  await Promise.all(updates)\n}\n\nexport async function markCloudAuthUserRevalidated(\n  db: ReturnType<typeof getDb>,\n  input: {\n    userId: string\n    now: Date\n  },\n): Promise<void> {\n  await db\n    .update(cloudAuthUserLinks)\n    .set({\n      lastRevalidatedAt: input.now,\n      revokedAt: null,\n      updatedAt: input.now,\n    })\n    .where(eq(cloudAuthUserLinks.userId, input.userId))\n}\n"]}

package/dist/cloud-admin-session.d.ts

@@ -67,4 +67,3 @@ export declare function createVoyantCloudAdminAuthPlugin(options: VoyantCloudAdm
 export declare function revalidateVoyantCloudAdminAuthSession({ db, sessionId, config, fetch, now, revalidateAfterSeconds, }: VoyantCloudAdminSessionRevalidationInput): Promise<VoyantCloudAdminSessionRevalidationResult>;
 export declare function revalidateVoyantCloudAdminAuthUser({ db, userId, config, fetch, now, revalidateAfterSeconds, }: VoyantCloudAdminUserRevalidationInput): Promise<VoyantCloudAdminUserRevalidationResult>;
 export {};
-//# sourceMappingURL=cloud-admin-session.d.ts.map

package/dist/cloud-admin-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-admin-session.js","sourceRoot":"","sources":["../src/cloud-admin-session.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,QAAQ,EACR,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,6CAA6C,CAAA;AACpD,OAAO,EAIL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AAmD7E,MAAM,wBAAwB,GAAG,cAAc,CAAA;AAC/C,MAAM,8CAA8C,GAAG,EAAE,GAAG,EAAE,CAAA;AAwC9D,MAAM,UAAU,gCAAgC,CAC9C,OAA0C;IAE1C,OAAO;QACL,EAAE,EAAE,yBAAyB;QAC7B,SAAS,EAAE;YACT,4BAA4B,EAAE,kBAAkB,CAC9C,iBAAiB,EACjB,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,EACvC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;oBAClD,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;oBAC3B,YAAY,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAC7E,YAAY,EAAE,OAAO,CAAC,YAAY;iBACnC,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;gBAEjD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;oBAC3D,OAAO,GAAG,CAAC,IAAI,CACb;wBACE,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACpE,EACD,EAAE,MAAM,EAAE,CACX,CAAA;gBACH,CAAC;gBAED,IAAI,SAA8B,CAAA;gBAClC,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,0BAA0B,CAAC;wBAC3C,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,MAAM,EAAE,OAAO,CAAC,QAAQ;wBACxB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnD,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAA;oBACvE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAClF,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE;oBACpE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;iBAC/C,CAAC,CAAA;gBACF,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAC9D,IAAI,CAAC,EAAE,CACR,CAA+B,CAAA;gBAChC,MAAM,4BAA4B,CAAC,OAAO,CAAC,EAAE,EAAE;oBAC7C,SAAS;oBACT,OAAO;oBACP,sBAAsB,EACpB,OAAO,CAAC,sBAAsB,IAAI,8CAA8C;iBACnF,CAAC,CAAA;gBACF,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;gBAE9C,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzC,CAAC,CACF;SACF;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,EAC1D,EAAE,EACF,SAAS,EACT,MAAM,EACN,KAAK,EACL,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,sBAAsB,GAAG,8CAA8C,GAC9B;IACzC,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,EAAE;SAC3B,MAAM,EAAE;SACR,IAAI,CAAC,qBAAqB,CAAC;SAC3B,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;SACrD,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;IAC/E,CAAC;IAED,IAAI,WAAW,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC;QACxD,YAAY,EAAE,WAAW,CAAC,iBAAiB;QAC3C,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAA;IAEF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,+BAA+B,CAAC,EAAE,EAAE;YACxC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,GAAG;YACH,sBAAsB;SACvB,CAAC,CAAA;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,8CAA8C;QAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,EAAE;iBACL,MAAM,CAAC,kBAAkB,CAAC;iBAC1B,GAAG,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACpD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;QAC7D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,yBAAyB,CAAC,EAAE,EAAE;QAClC,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,GAAG;KACJ,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,YAAY,CAAC,MAAM;KAC5B,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,EACvD,EAAE,EACF,MAAM,EACN,MAAM,EACN,KAAK,EACL,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,sBAAsB,GAAG,8CAA8C,GACjC;IACtC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC5C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAA;IAC5E,CAAC;IAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,iBAAiB;QACnD,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC;QAChF,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,kBAAkB,IAAI,kBAAkB,GAAG,GAAG,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC;QACxD,YAAY,EAAE,QAAQ,CAAC,iBAAiB;QACxC,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAA;IAEF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,4BAA4B,CAAC,EAAE,EAAE;YACrC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG;SACJ,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,yBAAyB,CAAC,EAAE,EAAE;QAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,GAAG;KACJ,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,YAAY,CAAC,MAAM;KAC5B,CAAA;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,EAA4B,EAC5B,SAA8B,EAC9B,UAEI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,iBAAiB,GAAG,SAAS,CAAC,YAAY,CAAA;IAChD,MAAM,WAAW,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACxD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAC5C,EAAE,EACF,iBAAiB,EACjB,SAAS,CAAC,KAAK,EACf,SAAS,CAAC,aAAa,CACxB,CAAA;IACD,MAAM,SAAS,GAAG,CAAC,YAAY,CAAA;IAC/B,MAAM,MAAM,GAAG,YAAY,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAA;IAEtD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,EAAE;aACL,MAAM,CAAC,QAAQ,CAAC;aAChB,GAAG,CAAC;YACH,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,IAAI;YAC9B,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC/B,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,IAAI;YAC9B,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,WAAW,CAAC;SACnB,MAAM,CAAC;QACN,EAAE,EAAE,kBAAkB,CAAC,iBAAiB,CAAC;QACzC,MAAM;QACN,SAAS,EAAE,iBAAiB;QAC5B,UAAU,EAAE,wBAAwB;QACpC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,SAAS,CAAC;QACvD,GAAG,EAAE;YACH,MAAM;YACN,SAAS,EAAE,GAAG;SACf;KACF,CAAC,CAAA;IAEJ,MAAM,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;IAE3D,MAAM,2BAA2B,CAAC,EAAE,EAAE;QACpC,MAAM;QACN,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,YAAY,EAAE,MAAM,eAAe,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC;SACD,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC9B,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,eAAe,GAAG;QACtB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAA;IAED,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACjC,EAAE;QACF,SAAS;QACT,IAAI,EAAE,eAAe;QACrB,SAAS;QACT,QAAQ,EAAE;YACR,UAAU,EAAE,wBAAwB;YACpC,iBAAiB;SAClB;KACF,CAAC,CAAA;IAEF,OAAO,eAAe,CAAA;AACxB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAA4B,EAC5B,iBAAyB,EACzB,KAAc,EACd,aAAuB;IAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;SAC3B,IAAI,CAAC,kBAAkB,CAAC;SACxB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;SAC/D,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,wBAAwB,CAAC,EAC3D,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAC5D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;SAC3B,IAAI,CAAC,WAAW,CAAC;SACjB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;SACxD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,wBAAwB,CAAC,EACpD,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAC7C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAEjD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;SAC3B,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;SAChC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,SAAS,IAAI,IAAI,CAAA;AAC1B,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAc,EACd,SAA8B,EAC9B,GAAS;IAET,OAAO;QACL,MAAM;QACN,UAAU,EAAE,wBAAwB;QACpC,iBAAiB,EAAE,SAAS,CAAC,YAAY;QACzC,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,IAAI;QAC5C,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI;QACpC,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI;QACpC,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE;QAClC,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI;QAChC,eAAe,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC;QAC/C,iBAAiB,EAAE,GAAG;QACtB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,GAAG;KACf,CAAA;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,EAA4B,EAC5B,MAAc,EACd,SAA8B,EAC9B,GAAS;IAET,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;IAC9D,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,EAAE;SAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC;SAC7C,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC5C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,GAAG,MAAM;YACT,MAAM;YACN,SAAS,EAAE,IAAI;SAChB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;QAC/C,OAAM;IACR,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,kBAAkB,CAAC;SAC1B,MAAM,CAAC,MAAM,CAAC;SACd,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,kBAAkB,CAAC,iBAAiB,CAAC;QAC7E,GAAG,EAAE;YACH,GAAG,MAAM;YACT,MAAM;YACN,SAAS,EAAE,IAAI;SAChB;KACF,CAAC,CAAA;AACN,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,EAA4B,EAC5B,KAIC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC;QAC5C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,UAAU,EAAE,wBAAwB;QACpC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;QAC/C,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;QAC1C,eAAe,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC;QAC9E,iBAAiB,EAAE,GAAG;QACtB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,GAAG;KACf,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,SAA8B;IAC/D,MAAM,SAAS,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;SACxD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;SAC3B,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SAC/C,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,SAAS,IAAI,SAAS,CAAC,KAAK,CAAA;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,iBAAyB;IACnD,OAAO,OAAO,wBAAwB,IAAI,iBAAiB,EAAE,CAAA;AAC/D,CAAC"}
+{"version":3,"file":"cloud-admin-session.js","sourceRoot":"","sources":["../src/cloud-admin-session.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,QAAQ,EACR,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,6CAA6C,CAAA;AACpD,OAAO,EAIL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AAmD7E,MAAM,wBAAwB,GAAG,cAAc,CAAA;AAC/C,MAAM,8CAA8C,GAAG,EAAE,GAAG,EAAE,CAAA;AAwC9D,MAAM,UAAU,gCAAgC,CAC9C,OAA0C;IAE1C,OAAO;QACL,EAAE,EAAE,yBAAyB;QAC7B,SAAS,EAAE;YACT,4BAA4B,EAAE,kBAAkB,CAC9C,iBAAiB,EACjB,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,EACvC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;oBAClD,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;oBAC3B,YAAY,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAC7E,YAAY,EAAE,OAAO,CAAC,YAAY;iBACnC,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;gBAEjD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;oBAC3D,OAAO,GAAG,CAAC,IAAI,CACb;wBACE,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACpE,EACD,EAAE,MAAM,EAAE,CACX,CAAA;gBACH,CAAC;gBAED,IAAI,SAA8B,CAAA;gBAClC,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,0BAA0B,CAAC;wBAC3C,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,MAAM,EAAE,OAAO,CAAC,QAAQ;wBACxB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnD,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAA;oBACvE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAClF,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE;oBACpE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;iBAC/C,CAAC,CAAA;gBACF,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAC9D,IAAI,CAAC,EAAE,CACR,CAA+B,CAAA;gBAChC,MAAM,4BAA4B,CAAC,OAAO,CAAC,EAAE,EAAE;oBAC7C,SAAS;oBACT,OAAO;oBACP,sBAAsB,EACpB,OAAO,CAAC,sBAAsB,IAAI,8CAA8C;iBACnF,CAAC,CAAA;gBACF,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;gBAE9C,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzC,CAAC,CACF;SACF;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,EAC1D,EAAE,EACF,SAAS,EACT,MAAM,EACN,KAAK,EACL,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,sBAAsB,GAAG,8CAA8C,GAC9B;IACzC,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,EAAE;SAC3B,MAAM,EAAE;SACR,IAAI,CAAC,qBAAqB,CAAC;SAC3B,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;SACrD,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;IAC/E,CAAC;IAED,IAAI,WAAW,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC;QACxD,YAAY,EAAE,WAAW,CAAC,iBAAiB;QAC3C,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAA;IAEF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,+BAA+B,CAAC,EAAE,EAAE;YACxC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,GAAG;YACH,sBAAsB;SACvB,CAAC,CAAA;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,8CAA8C;QAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,EAAE;iBACL,MAAM,CAAC,kBAAkB,CAAC;iBAC1B,GAAG,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACpD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;QAC7D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,yBAAyB,CAAC,EAAE,EAAE;QAClC,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,GAAG;KACJ,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,YAAY,CAAC,MAAM;KAC5B,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,EACvD,EAAE,EACF,MAAM,EACN,MAAM,EACN,KAAK,EACL,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,sBAAsB,GAAG,8CAA8C,GACjC;IACtC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC5C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAA;IAC5E,CAAC;IAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,iBAAiB;QACnD,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC;QAChF,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,kBAAkB,IAAI,kBAAkB,GAAG,GAAG,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,8BAA8B,CAAC;QACxD,YAAY,EAAE,QAAQ,CAAC,iBAAiB;QACxC,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAA;IAEF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,4BAA4B,CAAC,EAAE,EAAE;YACrC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG;SACJ,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,yBAAyB,CAAC,EAAE,EAAE;QAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,GAAG;KACJ,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,YAAY,CAAC,MAAM;KAC5B,CAAA;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,EAA4B,EAC5B,SAA8B,EAC9B,UAEI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,iBAAiB,GAAG,SAAS,CAAC,YAAY,CAAA;IAChD,MAAM,WAAW,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACxD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAC5C,EAAE,EACF,iBAAiB,EACjB,SAAS,CAAC,KAAK,EACf,SAAS,CAAC,aAAa,CACxB,CAAA;IACD,MAAM,SAAS,GAAG,CAAC,YAAY,CAAA;IAC/B,MAAM,MAAM,GAAG,YAAY,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAA;IAEtD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,EAAE;aACL,MAAM,CAAC,QAAQ,CAAC;aAChB,GAAG,CAAC;YACH,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,IAAI;YAC9B,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC/B,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,IAAI;YAC9B,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,WAAW,CAAC;SACnB,MAAM,CAAC;QACN,EAAE,EAAE,kBAAkB,CAAC,iBAAiB,CAAC;QACzC,MAAM;QACN,SAAS,EAAE,iBAAiB;QAC5B,UAAU,EAAE,wBAAwB;QACpC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,SAAS,CAAC;QACvD,GAAG,EAAE;YACH,MAAM;YACN,SAAS,EAAE,GAAG;SACf;KACF,CAAC,CAAA;IAEJ,MAAM,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;IAE3D,MAAM,2BAA2B,CAAC,EAAE,EAAE;QACpC,MAAM;QACN,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,YAAY,EAAE,MAAM,eAAe,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC;SACD,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC9B,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,eAAe,GAAG;QACtB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAA;IAED,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACjC,EAAE;QACF,SAAS;QACT,IAAI,EAAE,eAAe;QACrB,SAAS;QACT,QAAQ,EAAE;YACR,UAAU,EAAE,wBAAwB;YACpC,iBAAiB;SAClB;KACF,CAAC,CAAA;IAEF,OAAO,eAAe,CAAA;AACxB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAA4B,EAC5B,iBAAyB,EACzB,KAAc,EACd,aAAuB;IAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;SAC3B,IAAI,CAAC,kBAAkB,CAAC;SACxB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;SAC/D,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,wBAAwB,CAAC,EAC3D,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAC5D,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;SAC3B,IAAI,CAAC,WAAW,CAAC;SACjB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;SACxD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,wBAAwB,CAAC,EACpD,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAC7C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAEjD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;SAC3B,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;SAChC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,SAAS,IAAI,IAAI,CAAA;AAC1B,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAc,EACd,SAA8B,EAC9B,GAAS;IAET,OAAO;QACL,MAAM;QACN,UAAU,EAAE,wBAAwB;QACpC,iBAAiB,EAAE,SAAS,CAAC,YAAY;QACzC,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;QACxD,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,IAAI;QAC5C,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI;QACpC,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI;QACpC,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE;QAClC,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI;QAChC,eAAe,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC;QAC/C,iBAAiB,EAAE,GAAG;QACtB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,GAAG;KACf,CAAA;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,EAA4B,EAC5B,MAAc,EACd,SAA8B,EAC9B,GAAS;IAET,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;IAC9D,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,EAAE;SAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC;SAC7C,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC5C,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,GAAG,MAAM;YACT,MAAM;YACN,SAAS,EAAE,IAAI;SAChB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;QAC/C,OAAM;IACR,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,kBAAkB,CAAC;SAC1B,MAAM,CAAC,MAAM,CAAC;SACd,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,kBAAkB,CAAC,iBAAiB,CAAC;QAC7E,GAAG,EAAE;YACH,GAAG,MAAM;YACT,MAAM;YACN,SAAS,EAAE,IAAI;SAChB;KACF,CAAC,CAAA;AACN,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,EAA4B,EAC5B,KAIC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC;QAC5C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,UAAU,EAAE,wBAAwB;QACpC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;QAC/C,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;QAC1C,eAAe,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC;QAC9E,iBAAiB,EAAE,GAAG;QACtB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,GAAG;KACf,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,SAA8B;IAC/D,MAAM,SAAS,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;SACxD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;SAC3B,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SAC/C,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,SAAS,IAAI,SAAS,CAAC,KAAK,CAAA;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,iBAAyB;IACnD,OAAO,OAAO,wBAAwB,IAAI,iBAAiB,EAAE,CAAA;AAC/D,CAAC","sourcesContent":["import type { getDb } from \"@voyant-travel/db\"\nimport {\n  authAccount,\n  authUser,\n  cloudAuthSessionLinks,\n  cloudAuthUserLinks,\n} from \"@voyant-travel/db/schema/iam\"\nimport { createAuthEndpoint } from \"better-auth/api\"\nimport { setSessionCookie } from \"better-auth/cookies\"\nimport type { BetterAuthPlugin } from \"better-auth/types\"\nimport { and, eq } from \"drizzle-orm\"\nimport {\n  markCloudAuthSessionRevalidated,\n  markCloudAuthUserRevalidated,\n  revokeCloudAuthUserAccess,\n} from \"./cloud-admin-session-revalidation-store.js\"\nimport {\n  type CloudAdminAssertion,\n  type CloudAdminAuthExchangeConfig,\n  type CloudAdminAuthRevalidateConfig,\n  exchangeCloudAdminAuthCode,\n  revalidateCloudAdminAuthAccess,\n  verifyCloudAdminAuthCallback,\n} from \"./cloud-broker.js\"\nimport { isFirstAuthUser, provisionCurrentUserProfile } from \"./workspace.js\"\n\nexport interface VoyantCloudAdminAuthPluginOptions {\n  db: ReturnType<typeof getDb>\n  cookieSecret: string\n  exchange: CloudAdminAuthExchangeConfig\n  fetch?: typeof fetch\n  revalidateAfterSeconds?: number\n  onUserProvisioning?: CloudAdminUserProvisioningHandler\n}\n\nexport type VoyantCloudAdminSessionRevalidationInput = {\n  db: ReturnType<typeof getDb>\n  sessionId: string\n  config: CloudAdminAuthRevalidateConfig\n  fetch?: typeof fetch\n  now?: Date\n  revalidateAfterSeconds?: number\n}\n\nexport type VoyantCloudAdminSessionRevalidationResult =\n  | {\n      ok: true\n      status: \"active\" | \"cached\"\n    }\n  | {\n      ok: false\n      status: \"revoked\"\n      reason?: string\n    }\n\nexport type VoyantCloudAdminUserRevalidationInput = {\n  db: ReturnType<typeof getDb>\n  userId: string\n  config: CloudAdminAuthRevalidateConfig\n  fetch?: typeof fetch\n  now?: Date\n  revalidateAfterSeconds?: number\n}\n\nexport type VoyantCloudAdminUserRevalidationResult =\n  | {\n      ok: true\n      status: \"active\" | \"cached\"\n    }\n  | {\n      ok: false\n      status: \"revoked\"\n      reason?: string\n    }\n\nconst VOYANT_CLOUD_PROVIDER_ID = \"voyant-cloud\"\nconst DEFAULT_CLOUD_SESSION_REVALIDATE_AFTER_SECONDS = 15 * 60\n\ntype BetterAuthUserForCookie = {\n  id: string\n  name: string\n  email: string\n  emailVerified: boolean\n  image?: string | null\n  createdAt: Date\n  updatedAt: Date\n}\n\ntype BetterAuthSessionForCookie = {\n  id: string\n  token: string\n  userId: string\n  expiresAt: Date\n  createdAt: Date\n  updatedAt: Date\n  ipAddress?: string | null\n  userAgent?: string | null\n}\n\nexport type CloudAdminProvisionedUser = BetterAuthUserForCookie\n\nexport type CloudAdminUserProvisioningInput = {\n  db: ReturnType<typeof getDb>\n  assertion: CloudAdminAssertion\n  user: CloudAdminProvisionedUser\n  isNewUser: boolean\n  provider: {\n    providerId: typeof VOYANT_CLOUD_PROVIDER_ID\n    providerAccountId: string\n  }\n}\n\nexport type CloudAdminUserProvisioningHandler = (\n  input: CloudAdminUserProvisioningInput,\n) => Promise<void> | void\n\nexport function createVoyantCloudAdminAuthPlugin(\n  options: VoyantCloudAdminAuthPluginOptions,\n): BetterAuthPlugin {\n  return {\n    id: \"voyant-cloud-admin-auth\",\n    endpoints: {\n      voyantCloudAdminAuthCallback: createAuthEndpoint(\n        \"/cloud/callback\",\n        { method: \"GET\", requireRequest: true },\n        async (ctx) => {\n          const callback = await verifyCloudAdminAuthCallback({\n            requestUrl: ctx.request.url,\n            cookieHeader: ctx.headers?.get(\"cookie\") ?? ctx.request.headers.get(\"cookie\"),\n            cookieSecret: options.cookieSecret,\n          })\n          ctx.setHeader(\"Set-Cookie\", callback.clearCookie)\n\n          if (!callback.ok) {\n            const status = callback.error === \"cloud_error\" ? 401 : 400\n            return ctx.json(\n              {\n                error: callback.error,\n                ...(callback.cloudError ? { cloudError: callback.cloudError } : {}),\n              },\n              { status },\n            )\n          }\n\n          let assertion: CloudAdminAssertion\n          try {\n            assertion = await exchangeCloudAdminAuthCode({\n              code: callback.code,\n              state: callback.state,\n              config: options.exchange,\n              ...(options.fetch ? { fetch: options.fetch } : {}),\n            })\n          } catch (error) {\n            ctx.context.logger.error(\"[auth/cloud/callback] Exchange error\", error)\n            return ctx.json({ error: \"Voyant Cloud auth exchange failed\" }, { status: 401 })\n          }\n\n          const user = await upsertVoyantCloudMirrorUser(options.db, assertion, {\n            onUserProvisioning: options.onUserProvisioning,\n          })\n          const session = (await ctx.context.internalAdapter.createSession(\n            user.id,\n          )) as BetterAuthSessionForCookie\n          await upsertVoyantCloudSessionLink(options.db, {\n            assertion,\n            session,\n            revalidateAfterSeconds:\n              options.revalidateAfterSeconds ?? DEFAULT_CLOUD_SESSION_REVALIDATE_AFTER_SECONDS,\n          })\n          await setSessionCookie(ctx, { session, user })\n\n          throw ctx.redirect(callback.state.next)\n        },\n      ),\n    },\n  }\n}\n\nexport async function revalidateVoyantCloudAdminAuthSession({\n  db,\n  sessionId,\n  config,\n  fetch,\n  now = new Date(),\n  revalidateAfterSeconds = DEFAULT_CLOUD_SESSION_REVALIDATE_AFTER_SECONDS,\n}: VoyantCloudAdminSessionRevalidationInput): Promise<VoyantCloudAdminSessionRevalidationResult> {\n  const [sessionLink] = await db\n    .select()\n    .from(cloudAuthSessionLinks)\n    .where(eq(cloudAuthSessionLinks.sessionId, sessionId))\n    .limit(1)\n\n  if (!sessionLink || sessionLink.revokedAt) {\n    return { ok: false, status: \"revoked\", reason: \"missing_or_revoked_session\" }\n  }\n\n  if (sessionLink.revalidateAfter > now) {\n    return { ok: true, status: \"cached\" }\n  }\n\n  const revalidation = await revalidateCloudAdminAuthAccess({\n    workosUserId: sessionLink.providerAccountId,\n    config,\n    ...(fetch ? { fetch } : {}),\n  })\n\n  if (revalidation.ok) {\n    await markCloudAuthSessionRevalidated(db, {\n      sessionId: sessionLink.sessionId,\n      userId: sessionLink.userId,\n      now,\n      revalidateAfterSeconds,\n    })\n    // Refresh the cached RBAC scopes so a permission change applied while the\n    // member is signed in takes effect at the next revalidation, not only at\n    // next login (member-rbac-rfc, voyant#2085). `undefined` ⇒ older platform\n    // didn't send scopes; leave the column as-is.\n    if (revalidation.scopes !== undefined) {\n      await db\n        .update(cloudAuthUserLinks)\n        .set({ scopes: revalidation.scopes, updatedAt: now })\n        .where(eq(cloudAuthUserLinks.userId, sessionLink.userId))\n    }\n    return { ok: true, status: \"active\" }\n  }\n\n  await revokeCloudAuthUserAccess(db, {\n    sessionId: sessionLink.sessionId,\n    userId: sessionLink.userId,\n    now,\n  })\n\n  return {\n    ok: false,\n    status: \"revoked\",\n    reason: revalidation.reason,\n  }\n}\n\nexport async function revalidateVoyantCloudAdminAuthUser({\n  db,\n  userId,\n  config,\n  fetch,\n  now = new Date(),\n  revalidateAfterSeconds = DEFAULT_CLOUD_SESSION_REVALIDATE_AFTER_SECONDS,\n}: VoyantCloudAdminUserRevalidationInput): Promise<VoyantCloudAdminUserRevalidationResult> {\n  const [userLink] = await db\n    .select()\n    .from(cloudAuthUserLinks)\n    .where(eq(cloudAuthUserLinks.userId, userId))\n    .limit(1)\n\n  if (!userLink || userLink.revokedAt) {\n    return { ok: false, status: \"revoked\", reason: \"missing_or_revoked_user\" }\n  }\n\n  const nextRevalidationAt = userLink.lastRevalidatedAt\n    ? new Date(userLink.lastRevalidatedAt.getTime() + revalidateAfterSeconds * 1000)\n    : null\n  if (nextRevalidationAt && nextRevalidationAt > now) {\n    return { ok: true, status: \"cached\" }\n  }\n\n  const revalidation = await revalidateCloudAdminAuthAccess({\n    workosUserId: userLink.providerAccountId,\n    config,\n    ...(fetch ? { fetch } : {}),\n  })\n\n  if (revalidation.ok) {\n    await markCloudAuthUserRevalidated(db, {\n      userId: userLink.userId,\n      now,\n    })\n    return { ok: true, status: \"active\" }\n  }\n\n  await revokeCloudAuthUserAccess(db, {\n    userId: userLink.userId,\n    now,\n  })\n\n  return {\n    ok: false,\n    status: \"revoked\",\n    reason: revalidation.reason,\n  }\n}\n\nasync function upsertVoyantCloudMirrorUser(\n  db: ReturnType<typeof getDb>,\n  assertion: CloudAdminAssertion,\n  options: {\n    onUserProvisioning?: CloudAdminUserProvisioningHandler\n  } = {},\n): Promise<BetterAuthUserForCookie> {\n  const now = new Date()\n  const providerAccountId = assertion.workosUserId\n  const displayName = cloudAssertionDisplayName(assertion)\n  const existingUser = await findCloudMirrorUser(\n    db,\n    providerAccountId,\n    assertion.email,\n    assertion.emailVerified,\n  )\n  const isNewUser = !existingUser\n  const userId = existingUser?.id ?? crypto.randomUUID()\n\n  if (existingUser) {\n    await db\n      .update(authUser)\n      .set({\n        name: displayName,\n        email: assertion.email,\n        emailVerified: assertion.emailVerified,\n        image: assertion.image ?? null,\n        updatedAt: now,\n      })\n      .where(eq(authUser.id, existingUser.id))\n  } else {\n    await db.insert(authUser).values({\n      id: userId,\n      name: displayName,\n      email: assertion.email,\n      emailVerified: assertion.emailVerified,\n      image: assertion.image ?? null,\n      createdAt: now,\n      updatedAt: now,\n    })\n  }\n\n  await db\n    .insert(authAccount)\n    .values({\n      id: cloudAuthAccountId(providerAccountId),\n      userId,\n      accountId: providerAccountId,\n      providerId: VOYANT_CLOUD_PROVIDER_ID,\n      createdAt: now,\n      updatedAt: now,\n    })\n    .onConflictDoUpdate({\n      target: [authAccount.providerId, authAccount.accountId],\n      set: {\n        userId,\n        updatedAt: now,\n      },\n    })\n\n  await upsertVoyantCloudUserLink(db, userId, assertion, now)\n\n  await provisionCurrentUserProfile(db, {\n    userId,\n    name: displayName,\n    image: assertion.image,\n    isSuperAdmin: await isFirstAuthUser(db),\n  })\n\n  const [user] = await db\n    .select({\n      id: authUser.id,\n      name: authUser.name,\n      email: authUser.email,\n      emailVerified: authUser.emailVerified,\n      image: authUser.image,\n      createdAt: authUser.createdAt,\n      updatedAt: authUser.updatedAt,\n    })\n    .from(authUser)\n    .where(eq(authUser.id, userId))\n    .limit(1)\n\n  if (!user?.email) {\n    throw new Error(\"Voyant Cloud auth mirror user was not provisioned\")\n  }\n\n  const provisionedUser = {\n    id: user.id,\n    name: user.name,\n    email: user.email,\n    emailVerified: user.emailVerified,\n    image: user.image,\n    createdAt: user.createdAt,\n    updatedAt: user.updatedAt,\n  }\n\n  await options.onUserProvisioning?.({\n    db,\n    assertion,\n    user: provisionedUser,\n    isNewUser,\n    provider: {\n      providerId: VOYANT_CLOUD_PROVIDER_ID,\n      providerAccountId,\n    },\n  })\n\n  return provisionedUser\n}\n\nasync function findCloudMirrorUser(\n  db: ReturnType<typeof getDb>,\n  providerAccountId: string,\n  email?: string,\n  emailVerified?: boolean,\n): Promise<{ id: string } | null> {\n  const [linked] = await db\n    .select({ id: authUser.id })\n    .from(cloudAuthUserLinks)\n    .innerJoin(authUser, eq(authUser.id, cloudAuthUserLinks.userId))\n    .where(\n      and(\n        eq(cloudAuthUserLinks.providerId, VOYANT_CLOUD_PROVIDER_ID),\n        eq(cloudAuthUserLinks.providerAccountId, providerAccountId),\n      ),\n    )\n    .limit(1)\n\n  if (linked) return linked\n\n  const [account] = await db\n    .select({ id: authUser.id })\n    .from(authAccount)\n    .innerJoin(authUser, eq(authUser.id, authAccount.userId))\n    .where(\n      and(\n        eq(authAccount.providerId, VOYANT_CLOUD_PROVIDER_ID),\n        eq(authAccount.accountId, providerAccountId),\n      ),\n    )\n    .limit(1)\n\n  if (account) return account\n  if (!email || emailVerified !== true) return null\n\n  const [emailUser] = await db\n    .select({ id: authUser.id })\n    .from(authUser)\n    .where(eq(authUser.email, email))\n    .limit(1)\n\n  return emailUser ?? null\n}\n\nfunction cloudAuthUserLinkValues(\n  userId: string,\n  assertion: CloudAdminAssertion,\n  now: Date,\n): typeof cloudAuthUserLinks.$inferInsert {\n  return {\n    userId,\n    providerId: VOYANT_CLOUD_PROVIDER_ID,\n    providerAccountId: assertion.workosUserId,\n    deploymentId: assertion.deploymentId,\n    platformOrganizationId: assertion.platformOrganizationId,\n    workosOrganizationId: assertion.workosOrganizationId,\n    membershipId: assertion.membershipId ?? null,\n    roleSlug: assertion.roleSlug ?? null,\n    roleName: assertion.roleName ?? null,\n    surfaces: assertion.surfaces ?? [],\n    // Member RBAC scope set from the assertion. `null` (not `[]`) when the\n    // platform sent none, so resolveAuthRequest can tell \"no scopes claim\"\n    // (derive from role / full-access fallback) from \"explicitly empty\".\n    scopes: assertion.scopes ?? null,\n    lastAssertionAt: new Date(assertion.iat * 1000),\n    lastRevalidatedAt: now,\n    revokedAt: null,\n    updatedAt: now,\n  }\n}\n\nasync function upsertVoyantCloudUserLink(\n  db: ReturnType<typeof getDb>,\n  userId: string,\n  assertion: CloudAdminAssertion,\n  now: Date,\n): Promise<void> {\n  const values = cloudAuthUserLinkValues(userId, assertion, now)\n  const [existingForUser] = await db\n    .select({ userId: cloudAuthUserLinks.userId })\n    .from(cloudAuthUserLinks)\n    .where(eq(cloudAuthUserLinks.userId, userId))\n    .limit(1)\n\n  if (existingForUser) {\n    await db\n      .update(cloudAuthUserLinks)\n      .set({\n        ...values,\n        userId,\n        revokedAt: null,\n      })\n      .where(eq(cloudAuthUserLinks.userId, userId))\n    return\n  }\n\n  await db\n    .insert(cloudAuthUserLinks)\n    .values(values)\n    .onConflictDoUpdate({\n      target: [cloudAuthUserLinks.providerId, cloudAuthUserLinks.providerAccountId],\n      set: {\n        ...values,\n        userId,\n        revokedAt: null,\n      },\n    })\n}\n\nasync function upsertVoyantCloudSessionLink(\n  db: ReturnType<typeof getDb>,\n  input: {\n    assertion: CloudAdminAssertion\n    session: BetterAuthSessionForCookie\n    revalidateAfterSeconds: number\n  },\n): Promise<void> {\n  const now = new Date()\n  await db.insert(cloudAuthSessionLinks).values({\n    sessionId: input.session.id,\n    userId: input.session.userId,\n    providerId: VOYANT_CLOUD_PROVIDER_ID,\n    providerAccountId: input.assertion.workosUserId,\n    deploymentId: input.assertion.deploymentId,\n    revalidateAfter: new Date(now.getTime() + input.revalidateAfterSeconds * 1000),\n    lastRevalidatedAt: now,\n    revokedAt: null,\n    updatedAt: now,\n  })\n}\n\nfunction cloudAssertionDisplayName(assertion: CloudAdminAssertion): string {\n  const fromParts = [assertion.firstName, assertion.lastName]\n    .map((part) => part?.trim())\n    .filter((part): part is string => Boolean(part))\n    .join(\" \")\n  return assertion.name?.trim() || fromParts || assertion.email\n}\n\nfunction cloudAuthAccountId(providerAccountId: string): string {\n  return `acc_${VOYANT_CLOUD_PROVIDER_ID}_${providerAccountId}`\n}\n"]}

package/dist/cloud-broker/assertion.d.ts

@@ -79,4 +79,3 @@ export declare function verifyCloudAdminAssertion(assertion: string, options: {
     fetch?: typeof fetch;
     now?: Date;
 }): Promise<CloudAdminAssertion>;
-//# sourceMappingURL=assertion.d.ts.map

package/dist/cloud-broker/assertion.js.map

@@ -1 +1 @@
-{"version":3,"file":"assertion.js","sourceRoot":"","sources":["../../src/cloud-broker/assertion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE3F,MAAM,CAAC,MAAM,mCAAmC,GAAG,2BAA2B,CAAA;AA2F9E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,IAAI,EACJ,KAAK,EACL,MAAM,EACN,KAAK,EAAE,OAAO,GAAG,KAAK,EACtB,GAAG,GAAG,IAAI,IAAI,EAAE,GACgB;IAChC,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAE9B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI;YACJ,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;KACH,CAAC,CAAA;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAA;IAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE;QAC/C,OAAO,EAAE,MAAM,CAAC,gBAAgB;QAChC,MAAM,EAAE,MAAM,CAAC,eAAe,IAAI,mCAAmC;QACrE,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,OAAO;QACd,GAAG;KACJ,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,YAAY,EACZ,MAAM,EACN,KAAK,EAAE,OAAO,GAAG,KAAK,GACc;IACpC,wBAAwB,CAAC,MAAM,CAAC,CAAA;IAEhC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY;SACb,CAAC;KACH,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAA;IAEjE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,IACE,CAAC,QAAQ,CAAC,IAAI,CAAC;QACf,OAAO,IAAI,CAAC,EAAE,KAAK,SAAS;QAC5B,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,EACvD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,SAAS;QAChD,6EAA6E;QAC7E,yEAAyE;QACzE,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAAiB,EACjB,OAQC;IAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IAC/E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAA;IACnF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpD,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,aAAa,CAAC,SAAS,CAAC,EACxB,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CACtD,CAAA;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,gBAAgB,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAA;IACjE,iCAAiC,CAAC,gBAAgB,EAAE;QAClD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE;KAC/B,CAAC,CAAA;IACF,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAoC;IAClE,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAA;IACvD,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAA;IAEjE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAsC;IACtE,oBAAoB,CAAC,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IAE3D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IAMxC,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvF,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAY,CAAA;IAC9F,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE;QAC1F,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAY;QACzF,YAAY,EAAE,GAAG,aAAa,IAAI,cAAc,EAAE;QAClD,SAAS,EAAE,eAAe,CAAC,gBAAgB,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,GAAW,EAAE,OAAqB;IAC7E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAA;IAC/C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,+BAA+B,CAAC,OAAgB;IACvD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAiD;QAC9D,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QACvC,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QACvC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,aAAa,EAAE,eAAe,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC;QACtE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5C,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC;QAClE,oBAAoB,EAAE,cAAc,CAAC,OAAO,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;QAC1F,sBAAsB,EAAE,cAAc,CACpC,OAAO,CAAC,sBAAsB,EAC9B,wBAAwB,CACzB;QACD,wBAAwB,EAAE,cAAc,CACtC,OAAO,CAAC,wBAAwB,EAChC,0BAA0B,CAC3B;QACD,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC;QAClE,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC;QAChD,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC;QAClD,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC/C,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;QAC3C,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QACvC,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;KACxC,CAAA;AACH,CAAC;AAED,SAAS,iCAAiC,CACxC,SAA8B,EAC9B,QAMC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAE5D,IAAI,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,SAAS,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,GAAG,UAAU,GAAG,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;AACpF,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAA;AAC1F,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,mBAAmB,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACrE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,oBAAoB,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,mBAAmB,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"assertion.js","sourceRoot":"","sources":["../../src/cloud-broker/assertion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE3F,MAAM,CAAC,MAAM,mCAAmC,GAAG,2BAA2B,CAAA;AA2F9E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,IAAI,EACJ,KAAK,EACL,MAAM,EACN,KAAK,EAAE,OAAO,GAAG,KAAK,EACtB,GAAG,GAAG,IAAI,IAAI,EAAE,GACgB;IAChC,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAE9B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI;YACJ,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;KACH,CAAC,CAAA;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAA;IAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE;QAC/C,OAAO,EAAE,MAAM,CAAC,gBAAgB;QAChC,MAAM,EAAE,MAAM,CAAC,eAAe,IAAI,mCAAmC;QACrE,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,OAAO;QACd,GAAG;KACJ,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,YAAY,EACZ,MAAM,EACN,KAAK,EAAE,OAAO,GAAG,KAAK,GACc;IACpC,wBAAwB,CAAC,MAAM,CAAC,CAAA;IAEhC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY;SACb,CAAC;KACH,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAA;IAEjE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,IACE,CAAC,QAAQ,CAAC,IAAI,CAAC;QACf,OAAO,IAAI,CAAC,EAAE,KAAK,SAAS;QAC5B,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,EACvD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,SAAS;QAChD,6EAA6E;QAC7E,yEAAyE;QACzE,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAAiB,EACjB,OAQC;IAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IAC/E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAA;IACnF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpD,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,aAAa,CAAC,SAAS,CAAC,EACxB,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CACtD,CAAA;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,gBAAgB,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAA;IACjE,iCAAiC,CAAC,gBAAgB,EAAE;QAClD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE;KAC/B,CAAC,CAAA;IACF,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAoC;IAClE,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAA;IACvD,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAA;IAEjE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAsC;IACtE,oBAAoB,CAAC,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IAE3D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IAMxC,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvF,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAY,CAAA;IAC9F,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE;QAC1F,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAY;QACzF,YAAY,EAAE,GAAG,aAAa,IAAI,cAAc,EAAE;QAClD,SAAS,EAAE,eAAe,CAAC,gBAAgB,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,GAAW,EAAE,OAAqB;IAC7E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAA;IAC/C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,+BAA+B,CAAC,OAAgB;IACvD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAiD;QAC9D,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QACvC,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QACvC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,aAAa,EAAE,eAAe,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC;QACtE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5C,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC;QAClE,oBAAoB,EAAE,cAAc,CAAC,OAAO,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;QAC1F,sBAAsB,EAAE,cAAc,CACpC,OAAO,CAAC,sBAAsB,EAC9B,wBAAwB,CACzB;QACD,wBAAwB,EAAE,cAAc,CACtC,OAAO,CAAC,wBAAwB,EAChC,0BAA0B,CAC3B;QACD,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC;QAClE,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC;QAChD,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC;QAClD,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC/C,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;QAC3C,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QACvC,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;KACxC,CAAA;AACH,CAAC;AAED,SAAS,iCAAiC,CACxC,SAA8B,EAC9B,QAMC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAE5D,IAAI,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,SAAS,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,GAAG,UAAU,GAAG,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;AACpF,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAA;AAC1F,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,mBAAmB,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACrE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,oBAAoB,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,mBAAmB,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC","sourcesContent":["import type { CloudAdminAuthState } from \"./state.js\"\nimport { base64UrlDecode, isRecord, normalizeAbsoluteUrl, toArrayBuffer } from \"./utils.js\"\n\nexport const VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER = \"https://api.voyant.travel\"\n\nexport type CloudAdminAssertion = {\n  iss: typeof VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER\n  aud: string\n  sub: string\n  email: string\n  emailVerified: boolean\n  name?: string | null\n  firstName?: string | null\n  lastName?: string | null\n  image?: string | null\n  workosUserId: string\n  workosOrganizationId: string\n  platformOrganizationId: string\n  platformOrganizationSlug: string\n  deploymentId: string\n  appId?: string | null\n  environment?: string | null\n  membershipId?: string | null\n  roleSlug?: string | null\n  roleName?: string | null\n  surfaces?: string[] | null\n  /**\n   * Member RBAC scope set (`resource:action` strings). Absent on older platforms\n   * — the deployment then derives scopes from `roleSlug`. See member-rbac-rfc.md.\n   */\n  scopes?: string[] | null\n  nonce: string\n  iat: number\n  exp: number\n}\n\nexport type CloudAdminAuthExchangeConfig = {\n  exchangeUrl: string\n  deploymentId: string\n  clientToken: string\n  assertionJwksUrl: string\n  assertionAudience: string\n  assertionIssuer?: typeof VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER\n}\n\nexport type CloudAdminAuthRevalidateConfig = {\n  revalidateUrl: string\n  deploymentId: string\n  clientToken: string\n}\n\nexport type ExchangeCloudAdminAuthCodeInput = {\n  code: string\n  state: CloudAdminAuthState\n  config: CloudAdminAuthExchangeConfig\n  fetch?: typeof fetch\n  now?: Date\n}\n\nexport type RevalidateCloudAdminAuthAccessInput = {\n  workosUserId: string\n  config: CloudAdminAuthRevalidateConfig\n  fetch?: typeof fetch\n}\n\nexport type CloudAdminAuthRevalidationResult = {\n  ok: boolean\n  status: \"active\" | \"revoked\"\n  reason?: string\n  /**\n   * The member's current RBAC scope set for this deployment, refreshed from the\n   * platform (member-rbac-rfc, voyant#2085). `undefined` when the platform\n   * didn't include it (older platform); `null` means \"no explicit permissions —\n   * derive from role\". Lets a permission change take effect within one\n   * revalidation interval instead of only at next login.\n   */\n  scopes?: string[] | null\n}\n\ntype JwsHeader = {\n  alg: \"RS256\"\n  kid: string\n  typ?: string\n}\n\ntype JsonWebKeySet = {\n  keys: JwksKey[]\n}\n\ntype JwksKey = JsonWebKey & {\n  kid?: string\n  kty?: string\n}\n\nexport async function exchangeCloudAdminAuthCode({\n  code,\n  state,\n  config,\n  fetch: fetchFn = fetch,\n  now = new Date(),\n}: ExchangeCloudAdminAuthCodeInput): Promise<CloudAdminAssertion> {\n  validateExchangeConfig(config)\n\n  const response = await fetchFn(config.exchangeUrl, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${config.clientToken}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      code,\n      deploymentId: config.deploymentId,\n      redirectUri: state.redirectUri,\n      nonce: state.nonce,\n    }),\n  })\n\n  if (!response.ok) {\n    throw new Error(`Voyant Cloud auth exchange failed with HTTP ${response.status}`)\n  }\n\n  const body = (await response.json()) as unknown\n  if (!isRecord(body) || typeof body.assertion !== \"string\") {\n    throw new Error(\"Voyant Cloud auth exchange response is missing assertion\")\n  }\n\n  return verifyCloudAdminAssertion(body.assertion, {\n    jwksUrl: config.assertionJwksUrl,\n    issuer: config.assertionIssuer ?? VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER,\n    audience: config.assertionAudience,\n    deploymentId: config.deploymentId,\n    nonce: state.nonce,\n    fetch: fetchFn,\n    now,\n  })\n}\n\nexport async function revalidateCloudAdminAuthAccess({\n  workosUserId,\n  config,\n  fetch: fetchFn = fetch,\n}: RevalidateCloudAdminAuthAccessInput): Promise<CloudAdminAuthRevalidationResult> {\n  validateRevalidateConfig(config)\n\n  const response = await fetchFn(config.revalidateUrl, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${config.clientToken}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      deploymentId: config.deploymentId,\n      workosUserId,\n    }),\n  })\n\n  const body = (await response.json().catch(() => null)) as unknown\n\n  if (!response.ok && response.status !== 403) {\n    throw new Error(`Voyant Cloud auth revalidation failed with HTTP ${response.status}`)\n  }\n\n  if (\n    !isRecord(body) ||\n    typeof body.ok !== \"boolean\" ||\n    (body.status !== \"active\" && body.status !== \"revoked\")\n  ) {\n    throw new Error(\"Voyant Cloud auth revalidation response is invalid\")\n  }\n\n  return {\n    ok: body.ok,\n    status: body.status,\n    reason: optionalString(body.reason) ?? undefined,\n    // Only surface `scopes` when the platform sent the key, so an older platform\n    // (no key) leaves the cached scopes untouched rather than clearing them.\n    ...(\"scopes\" in body ? { scopes: optionalStringArray(body.scopes) } : {}),\n  }\n}\n\nexport async function verifyCloudAdminAssertion(\n  assertion: string,\n  options: {\n    jwksUrl: string\n    issuer: typeof VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER\n    audience: string\n    deploymentId: string\n    nonce: string\n    fetch?: typeof fetch\n    now?: Date\n  },\n): Promise<CloudAdminAssertion> {\n  const { header, payload, signingInput, signature } = parseCompactJws(assertion)\n  if (header.alg !== \"RS256\") {\n    throw new Error(`Unsupported Voyant Cloud auth assertion algorithm: ${header.alg}`)\n  }\n\n  const jwk = await fetchJwksKey(options.jwksUrl, header.kid, options.fetch ?? fetch)\n  const key = await globalThis.crypto.subtle.importKey(\n    \"jwk\",\n    jwk,\n    { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n    false,\n    [\"verify\"],\n  )\n  const verified = await globalThis.crypto.subtle.verify(\n    { name: \"RSASSA-PKCS1-v1_5\" },\n    key,\n    toArrayBuffer(signature),\n    toArrayBuffer(new TextEncoder().encode(signingInput)),\n  )\n  if (!verified) {\n    throw new Error(\"Invalid Voyant Cloud auth assertion signature\")\n  }\n\n  const assertionPayload = parseCloudAdminAssertionPayload(payload)\n  validateCloudAdminAssertionClaims(assertionPayload, {\n    issuer: options.issuer,\n    audience: options.audience,\n    deploymentId: options.deploymentId,\n    nonce: options.nonce,\n    now: options.now ?? new Date(),\n  })\n  return assertionPayload\n}\n\nfunction validateExchangeConfig(config: CloudAdminAuthExchangeConfig): void {\n  normalizeAbsoluteUrl(config.exchangeUrl, \"exchangeUrl\")\n  normalizeAbsoluteUrl(config.assertionJwksUrl, \"assertionJwksUrl\")\n\n  if (!config.deploymentId.trim()) {\n    throw new Error(\"Voyant Cloud auth exchange requires deploymentId\")\n  }\n  if (!config.clientToken.trim()) {\n    throw new Error(\"Voyant Cloud auth exchange requires clientToken\")\n  }\n  if (!config.assertionAudience.trim()) {\n    throw new Error(\"Voyant Cloud auth exchange requires assertionAudience\")\n  }\n}\n\nfunction validateRevalidateConfig(config: CloudAdminAuthRevalidateConfig): void {\n  normalizeAbsoluteUrl(config.revalidateUrl, \"revalidateUrl\")\n\n  if (!config.deploymentId.trim()) {\n    throw new Error(\"Voyant Cloud auth revalidation requires deploymentId\")\n  }\n  if (!config.clientToken.trim()) {\n    throw new Error(\"Voyant Cloud auth revalidation requires clientToken\")\n  }\n}\n\nfunction parseCompactJws(assertion: string): {\n  header: JwsHeader\n  payload: unknown\n  signingInput: string\n  signature: Uint8Array\n} {\n  const [encodedHeader, encodedPayload, encodedSignature, ...rest] = assertion.split(\".\")\n  if (!encodedHeader || !encodedPayload || !encodedSignature || rest.length > 0) {\n    throw new Error(\"Voyant Cloud auth assertion must be a compact JWS\")\n  }\n\n  const header = JSON.parse(new TextDecoder().decode(base64UrlDecode(encodedHeader))) as unknown\n  if (!isRecord(header) || header.alg !== \"RS256\" || typeof header.kid !== \"string\") {\n    throw new Error(\"Voyant Cloud auth assertion header is invalid\")\n  }\n\n  return {\n    header: { alg: header.alg, kid: header.kid, typ: optionalString(header.typ) ?? undefined },\n    payload: JSON.parse(new TextDecoder().decode(base64UrlDecode(encodedPayload))) as unknown,\n    signingInput: `${encodedHeader}.${encodedPayload}`,\n    signature: base64UrlDecode(encodedSignature),\n  }\n}\n\nasync function fetchJwksKey(jwksUrl: string, kid: string, fetchFn: typeof fetch): Promise<JwksKey> {\n  const response = await fetchFn(jwksUrl)\n  if (!response.ok) {\n    throw new Error(`Voyant Cloud auth JWKS fetch failed with HTTP ${response.status}`)\n  }\n\n  const body = (await response.json()) as unknown\n  if (!isJsonWebKeySet(body)) {\n    throw new Error(\"Voyant Cloud auth JWKS response is invalid\")\n  }\n\n  const key = body.keys.find((candidate) => candidate.kid === kid)\n  if (!key) {\n    throw new Error(\"Voyant Cloud auth assertion key was not found in JWKS\")\n  }\n  if (key.kty !== \"RSA\") {\n    throw new Error(\"Voyant Cloud auth assertion key must be RSA\")\n  }\n  return key\n}\n\nfunction parseCloudAdminAssertionPayload(payload: unknown): CloudAdminAssertion {\n  if (!isRecord(payload)) {\n    throw new Error(\"Voyant Cloud auth assertion payload is invalid\")\n  }\n\n  return {\n    iss: payload.iss as typeof VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER,\n    aud: requiredString(payload.aud, \"aud\"),\n    sub: requiredString(payload.sub, \"sub\"),\n    email: requiredString(payload.email, \"email\"),\n    emailVerified: requiredBoolean(payload.emailVerified, \"emailVerified\"),\n    name: optionalString(payload.name),\n    firstName: optionalString(payload.firstName),\n    lastName: optionalString(payload.lastName),\n    image: optionalString(payload.image),\n    workosUserId: requiredString(payload.workosUserId, \"workosUserId\"),\n    workosOrganizationId: requiredString(payload.workosOrganizationId, \"workosOrganizationId\"),\n    platformOrganizationId: requiredString(\n      payload.platformOrganizationId,\n      \"platformOrganizationId\",\n    ),\n    platformOrganizationSlug: requiredString(\n      payload.platformOrganizationSlug,\n      \"platformOrganizationSlug\",\n    ),\n    deploymentId: requiredString(payload.deploymentId, \"deploymentId\"),\n    appId: optionalString(payload.appId),\n    environment: optionalString(payload.environment),\n    membershipId: optionalString(payload.membershipId),\n    roleSlug: optionalString(payload.roleSlug),\n    roleName: optionalString(payload.roleName),\n    surfaces: optionalStringArray(payload.surfaces),\n    scopes: optionalStringArray(payload.scopes),\n    nonce: requiredString(payload.nonce, \"nonce\"),\n    iat: requiredNumber(payload.iat, \"iat\"),\n    exp: requiredNumber(payload.exp, \"exp\"),\n  }\n}\n\nfunction validateCloudAdminAssertionClaims(\n  assertion: CloudAdminAssertion,\n  expected: {\n    issuer: typeof VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER\n    audience: string\n    deploymentId: string\n    nonce: string\n    now: Date\n  },\n): void {\n  const nowSeconds = Math.floor(expected.now.getTime() / 1000)\n\n  if (assertion.iss !== expected.issuer) {\n    throw new Error(\"Voyant Cloud auth assertion issuer mismatch\")\n  }\n  if (assertion.aud !== expected.audience) {\n    throw new Error(\"Voyant Cloud auth assertion audience mismatch\")\n  }\n  if (assertion.deploymentId !== expected.deploymentId) {\n    throw new Error(\"Voyant Cloud auth assertion deployment mismatch\")\n  }\n  if (assertion.nonce !== expected.nonce) {\n    throw new Error(\"Voyant Cloud auth assertion nonce mismatch\")\n  }\n  if (assertion.exp <= nowSeconds) {\n    throw new Error(\"Voyant Cloud auth assertion is expired\")\n  }\n  if (assertion.iat > nowSeconds + 60) {\n    throw new Error(\"Voyant Cloud auth assertion iat is in the future\")\n  }\n}\n\nfunction isJsonWebKeySet(value: unknown): value is JsonWebKeySet {\n  return isRecord(value) && Array.isArray(value.keys) && value.keys.every(isJwksKey)\n}\n\nfunction isJwksKey(value: unknown): value is JwksKey {\n  return isRecord(value) && typeof value.kid === \"string\" && typeof value.kty === \"string\"\n}\n\nfunction requiredString(value: unknown, field: string): string {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new Error(`Voyant Cloud auth assertion ${field} must be a string`)\n  }\n  return value\n}\n\nfunction optionalString(value: unknown): string | null {\n  return typeof value === \"string\" && value.length > 0 ? value : null\n}\n\nfunction requiredBoolean(value: unknown, field: string): boolean {\n  if (typeof value !== \"boolean\") {\n    throw new Error(`Voyant Cloud auth assertion ${field} must be a boolean`)\n  }\n  return value\n}\n\nfunction requiredNumber(value: unknown, field: string): number {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) {\n    throw new Error(`Voyant Cloud auth assertion ${field} must be a number`)\n  }\n  return value\n}\n\nfunction optionalStringArray(value: unknown): string[] | null {\n  if (value === undefined || value === null) return null\n  if (!Array.isArray(value) || value.some((item) => typeof item !== \"string\")) {\n    throw new Error(\"Voyant Cloud auth assertion surfaces must be an array of strings\")\n  }\n  return value\n}\n"]}

package/dist/cloud-broker/members.d.ts

@@ -96,4 +96,3 @@ export declare function setCloudAdminMemberPermissions(input: CloudAdminMembersR
     membershipId: string;
     permissions: string[];
 }): Promise<CloudAdminMember>;
-//# sourceMappingURL=members.d.ts.map

package/dist/cloud-broker/members.js.map

@@ -1 +1 @@
-{"version":3,"file":"members.js","sourceRoot":"","sources":["../../src/cloud-broker/members.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAoD3D,kFAAkF;AAClF,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGpC;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,MAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAA;QAHL,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAS;QAGxB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,aAAqB;IAClE,OAAO,oBAAoB,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;AAC1F,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qCAAqC,CACnD,MAAsC;IAEtC,OAAO;QACL,OAAO,EAAE,8BAA8B,CAAC,MAAM,CAAC,aAAa,CAAC;QAC7D,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAA;AACH,CAAC;AAWD,SAAS,cAAc,CAAC,MAA+B;IACrD,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAI,EACxB,MAAM,EACN,kBAAkB,EAClB,IAAI,EACJ,MAAM,GAAG,KAAK,EACd,IAAI,EACJ,KAAK,EAAE,OAAO,GAAG,KAAK,GACT;IACb,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;QACzD,MAAM;QACN,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;YAClC,wBAAwB,EAAE,MAAM,CAAC,YAAY;YAC7C,yBAAyB,EAAE,kBAAkB;SAC9C;QACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC5D,CAAC,CAAA;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,SAAc,CAAA;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAA;IAEpE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GACV,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QACpF,MAAM,IAAI,sBAAsB,CAC9B,MAAM,IAAI,gDAAgD,QAAQ,CAAC,MAAM,EAAE,EAC3E,QAAQ,CAAC,MAAM,EACf,MAAM,CACP,CAAA;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,IAAS,CAAA;IAC1B,CAAC;IACD,OAAO,OAAY,CAAA;AACrB,CAAC;AAQD,MAAM,UAAU,qBAAqB,CACnC,KAA+B;IAE/B,OAAO,OAAO,CAAqB,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA+B;IAE/B,OAAO,OAAO,CAAyB,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA+B;IAE/B,OAAO,OAAO,CAAyB,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAkE;IAElE,OAAO,OAAO,CAAuB;QACnC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,KAAK;KAClB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAA0D;IAE1D,OAAO,OAAO,CAAO;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE;QAC9D,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAGC;IAED,OAAO,OAAO,CAAmB;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS;QACjE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;KACrC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAGC;IAED,OAAO,OAAO,CAAmB;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc;QACtE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;KACzC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"members.js","sourceRoot":"","sources":["../../src/cloud-broker/members.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAoD3D,kFAAkF;AAClF,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGpC;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,MAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAA;QAHL,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAS;QAGxB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,aAAqB;IAClE,OAAO,oBAAoB,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;AAC1F,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qCAAqC,CACnD,MAAsC;IAEtC,OAAO;QACL,OAAO,EAAE,8BAA8B,CAAC,MAAM,CAAC,aAAa,CAAC;QAC7D,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAA;AACH,CAAC;AAWD,SAAS,cAAc,CAAC,MAA+B;IACrD,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAI,EACxB,MAAM,EACN,kBAAkB,EAClB,IAAI,EACJ,MAAM,GAAG,KAAK,EACd,IAAI,EACJ,KAAK,EAAE,OAAO,GAAG,KAAK,GACT;IACb,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;QACzD,MAAM;QACN,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;YAClC,wBAAwB,EAAE,MAAM,CAAC,YAAY;YAC7C,yBAAyB,EAAE,kBAAkB;SAC9C;QACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC5D,CAAC,CAAA;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,SAAc,CAAA;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAA;IAEpE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GACV,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QACpF,MAAM,IAAI,sBAAsB,CAC9B,MAAM,IAAI,gDAAgD,QAAQ,CAAC,MAAM,EAAE,EAC3E,QAAQ,CAAC,MAAM,EACf,MAAM,CACP,CAAA;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,IAAS,CAAA;IAC1B,CAAC;IACD,OAAO,OAAY,CAAA;AACrB,CAAC;AAQD,MAAM,UAAU,qBAAqB,CACnC,KAA+B;IAE/B,OAAO,OAAO,CAAqB,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA+B;IAE/B,OAAO,OAAO,CAAyB,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA+B;IAE/B,OAAO,OAAO,CAAyB,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAkE;IAElE,OAAO,OAAO,CAAuB;QACnC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,KAAK;KAClB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAA0D;IAE1D,OAAO,OAAO,CAAO;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE;QAC9D,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAGC;IAED,OAAO,OAAO,CAAmB;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS;QACjE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;KACrC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAGC;IAED,OAAO,OAAO,CAAmB;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc;QACtE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;KACzC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["/**\n * Deployment-side client for Voyant Cloud member management.\n *\n * The team roster of a `voyant-cloud`-auth deployment lives on the platform, not\n * in the deployment DB. This client lets the deployment manage that roster\n * (list members, list/send/revoke invitations, grant/revoke this deployment's\n * access) by calling the platform's `/cloud/v1/admin-auth/*` member endpoints —\n * the management counterpart to {@link revalidateCloudAdminAuthAccess}.\n *\n * Every request carries the deployment client token (Bearer) plus the acting\n * staff user's WorkOS id; the platform re-verifies that user is an org manager\n * before mutating, so the deployment never self-asserts authority.\n */\nimport type { CloudAdminAuthRevalidateConfig } from \"./assertion.js\"\nimport { isRecord, normalizeAbsoluteUrl } from \"./utils.js\"\n\nexport type CloudAdminMembersConfig = {\n  /** Base URL of the platform member API, e.g. `.../cloud/v1/admin-auth`. */\n  baseUrl: string\n  deploymentId: string\n  clientToken: string\n}\n\nexport type CloudAdminMember = {\n  membershipId: string\n  externalUserId: string\n  email: string | null\n  roleSlug: string | null\n  roleName: string | null\n  status: string\n  /** Full platform access (owner/admin) — reaches every deployment. */\n  hasFullPlatformAccess: boolean\n  /** Whether the member can currently sign into this deployment. */\n  hasDeploymentAccess: boolean\n  /** True when this deployment is explicitly listed in their grants. */\n  isExplicitGrant: boolean\n  /** Explicit per-deployment RBAC scope set for this app, or null (role-derived). */\n  permissions: string[] | null\n}\n\nexport type CloudAdminMemberRole = {\n  slug: string\n  name: string\n  description: string | null\n}\n\nexport type CloudAdminInvitation = {\n  id: string\n  email: string\n  state: \"pending\" | \"accepted\" | \"expired\" | \"revoked\"\n  acceptedAt: string | null\n  revokedAt: string | null\n  expiresAt: string\n  inviterUserId: string | null\n  acceptedUserId: string | null\n  acceptInvitationUrl: string\n  createdAt: string\n  updatedAt: string\n}\n\nexport type CloudAdminInviteInput = {\n  email: string\n  roleSlug?: string | null\n  expiresInDays?: number\n}\n\n/** Raised when the platform rejects a member request; carries the HTTP status. */\nexport class CloudAdminMembersError extends Error {\n  constructor(\n    message: string,\n    readonly status: number,\n    readonly reason?: string,\n  ) {\n    super(message)\n    this.name = \"CloudAdminMembersError\"\n  }\n}\n\n/**\n * Derive the member API base URL from the revalidate URL — they share the\n * `/cloud/v1/admin-auth` prefix, so a deployment needs no extra env var.\n */\nexport function deriveCloudAdminMembersBaseUrl(revalidateUrl: string): string {\n  return normalizeAbsoluteUrl(revalidateUrl, \"revalidateUrl\").replace(/\\/revalidate$/, \"\")\n}\n\n/** Build a member-API config by reusing the deployment's revalidate config. */\nexport function cloudAdminMembersConfigFromRevalidate(\n  config: CloudAdminAuthRevalidateConfig,\n): CloudAdminMembersConfig {\n  return {\n    baseUrl: deriveCloudAdminMembersBaseUrl(config.revalidateUrl),\n    deploymentId: config.deploymentId,\n    clientToken: config.clientToken,\n  }\n}\n\ntype RequestInput = {\n  config: CloudAdminMembersConfig\n  actingWorkosUserId: string\n  path: string\n  method?: \"GET\" | \"POST\" | \"PUT\" | \"DELETE\"\n  body?: unknown\n  fetch?: typeof fetch\n}\n\nfunction validateConfig(config: CloudAdminMembersConfig) {\n  normalizeAbsoluteUrl(config.baseUrl, \"baseUrl\")\n  if (!config.deploymentId.trim()) {\n    throw new Error(\"Voyant Cloud member config is missing deploymentId\")\n  }\n  if (!config.clientToken.trim()) {\n    throw new Error(\"Voyant Cloud member config is missing clientToken\")\n  }\n}\n\nasync function request<T>({\n  config,\n  actingWorkosUserId,\n  path,\n  method = \"GET\",\n  body,\n  fetch: fetchFn = fetch,\n}: RequestInput): Promise<T> {\n  validateConfig(config)\n  if (!actingWorkosUserId.trim()) {\n    throw new Error(\"Voyant Cloud member request is missing the acting user\")\n  }\n\n  const response = await fetchFn(`${config.baseUrl}${path}`, {\n    method,\n    headers: {\n      Authorization: `Bearer ${config.clientToken}`,\n      \"Content-Type\": \"application/json\",\n      \"x-voyant-deployment-id\": config.deploymentId,\n      \"x-voyant-acting-user-id\": actingWorkosUserId,\n    },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  })\n\n  if (response.status === 204) {\n    return undefined as T\n  }\n\n  const payload = (await response.json().catch(() => null)) as unknown\n\n  if (!response.ok) {\n    const reason =\n      isRecord(payload) && typeof payload.error === \"string\" ? payload.error : undefined\n    throw new CloudAdminMembersError(\n      reason ?? `Voyant Cloud member request failed with HTTP ${response.status}`,\n      response.status,\n      reason,\n    )\n  }\n\n  if (isRecord(payload) && \"data\" in payload) {\n    return payload.data as T\n  }\n  return payload as T\n}\n\nexport type CloudAdminMembersRequest = {\n  config: CloudAdminMembersConfig\n  actingWorkosUserId: string\n  fetch?: typeof fetch\n}\n\nexport function listCloudAdminMembers(\n  input: CloudAdminMembersRequest,\n): Promise<CloudAdminMember[]> {\n  return request<CloudAdminMember[]>({ ...input, path: \"/members\" })\n}\n\nexport function listCloudAdminMemberRoles(\n  input: CloudAdminMembersRequest,\n): Promise<CloudAdminMemberRole[]> {\n  return request<CloudAdminMemberRole[]>({ ...input, path: \"/roles\" })\n}\n\nexport function listCloudAdminInvitations(\n  input: CloudAdminMembersRequest,\n): Promise<CloudAdminInvitation[]> {\n  return request<CloudAdminInvitation[]>({ ...input, path: \"/invitations\" })\n}\n\nexport function inviteCloudAdminMember(\n  input: CloudAdminMembersRequest & { input: CloudAdminInviteInput },\n): Promise<CloudAdminInvitation> {\n  return request<CloudAdminInvitation>({\n    config: input.config,\n    actingWorkosUserId: input.actingWorkosUserId,\n    fetch: input.fetch,\n    path: \"/invitations\",\n    method: \"POST\",\n    body: input.input,\n  })\n}\n\nexport function revokeCloudAdminInvitation(\n  input: CloudAdminMembersRequest & { invitationId: string },\n): Promise<void> {\n  return request<void>({\n    config: input.config,\n    actingWorkosUserId: input.actingWorkosUserId,\n    fetch: input.fetch,\n    path: `/invitations/${encodeURIComponent(input.invitationId)}`,\n    method: \"DELETE\",\n  })\n}\n\nexport function setCloudAdminMemberAccess(\n  input: CloudAdminMembersRequest & {\n    membershipId: string\n    hasAccess: boolean\n  },\n): Promise<CloudAdminMember> {\n  return request<CloudAdminMember>({\n    config: input.config,\n    actingWorkosUserId: input.actingWorkosUserId,\n    fetch: input.fetch,\n    path: `/members/${encodeURIComponent(input.membershipId)}/access`,\n    method: \"PUT\",\n    body: { hasAccess: input.hasAccess },\n  })\n}\n\n/**\n * Set a member's granular RBAC permissions for this deployment (`resource:action`\n * strings). A non-empty set also grants sign-in access; an empty set clears both.\n */\nexport function setCloudAdminMemberPermissions(\n  input: CloudAdminMembersRequest & {\n    membershipId: string\n    permissions: string[]\n  },\n): Promise<CloudAdminMember> {\n  return request<CloudAdminMember>({\n    config: input.config,\n    actingWorkosUserId: input.actingWorkosUserId,\n    fetch: input.fetch,\n    path: `/members/${encodeURIComponent(input.membershipId)}/permissions`,\n    method: \"PUT\",\n    body: { permissions: input.permissions },\n  })\n}\n"]}

package/dist/cloud-broker/state.d.ts

@@ -52,4 +52,3 @@ export declare function createCloudAdminAuthStart({ requestUrl, next, config, no
 export declare function verifyCloudAdminAuthCallback({ requestUrl, cookieHeader, cookieSecret, now, }: VerifyCloudAdminAuthCallbackInput): Promise<VerifyCloudAdminAuthCallbackResult>;
 export declare function normalizeCloudAdminAuthNext(next: string | null | undefined, adminOrigin: string): string;
 export declare function buildClearCloudAdminAuthStateCookie(secure: boolean, path?: string): string;
-//# sourceMappingURL=state.d.ts.map

package/dist/cloud-broker/state.js.map

@@ -1 +1 @@
-{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/cloud-broker/state.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,eAAe,EACf,QAAQ,EACR,oBAAoB,EACpB,eAAe,GAChB,MAAM,YAAY,CAAA;AAEnB,MAAM,CAAC,MAAM,oCAAoC,GAAG,yBAAyB,CAAA;AAE7E,MAAM,yBAAyB,GAAG,GAAG,CAAA;AACrC,MAAM,YAAY,GAAG,EAAE,CAAA;AA2DvB,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,UAAU,EACV,IAAI,EACJ,MAAM,EACN,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,WAAW,EACX,WAAW,GACoB;IAC/B,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAE3B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,IAAI,yBAAyB,CAAA;IACtE,MAAM,KAAK,GAAwB;QACjC,KAAK,EAAE,WAAW,IAAI,WAAW,EAAE;QACnC,KAAK,EAAE,WAAW,IAAI,WAAW,EAAE;QACnC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACxC,WAAW,EAAE,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QAC9E,IAAI,EAAE,2BAA2B,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC;QAChE,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI;KAC7C,CAAA;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;IACjE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IAC/D,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAClD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAClD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,CAAA;IAC1E,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IAEhD,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACzB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/B,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;QACnC,KAAK;QACL,SAAS,EAAE,MAAM,8BAA8B,CAAC;YAC9C,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,YAAY;YAC3B,MAAM,EAAE,gBAAgB,CAAC,QAAQ,KAAK,QAAQ;YAC9C,IAAI,EAAE,mBAAmB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC9D,aAAa,EAAE,UAAU;SAC1B,CAAC;KACH,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,GAAG,GAAG,IAAI,IAAI,EAAE,GACkB;IAClC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAEhC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IAC/B,MAAM,WAAW,GAAG,mCAAmC,CACrD,GAAG,CAAC,QAAQ,KAAK,QAAQ,EACzB,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClC,CAAA;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa;YACpB,UAAU;YACV,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS;YACnE,WAAW;SACZ,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAA;IAC7D,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,EAAE,oCAAoC,CAAC,CAAA;IAClF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC9E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;IAC3D,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;IAC3D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAA+B,EAC/B,WAAmB;IAEnB,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAA;IAEtB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,GAAG,CAAA;QAC1C,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,MAAe,EAAE,IAAI,GAAG,aAAa;IACvF,OAAO,eAAe,CAAC,oCAAoC,EAAE,EAAE,EAAE;QAC/D,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,CAAC;QACT,IAAI;QACJ,QAAQ,EAAE,KAAK;QACf,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,EAC5C,KAAK,EACL,MAAM,EACN,MAAM,EACN,IAAI,EACJ,aAAa,GAOd;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAE7C,OAAO,eAAe,CAAC,oCAAoC,EAAE,GAAG,OAAO,IAAI,SAAS,EAAE,EAAE;QACtF,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,aAAa;QACrB,IAAI;QACJ,QAAQ,EAAE,KAAK;QACf,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,WAAmB,EACnB,MAAc;IAEd,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5D,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1D,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACrD,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAA;IAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAY,CAAA;IACxF,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAiC;IAC5D,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACvC,oBAAoB,CAAC,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IACnE,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAA;IAEjE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAClC,OAAO,CACL,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACpC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,YAAuC,EAAE,IAAY;IACvE,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAA;IAE9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;IACtD,MAAM,MAAM,GAAG,cAAc,CAAA;IAC7B,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9C,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,aAAa,CAAA;IAC9E,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,OAAO,aAAa,CAAA;AACtB,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,KAAa,EACb,OAMC;IAED,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,KAAK,EAAE;QAClB,WAAW,OAAO,CAAC,MAAM,EAAE;QAC3B,QAAQ,OAAO,CAAC,IAAI,EAAE;QACtB,YAAY,OAAO,CAAC,QAAQ,EAAE;KAC/B,CAAA;IAED,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAExC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAA;IAC1C,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAA;AAC/B,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,MAAc;IAC/C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACnD,MAAM,EACN,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAChC,CAAA;IACD,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;AACnD,CAAC"}
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/cloud-broker/state.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,eAAe,EACf,QAAQ,EACR,oBAAoB,EACpB,eAAe,GAChB,MAAM,YAAY,CAAA;AAEnB,MAAM,CAAC,MAAM,oCAAoC,GAAG,yBAAyB,CAAA;AAE7E,MAAM,yBAAyB,GAAG,GAAG,CAAA;AACrC,MAAM,YAAY,GAAG,EAAE,CAAA;AA2DvB,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,UAAU,EACV,IAAI,EACJ,MAAM,EACN,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,WAAW,EACX,WAAW,GACoB;IAC/B,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAE3B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,IAAI,yBAAyB,CAAA;IACtE,MAAM,KAAK,GAAwB;QACjC,KAAK,EAAE,WAAW,IAAI,WAAW,EAAE;QACnC,KAAK,EAAE,WAAW,IAAI,WAAW,EAAE;QACnC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACxC,WAAW,EAAE,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QAC9E,IAAI,EAAE,2BAA2B,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC;QAChE,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI;KAC7C,CAAA;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;IACjE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IAC/D,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAClD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAClD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,CAAA;IAC1E,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IAEhD,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACzB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/B,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;QACnC,KAAK;QACL,SAAS,EAAE,MAAM,8BAA8B,CAAC;YAC9C,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,YAAY;YAC3B,MAAM,EAAE,gBAAgB,CAAC,QAAQ,KAAK,QAAQ;YAC9C,IAAI,EAAE,mBAAmB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC9D,aAAa,EAAE,UAAU;SAC1B,CAAC;KACH,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,GAAG,GAAG,IAAI,IAAI,EAAE,GACkB;IAClC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAEhC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IAC/B,MAAM,WAAW,GAAG,mCAAmC,CACrD,GAAG,CAAC,QAAQ,KAAK,QAAQ,EACzB,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClC,CAAA;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa;YACpB,UAAU;YACV,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS;YACnE,WAAW;SACZ,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAA;IAC7D,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,EAAE,oCAAoC,CAAC,CAAA;IAClF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC9E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;IAC3D,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;IAC3D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAA+B,EAC/B,WAAmB;IAEnB,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAA;IAEtB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,GAAG,CAAA;QAC1C,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,MAAe,EAAE,IAAI,GAAG,aAAa;IACvF,OAAO,eAAe,CAAC,oCAAoC,EAAE,EAAE,EAAE;QAC/D,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,CAAC;QACT,IAAI;QACJ,QAAQ,EAAE,KAAK;QACf,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,EAC5C,KAAK,EACL,MAAM,EACN,MAAM,EACN,IAAI,EACJ,aAAa,GAOd;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAE7C,OAAO,eAAe,CAAC,oCAAoC,EAAE,GAAG,OAAO,IAAI,SAAS,EAAE,EAAE;QACtF,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,aAAa;QACrB,IAAI;QACJ,QAAQ,EAAE,KAAK;QACf,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,WAAmB,EACnB,MAAc;IAEd,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5D,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1D,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACrD,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAA;IAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAY,CAAA;IACxF,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAiC;IAC5D,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACvC,oBAAoB,CAAC,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IACnE,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAA;IAEjE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAClC,OAAO,CACL,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACpC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,YAAuC,EAAE,IAAY;IACvE,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAA;IAE9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;IACtD,MAAM,MAAM,GAAG,cAAc,CAAA;IAC7B,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9C,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,aAAa,CAAA;IAC9E,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,OAAO,aAAa,CAAA;AACtB,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,KAAa,EACb,OAMC;IAED,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,KAAK,EAAE;QAClB,WAAW,OAAO,CAAC,MAAM,EAAE;QAC3B,QAAQ,OAAO,CAAC,IAAI,EAAE;QACtB,YAAY,OAAO,CAAC,QAAQ,EAAE;KAC/B,CAAA;IAED,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAExC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAA;IAC1C,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAA;AAC/B,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,MAAc;IAC/C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACnD,MAAM,EACN,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAChC,CAAA;IACD,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;AACnD,CAAC","sourcesContent":["import {\n  base64UrlDecode,\n  base64UrlEncode,\n  isRecord,\n  normalizeAbsoluteUrl,\n  timingSafeEqual,\n} from \"./utils.js\"\n\nexport const VOYANT_CLOUD_ADMIN_AUTH_STATE_COOKIE = \"voyant-cloud-admin-auth\"\n\nconst DEFAULT_STATE_TTL_SECONDS = 300\nconst RANDOM_BYTES = 32\n\nexport type CloudAdminAuthStartConfig = {\n  cloudAuthStartUrl: string\n  deploymentId: string\n  adminCallbackUrl: string\n  cookieSecret: string\n  appId?: string | null\n  environment?: string | null\n  surface?: string | null\n  stateTtlSeconds?: number\n}\n\nexport type CloudAdminAuthState = {\n  state: string\n  nonce: string\n  deploymentId: string\n  redirectUri: string\n  next: string\n  expiresAt: number\n}\n\nexport type CreateCloudAdminAuthStartInput = {\n  requestUrl: string\n  next?: string | null\n  config: CloudAdminAuthStartConfig\n  now?: Date\n  randomState?: string\n  randomNonce?: string\n}\n\nexport type CreateCloudAdminAuthStartResult = {\n  redirectUrl: string\n  state: CloudAdminAuthState\n  setCookie: string\n}\n\nexport type VerifyCloudAdminAuthCallbackInput = {\n  requestUrl: string\n  cookieHeader?: string | null\n  cookieSecret: string\n  now?: Date\n}\n\nexport type VerifyCloudAdminAuthCallbackResult =\n  | {\n      ok: true\n      code: string\n      state: CloudAdminAuthState\n      clearCookie: string\n    }\n  | {\n      ok: false\n      error: \"cloud_error\" | \"invalid_request\" | \"invalid_state\" | \"expired_state\"\n      description?: string\n      cloudError?: string\n      clearCookie: string\n    }\n\nexport async function createCloudAdminAuthStart({\n  requestUrl,\n  next,\n  config,\n  now = new Date(),\n  randomState,\n  randomNonce,\n}: CreateCloudAdminAuthStartInput): Promise<CreateCloudAdminAuthStartResult> {\n  validateStartConfig(config)\n\n  const parsedRequestUrl = new URL(requestUrl)\n  const ttlSeconds = config.stateTtlSeconds ?? DEFAULT_STATE_TTL_SECONDS\n  const state: CloudAdminAuthState = {\n    state: randomState ?? randomToken(),\n    nonce: randomNonce ?? randomToken(),\n    deploymentId: config.deploymentId.trim(),\n    redirectUri: normalizeAbsoluteUrl(config.adminCallbackUrl, \"adminCallbackUrl\"),\n    next: normalizeCloudAdminAuthNext(next, parsedRequestUrl.origin),\n    expiresAt: now.getTime() + ttlSeconds * 1000,\n  }\n  const redirectUrl = new URL(config.cloudAuthStartUrl)\n  redirectUrl.searchParams.set(\"deployment_id\", state.deploymentId)\n  redirectUrl.searchParams.set(\"redirect_uri\", state.redirectUri)\n  redirectUrl.searchParams.set(\"state\", state.state)\n  redirectUrl.searchParams.set(\"nonce\", state.nonce)\n  redirectUrl.searchParams.set(\"surface\", config.surface?.trim() || \"admin\")\n  redirectUrl.searchParams.set(\"next\", state.next)\n\n  if (config.appId?.trim()) {\n    redirectUrl.searchParams.set(\"app_id\", config.appId.trim())\n  }\n  if (config.environment?.trim()) {\n    redirectUrl.searchParams.set(\"environment\", config.environment.trim())\n  }\n\n  return {\n    redirectUrl: redirectUrl.toString(),\n    state,\n    setCookie: await buildCloudAdminAuthStateCookie({\n      state,\n      secret: config.cookieSecret,\n      secure: parsedRequestUrl.protocol === \"https:\",\n      path: cloudAuthCookiePath(new URL(state.redirectUri).pathname),\n      maxAgeSeconds: ttlSeconds,\n    }),\n  }\n}\n\nexport async function verifyCloudAdminAuthCallback({\n  requestUrl,\n  cookieHeader,\n  cookieSecret,\n  now = new Date(),\n}: VerifyCloudAdminAuthCallbackInput): Promise<VerifyCloudAdminAuthCallbackResult> {\n  assertUsableSecret(cookieSecret)\n\n  const url = new URL(requestUrl)\n  const clearCookie = buildClearCloudAdminAuthStateCookie(\n    url.protocol === \"https:\",\n    cloudAuthCookiePath(url.pathname),\n  )\n  const cloudError = url.searchParams.get(\"error\")\n  if (cloudError) {\n    return {\n      ok: false,\n      error: \"cloud_error\",\n      cloudError,\n      description: url.searchParams.get(\"error_description\") ?? undefined,\n      clearCookie,\n    }\n  }\n\n  const stateParam = url.searchParams.get(\"state\")\n  const code = url.searchParams.get(\"code\")\n  if (!stateParam || !code) {\n    return { ok: false, error: \"invalid_request\", clearCookie }\n  }\n\n  const stateCookie = readCookie(cookieHeader, VOYANT_CLOUD_ADMIN_AUTH_STATE_COOKIE)\n  if (!stateCookie) {\n    return { ok: false, error: \"invalid_state\", clearCookie }\n  }\n\n  const state = await verifyCloudAdminAuthStateCookie(stateCookie, cookieSecret)\n  if (!state || state.state !== stateParam) {\n    return { ok: false, error: \"invalid_state\", clearCookie }\n  }\n\n  if (state.expiresAt <= now.getTime()) {\n    return { ok: false, error: \"expired_state\", clearCookie }\n  }\n\n  return { ok: true, code, state, clearCookie }\n}\n\nexport function normalizeCloudAdminAuthNext(\n  next: string | null | undefined,\n  adminOrigin: string,\n): string {\n  const value = next?.trim()\n  if (!value) return \"/\"\n\n  if (value.startsWith(\"/\") && !value.startsWith(\"//\")) {\n    return value\n  }\n\n  try {\n    const url = new URL(value)\n    if (url.origin !== adminOrigin) return \"/\"\n    return `${url.pathname}${url.search}${url.hash}` || \"/\"\n  } catch {\n    return \"/\"\n  }\n}\n\nexport function buildClearCloudAdminAuthStateCookie(secure: boolean, path = \"/auth/cloud\"): string {\n  return serializeCookie(VOYANT_CLOUD_ADMIN_AUTH_STATE_COOKIE, \"\", {\n    httpOnly: true,\n    maxAge: 0,\n    path,\n    sameSite: \"Lax\",\n    secure,\n  })\n}\n\nasync function buildCloudAdminAuthStateCookie({\n  state,\n  secret,\n  secure,\n  path,\n  maxAgeSeconds,\n}: {\n  state: CloudAdminAuthState\n  secret: string\n  secure: boolean\n  path: string\n  maxAgeSeconds: number\n}): Promise<string> {\n  const payload = base64UrlEncode(new TextEncoder().encode(JSON.stringify(state)))\n  const signature = await hmac(payload, secret)\n\n  return serializeCookie(VOYANT_CLOUD_ADMIN_AUTH_STATE_COOKIE, `${payload}.${signature}`, {\n    httpOnly: true,\n    maxAge: maxAgeSeconds,\n    path,\n    sameSite: \"Lax\",\n    secure,\n  })\n}\n\nasync function verifyCloudAdminAuthStateCookie(\n  cookieValue: string,\n  secret: string,\n): Promise<CloudAdminAuthState | null> {\n  const [payload, signature, ...rest] = cookieValue.split(\".\")\n  if (!payload || !signature || rest.length > 0) return null\n\n  const expectedSignature = await hmac(payload, secret)\n  if (!timingSafeEqual(signature, expectedSignature)) return null\n\n  const parsed = JSON.parse(new TextDecoder().decode(base64UrlDecode(payload))) as unknown\n  if (!isCloudAdminAuthState(parsed)) return null\n  return parsed\n}\n\nfunction validateStartConfig(config: CloudAdminAuthStartConfig): void {\n  assertUsableSecret(config.cookieSecret)\n  normalizeAbsoluteUrl(config.cloudAuthStartUrl, \"cloudAuthStartUrl\")\n  normalizeAbsoluteUrl(config.adminCallbackUrl, \"adminCallbackUrl\")\n\n  if (!config.deploymentId.trim()) {\n    throw new Error(\"Voyant Cloud auth requires deploymentId\")\n  }\n}\n\nfunction assertUsableSecret(secret: string): void {\n  if (!secret || secret.length < 32) {\n    throw new Error(\"Voyant Cloud auth requires a cookie secret with at least 32 characters\")\n  }\n}\n\nfunction isCloudAdminAuthState(value: unknown): value is CloudAdminAuthState {\n  if (!isRecord(value)) return false\n  return (\n    typeof value.state === \"string\" &&\n    typeof value.nonce === \"string\" &&\n    typeof value.deploymentId === \"string\" &&\n    typeof value.redirectUri === \"string\" &&\n    typeof value.next === \"string\" &&\n    typeof value.expiresAt === \"number\"\n  )\n}\n\nfunction readCookie(cookieHeader: string | null | undefined, name: string): string | null {\n  if (!cookieHeader) return null\n\n  for (const part of cookieHeader.split(\";\")) {\n    const [rawName, ...rawValue] = part.trim().split(\"=\")\n    if (rawName === name) return rawValue.join(\"=\")\n  }\n\n  return null\n}\n\nfunction cloudAuthCookiePath(pathname: string): string {\n  const normalized = pathname.replace(/\\/+$/, \"\") || \"/\"\n  const marker = \"/auth/cloud/\"\n  const markerIndex = normalized.indexOf(marker)\n  if (markerIndex >= 0) {\n    return normalized.slice(0, markerIndex + marker.length - 1) || \"/auth/cloud\"\n  }\n\n  if (normalized.endsWith(\"/auth/cloud\")) {\n    return normalized\n  }\n\n  return \"/auth/cloud\"\n}\n\nfunction serializeCookie(\n  name: string,\n  value: string,\n  options: {\n    httpOnly: boolean\n    maxAge: number\n    path: string\n    sameSite: \"Lax\" | \"Strict\" | \"None\"\n    secure: boolean\n  },\n): string {\n  const parts = [\n    `${name}=${value}`,\n    `Max-Age=${options.maxAge}`,\n    `Path=${options.path}`,\n    `SameSite=${options.sameSite}`,\n  ]\n\n  if (options.httpOnly) parts.push(\"HttpOnly\")\n  if (options.secure) parts.push(\"Secure\")\n\n  return parts.join(\"; \")\n}\n\nfunction randomToken(): string {\n  const bytes = new Uint8Array(RANDOM_BYTES)\n  globalThis.crypto.getRandomValues(bytes)\n  return base64UrlEncode(bytes)\n}\n\nasync function hmac(value: string, secret: string): Promise<string> {\n  const key = await globalThis.crypto.subtle.importKey(\n    \"raw\",\n    new TextEncoder().encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  )\n  const signature = await globalThis.crypto.subtle.sign(\n    \"HMAC\",\n    key,\n    new TextEncoder().encode(value),\n  )\n  return base64UrlEncode(new Uint8Array(signature))\n}\n"]}

package/dist/cloud-broker/utils.d.ts

@@ -4,4 +4,3 @@ export declare function base64UrlEncode(bytes: Uint8Array): string;
 export declare function base64UrlDecode(value: string): Uint8Array;
 export declare function toArrayBuffer(bytes: Uint8Array): ArrayBuffer;
 export declare function timingSafeEqual(left: string, right: string): boolean;
-//# sourceMappingURL=utils.d.ts.map

package/dist/cloud-broker/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/cloud-broker/utils.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,KAAa;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,mCAAmC,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAExD,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,IAAI,SAAS,CAAC,CAAC,CAAE,GAAG,UAAU,CAAC,CAAC,CAAE,CAAA;IACxC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/cloud-broker/utils.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,KAAa;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,mCAAmC,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAExD,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,IAAI,SAAS,CAAC,CAAC,CAAE,GAAG,UAAU,CAAC,CAAC,CAAE,CAAA;IACxC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC","sourcesContent":["export function normalizeAbsoluteUrl(value: string, label: string): string {\n  const trimmed = value.trim()\n  if (!trimmed) {\n    throw new Error(`Voyant Cloud auth requires ${label}`)\n  }\n\n  const url = new URL(trimmed)\n  if (url.protocol !== \"https:\" && url.hostname !== \"localhost\" && url.hostname !== \"127.0.0.1\") {\n    throw new Error(`Voyant Cloud auth ${label} must use HTTPS outside localhost`)\n  }\n  return url.toString()\n}\n\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nexport function base64UrlEncode(bytes: Uint8Array): string {\n  let binary = \"\"\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte)\n  }\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\")\n}\n\nexport function base64UrlDecode(value: string): Uint8Array {\n  const padded = value\n    .replace(/-/g, \"+\")\n    .replace(/_/g, \"/\")\n    .padEnd(Math.ceil(value.length / 4) * 4, \"=\")\n  const binary = atob(padded)\n  const bytes = new Uint8Array(binary.length)\n  for (let i = 0; i < binary.length; i += 1) {\n    bytes[i] = binary.charCodeAt(i)\n  }\n  return bytes\n}\n\nexport function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {\n  const buffer = new ArrayBuffer(bytes.byteLength)\n  new Uint8Array(buffer).set(bytes)\n  return buffer\n}\n\nexport function timingSafeEqual(left: string, right: string): boolean {\n  const leftBytes = new TextEncoder().encode(left)\n  const rightBytes = new TextEncoder().encode(right)\n  if (leftBytes.length !== rightBytes.length) return false\n\n  let diff = 0\n  for (let i = 0; i < leftBytes.length; i += 1) {\n    diff |= leftBytes[i]! ^ rightBytes[i]!\n  }\n  return diff === 0\n}\n"]}