aicodeman 1.4.0 → 1.5.0

package/dist/user-store.js

@@ -0,0 +1,433 @@
+/**
+ * @fileoverview Multi-user store: `~/.codeman/users.json` (via `dataPath`, 0600).
+ *
+ * Mirrors the storage-module pattern of `remote-hosts.ts` / `docker-hosts.ts`, but
+ * because it holds password hashes it writes atomically (tmp + rename) at mode
+ * 0600 and keeps only a SHORT in-process cache so the CLI (`codeman users …`) can
+ * edit the file while the server runs and have changes picked up within the TTL.
+ *
+ * Pure, IO-free helpers (`isValidUsername`, `hashPassword`, `verifyPasswordHash`,
+ * `needsRehash`, `resolveClaudeModeForUser`, the last-admin invariants) are split
+ * out so they are unit-testable without a server. Hashing is `scrypt` from
+ * `node:crypto` (no new deps), compared via `timingSafeEqual`; parameters are
+ * stored per record so cost can be raised later and old records rehashed on their
+ * next successful login.
+ *
+ * See `docs/multi-user-plan.md` sections 4.1, 5, 6.3.
+ */
+import { existsSync, mkdirSync } from 'node:fs';
+import fs from 'node:fs/promises';
+import { isAbsolute, join, relative } from 'node:path';
+import { randomBytes, scrypt as scryptCb, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+import { dataPath, getDataDir } from './config/instance.js';
+import { getUserSpacesDir, isMultiUserMode, maxUsers } from './config/multiuser.js';
+const scrypt = promisify(scryptCb);
+const USERS_FILE = 'users.json';
+const CACHE_TTL_MS = 1000;
+const KEYLEN = 64;
+const SALT_BYTES = 32;
+/** Generous ceiling so raising N/r later does not trip scrypt's memory guard. */
+const SCRYPT_MAXMEM = 256 * 1024 * 1024;
+/** Current hashing parameters. Stored per record; raise these to increase cost. */
+export const DEFAULT_SCRYPT_PARAMS = { N: 16384, r: 8, p: 1 };
+/** Username: lowercase, first char alphanumeric, 2-32 chars total. Becomes a folder name. */
+const USERNAME_RE = /^[a-z0-9][a-z0-9_-]{1,31}$/;
+/** Typed error whose `.code` maps to an API errorCode at the route layer. */
+export class UserStoreError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'UserStoreError';
+    }
+}
+// ─────────────────────────────── pure helpers ───────────────────────────────
+export function normalizeUsername(name) {
+    return String(name ?? '')
+        .trim()
+        .toLowerCase();
+}
+export function isValidUsername(name) {
+    return USERNAME_RE.test(normalizeUsername(name));
+}
+/** Hash a password with the given (or current) scrypt params + a fresh random salt. */
+export async function hashPassword(password, params = DEFAULT_SCRYPT_PARAMS) {
+    const salt = randomBytes(SALT_BYTES);
+    const derived = await scrypt(password, salt, KEYLEN, { ...params, maxmem: SCRYPT_MAXMEM });
+    return {
+        algo: 'scrypt',
+        N: params.N,
+        r: params.r,
+        p: params.p,
+        salt: salt.toString('hex'),
+        hash: derived.toString('hex'),
+    };
+}
+/** Constant-time verify of a password against a stored hash record. Never throws. */
+export async function verifyPasswordHash(password, record) {
+    if (!record || record.algo !== 'scrypt')
+        return false;
+    let salt;
+    let expected;
+    try {
+        salt = Buffer.from(record.salt, 'hex');
+        expected = Buffer.from(record.hash, 'hex');
+    }
+    catch {
+        return false;
+    }
+    if (expected.length === 0)
+        return false;
+    let derived;
+    try {
+        derived = await scrypt(password, salt, expected.length, {
+            N: record.N,
+            r: record.r,
+            p: record.p,
+            maxmem: SCRYPT_MAXMEM,
+        });
+    }
+    catch {
+        return false;
+    }
+    if (derived.length !== expected.length)
+        return false;
+    return timingSafeEqual(derived, expected);
+}
+/** True when a stored hash uses weaker params than current and should be rehashed. */
+export function needsRehash(record, params = DEFAULT_SCRYPT_PARAMS) {
+    return record.algo !== 'scrypt' || record.N !== params.N || record.r !== params.r || record.p !== params.p;
+}
+/** URL-safe one-time password (16 chars) for admin create/reset flows. */
+export function generateOneTimePassword() {
+    return randomBytes(12).toString('base64url');
+}
+export function toPublicUser(u) {
+    return {
+        username: u.username,
+        role: u.role,
+        disabled: !!u.disabled,
+        mustChangePassword: !!u.mustChangePassword,
+        canBypassPermissions: !!u.canBypassPermissions,
+        createdAt: u.createdAt,
+        lastLoginAt: u.lastLoginAt,
+    };
+}
+export function countEnabledAdmins(users) {
+    return users.filter((u) => u.role === 'admin' && !u.disabled).length;
+}
+/**
+ * Section 6.3: resolve the effective Claude permission mode for a user. Admins and
+ * granted users get the global mode as-is; a non-granted regular user whose mode
+ * would be `dangerously-skip-permissions` is silently downgraded to `auto` (all
+ * other modes are already <= auto and pass through). Pure.
+ */
+export function resolveClaudeModeForUser(globalMode, grant) {
+    const mode = globalMode ?? 'dangerously-skip-permissions';
+    if (grant.role === 'admin' || grant.canBypassPermissions)
+        return mode;
+    return mode === 'dangerously-skip-permissions' ? 'auto' : mode;
+}
+/**
+ * Section 6.3: whether a user may run arbitrary commands as the host account
+ * (shell-mode sessions, cron `launchCommand`, other CLIs' bypass flags). Same
+ * one-bit grant as bypass. Admins always may.
+ */
+export function canRunPrivilegedCommands(grant) {
+    return grant.role === 'admin' || !!grant.canBypassPermissions;
+}
+// ─────────────────────────────── IO layer ───────────────────────────────
+let cache = null;
+/** Drop the in-process cache (called after every write; exported for tests). */
+export function invalidateUsersCache() {
+    cache = null;
+}
+export async function readUsers(force = false) {
+    const now = Date.now();
+    if (!force && cache && now - cache.ts < CACHE_TTL_MS)
+        return cache.users;
+    let raw;
+    try {
+        raw = await fs.readFile(dataPath(USERS_FILE), 'utf-8');
+    }
+    catch (err) {
+        // ENOENT is the ONLY legitimately-empty store (first boot). Any other read
+        // error (EIO/EACCES/EMFILE/EBUSY) is a transient/permission failure, NOT an
+        // empty store — do NOT cache [] and do NOT let it look empty, or a following
+        // createUser/bootstrap would overwrite users.json and destroy every account.
+        if (err.code === 'ENOENT') {
+            cache = { users: [], ts: now };
+            return [];
+        }
+        throw err;
+    }
+    // A present-but-corrupt file (invalid JSON) must also fail loud rather than
+    // read as empty, so mutators/bootstrap abort instead of clobbering it.
+    const parsed = JSON.parse(raw);
+    const users = Array.isArray(parsed.users) ? parsed.users : [];
+    cache = { users, ts: now };
+    return users;
+}
+async function writeUsers(users) {
+    const dir = getDataDir();
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    const finalPath = dataPath(USERS_FILE);
+    // Unique per-writer tmp name (pid + random) so the CLI (`codeman users …`) and
+    // the live server — designed to write this file concurrently across processes —
+    // never share a single `users.json.tmp` inode and tear each other's payload.
+    // Matches the state-store.ts / self-update.ts convention.
+    const tmpPath = `${finalPath}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
+    const payload = { version: 1, users };
+    try {
+        await fs.writeFile(tmpPath, JSON.stringify(payload, null, 2), { mode: 0o600 });
+        await fs.chmod(tmpPath, 0o600).catch(() => { });
+        await fs.rename(tmpPath, finalPath);
+    }
+    catch (err) {
+        await fs.unlink(tmpPath).catch(() => { });
+        throw err;
+    }
+    cache = { users, ts: Date.now() };
+}
+/**
+ * Serialize every read-modify-write on users.json. Without this a fire-and-forget
+ * touchLastLogin (fired on each Basic auth) can interleave with a route's
+ * create/update and clobber records, since both do readUsers(true) → mutate →
+ * writeUsers against a single shared file + tmp path.
+ */
+let mutateChain = Promise.resolve();
+function withUsersLock(fn) {
+    const run = mutateChain.then(fn, fn);
+    mutateChain = run.then(() => undefined, () => undefined);
+    return run;
+}
+export async function hasUsers() {
+    return (await readUsers()).length > 0;
+}
+// A precomputed dummy hash so an unknown/disabled user costs the same scrypt work
+// as a real verify (defeats username-enumeration by timing). Created once, lazily.
+let dummyHashPromise = null;
+function getDummyHash() {
+    if (!dummyHashPromise)
+        dummyHashPromise = hashPassword('codeman-timing-equalization-placeholder');
+    return dummyHashPromise;
+}
+/**
+ * Verify a username/password against the store. Returns the record (plus whether it
+ * should be rehashed) on success, or null for wrong password / unknown / disabled
+ * user. Runs a dummy scrypt on the miss path so timing does not reveal which users
+ * exist. Never writes (the caller decides when to persist lastLogin / rehash).
+ */
+export async function verifyPassword(username, password) {
+    const user = await findUser(username);
+    if (!user || user.disabled) {
+        await verifyPasswordHash(password, await getDummyHash());
+        return null;
+    }
+    const ok = await verifyPasswordHash(password, user.password);
+    if (!ok)
+        return null;
+    return { user, needsRehash: needsRehash(user.password) };
+}
+export async function findUser(username) {
+    const norm = normalizeUsername(username);
+    if (!norm)
+        return undefined;
+    const users = await readUsers();
+    return users.find((u) => u.username === norm);
+}
+export async function createUser(opts) {
+    const username = normalizeUsername(opts.username);
+    if (!isValidUsername(username)) {
+        throw new UserStoreError('Username must be lowercase, start alphanumeric, 2-32 chars ([a-z0-9_-])', 'INVALID_INPUT');
+    }
+    if (opts.role !== 'admin' && opts.role !== 'user') {
+        throw new UserStoreError('Role must be "admin" or "user"', 'INVALID_INPUT');
+    }
+    if (!opts.password || opts.password.length < 8) {
+        throw new UserStoreError('Password must be at least 8 characters', 'INVALID_INPUT');
+    }
+    return withUsersLock(async () => {
+        const users = await readUsers(true);
+        if (users.some((u) => u.username === username)) {
+            throw new UserStoreError(`User "${username}" already exists`, 'USER_EXISTS');
+        }
+        if (users.length >= maxUsers()) {
+            throw new UserStoreError(`Maximum number of users (${maxUsers()}) reached`, 'INVALID_INPUT');
+        }
+        const record = {
+            username,
+            role: opts.role,
+            password: await hashPassword(opts.password),
+            disabled: false,
+            mustChangePassword: !!opts.mustChangePassword,
+            canBypassPermissions: !!opts.canBypassPermissions,
+            createdAt: Date.now(),
+        };
+        users.push(record);
+        await writeUsers(users);
+        return record;
+    });
+}
+/** Set a user's password. `mustChangePassword` is left unchanged unless specified. */
+export async function setPassword(username, password, opts = {}) {
+    if (!password || password.length < 8) {
+        throw new UserStoreError('Password must be at least 8 characters', 'INVALID_INPUT');
+    }
+    const norm = normalizeUsername(username);
+    return withUsersLock(async () => {
+        const users = await readUsers(true);
+        const record = users.find((u) => u.username === norm);
+        if (!record)
+            throw new UserStoreError(`User "${norm}" not found`, 'USER_NOT_FOUND');
+        record.password = await hashPassword(password);
+        if (opts.mustChangePassword !== undefined)
+            record.mustChangePassword = opts.mustChangePassword;
+        await writeUsers(users);
+        return record;
+    });
+}
+export async function updateUser(username, patch) {
+    const norm = normalizeUsername(username);
+    return withUsersLock(async () => {
+        const users = await readUsers(true);
+        const record = users.find((u) => u.username === norm);
+        if (!record)
+            throw new UserStoreError(`User "${norm}" not found`, 'USER_NOT_FOUND');
+        // Guard the last-enabled-admin invariant against demote/disable.
+        const before = countEnabledAdmins(users);
+        const projected = {
+            ...record,
+            role: patch.role ?? record.role,
+            disabled: patch.disabled ?? record.disabled,
+        };
+        const after = countEnabledAdmins(users.map((u) => (u.username === norm ? projected : u)));
+        if (before > 0 && after === 0) {
+            throw new UserStoreError('Cannot demote or disable the last enabled admin', 'LAST_ADMIN');
+        }
+        if (patch.role !== undefined)
+            record.role = patch.role;
+        if (patch.disabled !== undefined)
+            record.disabled = patch.disabled;
+        if (patch.canBypassPermissions !== undefined)
+            record.canBypassPermissions = patch.canBypassPermissions;
+        if (patch.mustChangePassword !== undefined)
+            record.mustChangePassword = patch.mustChangePassword;
+        await writeUsers(users);
+        return record;
+    });
+}
+/**
+ * Record a successful login timestamp. Best-effort + throttled: skips the write if
+ * the last login was within the last minute (Basic clients re-send credentials on
+ * every request, so this fires often — the throttle keeps disk churn bounded).
+ */
+export async function touchLastLogin(username) {
+    const norm = normalizeUsername(username);
+    try {
+        await withUsersLock(async () => {
+            const users = await readUsers(true);
+            const record = users.find((u) => u.username === norm);
+            if (!record)
+                return;
+            if (record.lastLoginAt && Date.now() - record.lastLoginAt < 60_000)
+                return;
+            record.lastLoginAt = Date.now();
+            await writeUsers(users);
+        });
+    }
+    catch {
+        /* best-effort */
+    }
+}
+export async function deleteUser(username) {
+    const norm = normalizeUsername(username);
+    await withUsersLock(async () => {
+        const users = await readUsers(true);
+        const record = users.find((u) => u.username === norm);
+        if (!record)
+            throw new UserStoreError(`User "${norm}" not found`, 'USER_NOT_FOUND');
+        const before = countEnabledAdmins(users);
+        const remaining = users.filter((u) => u.username !== norm);
+        const after = countEnabledAdmins(remaining);
+        if (before > 0 && after === 0) {
+            throw new UserStoreError('Cannot delete the last enabled admin', 'LAST_ADMIN');
+        }
+        await writeUsers(remaining);
+    });
+}
+/**
+ * First-boot bootstrap: in multi-user mode with no users yet, create the initial
+ * admin from `CODEMAN_USERNAME`/`CODEMAN_PASSWORD` if both are set. Returns a
+ * status the caller (server start / CLI) uses to decide whether to refuse boot.
+ */
+export async function bootstrapInitialAdmin() {
+    if (await hasUsers())
+        return { status: 'exists' };
+    const username = process.env.CODEMAN_USERNAME;
+    const password = process.env.CODEMAN_PASSWORD;
+    if (!username || !password)
+        return { status: 'missing-env' };
+    const created = await createUser({ username, role: 'admin', password });
+    return { status: 'created', username: created.username };
+}
+/**
+ * Delete a user's on-disk space (`<USER_SPACES_DIR>/<username>`) with the section 8
+ * guard rails: the top-level dir must not be a symlink, and its realpath must
+ * resolve strictly inside USER_SPACES_DIR (so a symlinked or `..`-escaping target
+ * can never be used to rm an arbitrary tree). No-op if the space does not exist.
+ */
+export async function deleteUserSpace(username) {
+    const norm = normalizeUsername(username);
+    if (!isValidUsername(norm))
+        throw new UserStoreError('Invalid username', 'INVALID_INPUT');
+    const root = getUserSpacesDir();
+    const target = join(root, norm);
+    let lst;
+    try {
+        lst = await fs.lstat(target);
+    }
+    catch {
+        return; // nothing to delete
+    }
+    if (lst.isSymbolicLink()) {
+        throw new UserStoreError('Refusing to delete a symlinked user space', 'INVALID_INPUT');
+    }
+    const realRoot = await fs.realpath(root).catch(() => root);
+    const realTarget = await fs.realpath(target);
+    const rel = relative(realRoot, realTarget);
+    if (rel === '' || rel.startsWith('..') || isAbsolute(rel)) {
+        throw new UserStoreError('User space escapes USER_SPACES_DIR', 'INVALID_INPUT');
+    }
+    await fs.rm(realTarget, { recursive: true, force: true });
+}
+/** The synthetic admin used in single-user mode so downstream has one code path. */
+export const SYNTHETIC_ADMIN = { username: 'admin', role: 'admin' };
+/**
+ * Whether a username may run arbitrary commands (shell mode, cron launchCommand,
+ * other CLIs' bypass). Single-user or an unset owner: allowed. In multi-user a
+ * MISSING user (e.g. deleted) fails closed (non-privileged). Used at cron fire time.
+ */
+export async function canUsernameRunPrivilegedCommands(username) {
+    if (!isMultiUserMode() || !username)
+        return true;
+    const user = await findUser(username);
+    return canRunPrivilegedCommands(user ?? { role: 'user' });
+}
+/**
+ * Resolve the effective Claude mode for a username by looking up the grant. In
+ * single-user mode (or for an unknown owner) the global mode passes through.
+ */
+export async function resolveClaudeModeForUsername(globalMode, username) {
+    const fallback = globalMode ?? 'dangerously-skip-permissions';
+    if (!isMultiUserMode() || !username)
+        return fallback;
+    // Fail closed: an unknown/deleted owner in multi-user mode is treated as a
+    // non-granted regular user so a stale-owned spawn (e.g. an orphaned cron job)
+    // is downgraded to `auto` rather than inheriting the global bypass.
+    const user = await findUser(username);
+    return resolveClaudeModeForUser(globalMode, user ?? { role: 'user' });
+}
+//# sourceMappingURL=user-store.js.map

package/dist/user-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-store.js","sourceRoot":"","sources":["../src/user-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGpF,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAKb,CAAC;AAErB,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,iFAAiF;AACjF,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAW,CAAC;AAEvE,6FAA6F;AAC7F,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD,6EAA6E;AAC7E,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGrB;IAFlB,YACE,OAAe,EACC,IAAuE;QAEvF,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAmE;QAGvF,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;SACtB,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,SAA8C,qBAAqB;IAEnE,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3F,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,MAAoB;IAC7E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,IAAY,CAAC;IACjB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE;YACtD,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,MAAoB,EAAE,MAAM,GAAG,qBAAqB;IAC9E,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB;IACrC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAa;IACxC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ;QACtB,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB;QAC1C,oBAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB;QAC9C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAmB;IACpD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkC,EAClC,KAAyD;IAEzD,MAAM,IAAI,GAAe,UAAU,IAAI,8BAA8B,CAAC;IACtE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,IAAI,KAAK,8BAA8B,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAyD;IAChG,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;AAChE,CAAC;AAED,2EAA2E;AAE3E,IAAI,KAAK,GAA+C,IAAI,CAAC;AAE7D,gFAAgF;AAChF,MAAM,UAAU,oBAAoB;IAClC,KAAK,GAAG,IAAI,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAK,GAAG,KAAK;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,YAAY;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IACzE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,KAAK,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAmB;IAC3C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvC,+EAA+E;IAC/E,gFAAgF;IAChF,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACpF,MAAM,OAAO,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,KAAK,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,IAAI,WAAW,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;AACtD,SAAS,aAAa,CAAI,EAAoB;IAC5C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACrC,WAAW,GAAG,GAAG,CAAC,IAAI,CACpB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,OAAO,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,kFAAkF;AAClF,mFAAmF;AACnF,IAAI,gBAAgB,GAAiC,IAAI,CAAC;AAC1D,SAAS,YAAY;IACnB,IAAI,CAAC,gBAAgB;QAAE,gBAAgB,GAAG,YAAY,CAAC,yCAAyC,CAAC,CAAC;IAClG,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,kBAAkB,CAAC,QAAQ,EAAE,MAAM,YAAY,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;AAChD,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAuB;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,cAAc,CACtB,yEAAyE,EACzE,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,cAAc,CAAC,gCAAgC,EAAE,eAAe,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,cAAc,CAAC,wCAAwC,EAAE,eAAe,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,cAAc,CAAC,SAAS,QAAQ,kBAAkB,EAAE,aAAa,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,cAAc,CAAC,4BAA4B,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAe;YACzB,QAAQ;YACR,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC3C,QAAQ,EAAE,KAAK;YACf,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB;YAC7C,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB;YACjD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,QAAgB,EAChB,OAAyC,EAAE;IAE3C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,cAAc,CAAC,wCAAwC,EAAE,eAAe,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,IAAI,aAAa,EAAE,gBAAgB,CAAC,CAAC;QACpF,MAAM,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAAE,MAAM,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAC/F,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,KAAsB;IACvE,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,IAAI,aAAa,EAAE,gBAAgB,CAAC,CAAC;QAEpF,iEAAiE;QACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,SAAS,GAAe;YAC5B,GAAG,MAAM;YACT,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI;YAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;SAC5C,CAAC;QACF,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,MAAM,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,cAAc,CAAC,iDAAiD,EAAE,YAAY,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACvD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACnE,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS;YAAE,MAAM,CAAC,oBAAoB,GAAG,KAAK,CAAC,oBAAoB,CAAC;QACvG,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS;YAAE,MAAM,CAAC,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAC;QACjG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,GAAG,MAAM;gBAAE,OAAO;YAC3E,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,aAAa,CAAC,KAAK,IAAI,EAAE;QAC7B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,IAAI,aAAa,EAAE,gBAAgB,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,MAAM,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,cAAc,CAAC,sCAAsC,EAAE,YAAY,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IAIzC,IAAI,MAAM,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,oBAAoB;IAC9B,CAAC;IACD,IAAI,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,cAAc,CAAC,2CAA2C,EAAE,eAAe,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,cAAc,CAAC,oCAAoC,EAAE,eAAe,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,QAA4B;IACjF,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,wBAAwB,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,UAAkC,EAClC,QAA4B;IAE5B,MAAM,QAAQ,GAAe,UAAU,IAAI,8BAA8B,CAAC;IAC1E,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACrD,2EAA2E;IAC3E,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,wBAAwB,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC"}

package/dist/web/admin-audit.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @fileoverview Append-only admin audit log (~/.codeman/admin-audit.jsonl).
+ *
+ * Every user-management action (create/patch/reset/delete/logout/assign) writes one
+ * JSON line: timestamp, acting admin, action, target, request IP. Same idiom as
+ * session-lifecycle.jsonl. Best-effort: a write failure never blocks the action.
+ */
+export interface AdminAuditEntry {
+    ts: number;
+    admin: string;
+    action: string;
+    target?: string;
+    ip?: string;
+    detail?: Record<string, unknown>;
+}
+export declare function appendAdminAudit(entry: Omit<AdminAuditEntry, 'ts'>): Promise<void>;
+//# sourceMappingURL=admin-audit.d.ts.map

package/dist/web/admin-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-audit.d.ts","sourceRoot":"","sources":["../../src/web/admin-audit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOxF"}

package/dist/web/admin-audit.js

@@ -0,0 +1,19 @@
+/**
+ * @fileoverview Append-only admin audit log (~/.codeman/admin-audit.jsonl).
+ *
+ * Every user-management action (create/patch/reset/delete/logout/assign) writes one
+ * JSON line: timestamp, acting admin, action, target, request IP. Same idiom as
+ * session-lifecycle.jsonl. Best-effort: a write failure never blocks the action.
+ */
+import fs from 'node:fs/promises';
+import { dataPath } from '../config/instance.js';
+export async function appendAdminAudit(entry) {
+    try {
+        const line = JSON.stringify({ ts: Date.now(), ...entry }) + '\n';
+        await fs.appendFile(dataPath('admin-audit.jsonl'), line, { mode: 0o600 });
+    }
+    catch {
+        /* best-effort audit; never block the action */
+    }
+}
+//# sourceMappingURL=admin-audit.js.map

package/dist/web/admin-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-audit.js","sourceRoot":"","sources":["../../src/web/admin-audit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAWjD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAkC;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QACjE,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC"}

package/dist/web/middleware/auth.d.ts

@@ -11,6 +11,12 @@ import type { FastifyInstance } from 'fastify';
 import { StaleExpirationMap } from '../../utils/index.js';
 import type { AuthSessionRecord } from '../ports/auth-port.js';
 import { type HostPolicy } from '../network-auth-policy.js';
+import { type AuthUser } from '../../types.js';
+declare module 'fastify' {
+    interface FastifyRequest {
+        authUser?: AuthUser;
+    }
+}
 export declare const AUTH_COOKIE_NAME = "codeman_session";
 /** State returned from registerAuthMiddleware for cleanup in server stop() */
 interface AuthState {
@@ -18,6 +24,8 @@ interface AuthState {
     authFailures: StaleExpirationMap<string, number> | null;
     qrAuthFailures: StaleExpirationMap<string, number> | null;
     hookSecretFailures: StaleExpirationMap<string, number> | null;
+    /** Per-username Basic-auth failure bucket (multi-user only). */
+    userFailures: StaleExpirationMap<string, number> | null;
 }
 /**
  * Register HTTP Basic Auth middleware with session cookies and rate limiting.

package/dist/web/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/web/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAE7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAU1G,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAElD,8EAA8E;AAC9E,UAAU,SAAS;IACjB,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,IAAI,CAAC;IACnE,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACxD,cAAc,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1D,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,CAiLtF;AAKD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,GAAG,IAAI,CAazF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAqDlF"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/web/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAU1G,OAAO,EAAqC,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAIlF,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,QAAQ,CAAC,EAAE,QAAQ,CAAC;KACrB;CACF;AAGD,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAElD,8EAA8E;AAC9E,UAAU,SAAS;IACjB,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,IAAI,CAAC;IACnE,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACxD,cAAc,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1D,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC9D,gEAAgE;IAChE,YAAY,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CACzD;AA6ED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,CAuJtF;AAmKD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,GAAG,IAAI,CAazF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAqDlF"}