aimeat 2.1.0 → 2.3.0

package/dist/src/auth/jwt.d.ts

@@ -16,6 +16,7 @@ export interface JWTPayload {
     homeUrl?: string;
     eco_app?: string;
     app_grant?: string;
+    app?: string;
 }
 /** Generate a unique session ID for JWT tracking. */
 export declare function generateSessionId(): string;
@@ -35,6 +36,7 @@ export interface VerifiedToken {
     homeUrl?: string;
     eco_app?: string;
     app_grant?: string;
+    app?: string;
 }
 export declare function verifyJWT(token: string): Promise<VerifiedToken | null>;
 /**

package/dist/src/auth/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/jwt.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAQvD,wBAAgB,iBAAiB,IAAI;IAAE,UAAU,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAGnF;AAED,wBAAsB,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnG;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B3G;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAyB5E;AAkBD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmB5D;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAejF;AAOD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAA0B;AAEzG;;;GAGG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiB/D"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/jwt.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AASvD,wBAAgB,iBAAiB,IAAI;IAAE,UAAU,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAGnF;AAED,wBAAsB,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnG;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CAEd;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2B3G;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA6B5E;AAkBD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqB5D;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjF;AAOD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAA0B;AAEzG;;;GAGG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiB/D"}

package/dist/src/auth/jwt.js

@@ -11,6 +11,7 @@
  */
 import { SignJWT, jwtVerify } from 'jose';
 import { createHash, randomBytes } from 'node:crypto';
+import { logger } from '../utils/logger.js';
 // We use EdDSA JWTs signed with the node's private key
 // jose requires CryptoKey objects, so we convert from raw Ed25519 bytes
 let nodePrivateKey = null;
@@ -56,6 +57,7 @@ export async function issueJWT(payload, ttlSeconds, sessionId) {
         ...(payload.homeUrl ? { homeUrl: payload.homeUrl } : {}),
         ...(payload.eco_app ? { eco_app: payload.eco_app } : {}),
         ...(payload.app_grant ? { app_grant: payload.app_grant } : {}),
+        ...(payload.app ? { app: payload.app } : {}),
     })
         .setProtectedHeader({ alg: 'EdDSA', typ: 'JWT' })
         .setSubject(payload.sub)
@@ -88,9 +90,13 @@ export async function verifyJWT(token) {
             homeUrl: payload.homeUrl,
             eco_app: payload.eco_app,
             app_grant: payload.app_grant,
+            app: payload.app,
         };
     }
     catch {
+        // Fail-closed by design: any verification error (bad signature, expiry, malformed claims) means
+        // "not authenticated". Logging every rejected token on a public endpoint is a flooding vector.
+        // eslint-disable-next-line aimeat/no-silent-catch -- null here means "not authenticated"
         return null;
     }
 }
@@ -119,8 +125,10 @@ export function initRevocationStorage(storage) {
         try {
             await storage.cleanExpiredRevocations();
         }
-        catch {
-            // Swallow cleanup errors silently — non-critical
+        catch (err) {
+            // Non-critical for the request path, but not free: a cleanup that keeps failing means the
+            // revoked-token table grows without bound, and nobody would ever find out.
+            logger.warn('Expired-revocation cleanup failed; revoked token rows are accumulating', { error: err.message });
         }
         // Also evict stale cache entries
         const now = Date.now();
@@ -148,7 +156,11 @@ export async function revokeToken(token, expiresAt) {
     try {
         _onTokenRevoked?.(token);
     }
-    catch { /* tunnel optional */ }
+    catch (err) {
+        // The hook is optional, but a failure here means a REVOKED bearer may still hold an open tunnel
+        // until it next probes — a security-relevant miss that must not be invisible.
+        logger.warn('Token revoked, but the tunnel-close hook failed; a revoked session may stay open', { error: err.message });
+    }
 }
 /**
  * Hook invoked with the raw token whenever a token is revoked — the connector tunnel manager

package/dist/src/auth/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGtD,uDAAuD;AACvD,wEAAwE;AAExE,IAAI,cAAc,GAAqB,IAAI,CAAC;AAC5C,IAAI,aAAa,GAAqB,IAAI,CAAC;AAE3C,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACpF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,eAAuB,EAAE,gBAAwB;IAClF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAEhE,wDAAwD;IACxD,MAAM,YAAY,GAAG;QACnB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrD,CAAC;IACF,MAAM,aAAa,GAAG;QACpB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpD,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACtD,CAAC;IAEF,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1G,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5G,CAAC;AAgBD,qDAAqD;AACrD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAmB,EAAE,UAAkB,EAAE,SAAkB;IACxF,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC;QAC/B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAChD,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;IAEvC,0DAA0D;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACtC,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE;YACxD,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QACH,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAa;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAe;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAc;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAiB;YAChC,GAAG,EAAE,OAAO,CAAC,GAAa;YAC1B,MAAM,EAAG,OAAO,CAAC,MAAmB,IAAI,CAAC,GAAG,CAAC;YAC7C,SAAS,EAAE,OAAO,CAAC,GAAyB;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAgC;YACpD,SAAS,EAAG,OAAO,CAAC,SAAqB,IAAI,KAAK;YAClD,QAAQ,EAAE,OAAO,CAAC,QAA8B;YAChD,OAAO,EAAE,OAAO,CAAC,OAA6B;YAC9C,OAAO,EAAE,OAAO,CAAC,OAA6B;YAC9C,SAAS,EAAE,OAAO,CAAC,SAA+B;SACnD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAE1E,qEAAqE;AACrE,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,8DAA8D;AAC9D,sDAAsD;AACtD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkD,CAAC;AAClF,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,mEAAmE;AACnE,IAAI,QAAQ,GAAmB,IAAI,CAAC;AACpC,IAAI,gBAAgB,GAA0C,IAAI,CAAC;AAEnE;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,QAAQ,GAAG,OAAO,CAAC;IAEnB,gEAAgE;IAChE,IAAI,gBAAgB;QAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACtD,gBAAgB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,uBAAuB,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;QACD,iCAAiC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;YAC3C,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,YAAY,EAAE,CAAC;gBACxC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,SAAiB;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,qBAAqB;IACrB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,eAAe;IACf,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEnE,oGAAoG;IACpG,mGAAmG;IACnG,0FAA0F;IAC1F,IAAI,CAAC;QAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,IAAI,eAAe,GAAqC,IAAI,CAAC;AAC7D,MAAM,UAAU,mBAAmB,CAAC,EAAoC,IAAU,eAAe,GAAG,EAAE,CAAC,CAAC,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,4BAA4B;IAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,YAAY,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,oBAAoB;IACpB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACpD,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,uDAAuD;AACvD,wEAAwE;AAExE,IAAI,cAAc,GAAqB,IAAI,CAAC;AAC5C,IAAI,aAAa,GAAqB,IAAI,CAAC;AAE3C,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACpF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,eAAuB,EAAE,gBAAwB;IAClF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAEhE,wDAAwD;IACxD,MAAM,YAAY,GAAG;QACnB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrD,CAAC;IACF,MAAM,aAAa,GAAG;QACpB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpD,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACtD,CAAC;IAEF,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1G,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5G,CAAC;AAkBD,qDAAqD;AACrD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAmB,EAAE,UAAkB,EAAE,SAAkB;IACxF,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC;QAC/B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAChD,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;IAEvC,0DAA0D;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACtC,CAAC;AAoBD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE;YACxD,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QACH,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAa;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAe;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAc;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAiB;YAChC,GAAG,EAAE,OAAO,CAAC,GAAa;YAC1B,MAAM,EAAG,OAAO,CAAC,MAAmB,IAAI,CAAC,GAAG,CAAC;YAC7C,SAAS,EAAE,OAAO,CAAC,GAAyB;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAgC;YACpD,SAAS,EAAG,OAAO,CAAC,SAAqB,IAAI,KAAK;YAClD,QAAQ,EAAE,OAAO,CAAC,QAA8B;YAChD,OAAO,EAAE,OAAO,CAAC,OAA6B;YAC9C,OAAO,EAAE,OAAO,CAAC,OAA6B;YAC9C,SAAS,EAAE,OAAO,CAAC,SAA+B;YAClD,GAAG,EAAE,OAAO,CAAC,GAAyB;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,+FAA+F;QAC/F,yFAAyF;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAE1E,qEAAqE;AACrE,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,8DAA8D;AAC9D,sDAAsD;AACtD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkD,CAAC;AAClF,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,mEAAmE;AACnE,IAAI,QAAQ,GAAmB,IAAI,CAAC;AACpC,IAAI,gBAAgB,GAA0C,IAAI,CAAC;AAEnE;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,QAAQ,GAAG,OAAO,CAAC;IAEnB,gEAAgE;IAChE,IAAI,gBAAgB;QAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACtD,gBAAgB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,uBAAuB,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0FAA0F;YAC1F,2EAA2E;YAC3E,MAAM,CAAC,IAAI,CAAC,wEAAwE,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,iCAAiC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;YAC3C,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,YAAY,EAAE,CAAC;gBACxC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,SAAiB;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,qBAAqB;IACrB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,eAAe;IACf,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEnE,oGAAoG;IACpG,mGAAmG;IACnG,0FAA0F;IAC1F,IAAI,CAAC;QACH,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gGAAgG;QAChG,8EAA8E;QAC9E,MAAM,CAAC,IAAI,CAAC,kFAAkF,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,IAAI,eAAe,GAAqC,IAAI,CAAC;AAC7D,MAAM,UAAU,mBAAmB,CAAC,EAAoC,IAAU,eAAe,GAAG,EAAE,CAAC,CAAC,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,4BAA4B;IAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,YAAY,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,oBAAoB;IACpB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACpD,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/auth/keypair.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../../../src/auth/keypair.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAOxD;AAED,wBAAsB,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKrF;AAED,wBAAsB,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAShH"}
+{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../../../src/auth/keypair.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAOxD;AAED,wBAAsB,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKrF;AAED,wBAAsB,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAYhH"}

package/dist/src/auth/keypair.js

@@ -36,6 +36,9 @@ export async function verify(publicKeyBase64, message, signatureBase64) {
         return await ed.verifyAsync(signature, msgBytes, publicKey);
     }
     catch {
+        // Fail-closed by design: a malformed key or signature means the signature does NOT verify.
+        // Logging every bad signature on a public endpoint is a flooding vector.
+        // eslint-disable-next-line aimeat/no-silent-catch -- false here means "did not verify"
         return false;
     }
 }

package/dist/src/auth/keypair.js.map

@@ -1 +1 @@
-{"version":3,"file":"keypair.js","sourceRoot":"","sources":["../../../src/auth/keypair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAOrC,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,eAAe,GAAG,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IACnD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACnE,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzD,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,gBAAwB,EAAE,OAAe;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,eAAuB,EAAE,OAAe,EAAE,eAAuB;IAC5F,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACzD,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"keypair.js","sourceRoot":"","sources":["../../../src/auth/keypair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAOrC,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,eAAe,GAAG,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IACnD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACnE,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzD,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,gBAAwB,EAAE,OAAe;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,eAAuB,EAAE,OAAe,EAAE,eAAuB;IAC5F,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACzD,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,yEAAyE;QACzE,uFAAuF;QACvF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/auth/middleware.d.ts

@@ -11,6 +11,8 @@
  *   - resolvePatToken / maybeSetPatBrowserSession: Personal Access Token handling
  *
  * @version-history
+ *   v1.1.0 — 2026-07-28 — Every AUTH_REQUIRED 401 goes through deny401(), which stamps the RFC 9728
+ *     `WWW-Authenticate: Bearer resource_metadata="…"` hint for the origin the client reached.
  *   v1.0.0 — 2026-07-13 — Header added; file pre-dates header standard
  */
 import type { Request, Response, NextFunction } from 'express';

package/dist/src/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAGpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAOvD,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAG7E;AAoED,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED,yCAAyC;AACzC,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED,2FAA2F;AAC3F,wBAAgB,uBAAuB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAEzE;AAGD,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,aAAa,CAAC;SACtB;KACF;CACF;AAED;;;GAGG;AACH,wBAAgB,YAAY,KACZ,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAgC9D;AAED;;;GAGG;AACH,wBAAgB,WAAW,KACX,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAkF9D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,KAC5B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAQxD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,IAC9B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAiCxD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,KAC9B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAsBxD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAkBnD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,KACzB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAOxD;AAOD;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAC1D,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAYxD;AAED,wBAAgB,YAAY,CAAC,GAAG,cAAc,EAAE,MAAM,EAAE,IAC9C,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAqCxD"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAGpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAQvD,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAG7E;AA0ED,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED,yCAAyC;AACzC,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED,2FAA2F;AAC3F,wBAAgB,uBAAuB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAEzE;AAGD,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,aAAa,CAAC;SACtB;KACF;CACF;AAED;;;GAGG;AACH,wBAAgB,YAAY,KACZ,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAgC9D;AAED;;;GAGG;AACH,wBAAgB,WAAW,KACX,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAkF9D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,KAC5B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAQxD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,IAC9B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAiCxD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,KAC9B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAsBxD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAkBnD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,KACzB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAOxD;AAOD;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAC1D,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAYxD;AAED,wBAAgB,YAAY,CAAC,GAAG,cAAc,EAAE,MAAM,EAAE,IAC9C,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAqCxD"}

package/dist/src/auth/middleware.js

@@ -4,6 +4,7 @@ import { resolvePat, PAT_PREFIX } from '../services/access-token.js';
 import { getStats } from '../services/stats.js';
 import { getPromMetrics } from '../services/prometheus.js';
 import { logger } from '../utils/logger.js';
+import { resourceMetadataUrl } from '../services/protected-resource.js';
 // P3-7: Reference to storage for session revocation checks
 let _sessionStorage = null;
 let _config = null;
@@ -28,11 +29,15 @@ function touchAgentLastSeen(auth) {
         return;
     _lastSeenCache.set(id, now);
     const iso = new Date(now).toISOString();
+    // Best-effort liveness bookkeeping on the hot auth path: a failure must not fail the request, but
+    // it must not be invisible either — a lastSeen that silently stops updating reads as "the agent is
+    // gone" in every fleet view. The throttle above bounds how often this can log.
+    const lastSeenFailed = (err) => logger.warn('lastSeen update failed; fleet views will show this principal as stale', { id, error: String(err) });
     if (isEco) {
-        _sessionStorage.updateEcosystemApp(id, { lastSeen: iso }).catch(() => { });
+        _sessionStorage.updateEcosystemApp(id, { lastSeen: iso }).catch(lastSeenFailed);
     }
     else {
-        _sessionStorage.updateAgent(id, { lastSeen: iso }).catch(() => { });
+        _sessionStorage.updateAgent(id, { lastSeen: iso }).catch(lastSeenFailed);
     }
 }
 // Personal Access Tokens are presented as a Bearer credential (Authorization: Bearer
@@ -49,7 +54,8 @@ async function resolvePatToken(token) {
     const r = await resolvePat(_sessionStorage, token);
     if (!r)
         return null;
-    _sessionStorage.touchPat(r.patId, new Date().toISOString()).catch(() => { });
+    _sessionStorage.touchPat(r.patId, new Date().toISOString())
+        .catch(err => logger.warn('PAT lastUsed update failed; the token will look unused', { patId: r.patId, error: String(err) }));
     return {
         sub: r.sub,
         owner: r.owner,
@@ -154,7 +160,7 @@ export function requireAuth() {
                 const prom = getPromMetrics();
                 if (prom)
                     prom.authFailuresTotal.inc();
-                res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'This endpoint requires authentication'));
+                deny401(req, res, 'This endpoint requires authentication');
                 return;
             }
             next();
@@ -168,7 +174,7 @@ export function requireAuth() {
             const prom = getPromMetrics();
             if (prom)
                 prom.authFailuresTotal.inc();
-            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Authentication required'));
+            deny401(req, res, 'Authentication required');
             return;
         }
         // Personal Access Token presented as a Bearer credential — authenticate via the
@@ -182,7 +188,7 @@ export function requireAuth() {
                 const prom = getPromMetrics();
                 if (prom)
                     prom.authFailuresTotal.inc();
-                res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Invalid or revoked access token'));
+                deny401(req, res, 'Invalid or revoked access token');
                 return;
             }
             req.auth = patAuth;
@@ -198,7 +204,7 @@ export function requireAuth() {
             const prom = getPromMetrics();
             if (prom)
                 prom.authFailuresTotal.inc();
-            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Token has been revoked'));
+            deny401(req, res, 'Token has been revoked');
             return;
         }
         const verified = await verifyJWT(token);
@@ -209,7 +215,7 @@ export function requireAuth() {
             const prom = getPromMetrics();
             if (prom)
                 prom.authFailuresTotal.inc();
-            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Invalid or expired token'));
+            deny401(req, res, 'Invalid or expired token');
             return;
         }
         // P3-7: Check if the session has been revoked
@@ -222,7 +228,7 @@ export function requireAuth() {
                 const prom = getPromMetrics();
                 if (prom)
                     prom.authFailuresTotal.inc();
-                res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Session has been revoked'));
+                deny401(req, res, 'Session has been revoked');
                 return;
             }
         }
@@ -239,7 +245,7 @@ export function requireAuth() {
 export function requireAuthOrAnonymous() {
     return (req, res, next) => {
         if (!req.auth) {
-            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Authentication required'));
+            deny401(req, res, 'Authentication required');
             return;
         }
         // Allow both authenticated and anonymous
@@ -259,7 +265,7 @@ export function requireRole(role) {
             const prom = getPromMetrics();
             if (prom)
                 prom.authFailuresTotal.inc();
-            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Authentication required'));
+            deny401(req, res, 'Authentication required');
             return;
         }
         // Federated sessions cannot access operator functions
@@ -300,7 +306,7 @@ export function requireExternalPrincipal() {
             const prom = getPromMetrics();
             if (prom)
                 prom.authFailuresTotal.inc();
-            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Authentication required'));
+            deny401(req, res, 'Authentication required');
             return;
         }
         const roles = req.auth.roles;
@@ -388,7 +394,7 @@ export function requireLocalSession() {
 export function requireRoleOrScope(role, ...scopes) {
     return (req, res, next) => {
         if (!req.auth) {
-            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Authentication required'));
+            deny401(req, res, 'Authentication required');
             return;
         }
         const roles = req.auth.roles;
@@ -411,7 +417,7 @@ export function requireRoleOrScope(role, ...scopes) {
 export function requireScope(...requiredScopes) {
     return (req, res, next) => {
         if (!req.auth) {
-            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Authentication required'));
+            deny401(req, res, 'Authentication required');
             return;
         }
         // Owner-role requests bypass scope checks (owners act on behalf of all their agents).
@@ -450,6 +456,19 @@ function extractToken(req) {
     // Tokens in URLs are logged in access logs, browser history, and referrer headers.
     return null;
 }
+/**
+ * Refuse an unauthenticated request with 401 AND the RFC 9728 discovery hint. The
+ * `resource_metadata` parameter names the protected-resource metadata of the ORIGIN the client
+ * actually reached (apex, app origin, portfolio origin), which is how an MCP client learns where
+ * to get a token without having been told out of band. Header omitted when the config was never
+ * wired (unit tests constructing middleware standalone) — the 401 body is unchanged either way.
+ */
+function deny401(req, res, message) {
+    if (_config && !res.headersSent) {
+        res.setHeader('WWW-Authenticate', `Bearer resource_metadata="${resourceMetadataUrl(req, _config)}"`);
+    }
+    res.status(401).json(errorEnvelope('AUTH_REQUIRED', message));
+}
 function errorEnvelope(code, message) {
     return {
         ok: false,

package/dist/src/auth/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/auth/middleware.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAsB,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,2DAA2D;AAC3D,IAAI,eAAe,GAAmB,IAAI,CAAC;AAC3C,IAAI,OAAO,GAAwB,IAAI,CAAC;AAExC,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,MAAqB;IACrE,eAAe,GAAG,OAAO,CAAC;IAC1B,OAAO,GAAG,MAAM,IAAI,IAAI,CAAC;AAC3B,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;AACjD,MAAM,qBAAqB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEzC,SAAS,kBAAkB,CAAC,IAAmB;IAC7C,IAAI,CAAC,eAAe;QAAE,OAAO;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,GAAG,GAAG,IAAI,GAAG,qBAAqB;QAAE,OAAO;IAC/C,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,KAAK,EAAE,CAAC;QACV,eAAe,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,eAAe,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,wFAAwF;AACxF,6FAA6F;AAE7F;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5E,OAAO;QACL,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;KACrG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,GAAY,EAAE,GAAa,EAAE,QAAgB,EAAE,OAAsB;IACtG,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO;IAC7C,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO;IAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO;IACzE,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO;IACnC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,kFAAkF;AAClF,IAAI,cAAc,GAAG,KAAK,CAAC;AAC3B,IAAI,cAAc,GAAG,EAAE,CAAC;AACxB,IAAI,eAAe,GAAG,EAAE,CAAC;AAEzB,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAa;IAC7D,cAAc,GAAG,IAAI,CAAC;IACtB,cAAc,GAAG,IAAI,CAAC;IACtB,eAAe,GAAG,KAAK,CAAC;AAC1B,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,eAAe;IAC7B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB;IACrC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AAC1D,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC7C,IAAI,OAAO,EAAE,CAAC;oBACZ,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;oBACnB,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;gBACxC,IAAI,QAAQ,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QACD,iEAAiE;QACjE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,GAAG;gBACT,GAAG,EAAE,cAAc;gBACnB,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,EAAE;gBACR,KAAK,EAAE,CAAC,OAAO,CAAC;gBAChB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK;gBAC1C,MAAM,EAAE,CAAC,aAAa,EAAE,gBAAgB,EAAE,aAAa,CAAC;gBACxD,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,8EAA8E;QAC9E,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,sFAAsF;YACtF,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,IAAI,KAAK;oBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC9B,IAAI,IAAI;oBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,gFAAgF;QAChF,4EAA4E;QAC5E,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,IAAI,KAAK;oBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC9B,IAAI,IAAI;oBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,iCAAiC,CAAC,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;YACnB,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACpD,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,8CAA8C;QAC9C,IAAI,QAAQ,CAAC,SAAS,IAAI,eAAe,EAAE,CAAC;YAC1C,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAClF,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,IAAI,KAAK;oBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC9B,IAAI,IAAI;oBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;QACH,CAAC;QAED,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QACpB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,yCAAyC;QACzC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,IAAI,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,qDAAqD,CAAC,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QAED,0DAA0D;QAC1D,+FAA+F;QAC/F,mFAAmF;QACnF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC3C,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACzD,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1D,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC7D,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7B,0FAA0F;QAC1F,wFAAwF;QACxF,2FAA2F;QAC3F,wFAAwF;QACxF,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/D,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACjF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,iDAAiD,CAAC,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAY,EACZ,SAAiB,EACjB,YAAoB,EACpB,MAA2C;IAE3C,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAClE,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC;IACjC,IAAI,cAAc,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAClD,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EACL,kCAAkC,SAAS,2BAA2B,MAAM,CAAC,MAAM,IAAI;gBACvF,8DAA8D;gBAC9D,8BAA8B,SAAS,YAAY,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,SAAS,UAAU,MAAM,CAAC,OAAO,EAAE;SAC5G,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,UAAU,SAAS,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,sCAAsC,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,gFAAgF;AAChF,4FAA4F;AAC5F,2FAA2F;AAE3F;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAG,MAAgB;IAClE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3G,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7B,8GAA8G;QAC9G,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpB,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;YAC7E,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACzE,sGAAsG;QACtG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC1H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,kBAAkB,IAAI,wBAAwB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3H,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAG,cAAwB;IACtD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,sFAAsF;QACtF,wFAAwF;QACxF,2FAA2F;QAC3F,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAChC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/E,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAEpC,kBAAkB;QAClB,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;YAE1D,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,QAAQ,WAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAChI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,UAAU,QAAQ,8BAA8B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/H,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,sEAAsE;IACtE,mFAAmF;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QACxB,KAAK,EAAE;YACL,YAAY,EAAE;gBACZ,EAAE,WAAW,EAAE,iCAAiC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE;aAC1F;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/auth/middleware.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAsB,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,2DAA2D;AAC3D,IAAI,eAAe,GAAmB,IAAI,CAAC;AAC3C,IAAI,OAAO,GAAwB,IAAI,CAAC;AAExC,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,MAAqB;IACrE,eAAe,GAAG,OAAO,CAAC;IAC1B,OAAO,GAAG,MAAM,IAAI,IAAI,CAAC;AAC3B,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;AACjD,MAAM,qBAAqB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEzC,SAAS,kBAAkB,CAAC,IAAmB;IAC7C,IAAI,CAAC,eAAe;QAAE,OAAO;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,GAAG,GAAG,IAAI,GAAG,qBAAqB;QAAE,OAAO;IAC/C,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,kGAAkG;IAClG,mGAAmG;IACnG,+EAA+E;IAC/E,MAAM,cAAc,GAAG,CAAC,GAAY,EAAE,EAAE,CACtC,MAAM,CAAC,IAAI,CAAC,uEAAuE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnH,IAAI,KAAK,EAAE,CAAC;QACV,eAAe,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,eAAe,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,wFAAwF;AACxF,6FAA6F;AAE7F;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SACxD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/H,OAAO;QACL,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;KACrG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,GAAY,EAAE,GAAa,EAAE,QAAgB,EAAE,OAAsB;IACtG,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO;IAC7C,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO;IAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO;IACzE,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO;IACnC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,kFAAkF;AAClF,IAAI,cAAc,GAAG,KAAK,CAAC;AAC3B,IAAI,cAAc,GAAG,EAAE,CAAC;AACxB,IAAI,eAAe,GAAG,EAAE,CAAC;AAEzB,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAa;IAC7D,cAAc,GAAG,IAAI,CAAC;IACtB,cAAc,GAAG,IAAI,CAAC;IACtB,eAAe,GAAG,KAAK,CAAC;AAC1B,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,eAAe;IAC7B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB;IACrC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AAC1D,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC7C,IAAI,OAAO,EAAE,CAAC;oBACZ,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;oBACnB,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;gBACxC,IAAI,QAAQ,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QACD,iEAAiE;QACjE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,GAAG;gBACT,GAAG,EAAE,cAAc;gBACnB,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,EAAE;gBACR,KAAK,EAAE,CAAC,OAAO,CAAC;gBAChB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK;gBAC1C,MAAM,EAAE,CAAC,aAAa,EAAE,gBAAgB,EAAE,aAAa,CAAC;gBACxD,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,8EAA8E;QAC9E,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,sFAAsF;YACtF,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,IAAI,KAAK;oBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC9B,IAAI,IAAI;oBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBACvC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,gFAAgF;QAChF,4EAA4E;QAC5E,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,IAAI,KAAK;oBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC9B,IAAI,IAAI;oBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBACvC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;YACnB,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACpD,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,8CAA8C;QAC9C,IAAI,QAAQ,CAAC,SAAS,IAAI,eAAe,EAAE,CAAC;YAC1C,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAClF,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,IAAI,KAAK;oBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC9B,IAAI,IAAI;oBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBACvC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;QACH,CAAC;QAED,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QACpB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,yCAAyC;QACzC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,IAAI,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,qDAAqD,CAAC,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QAED,0DAA0D;QAC1D,+FAA+F;QAC/F,mFAAmF;QACnF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC3C,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACzD,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1D,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC7D,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7B,0FAA0F;QAC1F,wFAAwF;QACxF,2FAA2F;QAC3F,wFAAwF;QACxF,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/D,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACjF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,iDAAiD,CAAC,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAY,EACZ,SAAiB,EACjB,YAAoB,EACpB,MAA2C;IAE3C,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAClE,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC;IACjC,IAAI,cAAc,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAClD,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EACL,kCAAkC,SAAS,2BAA2B,MAAM,CAAC,MAAM,IAAI;gBACvF,8DAA8D;gBAC9D,8BAA8B,SAAS,YAAY,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,SAAS,UAAU,MAAM,CAAC,OAAO,EAAE;SAC5G,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,UAAU,SAAS,aAAa;KAC1C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,sCAAsC,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,gFAAgF;AAChF,4FAA4F;AAC5F,2FAA2F;AAE3F;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAG,MAAgB;IAClE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACxE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7B,8GAA8G;QAC9G,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpB,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;YAC7E,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACzE,sGAAsG;QACtG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC1H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,kBAAkB,IAAI,wBAAwB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3H,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAG,cAAwB;IACtD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,sFAAsF;QACtF,wFAAwF;QACxF,2FAA2F;QAC3F,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAChC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/E,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAEpC,kBAAkB;QAClB,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;YAE1D,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,QAAQ,WAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAChI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,UAAU,QAAQ,8BAA8B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/H,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,sEAAsE;IACtE,mFAAmF;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,OAAe;IAC3D,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,6BAA6B,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACvG,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QACxB,KAAK,EAAE;YACL,YAAY,EAAE;gBACZ,EAAE,WAAW,EAAE,iCAAiC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE;aAC1F;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/src/auth/node-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-keys.d.ts","sourceRoot":"","sources":["../../../src/auth/node-keys.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAoHvD;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B1F"}
+{"version":3,"file":"node-keys.d.ts","sourceRoot":"","sources":["../../../src/auth/node-keys.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AA8JvD;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B1F"}

package/dist/src/auth/node-keys.js

@@ -11,6 +11,11 @@
  *   - initializeNode(config, storage): resolve/generate keys and init all token signers
  *
  * @version-history
+ *   v1.1.0 — 2026-07-26 — loadPersistedNodeKey distinguishes "no key file" from "cannot read the key
+ *     file". It used to answer null to both, and the caller's answer to null is to generate a NEW
+ *     keypair — silently changing the node identity so issued JWTs and pinned peer keys stop
+ *     verifying. An unreadable/corrupt/undecryptable file now refuses to start. A failed persist is
+ *     logged at error, because the node is then one restart away from a new identity.
  *   v1.0.0 — 2026-07-13 — Header added; file pre-dates header standard
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
@@ -59,28 +64,61 @@ function decryptNodeKey(file, passphrase) {
     }
     return { publicKey: data.publicKey, privateKey: data.privateKey };
 }
+/**
+ * Read the persisted key file. `null` means ONE thing: there is no key file, so the caller may
+ * generate a fresh identity.
+ *
+ * Everything else is fatal on purpose. This function used to end in `catch { return null; }`, so a
+ * key file that existed but could not be read (permissions, truncation, a half-written file, invalid
+ * JSON) was indistinguishable from "no key yet" — and the caller's response to null is to GENERATE A
+ * NEW KEYPAIR. That silently changes the node's identity: every JWT it issued stops verifying and
+ * every federation peer that pinned the old public key rejects it. Refusing to start is recoverable;
+ * a new identity is not.
+ */
 function loadPersistedNodeKey() {
     const keyPath = getNodeKeyPath();
+    if (!existsSync(keyPath))
+        return null;
+    let raw;
     try {
-        if (!existsSync(keyPath))
-            return null;
-        const data = JSON.parse(readFileSync(keyPath, 'utf-8'));
-        // P3-8: Handle encrypted key file
-        if (data.encrypted) {
-            const passphrase = process.env.AIMEAT_KEY_PASSPHRASE;
-            if (!passphrase) {
-                logger.error('Node key file is encrypted but AIMEAT_KEY_PASSPHRASE is not set. Cannot decrypt.');
-                process.exit(1);
-            }
+        raw = readFileSync(keyPath, 'utf-8');
+    }
+    catch (err) {
+        logger.error('Node key file exists but could not be read. Refusing to start with a NEW identity — '
+            + 'fix the file permissions, or move the file aside if you intend to regenerate the node key.', { path: keyPath, error: err.message });
+        process.exit(1);
+    }
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch (err) {
+        logger.error('Node key file exists but is not valid JSON. Refusing to start with a NEW identity — '
+            + 'restore the file from backup, or move it aside if you intend to regenerate the node key.', { path: keyPath, error: err.message });
+        process.exit(1);
+    }
+    // P3-8: Handle encrypted key file
+    if (data.encrypted) {
+        const passphrase = process.env.AIMEAT_KEY_PASSPHRASE;
+        if (!passphrase) {
+            logger.error('Node key file is encrypted but AIMEAT_KEY_PASSPHRASE is not set. Cannot decrypt.');
+            process.exit(1);
+        }
+        try {
             return decryptNodeKey(data, passphrase);
         }
-        if (data.publicKey && data.privateKey)
-            return data;
-        return null;
+        catch (err) {
+            logger.error('Node key file could not be decrypted (wrong AIMEAT_KEY_PASSPHRASE, or the file is '
+                + 'corrupt). Refusing to start with a NEW identity.', { path: keyPath, error: err.message });
+            process.exit(1);
+        }
     }
-    catch {
-        return null;
+    if (data.publicKey && data.privateKey) {
+        return { publicKey: data.publicKey, privateKey: data.privateKey };
     }
+    logger.error('Node key file is present but holds no keypair. Refusing to start with a NEW identity — '
+        + 'move the file aside if you intend to regenerate the node key.', { path: keyPath });
+    process.exit(1);
 }
 function persistNodeKey(kp) {
     const keyPath = getNodeKeyPath();
@@ -104,7 +142,12 @@ function persistNodeKey(kp) {
         }
     }
     catch (err) {
-        logger.warn('Could not persist node key', { path: keyPath, error: err });
+        // Not fatal (a read-only home directory is a legitimate deployment), but it MUST be loud: the
+        // node is now running on an in-memory key and will come back with a different identity after a
+        // restart, which looks like a federation/JWT bug hours later.
+        logger.error('Could not persist the node key. This node is running on an IN-MEMORY key and will '
+            + 'have a DIFFERENT identity after restart — previously issued tokens and pinned peer keys will '
+            + 'stop verifying. Fix the path permissions or set the key explicitly in config.', { path: keyPath, error: err.message });
     }
 }
 /**

package/dist/src/auth/node-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-keys.js","sourceRoot":"","sources":["../../../src/auth/node-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,IAAI,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG7G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAY5C,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC;IAChE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CACrB,EAA6C,EAC7C,UAAkB;IAElB,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B;IAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO;QACL,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,IAAsB,EACtB,UAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAExD,kCAAkC;QAClC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACrD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;gBACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,EAA6C;IACnE,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACrD,IAAI,UAAU,EAAE,CAAC;YACf,2EAA2E;YAC3E,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YACjD,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnF,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,uCAAuC;YACvC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAChI,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,2GAA2G,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAoB,EAAE,OAAgB;IACzE,IAAI,CAAC;QACH,IAAI,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8DAA8D;YAC9D,OAAO,GAAG,oBAAoB,EAAE,CAAC;YACjC,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAC1C,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;gBACnC,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;gBACtD,OAAO,GAAG,EAAE,CAAC;gBACb,cAAc,CAAC,EAAE,CAAC,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACtD,mBAAmB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC3C,qBAAqB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC7C,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5C,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1C,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}
+{"version":3,"file":"node-keys.js","sourceRoot":"","sources":["../../../src/auth/node-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,IAAI,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG7G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAY5C,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC;IAChE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CACrB,EAA6C,EAC7C,UAAkB;IAElB,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B;IAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO;QACL,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,IAAsB,EACtB,UAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB;IAC3B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,sFAAsF;cAC/F,4FAA4F,EAC9F,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAsE,CAAC;IAC3E,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,sFAAsF;cAC/F,0FAA0F,EAC5F,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kCAAkC;IAClC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;YACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,cAAc,CAAC,IAAwB,EAAE,UAAU,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,oFAAoF;kBAC7F,kDAAkD,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,yFAAyF;UAClG,+DAA+D,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,EAA6C;IACnE,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACrD,IAAI,UAAU,EAAE,CAAC;YACf,2EAA2E;YAC3E,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YACjD,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnF,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,uCAAuC;YACvC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAChI,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,2GAA2G,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8FAA8F;QAC9F,+FAA+F;QAC/F,8DAA8D;QAC9D,MAAM,CAAC,KAAK,CAAC,oFAAoF;cAC7F,+FAA+F;cAC/F,+EAA+E,EACjF,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAoB,EAAE,OAAgB;IACzE,IAAI,CAAC;QACH,IAAI,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8DAA8D;YAC9D,OAAO,GAAG,oBAAoB,EAAE,CAAC;YACjC,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAC1C,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;gBACnC,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;gBACtD,OAAO,GAAG,EAAE,CAAC;gBACb,cAAc,CAAC,EAAE,CAAC,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACtD,mBAAmB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC3C,qBAAqB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC7C,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5C,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1C,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}

package/dist/src/auth/sse-domain-scopes.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @file sse-domain-scopes.ts
+ * @description Authorization for the SSE live-update stream: which change DOMAINS a given
+ *   principal may be told about. The stream carries no payload (only domain names), but a
+ *   domain name plus its timing is still metadata: an app granted `memory:read` must not
+ *   learn that the owner's messages, wallet or agent tasks just changed. H-2 app-origin
+ *   isolation fences an app's DATA access; this fences its CHANGE-NOTIFICATION access the
+ *   same way, using the very same scope vocabulary the owner approved at sign-in.
+ *
+ *   Owner sessions (a human on the apex portal) see everything — the whole keyspace is
+ *   theirs. Every other principal (app grant, agent, ecosystem app, anonymous) is RESTRICTED:
+ *   a domain is forwarded only when the principal holds the scope that domain maps to, and a
+ *   domain absent from the map is DENIED. Deny-by-default is deliberate: a new domain added
+ *   elsewhere in the node must not silently start leaking to sandboxed apps. Adding the
+ *   mapping is a one-line, reviewable decision.
+ * @structure DOMAIN_SCOPE (domain → required scope) · isOwnerPrincipal · allowedDomains ·
+ *   filterDomains
+ * @usage
+ *   const restricted = !isOwnerPrincipal(req.auth!);
+ *   const allow = allowedDomains(req.auth!.scopes);        // Set<string> | null (null = all)
+ *   const visible = filterDomains(['memory', 'wallet'], allow);
+ * @version-history
+ *   v1.0.0 — 2026-07-25 — Initial: scope-gated SSE domains (an app-grant stream no longer
+ *     sees every domain in the owner's keyspace).
+ */
+/**
+ * Change domain → the scope a RESTRICTED principal must hold to be told about it.
+ * Keys are the domain strings passed to `emitChange(domain, …)`. Anything not listed here
+ * is invisible to restricted principals (operator/infra domains: config, features, admin-*,
+ * federation, disputes, appeals, verification, totp, ghii, owners, consent, flags, feedback,
+ * instances, extensions, cortex, skills, portfolio, ecosystem-apps, presence, realtime).
+ */
+export declare const DOMAIN_SCOPE: Readonly<Record<string, string>>;
+/**
+ * True for a human owner session on the apex portal — the principal whose keyspace this is.
+ * An app grant carries roles ['app'] (never 'owner'), so it is restricted even though it acts
+ * on the owner's behalf; agents and ecosystem apps are restricted for the same reason.
+ */
+export declare function isOwnerPrincipal(auth: {
+    roles?: string[];
+}): boolean;
+/**
+ * The domains a restricted principal holding `scopes` may be told about, or `null` when no
+ * filtering applies (owner sessions). A wildcard scope ('*') also disables filtering — the
+ * node's own dev/default-scope escape hatch, unchanged in meaning here.
+ */
+export declare function allowedDomains(scopes: string[] | undefined): Set<string> | null;
+/** Keep only the domains this principal may see. `allow === null` passes everything through. */
+export declare function filterDomains(domains: string[], allow: Set<string> | null): string[];
+//# sourceMappingURL=sse-domain-scopes.d.ts.map

package/dist/src/auth/sse-domain-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-domain-scopes.d.ts","sourceRoot":"","sources":["../../../src/auth/sse-domain-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqDxD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAIpE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAQ/E;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,CAGpF"}