brains-mcp 1.61.2

package/dist/auth/patStore.js

@@ -0,0 +1,308 @@
+/**
+ * Personal Access Token (PAT) store.
+ *
+ * PATs are long-lived, user-scoped bearer tokens meant for CLI / local-first
+ * workflows where re-authenticating every hour is impractical.  They are
+ * distinct from the short-lived Supabase JWTs and the workspace-wide
+ * BRAINS_API_KEY — each PAT is tied to the Supabase/OAuth user who minted it
+ * and is stored alongside their wiki content under `users/<subject>/`.
+ *
+ * Two backends, auto-selected (mirrors createTokenStore):
+ *   - LocalSQLitePATStore  — adds a `pats` table to the existing oauth-tokens
+ *     SQLite database. Good for single-instance / local runs.
+ *   - PostgresPATStore     — PostgREST-backed, stored in a `pats` table.
+ *     Requires scripts/pats.sql to be applied once.
+ *
+ * expires_at is nullable — NULL means the token never expires.
+ */
+import fs from "fs";
+import path from "path";
+import { randomUUID } from "crypto";
+import { randomBytes } from "crypto";
+import Database from "better-sqlite3";
+// ─── Types ────────────────────────────────────────────────────────────────────
+export const PAT_EXPIRY_DAYS_DEFAULT = 30;
+export const PAT_EXPIRY_DAYS_MAX = 365;
+export class LocalSQLitePATStore {
+    db;
+    constructor(storageLocation) {
+        const cacheDir = path.join(storageLocation, ".cache");
+        fs.mkdirSync(cacheDir, { recursive: true });
+        const dbPath = path.join(cacheDir, "oauth-tokens.db");
+        this.db = new Database(dbPath);
+        this.db.pragma("journal_mode = WAL");
+        this.db.pragma("synchronous = NORMAL");
+        this.initSchema();
+    }
+    initSchema() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS pats (
+        id         TEXT    NOT NULL PRIMARY KEY,
+        token      TEXT    NOT NULL UNIQUE,
+        subject    TEXT    NOT NULL,
+        label      TEXT    NOT NULL DEFAULT '',
+        scopes     TEXT    NOT NULL,
+        expires_at INTEGER,
+        created_at INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_pats_token     ON pats (token);
+      CREATE INDEX IF NOT EXISTS idx_pats_subject   ON pats (subject);
+      CREATE INDEX IF NOT EXISTS idx_pats_expires_at ON pats (expires_at);
+    `);
+        this.migrateNullableExpiry();
+    }
+    /** Migrate existing tables that have NOT NULL on expires_at to allow NULL. */
+    migrateNullableExpiry() {
+        const colInfo = this.db.pragma("table_info(pats)");
+        const col = colInfo.find((c) => c.name === "expires_at");
+        if (!col || col.notnull === 0)
+            return; // already nullable or column missing
+        this.db.pragma("foreign_keys = off");
+        const migrate = this.db.transaction(() => {
+            this.db
+                .prepare(`CREATE TABLE _pats_migrate (
+            id         TEXT    NOT NULL PRIMARY KEY,
+            token      TEXT    NOT NULL UNIQUE,
+            subject    TEXT    NOT NULL,
+            label      TEXT    NOT NULL DEFAULT '',
+            scopes     TEXT    NOT NULL,
+            expires_at INTEGER,
+            created_at INTEGER NOT NULL
+          )`)
+                .run();
+            this.db.prepare("INSERT INTO _pats_migrate SELECT * FROM pats").run();
+            this.db.prepare("DROP TABLE pats").run();
+            this.db.prepare("ALTER TABLE _pats_migrate RENAME TO pats").run();
+        });
+        migrate();
+        this.db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_pats_token      ON pats (token);
+      CREATE INDEX IF NOT EXISTS idx_pats_subject    ON pats (subject);
+      CREATE INDEX IF NOT EXISTS idx_pats_expires_at ON pats (expires_at);
+    `);
+        this.db.pragma("foreign_keys = on");
+    }
+    async create(subject, label, scopes, expiresAt) {
+        const id = randomUUID();
+        const token = randomBytes(32).toString("hex");
+        const createdAt = Date.now();
+        this.db
+            .prepare(`INSERT INTO pats (id, token, subject, label, scopes, expires_at, created_at)
+         VALUES (@id, @token, @subject, @label, @scopes, @expires_at, @created_at)`)
+            .run({
+            id,
+            token,
+            subject,
+            label,
+            scopes: JSON.stringify(scopes),
+            expires_at: expiresAt ?? null,
+            created_at: createdAt,
+        });
+        return { id, token, subject, label, scopes, expiresAt, createdAt };
+    }
+    async find(token) {
+        const row = this.db
+            .prepare("SELECT * FROM pats WHERE token = ? AND (expires_at IS NULL OR expires_at > ?)")
+            .get(token, Date.now());
+        if (!row)
+            return null;
+        return rowToPAT(row);
+    }
+    async list(subject) {
+        const rows = this.db
+            .prepare("SELECT * FROM pats WHERE subject = ? AND (expires_at IS NULL OR expires_at > ?) ORDER BY created_at DESC")
+            .all(subject, Date.now());
+        return rows.map(rowToPAT);
+    }
+    async revoke(id, subject) {
+        const result = this.db
+            .prepare("DELETE FROM pats WHERE id = ? AND subject = ?")
+            .run(id, subject);
+        return result.changes > 0;
+    }
+    async pruneExpired() {
+        this.db.prepare("DELETE FROM pats WHERE expires_at IS NOT NULL AND expires_at <= ?").run(Date.now());
+    }
+}
+/**
+ * Token-validation cache TTL. Matches AUTH_CACHE_TTL_MS in auth/supabase.ts,
+ * which has cached Supabase token auth the same way for some time.
+ */
+const PAT_CACHE_TTL_MS = 60 * 1000;
+/**
+ * Bound on cached tokens, so a flood of invalid bearer tokens cannot grow the
+ * map without limit. Evicts oldest-inserted first.
+ */
+const PAT_CACHE_MAX_ENTRIES = 1000;
+export class PostgresPATStore {
+    supabaseUrl;
+    serviceRoleKey;
+    /**
+     * Validation cache, keyed by raw token.
+     *
+     * find() runs on every bearer-authenticated request and was an uncached
+     * Supabase round trip — ~175ms, measured (GH #427). Worse, PATs are
+     * indistinguishable from OAuth tokens (both opaque hex), so PAT lookup runs
+     * first and every OAuth/MCP request paid that round trip for a query
+     * guaranteed to miss. Negative results are therefore cached too; that is
+     * where most of the saving is.
+     *
+     * Revocation stays immediate: revoke() and pruneExpired() clear the cache,
+     * and create() seeds it. Only out-of-band changes (direct SQL) wait out the
+     * TTL — the same tradeoff auth/supabase.ts already accepts.
+     */
+    cache = new Map();
+    constructor(supabaseUrl, serviceRoleKey) {
+        this.supabaseUrl = supabaseUrl.trim().replace(/\/$/, "");
+        this.serviceRoleKey = serviceRoleKey.trim();
+    }
+    cacheTtlMs() {
+        const raw = parseInt(process.env.BRAINS_PAT_CACHE_TTL_MS ?? "", 10);
+        return Number.isFinite(raw) && raw >= 0 ? raw : PAT_CACHE_TTL_MS;
+    }
+    cacheSet(token, pat) {
+        if (this.cache.size >= PAT_CACHE_MAX_ENTRIES) {
+            const oldest = this.cache.keys().next().value;
+            if (oldest !== undefined)
+                this.cache.delete(oldest);
+        }
+        this.cache.set(token, { pat, at: Date.now() });
+    }
+    /** Drop all cached validations. Called whenever a PAT is revoked or pruned. */
+    invalidateCache() {
+        this.cache.clear();
+    }
+    get baseUrl() {
+        return `${this.supabaseUrl}/rest/v1/pats`;
+    }
+    headers(extra) {
+        return {
+            apikey: this.serviceRoleKey,
+            authorization: `Bearer ${this.serviceRoleKey}`,
+            "content-type": "application/json",
+            prefer: "return=minimal",
+            ...extra,
+        };
+    }
+    async create(subject, label, scopes, expiresAt) {
+        const id = randomUUID();
+        const token = randomBytes(32).toString("hex");
+        const createdAt = Date.now();
+        const body = JSON.stringify({
+            id,
+            token,
+            subject,
+            label,
+            scopes: JSON.stringify(scopes),
+            expires_at: expiresAt, // null serializes as JSON null → Postgres NULL
+            created_at: createdAt,
+        });
+        const res = await fetch(this.baseUrl, { method: "POST", headers: this.headers(), body });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            throw new Error(`PostgresPATStore.create failed (${res.status}): ${text}`);
+        }
+        // Seed the cache so a freshly minted token cannot be defeated by a negative
+        // entry left behind by someone probing it before it existed.
+        this.cacheSet(token, { id, subject, label, scopes, expiresAt, createdAt });
+        return { id, token, subject, label, scopes, expiresAt, createdAt };
+    }
+    async find(token) {
+        const now = Date.now();
+        const ttl = this.cacheTtlMs();
+        const hit = this.cache.get(token);
+        if (hit && ttl > 0 && now - hit.at < ttl) {
+            // Re-check expiry on every hit: a token can lapse mid-TTL, and the cached
+            // record must not outlive its own expires_at.
+            if (hit.pat === null || hit.pat.expiresAt === null || hit.pat.expiresAt > now) {
+                return hit.pat;
+            }
+            this.cache.delete(token);
+        }
+        // expires_at IS NULL (never expires) OR expires_at > now
+        const url = `${this.baseUrl}?token=eq.${encodeURIComponent(token)}&or=(expires_at.is.null,expires_at.gt.${now})&limit=1`;
+        const res = await fetch(url, { method: "GET", headers: this.headers({ prefer: "return=representation" }) }).catch(() => null);
+        // Do not cache transport failures — a Supabase blip would otherwise pin
+        // every token to "invalid" for the whole TTL and lock users out.
+        if (!res || !res.ok)
+            return null;
+        const rows = (await res.json().catch(() => []));
+        const row = rows[0];
+        const pat = row ? postgresRowToPAT(row) : null;
+        this.cacheSet(token, pat);
+        return pat;
+    }
+    async list(subject) {
+        const now = Date.now();
+        const url = `${this.baseUrl}?subject=eq.${encodeURIComponent(subject)}&or=(expires_at.is.null,expires_at.gt.${now})&order=created_at.desc`;
+        const res = await fetch(url, { method: "GET", headers: this.headers({ prefer: "return=representation" }) }).catch(() => null);
+        if (!res || !res.ok)
+            return [];
+        const rows = (await res.json().catch(() => []));
+        return rows.map(postgresRowToPAT);
+    }
+    async revoke(id, subject) {
+        const url = `${this.baseUrl}?id=eq.${encodeURIComponent(id)}&subject=eq.${encodeURIComponent(subject)}`;
+        const res = await fetch(url, { method: "DELETE", headers: this.headers({ prefer: "return=representation" }) }).catch(() => null);
+        // Cleared unconditionally, before checking the result: revocation is
+        // security-sensitive, so a cached token must never outlive an attempt to
+        // revoke it. The cache is keyed by raw token and revoke() identifies the
+        // PAT by id, so there is nothing narrower to drop.
+        this.invalidateCache();
+        if (!res || !res.ok)
+            return false;
+        const rows = (await res.json().catch(() => []));
+        return rows.length > 0;
+    }
+    async pruneExpired() {
+        // Delete rows where expires_at IS NOT NULL AND expires_at <= now
+        const url = `${this.baseUrl}?expires_at=not.is.null&expires_at=lte.${Date.now()}`;
+        await fetch(url, { method: "DELETE", headers: this.headers() }).catch(() => null);
+        this.invalidateCache();
+    }
+}
+// ─── Factory ──────────────────────────────────────────────────────────────────
+export function createPATStore(storageLocation) {
+    const supabaseUrl = (process.env.SUPABASE_URL ?? "").trim();
+    const serviceRoleKey = (process.env.SUPABASE_SERVICE_ROLE_KEY ?? "").trim();
+    if (supabaseUrl && serviceRoleKey) {
+        return new PostgresPATStore(supabaseUrl, serviceRoleKey);
+    }
+    return new LocalSQLitePATStore(storageLocation);
+}
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+function rowToPAT(row) {
+    let scopes = [];
+    try {
+        scopes = JSON.parse(row.scopes);
+    }
+    catch {
+        scopes = [];
+    }
+    return {
+        id: row.id,
+        subject: row.subject,
+        label: row.label,
+        scopes,
+        expiresAt: row.expires_at,
+        createdAt: row.created_at,
+    };
+}
+function postgresRowToPAT(row) {
+    let scopes = [];
+    try {
+        scopes = JSON.parse(row.scopes);
+    }
+    catch {
+        scopes = [];
+    }
+    return {
+        id: row.id,
+        subject: row.subject,
+        label: row.label,
+        scopes,
+        expiresAt: row.expires_at !== null ? Number(row.expires_at) : null,
+        createdAt: Number(row.created_at),
+    };
+}
+//# sourceMappingURL=patStore.js.map

package/dist/auth/patStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patStore.js","sourceRoot":"","sources":["../../src/auth/patStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAEtC,iFAAiF;AAEjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AA0CvC,MAAM,OAAO,mBAAmB;IACb,EAAE,CAAoB;IAEvC,YAAY,eAAuB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;KAaZ,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAED,8EAA8E;IACtE,qBAAqB;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAA6C,CAAC;QAC/F,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,CAAC,qCAAqC;QAC5E,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACvC,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;;;;;;;YAQE,CACH;iBACA,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,EAAE,CAAC;YACtE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,CAAC;YACzC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,EAAE,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;QACV,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;KAIZ,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,KAAa,EAAE,MAAgB,EAAE,SAAwB;QACrF,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;mFAC2E,CAC5E;aACA,GAAG,CAAC;YACH,EAAE;YACF,KAAK;YACL,OAAO;YACP,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAC9B,UAAU,EAAE,SAAS,IAAI,IAAI;YAC7B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;QACL,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,+EAA+E,CAAC;aACxF,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAA6B,CAAC;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,0GAA0G,CAC3G;aACA,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAmB,CAAC;QAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAe;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CAAC,+CAA+C,CAAC;aACxD,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACpB,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mEAAmE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACvG,CAAC;CACF;AAcD;;;GAGG;AACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;GAGG;AACH,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,MAAM,OAAO,gBAAgB;IACV,WAAW,CAAS;IACpB,cAAc,CAAS;IAExC;;;;;;;;;;;;;OAaG;IACc,KAAK,GAAG,IAAI,GAAG,EAA2C,CAAC;IAE5E,YAAY,WAAmB,EAAE,cAAsB;QACrD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAEO,UAAU;QAChB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACnE,CAAC;IAEO,QAAQ,CAAC,KAAa,EAAE,GAAe;QAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,qBAAqB,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,+EAA+E;IAC/E,eAAe;QACb,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,IAAY,OAAO;QACjB,OAAO,GAAG,IAAI,CAAC,WAAW,eAAe,CAAC;IAC5C,CAAC;IAEO,OAAO,CAAC,KAA8B;QAC5C,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,aAAa,EAAE,UAAU,IAAI,CAAC,cAAc,EAAE;YAC9C,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,gBAAgB;YACxB,GAAG,KAAK;SACT,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,KAAa,EAAE,MAAgB,EAAE,SAAwB;QACrF,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,EAAE;YACF,KAAK;YACL,OAAO;YACP,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAC9B,UAAU,EAAE,SAAS,EAAE,+CAA+C;YACtE,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,4EAA4E;QAC5E,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC;YACzC,0EAA0E;YAC1E,8CAA8C;YAC9C,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC9E,OAAO,GAAG,CAAC,GAAG,CAAC;YACjB,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,yDAAyD;QACzD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,aAAa,kBAAkB,CAAC,KAAK,CAAC,yCAAyC,GAAG,WAAW,CAAC;QACzH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAE9H,wEAAwE;QACxE,iEAAiE;QACjE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAEjC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAqB,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,eAAe,kBAAkB,CAAC,OAAO,CAAC,yCAAyC,GAAG,yBAAyB,CAAC;QAC3I,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9H,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAqB,CAAC;QACpE,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAe;QACtC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,UAAU,kBAAkB,CAAC,EAAE,CAAC,eAAe,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACxG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjI,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,mDAAmD;QACnD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAc,CAAC;QAC7D,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,iEAAiE;QACjE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,0CAA0C,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAClF,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;CACF;AAED,iFAAiF;AAEjF,MAAM,UAAU,cAAc,CAAC,eAAuB;IACpD,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,IAAI,WAAW,IAAI,cAAc,EAAE,CAAC;QAClC,OAAO,IAAI,gBAAgB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;AAClD,CAAC;AAED,iFAAiF;AAEjF,SAAS,QAAQ,CAAC,GAAiB;IACjC,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAa,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,GAAG,EAAE,CAAC;IAAC,CAAC;IAC3E,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM;QACN,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAmB;IAC3C,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAa,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,GAAG,EAAE,CAAC;IAAC,CAAC;IAC3E,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM;QACN,SAAS,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QAClE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC"}

package/dist/auth/supabase.d.ts

@@ -0,0 +1,15 @@
+export declare class SupabaseAuthManager {
+    private readonly supabaseUrl;
+    private readonly anonKey;
+    private readonly cache;
+    constructor();
+    isEnabled(): boolean;
+    authenticateAccessToken(token: string): Promise<{
+        subject: string;
+        scopes: string[];
+    } | null>;
+    private fetchUser;
+    private resolveScopes;
+    private pruneExpired;
+}
+//# sourceMappingURL=supabase.d.ts.map

package/dist/auth/supabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../src/auth/supabase.ts"],"names":[],"mappings":"AAmBA,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;;IAOvD,SAAS,IAAI,OAAO;IAId,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;YAmBrF,SAAS;IAevB,OAAO,CAAC,aAAa;IAcrB,OAAO,CAAC,YAAY;CAQrB"}

package/dist/auth/supabase.js

@@ -0,0 +1,66 @@
+const AUTH_CACHE_TTL_MS = 60 * 1000;
+export class SupabaseAuthManager {
+    supabaseUrl;
+    anonKey;
+    cache = new Map();
+    constructor() {
+        this.supabaseUrl = (process.env.SUPABASE_URL ?? "").trim().replace(/\/$/, "");
+        this.anonKey = (process.env.SUPABASE_ANON_KEY ?? "").trim();
+    }
+    isEnabled() {
+        return this.supabaseUrl.length > 0 && this.anonKey.length > 0;
+    }
+    async authenticateAccessToken(token) {
+        if (!this.isEnabled())
+            return null;
+        this.pruneExpired();
+        const cached = this.cache.get(token);
+        if (cached)
+            return cached.auth;
+        const user = await this.fetchUser(token);
+        if (!user?.id)
+            return null;
+        const scopes = this.resolveScopes(user);
+        const auth = { subject: user.id, scopes };
+        this.cache.set(token, {
+            expiresAt: Date.now() + AUTH_CACHE_TTL_MS,
+            auth,
+        });
+        return auth;
+    }
+    async fetchUser(token) {
+        const url = `${this.supabaseUrl}/auth/v1/user`;
+        const response = await fetch(url, {
+            method: "GET",
+            headers: {
+                apikey: this.anonKey,
+                authorization: `Bearer ${token}`,
+            },
+        }).catch(() => null);
+        if (!response || !response.ok)
+            return null;
+        return (await response.json().catch(() => null));
+    }
+    resolveScopes(user) {
+        const configured = user.app_metadata?.brainsScopes;
+        if (Array.isArray(configured) && configured.length > 0) {
+            const normalized = configured
+                .filter((v) => typeof v === "string")
+                .map((v) => v.trim())
+                .filter((v) => v === "wiki.read" || v === "wiki.write");
+            if (normalized.length > 0)
+                return Array.from(new Set(normalized));
+        }
+        // Default for first rollout: authenticated users can read/write.
+        return ["wiki.read", "wiki.write"];
+    }
+    pruneExpired() {
+        const now = Date.now();
+        for (const [token, cached] of this.cache.entries()) {
+            if (cached.expiresAt <= now) {
+                this.cache.delete(token);
+            }
+        }
+    }
+}
+//# sourceMappingURL=supabase.js.map

package/dist/auth/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../src/auth/supabase.ts"],"names":[],"mappings":"AAiBA,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,MAAM,OAAO,mBAAmB;IACb,WAAW,CAAS;IACpB,OAAO,CAAS;IAChB,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEvD;QACE,IAAI,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,IAAI,CAAC;QAEnC,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;QAE/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,EAAE;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE;YACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB;YACzC,IAAI;SACL,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAa;QACnC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,eAAe,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;SACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAErB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE3C,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAwB,CAAC;IAC1E,CAAC;IAEO,aAAa,CAAC,IAAkB;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,UAAU;iBAC1B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;iBACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,YAAY,CAAC,CAAC;YAC1D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,iEAAiE;QACjE,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACrC,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACnD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/auth/tokenStore.d.ts

@@ -0,0 +1,73 @@
+/**
+ * OAuth token persistence layer — local session sync.
+ *
+ * Provides a `TokenStore` interface with two implementations:
+ *
+ *   - `LocalSQLiteTokenStore`  — SQLite-backed, stored next to the search
+ *     index under `<storageLocation>/.cache/oauth-tokens.db`.  Zero extra
+ *     dependencies (uses the already-bundled `better-sqlite3`).  Suitable
+ *     for single-instance local and Railway deployments.
+ *
+ *   - `PostgresTokenStore`     — Supabase PostgREST-backed, stored in an
+ *     `oauth_tokens` table.  Enables multi-instance / stateless deployments
+ *     where the process may restart without losing active sessions.  See
+ *     `scripts/oauth-tokens.sql` for the required migration.
+ *
+ * `createTokenStore()` auto-selects the backend based on env vars:
+ *   - `SUPABASE_URL` + `SUPABASE_SERVICE_ROLE_KEY` → PostgresTokenStore
+ *   - otherwise                                    → LocalSQLiteTokenStore
+ */
+export type TokenType = "auth_code" | "access_token" | "refresh_token";
+export interface StoredToken {
+    type: TokenType;
+    token: string;
+    clientId: string;
+    subject: string;
+    scope: string[];
+    expiresAt: number;
+    /** auth_code only */
+    redirectUri?: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: string;
+}
+export interface TokenStore {
+    save(record: StoredToken): Promise<void>;
+    find(type: TokenType, token: string): Promise<StoredToken | null>;
+    delete(type: TokenType, token: string): Promise<void>;
+    /** Delete all tokens of `type` for a given subject + client pair. */
+    deleteAllForSubject(subject: string, clientId: string, type: TokenType): Promise<void>;
+    /** Delete ALL tokens (all types, all clients) for a subject — used during account deletion. */
+    deleteAllTokensForSubject(subject: string): Promise<void>;
+    pruneExpired(): Promise<void>;
+}
+export declare class LocalSQLiteTokenStore implements TokenStore {
+    private readonly db;
+    constructor(storageLocation: string);
+    private initSchema;
+    save(record: StoredToken): Promise<void>;
+    find(type: TokenType, token: string): Promise<StoredToken | null>;
+    delete(type: TokenType, token: string): Promise<void>;
+    deleteAllForSubject(subject: string, clientId: string, type: TokenType): Promise<void>;
+    deleteAllTokensForSubject(subject: string): Promise<void>;
+    pruneExpired(): Promise<void>;
+}
+export declare class PostgresTokenStore implements TokenStore {
+    private readonly supabaseUrl;
+    private readonly serviceRoleKey;
+    constructor(supabaseUrl: string, serviceRoleKey: string);
+    private authHeaders;
+    private get baseUrl();
+    save(record: StoredToken): Promise<void>;
+    find(type: TokenType, token: string): Promise<StoredToken | null>;
+    delete(type: TokenType, token: string): Promise<void>;
+    deleteAllForSubject(subject: string, clientId: string, type: TokenType): Promise<void>;
+    deleteAllTokensForSubject(subject: string): Promise<void>;
+    pruneExpired(): Promise<void>;
+}
+/**
+ * Select and instantiate a token store based on the environment:
+ *   - SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY present → PostgresTokenStore
+ *   - otherwise → LocalSQLiteTokenStore (stored under `storageLocation/.cache/`)
+ */
+export declare function createTokenStore(storageLocation: string): TokenStore;
+//# sourceMappingURL=tokenStore.d.ts.map

package/dist/auth/tokenStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenStore.d.ts","sourceRoot":"","sources":["../../src/auth/tokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,cAAc,GAAG,eAAe,CAAC;AAEvE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,qEAAqE;IACrE,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,+FAA+F;IAC/F,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAkBD,qBAAa,qBAAsB,YAAW,UAAU;IACtD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAoB;gBAE3B,eAAe,EAAE,MAAM;IAUnC,OAAO,CAAC,UAAU;IAmBZ,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BxC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAWjE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMrD,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtF,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzD,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CAKpC;AAgBD,qBAAa,kBAAmB,YAAW,UAAU;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAE5B,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM;IAKvD,OAAO,CAAC,WAAW;IAUnB,OAAO,KAAK,OAAO,GAElB;IAEK,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBxC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAgBjE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAarD,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAatF,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAazD,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CAOpC;AAID;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,UAAU,CASpE"}