fluxmail 0.4.0 → 0.5.0

package/dist/auth.js

@@ -0,0 +1,452 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { hostname } from 'node:os';
+import { hash, verify } from '@node-rs/argon2';
+import { and, eq, gt, isNull, lte, sql } from 'drizzle-orm';
+import { EmailError } from '@fluxmail/core';
+import { accounts, apiKeys, authRateLimits, instanceSettings, memberAuthTokens, memberCredentials, memberSessions, members, } from './storage/db.js';
+import { authenticateApiKey } from './storage/apiKeys.js';
+import { addMember, findMember, getMember } from './storage/members.js';
+import { FULL_PERMISSION_POLICY } from './permissions.js';
+import { assertMemberLimit, getEntitlements } from './licensing/entitlements.js';
+const SESSION_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+const ENROLLMENT_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+const PASSWORD_RESET_TTL_MS = 60 * 60 * 1000;
+const RATE_WINDOW_MS = 15 * 60 * 1000;
+const SESSION_TOUCH_INTERVAL_MS = 60 * 60 * 1000;
+const COMMON_PASSWORDS = new Set([
+    '123456789012345',
+    'correcthorsebatterystaple',
+    'letmeinletmeinletmein',
+    'passwordpassword',
+    'qwertyqwertyqwerty',
+]);
+const ARGON_OPTIONS = {
+    algorithm: 2,
+    memoryCost: 19_456,
+    timeCost: 2,
+    parallelism: 1,
+    outputLen: 32,
+};
+const dummyPasswordHash = hash('fluxmail-invalid-login-padding', ARGON_OPTIONS);
+function secretHash(secret) {
+    return createHash('sha256').update(secret).digest('hex');
+}
+function normalizedEmail(email) {
+    const normalized = email.trim().toLowerCase();
+    if (normalized.length > 320 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/u.test(normalized)) {
+        throw new EmailError('invalid_request', 'Enter a valid member email address.');
+    }
+    return normalized;
+}
+function rateKey(kind, value) {
+    return `${kind}:${secretHash(value.trim().toLowerCase())}`;
+}
+function reserveLoginAttempt(db, emailKey, ipKey, now) {
+    return db.transaction((tx) => {
+        tx.delete(authRateLimits)
+            .where(lte(authRateLimits.windowStartedAt, now - RATE_WINDOW_MS))
+            .run();
+        const emailRow = tx.select().from(authRateLimits).where(eq(authRateLimits.key, emailKey)).get();
+        const ipRow = tx.select().from(authRateLimits).where(eq(authRateLimits.key, ipKey)).get();
+        if ((emailRow?.attempts ?? 0) >= 5 || (ipRow?.attempts ?? 0) >= 30)
+            return null;
+        const reserve = (key, row) => {
+            if (!row) {
+                tx.insert(authRateLimits).values({ key, attempts: 1, windowStartedAt: now }).run();
+                return now;
+            }
+            tx.update(authRateLimits)
+                .set({ attempts: row.attempts + 1 })
+                .where(eq(authRateLimits.key, key))
+                .run();
+            return row.windowStartedAt;
+        };
+        reserve(emailKey, emailRow);
+        return { ipWindowStartedAt: reserve(ipKey, ipRow) };
+    });
+}
+function releaseLoginAttempt(db, key, windowStartedAt) {
+    db.transaction((tx) => {
+        const row = tx
+            .select()
+            .from(authRateLimits)
+            .where(and(eq(authRateLimits.key, key), eq(authRateLimits.windowStartedAt, windowStartedAt)))
+            .get();
+        if (!row)
+            return;
+        if (row.attempts <= 1) {
+            tx.delete(authRateLimits).where(eq(authRateLimits.key, key)).run();
+            return;
+        }
+        tx.update(authRateLimits)
+            .set({ attempts: row.attempts - 1 })
+            .where(and(eq(authRateLimits.key, key), eq(authRateLimits.windowStartedAt, windowStartedAt)))
+            .run();
+    });
+}
+export function normalizeAndValidatePassword(password, member) {
+    const normalized = password.normalize('NFC');
+    const length = [...normalized].length;
+    if (length < 15 || length > 256) {
+        throw new EmailError('invalid_request', 'Password must contain between 15 and 256 characters.');
+    }
+    const lower = normalized.toLowerCase();
+    const context = [member?.name, member?.email, member?.email?.split('@')[0], 'fluxmail']
+        .filter((value) => Boolean(value && value.length >= 3))
+        .map((value) => value.toLowerCase());
+    if (COMMON_PASSWORDS.has(lower.trim()) || context.some((value) => lower.includes(value))) {
+        throw new EmailError('invalid_request', 'Choose a password that is not common or based on your member details.');
+    }
+    return normalized;
+}
+export async function hashPassword(password, member) {
+    return hash(normalizeAndValidatePassword(password, member), ARGON_OPTIONS);
+}
+async function passwordMatches(passwordHash, password) {
+    try {
+        return await verify(passwordHash, password.normalize('NFC'));
+    }
+    catch {
+        return false;
+    }
+}
+export function isBootstrapComplete(db) {
+    return db.select().from(instanceSettings).where(eq(instanceSettings.key, 'bootstrap_complete')).get()?.value === '1';
+}
+function markBootstrapComplete(db) {
+    db.insert(instanceSettings)
+        .values({ key: 'bootstrap_complete', value: '1' })
+        .onConflictDoUpdate({ target: instanceSettings.key, set: { value: '1' } })
+        .run();
+}
+async function replacePassword(db, member, password) {
+    const passwordHash = await hashPassword(password, member);
+    storePasswordHash(db, member.id, passwordHash);
+}
+function storePasswordHash(db, memberId, passwordHash) {
+    const current = db.select().from(memberCredentials).where(eq(memberCredentials.memberId, memberId)).get();
+    db.insert(memberCredentials)
+        .values({
+        memberId,
+        passwordHash,
+        passwordVersion: (current?.passwordVersion ?? 0) + 1,
+        updatedAt: Date.now(),
+    })
+        .onConflictDoUpdate({
+        target: memberCredentials.memberId,
+        set: {
+            passwordHash,
+            passwordVersion: (current?.passwordVersion ?? 0) + 1,
+            updatedAt: Date.now(),
+        },
+    })
+        .run();
+}
+export async function setupInitialAdmin(db, input) {
+    if (isBootstrapComplete(db))
+        throw new EmailError('invalid_request', 'This instance has already been set up.');
+    const existing = db.select().from(members).all();
+    let member;
+    if (existing.length === 0) {
+        if (!input.name?.trim())
+            throw new EmailError('invalid_request', 'Administrator name is required.');
+        const email = normalizedEmail(input.email);
+        const passwordHash = await hashPassword(input.password, {
+            name: input.name.trim(),
+            email,
+        });
+        member = addMember(db, {
+            name: input.name,
+            email,
+            role: 'admin',
+            status: 'pending',
+            completeBootstrap: false,
+        });
+        storePasswordHash(db, member.id, passwordHash);
+    }
+    else {
+        if (!input.existingAdmin) {
+            const candidates = existing
+                .filter((candidate) => candidate.role === 'admin')
+                .map((candidate) => `${candidate.id} (${candidate.name}${candidate.email ? `, ${candidate.email}` : ''})`)
+                .join(', ');
+            throw new EmailError('invalid_request', `Choose an existing administrator with --existing-admin. Available: ${candidates || 'none'}.`);
+        }
+        member = findMember(db, input.existingAdmin);
+        if (member.role !== 'admin')
+            throw new EmailError('permission_denied', 'The claimed member must be an administrator.');
+        const email = normalizedEmail(input.email);
+        const passwordHash = await hashPassword(input.password, { ...member, email });
+        db.update(members).set({ email, status: 'pending' }).where(eq(members.id, member.id)).run();
+        storePasswordHash(db, member.id, passwordHash);
+        db.update(accounts).set({ ownerMemberId: member.id }).where(isNull(accounts.ownerMemberId)).run();
+        member = getMember(db, member.id);
+    }
+    db.update(members).set({ status: 'active' }).where(eq(members.id, member.id)).run();
+    member = getMember(db, member.id);
+    markBootstrapComplete(db);
+    return { member, session: issueSession(db, member.id, input.deviceName ?? `CLI on ${hostname()}`) };
+}
+export function issueMemberAuthToken(db, input) {
+    const member = getMember(db, input.memberId);
+    if (member.status === 'suspended')
+        throw new EmailError('permission_denied', 'Suspended members cannot enroll or reset passwords.');
+    if (input.kind === 'enrollment') {
+        if (member.status !== 'pending') {
+            throw new EmailError('invalid_request', 'Enrollment codes can only be issued to pending members.');
+        }
+        if (!member.email) {
+            throw new EmailError('invalid_request', 'Set the member email before issuing an enrollment code.');
+        }
+    }
+    else if (member.status !== 'active') {
+        throw new EmailError('invalid_request', 'Password resets can only be issued to active members.');
+    }
+    const now = Date.now();
+    const expiresAt = now + (input.kind === 'enrollment' ? ENROLLMENT_TTL_MS : PASSWORD_RESET_TTL_MS);
+    const token = `fmt_${randomBytes(32).toString('hex')}`;
+    db.transaction((tx) => {
+        tx.delete(memberAuthTokens)
+            .where(and(eq(memberAuthTokens.memberId, member.id), eq(memberAuthTokens.kind, input.kind)))
+            .run();
+        tx.insert(memberAuthTokens)
+            .values({
+            id: `token_${randomBytes(8).toString('hex')}`,
+            memberId: member.id,
+            kind: input.kind,
+            tokenHash: secretHash(token),
+            createdByMemberId: input.createdByMemberId ?? null,
+            createdAt: now,
+            expiresAt,
+        })
+            .run();
+    });
+    return { token, expiresAt };
+}
+async function consumeMemberAuthToken(db, input) {
+    const now = Date.now();
+    const row = db
+        .select()
+        .from(memberAuthTokens)
+        .where(and(eq(memberAuthTokens.tokenHash, secretHash(input.token)), eq(memberAuthTokens.kind, input.kind), isNull(memberAuthTokens.usedAt), gt(memberAuthTokens.expiresAt, now)))
+        .get();
+    if (!row)
+        throw new EmailError('auth_expired', 'The enrollment or reset code is invalid, expired, or already used.');
+    let member = getMember(db, row.memberId);
+    if (member.status === 'suspended')
+        throw new EmailError('permission_denied', 'This member is suspended.');
+    if (input.kind === 'enrollment' && member.status !== 'pending') {
+        throw new EmailError('auth_expired', 'The enrollment or reset code is invalid, expired, or already used.');
+    }
+    if (input.kind === 'password_reset' && member.status !== 'active') {
+        throw new EmailError('auth_expired', 'The enrollment or reset code is invalid, expired, or already used.');
+    }
+    if (input.kind === 'enrollment') {
+        assertMemberLimit(Math.max(db.select().from(members).all().length - 1, 0), getEntitlements(db));
+    }
+    const passwordHash = await hashPassword(input.password, member);
+    const claimedAt = Date.now();
+    db.transaction((tx) => {
+        const claimed = tx
+            .update(memberAuthTokens)
+            .set({ usedAt: claimedAt })
+            .where(and(eq(memberAuthTokens.id, row.id), isNull(memberAuthTokens.usedAt), gt(memberAuthTokens.expiresAt, claimedAt)))
+            .run();
+        if (claimed.changes !== 1) {
+            throw new EmailError('auth_expired', 'The enrollment or reset code is invalid, expired, or already used.');
+        }
+        const credential = tx.select().from(memberCredentials).where(eq(memberCredentials.memberId, member.id)).get();
+        tx.insert(memberCredentials)
+            .values({
+            memberId: member.id,
+            passwordHash,
+            passwordVersion: (credential?.passwordVersion ?? 0) + 1,
+            updatedAt: claimedAt,
+        })
+            .onConflictDoUpdate({
+            target: memberCredentials.memberId,
+            set: {
+                passwordHash,
+                passwordVersion: (credential?.passwordVersion ?? 0) + 1,
+                updatedAt: claimedAt,
+            },
+        })
+            .run();
+        tx.update(memberSessions)
+            .set({ revokedAt: claimedAt })
+            .where(and(eq(memberSessions.memberId, member.id), isNull(memberSessions.revokedAt)))
+            .run();
+        if (input.kind === 'enrollment') {
+            tx.update(members).set({ status: 'active' }).where(eq(members.id, member.id)).run();
+        }
+    });
+    member = getMember(db, member.id);
+    return { member, session: issueSession(db, member.id, input.deviceName) };
+}
+export function enrollMember(db, input) {
+    return consumeMemberAuthToken(db, { ...input, kind: 'enrollment' });
+}
+export function resetPassword(db, input) {
+    return consumeMemberAuthToken(db, { ...input, kind: 'password_reset' });
+}
+export function issueSession(db, memberId, deviceName) {
+    const member = getMember(db, memberId);
+    if (member.status !== 'active')
+        throw new EmailError('permission_denied', 'This member is not active.');
+    const now = Date.now();
+    const id = `session_${randomBytes(8).toString('hex')}`;
+    const token = `fms_${randomBytes(32).toString('hex')}`;
+    const info = {
+        id,
+        memberId,
+        deviceName: deviceName.trim() || 'Unknown device',
+        createdAt: now,
+        expiresAt: now + SESSION_TTL_MS,
+        lastUsedAt: now,
+        current: true,
+    };
+    db.insert(memberSessions)
+        .values({
+        id: info.id,
+        memberId: info.memberId,
+        deviceName: info.deviceName,
+        createdAt: info.createdAt,
+        expiresAt: info.expiresAt,
+        lastUsedAt: info.lastUsedAt,
+        tokenHash: secretHash(token),
+        revokedAt: null,
+    })
+        .run();
+    return { token, info };
+}
+export async function loginWithPassword(db, input) {
+    if (!isBootstrapComplete(db))
+        throw new EmailError('permission_denied', 'This instance has not finished setup.');
+    const email = normalizedEmail(input.email);
+    const now = Date.now();
+    const emailKey = rateKey('email', email);
+    const ipKey = rateKey('ip', input.ipAddress || 'unknown');
+    const reservation = reserveLoginAttempt(db, emailKey, ipKey, now);
+    if (!reservation) {
+        throw new EmailError('rate_limited', 'Too many login attempts. Try again later.');
+    }
+    const memberRow = db
+        .select()
+        .from(members)
+        .where(sql `lower(${members.email}) = ${email}`)
+        .get();
+    const credential = memberRow
+        ? db.select().from(memberCredentials).where(eq(memberCredentials.memberId, memberRow.id)).get()
+        : undefined;
+    const matches = await passwordMatches(credential?.passwordHash ?? (await dummyPasswordHash), input.password);
+    if (!memberRow || !credential || !matches || memberRow.status !== 'active') {
+        throw new EmailError('permission_denied', 'Email or password is incorrect.');
+    }
+    db.delete(authRateLimits).where(eq(authRateLimits.key, emailKey)).run();
+    releaseLoginAttempt(db, ipKey, reservation.ipWindowStartedAt);
+    const member = getMember(db, memberRow.id);
+    return { member, session: issueSession(db, member.id, input.deviceName) };
+}
+export function authenticateBearer(db, token) {
+    if (token.startsWith('fmk_')) {
+        const auth = authenticateApiKey(db, token);
+        if (!auth)
+            return null;
+        return {
+            kind: 'api_key',
+            principalId: auth.keyId,
+            keyId: auth.keyId,
+            memberId: auth.memberId,
+            role: auth.role,
+            permissions: auth.permissions,
+            accountIds: auth.accountIds,
+        };
+    }
+    if (!token.startsWith('fms_'))
+        return null;
+    const now = Date.now();
+    const row = db
+        .select()
+        .from(memberSessions)
+        .where(eq(memberSessions.tokenHash, secretHash(token)))
+        .get();
+    if (!row || row.revokedAt !== null || row.expiresAt <= now)
+        return null;
+    const member = getMember(db, row.memberId);
+    if (member.status !== 'active')
+        return null;
+    if (now - row.lastUsedAt >= SESSION_TOUCH_INTERVAL_MS) {
+        db.update(memberSessions).set({ lastUsedAt: now }).where(eq(memberSessions.id, row.id)).run();
+    }
+    return {
+        kind: 'session',
+        principalId: row.id,
+        sessionId: row.id,
+        memberId: member.id,
+        role: member.role,
+        permissions: FULL_PERMISSION_POLICY,
+        accountIds: null,
+    };
+}
+export function listMemberSessions(db, memberId, currentSessionId) {
+    const now = Date.now();
+    return db
+        .select()
+        .from(memberSessions)
+        .where(eq(memberSessions.memberId, memberId))
+        .all()
+        .filter((row) => row.revokedAt === null && row.expiresAt > now)
+        .map((row) => ({
+        id: row.id,
+        memberId: row.memberId,
+        deviceName: row.deviceName,
+        createdAt: row.createdAt,
+        expiresAt: row.expiresAt,
+        lastUsedAt: row.lastUsedAt,
+        current: row.id === currentSessionId,
+    }));
+}
+export function revokeSession(db, memberId, sessionId) {
+    return (db
+        .update(memberSessions)
+        .set({ revokedAt: Date.now() })
+        .where(and(eq(memberSessions.id, sessionId), eq(memberSessions.memberId, memberId), isNull(memberSessions.revokedAt)))
+        .run().changes > 0);
+}
+export async function changePassword(db, input) {
+    const member = getMember(db, input.memberId);
+    const credential = db.select().from(memberCredentials).where(eq(memberCredentials.memberId, member.id)).get();
+    if (!credential || !(await passwordMatches(credential.passwordHash, input.currentPassword))) {
+        throw new EmailError('permission_denied', 'Current password is incorrect.');
+    }
+    await replacePassword(db, member, input.newPassword);
+    db.update(memberSessions)
+        .set({ revokedAt: Date.now() })
+        .where(and(eq(memberSessions.memberId, member.id), sql `${memberSessions.id} != ${input.keepSessionId}`, isNull(memberSessions.revokedAt)))
+        .run();
+}
+export async function recoverAdminPassword(db, ref, password) {
+    if (!isBootstrapComplete(db)) {
+        throw new EmailError('invalid_request', 'Finish instance setup before using administrator recovery.');
+    }
+    const member = findMember(db, ref);
+    if (member.role !== 'admin')
+        throw new EmailError('permission_denied', 'Break-glass recovery is limited to administrators.');
+    if (!member.email) {
+        throw new EmailError('invalid_request', 'Claim this administrator with setup before using break-glass recovery.');
+    }
+    const passwordHash = await hashPassword(password, member);
+    storePasswordHash(db, member.id, passwordHash);
+    if (member.status !== 'active')
+        db.update(members).set({ status: 'active' }).where(eq(members.id, member.id)).run();
+    db.update(memberSessions)
+        .set({ revokedAt: Date.now() })
+        .where(and(eq(memberSessions.memberId, member.id), isNull(memberSessions.revokedAt)))
+        .run();
+    markBootstrapComplete(db);
+    return getMember(db, member.id);
+}
+export function deleteAllApiKeys(db) {
+    return db.delete(apiKeys).run().changes;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EACL,QAAQ,EACR,OAAO,EACP,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,OAAO,GAER,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAoC,MAAM,sBAAsB,CAAC;AAC1G,OAAO,EAAE,sBAAsB,EAAyB,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEjF,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAClD,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7C,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,iBAAiB;IACjB,2BAA2B;IAC3B,uBAAuB;IACvB,kBAAkB;IAClB,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG;IACpB,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE,CAAC;IACd,SAAS,EAAE,EAAE;CACL,CAAC;AAEX,MAAM,iBAAiB,GAAG,IAAI,CAAC,gCAAgC,EAAE,aAAa,CAAC,CAAC;AAoChF,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,IAAoB,EAAE,KAAa;IAClD,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;AAC7D,CAAC;AAMD,SAAS,mBAAmB,CAC1B,EAAc,EACd,QAAgB,EAChB,KAAa,EACb,GAAW;IAEX,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QAC3B,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,GAAG,GAAG,cAAc,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAChG,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1F,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAEhF,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,GAAoB,EAAU,EAAE;YAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;gBACnF,OAAO,GAAG,CAAC;YACb,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;iBACtB,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;iBACnC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;iBAClC,GAAG,EAAE,CAAC;YACT,OAAO,GAAG,CAAC,eAAe,CAAC;QAC7B,CAAC,CAAC;QACF,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5B,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,EAAc,EAAE,GAAW,EAAE,eAAuB;IAC/E,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,GAAG,GAAG,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;aAC5F,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;YACtB,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACnE,OAAO;QACT,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;aACnC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;aAC5F,GAAG,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,QAAgB,EAAE,MAA2C;IACxG,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,sDAAsD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC;SACpF,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;SACvE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACvC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,uEAAuE,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,MAA2C;IAC9F,OAAO,IAAI,CAAC,4BAA4B,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,YAAoB,EAAE,QAAgB;IACnE,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAc;IAChD,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,KAAK,GAAG,CAAC;AACvH,CAAC;AAED,SAAS,qBAAqB,CAAC,EAAc;IAC3C,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;SACxB,MAAM,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;SACjD,kBAAkB,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;SACzE,GAAG,EAAE,CAAC;AACX,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,EAAc,EAAE,MAAkB,EAAE,QAAgB;IACjF,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAc,EAAE,QAAgB,EAAE,YAAoB;IAC/E,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC1G,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC;SACzB,MAAM,CAAC;QACN,QAAQ;QACR,YAAY;QACZ,eAAe,EAAE,CAAC,OAAO,EAAE,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC;QACpD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,iBAAiB,CAAC,QAAQ;QAClC,GAAG,EAAE;YACH,YAAY;YACZ,eAAe,EAAE,CAAC,OAAO,EAAE,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC;YACpD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB;KACF,CAAC;SACD,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAc,EACd,KAAsG;IAEtG,IAAI,mBAAmB,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;IACjD,IAAI,MAAkB,CAAC;IACvB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QACpG,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE;YACtD,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACvB,KAAK;SACN,CAAC,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE;YACrB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,SAAS;YACjB,iBAAiB,EAAE,KAAK;SACzB,CAAC,CAAC;QACH,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,QAAQ;iBACxB,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;iBACjD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;iBACzG,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,sEAAsE,UAAU,IAAI,MAAM,GAAG,CAC9F,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YACzB,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,8CAA8C,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5F,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/C,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClG,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACpF,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAClC,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,IAAI,UAAU,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;AACtG,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,EAAc,EACd,KAAkF;IAElF,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;QAC/B,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,qDAAqD,CAAC,CAAC;IACnG,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,yDAAyD,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,yDAAyD,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,uDAAuD,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACvD,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;aACxB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;aAC3F,GAAG,EAAE,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;aACxB,MAAM,CAAC;YACN,EAAE,EAAE,SAAS,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YAC7C,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;YAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,SAAS,EAAE,GAAG;YACd,SAAS;SACV,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,EAAc,EACd,KAAyF;IAEzF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,EAAE;SACX,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EACvD,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EACrC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAC/B,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,CACpC,CACF;SACA,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,oEAAoE,CAAC,CAAC;IACrH,IAAI,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;QAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;IAC1G,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,oEAAoE,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,oEAAoE,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAChC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,EAAE;aACf,MAAM,CAAC,gBAAgB,CAAC;aACxB,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;aAC1B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,EAC/B,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAC/B,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAC1C,CACF;aACA,GAAG,EAAE,CAAC;QACT,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,oEAAoE,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,UAAU,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9G,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC;YACN,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,YAAY;YACZ,eAAe,EAAE,CAAC,UAAU,EAAE,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC;YACvD,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,kBAAkB,CAAC;YAClB,MAAM,EAAE,iBAAiB,CAAC,QAAQ;YAClC,GAAG,EAAE;gBACH,YAAY;gBACZ,eAAe,EAAE,CAAC,UAAU,EAAE,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC;gBACvD,SAAS,EAAE,SAAS;aACrB;SACF,CAAC;aACD,GAAG,EAAE,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;aAC7B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;aACpF,GAAG,EAAE,CAAC;QACT,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACtF,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAClC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,EAAc,EACd,KAA8D;IAE9D,OAAO,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,EAAc,EACd,KAA8D;IAE9D,OAAO,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,EAAc,EACd,QAAgB,EAChB,UAAkB;IAElB,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;IACxG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,WAAW,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACvD,MAAM,IAAI,GAAgB;QACxB,EAAE;QACF,QAAQ;QACR,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,gBAAgB;QACjD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,cAAc;QAC/B,UAAU,EAAE,GAAG;QACf,OAAO,EAAE,IAAI;KACd,CAAC;IACF,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;QAC5B,SAAS,EAAE,IAAI;KAChB,CAAC;SACD,GAAG,EAAE,CAAC;IACT,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAc,EACd,KAAiF;IAEjF,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,SAAS,GAAG,EAAE;SACjB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAA,SAAS,OAAO,CAAC,KAAK,OAAO,KAAK,EAAE,CAAC;SAC9C,GAAG,EAAE,CAAC;IACT,MAAM,UAAU,GAAG,SAAS;QAC1B,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;QAC/F,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,YAAY,IAAI,CAAC,MAAM,iBAAiB,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7G,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;IAC/E,CAAC;IACD,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACxE,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAc,EAAE,KAAa;IAC9D,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,IAAI,CAAC,KAAK;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,EAAE;SACX,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;SACtD,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACxE,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,GAAG,GAAG,GAAG,CAAC,UAAU,IAAI,yBAAyB,EAAE,CAAC;QACtD,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAChG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,GAAG,CAAC,EAAE;QACnB,SAAS,EAAE,GAAG,CAAC,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,sBAAsB;QACnC,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAc,EAAE,QAAgB,EAAE,gBAAyB;IAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC5C,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC;SAC9D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,gBAAgB;KACrC,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAc,EAAE,QAAgB,EAAE,SAAiB;IAC/E,OAAO,CACL,EAAE;SACC,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;SAC9B,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAC/G;SACA,GAAG,EAAE,CAAC,OAAO,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAc,EACd,KAAgG;IAEhG,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9G,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,gCAAgC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACrD,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;SAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,EACtC,GAAG,CAAA,GAAG,cAAc,CAAC,EAAE,OAAO,KAAK,CAAC,aAAa,EAAE,EACnD,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CACjC,CACF;SACA,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAc,EAAE,GAAW,EAAE,QAAgB;IACtF,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4DAA4D,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QACzB,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,oDAAoD,CAAC,CAAC;IAClG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,wEAAwE,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACpH,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;SAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;SACpF,GAAG,EAAE,CAAC;IACT,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC1B,OAAO,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAc;IAC7C,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;AAC1C,CAAC"}

package/dist/authorization.d.ts

@@ -0,0 +1,9 @@
+import type { Account } from '@fluxmail/core';
+import type { Principal } from './auth.js';
+import { type AdminCapability, type Capability } from './permissions.js';
+export declare function canAccessAccount(principal: Principal, account: Account): boolean;
+export declare function canSeeAccountMetadata(principal: Principal, account: Account): boolean;
+export declare function allowsCapability(principal: Principal, capability: Capability): boolean;
+export declare function canAdminister(principal: Principal, capability: AdminCapability): boolean;
+export declare function canManageOwnedAccount(principal: Principal, account: Account): boolean;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAiB,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAExF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAMhF;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAMrF;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAEtF;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAIxF;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAErF"}

package/dist/authorization.js

@@ -0,0 +1,23 @@
+import { hasCapability } from './permissions.js';
+export function canAccessAccount(principal, account) {
+    const granted = account.ownerMemberId === principal.memberId ||
+        account.sharedWithAll ||
+        account.grantedMemberIds.includes(principal.memberId);
+    return granted && (principal.accountIds === null || principal.accountIds.includes(account.id));
+}
+export function canSeeAccountMetadata(principal, account) {
+    if (canAccessAccount(principal, account))
+        return true;
+    return (canAdminister(principal, 'admin.accounts') &&
+        (principal.accountIds === null || principal.accountIds.includes(account.id)));
+}
+export function allowsCapability(principal, capability) {
+    return principal.kind === 'session' || hasCapability(principal.permissions, capability);
+}
+export function canAdminister(principal, capability) {
+    return (principal.role === 'admin' && (principal.kind === 'session' || hasCapability(principal.permissions, capability)));
+}
+export function canManageOwnedAccount(principal, account) {
+    return principal.role === 'admin' || account.ownerMemberId === principal.memberId;
+}
+//# sourceMappingURL=authorization.js.map

package/dist/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAyC,MAAM,kBAAkB,CAAC;AAExF,MAAM,UAAU,gBAAgB,CAAC,SAAoB,EAAE,OAAgB;IACrE,MAAM,OAAO,GACX,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,QAAQ;QAC5C,OAAO,CAAC,aAAa;QACrB,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAoB,EAAE,OAAgB;IAC1E,IAAI,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,CACL,aAAa,CAAC,SAAS,EAAE,gBAAgB,CAAC;QAC1C,CAAC,SAAS,CAAC,UAAU,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAoB,EAAE,UAAsB;IAC3E,OAAO,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAoB,EAAE,UAA2B;IAC7E,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CACjH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAoB,EAAE,OAAgB;IAC1E,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,QAAQ,CAAC;AACpF,CAAC"}

package/dist/cli.d.ts

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
+import { serve } from '@hono/node-server';
 import { type ApiKeyInfo } from './storage/apiKeys.js';
 import { type PermissionPolicy } from './permissions.js';
+import { type Telemetry } from './telemetry.js';
 interface PermissionOptions {
     profile?: string;
     allow: string[];
@@ -9,8 +11,12 @@ interface PermissionOptions {
 }
 export declare function permissionPolicyFromOptions(opts: PermissionOptions, requireSelection?: boolean): PermissionPolicy;
 export declare function permissionPolicyForUpdate(opts: PermissionOptions, existing: Pick<ApiKeyInfo, 'permissionProfile'>): PermissionPolicy;
+export interface CliProgramOptions {
+    telemetry?: Telemetry;
+}
+export declare function waitForServerListening(server: ReturnType<typeof serve>): Promise<void>;
 /** Build the command tree without parsing arguments or running command actions. */
-export declare function createCliProgram(): Command;
+export declare function createCliProgram(options?: CliProgramOptions): Command;
 export declare function runCli(argv?: readonly string[]): Promise<void>;
 export {};
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuBpC,OAAO,EAML,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAC;AAgB9B,OAAO,EAQL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAqC1B,UAAU,iBAAiB;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAqBD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,UAAQ,GAAG,gBAAgB,CAoB/G;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,iBAAiB,EACvB,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,GAC9C,gBAAgB,CAQlB;AAyED,mFAAmF;AACnF,wBAAgB,gBAAgB,IAAI,OAAO,CA06B1C;AAED,wBAAsB,MAAM,CAAC,IAAI,GAAE,SAAS,MAAM,EAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQlF"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAOA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAsB1C,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAOpE,OAAO,EAQL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AAwCxB,UAAU,iBAAiB;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAcD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,UAAQ,GAAG,gBAAgB,CAoB/G;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,iBAAiB,EACvB,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,GAC9C,gBAAgB,CAQlB;AAuFD,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAwBD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAatF;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAy0CzE;AAED,wBAAsB,MAAM,CAAC,IAAI,GAAE,SAAS,MAAM,EAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUlF"}