indraq_cli 2.2.1 → 2.2.2

package/cloud-api/README.md

@@ -1,93 +1,101 @@
-# IndraQ Cloud API
-
-Control plane for IndraQ CLI v2.1. The public CLI endpoint is `https://cli.indraq.com`.
-
-## Responsibilities
-
-- authentication and organization RBAC (`user`, `manager`, `admin`)
-- provider scopes for AWS/NPM/Jenkins/GHCR
-- scope USE/MANAGE membership and audited delegation
-- encrypted provider scope secrets
-- per-user scope defaults
-- per-project/environment scope bindings
-- scope-native AWS/NPM/Jenkins identity mappings
-- self-service AWS key rotation and password lifecycle
-- projects, environments and project resource grants
-- audit logging
-
-## Requirements
-
-- Node.js 22+
-- PostgreSQL
-
-## Configure
-
-```bash
-npm install
-cp .env.example .env
-```
-
-Required values include:
-
-```env
-PORT=4010
-DATABASE_URL=postgresql://indraq:change-me@127.0.0.1:5432/indraq_cloud
-JWT_SECRET=replace-with-at-least-32-random-characters
-MASTER_KEY=replace-with-exactly-64-hex-characters
-BOOTSTRAP_ADMIN_EMAIL=admin@example.com
-BOOTSTRAP_ADMIN_PASSWORD=use-a-strong-password
-```
-
-`MASTER_KEY` must remain stable because provider scope secrets use AES-256-GCM encryption.
-
-## Build / run
-
-```bash
-npm run build
-npm start
-```
-
-Development:
-
-```bash
-npm run dev
-```
-
-Numbered migrations in `sql/` are applied automatically at startup. v2.1 adds:
-
-```text
-008_provider_scopes.sql
-```
-
-## v2.1 authorization model
-
-- **Admin** — creates/deletes scopes, grants MANAGE/USE, creates managers/admins, changes organization roles.
-- **Manager** — can add/remove normal users only inside scopes where the manager has MANAGE.
-- **User** — can use only assigned scopes and rotate only their own managed provider credentials.
-
-Scope membership operations and secret resolution require an audit reason and are written to `audit_logs`.
-
-## Provider scopes
-
-`provider_scopes` stores named organization accounts/controllers. `provider_scope_members` controls visibility and use. A user cannot discover a scope simply because it exists.
-
-Related v2.1 tables:
-
-- `provider_scopes`
-- `provider_scope_members`
-- `user_scope_defaults`
-- `project_environment_scopes`
-- `scope_external_accounts`
-- `scope_aws_credentials`
-
-## Projects
-
-Projects and infrastructure are durable. Deleting a user removes scope memberships/native identity mappings and the Cloud identity but retains shared project/environment/resource definitions. Ownership is reassigned before hard deletion where required.
-
-## Security notes
-
-- Passwords are bcrypt-hashed.
-- Provider secrets are encrypted with AES-256-GCM.
-- Secret-resolution responses are `Cache-Control: no-store` and audited.
-- Role/account state is re-read from PostgreSQL on protected requests so demotion/disable takes effect without waiting for JWT expiry.
-- Keep bootstrap credentials and `MASTER_KEY` out of source control.
+# IndraQ Cloud API
+
+Control plane for IndraQ CLI v2.2.2. The public CLI endpoint is `https://cli.indraq.com`.
+
+## Responsibilities
+
+- persistent CLI authentication sessions and organization RBAC (`user`, `manager`, `admin`)
+- provider scopes for AWS/NPM/Jenkins/GHCR
+- scope USE/MANAGE membership and audited delegation
+- encrypted provider scope secrets
+- per-user scope defaults
+- per-project/environment scope bindings
+- scope-native AWS/NPM/Jenkins identity mappings
+- self-service AWS key rotation and password lifecycle
+- projects, environments and project resource grants
+- audit logging
+
+## Requirements
+
+- Node.js 22+
+- PostgreSQL
+
+## Configure
+
+```bash
+npm install
+cp .env.example .env
+```
+
+Required values include:
+
+```env
+PORT=4010
+DATABASE_URL=postgresql://indraq:change-me@127.0.0.1:5432/indraq_cloud
+JWT_SECRET=replace-with-at-least-32-random-characters
+MASTER_KEY=replace-with-exactly-64-hex-characters
+BOOTSTRAP_ADMIN_EMAIL=admin@example.com
+BOOTSTRAP_ADMIN_PASSWORD=use-a-strong-password
+```
+
+`MASTER_KEY` must remain stable because provider scope secrets use AES-256-GCM encryption.
+
+## Build / run
+
+```bash
+npm run build
+npm start
+```
+
+Development:
+
+```bash
+npm run dev
+```
+
+Numbered migrations in `sql/` are applied automatically at startup. Current scope/session migrations include:
+
+```text
+008_provider_scopes.sql
+009_scope_user_secrets_and_project_lifecycle.sql
+010_persistent_auth_sessions.sql
+```
+
+## Authorization model
+
+- **Admin** — creates/deletes scopes, grants MANAGE/USE, creates managers/admins, changes organization roles.
+- **Manager** — can add/remove normal users only inside scopes where the manager has MANAGE.
+- **User** — can use only assigned scopes and rotate only their own managed provider credentials.
+
+Scope membership operations and secret resolution require an audit reason and are written to `audit_logs`.
+
+## Provider scopes
+
+`provider_scopes` stores named organization accounts/controllers. `provider_scope_members` controls visibility and use. A user cannot discover a scope simply because it exists.
+
+Related scope tables:
+
+- `provider_scopes`
+- `provider_scope_members`
+- `user_scope_defaults`
+- `project_environment_scopes`
+- `scope_external_accounts`
+- `scope_aws_credentials`
+
+## Projects
+
+Projects and infrastructure are durable. Deleting a user removes scope memberships/native identity mappings and the Cloud identity but retains shared project/environment/resource definitions. Ownership is reassigned before hard deletion where required.
+
+## Persistent CLI sessions
+
+A successful `/auth/login` creates a server-side `auth_sessions` row and returns an access JWT plus an opaque refresh token. The database stores only a SHA-256 hash of the refresh token. The CLI automatically calls `/auth/refresh` after access-token expiry and retries the original request, so normal users remain signed in until they explicitly logout or a security event revokes the session.
+
+`/auth/logout` revokes the session. Session-backed access JWTs include a session ID and the auth middleware checks that the corresponding session has not been revoked on every protected request. Still-valid legacy v2.2.1 JWTs may use `/auth/session` once to upgrade to the persistent model without another password prompt.
+
+## Security notes
+
+- Passwords are bcrypt-hashed.
+- Provider secrets are encrypted with AES-256-GCM.
+- Secret-resolution responses are `Cache-Control: no-store` and audited.
+- Role/account state is re-read from PostgreSQL on protected requests so demotion/disable takes effect without waiting for JWT expiry.
+- Keep bootstrap credentials and `MASTER_KEY` out of source control.

package/cloud-api/dist/index.js

@@ -5,7 +5,7 @@ import jwt from 'jsonwebtoken';
 import pg from 'pg';
 import nodemailer from 'nodemailer';
 import { IAMClient, CreateAccessKeyCommand, DeleteAccessKeyCommand, ListAccessKeysCommand } from '@aws-sdk/client-iam';
-import { createCipheriv, createDecipheriv, randomBytes, randomInt } from 'node:crypto';
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt } from 'node:crypto';
 import { isIP } from 'node:net';
 import { readdir, readFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
@@ -21,6 +21,13 @@ const masterHex = process.env.MASTER_KEY || '';
 if (!/^[a-fA-F0-9]{64}$/.test(masterHex))
     throw new Error('MASTER_KEY must be exactly 64 hex characters (32 bytes).');
 const masterKey = Buffer.from(masterHex, 'hex');
+const accessTokenFor = (user, sessionId) => jwt.sign({ id: user.id, email: user.email, role: user.role, sid: sessionId }, jwtSecret, { expiresIn: '1h' });
+const refreshHash = (token) => createHash('sha256').update(token).digest('hex');
+const createAuthSession = async (userId) => {
+    const refreshToken = randomBytes(48).toString('base64url');
+    const result = await pool.query('INSERT INTO auth_sessions(user_id,refresh_token_hash) VALUES($1,$2) RETURNING id', [userId, refreshHash(refreshToken)]);
+    return { sessionId: result.rows[0].id, refreshToken };
+};
 const encrypt = (text) => {
     const iv = randomBytes(12);
     const cipher = createCipheriv('aes-256-gcm', masterKey, iv);
@@ -49,15 +56,21 @@ const auth = async (req, res, next) => {
             return;
         }
         // Roles and account state are resolved from the database on every request.
-        // This makes admin/manager demotion and account disabling effective
-        // immediately instead of trusting a stale role embedded in a 12-hour JWT.
-        const current = await pool.query('SELECT id,email,name,role,is_active,must_change_password FROM users WHERE id=$1', [token.id]);
+        // Session-backed tokens also verify server-side revocation on every request,
+        // so `indraq logout` takes effect immediately. Legacy tokens without sid are
+        // temporarily accepted so a v2.2.1 CLI session can upgrade without re-login.
+        const current = token.sid
+            ? await pool.query(`SELECT u.id,u.email,u.name,u.role,u.is_active,u.must_change_password
+             FROM users u
+             JOIN auth_sessions s ON s.id=$2 AND s.user_id=u.id AND s.revoked_at IS NULL
+            WHERE u.id=$1`, [token.id, token.sid])
+            : await pool.query('SELECT id,email,name,role,is_active,must_change_password FROM users WHERE id=$1', [token.id]);
         const user = current.rows[0];
         if (!user || !user.is_active || !['user', 'manager', 'admin'].includes(user.role)) {
             res.status(401).json({ error: 'Account is disabled or no longer available' });
             return;
         }
-        req.auth = { id: user.id, email: user.email, name: user.name, role: user.role, mustChangePassword: !!user.must_change_password };
+        req.auth = { id: user.id, email: user.email, name: user.name, role: user.role, mustChangePassword: !!user.must_change_password, ...(token.sid ? { sessionId: token.sid } : {}) };
         if (user.must_change_password && !['/auth/me', '/auth/first-login-password'].includes(req.path)) {
             res.status(428).json({ error: 'Temporary password must be changed before using IndraQ. Run `indraq login` and complete the first-login password change.' });
             return;
@@ -467,8 +480,46 @@ app.post('/auth/login', async (req, res) => {
         return;
     }
     await pool.query('UPDATE users SET last_login_at=now() WHERE id=$1', [user.id]);
-    const token = jwt.sign({ id: user.id, email: user.email, role: user.role }, jwtSecret, { expiresIn: '12h' });
-    res.json({ token, user: { id: user.id, email: user.email, name: user.name, role: user.role, mustChangePassword: !!user.must_change_password } });
+    const session = await createAuthSession(user.id);
+    const token = accessTokenFor({ id: user.id, email: user.email, role: user.role }, session.sessionId);
+    res.setHeader('Cache-Control', 'no-store');
+    res.json({ token, refreshToken: session.refreshToken, user: { id: user.id, email: user.email, name: user.name, role: user.role, mustChangePassword: !!user.must_change_password } });
+});
+app.post('/auth/session', auth, async (req, res) => {
+    if (req.auth.sessionId) {
+        res.status(409).json({ error: 'This access token already belongs to a persistent session.' });
+        return;
+    }
+    const session = await createAuthSession(req.auth.id);
+    const token = accessTokenFor({ id: req.auth.id, email: req.auth.email, role: req.auth.role }, session.sessionId);
+    res.setHeader('Cache-Control', 'no-store');
+    res.json({ token, refreshToken: session.refreshToken });
+});
+app.post('/auth/refresh', async (req, res) => {
+    const refreshToken = String(req.body?.refreshToken || '');
+    if (!refreshToken) {
+        res.status(401).json({ error: 'Refresh token required' });
+        return;
+    }
+    const result = await pool.query(`SELECT s.id AS session_id,u.id,u.email,u.role,u.is_active
+       FROM auth_sessions s
+       JOIN users u ON u.id=s.user_id
+      WHERE s.refresh_token_hash=$1 AND s.revoked_at IS NULL`, [refreshHash(refreshToken)]);
+    const row = result.rows[0];
+    if (!row || !row.is_active) {
+        res.status(401).json({ error: 'Session is no longer valid' });
+        return;
+    }
+    await pool.query('UPDATE auth_sessions SET last_used_at=now() WHERE id=$1', [row.session_id]);
+    const token = accessTokenFor({ id: row.id, email: row.email, role: row.role }, row.session_id);
+    res.setHeader('Cache-Control', 'no-store');
+    res.json({ token, refreshToken });
+});
+app.post('/auth/logout', async (req, res) => {
+    const refreshToken = String(req.body?.refreshToken || '');
+    if (refreshToken)
+        await pool.query('UPDATE auth_sessions SET revoked_at=now() WHERE refresh_token_hash=$1 AND revoked_at IS NULL', [refreshHash(refreshToken)]);
+    res.status(204).end();
 });
 app.get('/auth/me', auth, (req, res) => res.json(req.auth));
 app.post('/auth/first-login-password', auth, async (req, res) => {
@@ -488,6 +539,8 @@ app.post('/auth/first-login-password', auth, async (req, res) => {
         return;
     }
     await pool.query('UPDATE users SET password_hash=$1,must_change_password=false,password_changed_at=now(),updated_at=now() WHERE id=$2', [await bcrypt.hash(newPassword, 12), req.auth.id]);
+    if (req.auth.sessionId)
+        await pool.query('UPDATE auth_sessions SET revoked_at=now() WHERE user_id=$1 AND id<>$2 AND revoked_at IS NULL', [req.auth.id, req.auth.sessionId]);
     await audit(req.auth.id, 'user.password.first-login', 'user', req.auth.id, 'Required first-login password change', { providers: external.map((item) => item.provider) });
     res.json({ ok: true, results: [{ provider: 'cloud', ok: true }, ...external] });
 });
@@ -553,6 +606,7 @@ app.post('/auth/password-reset/verify', async (req, res) => {
         results.push(...await resetManagedExternalPasswords(user.id, newPassword, targets));
     if (targets.includes('cloud')) {
         await pool.query('UPDATE users SET password_hash=$1,must_change_password=false,password_changed_at=now(),updated_at=now() WHERE id=$2', [await bcrypt.hash(newPassword, 12), user.id]);
+        await pool.query('UPDATE auth_sessions SET revoked_at=now() WHERE user_id=$1 AND revoked_at IS NULL', [user.id]);
         results.unshift({ provider: 'cloud', ok: true });
     }
     await pool.query('UPDATE password_reset_otps SET used_at=now() WHERE id=$1', [row.id]);
@@ -606,6 +660,7 @@ app.patch('/users/:id/password', ...allow('manager', 'admin'), async (req, res)
         return;
     }
     await pool.query('UPDATE users SET password_hash=$1,must_change_password=true,updated_at=now() WHERE id=$2', [await bcrypt.hash(password, 12), id]);
+    await pool.query('UPDATE auth_sessions SET revoked_at=now() WHERE user_id=$1 AND revoked_at IS NULL', [id]);
     await audit(req.auth.id, 'user.password.update', 'user', id, reason);
     res.status(204).end();
 });

package/cloud-api/node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@indraq/cloud-api",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/cloud-api/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@indraq/cloud-api",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@indraq/cloud-api",
-      "version": "0.7.0",
+      "version": "0.8.0",
       "dependencies": {
         "@aws-sdk/client-iam": "^3.1123.0",
         "bcryptjs": "^3.0.2",

package/cloud-api/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@indraq/cloud-api",
   "private": true,
-  "version": "0.7.0",
+  "version": "0.8.0",
   "type": "module",
   "scripts": {
     "dev": "tsx watch src/index.ts",

package/cloud-api/sql/010_persistent_auth_sessions.sql

@@ -0,0 +1,12 @@
+CREATE TABLE IF NOT EXISTS auth_sessions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  refresh_token_hash text NOT NULL UNIQUE,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  last_used_at timestamptz NOT NULL DEFAULT now(),
+  revoked_at timestamptz
+);
+
+CREATE INDEX IF NOT EXISTS auth_sessions_user_active_idx
+  ON auth_sessions(user_id)
+  WHERE revoked_at IS NULL;

package/cloud-api/src/index.ts

@@ -5,7 +5,7 @@ import jwt from 'jsonwebtoken';
 import pg from 'pg';
 import nodemailer from 'nodemailer';
 import { IAMClient, CreateAccessKeyCommand, DeleteAccessKeyCommand, ListAccessKeysCommand } from '@aws-sdk/client-iam';
-import { createCipheriv, createDecipheriv, randomBytes, randomInt } from 'node:crypto';
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt } from 'node:crypto';
 import { isIP } from 'node:net';
 import { readdir, readFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
@@ -23,7 +23,22 @@ if (!/^[a-fA-F0-9]{64}$/.test(masterHex)) throw new Error('MASTER_KEY must be ex
 const masterKey = Buffer.from(masterHex, 'hex');
 
 type Role = 'user' | 'manager' | 'admin';
-type Auth = { id: string; email: string; name: string; role: Role; mustChangePassword: boolean };
+type Auth = { id: string; email: string; name: string; role: Role; mustChangePassword: boolean; sessionId?: string };
+type AccessClaims = { id?: string; sid?: string };
+
+const accessTokenFor = (user: { id: string; email: string; role: Role }, sessionId: string): string =>
+  jwt.sign({ id: user.id, email: user.email, role: user.role, sid: sessionId }, jwtSecret, { expiresIn: '1h' });
+
+const refreshHash = (token: string): string => createHash('sha256').update(token).digest('hex');
+
+const createAuthSession = async (userId: string): Promise<{ sessionId: string; refreshToken: string }> => {
+  const refreshToken = randomBytes(48).toString('base64url');
+  const result = await pool.query(
+    'INSERT INTO auth_sessions(user_id,refresh_token_hash) VALUES($1,$2) RETURNING id',
+    [userId, refreshHash(refreshToken)]
+  );
+  return { sessionId: result.rows[0].id, refreshToken };
+};
 interface AuthedRequest extends Request { auth?: Auth }
 
 const encrypt = (text: string): string => {
@@ -46,17 +61,26 @@ const auth = async (req: AuthedRequest, res: Response, next: NextFunction): Prom
   const header = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;
   if (!header?.startsWith('Bearer ')) { res.status(401).json({ error: 'Authentication required' }); return; }
   try {
-    const token = jwt.verify(header.slice(7), jwtSecret) as Partial<Auth>;
+    const token = jwt.verify(header.slice(7), jwtSecret) as AccessClaims;
     if (!token.id) { res.status(401).json({ error: 'Invalid or expired token' }); return; }
     // Roles and account state are resolved from the database on every request.
-    // This makes admin/manager demotion and account disabling effective
-    // immediately instead of trusting a stale role embedded in a 12-hour JWT.
-    const current = await pool.query('SELECT id,email,name,role,is_active,must_change_password FROM users WHERE id=$1', [token.id]);
+    // Session-backed tokens also verify server-side revocation on every request,
+    // so `indraq logout` takes effect immediately. Legacy tokens without sid are
+    // temporarily accepted so a v2.2.1 CLI session can upgrade without re-login.
+    const current = token.sid
+      ? await pool.query(
+          `SELECT u.id,u.email,u.name,u.role,u.is_active,u.must_change_password
+             FROM users u
+             JOIN auth_sessions s ON s.id=$2 AND s.user_id=u.id AND s.revoked_at IS NULL
+            WHERE u.id=$1`,
+          [token.id, token.sid]
+        )
+      : await pool.query('SELECT id,email,name,role,is_active,must_change_password FROM users WHERE id=$1', [token.id]);
     const user = current.rows[0];
     if (!user || !user.is_active || !['user','manager','admin'].includes(user.role)) {
       res.status(401).json({ error: 'Account is disabled or no longer available' }); return;
     }
-    req.auth = { id: user.id, email: user.email, name: user.name, role: user.role as Role, mustChangePassword: !!user.must_change_password };
+    req.auth = { id: user.id, email: user.email, name: user.name, role: user.role as Role, mustChangePassword: !!user.must_change_password, ...(token.sid ? { sessionId: token.sid } : {}) };
     if (user.must_change_password && !['/auth/me','/auth/first-login-password'].includes(req.path)) {
       res.status(428).json({ error: 'Temporary password must be changed before using IndraQ. Run `indraq login` and complete the first-login password change.' }); return;
     }
@@ -515,9 +539,44 @@ app.post('/auth/login', async (req, res) => {
     res.status(401).json({ error: 'Invalid credentials' }); return;
   }
   await pool.query('UPDATE users SET last_login_at=now() WHERE id=$1', [user.id]);
-  const token = jwt.sign({ id: user.id, email: user.email, role: user.role }, jwtSecret, { expiresIn: '12h' });
-  res.json({ token, user: { id: user.id, email: user.email, name: user.name, role: user.role, mustChangePassword: !!user.must_change_password } });
+  const session = await createAuthSession(user.id);
+  const token = accessTokenFor({ id: user.id, email: user.email, role: user.role as Role }, session.sessionId);
+  res.setHeader('Cache-Control', 'no-store');
+  res.json({ token, refreshToken: session.refreshToken, user: { id: user.id, email: user.email, name: user.name, role: user.role, mustChangePassword: !!user.must_change_password } });
+});
+
+app.post('/auth/session', auth, async (req: AuthedRequest, res) => {
+  if (req.auth!.sessionId) { res.status(409).json({ error: 'This access token already belongs to a persistent session.' }); return; }
+  const session = await createAuthSession(req.auth!.id);
+  const token = accessTokenFor({ id: req.auth!.id, email: req.auth!.email, role: req.auth!.role }, session.sessionId);
+  res.setHeader('Cache-Control', 'no-store');
+  res.json({ token, refreshToken: session.refreshToken });
 });
+
+app.post('/auth/refresh', async (req, res) => {
+  const refreshToken = String(req.body?.refreshToken || '');
+  if (!refreshToken) { res.status(401).json({ error: 'Refresh token required' }); return; }
+  const result = await pool.query(
+    `SELECT s.id AS session_id,u.id,u.email,u.role,u.is_active
+       FROM auth_sessions s
+       JOIN users u ON u.id=s.user_id
+      WHERE s.refresh_token_hash=$1 AND s.revoked_at IS NULL`,
+    [refreshHash(refreshToken)]
+  );
+  const row = result.rows[0];
+  if (!row || !row.is_active) { res.status(401).json({ error: 'Session is no longer valid' }); return; }
+  await pool.query('UPDATE auth_sessions SET last_used_at=now() WHERE id=$1', [row.session_id]);
+  const token = accessTokenFor({ id: row.id, email: row.email, role: row.role as Role }, row.session_id);
+  res.setHeader('Cache-Control', 'no-store');
+  res.json({ token, refreshToken });
+});
+
+app.post('/auth/logout', async (req, res) => {
+  const refreshToken = String(req.body?.refreshToken || '');
+  if (refreshToken) await pool.query('UPDATE auth_sessions SET revoked_at=now() WHERE refresh_token_hash=$1 AND revoked_at IS NULL', [refreshHash(refreshToken)]);
+  res.status(204).end();
+});
+
 app.get('/auth/me', auth, (req: AuthedRequest, res) => res.json(req.auth));
 
 app.post('/auth/first-login-password', auth, async (req: AuthedRequest, res) => {
@@ -528,6 +587,7 @@ app.post('/auth/first-login-password', auth, async (req: AuthedRequest, res) =>
   const failed = external.filter((item) => !item.ok);
   if (failed.length) { res.status(502).json({ error: 'Could not rotate the temporary password on every managed provider. Retry or ask an admin.', results: external }); return; }
   await pool.query('UPDATE users SET password_hash=$1,must_change_password=false,password_changed_at=now(),updated_at=now() WHERE id=$2', [await bcrypt.hash(newPassword, 12), req.auth!.id]);
+  if (req.auth!.sessionId) await pool.query('UPDATE auth_sessions SET revoked_at=now() WHERE user_id=$1 AND id<>$2 AND revoked_at IS NULL', [req.auth!.id, req.auth!.sessionId]);
   await audit(req.auth!.id, 'user.password.first-login', 'user', req.auth!.id, 'Required first-login password change', { providers: external.map((item) => item.provider) });
   res.json({ ok: true, results: [{ provider: 'cloud', ok: true }, ...external] });
 });
@@ -569,6 +629,7 @@ app.post('/auth/password-reset/verify', async (req, res) => {
   if (targets.includes('npm') || targets.includes('jenkins')) results.push(...await resetManagedExternalPasswords(user.id, newPassword, targets));
   if (targets.includes('cloud')) {
     await pool.query('UPDATE users SET password_hash=$1,must_change_password=false,password_changed_at=now(),updated_at=now() WHERE id=$2', [await bcrypt.hash(newPassword, 12), user.id]);
+    await pool.query('UPDATE auth_sessions SET revoked_at=now() WHERE user_id=$1 AND revoked_at IS NULL', [user.id]);
     results.unshift({ provider: 'cloud', ok: true });
   }
   await pool.query('UPDATE password_reset_otps SET used_at=now() WHERE id=$1', [row.id]);
@@ -602,6 +663,7 @@ app.patch('/users/:id/password', ...allow('manager', 'admin'), async (req: Authe
   const password = String(req.body.password || '');
   if (password.length < 10) { res.status(400).json({ error: 'Password must be at least 10 characters.' }); return; }
   await pool.query('UPDATE users SET password_hash=$1,must_change_password=true,updated_at=now() WHERE id=$2', [await bcrypt.hash(password, 12), id]);
+  await pool.query('UPDATE auth_sessions SET revoked_at=now() WHERE user_id=$1 AND revoked_at IS NULL', [id]);
   await audit(req.auth!.id, 'user.password.update', 'user', id, reason);
   res.status(204).end();
 });

package/dist/cli/help-content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help-content.d.ts","sourceRoot":"","sources":["../../src/cli/help-content.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAC;AAMpH,eAAO,MAAM,oBAAoB,QAAO,MAqGvC,CAAC;AA6IF,eAAO,MAAM,YAAY,GAAI,OAAO,SAAS,KAAG,MAS/C,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,KAAG,SAAS,GAAG,SAa3D,CAAC"}
+{"version":3,"file":"help-content.d.ts","sourceRoot":"","sources":["../../src/cli/help-content.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAC;AAMpH,eAAO,MAAM,oBAAoB,QAAO,MAuGvC,CAAC;AAgJF,eAAO,MAAM,YAAY,GAAI,OAAO,SAAS,KAAG,MAS/C,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,KAAG,SAAS,GAAG,SAa3D,CAAC"}

package/dist/cli/help-content.js

@@ -9,16 +9,18 @@ const heading = (value) => chalk_1.default.bold(value);
 const command = (value) => chalk_1.default.cyan(value);
 const note = (value) => chalk_1.default.gray(value);
 const fullCommandReference = () => `
-${heading('IndraQ CLI v2.2 — scope-first infrastructure and deployment')}
+${heading('IndraQ CLI v2.2.2 — scope-first infrastructure and deployment')}
 
 ${heading('Start here')}
-  ${command('indraq login')}                              Sign in to https://cli.indraq.com
+  ${command('indraq login')}                              Sign in once; the session refreshes automatically until logout
+  ${command('indraq logout')}                             Revoke the persistent session and clear local session credentials
+  ${note('Login persists across builds and time; access tokens refresh automatically until you explicitly logout or a security event revokes the session.')}
   ${command('indraq scope list')}                         Show only provider scopes assigned to you
   ${command('indraq scope describe [nameOrId]')}          Identify a scope safely without revealing secrets
   ${command('indraq project status')}                     Review the current linked project
-  ${command('indraq project scopes --env dev')}           Choose project provider defaults for an environment
-  ${command('indraq prebuild --env dev')}                 Reconcile required/optional project infrastructure
-  ${command('indraq deploy:dev')}                         Build, push and deploy the dev environment
+  ${command('indraq project scopes --env <environment>')} Choose project provider defaults for a shared environment
+  ${command('indraq prebuild')}                           Choose a shared environment and reconcile infrastructure
+  ${command('indraq deploy')}                            Choose an available shared environment and deploy
 
 ${heading('Scopes — AWS / NPM / Jenkins / GHCR')}
   ${command('indraq scope list')}                         List scopes visible to your account
@@ -58,13 +60,13 @@ ${heading('Projects and project access')}
   ${command('indraq access delete user')}                 Revoke selected project resources
 
 ${heading('Prebuild and deploy')}
-  ${command('indraq prebuild --env dev')}                 Jenkins + GHCR required; DNS + NPM optional
-  ${command('indraq deploy:dev')}                         Deploy dev
-  ${command('indraq deploy:prod')}                        Deploy prod
-  ${command('indraq deploy --env staging')}               Deploy a named IndraQ project/resource environment
-  ${command('indraq deploy --env dev --select-scopes')}   Explicitly review/change saved scope bindings before deploy
-  ${command('indraq deployment create --env dev')}        Reconcile deployment infrastructure
-  ${command('indraq deployment run --env dev')}           Run deployment
+  ${command('indraq prebuild')}                           Choose an available shared environment and reconcile infrastructure
+  ${command('indraq prebuild --env <environment>')}       Reconcile one named shared environment directly
+  ${command('indraq deploy')}                            Choose an available shared environment and deploy
+  ${command('indraq deploy --env <environment>')}         Deploy one named shared environment directly
+  ${command('indraq deploy --env <environment> --select-scopes')} Explicitly review/change saved scope bindings before deploy
+  ${command('indraq deployment create --env <environment>')} Reconcile deployment infrastructure
+  ${command('indraq deployment run --env <environment>')} Run deployment
 
   ${note('--env selects an IndraQ deployment/resource environment. It does NOT load .env, .env.dev, or .env.prod files.')}
 
@@ -176,27 +178,30 @@ ${command('indraq password reset')}
 const deployHelp = () => `
 ${heading('Project scopes, prebuild and deployment')}
 
-${command('indraq project scopes --env dev')}
-  Select project/provider defaults from scopes visible to you. Jenkins and GHCR are
-  required for deployment. AWS and NPM scope links are optional.
+${command('indraq project scopes --env <environment>')}
+  Shows the scopes visible to you, then lets you explicitly choose which scope is linked
+  to that shared environment. Jenkins and GHCR are required; AWS and NPM are optional.
 
-${command('indraq prebuild --env dev')}
+${command('indraq prebuild')}
   Required: Jenkins + GHCR
   Optional Route53: Skip | Create/reconcile | Link existing
   Optional NPM:     Skip | Create/reconcile | Link existing
 
-${command('indraq deploy --env dev')}
-  Builds the Docker image, pushes it to the GHCR scope linked/defaulted for dev, then
-  runs the Jenkins deployment associated with the dev project environment. Normal
-  deployments reuse the saved project/environment scope bindings without prompting.
+${command('indraq deploy')}
+  Shows the available shared environments and lets you choose one. It then builds the
+  Docker image, pushes it to the GHCR scope linked to that exact environment, and runs
+  the matching Jenkins deployment. Existing project/environment scope bindings are reused.
 
-${command('indraq deploy --env dev --select-scopes')}
+${command('indraq deploy --env indraq-test-airtel')}
+  Skip the environment picker and deploy that exact shared environment.
+
+${command('indraq deploy --env <environment> --select-scopes')}
   Explicitly review or change the saved scope bindings before this deployment.
 
 ${note('--env is an IndraQ environment selector. Application environment files are part of your own Docker/build process and are not selected by this flag.')}
 `;
 const configureHelp = () => `
-${heading('Configuration in v2.2')}
+${heading('Configuration in v2.2.2')}
 
 Organization provider credentials are configured once as named scopes by an ADMIN.
 Managers and users do not create organization AWS/NPM/Jenkins/GHCR credentials.

package/dist/cli/help-content.js.map

@@ -1 +1 @@
-{"version":3,"file":"help-content.js","sourceRoot":"","sources":["../../src/cli/help-content.ts"],"names":[],"mappings":";;;;;;AAAA,kDAA0B;AAI1B,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEnD,MAAM,oBAAoB,GAAG,GAAW,EAAE,CAAC;EAChD,OAAO,CAAC,6DAA6D,CAAC;;EAEtE,OAAO,CAAC,YAAY,CAAC;IACnB,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,kCAAkC,CAAC;IAC3C,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,iCAAiC,CAAC;IAC1C,OAAO,CAAC,2BAA2B,CAAC;IACpC,OAAO,CAAC,mBAAmB,CAAC;;EAE9B,OAAO,CAAC,qCAAqC,CAAC;IAC5C,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,gCAAgC,CAAC;IACzC,OAAO,CAAC,kCAAkC,CAAC;IAC3C,OAAO,CAAC,sBAAsB,CAAC;IAC/B,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,iCAAiC,CAAC;IAC1C,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,8BAA8B,CAAC;;EAEzC,OAAO,CAAC,oBAAoB,CAAC;IAC3B,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,4BAA4B,CAAC;IACrC,OAAO,CAAC,+BAA+B,CAAC;IACxC,OAAO,CAAC,6CAA6C,CAAC;IACtD,OAAO,CAAC,+BAA+B,CAAC;IACxC,OAAO,CAAC,uBAAuB,CAAC;;EAElC,OAAO,CAAC,6BAA6B,CAAC;IACpC,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,8BAA8B,CAAC;IACvC,OAAO,CAAC,qBAAqB,CAAC;IAC9B,OAAO,CAAC,qBAAqB,CAAC;IAC9B,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,mCAAmC,CAAC;IAC5C,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,4BAA4B,CAAC;IACrC,OAAO,CAAC,8BAA8B,CAAC;IACvC,OAAO,CAAC,wBAAwB,CAAC;IACjC,OAAO,CAAC,wBAAwB,CAAC;IACjC,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,wBAAwB,CAAC;IACjC,OAAO,CAAC,2BAA2B,CAAC;;EAEtC,OAAO,CAAC,qBAAqB,CAAC;IAC5B,OAAO,CAAC,2BAA2B,CAAC;IACpC,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,6BAA6B,CAAC;IACtC,OAAO,CAAC,yCAAyC,CAAC;IAClD,OAAO,CAAC,oCAAoC,CAAC;IAC7C,OAAO,CAAC,iCAAiC,CAAC;;IAE1C,IAAI,CAAC,+GAA+G,CAAC;;EAEvH,OAAO,CAAC,SAAS,CAAC;IAChB,OAAO,CAAC,sCAAsC,CAAC;IAC/C,OAAO,CAAC,sCAAsC,CAAC;IAC/C,OAAO,CAAC,mCAAmC,CAAC;IAC5C,OAAO,CAAC,kCAAkC,CAAC;IAC3C,OAAO,CAAC,kCAAkC,CAAC;;IAE3C,IAAI,CAAC,2IAA2I,CAAC;;EAEnJ,OAAO,CAAC,KAAK,CAAC;IACZ,OAAO,CAAC,wBAAwB,CAAC;IACjC,OAAO,CAAC,8BAA8B,CAAC;IACvC,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,mCAAmC,CAAC;IAC5C,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,gCAAgC,CAAC;IACzC,OAAO,CAAC,yBAAyB,CAAC;;EAEpC,OAAO,CAAC,qBAAqB,CAAC;IAC5B,OAAO,CAAC,wBAAwB,CAAC;IACjC,OAAO,CAAC,8BAA8B,CAAC;IACvC,OAAO,CAAC,8BAA8B,CAAC;IACvC,OAAO,CAAC,8BAA8B,CAAC;;EAEzC,OAAO,CAAC,QAAQ,CAAC;IACf,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,6BAA6B,CAAC;IACtC,OAAO,CAAC,0BAA0B,CAAC;;EAErC,OAAO,CAAC,uBAAuB,CAAC;IAC9B,OAAO,CAAC,sBAAsB,CAAC;IAC/B,OAAO,CAAC,sCAAsC,CAAC;;EAEjD,OAAO,CAAC,cAAc,CAAC;IACrB,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,iBAAiB,CAAC;IAC1B,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,oBAAoB,CAAC;CAChC,CAAC;AArGW,QAAA,oBAAoB,wBAqG/B;AAEF,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC;EAC9B,OAAO,CAAC,iBAAiB,CAAC;;;;;EAK1B,OAAO,CAAC,WAAW,CAAC;;;;;EAKpB,OAAO,CAAC,UAAU,CAAC;IACjB,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,kCAAkC,CAAC;IAC3C,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,iCAAiC,CAAC;IAC1C,OAAO,CAAC,kCAAkC,CAAC;IAC3C,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,sBAAsB,CAAC;IAC/B,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,8BAA8B,CAAC;;EAEzC,IAAI,CAAC,gOAAgO,CAAC;CACvO,CAAC;AAEF,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC;EAC9B,OAAO,CAAC,4BAA4B,CAAC;;EAErC,OAAO,CAAC,kBAAkB,CAAC;;;EAG3B,OAAO,CAAC,4BAA4B,CAAC;;;EAGrC,OAAO,CAAC,oBAAoB,CAAC;;;;;EAK7B,OAAO,CAAC,uBAAuB,CAAC;;;;EAIhC,OAAO,CAAC,0BAA0B,CAAC;;;EAGnC,OAAO,CAAC,0CAA0C,CAAC;;;;EAInD,OAAO,CAAC,oBAAoB,CAAC;;;;EAI7B,OAAO,CAAC,uBAAuB,CAAC;;CAEjC,CAAC;AAEF,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC;EAC/B,OAAO,CAAC,yCAAyC,CAAC;;EAElD,OAAO,CAAC,iCAAiC,CAAC;;;;EAI1C,OAAO,CAAC,2BAA2B,CAAC;;;;;EAKpC,OAAO,CAAC,yBAAyB,CAAC;;;;;EAKlC,OAAO,CAAC,yCAAyC,CAAC;;;EAGlD,IAAI,CAAC,qJAAqJ,CAAC;CAC5J,CAAC;AAEF,MAAM,aAAa,GAAG,GAAW,EAAE,CAAC;EAClC,OAAO,CAAC,uBAAuB,CAAC;;;;;IAK9B,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,qBAAqB,CAAC;IAC9B,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,sBAAsB,CAAC;IAC/B,OAAO,CAAC,iCAAiC,CAAC;;;CAG7C,CAAC;AAEF,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC;EAC/B,OAAO,CAAC,uBAAuB,CAAC;;IAE9B,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,6BAA6B,CAAC;IACtC,OAAO,CAAC,0BAA0B,CAAC;;;;CAItC,CAAC;AAEF,MAAM,OAAO,GAAG,GAAW,EAAE,CAAC;EAC5B,OAAO,CAAC,oBAAoB,CAAC;;;IAG3B,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,yBAAyB,CAAC;;;IAGlC,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,mCAAmC,CAAC;IAC5C,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,yBAAyB,CAAC;CACrC,CAAC;AAEF,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC;EAC/B,OAAO,CAAC,eAAe,CAAC;;IAEtB,OAAO,CAAC,eAAe,CAAC;;;CAG3B,CAAC;AAEK,MAAM,YAAY,GAAG,CAAC,KAAgB,EAAU,EAAE;IACvD,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,aAAa,EAAE,CAAC;IAClD,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,EAAE,CAAC;IAC1C,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,EAAE,CAAC;IAC1C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IAClE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IAC5C,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,OAAO,EAAE,CAAC;IACtC,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IAC5C,OAAO,IAAA,4BAAoB,GAAE,CAAC;AAChC,CAAC,CAAC;AATW,QAAA,YAAY,gBASvB;AAEK,MAAM,cAAc,GAAG,CAAC,KAAc,EAAyB,EAAE;IACtE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IAC9E,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,UAAU,IAAI,UAAU,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC;IACjI,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACxH,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC;IACzG,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IACtE,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACnG,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACnH,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,aAAa,IAAI,UAAU,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IAC5G,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAbW,QAAA,cAAc,kBAazB"}
+{"version":3,"file":"help-content.js","sourceRoot":"","sources":["../../src/cli/help-content.ts"],"names":[],"mappings":";;;;;;AAAA,kDAA0B;AAI1B,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEnD,MAAM,oBAAoB,GAAG,GAAW,EAAE,CAAC;EAChD,OAAO,CAAC,+DAA+D,CAAC;;EAExE,OAAO,CAAC,YAAY,CAAC;IACnB,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,eAAe,CAAC;IACxB,IAAI,CAAC,iJAAiJ,CAAC;IACvJ,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,kCAAkC,CAAC;IAC3C,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,2CAA2C,CAAC;IACpD,OAAO,CAAC,iBAAiB,CAAC;IAC1B,OAAO,CAAC,eAAe,CAAC;;EAE1B,OAAO,CAAC,qCAAqC,CAAC;IAC5C,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,gCAAgC,CAAC;IACzC,OAAO,CAAC,kCAAkC,CAAC;IAC3C,OAAO,CAAC,sBAAsB,CAAC;IAC/B,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,iCAAiC,CAAC;IAC1C,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,8BAA8B,CAAC;;EAEzC,OAAO,CAAC,oBAAoB,CAAC;IAC3B,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,4BAA4B,CAAC;IACrC,OAAO,CAAC,+BAA+B,CAAC;IACxC,OAAO,CAAC,6CAA6C,CAAC;IACtD,OAAO,CAAC,+BAA+B,CAAC;IACxC,OAAO,CAAC,uBAAuB,CAAC;;EAElC,OAAO,CAAC,6BAA6B,CAAC;IACpC,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,8BAA8B,CAAC;IACvC,OAAO,CAAC,qBAAqB,CAAC;IAC9B,OAAO,CAAC,qBAAqB,CAAC;IAC9B,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,mCAAmC,CAAC;IAC5C,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,4BAA4B,CAAC;IACrC,OAAO,CAAC,8BAA8B,CAAC;IACvC,OAAO,CAAC,wBAAwB,CAAC;IACjC,OAAO,CAAC,wBAAwB,CAAC;IACjC,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,wBAAwB,CAAC;IACjC,OAAO,CAAC,2BAA2B,CAAC;;EAEtC,OAAO,CAAC,qBAAqB,CAAC;IAC5B,OAAO,CAAC,iBAAiB,CAAC;IAC1B,OAAO,CAAC,qCAAqC,CAAC;IAC9C,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,mCAAmC,CAAC;IAC5C,OAAO,CAAC,mDAAmD,CAAC;IAC5D,OAAO,CAAC,8CAA8C,CAAC;IACvD,OAAO,CAAC,2CAA2C,CAAC;;IAEpD,IAAI,CAAC,+GAA+G,CAAC;;EAEvH,OAAO,CAAC,SAAS,CAAC;IAChB,OAAO,CAAC,sCAAsC,CAAC;IAC/C,OAAO,CAAC,sCAAsC,CAAC;IAC/C,OAAO,CAAC,mCAAmC,CAAC;IAC5C,OAAO,CAAC,kCAAkC,CAAC;IAC3C,OAAO,CAAC,kCAAkC,CAAC;;IAE3C,IAAI,CAAC,2IAA2I,CAAC;;EAEnJ,OAAO,CAAC,KAAK,CAAC;IACZ,OAAO,CAAC,wBAAwB,CAAC;IACjC,OAAO,CAAC,8BAA8B,CAAC;IACvC,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,mCAAmC,CAAC;IAC5C,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,gCAAgC,CAAC;IACzC,OAAO,CAAC,yBAAyB,CAAC;;EAEpC,OAAO,CAAC,qBAAqB,CAAC;IAC5B,OAAO,CAAC,wBAAwB,CAAC;IACjC,OAAO,CAAC,8BAA8B,CAAC;IACvC,OAAO,CAAC,8BAA8B,CAAC;IACvC,OAAO,CAAC,8BAA8B,CAAC;;EAEzC,OAAO,CAAC,QAAQ,CAAC;IACf,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,6BAA6B,CAAC;IACtC,OAAO,CAAC,0BAA0B,CAAC;;EAErC,OAAO,CAAC,uBAAuB,CAAC;IAC9B,OAAO,CAAC,sBAAsB,CAAC;IAC/B,OAAO,CAAC,sCAAsC,CAAC;;EAEjD,OAAO,CAAC,cAAc,CAAC;IACrB,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,iBAAiB,CAAC;IAC1B,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,oBAAoB,CAAC;CAChC,CAAC;AAvGW,QAAA,oBAAoB,wBAuG/B;AAEF,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC;EAC9B,OAAO,CAAC,iBAAiB,CAAC;;;;;EAK1B,OAAO,CAAC,WAAW,CAAC;;;;;EAKpB,OAAO,CAAC,UAAU,CAAC;IACjB,OAAO,CAAC,mBAAmB,CAAC;IAC5B,OAAO,CAAC,kCAAkC,CAAC;IAC3C,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,iCAAiC,CAAC;IAC1C,OAAO,CAAC,kCAAkC,CAAC;IAC3C,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,sBAAsB,CAAC;IAC/B,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,8BAA8B,CAAC;;EAEzC,IAAI,CAAC,gOAAgO,CAAC;CACvO,CAAC;AAEF,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC;EAC9B,OAAO,CAAC,4BAA4B,CAAC;;EAErC,OAAO,CAAC,kBAAkB,CAAC;;;EAG3B,OAAO,CAAC,4BAA4B,CAAC;;;EAGrC,OAAO,CAAC,oBAAoB,CAAC;;;;;EAK7B,OAAO,CAAC,uBAAuB,CAAC;;;;EAIhC,OAAO,CAAC,0BAA0B,CAAC;;;EAGnC,OAAO,CAAC,0CAA0C,CAAC;;;;EAInD,OAAO,CAAC,oBAAoB,CAAC;;;;EAI7B,OAAO,CAAC,uBAAuB,CAAC;;CAEjC,CAAC;AAEF,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC;EAC/B,OAAO,CAAC,yCAAyC,CAAC;;EAElD,OAAO,CAAC,2CAA2C,CAAC;;;;EAIpD,OAAO,CAAC,iBAAiB,CAAC;;;;;EAK1B,OAAO,CAAC,eAAe,CAAC;;;;;EAKxB,OAAO,CAAC,wCAAwC,CAAC;;;EAGjD,OAAO,CAAC,mDAAmD,CAAC;;;EAG5D,IAAI,CAAC,qJAAqJ,CAAC;CAC5J,CAAC;AAEF,MAAM,aAAa,GAAG,GAAW,EAAE,CAAC;EAClC,OAAO,CAAC,yBAAyB,CAAC;;;;;IAKhC,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,qBAAqB,CAAC;IAC9B,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,sBAAsB,CAAC;IAC/B,OAAO,CAAC,iCAAiC,CAAC;;;CAG7C,CAAC;AAEF,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC;EAC/B,OAAO,CAAC,uBAAuB,CAAC;;IAE9B,OAAO,CAAC,yBAAyB,CAAC;IAClC,OAAO,CAAC,6BAA6B,CAAC;IACtC,OAAO,CAAC,0BAA0B,CAAC;;;;CAItC,CAAC;AAEF,MAAM,OAAO,GAAG,GAAW,EAAE,CAAC;EAC5B,OAAO,CAAC,oBAAoB,CAAC;;;IAG3B,OAAO,CAAC,uBAAuB,CAAC;IAChC,OAAO,CAAC,0BAA0B,CAAC;IACnC,OAAO,CAAC,yBAAyB,CAAC;;;IAGlC,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,mCAAmC,CAAC;IAC5C,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,yBAAyB,CAAC;CACrC,CAAC;AAEF,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC;EAC/B,OAAO,CAAC,eAAe,CAAC;;IAEtB,OAAO,CAAC,eAAe,CAAC;;;CAG3B,CAAC;AAEK,MAAM,YAAY,GAAG,CAAC,KAAgB,EAAU,EAAE;IACvD,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,aAAa,EAAE,CAAC;IAClD,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,EAAE,CAAC;IAC1C,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,EAAE,CAAC;IAC1C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IAClE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IAC5C,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,OAAO,EAAE,CAAC;IACtC,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IAC5C,OAAO,IAAA,4BAAoB,GAAE,CAAC;AAChC,CAAC,CAAC;AATW,QAAA,YAAY,gBASvB;AAEK,MAAM,cAAc,GAAG,CAAC,KAAc,EAAyB,EAAE;IACtE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IAC9E,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,UAAU,IAAI,UAAU,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC;IACjI,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACxH,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC;IACzG,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IACtE,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACnG,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACnH,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,aAAa,IAAI,UAAU,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IAC5G,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAbW,QAAA,cAAc,kBAazB"}