pipework 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The Constructory
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,128 @@
+# Pipework
+
+A TypeScript framework for multi-tenant SaaS applications. PostgreSQL-only. Owns the wiring between Drizzle, Fastify, Vitest, and Zod so your application code never has to.
+
+## What it does
+
+Pipework eliminates the infrastructure decisions that every SaaS backend makes independently and gets wrong:
+
+- **Database wiring** — named connections, pooling, context-aware `pipe()` accessor, test isolation
+- **Request context** — AsyncLocalStorage propagation of auth, tenant, transactions from HTTP entry to database query
+- **DI builder** — type-safe handler composition with `.use()`, `.auth()`, `.input()`, `.output()`, `.route()`, `.fit()`
+- **Multi-tenant scoping** — `SET LOCAL` propagation, tenant extraction from auth, UUID validation
+- **Auth chain** — pluggable strategies, enrichers, session management with JWT refresh rotation, cookie-based token delivery
+- **Multi-org auth** — org selection on login, org switching, membership management via `auth.createMultiOrg()`
+- **RBAC** — hierarchical scope resolution, permission caching, DI integration via `.permission()`
+- **Background jobs** — Postgres-backed queue with `SKIP LOCKED`, heartbeat, reaper, `LISTEN/NOTIFY`, synchronous wait (`jobs.enqueueAndWait`)
+- **Cron scheduling** — recurring jobs with cron expressions, dedup, catch-up on missed ticks
+- **Temporal records** — SCD Type 2 versioning with atomic `temporal.revise()`, point-in-time queries
+- **Resource CRUD** — `fixture` builder with cursor-based pagination, batch operations (preview + execute), auth, tenant scoping, 404/405
+- **Composable behaviors** — `behavior.compose()` to stack versioned + audited + cached on any resource
+- **State machines** — validated transitions with guards and audit integration
+- **Pipelines** — ordered sync/async step execution with persistent state and resume
+- **HTTP security** — CORS, Helmet, rate limiting via `http.createServer()`, production startup validation (refuses insecure defaults)
+- **Structured logging** — context-aware `log` proxy with automatic correlation fields (requestId, tenantId, userId, sessionId, traceId, jobType), configurable redaction, `X-Request-Id` response header
+- **OpenAPI** — automatic schema generation from handler metadata, served at `/openapi.json`
+
+## Quick example
+
+```typescript
+import { createPipework, http, pipe, fitting, schema } from 'pipework'
+
+const instance = createPipework({
+  databases: { app: { url: 'DATABASE_URL', testUrl: 'DATABASE_URL_TEST' } },
+})
+
+const createNote = fitting
+  .use('app')
+  .auth<{ userId: string; tenantId: string }>()
+  .input(schema.object({ title: schema.string(), body: schema.string() }))
+  .route('POST', '/notes')
+  .fit(async ({ app, auth, input }) => {
+    const [note] = await app
+      .insert(notes)
+      .values({ ...input, tenantId: auth.tenantId })
+      .returning()
+    return note
+  })
+
+const server = http.createServer(instance, {
+  auth: { strategy: myAuthStrategy },
+  tenant: { extract: (auth) => auth.tenantId },
+})
+
+server.registerHandlers([createNote])
+await server.listen()
+```
+
+## Install
+
+```bash
+pnpm add pipework
+```
+
+Includes `drizzle-orm`, `postgres`, `zod`, and `fastify` — no additional dependencies needed.
+
+Database operations, schema builders, and validation are all accessed through pipework's namespaces:
+
+```typescript
+import { pipe, schema } from 'pipework'
+
+// Database: table definitions, SQL, operators
+const users = pipe.table('users', {
+  id: pipe.col.uuid('id').primaryKey().defaultRandom(),
+  name: pipe.col.text('name').notNull(),
+})
+
+// Validation
+const input = schema.object({ name: schema.string().min(1) })
+```
+
+## Documentation
+
+- **[Getting Started](docs/getting-started.md)** — zero to running server
+- **Guides**
+  - [Configuration](docs/guides/configuration.md)
+  - [DI Builder & Handlers](docs/guides/handlers.md)
+  - [Authentication & Tenants](docs/guides/auth-and-tenants.md)
+  - [Background Jobs](docs/guides/jobs.md)
+  - [Cron Scheduling](docs/guides/cron.md)
+  - [Temporal Records](docs/guides/temporal.md)
+  - [Resource CRUD](docs/guides/resources.md)
+  - [Caching](docs/guides/caching.md)
+  - [State Machines](docs/guides/state-machines.md)
+  - [Pipelines](docs/guides/pipelines.md)
+  - [pgvector & Search](docs/guides/vector.md)
+  - [RBAC](docs/guides/rbac.md)
+  - [Audit Trail](docs/guides/audit.md)
+  - [HTTP Security](docs/guides/security.md)
+  - [Logging](docs/guides/logging.md)
+  - [OpenAPI](docs/guides/openapi.md)
+  - [Testing](docs/guides/testing.md)
+  - [Error Handling](docs/guides/errors.md)
+- **Recipes** — composing primitives for real use cases
+  - [Content Pipeline](docs/recipes/content-pipeline.md) — document lifecycle, versioning, chunking, embedding
+  - [Flexible Entities](docs/recipes/flexible-entities.md) — runtime-validated JSONB over fixed tables
+  - [Assertion Provenance](docs/recipes/assertion-provenance.md) — sourced claims, conflict detection, audit
+
+## Design principles
+
+1. **Resolution, not reimplementation.** Wraps Drizzle, Fastify, Vitest, and Zod. Doesn't replace them.
+2. **Constraints over conventions.** If a rule can be enforced in code, it is.
+3. **Fail at startup, not at first use.** Missing config throws immediately with what's wrong and how to fix it.
+4. **PostgreSQL-only.** No database abstraction. Build deep on Postgres features.
+5. **TypeScript strict mode.** `exactOptionalPropertyTypes`, `noUncheckedIndexedAccess` — all enabled.
+
+## Tech stack
+
+- **PostgreSQL** — the only supported database
+- **postgres.js** — connection driver
+- **Drizzle ORM** — schema-as-code, no binary runtime
+- **Zod** — runtime validation with TypeScript inference
+- **Fastify** — HTTP framework (wrapped, not replaced)
+- **Vitest** — test runner
+- **Pino** — structured logging
+
+## License
+
+MIT

package/bin/pipework.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import { run } from '../dist/cli/index.js'
+
+run(process.argv.slice(2))

package/dist/audit/emit.d.ts

@@ -0,0 +1,3 @@
+import type { AuditConfig, Audit } from './types.js';
+export declare function createAudit(config: AuditConfig): Audit;
+//# sourceMappingURL=emit.d.ts.map

package/dist/audit/emit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/audit/emit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAoB,KAAK,EAAE,MAAM,YAAY,CAAA;AAItE,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,CAyEtD"}

package/dist/audit/emit.js

@@ -0,0 +1,66 @@
+import { sql } from '../db/sql.js';
+import { getContext } from '../context/store.js';
+import { assertValidIdentifier, quoteIdentifier } from '../db/identifiers.js';
+export function createAudit(config) {
+    const table = config.table ?? 'pipework_audit_events';
+    assertValidIdentifier(table, 'audit table');
+    return {
+        async emit(options) {
+            const ctx = getContext();
+            if (!ctx) {
+                throw new Error('[pipework] audit.emit() called outside a managed context. ' +
+                    'It must run inside a request handler or job.');
+            }
+            if (ctx.tenant === null) {
+                throw new Error('[pipework] audit.emit() requires tenant context. ' +
+                    'Configure tenant extraction in createServer().');
+            }
+            if (ctx.auth === null) {
+                throw new Error('[pipework] audit.emit() requires authenticated context. ' +
+                    'Ensure the handler uses .auth() or the route is not .public().');
+            }
+            const userId = extractUserId(ctx.auth);
+            if (userId === null) {
+                throw new Error('[pipework] audit.emit() requires auth.userId. ' +
+                    'Ensure the auth object has a userId field.');
+            }
+            const bound = ctx.transactions.get(config.database);
+            if (!bound) {
+                throw new Error(`[pipework] audit.emit() requires an active transaction on database "${config.database}". ` +
+                    `Configure transactionPerRequest: ['${config.database}'] in createServer().`);
+            }
+            const tx = bound.drizzle;
+            const sessionId = config.sessionIdField !== undefined && typeof ctx.auth === 'object'
+                ? ctx.auth[config.sessionIdField] ?? null
+                : null;
+            const beforeJson = options.before !== undefined ? JSON.stringify(options.before) : null;
+            const afterJson = options.after !== undefined ? JSON.stringify(options.after) : null;
+            const metadataJson = options.metadata !== undefined ? JSON.stringify(options.metadata) : null;
+            const result = await tx.execute(sql `
+        INSERT INTO ${sql.raw(quoteIdentifier(table, 'audit table'))} (tenant_id, request_id, user_id, session_id, action_type, entity_type, entity_id, before_state, after_state, metadata)
+        VALUES (
+          ${ctx.tenant},
+          ${ctx.requestId},
+          ${userId},
+          ${sessionId ?? null},
+          ${options.actionType},
+          ${options.entityType ?? null},
+          ${options.entityId ?? null},
+          ${beforeJson !== null ? sql `${beforeJson}::jsonb` : sql `NULL`},
+          ${afterJson !== null ? sql `${afterJson}::jsonb` : sql `NULL`},
+          ${metadataJson !== null ? sql `${metadataJson}::jsonb` : sql `NULL`}
+        )
+        RETURNING id::text
+      `);
+            return result[0].id;
+        },
+    };
+}
+function extractUserId(auth) {
+    if (auth !== null && auth !== undefined && typeof auth === 'object' && 'userId' in auth) {
+        const val = auth.userId;
+        return typeof val === 'string' ? val : null;
+    }
+    return null;
+}
+//# sourceMappingURL=emit.js.map

package/dist/audit/emit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../src/audit/emit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE7E,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAA;IACrD,qBAAqB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;IAE3C,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAyB;YAClC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;YACxB,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CACb,4DAA4D;oBAC5D,8CAA8C,CAC/C,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,mDAAmD;oBACnD,gDAAgD,CACjD,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,0DAA0D;oBAC1D,gEAAgE,CACjE,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,gDAAgD;oBAChD,4CAA4C,CAC7C,CAAA;YACH,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACnD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,QAAQ,KAAK;oBAC3F,sCAAsC,MAAM,CAAC,QAAQ,uBAAuB,CAC7E,CAAA;YACH,CAAC;YACD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAA;YAExB,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;gBACnF,CAAC,CAAE,GAAG,CAAC,IAAgC,CAAC,MAAM,CAAC,cAAc,CAAkB,IAAI,IAAI;gBACvF,CAAC,CAAC,IAAI,CAAA;YAER,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACvF,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACpF,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAE7F,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;sBACnB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;;YAExD,GAAG,CAAC,MAAM;YACV,GAAG,CAAC,SAAS;YACb,MAAM;YACN,SAAS,IAAI,IAAI;YACjB,OAAO,CAAC,UAAU;YAClB,OAAO,CAAC,UAAU,IAAI,IAAI;YAC1B,OAAO,CAAC,QAAQ,IAAI,IAAI;YACxB,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA,GAAG,UAAU,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM;YAC3D,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA,GAAG,SAAS,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM;YACzD,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM;;;OAGpE,CAAC,CAAA;YAEF,OAAQ,MAAM,CAAC,CAAC,CAAoB,CAAC,EAAE,CAAA;QACzC,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACxF,MAAM,GAAG,GAAI,IAA4B,CAAC,MAAM,CAAA;QAChD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/audit/index.d.ts

@@ -0,0 +1,3 @@
+export type { AuditConfig, AuditEmitOptions, Audit } from './types.js';
+export { createAudit } from './emit.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA"}

package/dist/audit/index.js

@@ -0,0 +1,2 @@
+export { createAudit } from './emit.js';
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA"}

package/dist/audit/namespace.d.ts

@@ -0,0 +1,5 @@
+import { createAudit } from './index.js';
+export declare const audit: {
+    create: typeof createAudit;
+};
+//# sourceMappingURL=namespace.d.ts.map

package/dist/audit/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/audit/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,eAAO,MAAM,KAAK;;CAEjB,CAAA"}

package/dist/audit/namespace.js

@@ -0,0 +1,5 @@
+import { createAudit } from './index.js';
+export const audit = {
+    create: createAudit,
+};
+//# sourceMappingURL=namespace.js.map

package/dist/audit/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../src/audit/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,MAAM,EAAE,WAAW;CACpB,CAAA"}

package/dist/audit/types.d.ts

@@ -0,0 +1,17 @@
+export interface AuditConfig {
+    readonly database: string;
+    readonly table?: string;
+    readonly sessionIdField?: string;
+}
+export interface AuditEmitOptions {
+    readonly actionType: string;
+    readonly entityType?: string;
+    readonly entityId?: string;
+    readonly before?: unknown;
+    readonly after?: unknown;
+    readonly metadata?: Record<string, unknown>;
+}
+export interface Audit {
+    emit(options: AuditEmitOptions): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/audit/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC5C;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACjD"}

package/dist/audit/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/audit/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":""}

package/dist/auth/chain.d.ts

@@ -0,0 +1,21 @@
+import type { AuthStrategy, AuthRequest } from './types.js';
+export interface AuthEnricher<TAuth> {
+    readonly name: string;
+    enrich(auth: TAuth): Promise<TAuth>;
+}
+export interface TenantResolver<TAuth> {
+    resolve(auth: TAuth): string;
+}
+export interface AuthChainConfig<TAuth> {
+    readonly strategies: readonly AuthStrategy<TAuth>[];
+    readonly enrichers?: readonly AuthEnricher<TAuth>[];
+    readonly tenantResolver?: TenantResolver<TAuth>;
+}
+export interface AuthChainResult<TAuth> {
+    readonly auth: TAuth | null;
+    readonly tenant: string | null;
+}
+export declare function runAuthChain<TAuth>(config: AuthChainConfig<TAuth>, request: AuthRequest, options: {
+    optional: boolean;
+}): Promise<AuthChainResult<TAuth>>;
+//# sourceMappingURL=chain.d.ts.map

package/dist/auth/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/auth/chain.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAG3D,MAAM,WAAW,YAAY,CAAC,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;CACpC;AAED,MAAM,WAAW,cAAc,CAAC,KAAK;IACnC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,eAAe,CAAC,KAAK;IACpC,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,CAAC,KAAK,CAAC,EAAE,CAAA;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,CAAC,KAAK,CAAC,EAAE,CAAA;IACnD,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAA;CAChD;AAED,MAAM,WAAW,eAAe,CAAC,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,wBAAsB,YAAY,CAAC,KAAK,EACtC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,EAC9B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAqCjC"}

package/dist/auth/chain.js

@@ -0,0 +1,45 @@
+import { UnauthorizedError } from '../errors/index.js';
+export async function runAuthChain(config, request, options) {
+    let extracted = null;
+    let matchedStrategy = null;
+    for (const strategy of config.strategies) {
+        extracted = await strategy.extract(request);
+        if (extracted !== null) {
+            matchedStrategy = strategy;
+            break;
+        }
+    }
+    if (extracted === null) {
+        if (options.optional)
+            return { auth: null, tenant: null };
+        throw new UnauthorizedError();
+    }
+    let auth;
+    try {
+        auth = await matchedStrategy.verify(extracted);
+    }
+    catch (error) {
+        if (error instanceof UnauthorizedError)
+            throw error;
+        throw new UnauthorizedError('Authentication failed', {
+            strategy: matchedStrategy.name,
+            cause: error instanceof Error ? error.message : String(error),
+        });
+    }
+    if (config.enrichers) {
+        for (const enricher of config.enrichers) {
+            auth = await enricher.enrich(auth);
+        }
+    }
+    const tenant = config.tenantResolver ? config.tenantResolver.resolve(auth) : extractTenant(auth);
+    return { auth, tenant };
+}
+function extractTenant(auth) {
+    if (auth !== null && typeof auth === 'object' && 'tenantId' in auth) {
+        const tenantId = auth.tenantId;
+        if (typeof tenantId === 'string')
+            return tenantId;
+    }
+    return null;
+}
+//# sourceMappingURL=chain.js.map

package/dist/auth/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/auth/chain.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAsBtD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA8B,EAC9B,OAAoB,EACpB,OAA8B;IAE9B,IAAI,SAAS,GAAiB,IAAI,CAAA;IAClC,IAAI,eAAe,GAA+B,IAAI,CAAA;IAEtD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACzC,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,eAAe,GAAG,QAAQ,CAAA;YAC1B,MAAK;QACP,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QACzD,MAAM,IAAI,iBAAiB,EAAE,CAAA;IAC/B,CAAC;IAED,IAAI,IAAW,CAAA;IACf,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,eAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,KAAK,CAAA;QACnD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,EAAE;YACnD,QAAQ,EAAE,eAAgB,CAAC,IAAI;YAC/B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAEhG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAI,IAA8B,CAAC,QAAQ,CAAA;QACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAA;IACnD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/auth/cookie.d.ts

@@ -0,0 +1,18 @@
+export interface CookieConfig {
+    readonly name?: string;
+    readonly secure?: 'auto' | boolean;
+    readonly sameSite?: 'strict' | 'lax' | 'none';
+    readonly path?: string;
+}
+export interface ResolvedCookieConfig {
+    readonly name: string;
+    readonly secure: boolean;
+    readonly sameSite: string;
+    readonly path: string;
+    readonly httpOnly: true;
+}
+export declare function resolveCookieConfig(cookie: CookieConfig, env: string): ResolvedCookieConfig;
+export declare function buildSetCookieHeader(resolved: ResolvedCookieConfig, value: string, maxAge: number): string;
+export declare function buildClearCookieHeader(resolved: ResolvedCookieConfig): string;
+export declare function parseCookieHeader(header: string | undefined, name: string): string | undefined;
+//# sourceMappingURL=cookie.d.ts.map

package/dist/auth/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../src/auth/cookie.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAY3F;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAU1G;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAU7E;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAY9F"}

package/dist/auth/cookie.js

@@ -0,0 +1,55 @@
+export function resolveCookieConfig(cookie, env) {
+    const secure = cookie.secure === 'auto' || cookie.secure === undefined
+        ? env === 'production'
+        : cookie.secure;
+    return {
+        name: cookie.name ?? '__pipework_refresh',
+        secure,
+        sameSite: cookie.sameSite ?? 'strict',
+        path: cookie.path ?? '/',
+        httpOnly: true,
+    };
+}
+export function buildSetCookieHeader(resolved, value, maxAge) {
+    const parts = [
+        `${resolved.name}=${encodeURIComponent(value)}`,
+        `HttpOnly`,
+        `Path=${resolved.path}`,
+        `Max-Age=${maxAge}`,
+        `SameSite=${capitalize(resolved.sameSite)}`,
+    ];
+    if (resolved.secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}
+export function buildClearCookieHeader(resolved) {
+    const parts = [
+        `${resolved.name}=`,
+        `HttpOnly`,
+        `Path=${resolved.path}`,
+        `Max-Age=0`,
+        `SameSite=${capitalize(resolved.sameSite)}`,
+    ];
+    if (resolved.secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}
+export function parseCookieHeader(header, name) {
+    if (header === undefined)
+        return undefined;
+    for (const pair of header.split(';')) {
+        const trimmed = pair.trim();
+        const eqIdx = trimmed.indexOf('=');
+        if (eqIdx === -1)
+            continue;
+        const key = trimmed.slice(0, eqIdx).trim();
+        if (key === name) {
+            return decodeURIComponent(trimmed.slice(eqIdx + 1).trim());
+        }
+    }
+    return undefined;
+}
+function capitalize(s) {
+    return s.charAt(0).toUpperCase() + s.slice(1);
+}
+//# sourceMappingURL=cookie.js.map

package/dist/auth/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/auth/cookie.ts"],"names":[],"mappings":"AAeA,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,GAAW;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QACpE,CAAC,CAAC,GAAG,KAAK,YAAY;QACtB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IAEjB,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,oBAAoB;QACzC,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ;QACrC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG;QACxB,QAAQ,EAAE,IAAI;KACf,CAAA;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAA8B,EAAE,KAAa,EAAE,MAAc;IAChG,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC/C,UAAU;QACV,QAAQ,QAAQ,CAAC,IAAI,EAAE;QACvB,WAAW,MAAM,EAAE;QACnB,YAAY,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KAC5C,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAA8B;IACnE,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,GAAG;QACnB,UAAU;QACV,QAAQ,QAAQ,CAAC,IAAI,EAAE;QACvB,WAAW;QACX,YAAY,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KAC5C,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,IAAY;IACxE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC/C,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,10 @@
+export type { AuthStrategy, AuthRequest, BaseAuth } from './types.js';
+export { runAuthChain } from './chain.js';
+export type { AuthEnricher, TenantResolver, AuthChainConfig, AuthChainResult } from './chain.js';
+export { createSessions } from './sessions.js';
+export type { Sessions, SessionConfig, TokenPair, TokenPayload, HttpTokenResult, HttpRequest, HttpResponse } from './sessions.js';
+export type { CookieConfig, ResolvedCookieConfig } from './cookie.js';
+export { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';
+export { createMultiOrgSessions } from './multi-org.js';
+export type { MultiOrgConfig, MultiOrgSessions, ResolveLoginResult, AuthenticatedResult, OrgSelectResult, OrgMembership, OrgInfo, OrgMembershipDetail } from './multi-org.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjI,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,5 @@
+export { runAuthChain } from './chain.js';
+export { createSessions } from './sessions.js';
+export { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';
+export { createMultiOrgSessions } from './multi-org.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/auth/multi-org.d.ts

@@ -0,0 +1,68 @@
+import type { DB } from '../db/index.js';
+import type { Sessions, HttpResponse, HttpRequest, HttpTokenResult } from './sessions.js';
+export interface MultiOrgConfig {
+    readonly sessions: Sessions;
+    readonly signing: {
+        algorithm: 'ES256';
+        privateKey: string;
+        publicKey: string;
+    };
+    readonly issuer: string;
+    readonly audience: string;
+    readonly orgSelectToken?: {
+        readonly expiresIn?: string;
+    };
+    readonly table?: string;
+    readonly resolveOrgNames?: (db: DB, orgIds: string[]) => Promise<Map<string, string>>;
+}
+export interface OrgMembership {
+    readonly id: string;
+    readonly orgId: string;
+    readonly role: string | null;
+    readonly joinedAt: Date;
+}
+export interface OrgInfo {
+    readonly id: string;
+    readonly name: string;
+}
+export interface OrgMembershipDetail {
+    readonly id: string;
+    readonly name: string;
+    readonly role: string | null;
+}
+export interface AuthenticatedResult {
+    readonly type: 'authenticated';
+    readonly accessToken: string;
+    readonly expiresIn: number;
+}
+export interface OrgSelectResult {
+    readonly type: 'org_select';
+    readonly sessionToken: string;
+    readonly orgs: readonly OrgInfo[];
+}
+export type ResolveLoginResult = AuthenticatedResult | OrgSelectResult;
+export interface MultiOrgSessions {
+    resolveLogin(response: HttpResponse, db: DB, user: {
+        id: string;
+    }): Promise<ResolveLoginResult>;
+    selectOrg(response: HttpResponse, db: DB, sessionToken: string, orgId: string): Promise<HttpTokenResult>;
+    switchOrg(response: HttpResponse, db: DB, request: HttpRequest, orgId: string, userId: string): Promise<HttpTokenResult>;
+    listOrgs(db: DB, userId: string): Promise<{
+        orgs: readonly OrgMembershipDetail[];
+    }>;
+    addMember(db: DB, params: {
+        userId: string;
+        orgId: string;
+        role?: string;
+        addedBy?: string;
+    }): Promise<{
+        id: string;
+    }>;
+    removeMember(db: DB, params: {
+        userId: string;
+        orgId: string;
+    }): Promise<void>;
+    checkMembership(db: DB, userId: string, orgId: string): Promise<OrgMembership | null>;
+}
+export declare function createMultiOrgSessions(config: MultiOrgConfig): MultiOrgSessions;
+//# sourceMappingURL=multi-org.d.ts.map

package/dist/auth/multi-org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-org.d.ts","sourceRoot":"","sources":["../../src/auth/multi-org.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAGxC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAEzF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACtF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAClC;AAED,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,eAAe,CAAA;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CACV,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAE9B,SAAS,CACP,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAAA;IAE3B,SAAS,CACP,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAAA;IAE3B,QAAQ,CACN,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAA;IAEpD,SAAS,CACP,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAE1B,YAAY,CACV,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACxC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB,eAAe,CACb,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;CACjC;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAoO/E"}