pipework 0.7.12 → 0.7.17

package/dist/auth/auth/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../../src/auth/auth/cookie.ts"],"names":[],"mappings":"AAiBA,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,GAAW;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QACpE,CAAC,CAAC,GAAG,KAAK,YAAY;QACtB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IAEjB,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,oBAAoB;QACzC,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ;QACrC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG;QACxB,QAAQ,EAAE,IAAI;KACf,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAA8B,EAAE,KAAa,EAAE,MAAc;IAChG,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC/C,UAAU;QACV,QAAQ,QAAQ,CAAC,IAAI,EAAE;QACvB,WAAW,MAAM,EAAE;QACnB,YAAY,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KAC5C,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,sBAAsB,CAAC,QAA8B;IACnE,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,GAAG;QACnB,UAAU;QACV,QAAQ,QAAQ,CAAC,IAAI,EAAE;QACvB,WAAW;QACX,YAAY,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KAC5C,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,IAAY;IACxE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC/C,CAAC"}

package/dist/auth/auth/index.d.ts

@@ -0,0 +1,10 @@
+export type { AuthStrategy, AuthRequest, AuthContext, BaseAuth } from './types.js';
+export { runAuthChain } from './chain.js';
+export type { AuthEnricher, TenantResolver, AuthChainConfig, AuthChainResult } from './chain.js';
+export { createSessions } from './sessions.js';
+export type { Sessions, SessionConfig, TokenPair, TokenPayload, HttpTokenResult, HttpRequest, HttpResponse } from './sessions.js';
+export type { CookieConfig, ResolvedCookieConfig } from './cookie.js';
+export { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';
+export { createMultiOrgSessions } from './multi-org.js';
+export type { MultiOrgConfig, MultiOrgSessions, ResolveLoginResult, AuthenticatedResult, OrgSelectResult, OrgMembership, OrgInfo, OrgMembershipDetail } from './multi-org.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjI,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/auth/auth/index.js

@@ -0,0 +1,5 @@
+export { runAuthChain } from './chain.js';
+export { createSessions } from './sessions.js';
+export { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';
+export { createMultiOrgSessions } from './multi-org.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/auth/auth/multi-org.d.ts

@@ -0,0 +1,77 @@
+import type { DB } from '../../data/db/index.js';
+import type { Sessions, HttpResponse, HttpRequest, HttpTokenResult } from './sessions.js';
+/** Configuration for multi-org sessions — base sessions, signing keys, org-select token TTL. */
+export interface MultiOrgConfig {
+    readonly sessions: Sessions;
+    readonly signing: {
+        algorithm: 'ES256';
+        privateKey: string;
+        publicKey: string;
+    };
+    readonly issuer: string;
+    readonly audience: string;
+    readonly orgSelectToken?: {
+        readonly expiresIn?: string;
+    };
+    readonly table?: string;
+    readonly resolveOrgNames?: (db: DB, orgIds: string[]) => Promise<Map<string, string>>;
+}
+/** A user's membership in an organization — userId, orgId, role. */
+export interface OrgMembership {
+    readonly id: string;
+    readonly orgId: string;
+    readonly role: string | null;
+    readonly joinedAt: Date;
+}
+/** Basic organization info — id and display name. */
+export interface OrgInfo {
+    readonly id: string;
+    readonly name: string;
+}
+/** Organization membership with display name — extends OrgMembership with org info. */
+export interface OrgMembershipDetail {
+    readonly id: string;
+    readonly name: string;
+    readonly role: string | null;
+}
+/** Result when user has exactly one org — direct authentication, no org selection needed. */
+export interface AuthenticatedResult {
+    readonly type: 'authenticated';
+    readonly accessToken: string;
+    readonly expiresIn: number;
+}
+/** Result when user has multiple orgs — returns a session token for org selection. */
+export interface OrgSelectResult {
+    readonly type: 'org_select';
+    readonly sessionToken: string;
+    readonly orgs: readonly OrgInfo[];
+}
+/** Union result from resolveLogin() — either AuthenticatedResult or OrgSelectResult. */
+export type ResolveLoginResult = AuthenticatedResult | OrgSelectResult;
+/** Multi-org session manager — login resolution, org selection, switching, membership CRUD. */
+export interface MultiOrgSessions {
+    resolveLogin(response: HttpResponse, db: DB, user: {
+        id: string;
+    }): Promise<ResolveLoginResult>;
+    selectOrg(response: HttpResponse, db: DB, sessionToken: string, orgId: string): Promise<HttpTokenResult>;
+    switchOrg(response: HttpResponse, db: DB, request: HttpRequest, orgId: string, userId: string): Promise<HttpTokenResult>;
+    listOrgs(db: DB, userId: string): Promise<{
+        orgs: readonly OrgMembershipDetail[];
+    }>;
+    addMember(db: DB, params: {
+        userId: string;
+        orgId: string;
+        role?: string;
+        addedBy?: string;
+    }): Promise<{
+        id: string;
+    }>;
+    removeMember(db: DB, params: {
+        userId: string;
+        orgId: string;
+    }): Promise<void>;
+    checkMembership(db: DB, userId: string, orgId: string): Promise<OrgMembership | null>;
+}
+/** Creates a multi-org session manager with org selection flow and membership management. */
+export declare function createMultiOrgSessions(config: MultiOrgConfig): MultiOrgSessions;
+//# sourceMappingURL=multi-org.d.ts.map

package/dist/auth/auth/multi-org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-org.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/multi-org.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAGhD,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAEzF,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACtF;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,sFAAsF;AACtF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAClC;AAED,wFAAwF;AACxF,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,eAAe,CAAA;AAEtE,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CACV,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAE9B,SAAS,CACP,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAAA;IAE3B,SAAS,CACP,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAAA;IAE3B,QAAQ,CACN,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAA;IAEpD,SAAS,CACP,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAE1B,YAAY,CACV,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACxC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB,eAAe,CACb,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;CACjC;AAED,6FAA6F;AAC7F,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAoO/E"}

package/dist/auth/auth/multi-org.js

@@ -0,0 +1,164 @@
+import { SignJWT, jwtVerify, importPKCS8, importSPKI } from 'jose';
+import { sql } from '../../data/db/sql.js';
+import { ForbiddenError, UnauthorizedError, ConflictError, NotFoundError } from '../../core/errors/index.js';
+import { assertValidIdentifier } from '../../data/db/identifiers.js';
+/** Creates a multi-org session manager with org selection flow and membership management. */
+export function createMultiOrgSessions(config) {
+    const tableName = config.table ?? 'pipework_user_orgs';
+    assertValidIdentifier(tableName, 'multi-org membership table');
+    const t = sql.raw(`"${tableName}"`);
+    const orgSelectAudience = `${config.audience}:org-select`;
+    const orgSelectExpiresIn = config.orgSelectToken?.expiresIn ?? '10m';
+    let cachedPrivateKey = null;
+    let cachedPublicKey = null;
+    async function getPrivateKey() {
+        if (cachedPrivateKey === null) {
+            cachedPrivateKey = await importPKCS8(config.signing.privateKey, config.signing.algorithm);
+        }
+        return cachedPrivateKey;
+    }
+    async function getPublicKey() {
+        if (cachedPublicKey === null) {
+            cachedPublicKey = await importSPKI(config.signing.publicKey, config.signing.algorithm);
+        }
+        return cachedPublicKey;
+    }
+    function parseExpiry(exp) {
+        const match = exp.match(/^(\d+)([smhd])$/);
+        if (match === null)
+            throw new Error(`Invalid expiry format: ${exp}`);
+        const value = parseInt(match[1], 10);
+        const unit = match[2];
+        switch (unit) {
+            case 's': return value;
+            case 'm': return value * 60;
+            case 'h': return value * 3600;
+            case 'd': return value * 86400;
+            default: return value;
+        }
+    }
+    async function signOrgSelectToken(userId) {
+        const key = await getPrivateKey();
+        const expiresInSeconds = parseExpiry(orgSelectExpiresIn);
+        return new SignJWT({ purpose: 'org_select' })
+            .setProtectedHeader({ alg: config.signing.algorithm })
+            .setSubject(userId)
+            .setIssuer(config.issuer)
+            .setAudience(orgSelectAudience)
+            .setIssuedAt()
+            .setExpirationTime(`${expiresInSeconds}s`)
+            .sign(key);
+    }
+    async function verifyOrgSelectToken(token) {
+        const key = await getPublicKey();
+        try {
+            const { payload } = await jwtVerify(token, key, {
+                algorithms: [config.signing.algorithm],
+                issuer: config.issuer,
+                audience: orgSelectAudience,
+            });
+            if (payload['purpose'] !== 'org_select') {
+                throw new Error('wrong purpose');
+            }
+            return payload.sub;
+        }
+        catch {
+            throw new UnauthorizedError('Invalid or expired organization selection token. Please log in again.');
+        }
+    }
+    async function requireMembership(db, userId, orgId) {
+        const rows = await db.execute(sql `SELECT 1 FROM ${t} WHERE user_id = ${userId} AND org_id = ${orgId}`);
+        if (rows.length === 0) {
+            throw new ForbiddenError('You are not a member of this organization.');
+        }
+    }
+    async function resolveLogin(response, db, user) {
+        const rows = await db.execute(sql `SELECT org_id, role FROM ${t} WHERE user_id = ${user.id} ORDER BY joined_at`);
+        if (rows.length === 0) {
+            throw new ForbiddenError('User has no organization memberships. Contact your administrator to be added to an organization.');
+        }
+        if (rows.length === 1) {
+            const orgId = rows[0]['org_id'];
+            const result = await config.sessions.issueTokensHttp(response, db, { id: user.id, tenantId: orgId });
+            return { type: 'authenticated', accessToken: result.accessToken, expiresIn: result.expiresIn };
+        }
+        const orgIds = rows.map(r => r['org_id']);
+        let orgNames = null;
+        if (config.resolveOrgNames !== undefined) {
+            orgNames = await config.resolveOrgNames(db, orgIds);
+        }
+        const orgs = orgIds.map(id => ({
+            id,
+            name: orgNames?.get(id) ?? id,
+        }));
+        const sessionToken = await signOrgSelectToken(user.id);
+        return { type: 'org_select', sessionToken, orgs };
+    }
+    async function selectOrg(response, db, sessionToken, orgId) {
+        const userId = await verifyOrgSelectToken(sessionToken);
+        await requireMembership(db, userId, orgId);
+        return config.sessions.issueTokensHttp(response, db, { id: userId, tenantId: orgId });
+    }
+    async function switchOrg(response, db, _request, orgId, userId) {
+        await requireMembership(db, userId, orgId);
+        return config.sessions.issueTokensHttp(response, db, { id: userId, tenantId: orgId });
+    }
+    async function listOrgs(db, userId) {
+        const rows = await db.execute(sql `SELECT org_id, role FROM ${t} WHERE user_id = ${userId} ORDER BY joined_at`);
+        const orgIds = rows.map(r => r['org_id']);
+        let orgNames = null;
+        if (config.resolveOrgNames !== undefined && orgIds.length > 0) {
+            orgNames = await config.resolveOrgNames(db, orgIds);
+        }
+        const orgs = rows.map(r => {
+            const orgId = r['org_id'];
+            return {
+                id: orgId,
+                name: orgNames?.get(orgId) ?? orgId,
+                role: r['role'] ?? null,
+            };
+        });
+        return { orgs };
+    }
+    async function addMember(db, params) {
+        const role = params.role ?? null;
+        const addedBy = params.addedBy ?? null;
+        const rows = await db.execute(sql `INSERT INTO ${t} (user_id, org_id, role, added_by)
+          VALUES (${params.userId}, ${params.orgId}, ${role}, ${addedBy})
+          ON CONFLICT (user_id, org_id) DO NOTHING
+          RETURNING id`);
+        if (rows.length === 0) {
+            throw new ConflictError('User is already a member of this organization.');
+        }
+        return { id: rows[0]['id'] };
+    }
+    async function removeMember(db, params) {
+        const rows = await db.execute(sql `DELETE FROM ${t} WHERE user_id = ${params.userId} AND org_id = ${params.orgId} RETURNING id`);
+        if (rows.length === 0) {
+            throw new NotFoundError('Membership');
+        }
+        await config.sessions.bumpVersion(db, params.userId);
+    }
+    async function checkMembershipFn(db, userId, orgId) {
+        const rows = await db.execute(sql `SELECT id, org_id, role, joined_at FROM ${t} WHERE user_id = ${userId} AND org_id = ${orgId}`);
+        if (rows.length === 0)
+            return null;
+        const row = rows[0];
+        return {
+            id: row['id'],
+            orgId: row['org_id'],
+            role: row['role'] ?? null,
+            joinedAt: new Date(row['joined_at']),
+        };
+    }
+    return {
+        resolveLogin,
+        selectOrg,
+        switchOrg,
+        listOrgs,
+        addMember,
+        removeMember,
+        checkMembership: checkMembershipFn,
+    };
+}
+//# sourceMappingURL=multi-org.js.map

package/dist/auth/auth/multi-org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-org.js","sourceRoot":"","sources":["../../../src/auth/auth/multi-org.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAClE,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC5G,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAiGpE,6FAA6F;AAC7F,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,oBAAoB,CAAA;IACtD,qBAAqB,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAA;IAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,CAAA;IAEnC,MAAM,iBAAiB,GAAG,GAAG,MAAM,CAAC,QAAQ,aAAa,CAAA;IACzD,MAAM,kBAAkB,GAAG,MAAM,CAAC,cAAc,EAAE,SAAS,IAAI,KAAK,CAAA;IAEpE,IAAI,gBAAgB,GAAqB,IAAI,CAAA;IAC7C,IAAI,eAAe,GAAqB,IAAI,CAAA;IAE5C,KAAK,UAAU,aAAa;QAC1B,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC9B,gBAAgB,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAED,KAAK,UAAU,YAAY;QACzB,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,eAAe,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACxF,CAAC;QACD,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,SAAS,WAAW,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC1C,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;QACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,CAAA;YACtB,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,EAAE,CAAA;YAC3B,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,IAAI,CAAA;YAC7B,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,KAAK,CAAA;YAC9B,OAAO,CAAC,CAAC,OAAO,KAAK,CAAA;QACvB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,MAAc;QAC9C,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAA;QACjC,MAAM,gBAAgB,GAAG,WAAW,CAAC,kBAAkB,CAAC,CAAA;QACxD,OAAO,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAC1C,kBAAkB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;aACrD,UAAU,CAAC,MAAM,CAAC;aAClB,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;aACxB,WAAW,CAAC,iBAAiB,CAAC;aAC9B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,KAAa;QAC/C,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE;gBAC9C,UAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,iBAAiB;aAC5B,CAAC,CAAA;YACF,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,YAAY,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;YAClC,CAAC;YACD,OAAO,OAAO,CAAC,GAAI,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CACzB,uEAAuE,CACxE,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,MAAc,EAAE,KAAa;QACpE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,iBAAiB,CAAC,oBAAoB,MAAM,iBAAiB,KAAK,EAAE,CACxE,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CAAC,4CAA4C,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,QAAsB,EACtB,EAAM,EACN,IAAoB;QAEpB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,4BAA4B,CAAC,oBAAoB,IAAI,CAAC,EAAE,qBAAqB,CACjF,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CACtB,kGAAkG,CACnG,CAAA;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAA;YAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YACpG,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;QAChG,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAW,CAAC,CAAA;QACnD,IAAI,QAAQ,GAA+B,IAAI,CAAA;QAC/C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACzC,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,IAAI,GAAc,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACxC,EAAE;YACF,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;SAC9B,CAAC,CAAC,CAAA;QAEH,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IACnD,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,QAAsB,EACtB,EAAM,EACN,YAAoB,EACpB,KAAa;QAEb,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAA;QACvD,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,QAAsB,EACtB,EAAM,EACN,QAAqB,EACrB,KAAa,EACb,MAAc;QAEd,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,KAAK,UAAU,QAAQ,CACrB,EAAM,EACN,MAAc;QAEd,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,4BAA4B,CAAC,oBAAoB,MAAM,qBAAqB,CAChF,CAAA;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAW,CAAC,CAAA;QACnD,IAAI,QAAQ,GAA+B,IAAI,CAAA;QAC/C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,IAAI,GAA0B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAW,CAAA;YACnC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK;gBACnC,IAAI,EAAG,CAAC,CAAC,MAAM,CAAmB,IAAI,IAAI;aAC3C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,EAAM,EACN,MAA0E;QAE1E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAA;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,eAAe,CAAC;oBACL,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,KAAK,IAAI,KAAK,OAAO;;uBAEhD,CAClB,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,gDAAgD,CAAC,CAAA;QAC3E,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAW,EAAE,CAAA;IACzC,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,EAAM,EACN,MAAyC;QAEzC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,eAAe,CAAC,oBAAoB,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,KAAK,eAAe,CACjG,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,MAAc,EACd,KAAa;QAEb,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,2CAA2C,CAAC,oBAAoB,MAAM,iBAAiB,KAAK,EAAE,CAClG,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QACpB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW;YACvB,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAW;YAC9B,IAAI,EAAG,GAAG,CAAC,MAAM,CAAmB,IAAI,IAAI;YAC5C,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;SAC/C,CAAA;IACH,CAAC;IAED,OAAO;QACL,YAAY;QACZ,SAAS;QACT,SAAS;QACT,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,eAAe,EAAE,iBAAiB;KACnC,CAAA;AACH,CAAC"}

package/dist/auth/auth/namespace.d.ts

@@ -0,0 +1,22 @@
+import { createSessions } from './sessions.js';
+import { createMultiOrgSessions } from './multi-org.js';
+import { runAuthChain } from './chain.js';
+import { resolveCookieConfig, parseCookieHeader, buildSetCookieHeader, buildClearCookieHeader } from './cookie.js';
+/** Authentication namespace — session management, multi-org support, auth chain resolution. */
+export declare const auth: {
+    /** Creates a Sessions manager with JWT access/refresh tokens, rotation, and reuse detection. */
+    createSessions: typeof createSessions;
+    /** Creates multi-org session management — org selection, switching, membership CRUD. */
+    createMultiOrg: typeof createMultiOrgSessions;
+    /** Executes an auth chain (strategy pipeline) to resolve auth + tenant from a request. */
+    runChain: typeof runAuthChain;
+    /** Resolves CookieConfig with defaults for secure cookie-based token delivery. */
+    resolveCookie: typeof resolveCookieConfig;
+    /** Parses a Cookie header string into key-value pairs. */
+    parseCookie: typeof parseCookieHeader;
+    /** Builds a Set-Cookie header string from name, value, and CookieConfig. */
+    buildSetCookie: typeof buildSetCookieHeader;
+    /** Builds a Set-Cookie header that clears (expires) a cookie. */
+    buildClearCookie: typeof buildClearCookieHeader;
+};
+//# sourceMappingURL=namespace.d.ts.map

package/dist/auth/auth/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAElH,+FAA+F;AAC/F,eAAO,MAAM,IAAI;IACf,gGAAgG;;IAEhG,wFAAwF;;IAExF,0FAA0F;;IAE1F,kFAAkF;;IAElF,0DAA0D;;IAE1D,4EAA4E;;IAE5E,iEAAiE;;CAElE,CAAA"}

package/dist/auth/auth/namespace.js

@@ -0,0 +1,22 @@
+import { createSessions } from './sessions.js';
+import { createMultiOrgSessions } from './multi-org.js';
+import { runAuthChain } from './chain.js';
+import { resolveCookieConfig, parseCookieHeader, buildSetCookieHeader, buildClearCookieHeader } from './cookie.js';
+/** Authentication namespace — session management, multi-org support, auth chain resolution. */
+export const auth = {
+    /** Creates a Sessions manager with JWT access/refresh tokens, rotation, and reuse detection. */
+    createSessions,
+    /** Creates multi-org session management — org selection, switching, membership CRUD. */
+    createMultiOrg: createMultiOrgSessions,
+    /** Executes an auth chain (strategy pipeline) to resolve auth + tenant from a request. */
+    runChain: runAuthChain,
+    /** Resolves CookieConfig with defaults for secure cookie-based token delivery. */
+    resolveCookie: resolveCookieConfig,
+    /** Parses a Cookie header string into key-value pairs. */
+    parseCookie: parseCookieHeader,
+    /** Builds a Set-Cookie header string from name, value, and CookieConfig. */
+    buildSetCookie: buildSetCookieHeader,
+    /** Builds a Set-Cookie header that clears (expires) a cookie. */
+    buildClearCookie: buildClearCookieHeader,
+};
+//# sourceMappingURL=namespace.js.map

package/dist/auth/auth/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../src/auth/auth/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAElH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,gGAAgG;IAChG,cAAc;IACd,wFAAwF;IACxF,cAAc,EAAE,sBAAsB;IACtC,0FAA0F;IAC1F,QAAQ,EAAE,YAAY;IACtB,kFAAkF;IAClF,aAAa,EAAE,mBAAmB;IAClC,0DAA0D;IAC1D,WAAW,EAAE,iBAAiB;IAC9B,4EAA4E;IAC5E,cAAc,EAAE,oBAAoB;IACpC,iEAAiE;IACjE,gBAAgB,EAAE,sBAAsB;CACzC,CAAA"}

package/dist/auth/auth/sessions.d.ts

@@ -0,0 +1,70 @@
+import type { DB } from '../../data/db/index.js';
+import type { CookieConfig } from './cookie.js';
+import type { HttpRequest, HttpResponse } from '../../request/http/types.js';
+/** Session configuration — signing keys, issuer, audience, token TTLs, refresh rotation. */
+export interface SessionConfig {
+    readonly signing: {
+        algorithm: 'ES256';
+        privateKey: string;
+        publicKey: string;
+    };
+    readonly issuer: string;
+    readonly audience: string;
+    readonly accessToken: {
+        expiresIn: string;
+    };
+    readonly refreshToken: {
+        expiresIn: string;
+        rotateOnUse: boolean;
+        reuseDetection: boolean;
+        cookie?: CookieConfig;
+    };
+    readonly versionCheck: boolean;
+    readonly versionCacheTtlMs?: number;
+    readonly resolveRoles?: (db: DB, userId: string, tenantId: string) => Promise<string[]>;
+    readonly environment?: string;
+}
+/** Access + refresh token pair returned by issueTokens(). */
+export interface TokenPair {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly expiresIn: number;
+}
+/** Decoded JWT payload — userId, tenantId, roles, version. */
+export interface TokenPayload {
+    readonly sub: string;
+    readonly tid: string;
+    readonly av: number;
+    readonly roles: string[] | undefined;
+}
+/** Result from HTTP token operations — the token pair plus whether cookies were set. */
+export interface HttpTokenResult {
+    readonly accessToken: string;
+    readonly expiresIn: number;
+}
+export type { HttpRequest, HttpResponse };
+/** Session manager with JWT issue/refresh/revoke lifecycle and cookie-based HTTP helpers. */
+export interface Sessions {
+    issueTokens(db: DB, user: {
+        id: string;
+        tenantId: string;
+        roles?: string[];
+    }): Promise<TokenPair>;
+    refresh(db: DB, refreshToken: string): Promise<TokenPair>;
+    revokeAll(db: DB, userId: string): Promise<void>;
+    bumpVersion(db: DB, userId: string): Promise<void>;
+    verifyAccessToken(token: string): Promise<TokenPayload>;
+    checkVersion(db: DB, userId: string, tokenVersion: number): Promise<boolean>;
+    cleanExpiredTokens(db: DB): Promise<number>;
+    issueTokensHttp(response: HttpResponse, db: DB, user: {
+        id: string;
+        tenantId: string;
+        roles?: string[];
+    }): Promise<HttpTokenResult>;
+    refreshHttp(response: HttpResponse, db: DB, request: HttpRequest): Promise<HttpTokenResult>;
+    revokeHttp(response: HttpResponse, db: DB, request: HttpRequest): Promise<void>;
+    revokeAllHttp(response: HttpResponse, db: DB, userId: string): Promise<void>;
+}
+/** Creates a Sessions manager with JWT access/refresh tokens, rotation, reuse detection, and cookie helpers. */
+export declare function createSessions(config: SessionConfig): Sessions;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/auth/auth/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG/C,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAE5E,4FAA4F;AAC5F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,YAAY,CAAA;KAAE,CAAA;IAClH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CACrC;AAED,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,CAAA;AAEzC,6FAA6F;AAC7F,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACjG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACzD,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChD,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACvD,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5E,kBAAkB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,eAAe,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IACnI,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAC3F,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/E,aAAa,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7E;AAED,gHAAgH;AAChH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,QAAQ,CAmQ9D"}