pipework 0.75.1 → 0.76.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.76.0
+
+- **New: browser sessions.** `SessionConfig.accessToken.cookie` also delivers the access token as an HttpOnly cookie (`__pipework_access`, SameSite Lax, Path `/`), set, replaced and cleared alongside the refresh cookie by `issueTokensHttp`, `refreshHttp`, `revokeHttp`, `revokeAllHttp` and multi-org sign-in, select and switch, so a plain link, image or form reaches a route signed in. Without it nothing changes (#487).
+- **New: `sessions.strategy({ trustedOrigins? })`**, the auth strategy for pipework's own sessions: `Authorization: Bearer` first, else the access cookie; checks the session version when `versionCheck` is on. A write (not GET/HEAD/OPTIONS) authenticated by the cookie must come from the app's own site (`Sec-Fetch-Site`, else `Origin` against `Host` or `trustedOrigins`), otherwise 403 `CROSS_SITE_REQUEST` (`CrossSiteRequestError`). It never refreshes; the client calls its refresh route on a 401.
+- **Changed: an expired access token answers 401 "Access token expired"** instead of "Invalid access token". `switchOrg` revokes the refresh token the request carried. New `sessions.revokeRefreshCookie(db, request)`. Auth strategies now receive the request's parsed `cookies` and its `method`.
+
+## 0.75.2
+
+- **Fixed: the work a public request runs under `accessLinks.asLink` is readable by the link's tenant.** It is now recorded in a child trace of the request's trace that carries the link's tenant and the `link:<id>` user; before, it sat in the request's tenantless trace, which no tenant can read. The request's own trace is unchanged. Audit rows written inside `asLink` now point at the child trace (#474).
+- **Fixed: `asLink` accepts the ok result of `claimUse` in its type**, as it already did at run time (#473).
+
 ## 0.75.1
 
 - **Fixed: a column in a table-level foreign key may carry the referenced field's brand.** The startup check accepted an inherited brand only through a field-level `.references()`, so a tenant-scoped app using composite foreign keys (`(tenant_id, parent_id) → parent(tenant_id, id)`) was refused at `serve` with a `[domain] brand … used by both` issue for every such column. The column is matched by position to the foreign column (#481).

package/dist/auth/auth/cookie.d.ts

@@ -14,11 +14,16 @@ export interface ResolvedCookieConfig {
     readonly httpOnly: true;
 }
 /** Resolves a partial CookieConfig into a ResolvedCookieConfig with secure defaults. */
-export declare function resolveCookieConfig(cookie: CookieConfig, env: string): ResolvedCookieConfig;
+export declare function resolveCookieConfig(cookie: CookieConfig, env: string, defaults?: {
+    readonly name: string;
+    readonly sameSite: 'strict' | 'lax' | 'none';
+}): ResolvedCookieConfig;
 /** Builds a Set-Cookie header string from name, value, and resolved config. */
 export declare function buildSetCookieHeader(resolved: ResolvedCookieConfig, value: string, maxAge: number): string;
 /** Builds a Set-Cookie header that expires (clears) a cookie. */
 export declare function buildClearCookieHeader(resolved: ResolvedCookieConfig): string;
 /** Parses a Cookie header string into a Record of key-value pairs. */
 export declare function parseCookieHeader(header: string | undefined, name: string): string | undefined;
+/** Parses every name=value pair of a Cookie header. */
+export declare function parseCookies(header: string | undefined): Record<string, string>;
 //# sourceMappingURL=cookie.d.ts.map

package/dist/auth/auth/cookie.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/cookie.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAY3F;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAU1G;AAED,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAU7E;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAY9F"}
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/cookie.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;CAAuD,GACrI,oBAAoB,CAYtB;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAU1G;AAED,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAU7E;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAY9F;AAED,uDAAuD;AACvD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgB/E"}

package/dist/auth/auth/cookie.js

@@ -1,12 +1,12 @@
 /** Resolves a partial CookieConfig into a ResolvedCookieConfig with secure defaults. */
-export function resolveCookieConfig(cookie, env) {
+export function resolveCookieConfig(cookie, env, defaults = { name: '__pipework_refresh', sameSite: 'strict' }) {
     const secure = cookie.secure === 'auto' || cookie.secure === undefined
         ? env === 'production'
         : cookie.secure;
     return {
-        name: cookie.name ?? '__pipework_refresh',
+        name: cookie.name ?? defaults.name,
         secure,
-        sameSite: cookie.sameSite ?? 'strict',
+        sameSite: cookie.sameSite ?? defaults.sameSite,
         path: cookie.path ?? '/',
         httpOnly: true,
     };
@@ -53,6 +53,28 @@ export function parseCookieHeader(header, name) {
     }
     return undefined;
 }
+/** Parses every name=value pair of a Cookie header. */
+export function parseCookies(header) {
+    const out = {};
+    if (header === undefined)
+        return out;
+    for (const pair of header.split(';')) {
+        const trimmed = pair.trim();
+        const eqIdx = trimmed.indexOf('=');
+        if (eqIdx === -1)
+            continue;
+        const key = trimmed.slice(0, eqIdx).trim();
+        if (key in out)
+            continue;
+        try {
+            out[key] = decodeURIComponent(trimmed.slice(eqIdx + 1).trim());
+        }
+        catch {
+            continue;
+        }
+    }
+    return out;
+}
 function capitalize(s) {
     return s.charAt(0).toUpperCase() + s.slice(1);
 }

package/dist/auth/auth/cookie.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../../src/auth/auth/cookie.ts"],"names":[],"mappings":"AAiBA,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,GAAW;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QACpE,CAAC,CAAC,GAAG,KAAK,YAAY;QACtB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IAEjB,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,oBAAoB;QACzC,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ;QACrC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG;QACxB,QAAQ,EAAE,IAAI;KACf,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAA8B,EAAE,KAAa,EAAE,MAAc;IAChG,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC/C,UAAU;QACV,QAAQ,QAAQ,CAAC,IAAI,EAAE;QACvB,WAAW,MAAM,EAAE;QACnB,YAAY,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KAC5C,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,sBAAsB,CAAC,QAA8B;IACnE,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,GAAG;QACnB,UAAU;QACV,QAAQ,QAAQ,CAAC,IAAI,EAAE;QACvB,WAAW;QACX,YAAY,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KAC5C,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,IAAY;IACxE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC/C,CAAC"}
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../../src/auth/auth/cookie.ts"],"names":[],"mappings":"AAiBA,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CACjC,MAAoB,EACpB,GAAW,EACX,WAAoF,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAEtI,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QACpE,CAAC,CAAC,GAAG,KAAK,YAAY;QACtB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IAEjB,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;QAClC,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;QAC9C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG;QACxB,QAAQ,EAAE,IAAI;KACf,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAA8B,EAAE,KAAa,EAAE,MAAc;IAChG,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC/C,UAAU;QACV,QAAQ,QAAQ,CAAC,IAAI,EAAE;QACvB,WAAW,MAAM,EAAE;QACnB,YAAY,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KAC5C,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,sBAAsB,CAAC,QAA8B;IACnE,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,GAAG;QACnB,UAAU;QACV,QAAQ,QAAQ,CAAC,IAAI,EAAE;QACvB,WAAW;QACX,YAAY,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KAC5C,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,IAAY;IACxE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,CAAA;IACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,GAAG,IAAI,GAAG;YAAE,SAAQ;QACxB,IAAI,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC/C,CAAC"}

package/dist/auth/auth/index.d.ts

@@ -2,6 +2,7 @@ export type { AuthStrategy, AuthRequest, AuthContext, BaseAuth } from './types.j
 export { runAuthChain } from './chain.js';
 export type { AuthEnricher, TenantResolver, AuthChainConfig, AuthChainResult } from './chain.js';
 export { createSessions } from './sessions.js';
+export type { SessionAuth, SessionStrategyOptions } from './sessions.js';
 export type { Sessions, SessionConfig, TokenPair, TokenPayload, HttpTokenResult, HttpRequest, HttpResponse } from './sessions.js';
 export type { CookieConfig, ResolvedCookieConfig } from './cookie.js';
 export { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';

package/dist/auth/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjI,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAC7K,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,YAAY,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACxE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjI,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAC7K,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA"}

package/dist/auth/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAI9C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA"}

package/dist/auth/auth/multi-org.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multi-org.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/multi-org.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAIhD,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAEzF,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACzD;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACtF;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,sFAAsF;AACtF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAClC;AAED,wFAAwF;AACxF,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,eAAe,CAAA;AAEtE,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CACV,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAE9B,SAAS,CACP,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAAA;IAE3B,SAAS,CACP,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,EACrC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAAA;IAE3B,QAAQ,CACN,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAA;IAEpD,SAAS,CACP,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAE1B,YAAY,CACV,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACxC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB,eAAe,CACb,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;CACjC;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CA2N/E"}
+{"version":3,"file":"multi-org.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/multi-org.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAIhD,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAEzF,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACzD;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACtF;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,sFAAsF;AACtF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAClC;AAED,wFAAwF;AACxF,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,eAAe,CAAA;AAEtE,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CACV,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAE9B,SAAS,CACP,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAAA;IAE3B,SAAS,CACP,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,EACrC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAAA;IAE3B,QAAQ,CACN,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAA;IAEpD,SAAS,CACP,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAE1B,YAAY,CACV,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACxC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB,eAAe,CACb,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;CACjC;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CA4N/E"}

package/dist/auth/auth/multi-org.js

@@ -91,8 +91,9 @@ export function createMultiOrgSessions(config) {
         await requireMembership(db, userId, orgId);
         return config.sessions.issueTokensHttp(response, db, { id: userId, tenantId: orgId });
     }
-    async function switchOrg(response, db, _request, orgId, userId) {
+    async function switchOrg(response, db, request, orgId, userId) {
         await requireMembership(db, userId, orgId);
+        await config.sessions.revokeRefreshCookie(db, request);
         return config.sessions.issueTokensHttp(response, db, { id: userId, tenantId: orgId });
     }
     async function listOrgs(db, userId) {

package/dist/auth/auth/multi-org.js.map

@@ -1 +1 @@
-{"version":3,"file":"multi-org.js","sourceRoot":"","sources":["../../../src/auth/auth/multi-org.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC5G,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAqGtC;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,oBAAoB,CAAA;IACtD,qBAAqB,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAA;IAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,CAAA;IAEnC,MAAM,iBAAiB,GAAG,GAAG,MAAM,CAAC,QAAQ,aAAa,CAAA;IACzD,MAAM,kBAAkB,GAAG,MAAM,CAAC,cAAc,EAAE,SAAS,IAAI,KAAK,CAAA;IAEpE,IAAI,gBAAgB,GAAqB,IAAI,CAAA;IAC7C,IAAI,eAAe,GAAqB,IAAI,CAAA;IAE5C,KAAK,UAAU,aAAa;QAC1B,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC9B,gBAAgB,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAED,KAAK,UAAU,YAAY;QACzB,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,eAAe,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACxF,CAAC;QACD,OAAO,eAAe,CAAA;IACxB,CAAC;IAGD,KAAK,UAAU,kBAAkB,CAAC,MAAc;QAC9C,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAA;QACjC,MAAM,gBAAgB,GAAG,WAAW,CAAC,kBAAkB,CAAC,CAAA;QACxD,OAAO,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAC1C,kBAAkB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;aACrD,UAAU,CAAC,MAAM,CAAC;aAClB,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;aACxB,WAAW,CAAC,iBAAiB,CAAC;aAC9B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,KAAa;QAC/C,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE;gBAC9C,UAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,iBAAiB;aAC5B,CAAC,CAAA;YACF,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,YAAY,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;YAClC,CAAC;YACD,OAAO,OAAO,CAAC,GAAI,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CACzB,uEAAuE,CACxE,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,MAAc,EAAE,KAAa;QACpE,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC1B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,iBAAiB,CAAC,oBAAoB,MAAM,iBAAiB,KAAK,EAAE,CACxE,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CAAC,4CAA4C,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,QAAsB,EACtB,EAAM,EACN,IAAoB;QAEpB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,4BAA4B,CAAC,oBAAoB,IAAI,CAAC,EAAE,qBAAqB,CACjF,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CACtB,kGAAkG,CACnG,CAAA;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAA;YAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YACpG,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;QAChG,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAW,CAAC,CAAA;QACnD,IAAI,QAAQ,GAA+B,IAAI,CAAA;QAC/C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACzC,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,IAAI,GAAc,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACxC,EAAE;YACF,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;SAC9B,CAAC,CAAC,CAAA;QAEH,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IACnD,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,QAAsB,EACtB,EAAM,EACN,YAAoB,EACpB,KAAa;QAEb,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAA;QACvD,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,QAAsB,EACtB,EAAM,EACN,QAAsC,EACtC,KAAa,EACb,MAAc;QAEd,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,KAAK,UAAU,QAAQ,CACrB,EAAM,EACN,MAAc;QAEd,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,4BAA4B,CAAC,oBAAoB,MAAM,qBAAqB,CAChF,CAAA;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAW,CAAC,CAAA;QACnD,IAAI,QAAQ,GAA+B,IAAI,CAAA;QAC/C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,IAAI,GAA0B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAW,CAAA;YACnC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK;gBACnC,IAAI,EAAG,CAAC,CAAC,MAAM,CAAmB,IAAI,IAAI;aAC3C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,EAAM,EACN,MAA0E;QAE1E,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAA;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,eAAe,CAAC;oBACL,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,KAAK,IAAI,KAAK,OAAO;;uBAEhD,CAClB,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,gDAAgD,CAAC,CAAA;QAC3E,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAW,EAAE,CAAA;IACzC,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,EAAM,EACN,MAAyC;QAEzC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,eAAe,CAAC,oBAAoB,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,KAAK,eAAe,CACjG,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,MAAc,EACd,KAAa;QAEb,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC1B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,2CAA2C,CAAC,oBAAoB,MAAM,iBAAiB,KAAK,EAAE,CAClG,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QACpB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW;YACvB,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAW;YAC9B,IAAI,EAAG,GAAG,CAAC,MAAM,CAAmB,IAAI,IAAI;YAC5C,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;SAC/C,CAAA;IACH,CAAC;IAED,OAAO;QACL,YAAY;QACZ,SAAS;QACT,SAAS;QACT,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,eAAe,EAAE,iBAAiB;KACnC,CAAA;AACH,CAAC"}
+{"version":3,"file":"multi-org.js","sourceRoot":"","sources":["../../../src/auth/auth/multi-org.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC5G,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAqGtC;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,oBAAoB,CAAA;IACtD,qBAAqB,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAA;IAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,CAAA;IAEnC,MAAM,iBAAiB,GAAG,GAAG,MAAM,CAAC,QAAQ,aAAa,CAAA;IACzD,MAAM,kBAAkB,GAAG,MAAM,CAAC,cAAc,EAAE,SAAS,IAAI,KAAK,CAAA;IAEpE,IAAI,gBAAgB,GAAqB,IAAI,CAAA;IAC7C,IAAI,eAAe,GAAqB,IAAI,CAAA;IAE5C,KAAK,UAAU,aAAa;QAC1B,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC9B,gBAAgB,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAED,KAAK,UAAU,YAAY;QACzB,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,eAAe,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACxF,CAAC;QACD,OAAO,eAAe,CAAA;IACxB,CAAC;IAGD,KAAK,UAAU,kBAAkB,CAAC,MAAc;QAC9C,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAA;QACjC,MAAM,gBAAgB,GAAG,WAAW,CAAC,kBAAkB,CAAC,CAAA;QACxD,OAAO,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAC1C,kBAAkB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;aACrD,UAAU,CAAC,MAAM,CAAC;aAClB,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;aACxB,WAAW,CAAC,iBAAiB,CAAC;aAC9B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,KAAa;QAC/C,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE;gBAC9C,UAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,iBAAiB;aAC5B,CAAC,CAAA;YACF,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,YAAY,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;YAClC,CAAC;YACD,OAAO,OAAO,CAAC,GAAI,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CACzB,uEAAuE,CACxE,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,MAAc,EAAE,KAAa;QACpE,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC1B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,iBAAiB,CAAC,oBAAoB,MAAM,iBAAiB,KAAK,EAAE,CACxE,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CAAC,4CAA4C,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,QAAsB,EACtB,EAAM,EACN,IAAoB;QAEpB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,4BAA4B,CAAC,oBAAoB,IAAI,CAAC,EAAE,qBAAqB,CACjF,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CACtB,kGAAkG,CACnG,CAAA;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAA;YAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YACpG,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;QAChG,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAW,CAAC,CAAA;QACnD,IAAI,QAAQ,GAA+B,IAAI,CAAA;QAC/C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACzC,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,IAAI,GAAc,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACxC,EAAE;YACF,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;SAC9B,CAAC,CAAC,CAAA;QAEH,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IACnD,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,QAAsB,EACtB,EAAM,EACN,YAAoB,EACpB,KAAa;QAEb,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAA;QACvD,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,QAAsB,EACtB,EAAM,EACN,OAAqC,EACrC,KAAa,EACb,MAAc;QAEd,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1C,MAAM,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QACtD,OAAO,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,KAAK,UAAU,QAAQ,CACrB,EAAM,EACN,MAAc;QAEd,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,4BAA4B,CAAC,oBAAoB,MAAM,qBAAqB,CAChF,CAAA;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAW,CAAC,CAAA;QACnD,IAAI,QAAQ,GAA+B,IAAI,CAAA;QAC/C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,IAAI,GAA0B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAW,CAAA;YACnC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK;gBACnC,IAAI,EAAG,CAAC,CAAC,MAAM,CAAmB,IAAI,IAAI;aAC3C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,EAAM,EACN,MAA0E;QAE1E,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAA;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,eAAe,CAAC;oBACL,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,KAAK,IAAI,KAAK,OAAO;;uBAEhD,CAClB,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,gDAAgD,CAAC,CAAA;QAC3E,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAW,EAAE,CAAA;IACzC,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,EAAM,EACN,MAAyC;QAEzC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,eAAe,CAAC,oBAAoB,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,KAAK,eAAe,CACjG,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,MAAc,EACd,KAAa;QAEb,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC1B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,2CAA2C,CAAC,oBAAoB,MAAM,iBAAiB,KAAK,EAAE,CAClG,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QACpB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW;YACvB,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAW;YAC9B,IAAI,EAAG,GAAG,CAAC,MAAM,CAAmB,IAAI,IAAI;YAC5C,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;SAC/C,CAAA;IACH,CAAC;IAED,OAAO;QACL,YAAY;QACZ,SAAS;QACT,SAAS;QACT,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,eAAe,EAAE,iBAAiB;KACnC,CAAA;AACH,CAAC"}

package/dist/auth/auth/sessions.d.ts

@@ -1,4 +1,5 @@
 import type { DB } from '../../data/db/index.js';
+import type { AuthStrategy, BaseAuth } from './types.js';
 import type { CookieConfig } from './cookie.js';
 import type { HttpRequest, HttpResponse } from '../../request/http/types.js';
 /** Session configuration — signing keys, issuer, audience, token TTLs, refresh rotation. */
@@ -10,8 +11,13 @@ export interface SessionConfig {
     };
     readonly issuer: string;
     readonly audience: string;
+    /**
+     * `cookie` also delivers the access token as an HttpOnly cookie (default name `__pipework_access`,
+     * SameSite Lax so a link from another site arrives signed in, Path `/`), set and cleared with the refresh cookie.
+     */
     readonly accessToken: {
         expiresIn: string;
+        cookie?: CookieConfig;
     };
     readonly refreshToken: {
         expiresIn: string;
@@ -43,6 +49,16 @@ export interface HttpTokenResult {
     readonly expiresIn: number;
 }
 export type { HttpRequest, HttpResponse };
+/** What `sessions.strategy()` authenticates: the token's user and org, its roles, and where the token came from. */
+export type SessionAuth = BaseAuth & {
+    readonly roles: readonly string[];
+    readonly via: 'cookie' | 'header';
+};
+/** Options for `sessions.strategy()`. */
+export interface SessionStrategyOptions {
+    /** Origins (e.g. `https://app.example.com`) besides the request's own host allowed to send cookie-authenticated writes. */
+    readonly trustedOrigins?: readonly string[];
+}
 /** Session manager with JWT issue/refresh/revoke lifecycle and cookie-based HTTP helpers. */
 export interface Sessions {
     issueTokens(db: DB, user: {
@@ -56,6 +72,16 @@ export interface Sessions {
     verifyAccessToken(token: string): Promise<TokenPayload>;
     checkVersion(db: DB, userId: string, tokenVersion: number): Promise<boolean>;
     cleanExpiredTokens(db: DB): Promise<number>;
+    /**
+     * The auth strategy for these sessions: `Authorization: Bearer` first, else the access cookie when
+     * `accessToken.cookie` is set. A cookie-authenticated write (not GET/HEAD/OPTIONS) must come from the
+     * app's own site or a trusted origin, else 403 `CROSS_SITE_REQUEST`. It never refreshes: the client
+     * calls the refresh route on a 401 "Access token expired" (a refresh here would trip reuse detection
+     * on concurrent requests).
+     */
+    strategy(options?: SessionStrategyOptions): AuthStrategy<SessionAuth>;
+    /** Revokes the refresh token in the request's refresh cookie, if any; sets no cookie. */
+    revokeRefreshCookie(db: DB, request: Pick<HttpRequest, 'headers'>): Promise<void>;
     issueTokensHttp(response: HttpResponse, db: DB, user: {
         id: string;
         tenantId: string;

package/dist/auth/auth/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/sessions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAGhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG/C,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAE5E,4FAA4F;AAC5F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,YAAY,CAAA;KAAE,CAAA;IAClH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CACrC;AAED,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAaD,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,CAAA;AAEzC,6FAA6F;AAC7F,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACjG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACzD,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChD,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACvD,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5E,kBAAkB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,eAAe,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IACnI,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAC5G,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChG,aAAa,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,QAAQ,CA6Q9D"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/sessions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAA4B,QAAQ,EAAE,MAAM,YAAY,CAAA;AAElF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG/C,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAE5E,4FAA4F;AAC5F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,YAAY,CAAA;KAAE,CAAA;IAClE,QAAQ,CAAC,YAAY,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,YAAY,CAAA;KAAE,CAAA;IAClH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CACrC;AAED,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAaD,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,CAAA;AAEzC,oHAAoH;AACpH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAAE,CAAA;AAE7G,yCAAyC;AACzC,MAAM,WAAW,sBAAsB;IACrC,2HAA2H;IAC3H,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAED,6FAA6F;AAC7F,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACjG,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACzD,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChD,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACvD,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5E,kBAAkB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;IACrE,yFAAyF;IACzF,mBAAmB,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjF,eAAe,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IACnI,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAC5G,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChG,aAAa,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,QAAQ,CAgW9D"}

package/dist/auth/auth/sessions.js

@@ -1,7 +1,7 @@
 import { SignJWT, jwtVerify, importPKCS8, importSPKI } from 'jose';
 import { parseExpiry } from './parse-expiry.js';
 import { sql } from '../../data/db/sql.js';
-import { UnauthorizedError } from '../../core/errors/index.js';
+import { UnauthorizedError, CrossSiteRequestError } from '../../core/errors/index.js';
 import { assertUuid } from './uuid.js';
 import { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';
 /**
@@ -138,7 +138,10 @@ export function createSessions(config) {
                 roles: payload['roles'],
             };
         }
-        catch {
+        catch (error) {
+            if (error?.code === 'ERR_JWT_EXPIRED') {
+                throw new UnauthorizedError('Access token expired');
+            }
             throw new UnauthorizedError('Invalid access token');
         }
     }
@@ -163,13 +166,36 @@ export function createSessions(config) {
         }
         return resolveCookieConfig(cookie, config.environment ?? 'production');
     }
+    function getAccessCookieConfig() {
+        const cookie = config.accessToken.cookie;
+        if (cookie === undefined)
+            return null;
+        return resolveCookieConfig(cookie, environment, { name: '__pipework_access', sameSite: 'lax' });
+    }
     function getRefreshMaxAge() {
         return parseExpiry(config.refreshToken.expiresIn);
     }
+    function setCookies(response, values) {
+        response.header('Set-Cookie', values.length === 1 ? values[0] : values);
+    }
+    function sessionCookies(resolved, pair) {
+        const values = [buildSetCookieHeader(resolved, pair.refreshToken, getRefreshMaxAge())];
+        const access = getAccessCookieConfig();
+        if (access !== null)
+            values.push(buildSetCookieHeader(access, pair.accessToken, pair.expiresIn));
+        return values;
+    }
+    function clearCookies(resolved) {
+        const values = [buildClearCookieHeader(resolved)];
+        const access = getAccessCookieConfig();
+        if (access !== null)
+            values.push(buildClearCookieHeader(access));
+        return values;
+    }
     async function issueTokensHttp(response, db, user) {
         const resolved = getCookieConfig();
         const pair = await issueTokens(db, user);
-        response.header('Set-Cookie', buildSetCookieHeader(resolved, pair.refreshToken, getRefreshMaxAge()));
+        setCookies(response, sessionCookies(resolved, pair));
         return { accessToken: pair.accessToken, expiresIn: pair.expiresIn };
     }
     async function refreshHttp(response, db, request) {
@@ -179,30 +205,112 @@ export function createSessions(config) {
             throw new UnauthorizedError('Missing refresh token cookie');
         }
         const pair = await refresh(db, token);
-        response.header('Set-Cookie', buildSetCookieHeader(resolved, pair.refreshToken, getRefreshMaxAge()));
+        setCookies(response, sessionCookies(resolved, pair));
         return { accessToken: pair.accessToken, expiresIn: pair.expiresIn };
     }
+    async function revokeToken(db, token) {
+        const tokenHash = await hashToken(token);
+        await db.execute(sql `UPDATE pipework_refresh_tokens SET revoked_at = now()
+          WHERE token_hash = ${tokenHash} AND revoked_at IS NULL`);
+    }
     async function revokeHttp(response, db, request) {
         const resolved = getCookieConfig();
         const token = parseCookieHeader(request.headers['cookie'], resolved.name);
         if (token === undefined) {
             throw new UnauthorizedError('Missing refresh token cookie');
         }
-        const tokenHash = await hashToken(token);
-        await db.execute(sql `UPDATE pipework_refresh_tokens SET revoked_at = now()
-          WHERE token_hash = ${tokenHash} AND revoked_at IS NULL`);
-        response.header('Set-Cookie', buildClearCookieHeader(resolved));
+        await revokeToken(db, token);
+        setCookies(response, clearCookies(resolved));
+    }
+    async function revokeRefreshCookie(db, request) {
+        const resolved = getCookieConfig();
+        const token = parseCookieHeader(request.headers['cookie'], resolved.name);
+        if (token !== undefined)
+            await revokeToken(db, token);
     }
     async function revokeAllHttp(response, db, userId) {
         const resolved = getCookieConfig();
         await revokeAll(db, userId);
-        response.header('Set-Cookie', buildClearCookieHeader(resolved));
+        setCookies(response, clearCookies(resolved));
+    }
+    function strategy(options = {}) {
+        const trusted = options.trustedOrigins ?? [];
+        const tokens = new WeakMap();
+        const accessCookieName = getAccessCookieConfig()?.name;
+        return {
+            name: 'sessions',
+            extract(request) {
+                try {
+                    return Promise.resolve(extractSync(request));
+                }
+                catch (error) {
+                    return Promise.reject(error instanceof Error ? error : new Error(String(error)));
+                }
+            },
+            async verify(extracted, context) {
+                const token = tokens.get(extracted);
+                if (token === undefined)
+                    throw new UnauthorizedError('Invalid access token');
+                const payload = await verifyAccessToken(token);
+                if (config.versionCheck && !(await checkVersion(context.db(), payload.sub, payload.av))) {
+                    throw new UnauthorizedError('Session revoked');
+                }
+                return { userId: payload.sub, tenantId: payload.tid, roles: payload.roles ?? [], via: extracted.via };
+            },
+        };
+        function extractSync(request) {
+            let token;
+            let via = 'header';
+            const authorization = request.headers['authorization'];
+            if (authorization !== undefined && /^bearer /i.test(authorization)) {
+                token = authorization.slice(7).trim();
+            }
+            else if (accessCookieName !== undefined) {
+                const cookie = request.cookies[accessCookieName];
+                if (cookie !== undefined && cookie !== '') {
+                    token = cookie;
+                    via = 'cookie';
+                    assertSameSiteWrite(request, trusted);
+                }
+            }
+            if (token === undefined || token === '')
+                return null;
+            const extracted = { userId: '', tenantId: '', roles: [], via };
+            tokens.set(extracted, token);
+            return extracted;
+        }
     }
     return {
         issueTokens, refresh, revokeAll, bumpVersion, verifyAccessToken, checkVersion, cleanExpiredTokens,
-        issueTokensHttp, refreshHttp, revokeHttp, revokeAllHttp,
+        strategy, revokeRefreshCookie, issueTokensHttp, refreshHttp, revokeHttp, revokeAllHttp,
     };
 }
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+function assertSameSiteWrite(request, trusted) {
+    // No method is treated as a write: an AuthRequest built without one must not skip the check.
+    if (request.method !== undefined && SAFE_METHODS.has(request.method.toUpperCase()))
+        return;
+    const site = request.headers['sec-fetch-site'];
+    if (site !== undefined) {
+        if (site === 'same-origin' || site === 'same-site' || site === 'none')
+            return;
+        throw new CrossSiteRequestError();
+    }
+    const origin = request.headers['origin'];
+    if (origin !== undefined) {
+        if (trusted.includes(origin))
+            return;
+        try {
+            const host = request.headers['host'];
+            if (host !== undefined && new URL(origin).host === host.toLowerCase())
+                return;
+        }
+        catch {
+            // an unparseable Origin (such as "null") is refused below
+        }
+    }
+    throw new CrossSiteRequestError();
+}
 const TEST_KEY_PATTERNS = [
     'test', 'example', 'dummy', 'placeholder', 'changeme', 'insecure', 'dev-only',
 ];

package/dist/auth/auth/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/auth/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEtC,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAkElH;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,YAAY,CAAA;IACtD,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACjC,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,UAAU,GAAqB,IAAI,CAAA;IACvC,IAAI,SAAS,GAAqB,IAAI,CAAA;IACtC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkD,CAAA;IAC9E,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAA;IAEnD,KAAK,UAAU,aAAa;QAC1B,IAAI,CAAC,UAAU;YAAE,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACpG,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,KAAK,UAAU,YAAY;QACzB,IAAI,CAAC,SAAS;YAAE,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAChG,OAAO,SAAS,CAAA;IAClB,CAAC;IAGD,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,MAAc;QACtD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,iEAAiE,MAAM;;4BAEpD,CACvB,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,SAAS,CAAW,CAAA;QAEzD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAC/B,GAAG,CAAA,8DAA8D,MAAM,EAAE,CAC1E,CAAA;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,CAAC,CAAA;QAC/B,OAAO,GAAG,CAAC,SAAS,CAAW,CAAA;IACjC,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,EAAM,EACN,IAAwD,EACxD,WAAmB,MAAM,CAAC,UAAU,EAAE;QAEtC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/E,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QAElE,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;aAC1F,kBAAkB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;aACrD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;aACxB,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QAC7C,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAA;QACtD,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;QACnE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAA;QAEhE,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;oBACW,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,KAAK,WAAW,KAAK,QAAQ,WAAW,SAAS,CAAC,WAAW,EAAE,gBAAgB,CACvH,CAAA;QAED,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAA;IACtF,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,EAAM,EAAE,YAAoB;QACjD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,CAAA;QAE/C,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAA2B,EAAE;YACzE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA;;iCAEsB,SAAS;uBACnB,CAChB,CAAA;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;YAC5B,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;YACpB,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAW,CAAA;YACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAW,CAAA;YAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAW,CAAA;YAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAkB,CAAA;YACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAW,CAAC,CAAA;YAEvD,IAAI,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;YAC5B,CAAC;YAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,IAAI,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;oBACvC,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;oCACqB,QAAQ,+BAA+B,CAChE,CAAA;gBACH,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,4EAA4E,SAAS,EAAE,CAC3F,CAAA;YACH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY;gBAC/B,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACjD,CAAC,CAAC,SAAS,CAAA;YAEb,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,EAAE,EACF,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAClE,QAAQ,CACT,CAAA;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC7B,CAAC,CAAC,CAAA;QAEF,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,SAAS;gBACZ,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAA;YACtD,KAAK,SAAS;gBACZ,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAA;YACtD,KAAK,OAAO;gBACV,MAAM,IAAI,iBAAiB,CAAC,qDAAqD,CAAC,CAAA;YACpF,KAAK,IAAI;gBACP,OAAO,OAAO,CAAC,IAAI,CAAA;QACvB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,MAAc;QAC7C,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;4BACmB,MAAM,yBAAyB,CACtD,CAAA;IACH,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,MAAc;QAC/C,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;oBACW,MAAM;;yFAE+D,CACpF,CAAA;QACD,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,KAAa;QAC5C,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE;gBAC9C,UAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAA;YACF,OAAO;gBACL,GAAG,EAAE,OAAO,CAAC,GAAI;gBACjB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAW;gBAC7B,EAAE,EAAE,OAAO,CAAC,IAAI,CAAW;gBAC3B,KAAK,EAAE,OAAO,CAAC,OAAO,CAAyB;aAChD,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,MAAc,EAAE,YAAoB;QACtE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,OAAO,KAAK,YAAY,CAAA;QACxC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,8DAA8D,MAAM,EAAE,CAC1E,CAAA;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAE,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5E,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;QACvF,OAAO,cAAc,KAAK,YAAY,CAAA;IACxC,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,EAAM;QACtC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,2EAA2E,CAC/E,CAAA;QACD,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED,SAAS,eAAe;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAA;QACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;IACxE,CAAC;IAED,SAAS,gBAAgB;QACvB,OAAO,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,QAAsB,EACtB,EAAM,EACN,IAAwD;QAExD,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACxC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;QACpG,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;IACrE,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,QAAsB,EACtB,EAAM,EACN,OAAqC;QAErC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QACrC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;QACpG,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;IACrE,CAAC;IAED,KAAK,UAAU,UAAU,CACvB,QAAsB,EACtB,EAAM,EACN,OAAqC;QAErC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;+BACsB,SAAS,yBAAyB,CAC5D,CAAA;QACD,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,UAAU,aAAa,CAC1B,QAAsB,EACtB,EAAM,EACN,MAAc;QAEd,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC3B,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,OAAO;QACL,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,kBAAkB;QACjG,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa;KACxD,CAAA;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAC9E,CAAA;AAED,SAAS,mBAAmB,CAAC,MAAqB;IAChD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,OAAO,CAAA;IAEhD,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAA;IACnG,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAA;IAChG,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;IACvD,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,kCAAkC,OAAO,iCAAiC,CAAC,CAAA;YACzF,MAAK;QACP,CAAC;IACH,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAA;IACrF,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,uEAAuE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YACrH,oHAAoH,CACrH,CAAA;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC1C,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/auth/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAErF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEtC,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAyFlH;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,YAAY,CAAA;IACtD,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACjC,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,UAAU,GAAqB,IAAI,CAAA;IACvC,IAAI,SAAS,GAAqB,IAAI,CAAA;IACtC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkD,CAAA;IAC9E,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAA;IAEnD,KAAK,UAAU,aAAa;QAC1B,IAAI,CAAC,UAAU;YAAE,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACpG,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,KAAK,UAAU,YAAY;QACzB,IAAI,CAAC,SAAS;YAAE,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAChG,OAAO,SAAS,CAAA;IAClB,CAAC;IAGD,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,MAAc;QACtD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,iEAAiE,MAAM;;4BAEpD,CACvB,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,SAAS,CAAW,CAAA;QAEzD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAC/B,GAAG,CAAA,8DAA8D,MAAM,EAAE,CAC1E,CAAA;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,CAAC,CAAA;QAC/B,OAAO,GAAG,CAAC,SAAS,CAAW,CAAA;IACjC,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,EAAM,EACN,IAAwD,EACxD,WAAmB,MAAM,CAAC,UAAU,EAAE;QAEtC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/E,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QAElE,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;aAC1F,kBAAkB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;aACrD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;aACxB,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QAC7C,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAA;QACtD,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;QACnE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAA;QAEhE,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;oBACW,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,KAAK,WAAW,KAAK,QAAQ,WAAW,SAAS,CAAC,WAAW,EAAE,gBAAgB,CACvH,CAAA;QAED,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAA;IACtF,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,EAAM,EAAE,YAAoB;QACjD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,CAAA;QAE/C,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAA2B,EAAE;YACzE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA;;iCAEsB,SAAS;uBACnB,CAChB,CAAA;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;YAC5B,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;YACpB,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAW,CAAA;YACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAW,CAAA;YAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAW,CAAA;YAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAkB,CAAA;YACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAW,CAAC,CAAA;YAEvD,IAAI,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;YAC5B,CAAC;YAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,IAAI,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;oBACvC,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;oCACqB,QAAQ,+BAA+B,CAChE,CAAA;gBACH,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,4EAA4E,SAAS,EAAE,CAC3F,CAAA;YACH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY;gBAC/B,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACjD,CAAC,CAAC,SAAS,CAAA;YAEb,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,EAAE,EACF,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAClE,QAAQ,CACT,CAAA;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC7B,CAAC,CAAC,CAAA;QAEF,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,SAAS;gBACZ,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAA;YACtD,KAAK,SAAS;gBACZ,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAA;YACtD,KAAK,OAAO;gBACV,MAAM,IAAI,iBAAiB,CAAC,qDAAqD,CAAC,CAAA;YACpF,KAAK,IAAI;gBACP,OAAO,OAAO,CAAC,IAAI,CAAA;QACvB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,MAAc;QAC7C,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;4BACmB,MAAM,yBAAyB,CACtD,CAAA;IACH,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,MAAc;QAC/C,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;oBACW,MAAM;;yFAE+D,CACpF,CAAA;QACD,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,KAAa;QAC5C,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE;gBAC9C,UAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAA;YACF,OAAO;gBACL,GAAG,EAAE,OAAO,CAAC,GAAI;gBACjB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAW;gBAC7B,EAAE,EAAE,OAAO,CAAC,IAAI,CAAW;gBAC3B,KAAK,EAAE,OAAO,CAAC,OAAO,CAAyB;aAChD,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAAmC,EAAE,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACrE,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAA;YACrD,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,MAAc,EAAE,YAAoB;QACtE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,OAAO,KAAK,YAAY,CAAA;QACxC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,8DAA8D,MAAM,EAAE,CAC1E,CAAA;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAE,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5E,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;QACvF,OAAO,cAAc,KAAK,YAAY,CAAA;IACxC,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,EAAM;QACtC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,2EAA2E,CAC/E,CAAA;QACD,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED,SAAS,eAAe;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAA;QACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;IACxE,CAAC;IAED,SAAS,qBAAqB;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAA;QACxC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QACrC,OAAO,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IACjG,CAAC;IAED,SAAS,gBAAgB;QACvB,OAAO,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;IACnD,CAAC;IAED,SAAS,UAAU,CAAC,QAAsB,EAAE,MAAgB;QAC1D,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1E,CAAC;IAED,SAAS,cAAc,CAAC,QAA8B,EAAE,IAAe;QACrE,MAAM,MAAM,GAAG,CAAC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;QACtF,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAA;QACtC,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;QAChG,OAAO,MAAM,CAAA;IACf,CAAC;IAED,SAAS,YAAY,CAAC,QAA8B;QAClD,MAAM,MAAM,GAAG,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAA;QACtC,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAA;QAChE,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,QAAsB,EACtB,EAAM,EACN,IAAwD;QAExD,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACxC,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAA;QACpD,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;IACrE,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,QAAsB,EACtB,EAAM,EACN,OAAqC;QAErC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QACrC,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAA;QACpD,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;IACrE,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,KAAa;QAC9C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA;+BACsB,SAAS,yBAAyB,CAC5D,CAAA;IACH,CAAC;IAED,KAAK,UAAU,UAAU,CACvB,QAAsB,EACtB,EAAM,EACN,OAAqC;QAErC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC5B,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,EAAM,EAAE,OAAqC;QAC9E,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzE,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IACvD,CAAC;IAED,KAAK,UAAU,aAAa,CAC1B,QAAsB,EACtB,EAAM,EACN,MAAc;QAEd,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;QAClC,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC3B,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED,SAAS,QAAQ,CAAC,UAAkC,EAAE;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAA;QAC5C,MAAM,MAAM,GAAG,IAAI,OAAO,EAAkB,CAAA;QAC5C,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,EAAE,IAAI,CAAA;QAEtD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,OAAO,CAAC,OAAoB;gBAC1B,IAAI,CAAC;oBACH,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA;gBAC9C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAClF,CAAC;YACH,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,SAAsB,EAAE,OAAoB;gBACvD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;gBACnC,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAA;gBAC5E,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAA;gBAC9C,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBACxF,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;gBAChD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAA;YACvG,CAAC;SACF,CAAA;QAED,SAAS,WAAW,CAAC,OAAoB;YACvC,IAAI,KAAyB,CAAA;YAC7B,IAAI,GAAG,GAAwB,QAAQ,CAAA;YACvC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;YACtD,IAAI,aAAa,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnE,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACvC,CAAC;iBAAM,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;gBAChD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;oBAC1C,KAAK,GAAG,MAAM,CAAA;oBACd,GAAG,GAAG,QAAQ,CAAA;oBACd,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAA;YACpD,MAAM,SAAS,GAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAA;YAC3E,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;YAC5B,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,kBAAkB;QACjG,QAAQ,EAAE,mBAAmB,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa;KACvF,CAAA;AACH,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAExD,SAAS,mBAAmB,CAAC,OAAoB,EAAE,OAA0B;IAC3E,6FAA6F;IAC7F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAM;IAC1F,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,MAAM;YAAE,OAAM;QAC7E,MAAM,IAAI,qBAAqB,EAAE,CAAA;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAM;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACpC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE;gBAAE,OAAM;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,EAAE,CAAA;AACnC,CAAC;AAED,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAC9E,CAAA;AAED,SAAS,mBAAmB,CAAC,MAAqB;IAChD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,OAAO,CAAA;IAEhD,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAA;IACnG,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAA;IAChG,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;IACvD,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,kCAAkC,OAAO,iCAAiC,CAAC,CAAA;YACzF,MAAK;QACP,CAAC;IACH,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAA;IACrF,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,uEAAuE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YACrH,oHAAoH,CACrH,CAAA;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC1C,CAAC"}

package/dist/auth/auth/types.d.ts

@@ -9,10 +9,11 @@ export interface AuthStrategy<TAuth> {
     extract(request: AuthRequest, context: AuthContext): Promise<TAuth | null>;
     verify(extracted: TAuth, context: AuthContext): Promise<TAuth>;
 }
-/** Normalized request shape passed to auth strategies — headers, cookies, method, url. */
+/** Normalized request shape passed to auth strategies — headers, the parsed `Cookie` header, and the upper-case HTTP method. */
 export interface AuthRequest {
     readonly headers: Readonly<Record<string, string | undefined>>;
     readonly cookies: Readonly<Record<string, string | undefined>>;
+    readonly method?: string;
 }
 /** Minimum auth shape — userId and tenantId. Extend for app-specific auth fields. */
 export interface BaseAuth {

package/dist/auth/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAEhD,gGAAgG;AAChG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,EAAE,CAAA;CACnC;AAED,yFAAyF;AACzF,MAAM,WAAW,YAAY,CAAC,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAA;IAC1E,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;CAC/D;AAED,0FAA0F;AAC1F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC9D,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;CAC/D;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAEhD,gGAAgG;AAChG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,EAAE,CAAA;CACnC;AAED,yFAAyF;AACzF,MAAM,WAAW,YAAY,CAAC,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAA;IAC1E,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;CAC/D;AAED,gIAAgI;AAChI,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC9D,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B"}

package/dist/core/errors/http.d.ts

@@ -14,6 +14,11 @@ export declare class ForbiddenError extends PipeworkError {
     readonly httpStatus: 403;
     constructor(message?: string, details?: Record<string, unknown>);
 }
+export declare class CrossSiteRequestError extends PipeworkError {
+    readonly code: "CROSS_SITE_REQUEST";
+    readonly httpStatus: 403;
+    constructor(message?: string, details?: Record<string, unknown>);
+}
 export declare class ValidationError extends PipeworkError {
     readonly code: "VALIDATION_ERROR";
     readonly httpStatus: 422;

package/dist/core/errors/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/core/errors/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzC,qBAAa,aAAc,SAAQ,aAAa;IAC9C,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAS;IACpC,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAEtB,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAGpE;AAED,qBAAa,iBAAkB,SAAQ,aAAa;IAClD,QAAQ,CAAC,IAAI,EAAG,cAAc,CAAS;IACvC,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAEtB,OAAO,GAAE,MAAkC,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAG/F;AAED,qBAAa,cAAe,SAAQ,aAAa;IAC/C,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAS;IACpC,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAEtB,OAAO,GAAE,MAAmC,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAGhG;AAED,qBAAa,eAAgB,SAAQ,aAAa;IAChD,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAS;IAC3C,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;IAClC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;gBAErD,OAAO,EAAE,MAAM;gBACf,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM;CAWpE;AAED,qBAAa,oBAAqB,SAAQ,aAAa;IACrD,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAS;IAC5C,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;gBAEtB,iBAAiB,EAAE,MAAM,EAAE,OAAO,GAAE,MAA8C;CAI/F;AAED,qBAAa,aAAc,SAAQ,aAAa;IAC9C,QAAQ,CAAC,IAAI,EAAG,UAAU,CAAS;IACnC,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAEtB,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAGnE;AAGD,qBAAa,oBAAqB,SAAQ,aAAa;IACrD,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAS;IAC5C,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAEtB,OAAO,GAAE,MAAiC,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAG9F;AAED,qBAAa,yBAA0B,SAAQ,aAAa;IAC1D,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAS;IACjD,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAEtB,OAAO,GAAE,MAAiC,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAG9F"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/core/errors/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzC,qBAAa,aAAc,SAAQ,aAAa;IAC9C,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAS;IACpC,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAEtB,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAGpE;AAED,qBAAa,iBAAkB,SAAQ,aAAa;IAClD,QAAQ,CAAC,IAAI,EAAG,cAAc,CAAS;IACvC,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAEtB,OAAO,GAAE,MAAkC,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAG/F;AAED,qBAAa,cAAe,SAAQ,aAAa;IAC/C,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAS;IACpC,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAEtB,OAAO,GAAE,MAAmC,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAGhG;AAED,qBAAa,qBAAsB,SAAQ,aAAa;IACtD,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAS;IAC7C,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAGhC,OAAO,GAAE,MAAgF,EACzF,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAIxC;AAED,qBAAa,eAAgB,SAAQ,aAAa;IAChD,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAS;IAC3C,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;IAClC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;gBAErD,OAAO,EAAE,MAAM;gBACf,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM;CAWpE;AAED,qBAAa,oBAAqB,SAAQ,aAAa;IACrD,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAS;IAC5C,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;gBAEtB,iBAAiB,EAAE,MAAM,EAAE,OAAO,GAAE,MAA8C;CAI/F;AAED,qBAAa,aAAc,SAAQ,aAAa;IAC9C,QAAQ,CAAC,IAAI,EAAG,UAAU,CAAS;IACnC,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAEtB,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAGnE;AAGD,qBAAa,oBAAqB,SAAQ,aAAa;IACrD,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAS;IAC5C,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAEtB,OAAO,GAAE,MAAiC,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAG9F;AAED,qBAAa,yBAA0B,SAAQ,aAAa;IAC1D,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAS;IACjD,QAAQ,CAAC,UAAU,EAAG,GAAG,CAAS;gBAEtB,OAAO,GAAE,MAAiC,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAG9F"}

package/dist/core/errors/http.js

@@ -20,6 +20,13 @@ export class ForbiddenError extends PipeworkError {
         super(message, details);
     }
 }
+export class CrossSiteRequestError extends PipeworkError {
+    code = 'CROSS_SITE_REQUEST';
+    httpStatus = 403;
+    constructor(message = 'A write authenticated by a cookie must come from the app\'s own site.', details = {}) {
+        super(message, details);
+    }
+}
 export class ValidationError extends PipeworkError {
     code = 'VALIDATION_ERROR';
     httpStatus = 422;

package/dist/core/errors/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/core/errors/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzC,MAAM,OAAO,aAAc,SAAQ,aAAa;IACrC,IAAI,GAAG,WAAoB,CAAA;IAC3B,UAAU,GAAG,GAAY,CAAA;IAElC,YAAY,QAAgB,EAAE,UAAmC,EAAE;QACjE,KAAK,CAAC,GAAG,QAAQ,YAAY,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IACzC,IAAI,GAAG,cAAuB,CAAA;IAC9B,UAAU,GAAG,GAAY,CAAA;IAElC,YAAY,UAAkB,yBAAyB,EAAE,UAAmC,EAAE;QAC5F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzB,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,aAAa;IACtC,IAAI,GAAG,WAAoB,CAAA;IAC3B,UAAU,GAAG,GAAY,CAAA;IAElC,YAAY,UAAkB,0BAA0B,EAAE,UAAmC,EAAE;QAC7F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzB,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,aAAa;IACvC,IAAI,GAAG,kBAA2B,CAAA;IAClC,UAAU,GAAG,GAAY,CAAA;IACzB,WAAW,CAA6C;IAIjE,YAAY,oBAAuD,EAAE,OAAgB;QACnF,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;YAC7C,KAAK,CAAC,oBAAoB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;YAChD,IAAI,CAAC,WAAW,GAAG,EAAE,CAAA;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,OAAO,IAAI,eAAe,CAAA;YACtC,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC,CAAA;YACjD,IAAI,CAAC,WAAW,GAAG,oBAAoB,CAAA;QACzC,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IAC5C,IAAI,GAAG,mBAA4B,CAAA;IACnC,UAAU,GAAG,GAAY,CAAA;IACzB,iBAAiB,CAAQ;IAElC,YAAY,iBAAyB,EAAE,UAAkB,qCAAqC;QAC5F,KAAK,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;IAC5C,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,aAAa;IACrC,IAAI,GAAG,UAAmB,CAAA;IAC1B,UAAU,GAAG,GAAY,CAAA;IAElC,YAAY,OAAe,EAAE,UAAmC,EAAE;QAChE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzB,CAAC;CACF;AAGD,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IAC5C,IAAI,GAAG,mBAA4B,CAAA;IACnC,UAAU,GAAG,GAAY,CAAA;IAElC,YAAY,UAAkB,wBAAwB,EAAE,UAAmC,EAAE;QAC3F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzB,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,aAAa;IACjD,IAAI,GAAG,wBAAiC,CAAA;IACxC,UAAU,GAAG,GAAY,CAAA;IAElC,YAAY,UAAkB,wBAAwB,EAAE,UAAmC,EAAE;QAC3F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzB,CAAC;CACF"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/core/errors/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzC,MAAM,OAAO,aAAc,SAAQ,aAAa;IACrC,IAAI,GAAG,WAAoB,CAAA;IAC3B,UAAU,GAAG,GAAY,CAAA;IAElC,YAAY,QAAgB,EAAE,UAAmC,EAAE;QACjE,KAAK,CAAC,GAAG,QAAQ,YAAY,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IACzC,IAAI,GAAG,cAAuB,CAAA;IAC9B,UAAU,GAAG,GAAY,CAAA;IAElC,YAAY,UAAkB,yBAAyB,EAAE,UAAmC,EAAE;QAC5F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzB,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,aAAa;IACtC,IAAI,GAAG,WAAoB,CAAA;IAC3B,UAAU,GAAG,GAAY,CAAA;IAElC,YAAY,UAAkB,0BAA0B,EAAE,UAAmC,EAAE;QAC7F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzB,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,aAAa;IAC7C,IAAI,GAAG,oBAA6B,CAAA;IACpC,UAAU,GAAG,GAAY,CAAA;IAElC,YACE,UAAkB,uEAAuE,EACzF,UAAmC,EAAE;QAErC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzB,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,aAAa;IACvC,IAAI,GAAG,kBAA2B,CAAA;IAClC,UAAU,GAAG,GAAY,CAAA;IACzB,WAAW,CAA6C;IAIjE,YAAY,oBAAuD,EAAE,OAAgB;QACnF,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;YAC7C,KAAK,CAAC,oBAAoB,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;YAChD,IAAI,CAAC,WAAW,GAAG,EAAE,CAAA;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,OAAO,IAAI,eAAe,CAAA;YACtC,KAAK,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC,CAAA;YACjD,IAAI,CAAC,WAAW,GAAG,oBAAoB,CAAA;QACzC,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IAC5C,IAAI,GAAG,mBAA4B,CAAA;IACnC,UAAU,GAAG,GAAY,CAAA;IACzB,iBAAiB,CAAQ;IAElC,YAAY,iBAAyB,EAAE,UAAkB,qCAAqC;QAC5F,KAAK,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;IAC5C,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,aAAa;IACrC,IAAI,GAAG,UAAmB,CAAA;IAC1B,UAAU,GAAG,GAAY,CAAA;IAElC,YAAY,OAAe,EAAE,UAAmC,EAAE;QAChE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzB,CAAC;CACF;AAGD,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IAC5C,IAAI,GAAG,mBAA4B,CAAA;IACnC,UAAU,GAAG,GAAY,CAAA;IAElC,YAAY,UAAkB,wBAAwB,EAAE,UAAmC,EAAE;QAC3F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzB,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,aAAa;IACjD,IAAI,GAAG,wBAAiC,CAAA;IACxC,UAAU,GAAG,GAAY,CAAA;IAElC,YAAY,UAAkB,wBAAwB,EAAE,UAAmC,EAAE;QAC3F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzB,CAAC;CACF"}

package/dist/core/errors/index.d.ts

@@ -1,3 +1,3 @@
 export { PipeworkError, isPipeworkError } from './base.js';
-export { NotFoundError, UnauthorizedError, ForbiddenError, ValidationError, ConflictError, TooManyRequestsError, PayloadTooLargeError, UnsupportedMediaTypeError } from './http.js';
+export { NotFoundError, UnauthorizedError, ForbiddenError, CrossSiteRequestError, ValidationError, ConflictError, TooManyRequestsError, PayloadTooLargeError, UnsupportedMediaTypeError } from './http.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/errors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA"}

package/dist/core/errors/index.js

@@ -1,3 +1,3 @@
 export { PipeworkError, isPipeworkError } from './base.js';
-export { NotFoundError, UnauthorizedError, ForbiddenError, ValidationError, ConflictError, TooManyRequestsError, PayloadTooLargeError, UnsupportedMediaTypeError } from './http.js';
+export { NotFoundError, UnauthorizedError, ForbiddenError, CrossSiteRequestError, ValidationError, ConflictError, TooManyRequestsError, PayloadTooLargeError, UnsupportedMediaTypeError } from './http.js';
 //# sourceMappingURL=index.js.map

package/dist/core/errors/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA"}

package/dist/core/errors/namespace.d.ts

@@ -1,4 +1,4 @@
-import { PipeworkError, NotFoundError, UnauthorizedError, ForbiddenError, ValidationError, ConflictError, TooManyRequestsError, PayloadTooLargeError, UnsupportedMediaTypeError } from './index.js';
+import { PipeworkError, NotFoundError, UnauthorizedError, ForbiddenError, CrossSiteRequestError, ValidationError, ConflictError, TooManyRequestsError, PayloadTooLargeError, UnsupportedMediaTypeError } from './index.js';
 /** Standard error classes — all extend PipeworkError with structured error codes and actionable messages. */
 export declare const errors: {
     /** Base error class with code, statusCode, and suggestion fields. */
@@ -9,6 +9,8 @@ export declare const errors: {
     Unauthorized: typeof UnauthorizedError;
     /** 403 — authenticated but insufficient permissions. */
     Forbidden: typeof ForbiddenError;
+    /** 403 `CROSS_SITE_REQUEST` — a cookie-authenticated write that did not come from the app's own site. */
+    CrossSiteRequest: typeof CrossSiteRequestError;
     /** 422 — input validation failed, carries field-level details. */
     Validation: typeof ValidationError;
     /** 409 — resource state conflict (duplicate, version mismatch). */