sdlc-agent-4-enterprise-server 1.46.2 → 1.47.0

package/.dockerignore

@@ -16,3 +16,11 @@ test*.ts
 coverage
 .env
 .env.*
+# SA4E-335 DEF-001: the `test` stage COPYs tests/ and .env.test (Dockerfile
+# L127-128) — re-include exactly those so `docker build --target test` works.
+# Last matching pattern wins, so the negations must follow the exclusions.
+# Everything else (.env, .env.production, *.md, *.log) stays excluded.
+!tests
+!.env.test
+# SEC-01: credentials never enter the build context (nor any image layer).
+secrets

package/Dockerfile

@@ -1,43 +1,111 @@
-# SA4E-44 Backend Dockerfile
-# Node.js 22 + Hono backend for Code Intelligence MCP Server
-FROM node:22-alpine AS base
+# syntax=docker/dockerfile:1
+# =============================================================================
+# SA4E-335 Backend Dockerfile — Node.js 22 + Hono Code Intelligence MCP Server
+# -----------------------------------------------------------------------------
+# Multi-stage build (6 stages): base, deps, build, production, development, test.
+# `production` is the SOLE CI push target (TDD AD-2). Build-only tooling never
+# reaches the runtime image.
+#
+# Design decisions (TDD §3.2 / Security Review):
+#   - AD-1 : base = node:22-slim (Debian/glibc) so native modules such as
+#            onnxruntime-node link against glibc (musl/alpine is incompatible).
+#   - SEC-02 (Critical): base image pinned by immutable sha256 DIGEST, not only
+#            the mutable tag, to keep the build hermetic/reproducible. The human
+#            readable tag is kept as a comment; update the digest via Dependabot/
+#            Renovate (see documents/SA4E-335/BUILD-AND-REGISTRY.md).
+#   - SEC-05 (High): `git` and the compiler toolchain live ONLY in build-time
+#            stages (base/build). The runtime `production` stage installs the
+#            minimal runtime surface — no git, no compilers.
+#   - BR-05 : non-root user `sa4e` (uid/gid 1001) in production/development/test.
+#   - AD-6 : SA4E-44 capability items (draw.io CLI/Electron/xvfb, model pre-cache,
+#            SERVER_WORKSPACES_ROOT) are guarded behind build args and DEFAULT OFF
+#            (SEC-08) — a bare `docker build --target production .` must succeed.
+# =============================================================================
+
+# --- Build-time arguments (NO secrets — build args must never carry credentials, BR-17) ---
+ARG NODE_VERSION=22
+# node:22-slim — pin by digest for a reproducible supply chain (SEC-02).
+# Tag kept for readability; the digest is the authoritative pin.
+ARG NODE_BASE_DIGEST=sha256:43ac6c60b8f89723f746e8a92ce91abd5017e627ce1ddfe4238355d3a30b772c
 
+# -----------------------------------------------------------------------------
+# base — shared workdir + build toolchain (glibc). Build-time only.
+# -----------------------------------------------------------------------------
+FROM node:${NODE_VERSION}-slim@${NODE_BASE_DIGEST} AS base
 WORKDIR /app
+# Native-module build toolchain (python3/make/g++) + git for build-time fetches.
+# Single layer with apt cleanup to keep intermediate layers lean. These packages
+# are discarded from the runtime image (they exist only in base/build).
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends python3 make g++ git \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/*
 
-# Install dependencies for native modules (onnxruntime-node)
-RUN apk add --no-cache python3 make g++ git
-
-# --- Dependencies stage ---
+# -----------------------------------------------------------------------------
+# deps — production (runtime) dependencies only.
+# -----------------------------------------------------------------------------
 FROM base AS deps
 COPY package.json package-lock.json ./
+# `npm ci` is hermetic: it installs exactly the locked versions (BR-03).
 RUN npm ci --omit=dev
 
-# --- Build stage ---
+# -----------------------------------------------------------------------------
+# build — compile TypeScript -> dist/. Full (dev) dependency set.
+# -----------------------------------------------------------------------------
 FROM base AS build
 COPY package.json package-lock.json ./
 RUN npm ci
 COPY tsconfig.json ./
 COPY src/ ./src/
 RUN npm run build
+# (AD-6, conditional) Pre-download embedding model into TRANSFORMERS_CACHE here
+# and strip tree-sitter-jsp to keep the build hermetic. DEFAULT OFF (SEC-08):
+# enable only when the runtime genuinely needs local embeddings / diagram export.
 
-# --- Production stage ---
-FROM node:22-alpine AS production
-
+# -----------------------------------------------------------------------------
+# production ★ — runtime image. SOLE CI push target. Minimal surface, non-root.
+# No git, no compilers (SEC-05). node:22-slim pinned by digest (SEC-02).
+# -----------------------------------------------------------------------------
+FROM node:${NODE_VERSION}-slim@${NODE_BASE_DIGEST} AS production
 WORKDIR /app
 
-# Runtime dependencies only
-RUN apk add --no-cache git
-
+# SA4E-335 DEF-004 — CI Trivy gate (CRITICAL,HIGH + ignore-unfixed) counts the
+# npm CLI that the base image bundles under /usr/local/lib/node_modules/npm.
+# Those copies (pacote, sigstore, brace-expansion, picomatch, ip-address,
+# undici) are NOT reachable from backend/package-lock.json, and the pinned
+# node:22-slim digest is already the latest — so the fix is to bump the CLI
+# itself (10.9.9 → NPM_VERSION: pacote/sigstore majors land on patched lines)
+# and refresh the two packages upstream has not re-released yet, using
+# same-major PATCH releases only (5.0.9→5.0.12, 6.28.0→6.28.1).
+# npm/npx stay installed: the sandbox module's local-mode fallback (UC-06)
+# shells out to them at runtime, so removing the CLI would be a regression.
+# Build stages keep the base npm for `npm ci` — only the runtime CLI moves.
+# The trailing probes fail the build if either patch broke module resolution
+# or the CLI itself.
+ARG NPM_VERSION=11.21.0
+RUN npm install -g npm@${NPM_VERSION} --no-audit --no-fund --loglevel=error \
+ && NM=/usr/local/lib/node_modules/npm/node_modules \
+ && for entry in "brace-expansion 5.0.12" "undici 6.28.1"; do \
+      name=$(echo "$entry" | cut -d' ' -f1); ver=$(echo "$entry" | cut -d' ' -f2); \
+      tgz=$(npm pack "${name}@${ver}" --pack-destination /tmp --silent); \
+      rm -rf "${NM}/${name}"; mkdir -p "${NM}/${name}"; \
+      tar -xzf "/tmp/${tgz}" -C "${NM}/${name}" --strip-components=1; \
+    done \
+ && rm -rf /tmp/*.tgz \
+ && node -e "require('${NM}/brace-expansion'); require('${NM}/undici')" \
+ && npm --version
+
+# Runtime copies the pruned production node_modules + compiled dist only.
 COPY --from=deps /app/node_modules ./node_modules
 COPY --from=build /app/dist ./dist
 COPY --from=build /app/package.json ./
 
-# Create non-root user
-RUN addgroup -g 1001 -S sa4e && \
-    adduser -S sa4e -u 1001 -G sa4e && \
-    mkdir -p /app/.code-intel && \
-    chown -R sa4e:sa4e /app
-
+# Non-root runtime user (BR-05). Debian uses groupadd/useradd (not alpine addgroup).
+# `-r` = system account, `nologin` shell = no interactive login.
+RUN groupadd -g 1001 sa4e \
+ && useradd -u 1001 -g sa4e -r -s /usr/sbin/nologin sa4e \
+ && mkdir -p /app/.code-intel \
+ && chown -R sa4e:sa4e /app
 USER sa4e
 
 ENV NODE_ENV=production
@@ -45,13 +113,15 @@ ENV PORT=48721
 
 EXPOSE 48721
 
+# Dependency-free health probe (SEC-12): node:22-slim does not ship `wget`, so a
+# wget-based probe would silently fail. Use node's built-in http client instead.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-  CMD wget --no-verbose --tries=1 --spider http://localhost:48721/health || exit 1
+  CMD node -e "require('http').get('http://localhost:'+(process.env.PORT||48721)+'/health',r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"
 
 CMD ["node", "dist/index.js"]
 
 # -----------------------------------------------------------------------------
-# Development stage — hot reload (tsx watch) for local dev. Non-root user.
+# development — hot reload (tsx watch) for local dev. Non-root user.
 # Build: docker compose -f docker-compose.yml -f docker-compose.dev.yml up
 # -----------------------------------------------------------------------------
 FROM base AS development
@@ -61,15 +131,15 @@ COPY package.json package-lock.json ./
 RUN npm ci
 COPY tsconfig.json ./
 COPY src/ ./src/
-RUN addgroup -g 1001 -S sa4e && \
-    adduser -S sa4e -u 1001 -G sa4e && \
-    chown -R sa4e:sa4e /app
+RUN groupadd -g 1001 sa4e \
+ && useradd -u 1001 -g sa4e -r -s /usr/sbin/nologin sa4e \
+ && chown -R sa4e:sa4e /app
 USER sa4e
 EXPOSE 48721
 CMD ["npx", "tsx", "watch", "--ignore", ".code-intel/**", "src/index.ts"]
 
 # -----------------------------------------------------------------------------
-# Test stage — runs the vitest unit suite inside the container (non-root).
+# test — runs the vitest unit suite inside the container (non-root).
 # Build: docker build --target test -t sa4e-backend-test .
 # Run:   docker run --rm sa4e-backend-test
 # -----------------------------------------------------------------------------
@@ -82,8 +152,8 @@ COPY tsconfig.json ./
 COPY src/ ./src/
 COPY tests/ ./tests/
 COPY .env.test ./
-RUN addgroup -g 1001 -S sa4e && \
-    adduser -S sa4e -u 1001 -G sa4e && \
-    chown -R sa4e:sa4e /app
+RUN groupadd -g 1001 sa4e \
+ && useradd -u 1001 -g sa4e -r -s /usr/sbin/nologin sa4e \
+ && chown -R sa4e:sa4e /app
 USER sa4e
 CMD ["npx", "vitest", "run"]

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-1.46.2-blue?style=for-the-badge" alt="Version">
+  <img src="https://img.shields.io/badge/version-1.47.0-blue?style=for-the-badge" alt="Version">
   <img src="https://img.shields.io/badge/tools-66+-teal?style=for-the-badge" alt="Tools">
   <img src="https://img.shields.io/badge/node-%3E%3D18-green?style=for-the-badge" alt="Node">
 </p>
@@ -38,7 +38,7 @@ Server starts at **http://localhost:48721**. Verify it's running:
 
 ```bash
 curl http://localhost:48721/health
-# → {"status":"healthy","version":"1.46.2","uptime":5,"tools_loaded":52}
+# → {"status":"healthy","version":"1.47.0","uptime":5,"tools_loaded":52}
 ```
 
 ### Development Mode (auto-reload)
@@ -233,6 +233,7 @@ The embedding model is expected at `.code-intel/models/model.onnx`. Download it:
 
 | Version | Date | Ticket | Changes |
 |---------|------|--------|---------|
+| 1.47.0 | 2026-10-02 | — | New endpoint `GET /api/v1/enrichment/failures?limit=N` (clamp 1–1000, default 200) returns full FAILED enrichment task list from `pending_tasks` with resolved source, error, retry count, timestamp (`PendingTaskRepository.listFailedDetailed`). Surfaces ingest failures to the extension beyond the 10-item status tooltip. |
 | 1.46.2 | 2026-09-28 | — | Version sync (no backend code changes; packaging fix lives in `extension`: missing direct `yargs` dep for vendored devtools barrel). |
 | 1.46.1 | 2026-09-28 | — | Version sync patch: align `root`/`backend`/`extension` to 1.46.1; README badges + health example + changelogs updated. No runtime code changes since 1.46.0. |
 | 1.46.0 | 2026-09-27 | SA4E-289/324..332 | SA4E-289 epic (Option C): LangGraph decommission + Pi SDK cutover, shared kernel `extension/src/mcp/`. SA4E-324..330 small-model wave (`LlmProvider.countTokens()`, budget gate REJECT >95%/WARN >85%, compression, routing, compaction). Security: 4 High + 17 Medium fixed, 0 Critical. 20 test.todo implemented; suites green. |

package/dist/admin/db/core.js

@@ -15,6 +15,8 @@ import { hashPassword, verifyPassword, generateToken } from './password.js';
 import { SqliteWasmAdapter } from '../../database/adapters/wasm/SqliteWasmAdapter.js';
 import { DatabaseAdapterFactory } from '../../database/factory/DatabaseAdapterFactory.js';
 import { DatabaseConfigService } from '../../database/config/DatabaseConfigService.js';
+import { seedEngineFromEnv } from '../../database/config/seedEngineFromEnv.js';
+import { ensurePostgresSchema } from '../../database/schema-registry/ensure-postgres-schema.js';
 export { hashPassword, verifyPassword, generateToken };
 export const logger = pino({ name: 'admin-db' });
 const config = loadConfig();
@@ -140,6 +142,9 @@ export function getDbAdapter() {
  * @throws Error if connection fails (server should not start)
  */
 export async function initAdapters() {
+    // SA4E-335 DEF-002: a DATABASE_URL(_FILE) handed out by compose secrets wins
+    // over database.json — seed the engine before resolving it (no-op without env).
+    seedEngineFromEnv(DATA_DIR);
     const engine = getActiveEngine();
     if (engine === 'sqlite') {
         // Create instance + await wasm connect + schema init/seed (shared promise).
@@ -157,6 +162,9 @@ export async function initAdapters() {
     try {
         await initSchema(adapter);
         await seedDefaults(adapter);
+        // SA4E-335 DEF-002: initSchema covers admin/graph tables only — also ensure
+        // the engine-specific index + memory (KB) tables (idempotent; no-op off PG).
+        await ensurePostgresSchema(adapter);
     }
     catch (err) {
         logger.error({ err }, '[admin] Failed to init schema/seed defaults');

package/dist/admin/db/core.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../src/admin/db/core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AAEvD,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AAClE,4DAA4D;AAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;AAE5D,mFAAmF;AACnF,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,QAAQ,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,8EAA8E;QAC9E,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,GAAG,CAAC,YAAY,IAAI,QAAQ,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,QAAQ,CAAC;IAAC,CAAC;AAC9B,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAAC,MAAM,GAAG,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;QACtE,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAAC,CAAC;AACpE,CAAC;AAED,IAAI,aAAa,GAA6B,IAAI,CAAC;AACnD,6EAA6E;AAC7E,wEAAwE;AACxE,IAAI,WAAW,GAAyB,IAAI,CAAC;AAE7C;;;;;GAKG;AACH,SAAS,uBAAuB;IAC9B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB;IAC/B,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE;aAC5B,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;aAC/B,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;aACjC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0CAA0C,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,mDAAmD;AAEnD,IAAI,SAAS,GAA2B,IAAI,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,iEAAiE;YACjE,2EAA2E;YAC3E,uEAAuE;YACvE,0CAA0C;YAC1C,SAAS,GAAG,uBAAuB,EAAE,CAAC;YACtC,KAAK,wBAAwB,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC5C,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,+CAA+C,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;YACrD,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACxD,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,sCAAsC,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,4EAA4E;QAC5E,SAAS,GAAG,uBAAuB,EAAE,CAAC;QACtC,MAAM,wBAAwB,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,mDAAmD,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IACxB,SAAS,GAAG,OAAO,CAAC;IAEpB,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,6CAA6C,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,wCAAwC,CAAC,CAAC;AACpE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY;IAC1B,SAAS,GAAG,IAAI,CAAC;IACjB,WAAW,GAAG,IAAI,CAAC;IACnB,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../src/admin/db/core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0DAA0D,CAAC;AAEhG,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AAEvD,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AAClE,4DAA4D;AAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;AAE5D,mFAAmF;AACnF,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,QAAQ,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,8EAA8E;QAC9E,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,GAAG,CAAC,YAAY,IAAI,QAAQ,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,QAAQ,CAAC;IAAC,CAAC;AAC9B,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAAC,MAAM,GAAG,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;QACtE,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAAC,CAAC;AACpE,CAAC;AAED,IAAI,aAAa,GAA6B,IAAI,CAAC;AACnD,6EAA6E;AAC7E,wEAAwE;AACxE,IAAI,WAAW,GAAyB,IAAI,CAAC;AAE7C;;;;;GAKG;AACH,SAAS,uBAAuB;IAC9B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB;IAC/B,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE;aAC5B,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;aAC/B,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;aACjC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0CAA0C,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,mDAAmD;AAEnD,IAAI,SAAS,GAA2B,IAAI,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,iEAAiE;YACjE,2EAA2E;YAC3E,uEAAuE;YACvE,0CAA0C;YAC1C,SAAS,GAAG,uBAAuB,EAAE,CAAC;YACtC,KAAK,wBAAwB,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC5C,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,+CAA+C,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;YACrD,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACxD,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,sCAAsC,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,6EAA6E;IAC7E,gFAAgF;IAChF,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,4EAA4E;QAC5E,SAAS,GAAG,uBAAuB,EAAE,CAAC;QACtC,MAAM,wBAAwB,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,mDAAmD,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IACxB,SAAS,GAAG,OAAO,CAAC;IAEpB,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,6CAA6C,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,wCAAwC,CAAC,CAAC;AACpE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY;IAC1B,SAAS,GAAG,IAAI,CAAC;IACjB,WAAW,GAAG,IAAI,CAAC;IACnB,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC"}

package/dist/admin/db/jwt.d.ts

@@ -0,0 +1,42 @@
+/**
+ * admin/db/jwt.ts — Access-token JWT issue/verify (HS256).
+ * Dual-token auth (SA4E-321): short-lived access JWT (Bearer) + long-lived
+ * opaque refresh token. Byte-compatible with LocalHS256Verifier /
+ * jwt-auth verifyHs256 so one secret signs everything.
+ */
+/** Access-token lifetime: 15 minutes. */
+export declare const ACCESS_TTL_SEC: number;
+/** Claims carried by every access JWT. sid is mandatory (revocation key). */
+export interface AccessClaims {
+    /** User id. */
+    sub: string;
+    /** Session id — logout/revocation lookup key. */
+    sid: string;
+    /** Default project id. */
+    pid?: string;
+    /** Workspace id. */
+    wid?: string;
+    /** Issued-at (epoch seconds). */
+    iat?: number;
+    /** Expiry (epoch seconds). */
+    exp?: number;
+}
+export type VerifyResult = {
+    ok: true;
+    claims: AccessClaims;
+} | {
+    ok: false;
+    reason: 'malformed' | 'bad_signature' | 'bad_payload' | 'expired' | 'no_session';
+};
+/**
+ * Resolve the HS256 signing secret: KB_TOKEN_SECRET env (operator-managed),
+ * else provisioned <dataDir>/.jwt-secret (survives restarts), else an
+ * ephemeral per-process secret (read-only FS / test sandbox).
+ */
+export declare function getJwtSecret(): string;
+/** Sign a short-lived access JWT. */
+export declare function signAccessJwt(claims: AccessClaims): string;
+/** Verify an access JWT. Rejects anything that is not a 3-part signed, live token. */
+export declare function verifyAccessJwt(token: string): VerifyResult;
+/** True when the credential has JWT shape (3 dot-separated parts). */
+export declare function looksLikeJwt(token: string): boolean;

package/dist/admin/db/jwt.js

@@ -0,0 +1,97 @@
+/**
+ * admin/db/jwt.ts — Access-token JWT issue/verify (HS256).
+ * Dual-token auth (SA4E-321): short-lived access JWT (Bearer) + long-lived
+ * opaque refresh token. Byte-compatible with LocalHS256Verifier /
+ * jwt-auth verifyHs256 so one secret signs everything.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import { getWorkspacePath, loadConfig } from '../../config/index.js';
+/** Access-token lifetime: 15 minutes. */
+export const ACCESS_TTL_SEC = 15 * 60;
+let provisionedSecret = null;
+function secretFilePath() {
+    const cfg = loadConfig();
+    const dir = path.isAbsolute(cfg.dataDir) ? cfg.dataDir : path.resolve(getWorkspacePath(), cfg.dataDir);
+    return path.join(dir, '.jwt-secret');
+}
+function b64url(input) {
+    return Buffer.from(input).toString('base64url');
+}
+function hmac(data, secret) {
+    return createHmac('sha256', secret).update(data).digest('base64url');
+}
+function constantTimeEqual(a, b) {
+    const bufA = Buffer.from(a, 'utf8');
+    const bufB = Buffer.from(b, 'utf8');
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}
+/**
+ * Resolve the HS256 signing secret: KB_TOKEN_SECRET env (operator-managed),
+ * else provisioned <dataDir>/.jwt-secret (survives restarts), else an
+ * ephemeral per-process secret (read-only FS / test sandbox).
+ */
+export function getJwtSecret() {
+    const envSecret = (process.env.KB_TOKEN_SECRET || '').trim();
+    if (envSecret)
+        return envSecret;
+    if (provisionedSecret)
+        return provisionedSecret;
+    const file = secretFilePath();
+    try {
+        const existing = fs.existsSync(file) ? fs.readFileSync(file, 'utf8').trim() : '';
+        if (existing) {
+            provisionedSecret = existing;
+            return existing;
+        }
+        const generated = randomBytes(48).toString('hex');
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, generated, { mode: 0o600 });
+        provisionedSecret = generated;
+        return generated;
+    }
+    catch {
+        const generated = randomBytes(48).toString('hex');
+        provisionedSecret = generated;
+        return generated;
+    }
+}
+/** Sign a short-lived access JWT. */
+export function signAccessJwt(claims) {
+    const now = Math.floor(Date.now() / 1000);
+    const header = b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+    const payload = b64url(JSON.stringify({ ...claims, iat: now, exp: now + ACCESS_TTL_SEC }));
+    return `${header}.${payload}.${hmac(`${header}.${payload}`, getJwtSecret())}`;
+}
+/** Verify an access JWT. Rejects anything that is not a 3-part signed, live token. */
+export function verifyAccessJwt(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2]) {
+        return { ok: false, reason: 'malformed' };
+    }
+    if (!constantTimeEqual(parts[2], hmac(`${parts[0]}.${parts[1]}`, getJwtSecret()))) {
+        return { ok: false, reason: 'bad_signature' };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+    }
+    catch {
+        return { ok: false, reason: 'bad_payload' };
+    }
+    if (typeof payload['exp'] !== 'number' || Date.now() >= payload['exp'] * 1000) {
+        return { ok: false, reason: 'expired' };
+    }
+    if (typeof payload['sid'] !== 'string' || !payload['sid'] || typeof payload['sub'] !== 'string' || !payload['sub']) {
+        return { ok: false, reason: 'no_session' };
+    }
+    return { ok: true, claims: payload };
+}
+/** True when the credential has JWT shape (3 dot-separated parts). */
+export function looksLikeJwt(token) {
+    return token.split('.').length === 3;
+}
+//# sourceMappingURL=jwt.js.map

package/dist/admin/db/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/admin/db/jwt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAErE,yCAAyC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,CAAC;AAsBtC,IAAI,iBAAiB,GAAkB,IAAI,CAAC;AAE5C,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACvG,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,KAAsB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc;IACxC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IAEhD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,QAAQ,EAAE,CAAC;YACb,iBAAiB,GAAG,QAAQ,CAAC;YAC7B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,iBAAiB,GAAG,SAAS,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClD,iBAAiB,GAAG,SAAS,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,aAAa,CAAC,MAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC;IAC3F,OAAO,GAAG,MAAM,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;QAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAkC,EAAE,CAAC;AAClE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvC,CAAC"}

package/dist/admin/db/refresh-tokens.d.ts

@@ -0,0 +1,41 @@
+/**
+ * admin/db/refresh-tokens.ts — Opaque refresh-token storage (hashed at rest).
+ * SA4E-321: tokens are stored as SHA-256; a DB leak yields no usable credential.
+ * Rotation keeps every live token of a family valid so two clients refreshing
+ * concurrently do not lock each other out; reuse of a token older than the
+ * grace window revokes the whole family (stolen-token detection).
+ */
+/** Absolute refresh-token lifetime: 7 days from first login. */
+export declare const REFRESH_TTL_SEC: number;
+/** How long a superseded token stays usable for concurrent refreshes. */
+export declare const REFRESH_GRACE_SEC = 60;
+/** refresh_tokens row shape. */
+export interface RefreshTokenRow {
+    token_hash: string;
+    session_id: string;
+    user_id: string;
+    family_id: string;
+    used_at: string | null;
+    revoked_at: string | null;
+    expires_at: string;
+    created_at: string;
+}
+/** SHA-256 of the opaque refresh token — the value stored in the DB. */
+export declare function hashRefreshToken(token: string): string;
+/** Mint a refresh token for a session and persist its hash. */
+export declare function issueRefreshToken(sessionId: string, userId: string, familyId: string, absoluteExpiresAt: string): Promise<{
+    token: string;
+    expiresAt: string;
+}>;
+/** Look up a refresh token by its plaintext value. */
+export declare function findRefreshToken(token: string): Promise<RefreshTokenRow | null>;
+/** Mark a token as consumed (starts its grace window). */
+export declare function markRefreshTokenUsed(tokenHash: string): Promise<void>;
+/** Revoke every token in a rotation family (reuse detected). */
+export declare function revokeRefreshFamily(familyId: string): Promise<void>;
+/** Revoke every refresh token of a session (logout). */
+export declare function revokeSessionRefreshTokens(sessionId: string): Promise<void>;
+/** Revoke every refresh token of a user (force-logout / disable). */
+export declare function revokeUserRefreshTokens(userId: string): Promise<void>;
+/** True when the presented token is still inside its post-rotation grace window. */
+export declare function isWithinGrace(row: RefreshTokenRow): boolean;

package/dist/admin/db/refresh-tokens.js

@@ -0,0 +1,54 @@
+/**
+ * admin/db/refresh-tokens.ts — Opaque refresh-token storage (hashed at rest).
+ * SA4E-321: tokens are stored as SHA-256; a DB leak yields no usable credential.
+ * Rotation keeps every live token of a family valid so two clients refreshing
+ * concurrently do not lock each other out; reuse of a token older than the
+ * grace window revokes the whole family (stolen-token detection).
+ */
+import * as crypto from 'crypto';
+import { getDbAdapter } from './core.js';
+import { generateToken } from './password.js';
+/** Absolute refresh-token lifetime: 7 days from first login. */
+export const REFRESH_TTL_SEC = 7 * 24 * 60 * 60;
+/** How long a superseded token stays usable for concurrent refreshes. */
+export const REFRESH_GRACE_SEC = 60;
+/** SHA-256 of the opaque refresh token — the value stored in the DB. */
+export function hashRefreshToken(token) {
+    return crypto.createHash('sha256').update(token).digest('hex');
+}
+/** Mint a refresh token for a session and persist its hash. */
+export async function issueRefreshToken(sessionId, userId, familyId, absoluteExpiresAt) {
+    const token = generateToken();
+    const expiresAt = new Date(Math.min(new Date(absoluteExpiresAt).getTime(), Date.now() + REFRESH_TTL_SEC * 1000)).toISOString();
+    await getDbAdapter().runAsync(`INSERT INTO refresh_tokens (token_hash, session_id, user_id, family_id, used_at, revoked_at, expires_at, created_at)
+     VALUES (?, ?, ?, ?, NULL, NULL, ?, ?)`, [hashRefreshToken(token), sessionId, userId, familyId, expiresAt, new Date().toISOString()]);
+    return { token, expiresAt };
+}
+/** Look up a refresh token by its plaintext value. */
+export async function findRefreshToken(token) {
+    const row = await getDbAdapter().getAsync('SELECT * FROM refresh_tokens WHERE token_hash = ?', [hashRefreshToken(token)]);
+    return row ?? null;
+}
+/** Mark a token as consumed (starts its grace window). */
+export async function markRefreshTokenUsed(tokenHash) {
+    await getDbAdapter().runAsync('UPDATE refresh_tokens SET used_at = ? WHERE token_hash = ? AND used_at IS NULL', [new Date().toISOString(), tokenHash]);
+}
+/** Revoke every token in a rotation family (reuse detected). */
+export async function revokeRefreshFamily(familyId) {
+    await getDbAdapter().runAsync('UPDATE refresh_tokens SET revoked_at = ? WHERE family_id = ? AND revoked_at IS NULL', [new Date().toISOString(), familyId]);
+}
+/** Revoke every refresh token of a session (logout). */
+export async function revokeSessionRefreshTokens(sessionId) {
+    await getDbAdapter().runAsync('UPDATE refresh_tokens SET revoked_at = ? WHERE session_id = ? AND revoked_at IS NULL', [new Date().toISOString(), sessionId]);
+}
+/** Revoke every refresh token of a user (force-logout / disable). */
+export async function revokeUserRefreshTokens(userId) {
+    await getDbAdapter().runAsync('UPDATE refresh_tokens SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL', [new Date().toISOString(), userId]);
+}
+/** True when the presented token is still inside its post-rotation grace window. */
+export function isWithinGrace(row) {
+    if (!row.used_at)
+        return false;
+    return Date.now() - new Date(row.used_at).getTime() <= REFRESH_GRACE_SEC * 1000;
+}
+//# sourceMappingURL=refresh-tokens.js.map

package/dist/admin/db/refresh-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-tokens.js","sourceRoot":"","sources":["../../../src/admin/db/refresh-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,gEAAgE;AAChE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAcpC,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAiB,EACjB,MAAc,EACd,QAAgB,EAChB,iBAAyB;IAEzB,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC,CACrF,CAAC,WAAW,EAAE,CAAC;IAChB,MAAM,YAAY,EAAE,CAAC,QAAQ,CAC3B;2CACuC,EACvC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC5F,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC,QAAQ,CACvC,mDAAmD,EACnD,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAC1B,CAAC;IACF,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB;IAC1D,MAAM,YAAY,EAAE,CAAC,QAAQ,CAC3B,gFAAgF,EAChF,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,MAAM,YAAY,EAAE,CAAC,QAAQ,CAC3B,qFAAqF,EACrF,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,SAAiB;IAChE,MAAM,YAAY,EAAE,CAAC,QAAQ,CAC3B,sFAAsF,EACtF,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAAc;IAC1D,MAAM,YAAY,EAAE,CAAC,QAAQ,CAC3B,mFAAmF,EACnF,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,GAAoB;IAChD,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,iBAAiB,GAAG,IAAI,CAAC;AAClF,CAAC"}

package/dist/admin/db/schema.js

@@ -196,6 +196,15 @@ export async function initSchema(db) {
     catch (err) {
         console.debug('[schema] sessions.user_agent_hash already exists :', err.message);
     }
+    // SA4E-321 migration: absolute session deadline (7d hard cap) for dual-token auth
+    try {
+        await db.execAsync(`ALTER TABLE sessions ADD COLUMN absolute_expires_at TEXT DEFAULT ''`);
+    }
+    catch (err) {
+        console.debug('[schema] sessions.absolute_expires_at already exists :', err.message);
+    }
+    await db.execAsync(`CREATE INDEX IF NOT EXISTS idx_refresh_tokens_family ON refresh_tokens(family_id)`);
+    await db.execAsync(`CREATE INDEX IF NOT EXISTS idx_refresh_tokens_session ON refresh_tokens(session_id)`);
     // Idempotent migration: add project_id to graph_nodes for existing DBs
     try {
         await db.execAsync(`ALTER TABLE graph_nodes ADD COLUMN project_id TEXT NOT NULL DEFAULT ''`);
@@ -367,6 +376,18 @@ function schemaSql(engine) {
       FOREIGN KEY (user_id) REFERENCES users(user_id) ON DELETE CASCADE
     );
 
+    CREATE TABLE IF NOT EXISTS refresh_tokens (
+      token_hash TEXT PRIMARY KEY,
+      session_id TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      family_id TEXT NOT NULL,
+      used_at TEXT,
+      revoked_at TEXT,
+      expires_at TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      FOREIGN KEY (session_id) REFERENCES sessions(session_id) ON DELETE CASCADE
+    );
+
     CREATE TABLE IF NOT EXISTS audit_log (
       audit_id TEXT PRIMARY KEY,
       user_id TEXT NOT NULL,

package/dist/admin/db/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/admin/db/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAsB,EAAE,GAAW;IACvD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,QAAQ,CAAC,GAAG,yBAAyB,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,eAAe,CAAC,EAAmB,EAAE,MAAsB;IACxE,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,EAAE,CAAC,SAAS,CAAC,uFAAuF,CAAC,CAAC;YAC5G,MAAM,EAAE,CAAC,SAAS,CAAC,mEAAmE,CAAC,CAAC;YACxF,MAAM,EAAE,CAAC,SAAS,CAAC,qEAAqE,CAAC,CAAC;YAC1F,MAAM,EAAE,CAAC,SAAS,CAAC,4DAA4D,CAAC,CAAC;YACjF,MAAM,EAAE,CAAC,SAAS,CAAC,gHAAgH,CAAC,CAAC;QACvI,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,SAAS,CAAC,yEAAyE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAC/G,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,SAAS,CAAC,qDAAqD,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAC3F,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,SAAS,CAAC,uDAAuD,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAC7F,sFAAsF;YACtF,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;gBAC3D,MAAM,GAAG,GAAI,IAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;gBAClE,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,EAAE,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;oBAC5D,MAAM,EAAE,CAAC,SAAS,CAAC;;;;;;;;;;;;;YAajB,CAAC,CAAC;oBACJ,MAAM,EAAE,CAAC,SAAS,CAAC,iOAAiO,CAAC,CAAC;oBACtP,MAAM,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,MAAM,EAAE,CAAC,SAAS,CAAC,gHAAgH,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,EAAmB;IACxD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG;YAChB;gBACE,uEAAuE;gBACvE,2EAA2E;gBAC3E,aAAa,EAAE,OAAO;gBACtB,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,4RAA4R;aAC5S;YACD;gBACE,aAAa,EAAE,QAAQ;gBACvB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,CAAC;gBACV,0EAA0E;gBAC1E,uEAAuE;gBACvE,0EAA0E;gBAC1E,aAAa,EAAE,mWAAmW;aACnX;YACD;gBACE,aAAa,EAAE,QAAQ;gBACvB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,yoBAAyoB;aACzpB;YACD;gBACE,aAAa,EAAE,GAAG;gBAClB,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,mDAAmD;aACnE;YACD;gBACE,aAAa,EAAE,UAAU;gBACzB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,kYAAkY;aAClZ;SACF,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACvD,iFAAiF;gBACjF,MAAM,EAAE,CAAC,QAAQ,CAAC,+NAA+N,EAC/O,CAAC,WAAW,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,iFAAiF;QACjF,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,2BAA2B,CAAC,EAAmB;IAC5D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC5B,uGAAuG,CACxG,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7B,+EAA+E;YAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa;iBAC/B,OAAO,CAAC,4DAA4D,EAAE,wBAAwB,CAAC;iBAC/F,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAChC,MAAM,EAAE,CAAC,QAAQ,CAAC,kEAAkE,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,MAAM,wCAAwC,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6DAA6D;QAC7D,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,EAAmB;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAiB,6CAA6C,CAAC,CAAC;QAC7F,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC;YAAE,OAAO;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,KAAK,MAAM;YAAE,OAAO;QAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;YAAE,OAAO;QACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC;QACxB,MAAM,OAAO,GAAG,CAAC,CAAC;QAClB,MAAM,YAAY,GAAG,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAClD,MAAM,iBAAiB,GAAG,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,IAAI,qCAAqC,CAAC;QACzE,MAAM,aAAa,GAAG,kEAAkE,CAAC;QACzF,iFAAiF;QACjF,MAAM,EAAE,CAAC,QAAQ,CAAC,+NAA+N,EAC/O,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3I,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iFAAiF;QACjF,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAmB;IAClD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAE9B,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAEtC,gCAAgC;IAChC,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAElC,qFAAqF;IACrF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAE9G,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,wEAAwE,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAC5F,MAAM,EAAE,CAAC,SAAS,CAAC,+EAA+E,CAAC,CAAC;IAEpG,4DAA4D;IAC5D,MAAM,EAAE,CAAC,SAAS,CAAC;;;;;wCAKmB,OAAO,CAAC,MAAM,CAAC;;GAEpD,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,SAAS,CAAC,qFAAqF,CAAC,CAAC;IAE1G,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,6EAA6E,CAAC,CAAC;IACpG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAE5F,8EAA8E;IAC9E,+EAA+E;IAC/E,mFAAmF;IACnF,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAChB;4DACsD,CACvD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAErG,iDAAiD;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,6EAA6E,CAAC,CAAC;IACpG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAElG,+EAA+E;IAC/E,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,2BAA2B,CAAC,EAAE,CAAC,CAAC;IAEtC,wDAAwD;IACxD,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAElC,+DAA+D;IAC/D,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAmB;IACpD,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CACnC,uDAAuD,EAAE,CAAC,WAAW,CAAC,CACvE,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,iEAAiE;IACjE,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAEjC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAClC,wCAAwC,EAAE,CAAC,OAAO,CAAC,CACpD,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,SAAS,CACtB,EAAmB,EAAE,MAAsB,EAC3C,OAAe,EAAE,SAAiB,EAAE,QAAe,EAAE,KAAe;IAEpE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,CAAC,QAAQ,CACf,YAAY,CAAC,MAAM,EACjB;8BACwB,CAAC,EAC3B,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CACzC,CAAC;IACF,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,qEAAqE;AACrE,KAAK,UAAU,WAAW,CACxB,EAAmB,EAAE,MAAsB,EAAE,OAAe,EAAE,KAAe;IAE7E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC,QAAQ,CACf,YAAY,CAAC,MAAM,EACjB,sGAAsG,CAAC,EACzG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,EAAmB;IACjD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACzE,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,EACpD,CAAC,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC7G,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,EACpD,CAAC,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnF,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,EAC3D,CAAC,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,EAAmB;IACvD,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,EAAmB;IAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACvD,MAAM,eAAe,GAAG,WAAW,IAAI,WAAW,CAAC,MAAM,IAAI,EAAE;QAC7D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,CAAC,QAAQ,CACf;+DAC2D,EAC3D,CAAC,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAC1D,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kEAAkE;YAClE,0DAA0D;YAC1D,kCAAkC,eAAe,IAAI;YACrD,qEAAqE;YACrE,8CAA8C;YAC9C,gEAAgE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,SAAS,GAAG;IAChB,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB;IACzE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;IACvE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB;CACjF,CAAC;AAEF,yDAAyD;AACzD,SAAS,OAAO,CAAC,MAAsB;IACrC,OAAO,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;AACjE,CAAC;AAED,4DAA4D;AAC5D,SAAS,SAAS,CAAC,MAAsB;IACvC,OAAO,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mCAAmC,CAAC;AAC9F,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,MAAsB;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;WAyBE,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkCJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yCA8B0B,GAAG;yCACH,GAAG;;;;;;;;;;;;;;;;yCAgBH,GAAG;;;;WAIjC,IAAI;;;;;;;;;;;;;;;;CAgBd,CAAC;AACF,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/admin/db/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAsB,EAAE,GAAW;IACvD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,QAAQ,CAAC,GAAG,yBAAyB,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,eAAe,CAAC,EAAmB,EAAE,MAAsB;IACxE,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,EAAE,CAAC,SAAS,CAAC,uFAAuF,CAAC,CAAC;YAC5G,MAAM,EAAE,CAAC,SAAS,CAAC,mEAAmE,CAAC,CAAC;YACxF,MAAM,EAAE,CAAC,SAAS,CAAC,qEAAqE,CAAC,CAAC;YAC1F,MAAM,EAAE,CAAC,SAAS,CAAC,4DAA4D,CAAC,CAAC;YACjF,MAAM,EAAE,CAAC,SAAS,CAAC,gHAAgH,CAAC,CAAC;QACvI,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,SAAS,CAAC,yEAAyE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAC/G,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,SAAS,CAAC,qDAAqD,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAC3F,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,SAAS,CAAC,uDAAuD,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAC7F,sFAAsF;YACtF,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;gBAC3D,MAAM,GAAG,GAAI,IAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;gBAClE,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,EAAE,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;oBAC5D,MAAM,EAAE,CAAC,SAAS,CAAC;;;;;;;;;;;;;YAajB,CAAC,CAAC;oBACJ,MAAM,EAAE,CAAC,SAAS,CAAC,iOAAiO,CAAC,CAAC;oBACtP,MAAM,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,MAAM,EAAE,CAAC,SAAS,CAAC,gHAAgH,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,EAAmB;IACxD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG;YAChB;gBACE,uEAAuE;gBACvE,2EAA2E;gBAC3E,aAAa,EAAE,OAAO;gBACtB,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,4RAA4R;aAC5S;YACD;gBACE,aAAa,EAAE,QAAQ;gBACvB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,CAAC;gBACV,0EAA0E;gBAC1E,uEAAuE;gBACvE,0EAA0E;gBAC1E,aAAa,EAAE,mWAAmW;aACnX;YACD;gBACE,aAAa,EAAE,QAAQ;gBACvB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,yoBAAyoB;aACzpB;YACD;gBACE,aAAa,EAAE,GAAG;gBAClB,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,mDAAmD;aACnE;YACD;gBACE,aAAa,EAAE,UAAU;gBACzB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,kYAAkY;aAClZ;SACF,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACvD,iFAAiF;gBACjF,MAAM,EAAE,CAAC,QAAQ,CAAC,+NAA+N,EAC/O,CAAC,WAAW,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,iFAAiF;QACjF,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,2BAA2B,CAAC,EAAmB;IAC5D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC5B,uGAAuG,CACxG,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7B,+EAA+E;YAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa;iBAC/B,OAAO,CAAC,4DAA4D,EAAE,wBAAwB,CAAC;iBAC/F,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAChC,MAAM,EAAE,CAAC,QAAQ,CAAC,kEAAkE,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,MAAM,wCAAwC,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6DAA6D;QAC7D,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,EAAmB;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAiB,6CAA6C,CAAC,CAAC;QAC7F,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC;YAAE,OAAO;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,KAAK,MAAM;YAAE,OAAO;QAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;YAAE,OAAO;QACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC;QACxB,MAAM,OAAO,GAAG,CAAC,CAAC;QAClB,MAAM,YAAY,GAAG,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAClD,MAAM,iBAAiB,GAAG,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,IAAI,qCAAqC,CAAC;QACzE,MAAM,aAAa,GAAG,kEAAkE,CAAC;QACzF,iFAAiF;QACjF,MAAM,EAAE,CAAC,QAAQ,CAAC,+NAA+N,EAC/O,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3I,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iFAAiF;QACjF,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAmB;IAClD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAE9B,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAEtC,gCAAgC;IAChC,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAElC,qFAAqF;IACrF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAE9G,kFAAkF;IAClF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,qEAAqE,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,wDAAwD,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAElH,MAAM,EAAE,CAAC,SAAS,CAAC,mFAAmF,CAAC,CAAC;IACxG,MAAM,EAAE,CAAC,SAAS,CAAC,qFAAqF,CAAC,CAAC;IAE1G,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,wEAAwE,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAC5F,MAAM,EAAE,CAAC,SAAS,CAAC,+EAA+E,CAAC,CAAC;IAEpG,4DAA4D;IAC5D,MAAM,EAAE,CAAC,SAAS,CAAC;;;;;wCAKmB,OAAO,CAAC,MAAM,CAAC;;GAEpD,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,SAAS,CAAC,qFAAqF,CAAC,CAAC;IAE1G,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,6EAA6E,CAAC,CAAC;IACpG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAE5F,8EAA8E;IAC9E,+EAA+E;IAC/E,mFAAmF;IACnF,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAChB;4DACsD,CACvD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAErG,iDAAiD;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,6EAA6E,CAAC,CAAC;IACpG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAElG,+EAA+E;IAC/E,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,2BAA2B,CAAC,EAAE,CAAC,CAAC;IAEtC,wDAAwD;IACxD,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAElC,+DAA+D;IAC/D,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAmB;IACpD,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CACnC,uDAAuD,EAAE,CAAC,WAAW,CAAC,CACvE,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,iEAAiE;IACjE,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAEjC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAClC,wCAAwC,EAAE,CAAC,OAAO,CAAC,CACpD,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,SAAS,CACtB,EAAmB,EAAE,MAAsB,EAC3C,OAAe,EAAE,SAAiB,EAAE,QAAe,EAAE,KAAe;IAEpE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,CAAC,QAAQ,CACf,YAAY,CAAC,MAAM,EACjB;8BACwB,CAAC,EAC3B,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CACzC,CAAC;IACF,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,qEAAqE;AACrE,KAAK,UAAU,WAAW,CACxB,EAAmB,EAAE,MAAsB,EAAE,OAAe,EAAE,KAAe;IAE7E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC,QAAQ,CACf,YAAY,CAAC,MAAM,EACjB,sGAAsG,CAAC,EACzG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,EAAmB;IACjD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9B,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACzE,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,EACpD,CAAC,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC7G,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,EACpD,CAAC,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnF,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,EAC3D,CAAC,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,EAAmB;IACvD,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,EAAmB;IAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACvD,MAAM,eAAe,GAAG,WAAW,IAAI,WAAW,CAAC,MAAM,IAAI,EAAE;QAC7D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,CAAC,QAAQ,CACf;+DAC2D,EAC3D,CAAC,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAC1D,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kEAAkE;YAClE,0DAA0D;YAC1D,kCAAkC,eAAe,IAAI;YACrD,qEAAqE;YACrE,8CAA8C;YAC9C,gEAAgE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,SAAS,GAAG;IAChB,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB;IACzE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;IACvE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB;CACjF,CAAC;AAEF,yDAAyD;AACzD,SAAS,OAAO,CAAC,MAAsB;IACrC,OAAO,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;AACjE,CAAC;AAED,4DAA4D;AAC5D,SAAS,SAAS,CAAC,MAAsB;IACvC,OAAO,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mCAAmC,CAAC;AAC9F,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,MAAsB;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;WAyBE,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8CJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yCA8B0B,GAAG;yCACH,GAAG;;;;;;;;;;;;;;;;yCAgBH,GAAG;;;;WAIjC,IAAI;;;;;;;;;;;;;;;;CAgBd,CAAC;AACF,CAAC"}

package/dist/admin/db/session-cache.d.ts

@@ -0,0 +1,22 @@
+/**
+ * admin/db/session-cache.ts — 30s revocation cache for session lookups.
+ * Access JWTs verify statelessly; this cache is the only place a logged-out
+ * session is noticed before the JWT's own 15-minute expiry.
+ */
+/** Cache entry lifetime — bounded staleness for a revoked session. */
+export declare const REVOCATION_TTL_MS = 30000;
+interface CacheEntry {
+    valid: boolean;
+    expires: number;
+    /** Cached session identity (shape owned by sessions.ts). */
+    value?: unknown;
+}
+/** Read a cached session verdict; undefined when absent or stale. */
+export declare function sessionCacheGet(key: string): CacheEntry | undefined;
+/** Store a session verdict for REVOCATION_TTL_MS. */
+export declare function sessionCacheSet(key: string, valid: boolean, value?: unknown): void;
+/** Drop one session from the cache (logout / password change). */
+export declare function sessionCacheInvalidate(key: string): void;
+/** Drop every cached session (force-logout of a user). */
+export declare function sessionCacheClear(): void;
+export {};