@antseed/cli 0.1.179 → 0.1.180

package/dist/gateway/auth/db.d.ts

@@ -0,0 +1,156 @@
+import type Database from 'better-sqlite3';
+export declare const SESSION_IDLE_MS: number;
+export declare const SESSION_ABSOLUTE_MS: number;
+export declare const SETUP_TOKEN_TTL_MS: number;
+/** How recent a sign-in must be for sensitive actions (operator authorizations). */
+export declare const FRESH_SIGN_IN_MS: number;
+/**
+ * A wallet credential must be this old before it can be authorized as a
+ * workspace wallet's operator: a stolen session that links its own wallet
+ * can't turn it into an operator before the owner notices (the add is audited).
+ */
+export declare const OPERATOR_WALLET_MIN_AGE_MS: number;
+/** Unauthenticated endpoints write challenges and nonces; keep at most this many live rows of each. */
+export declare const MAX_PENDING_TICKETS = 5000;
+export declare const WALLET_NONCE_TTL_MS: number;
+export declare const OIDC_STATE_TTL_MS: number;
+export declare function sha256Hex(value: string): string;
+export declare function randomToken(bytes?: number): string;
+export interface SessionRow {
+    id: string;
+    kind: 'member' | 'key';
+    member_id: string | null;
+    key_id: string | null;
+    created_at: number;
+    expires_at: number;
+    last_seen_at: number;
+    authenticated_at: number | null;
+    authenticated_credential_id: string | null;
+}
+export interface CredentialRow {
+    id: string;
+    member_id: string;
+    kind: 'passkey' | 'wallet' | 'oidc';
+    label: string;
+    webauthn_id: string | null;
+    public_key: Buffer | null;
+    counter: number | null;
+    transports: string | null;
+    wallet_address: string | null;
+    oidc_issuer: string | null;
+    oidc_subject: string | null;
+    created_at: number;
+    last_used_at: number | null;
+}
+export type NewCredential = {
+    kind: 'passkey';
+    label: string;
+    webauthnId: string;
+    publicKey: Uint8Array;
+    counter: number;
+    transports: string[];
+} | {
+    kind: 'wallet';
+    label: string;
+    address: string;
+} | {
+    kind: 'oidc';
+    label: string;
+    issuer: string;
+    subject: string;
+};
+/** Auth's own rows: sessions, credentials and short-lived login tickets. Secrets are stored as SHA-256 hashes. */
+export declare class AuthDb {
+    private readonly _db;
+    private readonly _now;
+    constructor(_db: Database.Database, _now: () => number);
+    /**
+     * The version is read and bumped inside one IMMEDIATE transaction (it holds
+     * the write lock), so processes opening the database at once never apply a
+     * migration twice.
+     */
+    private _migrate;
+    transaction<T>(fn: () => T): T;
+    /** Drops expired tickets and sessions; cheap enough to run on every login. */
+    sweep(): void;
+    getMeta(key: string): string | null;
+    setMeta(key: string, value: string): void;
+    /** Returns the cookie value; only its hash is stored. */
+    createSession(principal: {
+        kind: 'member';
+        memberId: string;
+    } | {
+        kind: 'key';
+        keyId: string;
+    }, client: {
+        userAgent: string | null;
+        ip: string | null;
+    }, credentialId?: string | null): string;
+    /** Resolves a live session by cookie value and records activity; null when unknown, idle or expired. */
+    findSession(secret: string): SessionRow | null;
+    deleteSession(id: string): void;
+    /** Records a new sign-in proof on an existing session (re-authentication); false when the session is gone. */
+    markAuthenticated(id: string, credentialId: string | null): boolean;
+    deleteSessionBySecret(secret: string): void;
+    deleteMemberSessions(memberId: string): number;
+    /** Ends a member's sessions except `keepId` (the caller's own, when they act on themselves). */
+    deleteMemberSessionsExcept(memberId: string, keepId: string | null): number;
+    deleteKeySessions(keyId: string): number;
+    addCredential(memberId: string, credential: NewCredential): CredentialRow;
+    getCredential(id: string): CredentialRow | null;
+    listCredentials(memberId: string): CredentialRow[];
+    countCredentials(memberId: string): number;
+    deleteCredential(memberId: string, id: string): boolean;
+    findPasskey(webauthnId: string): CredentialRow | null;
+    findWallet(address: string): CredentialRow | null;
+    findOidc(issuer: string, subject: string): CredentialRow | null;
+    touchCredential(id: string, counter?: number): void;
+    createEnrollment(memberId: string): string;
+    /** Member id of a live enrollment, without consuming it. */
+    peekEnrollment(secret: string): string | null;
+    consumeEnrollment(secret: string): string | null;
+    /** Only the newest setup link works: issuing one retires unused earlier ones. */
+    createSetupToken(): string;
+    consumeSetupToken(secret: string): boolean;
+    /** Drops expired rows of a ticket table, then the oldest ones beyond the cap. */
+    private _capTickets;
+    saveChallenge(challenge: string, kind: 'register' | 'login', memberId: string | null): void;
+    /** Single use: the row is deleted whether or not the response then verifies. */
+    takeChallenge(challenge: string, kind: 'register' | 'login'): {
+        memberId: string | null;
+    } | null;
+    saveWalletNonce(nonce: string, address: string, message: string, expiresAt: number): void;
+    takeWalletNonce(nonce: string): {
+        address: string;
+        message: string;
+    } | null;
+    saveOidcState(state: string, input: {
+        nonce: string;
+        codeVerifier: string;
+        enrollment: string | null;
+    }): void;
+    takeOidcState(state: string): {
+        nonce: string;
+        codeVerifier: string;
+        enrollmentHash: string | null;
+    } | null;
+    /** Consumes an enrollment by its stored hash (the OIDC state carries the hash, not the secret). */
+    consumeEnrollmentHash(hash: string): string | null;
+}
+/** The sign-in behind a console session: when it happened and with which credential (null: unknown, e.g. older sessions). */
+export declare function sessionSignIn(db: Database.Database, sessionId: string): {
+    authenticatedAt: number;
+    credentialId: string | null;
+} | null;
+/** A member's wallet credentials (lower-case addresses) with when each was added, plus how many credentials they have in all. */
+export declare function memberWalletCredentials(db: Database.Database, memberId: string): {
+    wallets: Array<{
+        id: string;
+        address: string;
+        createdAt: number;
+    }>;
+    total: number;
+};
+/** Lower-case addresses of the wallets a member has proven (SIWE) as sign-in methods. */
+export declare function memberWalletAddresses(db: Database.Database, memberId: string): string[];
+//# sourceMappingURL=db.d.ts.map

package/dist/gateway/auth/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAuF1C,eAAO,MAAM,eAAe,QAAsB,CAAA;AAClD,eAAO,MAAM,mBAAmB,QAA2B,CAAA;AAE3D,eAAO,MAAM,kBAAkB,QAAiB,CAAA;AAChD,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,QAAgB,CAAA;AAC7C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,QAAsB,CAAA;AAC7D,uGAAuG;AACvG,eAAO,MAAM,mBAAmB,OAAO,CAAA;AAEvC,eAAO,MAAM,mBAAmB,QAAiB,CAAA;AACjD,eAAO,MAAM,iBAAiB,QAAiB,CAAA;AAI/C,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,WAAW,CAAC,KAAK,SAAK,GAAG,MAAM,CAE9C;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAA;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3C;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAA;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpE,kHAAkH;AAClH,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAqB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAA7C,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAmB,IAAI,EAAE,MAAM,MAAM;IAIxF;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IAgBhB,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC;IAI9B,8EAA8E;IAC9E,KAAK,IAAI,IAAI;IAUb,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKnC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAMzC,yDAAyD;IACzD,aAAa,CACX,SAAS,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAChF,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EACvD,YAAY,GAAE,MAAM,GAAG,IAAW,GACjC,MAAM;IAeT,wGAAwG;IACxG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAgB9C,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAI/B,8GAA8G;IAC9G,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAKnE,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI3C,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI9C,gGAAgG;IAChG,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM;IAK3E,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAMxC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,aAAa;IAmBzE,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAI/C,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE;IAIlD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI1C,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAIvD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAIrD,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAIjD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAI/D,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAUnD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAQ1C,4DAA4D;IAC5D,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAM7C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQhD,iFAAiF;IACjF,gBAAgB,IAAI,MAAM;IAW1B,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAQ1C,iFAAiF;IACjF,OAAO,CAAC,WAAW;IASnB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAO3F,gFAAgF;IAChF,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAUhG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAMzF,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAU3E,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAM7G,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAS3G,mGAAmG;IACnG,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAOnD;AAED,6HAA6H;AAC7H,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAQvI;AAED,iIAAiI;AACjI,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAYtK;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAQvF"}

package/dist/gateway/auth/db.js

@@ -0,0 +1,390 @@
+import { createHash, randomBytes } from 'node:crypto';
+/**
+ * Auth tables share the gateway database but track their own schema version.
+ * Append-only once shipped; v1 has not shipped yet, so columns still go
+ * straight into it.
+ */
+const MIGRATIONS = [
+    `
+  CREATE TABLE auth_sessions (
+    id TEXT PRIMARY KEY,
+    kind TEXT NOT NULL CHECK (kind IN ('member', 'key')),
+    member_id TEXT,
+    key_id TEXT,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    last_seen_at INTEGER NOT NULL,
+    user_agent TEXT,
+    ip TEXT,
+    -- When the session's sign-in happened (a passkey, wallet or SSO proof);
+    -- sensitive actions need a recent one.
+    authenticated_at INTEGER,
+    -- Which credential proved that sign-in, so a sensitive action can insist
+    -- on a proof other than the credential it concerns.
+    authenticated_credential_id TEXT
+  );
+  CREATE INDEX auth_sessions_member ON auth_sessions(member_id);
+  CREATE INDEX auth_sessions_key ON auth_sessions(key_id);
+  CREATE TABLE auth_credentials (
+    id TEXT PRIMARY KEY,
+    member_id TEXT NOT NULL,
+    kind TEXT NOT NULL CHECK (kind IN ('passkey', 'wallet', 'oidc')),
+    label TEXT NOT NULL,
+    webauthn_id TEXT UNIQUE,
+    public_key BLOB,
+    counter INTEGER,
+    transports TEXT,
+    wallet_address TEXT UNIQUE,
+    oidc_issuer TEXT,
+    oidc_subject TEXT,
+    created_at INTEGER NOT NULL,
+    last_used_at INTEGER,
+    UNIQUE (oidc_issuer, oidc_subject)
+  );
+  CREATE INDEX auth_credentials_member ON auth_credentials(member_id);
+  CREATE TABLE auth_enrollments (
+    token_hash TEXT PRIMARY KEY,
+    member_id TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL
+  );
+  CREATE TABLE auth_setup_tokens (
+    token_hash TEXT PRIMARY KEY,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    used_at INTEGER
+  );
+  CREATE TABLE auth_challenges (
+    challenge TEXT PRIMARY KEY,
+    kind TEXT NOT NULL CHECK (kind IN ('register', 'login')),
+    member_id TEXT,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL
+  );
+  CREATE TABLE auth_wallet_nonces (
+    nonce TEXT PRIMARY KEY,
+    address TEXT NOT NULL,
+    message TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL
+  );
+  CREATE TABLE auth_oidc_states (
+    state_hash TEXT PRIMARY KEY,
+    nonce TEXT NOT NULL,
+    code_verifier TEXT NOT NULL,
+    enrollment_hash TEXT,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL
+  );
+  CREATE TABLE auth_meta (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL
+  );
+  `,
+];
+export const SESSION_IDLE_MS = 12 * 60 * 60 * 1000;
+export const SESSION_ABSOLUTE_MS = 14 * 24 * 60 * 60 * 1000;
+const ENROLLMENT_TTL_MS = 15 * 60 * 1000;
+export const SETUP_TOKEN_TTL_MS = 60 * 60 * 1000;
+/** How recent a sign-in must be for sensitive actions (operator authorizations). */
+export const FRESH_SIGN_IN_MS = 5 * 60 * 1000;
+/**
+ * A wallet credential must be this old before it can be authorized as a
+ * workspace wallet's operator: a stolen session that links its own wallet
+ * can't turn it into an operator before the owner notices (the add is audited).
+ */
+export const OPERATOR_WALLET_MIN_AGE_MS = 24 * 60 * 60 * 1000;
+/** Unauthenticated endpoints write challenges and nonces; keep at most this many live rows of each. */
+export const MAX_PENDING_TICKETS = 5000;
+const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+export const WALLET_NONCE_TTL_MS = 10 * 60 * 1000;
+export const OIDC_STATE_TTL_MS = 10 * 60 * 1000;
+/** Sessions record activity at most this often, so reads don't write on every request. */
+const SESSION_TOUCH_MS = 60 * 1000;
+export function sha256Hex(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+export function randomToken(bytes = 32) {
+    return randomBytes(bytes).toString('base64url');
+}
+/** Auth's own rows: sessions, credentials and short-lived login tickets. Secrets are stored as SHA-256 hashes. */
+export class AuthDb {
+    _db;
+    _now;
+    constructor(_db, _now) {
+        this._db = _db;
+        this._now = _now;
+        this._migrate();
+    }
+    /**
+     * The version is read and bumped inside one IMMEDIATE transaction (it holds
+     * the write lock), so processes opening the database at once never apply a
+     * migration twice.
+     */
+    _migrate() {
+        const current = this._db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'auth_schema_version'").get()
+            ? this._db.prepare('SELECT version FROM auth_schema_version').get()?.version
+            : undefined;
+        if (current !== undefined && current >= MIGRATIONS.length)
+            return;
+        this._db.transaction(() => {
+            this._db.exec('CREATE TABLE IF NOT EXISTS auth_schema_version (version INTEGER NOT NULL)');
+            const row = this._db.prepare('SELECT version FROM auth_schema_version').get();
+            if (!row)
+                this._db.prepare('INSERT INTO auth_schema_version (version) VALUES (0)').run();
+            for (let index = row?.version ?? 0; index < MIGRATIONS.length; index += 1) {
+                this._db.exec(MIGRATIONS[index]);
+                this._db.prepare('UPDATE auth_schema_version SET version = ?').run(index + 1);
+            }
+        }).immediate();
+    }
+    transaction(fn) {
+        return this._db.transaction(fn)();
+    }
+    /** Drops expired tickets and sessions; cheap enough to run on every login. */
+    sweep() {
+        const now = this._now();
+        this._db.prepare('DELETE FROM auth_sessions WHERE expires_at <= ? OR last_seen_at <= ?').run(now, now - SESSION_IDLE_MS);
+        for (const table of ['auth_enrollments', 'auth_challenges', 'auth_wallet_nonces', 'auth_oidc_states']) {
+            this._db.prepare(`DELETE FROM ${table} WHERE expires_at <= ?`).run(now);
+        }
+    }
+    // ── Meta ────────────────────────────────────────────────────────────────
+    getMeta(key) {
+        const row = this._db.prepare('SELECT value FROM auth_meta WHERE key = ?').get(key);
+        return row?.value ?? null;
+    }
+    setMeta(key, value) {
+        this._db.prepare('INSERT INTO auth_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(key, value);
+    }
+    // ── Sessions ────────────────────────────────────────────────────────────
+    /** Returns the cookie value; only its hash is stored. */
+    createSession(principal, client, credentialId = null) {
+        const secret = randomToken(32);
+        const now = this._now();
+        this._db.prepare(`
+      INSERT INTO auth_sessions (id, kind, member_id, key_id, created_at, expires_at, last_seen_at, user_agent, ip, authenticated_at, authenticated_credential_id)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(sha256Hex(secret), principal.kind, principal.kind === 'member' ? principal.memberId : null, principal.kind === 'key' ? principal.keyId : null, now, now + SESSION_ABSOLUTE_MS, now, client.userAgent?.slice(0, 300) ?? null, client.ip, now, credentialId);
+        return secret;
+    }
+    /** Resolves a live session by cookie value and records activity; null when unknown, idle or expired. */
+    findSession(secret) {
+        const id = sha256Hex(secret);
+        const row = this._db.prepare('SELECT * FROM auth_sessions WHERE id = ?').get(id);
+        if (!row)
+            return null;
+        const now = this._now();
+        if (row.expires_at <= now || row.last_seen_at + SESSION_IDLE_MS <= now) {
+            this.deleteSession(id);
+            return null;
+        }
+        if (now - row.last_seen_at >= SESSION_TOUCH_MS) {
+            this._db.prepare('UPDATE auth_sessions SET last_seen_at = ? WHERE id = ?').run(now, id);
+            row.last_seen_at = now;
+        }
+        return row;
+    }
+    deleteSession(id) {
+        this._db.prepare('DELETE FROM auth_sessions WHERE id = ?').run(id);
+    }
+    /** Records a new sign-in proof on an existing session (re-authentication); false when the session is gone. */
+    markAuthenticated(id, credentialId) {
+        return this._db.prepare('UPDATE auth_sessions SET authenticated_at = ?, authenticated_credential_id = ? WHERE id = ?')
+            .run(this._now(), credentialId, id).changes > 0;
+    }
+    deleteSessionBySecret(secret) {
+        this.deleteSession(sha256Hex(secret));
+    }
+    deleteMemberSessions(memberId) {
+        return this._db.prepare('DELETE FROM auth_sessions WHERE member_id = ?').run(memberId).changes;
+    }
+    /** Ends a member's sessions except `keepId` (the caller's own, when they act on themselves). */
+    deleteMemberSessionsExcept(memberId, keepId) {
+        if (!keepId)
+            return this.deleteMemberSessions(memberId);
+        return this._db.prepare('DELETE FROM auth_sessions WHERE member_id = ? AND id != ?').run(memberId, keepId).changes;
+    }
+    deleteKeySessions(keyId) {
+        return this._db.prepare('DELETE FROM auth_sessions WHERE key_id = ?').run(keyId).changes;
+    }
+    // ── Credentials ─────────────────────────────────────────────────────────
+    addCredential(memberId, credential) {
+        const id = `cred_${randomBytes(8).toString('hex')}`;
+        const now = this._now();
+        const insert = this._db.prepare(`
+      INSERT INTO auth_credentials
+        (id, member_id, kind, label, webauthn_id, public_key, counter, transports, wallet_address, oidc_issuer, oidc_subject, created_at, last_used_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `);
+        if (credential.kind === 'passkey') {
+            insert.run(id, memberId, 'passkey', credential.label, credential.webauthnId, Buffer.from(credential.publicKey), credential.counter, JSON.stringify(credential.transports), null, null, null, now, now);
+        }
+        else if (credential.kind === 'wallet') {
+            insert.run(id, memberId, 'wallet', credential.label, null, null, null, null, credential.address.toLowerCase(), null, null, now, now);
+        }
+        else {
+            insert.run(id, memberId, 'oidc', credential.label, null, null, null, null, null, credential.issuer, credential.subject, now, now);
+        }
+        return this.getCredential(id);
+    }
+    getCredential(id) {
+        return this._db.prepare('SELECT * FROM auth_credentials WHERE id = ?').get(id) ?? null;
+    }
+    listCredentials(memberId) {
+        return this._db.prepare('SELECT * FROM auth_credentials WHERE member_id = ? ORDER BY created_at, id').all(memberId);
+    }
+    countCredentials(memberId) {
+        return this._db.prepare('SELECT COUNT(*) AS count FROM auth_credentials WHERE member_id = ?').get(memberId).count;
+    }
+    deleteCredential(memberId, id) {
+        return this._db.prepare('DELETE FROM auth_credentials WHERE id = ? AND member_id = ?').run(id, memberId).changes > 0;
+    }
+    findPasskey(webauthnId) {
+        return this._db.prepare("SELECT * FROM auth_credentials WHERE kind = 'passkey' AND webauthn_id = ?").get(webauthnId) ?? null;
+    }
+    findWallet(address) {
+        return this._db.prepare("SELECT * FROM auth_credentials WHERE kind = 'wallet' AND wallet_address = ?").get(address.toLowerCase()) ?? null;
+    }
+    findOidc(issuer, subject) {
+        return this._db.prepare("SELECT * FROM auth_credentials WHERE kind = 'oidc' AND oidc_issuer = ? AND oidc_subject = ?").get(issuer, subject) ?? null;
+    }
+    touchCredential(id, counter) {
+        if (counter === undefined) {
+            this._db.prepare('UPDATE auth_credentials SET last_used_at = ? WHERE id = ?').run(this._now(), id);
+        }
+        else {
+            this._db.prepare('UPDATE auth_credentials SET last_used_at = ?, counter = ? WHERE id = ?').run(this._now(), counter, id);
+        }
+    }
+    // ── Enrollments ─────────────────────────────────────────────────────────
+    createEnrollment(memberId) {
+        const secret = randomToken(32);
+        const now = this._now();
+        this._db.prepare('INSERT INTO auth_enrollments (token_hash, member_id, created_at, expires_at) VALUES (?, ?, ?, ?)')
+            .run(sha256Hex(secret), memberId, now, now + ENROLLMENT_TTL_MS);
+        return secret;
+    }
+    /** Member id of a live enrollment, without consuming it. */
+    peekEnrollment(secret) {
+        const row = this._db.prepare('SELECT member_id, expires_at FROM auth_enrollments WHERE token_hash = ?').get(sha256Hex(secret));
+        return row && row.expires_at > this._now() ? row.member_id : null;
+    }
+    consumeEnrollment(secret) {
+        const memberId = this.peekEnrollment(secret);
+        if (memberId)
+            this._db.prepare('DELETE FROM auth_enrollments WHERE token_hash = ?').run(sha256Hex(secret));
+        return memberId;
+    }
+    // ── Setup tokens ────────────────────────────────────────────────────────
+    /** Only the newest setup link works: issuing one retires unused earlier ones. */
+    createSetupToken() {
+        const secret = randomToken(32);
+        const now = this._now();
+        this.transaction(() => {
+            this._db.prepare('DELETE FROM auth_setup_tokens WHERE used_at IS NULL').run();
+            this._db.prepare('INSERT INTO auth_setup_tokens (token_hash, created_at, expires_at) VALUES (?, ?, ?)')
+                .run(sha256Hex(secret), now, now + SETUP_TOKEN_TTL_MS);
+        });
+        return secret;
+    }
+    consumeSetupToken(secret) {
+        const now = this._now();
+        return this._db.prepare('UPDATE auth_setup_tokens SET used_at = ? WHERE token_hash = ? AND used_at IS NULL AND expires_at > ?')
+            .run(now, sha256Hex(secret), now).changes > 0;
+    }
+    // ── WebAuthn challenges ─────────────────────────────────────────────────
+    /** Drops expired rows of a ticket table, then the oldest ones beyond the cap. */
+    _capTickets(table, key) {
+        const now = this._now();
+        this._db.prepare(`DELETE FROM ${table} WHERE expires_at <= ?`).run(now);
+        const count = this._db.prepare(`SELECT COUNT(*) AS count FROM ${table}`).get().count;
+        if (count >= MAX_PENDING_TICKETS) {
+            this._db.prepare(`DELETE FROM ${table} WHERE ${key} IN (SELECT ${key} FROM ${table} ORDER BY created_at LIMIT ?)`).run(count - MAX_PENDING_TICKETS + 1);
+        }
+    }
+    saveChallenge(challenge, kind, memberId) {
+        this._capTickets('auth_challenges', 'challenge');
+        const now = this._now();
+        this._db.prepare('INSERT INTO auth_challenges (challenge, kind, member_id, created_at, expires_at) VALUES (?, ?, ?, ?, ?)')
+            .run(challenge, kind, memberId, now, now + CHALLENGE_TTL_MS);
+    }
+    /** Single use: the row is deleted whether or not the response then verifies. */
+    takeChallenge(challenge, kind) {
+        const row = this._db.prepare('SELECT member_id, expires_at FROM auth_challenges WHERE challenge = ? AND kind = ?').get(challenge, kind);
+        if (!row)
+            return null;
+        this._db.prepare('DELETE FROM auth_challenges WHERE challenge = ?').run(challenge);
+        return row.expires_at > this._now() ? { memberId: row.member_id } : null;
+    }
+    // ── Wallet nonces ───────────────────────────────────────────────────────
+    saveWalletNonce(nonce, address, message, expiresAt) {
+        this._capTickets('auth_wallet_nonces', 'nonce');
+        this._db.prepare('INSERT INTO auth_wallet_nonces (nonce, address, message, created_at, expires_at) VALUES (?, ?, ?, ?, ?)')
+            .run(nonce, address.toLowerCase(), message, this._now(), expiresAt);
+    }
+    takeWalletNonce(nonce) {
+        const row = this._db.prepare('SELECT address, message, expires_at FROM auth_wallet_nonces WHERE nonce = ?').get(nonce);
+        if (!row)
+            return null;
+        this._db.prepare('DELETE FROM auth_wallet_nonces WHERE nonce = ?').run(nonce);
+        return row.expires_at > this._now() ? { address: row.address, message: row.message } : null;
+    }
+    // ── OIDC states ─────────────────────────────────────────────────────────
+    saveOidcState(state, input) {
+        const now = this._now();
+        this._db.prepare('INSERT INTO auth_oidc_states (state_hash, nonce, code_verifier, enrollment_hash, created_at, expires_at) VALUES (?, ?, ?, ?, ?, ?)')
+            .run(sha256Hex(state), input.nonce, input.codeVerifier, input.enrollment === null ? null : sha256Hex(input.enrollment), now, now + OIDC_STATE_TTL_MS);
+    }
+    takeOidcState(state) {
+        const hash = sha256Hex(state);
+        const row = this._db.prepare('SELECT nonce, code_verifier, enrollment_hash, expires_at FROM auth_oidc_states WHERE state_hash = ?').get(hash);
+        if (!row)
+            return null;
+        this._db.prepare('DELETE FROM auth_oidc_states WHERE state_hash = ?').run(hash);
+        return row.expires_at > this._now() ? { nonce: row.nonce, codeVerifier: row.code_verifier, enrollmentHash: row.enrollment_hash } : null;
+    }
+    /** Consumes an enrollment by its stored hash (the OIDC state carries the hash, not the secret). */
+    consumeEnrollmentHash(hash) {
+        const row = this._db.prepare('SELECT member_id, expires_at FROM auth_enrollments WHERE token_hash = ?').get(hash);
+        if (!row)
+            return null;
+        this._db.prepare('DELETE FROM auth_enrollments WHERE token_hash = ?').run(hash);
+        return row.expires_at > this._now() ? row.member_id : null;
+    }
+}
+/** The sign-in behind a console session: when it happened and with which credential (null: unknown, e.g. older sessions). */
+export function sessionSignIn(db, sessionId) {
+    try {
+        const row = db.prepare('SELECT authenticated_at, created_at, authenticated_credential_id FROM auth_sessions WHERE id = ?').get(sessionId);
+        return row ? { authenticatedAt: row.authenticated_at ?? row.created_at, credentialId: row.authenticated_credential_id } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** A member's wallet credentials (lower-case addresses) with when each was added, plus how many credentials they have in all. */
+export function memberWalletCredentials(db, memberId) {
+    try {
+        const rows = db.prepare('SELECT id, kind, wallet_address, created_at FROM auth_credentials WHERE member_id = ?').all(memberId);
+        return {
+            wallets: rows.filter((row) => row.kind === 'wallet' && row.wallet_address)
+                .map((row) => ({ id: row.id, address: row.wallet_address.toLowerCase(), createdAt: row.created_at })),
+            total: rows.length,
+        };
+    }
+    catch {
+        return { wallets: [], total: 0 };
+    }
+}
+/** Lower-case addresses of the wallets a member has proven (SIWE) as sign-in methods. */
+export function memberWalletAddresses(db, memberId) {
+    try {
+        const rows = db.prepare("SELECT wallet_address FROM auth_credentials WHERE member_id = ? AND kind = 'wallet' AND wallet_address IS NOT NULL").all(memberId);
+        return rows.map((row) => row.wallet_address.toLowerCase());
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=db.js.map

package/dist/gateway/auth/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../../src/gateway/auth/db.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErD;;;;GAIG;AACH,MAAM,UAAU,GAAsB;IACpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC3D,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACxC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAChD,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC7D,uGAAuG;AACvG,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AACvC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACjD,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC/C,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAA;AAElC,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,EAAE;IACpC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACjD,CAAC;AAmCD,kHAAkH;AAClH,MAAM,OAAO,MAAM;IACY;IAAyC;IAAtE,YAA6B,GAAsB,EAAmB,IAAkB;QAA3D,QAAG,GAAH,GAAG,CAAmB;QAAmB,SAAI,GAAJ,IAAI,CAAc;QACtF,IAAI,CAAC,QAAQ,EAAE,CAAA;IACjB,CAAC;IAED;;;;OAIG;IACK,QAAQ;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mFAAmF,CAAC,CAAC,GAAG,EAAE;YACzH,CAAC,CAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAAsC,EAAE,OAAO;YACjH,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,UAAU,CAAC,MAAM;YAAE,OAAM;QACjE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE;YACxB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAA;YAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAAqC,CAAA;YAChH,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,EAAE,CAAA;YACxF,KAAK,IAAI,KAAK,GAAG,GAAG,EAAE,OAAO,IAAI,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;gBACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YAC/E,CAAC;QACH,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;IAChB,CAAC;IAED,WAAW,CAAI,EAAW;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAA;IACnC,CAAC;IAED,8EAA8E;IAC9E,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,sEAAsE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,eAAe,CAAC,CAAA;QACxH,KAAK,MAAM,KAAK,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACtG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,wBAAwB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IAED,2EAA2E;IAE3E,OAAO,CAAC,GAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAkC,CAAA;QACnH,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAA;IAC3B,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,KAAa;QAChC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,wGAAwG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5I,CAAC;IAED,2EAA2E;IAE3E,yDAAyD;IACzD,aAAa,CACX,SAAgF,EAChF,MAAuD,EACvD,eAA8B,IAAI;QAElC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;;;KAGhB,CAAC,CAAC,GAAG,CACJ,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,EACjC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EACvD,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EACjD,GAAG,EAAE,GAAG,GAAG,mBAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,YAAY,CAC3G,CAAA;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,wGAAwG;IACxG,WAAW,CAAC,MAAc;QACxB,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,EAAE,CAA2B,CAAA;QAC1G,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,YAAY,GAAG,eAAe,IAAI,GAAG,EAAE,CAAC;YACvE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,GAAG,GAAG,GAAG,CAAC,YAAY,IAAI,gBAAgB,EAAE,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YACvF,GAAG,CAAC,YAAY,GAAG,GAAG,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,8GAA8G;IAC9G,iBAAiB,CAAC,EAAU,EAAE,YAA2B;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,6FAA6F,CAAC;aACnH,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,qBAAqB,CAAC,MAAc;QAClC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,oBAAoB,CAAC,QAAgB;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAA;IAChG,CAAC;IAED,gGAAgG;IAChG,0BAA0B,CAAC,QAAgB,EAAE,MAAqB;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAA;IACpH,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAA;IAC1F,CAAC;IAED,2EAA2E;IAE3E,aAAa,CAAC,QAAgB,EAAE,UAAyB;QACvD,MAAM,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;;;;KAI/B,CAAC,CAAA;QACF,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,OAAO,EAChI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QACtE,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QACtI,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QACnI,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,EAAE,CAAE,CAAA;IAChC,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,OAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,EAAE,CAA+B,IAAI,IAAI,CAAA;IACvH,CAAC;IAED,eAAe,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,4EAA4E,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAoB,CAAA;IACxI,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAuB,CAAC,KAAK,CAAA;IAC1I,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,EAAU;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,OAAO,GAAG,CAAC,CAAA;IACtH,CAAC;IAED,WAAW,CAAC,UAAkB;QAC5B,OAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,2EAA2E,CAAC,CAAC,GAAG,CAAC,UAAU,CAA+B,IAAI,IAAI,CAAA;IAC7J,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,OAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,6EAA6E,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAA+B,IAAI,IAAI,CAAA;IAC1K,CAAC;IAED,QAAQ,CAAC,MAAc,EAAE,OAAe;QACtC,OAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,6FAA6F,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAA+B,IAAI,IAAI,CAAA;IACpL,CAAC;IAED,eAAe,CAAC,EAAU,EAAE,OAAgB;QAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACpG,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QAC1H,CAAC;IACH,CAAC;IAED,2EAA2E;IAE3E,gBAAgB,CAAC,QAAgB;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kGAAkG,CAAC;aACjH,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,iBAAiB,CAAC,CAAA;QACjE,OAAO,MAAM,CAAA;IACf,CAAC;IAED,4DAA4D;IAC5D,cAAc,CAAC,MAAc;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CACtE,CAAA;QACvD,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IACnE,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC5C,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1G,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,2EAA2E;IAE3E,iFAAiF;IACjF,gBAAgB;QACd,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YACpB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,GAAG,EAAE,CAAA;YAC7E,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,qFAAqF,CAAC;iBACpG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,kBAAkB,CAAC,CAAA;QAC1D,CAAC,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,sGAAsG,CAAC;aAC5H,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAA;IACjD,CAAC;IAED,2EAA2E;IAE3E,iFAAiF;IACzE,WAAW,CAAC,KAA+C,EAAE,GAA0B;QAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,wBAAwB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACvE,MAAM,KAAK,GAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAA;QAC3G,IAAI,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,UAAU,GAAG,eAAe,GAAG,SAAS,KAAK,+BAA+B,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,mBAAmB,GAAG,CAAC,CAAC,CAAA;QACzJ,CAAC;IACH,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,IAA0B,EAAE,QAAuB;QAClF,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAA;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,yGAAyG,CAAC;aACxH,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,gBAAgB,CAAC,CAAA;IAChE,CAAC;IAED,gFAAgF;IAChF,aAAa,CAAC,SAAiB,EAAE,IAA0B;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,oFAAoF,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CACxE,CAAA;QAC9D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAClF,OAAO,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,CAAC;IAED,2EAA2E;IAE3E,eAAe,CAAC,KAAa,EAAE,OAAe,EAAE,OAAe,EAAE,SAAiB;QAChF,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;QAC/C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,yGAAyG,CAAC;aACxH,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAA;IACvE,CAAC;IAED,eAAe,CAAC,KAAa;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,6EAA6E,CAAC,CAAC,GAAG,CAAC,KAAK,CAC/C,CAAA;QACtE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7E,OAAO,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7F,CAAC;IAED,2EAA2E;IAE3E,aAAa,CAAC,KAAa,EAAE,KAAyE;QACpG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,oIAAoI,CAAC;aACnJ,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,iBAAiB,CAAC,CAAA;IACzJ,CAAC;IAED,aAAa,CAAC,KAAa;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,qGAAqG,CAAC,CAAC,GAAG,CAAC,IAAI,CAClC,CAAA;QAC1G,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC/E,OAAO,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACzI,CAAC;IAED,mGAAmG;IACnG,qBAAqB,CAAC,IAAY;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,GAAG,CAAC,IAAI,CACzD,CAAA;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC/E,OAAO,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5D,CAAC;CACF;AAED,6HAA6H;AAC7H,MAAM,UAAU,aAAa,CAAC,EAAqB,EAAE,SAAiB;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,kGAAkG,CAAC,CAAC,GAAG,CAAC,SAAS,CACvB,CAAA;QACjH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAChI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,iIAAiI;AACjI,MAAM,UAAU,uBAAuB,CAAC,EAAqB,EAAE,QAAgB;IAC7E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,uFAAuF,CAAC,CAAC,GAAG,CAAC,QAAQ,CACrC,CAAA;QACxF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,cAAc,CAAC;iBACvE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,cAAe,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YACxG,KAAK,EAAE,IAAI,CAAC,MAAM;SACnB,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IAClC,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CAAC,EAAqB,EAAE,QAAgB;IAC3E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,oHAAoH,CAAC,CAAC,GAAG,CAAC,QAAQ,CACvH,CAAA;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/gateway/auth/hardening.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=hardening.test.d.ts.map

package/dist/gateway/auth/hardening.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardening.test.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/hardening.test.ts"],"names":[],"mappings":""}