@arkstack/auth 0.5.2 → 0.5.3

package/dist/index.js

@@ -1,7 +1,8 @@
-import { Encryption, Exception, Hash, env, getModel } from "@arkstack/common";
+import { Encryption, Exception, Hash, appKey, env, getModel } from "@arkstack/common";
 import { SignJWT, jwtVerify } from "jose";
-import { Request, Response } from "@arkstack/http";
+import { Request, Response, Session } from "@arkstack/http";
 import { UAParser } from "ua-parser-js";
+import { Secret } from "otpauth";
 import { randomBytes } from "node:crypto";
 import { Model } from "@arkstack/database";
 //#region src/Contracts/AuthContract.ts
@@ -37,35 +38,33 @@ var AuthenticationException = class extends Exception {
 	}
 };
 //#endregion
-//#region src/CurrentSession.ts
+//#region src/AuthSession.ts
 /**
-* The CurrentSession class represents the current authentication session and provides 
-* methods to manage it, such as destroying the session (logging out) and retrieving 
-* the current personal access token. It is used internally by the Auth class to 
-* handle session-specific operations.
-* 
-* @author Legacy (3m1n3nc3)
-* @since 1.0.0
-* @version 1.0.0
-* @see Auth
+* Represents an authenticated user session.
+*
+* @author 3m1n3nc3
 */
-var CurrentSession = class {
+var AuthSession = class extends Session {
 	auth;
-	constructor(auth) {
+	constructor(auth, current = globalThis.session?.()) {
+		super(current instanceof Session ? current : void 0);
 		this.auth = auth;
 	}
 	/**
-	* Destroy the current session's personal access token, effectively 
-	* logging out the user from this session.
+	* Destroy the current session
+	* 
+	* @returns
 	*/
 	async destroy() {
 		const pat = await this.token();
 		if (pat) await this.auth.logout(pat);
+		await super.destroy();
+		return this;
 	}
 	/**
-	* Get the current session's personal access token
+	* Get the current auth session token
 	* 
-	* @returns 
+	* @returns
 	*/
 	async token() {
 		if (!this.auth.getRequest()) return null;
@@ -96,7 +95,7 @@ var SessionDevice = class {
 	static fromRequest(req) {
 		const userAgent = this.readUserAgent(req);
 		const ua = new UAParser(userAgent ?? void 0).getResult();
-		const ca = this.readAuthAgent(req);
+		const ca = this.readDeviceAgent(req);
 		return {
 			browser: this.readString(ua.browser.name) ?? this.detectBrowser(userAgent),
 			os: ca?.os ?? this.readString(ua.os.name) ?? this.detectOs(userAgent),
@@ -182,8 +181,8 @@ var SessionDevice = class {
 	* @param headerName 
 	* @returns 
 	*/
-	static readAuthAgent(req) {
-		const value = req?.header("x-auth-agent");
+	static readDeviceAgent(req) {
+		const value = req?.header("x-device-agent");
 		if (typeof value !== "string" || value.length < 1) return null;
 		try {
 			const parsed = JSON.parse(value);
@@ -357,8 +356,7 @@ var Auth = class Auth extends AuthContract {
 			status: 422,
 			errors: { password: ["Invalid password"] }
 		});
-		Auth.req?.setUser(user);
-		this.#user = user;
+		this.setAuthenticated(user);
 		return user;
 	}
 	/**
@@ -407,8 +405,7 @@ var Auth = class Auth extends AuthContract {
 			req: Auth.req,
 			status: 401
 		});
-		Auth.req?.setUser(user);
-		this.#user = user;
+		this.setAuthenticated(user, token);
 		return user;
 	}
 	/**
@@ -423,6 +420,7 @@ var Auth = class Auth extends AuthContract {
 		else await token.delete();
 		else await (await getModel("PersonalAccessToken")).query().where({ userId: this.#user.id }).delete();
 		this.#user = null;
+		if (Auth.req?.auth === this) Auth.req.clearAuthentication();
 	}
 	/**
 	* Check if the user is authenticated
@@ -437,8 +435,8 @@ var Auth = class Auth extends AuthContract {
 	* 
 	* @returns 
 	*/
-	currentSession() {
-		return new CurrentSession(this);
+	session() {
+		return new AuthSession(this);
 	}
 	/**
 	* Create a personal access token for a user
@@ -451,11 +449,11 @@ var Auth = class Auth extends AuthContract {
 			sub: user.id.toString(),
 			email: user.email
 		};
-		Auth.req?.setUser(user);
 		const token = await this.createJWT(payload);
 		const deviceInfo = SessionDevice.fromRequest(Auth.req);
 		const pat = await this.upsertDeviceToken(user, token, deviceInfo);
 		pat.setLoadedRelation("user", user);
+		this.setAuthenticated(user, token);
 		return pat;
 	}
 	/**
@@ -483,15 +481,15 @@ var Auth = class Auth extends AuthContract {
 			return (right.lastUsedAt ?? right.createdAt).getTime() - leftTime;
 		});
 		if (matchingSessions.length < 1) return await TokenModel.query().create(payload);
-		const [currentSession, ...duplicateSessions] = matchingSessions;
+		const [session, ...duplicateSessions] = matchingSessions;
 		if (duplicateSessions.length > 0) await Promise.all(duplicateSessions.map(async (session) => await session.delete()));
-		await TokenModel.query().where({ id: currentSession.id }).update(payload);
-		currentSession.token = payload.token;
-		currentSession.name = payload.name;
-		currentSession.userId = payload.userId;
-		currentSession.deviceInfo = payload.deviceInfo;
-		currentSession.lastUsedAt = payload.lastUsedAt;
-		return currentSession;
+		await TokenModel.query().where({ id: session.id }).update(payload);
+		session.token = payload.token;
+		session.name = payload.name;
+		session.userId = payload.userId;
+		session.deviceInfo = payload.deviceInfo;
+		session.lastUsedAt = payload.lastUsedAt;
+		return session;
 	}
 	/**
 	* Authorize a token and return the associated user
@@ -515,11 +513,10 @@ var Auth = class Auth extends AuthContract {
 			req: Auth.req,
 			status: 401
 		});
-		Auth.req?.setUser(user);
 		this.touchSession(pat).catch((error) => {
 			if (env("NODE_ENV") === "development") console.error("Failed to update session activity", error);
 		});
-		this.#user = user;
+		this.setAuthenticated(user, token);
 		return user;
 	}
 	/**
@@ -546,7 +543,11 @@ var Auth = class Auth extends AuthContract {
 		}
 	}
 	getSecret() {
-		return this.configuredSecret ?? env("JWT_SECRET", "default_secret");
+		return this.configuredSecret ?? appKey("JWT_SECRET") ?? "default_secret";
+	}
+	setAuthenticated(user, token) {
+		this.#user = user;
+		Auth.req?.setAuthentication(this, user, token);
 	}
 	/**
 	* Update the last used timestamp and device information of a personal 
@@ -576,11 +577,20 @@ var Auth = class Auth extends AuthContract {
 	}
 };
 //#endregion
+//#region src/utils.ts
+/**
+* Create a new instance of the Auth class with an optional secret for JWT 
+* signing and verification.
+* 
+* @param secret — The secret key used for signing and verifying JWTs.
+* 
+* @returns — A new instance of the Auth class.
+*/
+const auth = (secret) => Auth.make(secret);
+//#endregion
 //#region src/TwoFactor.ts
-const secretAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-const appName = () => env("APP_NAME", "Arkstack");
-const smsCodeTtlMinutes = () => Number(env("TWO_FACTOR_SMS_TTL_MINUTES", 10)) || 10;
-var TwoFactor = class {
+var TwoFactor = class TwoFactor {
+	static smsCodeTtlMinutes = Number(env("TWO_FACTOR_SMS_TTL_MINUTES", 10)) || 10;
 	static async getModel() {
 		return await getModel("UserTwoFactor");
 	}
@@ -600,18 +610,40 @@ var TwoFactor = class {
 		if (normalized.length <= 4) return normalized;
 		return `${"*".repeat(Math.max(normalized.length - 4, 2))}${normalized.slice(-4)}`;
 	}
+	/** 
+	* Build the account label used inside the OTP URI. 
+	* 
+	* @param user 
+	* @returns 
+	*/
 	static getLabel(user) {
-		return user.email || `${appName()}:${user.id}`;
+		return user.email || `${env("APP_NAME", "Arkstack")}:${user.id}`;
 	}
+	/** 
+	* Create the per-user TOTP instance for setup and verification. 
+	* 
+	* @param user 
+	* @param secret 
+	* @returns 
+	*/
 	static getTotp(user, secret) {
-		return Hash.totp(secret, this.getLabel(user), appName());
+		return Hash.totp(secret, this.getLabel(user), env("APP_NAME", "Arkstack"));
 	}
+	/** 
+	* Generate a new shared secret for authenticator-based 2FA. 
+	* 
+	* @returns The generated secret in base32 format.
+	*/
 	static generateSecret(size = 20) {
-		const bytes = randomBytes(size);
-		let secret = "";
-		for (const byte of bytes) secret += secretAlphabet[byte % 32];
-		return secret;
+		return new Secret({ size }).base32;
 	}
+	/** 
+	* Build the setup payload returned to the client.
+	* 
+	* @param user The user for whom the setup is being created.
+	* @param secret Optional existing secret to use for the setup.
+	* @returns An object containing the secret and the OTPAuth URL.
+	*/
 	static createSetup(user, secret) {
 		const resolvedSecret = secret ?? this.generateSecret();
 		return {
@@ -619,6 +651,14 @@ var TwoFactor = class {
 			otpauthUrl: this.getTotp(user, resolvedSecret).toString()
 		};
 	}
+	/** 
+	* Verify a 6-digit authenticator code for a user.
+	* 
+	* @param user The user for whom the code is being verified.
+	* @param secret The secret used to generate the code.
+	* @param code The 6-digit code to verify.
+	* @returns  True if the code is valid, false otherwise.
+	*/
 	static verifyCode(user, secret, code) {
 		return this.getTotp(user, secret).validate({
 			token: code,
@@ -632,39 +672,98 @@ var TwoFactor = class {
 	static async setMethod(userId, method) {
 		await this.upsert(userId, { method });
 	}
+	/** 
+	* Read the setup secret stored for a user.
+	* 
+	* @param userId The ID of the user.
+	* @returns The stored secret, or null if not found.
+	*/
 	static async getSecret(userId) {
 		const record = await this.getRecord(userId);
 		return record?.secretCiphertext ? Encryption.decrypt(record.secretCiphertext) : null;
 	}
+	/** 
+	* Store the setup secret for a user.
+	* 
+	* @param userId The ID of the user.
+	* @param secret The secret to store.
+	*/
 	static async setSecret(userId, secret) {
 		await this.upsert(userId, { secretCiphertext: Encryption.encrypt(secret) });
 	}
 	static async clearSecret(userId) {
 		await this.upsert(userId, { secretCiphertext: null });
 	}
+	/** 
+	* Read the timestamp indicating whether 2FA is enabled.
+	* 
+	* @param userId The ID of the user.
+	* @returns The timestamp when 2FA was enabled, or null if not enabled.
+	*/
 	static async getEnabledAt(userId) {
 		return (await this.getRecord(userId))?.enabledAt?.toISOString() ?? null;
 	}
+	/** 
+	* Persist the timestamp marking 2FA as enabled.
+	* 
+	* @param userId The ID of the user.
+	* @param enabledAt The timestamp to store.
+	*/
 	static async setEnabledAt(userId, enabledAt = /* @__PURE__ */ new Date()) {
 		await this.upsert(userId, { enabledAt: typeof enabledAt === "string" ? new Date(enabledAt) : enabledAt });
 	}
+	/** 
+	* Remove all persisted 2FA state for a user.
+	* 
+	* @param userId The ID of the user.
+	*/
 	static async clear(userId) {
 		await (await this.getModel()).query().where({ userId }).delete();
 	}
+	/** 
+	* Generate one-time recovery codes shown when 2FA is enabled.
+	* 
+	* @returns An array of recovery codes.
+	*/
 	static generateBackupCodes(count = 8) {
 		return Array.from({ length: count }, () => {
 			return `${randomBytes(3).toString("hex").slice(0, 4).toUpperCase()}-${randomBytes(3).toString("hex").slice(0, 4).toUpperCase()}`;
 		});
 	}
+	/** 
+	* Hash recovery codes before persisting them.
+	* 
+	* @param codes An array of recovery codes to hash.
+	* @returns An array of hashed recovery codes.
+	*/
 	static async hashBackupCodes(codes) {
 		return await Promise.all(codes.map(async (code) => await Hash.make(code)));
 	}
+	/** 
+	* Read stored recovery-code hashes for a user.
+	* 
+	* @param userId The ID of the user.
+	* @returns An array of recovery-code hashes.
+	*/
 	static async readRecoveryCodeHashes(userId) {
 		return (await this.getRecord(userId))?.recoveryCodeHashes ?? [];
 	}
+	/** 
+	* Persist recovery-code hashes on the user's dedicated 2FA record.
+	* 
+	* @param userId 
+	* @param hashes 
+	*/
 	static async writeRecoveryCodeHashes(userId, hashes) {
 		await this.upsert(userId, { recoveryCodeHashes: hashes });
 	}
+	/** 
+	* Consume a valid recovery code and invalidate it immediately.
+	* 
+	* @param userId The ID of the user.
+	* @param recoveryCode The recovery code to consume.
+	* @returns True if the recovery code was valid and consumed, false otherwise.
+	*/
 	static async consumeRecoveryCode(userId, recoveryCode) {
 		const hashes = await this.readRecoveryCodeHashes(userId);
 		for (const [index, hash] of hashes.entries()) if (await Hash.verify(recoveryCode, hash)) {
@@ -673,6 +772,12 @@ var TwoFactor = class {
 		}
 		return false;
 	}
+	/** 
+	* Return the public 2FA status payload for a user.
+	* 
+	* @param userId The ID of the user.
+	* @returns An object containing the 2FA status and recovery codes remaining.
+	*/
 	static async readStatus(userId) {
 		const record = await this.getRecord(userId);
 		const enabledAt = record?.enabledAt?.toISOString() ?? null;
@@ -687,11 +792,17 @@ var TwoFactor = class {
 	static createSmsCode() {
 		return Math.floor(1e5 + Math.random() * 9e5).toString();
 	}
+	/**
+	* Issue a new SMS code for the given user and send it via SMS for the specified purpose.
+	* 
+	* @param user 
+	* @param purpose 
+	*/
 	static async issueSmsCode(user, purpose) {
 		if (!user.phone) throw new Error("A phone number is required to issue a two-factor SMS code.");
 		const code = this.createSmsCode();
 		const smsCodeHash = await Hash.make(code);
-		const expiresAt = new Date(Date.now() + smsCodeTtlMinutes() * 60 * 1e3);
+		const expiresAt = new Date(Date.now() + TwoFactor.smsCodeTtlMinutes * 60 * 1e3);
 		await this.upsert(user.id, {
 			smsCodeHash,
 			smsCodeExpiresAt: expiresAt,
@@ -710,6 +821,14 @@ var TwoFactor = class {
 			smsCodePurpose: null
 		});
 	}
+	/**
+	* Verify a submitted SMS code for a user and purpose, consuming the code if valid.
+	* 
+	* @param userId 
+	* @param code 
+	* @param purpose 
+	* @returns 
+	*/
 	static async verifySmsCode(userId, code, purpose) {
 		const record = await this.getRecord(userId);
 		if (!record?.smsCodeHash || !record.smsCodeExpiresAt || record.smsCodePurpose !== purpose) return false;
@@ -737,6 +856,4 @@ var UserTwoFactor = class extends Model {
 	casts = { recoveryCodeHashes: "json" };
 };
 //#endregion
-export { Auth, AuthContract, AuthenticationException, CurrentSession, PersonalAccessToken, SessionDevice, TwoFactor, User, UserTwoFactor };
-
-//# sourceMappingURL=index.js.map
+export { Auth, AuthContract, AuthSession, AuthenticationException, PersonalAccessToken, SessionDevice, TwoFactor, User, UserTwoFactor, auth };

package/dist/setup.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/setup.js

@@ -0,0 +1,25 @@
+import { Publisher } from "@arkstack/common";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+//#region src/setup.ts
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+/**
+* Register the artifacts `@arkstack/auth` publishes into the application.
+*
+* Run `ark publish --tag two-factor` (or `--package @arkstack/auth`) to copy the
+* `UserTwoFactor` model and the migration that creates the `user_two_factors`
+* table into the app.
+*/
+Publisher.publishes({
+	package: "@arkstack/auth",
+	tag: "two-factor",
+	entries: [{
+		from: join(root, "stubs/models/UserTwoFactor.ts.stub"),
+		to: "src/app/models/UserTwoFactor.ts"
+	}, {
+		from: join(root, "stubs/migrations/20260505110000_create_user_two_factors_table.ts.stub"),
+		to: "src/database/migrations/20260505110000_create_user_two_factors_table.ts"
+	}]
+});
+//#endregion
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arkstack/auth",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "type": "module",
   "description": "Authentication module for Arkstack, providing core authentication and identity features.",
   "homepage": "https://arkstack.toneflix.net/guide/auth",
@@ -25,28 +25,27 @@
     "arkstack"
   ],
   "files": [
-    "dist"
+    "dist",
+    "stubs"
   ],
   "publishConfig": {
     "access": "public"
   },
   "exports": {
     ".": "./dist/index.js",
+    "./setup": "./dist/setup.js",
     "./package.json": "./package.json"
   },
   "dependencies": {
     "jose": "^6.2.3",
+    "otpauth": "^9.5.1",
     "ua-parser-js": "^2.0.9",
-    "@arkstack/common": "^0.5.2",
-    "@arkstack/http": "^0.5.2"
+    "@arkstack/http": "^0.5.3",
+    "@arkstack/common": "^0.5.3"
   },
   "peerDependencies": {
-    "@h3ravel/support": "^0.15.11",
-    "@arkstack/database": "^0.5.2",
-    "@arkstack/notifications": "^0.5.2"
-  },
-  "inlinedDependencies": {
-    "otpauth": "9.5.1"
+    "@h3ravel/support": "^2.2.0",
+    "@arkstack/database": "^0.5.3"
   },
   "scripts": {
     "build": "tsdown --config-loader unrun",

package/stubs/migrations/20260505110000_create_user_two_factors_table.ts.stub

@@ -0,0 +1,24 @@
+import { Migration, SchemaBuilder } from 'arkormx'
+
+export default class CreateUserTwoFactorsTableMigration extends Migration {
+    public async up (schema: SchemaBuilder): Promise<void> {
+        schema.createTable('user_two_factors', (table) => {
+            table.id('id', 'uuid').primary()
+            table.uuid('userId').map('user_id')
+                .foreign().references('users', 'id').onDelete('cascade').as('user').inverseAlias('twoFactor')
+            table.enum('method', ['authenticator', 'sms']).nullable().enumName('TwoFactorMethod')
+            table.string('secretCiphertext').nullable().map('secret_ciphertext')
+            table.string('smsCodeHash').nullable().map('sms_code_hash')
+            table.date('smsCodeExpiresAt').nullable().map('sms_code_expires_at')
+            table.string('smsCodePurpose').nullable().map('sms_code_purpose')
+            table.date('enabledAt').nullable().map('enabled_at')
+            table.json('recoveryCodeHashes').nullable().map('recovery_code_hashes')
+            table.timestamps()
+            table.index(['userId'])
+        })
+    }
+
+    public async down (schema: SchemaBuilder): Promise<void> {
+        schema.dropTable('user_two_factors')
+    }
+}

package/stubs/models/UserTwoFactor.ts.stub

@@ -0,0 +1,20 @@
+import { UserTwoFactor as BaseUserTwoFactor } from '@arkstack/auth'
+import { User } from '@app/models/User'
+
+export class UserTwoFactor extends BaseUserTwoFactor {
+    protected static columns = {
+        userId: 'user_id',
+        secretCiphertext: 'secret_ciphertext',
+        smsCodeHash: 'sms_code_hash',
+        smsCodeExpiresAt: 'sms_code_expires_at',
+        smsCodePurpose: 'sms_code_purpose',
+        enabledAt: 'enabled_at',
+        recoveryCodeHashes: 'recovery_code_hashes',
+        createdAt: 'created_at',
+        updatedAt: 'updated_at',
+    }
+
+    user() {
+        return this.belongsTo(User, 'userId', 'id')
+    }
+}

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","names":["#request","#response","#errors","#user"],"sources":["../src/Contracts/AuthContract.ts","../src/Exceptions/AuthenticationException.ts","../src/CurrentSession.ts","../src/SessionDevice.ts","../src/Auth.ts","../src/TwoFactor.ts","../src/Contracts/PersonalAccessToken.ts","../src/Contracts/User.ts","../src/Contracts/UserTwoFactor.ts"],"sourcesContent":["import { CurrentSession } from '../CurrentSession'\nimport { PersonalAccessToken } from './PersonalAccessToken'\nimport { Request, type RequestSource } from '@arkstack/http'\nimport { User } from './User'\n\n/**\n * The Auth class provides methods for user authentication, including verifying \n * credentials, logging in, logging out, and managing personal access tokens. \n * \n * @author Legacy (3m1n3nc3)\n */\nexport abstract class AuthContract {\n    /**\n     * Set the current HTTP request instance being processed.\n     * \n     * @param req   The HTTP request instance to be set.\n     * @returns     The Auth instance itself for method chaining.\n     */\n    abstract setRequest (req: Request<User> | RequestSource<User>): this\n\n    /**\n     * Get the current HTTP request instance being processed, which may contain\n     * user information and other request-specific data relevant to authentication operations.\n     * \n     * @returns The current HTTP request instance or undefined if not set.\n     */\n    abstract getRequest (): Request<User> | undefined\n\n    /**\n     * Get the currently authenticated user\n     * \n     * @returns The currently authenticated user or null if not authenticated.\n     */\n    abstract user (): User | null\n\n    /**\n     * Verify user credentials\n     * \n     * @param email     The email address of the user.\n     * @param password  The password of the user.\n     * @returns         A boolean indicating whether the credentials are valid.\n     */\n    abstract verify (email: string, password: string): Promise<boolean>\n\n    /**\n     * Attempt to authenticate a user with the given email and password.\n     * \n     * @param email \n     * @param password \n     * @returns \n     */\n    abstract attempt (email: string, password: string): Promise<User>\n\n    /**\n     * Login a user and create a personal access token\n     * \n     * @param email \n     * @param password \n     * @returns \n     */\n    abstract login (email: string, password: string): Promise<PersonalAccessToken>\n\n    /**\n     * Create a temporary token for a user with a specific purpose, such as\n     * two-factor authentication.\n     * \n     * @param user \n     * @param purpose \n     * @param expiresIn \n     * @returns \n     */\n    abstract createTemporaryToken (user: User, purpose: string, expiresIn?: string): Promise<string>\n\n    /**\n     * Authorize a temporary token and return the associated user if the token is \n     * valid and matches the expected purpose.\n     * \n     * @param token \n     * @param purpose \n     * @returns \n     */\n    abstract authorizeTemporaryToken (token: string, purpose: string): Promise<User>\n\n    /**\n     * Logout the currently authenticated user and delete all their personal access tokens\n     * \n     * @param token \n     * @returns \n     */\n    abstract logout (token?: string | PersonalAccessToken): Promise<void>\n\n    /**\n     * Check if the user is authenticated\n     * \n     * @returns \n     */\n    abstract check (): Promise<boolean>\n\n    /**\n     * Get the current session's personal access token\n     * \n     * @returns \n     */\n    abstract currentSession (): CurrentSession\n\n    /**\n     * Create a personal access token for a user\n     * \n     * @param user \n     * @returns \n     */\n    abstract create (user: User): Promise<PersonalAccessToken>\n\n    /**\n     * Authorize a token and return the associated user\n     * \n     * @param token \n     * @returns \n     */\n    abstract authorizeToken (token: string): Promise<User>\n}\n","import { Request, Response, type RequestSource, type ResponseSource } from '@arkstack/http'\n\nimport { Exception } from '@arkstack/common'\n\nexport class AuthenticationException extends Exception {\n    #errors?: Record<string, any>\n    #request?: Request\n    #response?: Response\n    statusCode: number = 401\n    name: string\n\n    constructor(\n        message: string = 'Authentication failed',\n        ctx?: {\n            req?: Request | RequestSource,\n            res?: Response | ResponseSource,\n            status?: number,\n            errors?: Record<string, any>\n        }\n    ) {\n        super(message)\n        this.name = 'AuthenticationException'\n        this.statusCode = ctx?.status ?? 401\n        if (ctx) {\n            this.#request = Request.from(ctx.req)\n            this.#response = Response.from(ctx.res)\n            this.#errors = ctx.errors\n        }\n\n        void this.#response\n        void this.#request\n    }\n\n    errors (): Record<string, any> | undefined {\n        return this.#errors\n    }\n}\n","import { AuthContract } from './Contracts/AuthContract'\nimport { PersonalAccessToken } from './Contracts/PersonalAccessToken'\nimport { getModel } from '@arkstack/common'\n\n/**\n * The CurrentSession class represents the current authentication session and provides \n * methods to manage it, such as destroying the session (logging out) and retrieving \n * the current personal access token. It is used internally by the Auth class to \n * handle session-specific operations.\n * \n * @author Legacy (3m1n3nc3)\n * @since 1.0.0\n * @version 1.0.0\n * @see Auth\n */\nexport class CurrentSession {\n    constructor(private auth: AuthContract) { }\n\n    /**\n     * Destroy the current session's personal access token, effectively \n     * logging out the user from this session.\n     */\n    async destroy () {\n        const pat = await this.token()\n\n        if (pat) {\n            await this.auth.logout(pat)\n        }\n    }\n\n    /**\n     * Get the current session's personal access token\n     * \n     * @returns \n     */\n    async token (): Promise<PersonalAccessToken | null> {\n        if (!this.auth.getRequest()) {\n            return null\n        }\n\n        const token = this.auth.getRequest()!.bearerToken()\n\n        if (!token) {\n            return null\n        }\n\n        const Model = await getModel<typeof PersonalAccessToken>('PersonalAccessToken')\n        const pat = await Model.query().where({ token }).first()\n\n        return pat\n    }\n}\n","import { type Request } from '@arkstack/http'\nimport { AuthAgentPayload, SessionDeviceInfo } from './types/Session'\nimport { UAParser } from 'ua-parser-js'\n\nexport class SessionDevice {\n    private static readonly uniqueIdentityFields = [\n        'deviceName',\n        'manufacturer',\n        'model',\n        'platform',\n        'os',\n        'osVersion',\n        'browser',\n        'deviceType',\n    ] as const\n\n    /**\n     * Extracts device information from the incoming request to build a SessionDeviceInfo object.\n     * \n     * @param req The incoming HTTP request object.\n     * @returns A SessionDeviceInfo object containing information about the client's device.\n     */\n    static fromRequest (req?: Request): SessionDeviceInfo {\n        const userAgent = this.readUserAgent(req)\n        const ua = new UAParser(userAgent ?? undefined).getResult()\n        const ca = this.readAuthAgent(req)\n\n        return {\n            browser: this.readString(ua.browser.name) ?? this.detectBrowser(userAgent),\n            os: ca?.os ?? this.readString(ua.os.name) ?? this.detectOs(userAgent),\n            osVersion: ca?.osVersion ?? this.readString(ua.os.version),\n            deviceType: ca?.deviceType ?? this.normalizeDeviceType(ua.device.type) ?? this.detectDeviceType(userAgent),\n            deviceName: ca?.deviceName ?? null,\n            manufacturer: ca?.manufacturer ?? this.readString(ua.device.vendor),\n            model: ca?.model ?? this.readString(ua.device.model),\n            platform: ca?.platform ?? null,\n            ipAddress: this.detectIpAddress(req),\n            userAgent,\n        }\n    }\n\n    /**\n     * Generates a human-readable display name for the device based on available information.\n     * \n     * @param deviceInfo A record containing device information.\n     * @returns A string representing the display name of the device.\n     */\n    static getDisplayName (deviceInfo?: Record<string, unknown> | null) {\n        const deviceName = this.readString(deviceInfo?.deviceName)\n        const manufacturer = this.readString(deviceInfo?.manufacturer)\n        const model = this.readString(deviceInfo?.model)\n        const browser = this.readString(deviceInfo?.browser)\n        const os = this.readString(deviceInfo?.os)\n        const deviceType = this.readString(deviceInfo?.deviceType)\n\n        if (manufacturer && model) {\n            return model.startsWith(manufacturer) ? model : `${manufacturer} ${model}`\n        }\n\n        if (model) {\n            return model\n        }\n\n        if (deviceName) {\n            return deviceName\n        }\n\n        if (browser && os) {\n            return `${browser} on ${os}`\n        }\n\n        if (os && deviceType && deviceType !== 'unknown') {\n            return `${os} ${deviceType}`\n        }\n\n        if (browser) {\n            return browser\n        }\n\n        return 'Unknown device'\n    }\n\n    /**\n     * Builds a stable device key for matching previously issued sessions to the\n     * current request device.\n     *\n     * @param deviceInfo A record containing device information.\n     * @returns A normalized device key or null when there is not enough signal.\n     */\n    static getUniqueKey (deviceInfo?: Record<string, unknown> | null) {\n        const parts = this.uniqueIdentityFields\n            .map((field) => [field, this.readString(deviceInfo?.[field])?.toLowerCase()] as const)\n            .filter(([, value]) => !!value)\n\n        if (parts.length < 2) {\n            const fallbackUserAgent = this.readString(deviceInfo?.userAgent)?.toLowerCase()\n\n            return fallbackUserAgent ?? null\n        }\n\n        return parts.map(([field, value]) => `${field}:${value}`).join('|')\n    }\n\n    /**\n     * Determines whether two device payloads represent the same device.\n     *\n     * @param left The first device payload.\n     * @param right The second device payload.\n     * @returns True when both payloads resolve to the same device key.\n     */\n    static matches (left?: Record<string, unknown> | null, right?: Record<string, unknown> | null) {\n        const leftKey = this.getUniqueKey(left)\n        const rightKey = this.getUniqueKey(right)\n\n        if (!leftKey || !rightKey) {\n            return false\n        }\n\n        return leftKey === rightKey\n    }\n\n    /**\n     * Safely reads the user agent string from the request headers.\n     * \n     * @param req \n     * @returns \n     */\n    private static readUserAgent (req?: Request) {\n        const userAgent = req?.header('user-agent')\n\n        return typeof userAgent === 'string' ? userAgent : null\n    }\n\n    /**\n     * Safely reads a string value, ensuring it's a non-empty string or returns null.\n     * \n     * @param value \n     * @returns \n     */\n    private static readString (value: unknown) {\n        return typeof value === 'string' && value.length > 0 ? value : null\n    }\n\n    /**\n     * Reads a specific device-related header from the request\n     * \n     * @param req \n     * @param headerName \n     * @returns \n     */\n    private static readAuthAgent (req?: Request): AuthAgentPayload | null {\n        const value = req?.header('x-auth-agent')\n\n        if (typeof value !== 'string' || value.length < 1) {\n            return null\n        }\n\n        try {\n            const parsed: AuthAgentPayload = JSON.parse(value)\n\n            return {\n                deviceName: this.readString(parsed.deviceName) ?? undefined,\n                manufacturer: this.readString(parsed.manufacturer) ?? undefined,\n                model: this.readString(parsed.model) ?? undefined,\n                platform: this.readString(parsed.platform) ?? undefined,\n                os: this.readString(parsed.os) ?? undefined,\n                osVersion: this.readString(parsed.osVersion) ?? undefined,\n                deviceType: this.normalizeDeviceType(parsed.deviceType) ?? undefined,\n            }\n        } catch {\n            return null\n        }\n    }\n\n    private static normalizeDeviceType (value: unknown): SessionDeviceInfo['deviceType'] | null {\n        if (value === 'mobile' || value === 'tablet' || value === 'desktop' || value === 'bot' || value === 'unknown') {\n            return value\n        }\n\n        return null\n    }\n\n    /**\n     * Detects the client's IP address from the request, considering common headers set by proxies.\n     * \n     * @param req \n     * @returns \n     */\n    private static detectIpAddress (req?: Request) {\n        const forwarded = req?.header('x-forwarded-for')\n\n        if (typeof forwarded === 'string' && forwarded.length > 0) {\n            return forwarded.split(',')[0].trim()\n        }\n\n        return req?.ip ?? null\n    }\n\n    /**\n     * Detects the browser from the user agent string.\n     * \n     * @param userAgent \n     * @returns \n     */\n    private static detectBrowser (userAgent: string | null) {\n        if (!userAgent) return null\n        if (/Edg\\//i.test(userAgent)) return 'Edge'\n        if (/OPR\\//i.test(userAgent)) return 'Opera'\n        if (/SamsungBrowser\\//i.test(userAgent)) return 'Samsung Internet'\n        if (/Chrome\\//i.test(userAgent) && !/Edg\\//i.test(userAgent)) return 'Chrome'\n        if (/Firefox\\//i.test(userAgent)) return 'Firefox'\n        if (/Safari\\//i.test(userAgent) && !/Chrome\\//i.test(userAgent)) return 'Safari'\n        if (/PostmanRuntime\\//i.test(userAgent)) return 'Postman'\n        if (/okhttp\\//i.test(userAgent)) return 'OkHttp'\n        if (/curl\\//i.test(userAgent)) return 'cURL'\n\n        return null\n    }\n\n    /**\n     * Detects the operating system from the user agent string.\n     * \n     * @param userAgent \n     * @returns \n     */\n    private static detectOs (userAgent: string | null) {\n        if (!userAgent) return null\n        if (/iPhone|iPad|iPod/i.test(userAgent)) return 'iOS'\n        if (/Android/i.test(userAgent)) return 'Android'\n        if (/Mac OS X|Macintosh/i.test(userAgent)) return 'macOS'\n        if (/Windows NT/i.test(userAgent)) return 'Windows'\n        if (/Linux/i.test(userAgent)) return 'Linux'\n\n        return null\n    }\n\n    /**\n     * Detects the device type from the user agent string.\n     * \n     * @param userAgent \n     * @returns \n     */\n    private static detectDeviceType (userAgent: string | null): SessionDeviceInfo['deviceType'] {\n        if (!userAgent) return 'unknown'\n        if (/bot|spider|crawl/i.test(userAgent)) return 'bot'\n        if (/iPad|Tablet/i.test(userAgent)) return 'tablet'\n        if (/Mobile|iPhone|Android/i.test(userAgent)) return 'mobile'\n\n        return 'desktop'\n    }\n}\n","import { Hash, env, getModel } from '@arkstack/common'\nimport { JWTPayload, SignJWT, jwtVerify } from 'jose'\n\nimport { AuthContract } from './Contracts/AuthContract'\nimport { AuthenticationException } from './Exceptions/AuthenticationException'\nimport { CurrentSession } from './CurrentSession'\nimport { PersonalAccessToken } from './Contracts/PersonalAccessToken'\nimport { Request, type RequestSource } from '@arkstack/http'\nimport { SessionDevice } from './SessionDevice'\nimport { User } from './Contracts/User'\n\n/**\n * The Auth class provides methods for user authentication, including verifying \n * credentials, logging in, logging out, and managing personal access tokens. \n * \n * @author Legacy (3m1n3nc3)\n */\nexport class Auth extends AuthContract {\n    protected static req?: Request<User>\n    private configuredSecret?: string\n    #user: User | null = null\n\n    constructor(secret?: string, req?: Request<User> | RequestSource<User>) {\n        super()\n        Auth.req = Request.from<User>(req)\n        this.configuredSecret = secret\n    }\n\n    /**\n     * Create a new instance of the Auth class with an optional secret for JWT \n     * signing and verification.\n     * \n     * @param secret    The secret key used for signing and verifying JWTs.\n     * @returns         A new instance of the Auth class.\n     */\n    static make (secret?: string) {\n        return new Auth(secret)\n    }\n\n    /**\n     * Set the current HTTP request instance being processed.\n     * \n     * @param req   The HTTP request instance to be set.\n     * @returns     The Auth class itself for method chaining.\n     */\n    static setRequest (req: Request<User> | RequestSource<User>) {\n        this.req = Request.from<User>(req)\n\n        return this\n    }\n\n    /**\n     * Set the current HTTP request instance being processed.\n     * \n     * @param req   The HTTP request instance to be set.\n     * @returns     The Auth instance itself for method chaining.\n     */\n    setRequest (req: Request<User> | RequestSource<User>) {\n        Auth.req ??= Request.from<User>(req)\n\n        return this\n    }\n\n    /**\n     * Get the current HTTP request instance being processed, which may contain\n     * user information and other request-specific data relevant to authentication operations.\n     * \n     * @returns The current HTTP request instance or undefined if not set.\n     */\n    getRequest (): Request<User> | undefined {\n        return Auth.req\n    }\n\n    /**\n     * Get the currently authenticated user\n     * \n     * @returns The currently authenticated user or null if not authenticated.\n     */\n    user (): User | null {\n        return this.#user\n    }\n\n    /**\n     * Verify user credentials\n     * \n     * @param email     The email address of the user.\n     * @param password  The password of the user.\n     * @returns         A boolean indicating whether the credentials are valid.\n     */\n    async verify (email: string, password: string): Promise<boolean> {\n        const user = await (await getModel<typeof User>('User')).query().where({ email }).first()\n\n        return !!user && await Hash.verify(password, user.password)\n    }\n\n    /**\n     * Attempt to authenticate a user with the given email and password.\n     * \n     * @param email \n     * @param password \n     * @returns \n     */\n    async attempt (email: string, password: string): Promise<User> {\n        const user = await (await getModel<typeof User>('User')).query().where({ email }).first()\n\n        if (!user) {\n            throw new AuthenticationException('User account not found', { req: Auth.req, status: 422, errors: { email: ['No account found for this email address'] } })\n        }\n\n        const isValid = await Hash.verify(password, user.password)\n\n        if (!isValid) {\n            throw new AuthenticationException('Invalid credentials', { req: Auth.req, status: 422, errors: { password: ['Invalid password'] } })\n        }\n\n        Auth.req?.setUser(user)\n\n        this.#user = user\n\n        return user\n    }\n\n    /**\n     * Login a user and create a personal access token\n     * \n     * @param email \n     * @param password \n     * @returns \n     */\n    async login (email: string, password: string): Promise<PersonalAccessToken> {\n        const user = await this.attempt(email, password)\n\n        return await this.create(user)\n    }\n\n    /**\n     * Create a temporary token for a user with a specific purpose, such as\n     * two-factor authentication.\n     * \n     * @param user \n     * @param purpose \n     * @param expiresIn \n     * @returns \n     */\n    async createTemporaryToken (user: User, purpose: string, expiresIn: string = '10m'): Promise<string> {\n        return await this.createJWT({\n            sub: user.id.toString(),\n            email: user.email,\n            purpose,\n        }, expiresIn)\n    }\n\n    /**\n     * Authorize a temporary token and return the associated user if the token is \n     * valid and matches the expected purpose.\n     * \n     * @param token \n     * @param purpose \n     * @returns \n     */\n    async authorizeTemporaryToken (token: string, purpose: string): Promise<User> {\n        const payload = await this.verifyJWT(token)\n\n        if (!payload || payload.purpose !== purpose || !payload.sub) {\n            throw new AuthenticationException(\n                'Invalid or expired two-factor session',\n                { req: Auth.req, status: 401 }\n            )\n        }\n\n        const user = await (await getModel<typeof User>('User')).query().find(payload.sub)\n\n        if (!user) {\n            throw new AuthenticationException(\n                'User account not found',\n                { req: Auth.req, status: 401 }\n            )\n        }\n\n        Auth.req?.setUser(user)\n\n        this.#user = user\n\n        return user\n    }\n\n    /**\n     * Logout the currently authenticated user and delete all their personal access tokens\n     * \n     * @param token \n     * @returns \n     */\n    async logout (token?: string | PersonalAccessToken): Promise<void> {\n        if (!this.#user && !token) {\n            return\n        }\n\n        if (token) {\n            if (typeof token === 'string') {\n                const TokenModel = await getModel<typeof PersonalAccessToken>('PersonalAccessToken')\n\n                await TokenModel.query().where({ token }).delete()\n            } else {\n                await token.delete()\n            }\n        } else {\n            const TokenModel = await getModel<typeof PersonalAccessToken>('PersonalAccessToken')\n\n            await TokenModel.query().where({ userId: this.#user!.id }).delete()\n        }\n\n        this.#user = null\n    }\n\n    /**\n     * Check if the user is authenticated\n     * \n     * @returns \n     */\n    async check (): Promise<boolean> {\n        return !!this.#user\n    }\n\n    /**\n     * Get the current session's personal access token\n     * \n     * @returns \n     */\n    currentSession () {\n        return new CurrentSession(this)\n    }\n\n    /**\n     * Create a personal access token for a user\n     * \n     * @param user \n     * @returns \n     */\n    async create (user: User): Promise<PersonalAccessToken> {\n        const payload: JWTPayload = {\n            sub: user.id.toString(),\n            email: user.email,\n        }\n\n        Auth.req?.setUser(user)\n\n        const token = await this.createJWT(payload)\n        const deviceInfo = SessionDevice.fromRequest(Auth.req)\n\n        const pat = await this.upsertDeviceToken(user, token, deviceInfo)\n\n        pat.setLoadedRelation('user', user)\n\n        return pat\n    }\n\n    /**\n     * Create or replace the personal access token for the same user and device\n     * while keeping a single active session record for that device.\n     *\n     * @param user The authenticated user.\n     * @param token The new bearer token to persist.\n     * @param deviceInfo The current request's device information.\n     */\n    private async upsertDeviceToken (user: User, token: string, deviceInfo: Record<string, unknown> | null) {\n        const TokenModel = await getModel<typeof PersonalAccessToken>('PersonalAccessToken')\n        const deviceKey = SessionDevice.getUniqueKey(deviceInfo)\n        const payload = {\n            abilities: [],\n            token,\n            name: SessionDevice.getDisplayName(deviceInfo),\n            userId: user.id,\n            lastUsedAt: new Date(),\n        } as {\n            abilities: string[]\n            token: string\n            name: string\n            userId: User['id']\n            deviceInfo?: Record<string, unknown> | null\n            lastUsedAt: Date\n        }\n\n        if (!deviceKey) {\n            return await TokenModel.query().create(payload)\n        }\n\n        payload.deviceInfo = deviceInfo\n\n        const existingSessions = (await TokenModel.query().where({ userId: user.id }).get()).all()\n        const matchingSessions = existingSessions\n            .filter((session) => SessionDevice.matches(session.deviceInfo, deviceInfo))\n            .sort((left, right) => {\n                const leftTime = (left.lastUsedAt ?? left.createdAt).getTime()\n                const rightTime = (right.lastUsedAt ?? right.createdAt).getTime()\n\n                return rightTime - leftTime\n            })\n\n        if (matchingSessions.length < 1) {\n            return await TokenModel.query().create(payload)\n        }\n\n        const [currentSession, ...duplicateSessions] = matchingSessions\n\n        if (duplicateSessions.length > 0) {\n            await Promise.all(duplicateSessions.map(async (session) => await session.delete()))\n        }\n\n        await TokenModel.query().where({ id: currentSession.id }).update(payload)\n\n        currentSession.token = payload.token\n        currentSession.name = payload.name\n        currentSession.userId = payload.userId\n        currentSession.deviceInfo = payload.deviceInfo\n        currentSession.lastUsedAt = payload.lastUsedAt\n\n        return currentSession\n    }\n\n    /**\n     * Authorize a token and return the associated user\n     * \n     * @param token \n     * @returns \n     */\n    async authorizeToken (token: string): Promise<User> {\n        const payload = await this.verifyJWT(token)\n\n        if (!payload) {\n            throw new AuthenticationException(\n                'Invalid or expired session',\n                { req: Auth.req, status: 401 }\n            )\n        }\n\n        const TokenModel = await getModel<typeof PersonalAccessToken>('PersonalAccessToken')\n        const pat = await TokenModel.query().where({ token }).first()\n\n        if (!pat) {\n            throw new AuthenticationException(\n                'Invalid or expired access token',\n                { req: Auth.req, status: 401 }\n            )\n        }\n\n        const user = await (await getModel<typeof User>('User')).query().find(payload.sub!)\n\n        if (!user) {\n            throw new AuthenticationException(\n                'User account not found',\n                { req: Auth.req, status: 401 }\n            )\n        }\n\n        Auth.req?.setUser(user)\n\n        void this.touchSession(pat).catch((error) => {\n            if (env('NODE_ENV') === 'development') {\n                console.error('Failed to update session activity', error)\n            }\n        })\n\n        this.#user = user\n\n        return user\n    }\n\n    /**\n     * Create a JWT token\n     * \n     * @param payload \n     * @returns \n     */\n    private async createJWT (payload: JWTPayload, expiresIn: string = env('JWT_EXPIRES_IN', '1h')): Promise<string> {\n        const jwt = await new SignJWT(payload)\n            .setProtectedHeader({ alg: 'HS256' })\n            .setIssuedAt()\n            .setExpirationTime(expiresIn)\n            .sign(new TextEncoder().encode(this.getSecret()))\n\n        return jwt\n    }\n\n    /**\n     * Verify a JWT token\n     * \n     * @param token \n     * @returns \n     */\n    private async verifyJWT (token: string): Promise<JWTPayload | null> {\n        try {\n            const { payload } = await jwtVerify(token, new TextEncoder().encode(this.getSecret()))\n\n            return payload\n        } catch {\n            return null\n        }\n    }\n\n    private getSecret (): string {\n        return this.configuredSecret ?? env('JWT_SECRET', 'default_secret')\n    }\n\n    /**\n     * Update the last used timestamp and device information of a personal \n     * access token to keep the session active and reflect the latest device details.\n     * \n     * @param pat The personal access token to update.\n     * @returns A promise that resolves when the update is complete.\n     */\n    private async touchSession (pat: PersonalAccessToken) {\n        const now = new Date()\n        const currentDeviceInfo = SessionDevice.fromRequest(Auth.req)\n        const shouldUpdateLastUsedAt = !pat.lastUsedAt || (now.getTime() - pat.lastUsedAt.getTime()) > 5 * 60 * 1000\n        const hasDeviceInfo = !!pat.deviceInfo\n        const currentDisplayName = SessionDevice.getDisplayName(currentDeviceInfo)\n        const storedDisplayName = SessionDevice.getDisplayName(pat.deviceInfo)\n        const shouldRefreshDeviceInfo = !hasDeviceInfo || storedDisplayName !== currentDisplayName\n\n        if (!shouldUpdateLastUsedAt && !shouldRefreshDeviceInfo) {\n            return\n        }\n\n        const payload: {\n            lastUsedAt: Date\n            deviceInfo?: Record<string, unknown> | null\n            name?: string\n        } = {\n            lastUsedAt: now,\n        }\n\n        if (shouldRefreshDeviceInfo) {\n            payload.deviceInfo = currentDeviceInfo\n            payload.name = currentDisplayName\n        }\n\n        const TokenModel = await getModel<typeof PersonalAccessToken>('PersonalAccessToken')\n\n        await TokenModel.query().where({ id: pat.id }).update(payload)\n\n        pat.lastUsedAt = now\n\n        if (payload.deviceInfo !== undefined) {\n            pat.deviceInfo = payload.deviceInfo\n        }\n\n        if (payload.name !== undefined) {\n            pat.name = payload.name\n        }\n    }\n}\n","import { Encryption, Hash, env, getModel } from '@arkstack/common'\nimport { randomBytes } from 'node:crypto'\n\nimport { User } from './Contracts/User'\nimport { UserTwoFactor } from './Contracts/UserTwoFactor'\nimport type { IssuedSmsCode, SmsCodePurpose, TwoFactorMethod, TwoFactorSetup, TwoFactorStatus } from './types/TwoFactor'\n\ntype TwoFactorUser = User & {\n    phone?: string | null\n}\n\nconst secretAlphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'\nconst appName = () => env('APP_NAME', 'Arkstack')\nconst smsCodeTtlMinutes = () => Number(env('TWO_FACTOR_SMS_TTL_MINUTES', 10)) || 10\n\nexport class TwoFactor {\n    private static async getModel () {\n        return await getModel<typeof UserTwoFactor>('UserTwoFactor')\n    }\n\n    private static async getRecord (userId: User['id']) {\n        const Model = await this.getModel()\n\n        return await Model.query().where({ userId }).first()\n    }\n\n    private static async upsert (\n        userId: User['id'],\n        attributes: Partial<Pick<UserTwoFactor,\n            | 'method' | 'secretCiphertext' | 'smsCodeHash' | 'smsCodeExpiresAt'\n            | 'smsCodePurpose' | 'enabledAt' | 'recoveryCodeHashes'\n        >>\n    ) {\n        const Model = await this.getModel()\n\n        await Model.query().updateOrInsert({ userId }, attributes)\n    }\n\n    static normalizeMethod (method?: string | null): TwoFactorMethod | null {\n        if (method === 'authenticator' || method === 'sms') {\n            return method\n        }\n\n        return null\n    }\n\n    static maskPhone (phone?: string | null) {\n        if (!phone) {\n            return null\n        }\n\n        const normalized = phone.replace(/\\s+/g, '')\n\n        if (normalized.length <= 4) {\n            return normalized\n        }\n\n        return `${'*'.repeat(Math.max(normalized.length - 4, 2))}${normalized.slice(-4)}`\n    }\n\n    static getLabel (user: User) {\n        return user.email || `${appName()}:${user.id}`\n    }\n\n    static getTotp (user: User, secret: string) {\n        return Hash.totp(secret, this.getLabel(user), appName())\n    }\n\n    static generateSecret (size = 20) {\n        const bytes = randomBytes(size)\n        let secret = ''\n\n        for (const byte of bytes) {\n            secret += secretAlphabet[byte % secretAlphabet.length]\n        }\n\n        return secret\n    }\n\n    static createSetup (user: User, secret?: string): TwoFactorSetup {\n        const resolvedSecret = secret ?? this.generateSecret()\n        const totp = this.getTotp(user, resolvedSecret)\n\n        return {\n            secret: resolvedSecret,\n            otpauthUrl: totp.toString(),\n        }\n    }\n\n    static verifyCode (user: User, secret: string, code: string) {\n        return this.getTotp(user, secret).validate({ token: code, window: 1 }) !== null\n    }\n\n    static async getMethod (userId: User['id']) {\n        const record = await this.getRecord(userId)\n\n        return this.normalizeMethod(record?.method)\n    }\n\n    static async setMethod (userId: User['id'], method: TwoFactorMethod) {\n        await this.upsert(userId, { method })\n    }\n\n    static async getSecret (userId: User['id']) {\n        const record = await this.getRecord(userId)\n\n        return record?.secretCiphertext ? Encryption.decrypt(record.secretCiphertext) : null\n    }\n\n    static async setSecret (userId: User['id'], secret: string) {\n        await this.upsert(userId, { secretCiphertext: Encryption.encrypt(secret) })\n    }\n\n    static async clearSecret (userId: User['id']) {\n        await this.upsert(userId, { secretCiphertext: null })\n    }\n\n    static async getEnabledAt (userId: User['id']) {\n        const record = await this.getRecord(userId)\n\n        return record?.enabledAt?.toISOString() ?? null\n    }\n\n    static async setEnabledAt (userId: User['id'], enabledAt: string | Date = new Date()) {\n        await this.upsert(userId, {\n            enabledAt: typeof enabledAt === 'string' ? new Date(enabledAt) : enabledAt,\n        })\n    }\n\n    static async clear (userId: User['id']) {\n        const Model = await this.getModel()\n\n        await Model.query().where({ userId }).delete()\n    }\n\n    static generateBackupCodes (count = 8) {\n        return Array.from({ length: count }, () => {\n            const left = randomBytes(3).toString('hex').slice(0, 4).toUpperCase()\n            const right = randomBytes(3).toString('hex').slice(0, 4).toUpperCase()\n\n            return `${left}-${right}`\n        })\n    }\n\n    static async hashBackupCodes (codes: string[]) {\n        return await Promise.all(codes.map(async code => await Hash.make(code)))\n    }\n\n    static async readRecoveryCodeHashes (userId: User['id']) {\n        const record = await this.getRecord(userId)\n\n        return record?.recoveryCodeHashes ?? []\n    }\n\n    static async writeRecoveryCodeHashes (userId: User['id'], hashes: string[]) {\n        await this.upsert(userId, { recoveryCodeHashes: hashes })\n    }\n\n    static async consumeRecoveryCode (userId: User['id'], recoveryCode: string) {\n        const hashes = await this.readRecoveryCodeHashes(userId)\n\n        for (const [index, hash] of hashes.entries()) {\n            if (await Hash.verify(recoveryCode, hash)) {\n                await this.writeRecoveryCodeHashes(\n                    userId,\n                    hashes.filter((_, currentIndex) => currentIndex !== index),\n                )\n\n                return true\n            }\n        }\n\n        return false\n    }\n\n    static async readStatus (userId: User['id']): Promise<TwoFactorStatus> {\n        const record = await this.getRecord(userId)\n        const enabledAt = record?.enabledAt?.toISOString() ?? null\n        const recoveryCodes = record?.recoveryCodeHashes ?? []\n\n        return {\n            enabled: !!enabledAt,\n            enabledAt,\n            method: this.normalizeMethod(record?.method),\n            recoveryCodesRemaining: recoveryCodes.length,\n        }\n    }\n\n    static createSmsCode () {\n        return Math.floor(100000 + Math.random() * 900000).toString()\n    }\n\n    static async issueSmsCode (user: User, purpose: SmsCodePurpose): Promise<IssuedSmsCode> {\n        if (!(user as TwoFactorUser).phone) {\n            throw new Error('A phone number is required to issue a two-factor SMS code.')\n        }\n\n        const code = this.createSmsCode()\n        const smsCodeHash = await Hash.make(code)\n        const expiresAt = new Date(Date.now() + smsCodeTtlMinutes() * 60 * 1000)\n\n        await this.upsert(user.id, {\n            smsCodeHash,\n            smsCodeExpiresAt: expiresAt,\n            smsCodePurpose: purpose,\n        })\n\n        return {\n            code,\n            expiresAt,\n            purpose,\n        }\n    }\n\n    static async clearSmsCode (userId: User['id']) {\n        await this.upsert(userId, {\n            smsCodeHash: null,\n            smsCodeExpiresAt: null,\n            smsCodePurpose: null,\n        })\n    }\n\n    static async verifySmsCode (userId: User['id'], code: string, purpose: SmsCodePurpose) {\n        const record = await this.getRecord(userId)\n\n        if (!record?.smsCodeHash || !record.smsCodeExpiresAt || record.smsCodePurpose !== purpose) {\n            return false\n        }\n\n        if (record.smsCodeExpiresAt.getTime() < Date.now()) {\n            await this.clearSmsCode(userId)\n\n            return false\n        }\n\n        const isValid = await Hash.verify(code, record.smsCodeHash)\n\n        if (isValid) {\n            await this.clearSmsCode(userId)\n        }\n\n        return isValid\n    }\n}\n","import { Model } from '@arkstack/database'\n\nexport abstract class PersonalAccessToken extends Model {\n    declare id: number\n    declare name: string\n    declare token: string\n    declare abilities: string[]\n    declare userId: number\n    declare createdAt: Date\n    declare expiresAt: Date | null\n    declare lastUsedAt: Date | null\n    declare deviceInfo: Record<string, unknown> | null\n}\n","import { Model } from '@arkstack/database'\n\nexport abstract class User extends Model {\n    declare id: number\n    declare email: string\n    declare name: string\n    declare password: string\n    declare createdAt: Date\n    declare updatedAt: Date\n\n    protected static table?: string | undefined = 'users'\n}","import { Model } from '@arkstack/database'\n\nimport type { SmsCodePurpose, TwoFactorMethod } from '../types/TwoFactor'\nimport type { User } from './User'\n\nexport abstract class UserTwoFactor extends Model {\n    declare id: number | string\n    declare userId: User['id']\n    declare method: TwoFactorMethod | null\n    declare secretCiphertext: string | null\n    declare smsCodeHash: string | null\n    declare smsCodeExpiresAt: Date | null\n    declare smsCodePurpose: SmsCodePurpose | null\n    declare enabledAt: Date | null\n    declare recoveryCodeHashes: string[] | null\n    declare createdAt: Date\n    declare updatedAt: Date\n\n    protected static override table?: string | undefined = 'user_two_factors'\n\n    protected casts = {\n        recoveryCodeHashes: 'json',\n    } as const\n}\n"],"mappings":";;;;;;;;;;;;;AAWA,IAAsB,eAAtB,MAAmC;;;ACPnC,IAAa,0BAAb,cAA6C,UAAU;CACnD;CACA;CACA;CACA,aAAqB;CACrB;CAEA,YACI,UAAkB,yBAClB,KAMF;EACE,MAAM,QAAQ;EACd,KAAK,OAAO;EACZ,KAAK,aAAa,KAAK,UAAU;EACjC,IAAI,KAAK;GACL,KAAKA,WAAW,QAAQ,KAAK,IAAI,IAAI;GACrC,KAAKC,YAAY,SAAS,KAAK,IAAI,IAAI;GACvC,KAAKC,UAAU,IAAI;;EAGvB,KAAUD;EACV,KAAUD;;CAGd,SAA2C;EACvC,OAAO,KAAKE;;;;;;;;;;;;;;;;ACnBpB,IAAa,iBAAb,MAA4B;CACJ;CAApB,YAAY,MAA4B;EAApB,KAAA,OAAA;;;;;;CAMpB,MAAM,UAAW;EACb,MAAM,MAAM,MAAM,KAAK,OAAO;EAE9B,IAAI,KACA,MAAM,KAAK,KAAK,OAAO,IAAI;;;;;;;CASnC,MAAM,QAA8C;EAChD,IAAI,CAAC,KAAK,KAAK,YAAY,EACvB,OAAO;EAGX,MAAM,QAAQ,KAAK,KAAK,YAAY,CAAE,aAAa;EAEnD,IAAI,CAAC,OACD,OAAO;EAMX,OAAO,OAFW,MADE,SAAqC,sBAAsB,EACvD,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO;;;;;AC3ChE,IAAa,gBAAb,MAA2B;CACvB,OAAwB,uBAAuB;EAC3C;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACH;;;;;;;CAQD,OAAO,YAAa,KAAkC;EAClD,MAAM,YAAY,KAAK,cAAc,IAAI;EACzC,MAAM,KAAK,IAAI,SAAS,aAAa,KAAA,EAAU,CAAC,WAAW;EAC3D,MAAM,KAAK,KAAK,cAAc,IAAI;EAElC,OAAO;GACH,SAAS,KAAK,WAAW,GAAG,QAAQ,KAAK,IAAI,KAAK,cAAc,UAAU;GAC1E,IAAI,IAAI,MAAM,KAAK,WAAW,GAAG,GAAG,KAAK,IAAI,KAAK,SAAS,UAAU;GACrE,WAAW,IAAI,aAAa,KAAK,WAAW,GAAG,GAAG,QAAQ;GAC1D,YAAY,IAAI,cAAc,KAAK,oBAAoB,GAAG,OAAO,KAAK,IAAI,KAAK,iBAAiB,UAAU;GAC1G,YAAY,IAAI,cAAc;GAC9B,cAAc,IAAI,gBAAgB,KAAK,WAAW,GAAG,OAAO,OAAO;GACnE,OAAO,IAAI,SAAS,KAAK,WAAW,GAAG,OAAO,MAAM;GACpD,UAAU,IAAI,YAAY;GAC1B,WAAW,KAAK,gBAAgB,IAAI;GACpC;GACH;;;;;;;;CASL,OAAO,eAAgB,YAA6C;EAChE,MAAM,aAAa,KAAK,WAAW,YAAY,WAAW;EAC1D,MAAM,eAAe,KAAK,WAAW,YAAY,aAAa;EAC9D,MAAM,QAAQ,KAAK,WAAW,YAAY,MAAM;EAChD,MAAM,UAAU,KAAK,WAAW,YAAY,QAAQ;EACpD,MAAM,KAAK,KAAK,WAAW,YAAY,GAAG;EAC1C,MAAM,aAAa,KAAK,WAAW,YAAY,WAAW;EAE1D,IAAI,gBAAgB,OAChB,OAAO,MAAM,WAAW,aAAa,GAAG,QAAQ,GAAG,aAAa,GAAG;EAGvE,IAAI,OACA,OAAO;EAGX,IAAI,YACA,OAAO;EAGX,IAAI,WAAW,IACX,OAAO,GAAG,QAAQ,MAAM;EAG5B,IAAI,MAAM,cAAc,eAAe,WACnC,OAAO,GAAG,GAAG,GAAG;EAGpB,IAAI,SACA,OAAO;EAGX,OAAO;;;;;;;;;CAUX,OAAO,aAAc,YAA6C;EAC9D,MAAM,QAAQ,KAAK,qBACd,KAAK,UAAU,CAAC,OAAO,KAAK,WAAW,aAAa,OAAO,EAAE,aAAa,CAAC,CAAU,CACrF,QAAQ,GAAG,WAAW,CAAC,CAAC,MAAM;EAEnC,IAAI,MAAM,SAAS,GAGf,OAF0B,KAAK,WAAW,YAAY,UAAU,EAAE,aAAa,IAEnD;EAGhC,OAAO,MAAM,KAAK,CAAC,OAAO,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC,KAAK,IAAI;;;;;;;;;CAUvE,OAAO,QAAS,MAAuC,OAAwC;EAC3F,MAAM,UAAU,KAAK,aAAa,KAAK;EACvC,MAAM,WAAW,KAAK,aAAa,MAAM;EAEzC,IAAI,CAAC,WAAW,CAAC,UACb,OAAO;EAGX,OAAO,YAAY;;;;;;;;CASvB,OAAe,cAAe,KAAe;EACzC,MAAM,YAAY,KAAK,OAAO,aAAa;EAE3C,OAAO,OAAO,cAAc,WAAW,YAAY;;;;;;;;CASvD,OAAe,WAAY,OAAgB;EACvC,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;;;;;;;;;CAUnE,OAAe,cAAe,KAAwC;EAClE,MAAM,QAAQ,KAAK,OAAO,eAAe;EAEzC,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAC5C,OAAO;EAGX,IAAI;GACA,MAAM,SAA2B,KAAK,MAAM,MAAM;GAElD,OAAO;IACH,YAAY,KAAK,WAAW,OAAO,WAAW,IAAI,KAAA;IAClD,cAAc,KAAK,WAAW,OAAO,aAAa,IAAI,KAAA;IACtD,OAAO,KAAK,WAAW,OAAO,MAAM,IAAI,KAAA;IACxC,UAAU,KAAK,WAAW,OAAO,SAAS,IAAI,KAAA;IAC9C,IAAI,KAAK,WAAW,OAAO,GAAG,IAAI,KAAA;IAClC,WAAW,KAAK,WAAW,OAAO,UAAU,IAAI,KAAA;IAChD,YAAY,KAAK,oBAAoB,OAAO,WAAW,IAAI,KAAA;IAC9D;UACG;GACJ,OAAO;;;CAIf,OAAe,oBAAqB,OAAwD;EACxF,IAAI,UAAU,YAAY,UAAU,YAAY,UAAU,aAAa,UAAU,SAAS,UAAU,WAChG,OAAO;EAGX,OAAO;;;;;;;;CASX,OAAe,gBAAiB,KAAe;EAC3C,MAAM,YAAY,KAAK,OAAO,kBAAkB;EAEhD,IAAI,OAAO,cAAc,YAAY,UAAU,SAAS,GACpD,OAAO,UAAU,MAAM,IAAI,CAAC,GAAG,MAAM;EAGzC,OAAO,KAAK,MAAM;;;;;;;;CAStB,OAAe,cAAe,WAA0B;EACpD,IAAI,CAAC,WAAW,OAAO;EACvB,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO;EACrC,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO;EACrC,IAAI,oBAAoB,KAAK,UAAU,EAAE,OAAO;EAChD,IAAI,YAAY,KAAK,UAAU,IAAI,CAAC,SAAS,KAAK,UAAU,EAAE,OAAO;EACrE,IAAI,aAAa,KAAK,UAAU,EAAE,OAAO;EACzC,IAAI,YAAY,KAAK,UAAU,IAAI,CAAC,YAAY,KAAK,UAAU,EAAE,OAAO;EACxE,IAAI,oBAAoB,KAAK,UAAU,EAAE,OAAO;EAChD,IAAI,YAAY,KAAK,UAAU,EAAE,OAAO;EACxC,IAAI,UAAU,KAAK,UAAU,EAAE,OAAO;EAEtC,OAAO;;;;;;;;CASX,OAAe,SAAU,WAA0B;EAC/C,IAAI,CAAC,WAAW,OAAO;EACvB,IAAI,oBAAoB,KAAK,UAAU,EAAE,OAAO;EAChD,IAAI,WAAW,KAAK,UAAU,EAAE,OAAO;EACvC,IAAI,sBAAsB,KAAK,UAAU,EAAE,OAAO;EAClD,IAAI,cAAc,KAAK,UAAU,EAAE,OAAO;EAC1C,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO;EAErC,OAAO;;;;;;;;CASX,OAAe,iBAAkB,WAA2D;EACxF,IAAI,CAAC,WAAW,OAAO;EACvB,IAAI,oBAAoB,KAAK,UAAU,EAAE,OAAO;EAChD,IAAI,eAAe,KAAK,UAAU,EAAE,OAAO;EAC3C,IAAI,yBAAyB,KAAK,UAAU,EAAE,OAAO;EAErD,OAAO;;;;;;;;;;;ACvOf,IAAa,OAAb,MAAa,aAAa,aAAa;CACnC,OAAiB;CACjB;CACA,QAAqB;CAErB,YAAY,QAAiB,KAA2C;EACpE,OAAO;EACP,KAAK,MAAM,QAAQ,KAAW,IAAI;EAClC,KAAK,mBAAmB;;;;;;;;;CAU5B,OAAO,KAAM,QAAiB;EAC1B,OAAO,IAAI,KAAK,OAAO;;;;;;;;CAS3B,OAAO,WAAY,KAA0C;EACzD,KAAK,MAAM,QAAQ,KAAW,IAAI;EAElC,OAAO;;;;;;;;CASX,WAAY,KAA0C;EAClD,KAAK,QAAQ,QAAQ,KAAW,IAAI;EAEpC,OAAO;;;;;;;;CASX,aAAyC;EACrC,OAAO,KAAK;;;;;;;CAQhB,OAAqB;EACjB,OAAO,KAAKC;;;;;;;;;CAUhB,MAAM,OAAQ,OAAe,UAAoC;EAC7D,MAAM,OAAO,OAAO,MAAM,SAAsB,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO;EAEzF,OAAO,CAAC,CAAC,QAAQ,MAAM,KAAK,OAAO,UAAU,KAAK,SAAS;;;;;;;;;CAU/D,MAAM,QAAS,OAAe,UAAiC;EAC3D,MAAM,OAAO,OAAO,MAAM,SAAsB,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO;EAEzF,IAAI,CAAC,MACD,MAAM,IAAI,wBAAwB,0BAA0B;GAAE,KAAK,KAAK;GAAK,QAAQ;GAAK,QAAQ,EAAE,OAAO,CAAC,0CAA0C,EAAE;GAAE,CAAC;EAK/J,IAAI,CAAC,MAFiB,KAAK,OAAO,UAAU,KAAK,SAAS,EAGtD,MAAM,IAAI,wBAAwB,uBAAuB;GAAE,KAAK,KAAK;GAAK,QAAQ;GAAK,QAAQ,EAAE,UAAU,CAAC,mBAAmB,EAAE;GAAE,CAAC;EAGxI,KAAK,KAAK,QAAQ,KAAK;EAEvB,KAAKA,QAAQ;EAEb,OAAO;;;;;;;;;CAUX,MAAM,MAAO,OAAe,UAAgD;EACxE,MAAM,OAAO,MAAM,KAAK,QAAQ,OAAO,SAAS;EAEhD,OAAO,MAAM,KAAK,OAAO,KAAK;;;;;;;;;;;CAYlC,MAAM,qBAAsB,MAAY,SAAiB,YAAoB,OAAwB;EACjG,OAAO,MAAM,KAAK,UAAU;GACxB,KAAK,KAAK,GAAG,UAAU;GACvB,OAAO,KAAK;GACZ;GACH,EAAE,UAAU;;;;;;;;;;CAWjB,MAAM,wBAAyB,OAAe,SAAgC;EAC1E,MAAM,UAAU,MAAM,KAAK,UAAU,MAAM;EAE3C,IAAI,CAAC,WAAW,QAAQ,YAAY,WAAW,CAAC,QAAQ,KACpD,MAAM,IAAI,wBACN,yCACA;GAAE,KAAK,KAAK;GAAK,QAAQ;GAAK,CACjC;EAGL,MAAM,OAAO,OAAO,MAAM,SAAsB,OAAO,EAAE,OAAO,CAAC,KAAK,QAAQ,IAAI;EAElF,IAAI,CAAC,MACD,MAAM,IAAI,wBACN,0BACA;GAAE,KAAK,KAAK;GAAK,QAAQ;GAAK,CACjC;EAGL,KAAK,KAAK,QAAQ,KAAK;EAEvB,KAAKA,QAAQ;EAEb,OAAO;;;;;;;;CASX,MAAM,OAAQ,OAAqD;EAC/D,IAAI,CAAC,KAAKA,SAAS,CAAC,OAChB;EAGJ,IAAI,OACA,IAAI,OAAO,UAAU,UAGjB,OAAM,MAFmB,SAAqC,sBAAsB,EAEnE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ;OAElD,MAAM,MAAM,QAAQ;OAKxB,OAAM,MAFmB,SAAqC,sBAAsB,EAEnE,OAAO,CAAC,MAAM,EAAE,QAAQ,KAAKA,MAAO,IAAI,CAAC,CAAC,QAAQ;EAGvE,KAAKA,QAAQ;;;;;;;CAQjB,MAAM,QAA2B;EAC7B,OAAO,CAAC,CAAC,KAAKA;;;;;;;CAQlB,iBAAkB;EACd,OAAO,IAAI,eAAe,KAAK;;;;;;;;CASnC,MAAM,OAAQ,MAA0C;EACpD,MAAM,UAAsB;GACxB,KAAK,KAAK,GAAG,UAAU;GACvB,OAAO,KAAK;GACf;EAED,KAAK,KAAK,QAAQ,KAAK;EAEvB,MAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ;EAC3C,MAAM,aAAa,cAAc,YAAY,KAAK,IAAI;EAEtD,MAAM,MAAM,MAAM,KAAK,kBAAkB,MAAM,OAAO,WAAW;EAEjE,IAAI,kBAAkB,QAAQ,KAAK;EAEnC,OAAO;;;;;;;;;;CAWX,MAAc,kBAAmB,MAAY,OAAe,YAA4C;EACpG,MAAM,aAAa,MAAM,SAAqC,sBAAsB;EACpF,MAAM,YAAY,cAAc,aAAa,WAAW;EACxD,MAAM,UAAU;GACZ,WAAW,EAAE;GACb;GACA,MAAM,cAAc,eAAe,WAAW;GAC9C,QAAQ,KAAK;GACb,4BAAY,IAAI,MAAM;GACzB;EASD,IAAI,CAAC,WACD,OAAO,MAAM,WAAW,OAAO,CAAC,OAAO,QAAQ;EAGnD,QAAQ,aAAa;EAGrB,MAAM,oBADoB,MAAM,WAAW,OAAO,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,KAC5C,CACpC,QAAQ,YAAY,cAAc,QAAQ,QAAQ,YAAY,WAAW,CAAC,CAC1E,MAAM,MAAM,UAAU;GACnB,MAAM,YAAY,KAAK,cAAc,KAAK,WAAW,SAAS;GAG9D,QAFmB,MAAM,cAAc,MAAM,WAAW,SAExC,GAAG;IACrB;EAEN,IAAI,iBAAiB,SAAS,GAC1B,OAAO,MAAM,WAAW,OAAO,CAAC,OAAO,QAAQ;EAGnD,MAAM,CAAC,gBAAgB,GAAG,qBAAqB;EAE/C,IAAI,kBAAkB,SAAS,GAC3B,MAAM,QAAQ,IAAI,kBAAkB,IAAI,OAAO,YAAY,MAAM,QAAQ,QAAQ,CAAC,CAAC;EAGvF,MAAM,WAAW,OAAO,CAAC,MAAM,EAAE,IAAI,eAAe,IAAI,CAAC,CAAC,OAAO,QAAQ;EAEzE,eAAe,QAAQ,QAAQ;EAC/B,eAAe,OAAO,QAAQ;EAC9B,eAAe,SAAS,QAAQ;EAChC,eAAe,aAAa,QAAQ;EACpC,eAAe,aAAa,QAAQ;EAEpC,OAAO;;;;;;;;CASX,MAAM,eAAgB,OAA8B;EAChD,MAAM,UAAU,MAAM,KAAK,UAAU,MAAM;EAE3C,IAAI,CAAC,SACD,MAAM,IAAI,wBACN,8BACA;GAAE,KAAK,KAAK;GAAK,QAAQ;GAAK,CACjC;EAIL,MAAM,MAAM,OAAM,MADO,SAAqC,sBAAsB,EACvD,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO;EAE7D,IAAI,CAAC,KACD,MAAM,IAAI,wBACN,mCACA;GAAE,KAAK,KAAK;GAAK,QAAQ;GAAK,CACjC;EAGL,MAAM,OAAO,OAAO,MAAM,SAAsB,OAAO,EAAE,OAAO,CAAC,KAAK,QAAQ,IAAK;EAEnF,IAAI,CAAC,MACD,MAAM,IAAI,wBACN,0BACA;GAAE,KAAK,KAAK;GAAK,QAAQ;GAAK,CACjC;EAGL,KAAK,KAAK,QAAQ,KAAK;EAEvB,KAAU,aAAa,IAAI,CAAC,OAAO,UAAU;GACzC,IAAI,IAAI,WAAW,KAAK,eACpB,QAAQ,MAAM,qCAAqC,MAAM;IAE/D;EAEF,KAAKA,QAAQ;EAEb,OAAO;;;;;;;;CASX,MAAc,UAAW,SAAqB,YAAoB,IAAI,kBAAkB,KAAK,EAAmB;EAO5G,OAAO,MANW,IAAI,QAAQ,QAAQ,CACjC,mBAAmB,EAAE,KAAK,SAAS,CAAC,CACpC,aAAa,CACb,kBAAkB,UAAU,CAC5B,KAAK,IAAI,aAAa,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC;;;;;;;;CAWzD,MAAc,UAAW,OAA2C;EAChE,IAAI;GACA,MAAM,EAAE,YAAY,MAAM,UAAU,OAAO,IAAI,aAAa,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC;GAEtF,OAAO;UACH;GACJ,OAAO;;;CAIf,YAA6B;EACzB,OAAO,KAAK,oBAAoB,IAAI,cAAc,iBAAiB;;;;;;;;;CAUvE,MAAc,aAAc,KAA0B;EAClD,MAAM,sBAAM,IAAI,MAAM;EACtB,MAAM,oBAAoB,cAAc,YAAY,KAAK,IAAI;EAC7D,MAAM,yBAAyB,CAAC,IAAI,cAAe,IAAI,SAAS,GAAG,IAAI,WAAW,SAAS,GAAI,MAAS;EACxG,MAAM,gBAAgB,CAAC,CAAC,IAAI;EAC5B,MAAM,qBAAqB,cAAc,eAAe,kBAAkB;EAC1E,MAAM,oBAAoB,cAAc,eAAe,IAAI,WAAW;EACtE,MAAM,0BAA0B,CAAC,iBAAiB,sBAAsB;EAExE,IAAI,CAAC,0BAA0B,CAAC,yBAC5B;EAGJ,MAAM,UAIF,EACA,YAAY,KACf;EAED,IAAI,yBAAyB;GACzB,QAAQ,aAAa;GACrB,QAAQ,OAAO;;EAKnB,OAAM,MAFmB,SAAqC,sBAAsB,EAEnE,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,QAAQ;EAE9D,IAAI,aAAa;EAEjB,IAAI,QAAQ,eAAe,KAAA,GACvB,IAAI,aAAa,QAAQ;EAG7B,IAAI,QAAQ,SAAS,KAAA,GACjB,IAAI,OAAO,QAAQ;;;;;ACpb/B,MAAM,iBAAiB;AACvB,MAAM,gBAAgB,IAAI,YAAY,WAAW;AACjD,MAAM,0BAA0B,OAAO,IAAI,8BAA8B,GAAG,CAAC,IAAI;AAEjF,IAAa,YAAb,MAAuB;CACnB,aAAqB,WAAY;EAC7B,OAAO,MAAM,SAA+B,gBAAgB;;CAGhE,aAAqB,UAAW,QAAoB;EAGhD,OAAO,OAAM,MAFO,KAAK,UAAU,EAEhB,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,OAAO;;CAGxD,aAAqB,OACjB,QACA,YAIF;EAGE,OAAM,MAFc,KAAK,UAAU,EAEvB,OAAO,CAAC,eAAe,EAAE,QAAQ,EAAE,WAAW;;CAG9D,OAAO,gBAAiB,QAAgD;EACpE,IAAI,WAAW,mBAAmB,WAAW,OACzC,OAAO;EAGX,OAAO;;CAGX,OAAO,UAAW,OAAuB;EACrC,IAAI,CAAC,OACD,OAAO;EAGX,MAAM,aAAa,MAAM,QAAQ,QAAQ,GAAG;EAE5C,IAAI,WAAW,UAAU,GACrB,OAAO;EAGX,OAAO,GAAG,IAAI,OAAO,KAAK,IAAI,WAAW,SAAS,GAAG,EAAE,CAAC,GAAG,WAAW,MAAM,GAAG;;CAGnF,OAAO,SAAU,MAAY;EACzB,OAAO,KAAK,SAAS,GAAG,SAAS,CAAC,GAAG,KAAK;;CAG9C,OAAO,QAAS,MAAY,QAAgB;EACxC,OAAO,KAAK,KAAK,QAAQ,KAAK,SAAS,KAAK,EAAE,SAAS,CAAC;;CAG5D,OAAO,eAAgB,OAAO,IAAI;EAC9B,MAAM,QAAQ,YAAY,KAAK;EAC/B,IAAI,SAAS;EAEb,KAAK,MAAM,QAAQ,OACf,UAAU,eAAe,OAAO;EAGpC,OAAO;;CAGX,OAAO,YAAa,MAAY,QAAiC;EAC7D,MAAM,iBAAiB,UAAU,KAAK,gBAAgB;EAGtD,OAAO;GACH,QAAQ;GACR,YAJS,KAAK,QAAQ,MAAM,eAIZ,CAAC,UAAU;GAC9B;;CAGL,OAAO,WAAY,MAAY,QAAgB,MAAc;EACzD,OAAO,KAAK,QAAQ,MAAM,OAAO,CAAC,SAAS;GAAE,OAAO;GAAM,QAAQ;GAAG,CAAC,KAAK;;CAG/E,aAAa,UAAW,QAAoB;EACxC,MAAM,SAAS,MAAM,KAAK,UAAU,OAAO;EAE3C,OAAO,KAAK,gBAAgB,QAAQ,OAAO;;CAG/C,aAAa,UAAW,QAAoB,QAAyB;EACjE,MAAM,KAAK,OAAO,QAAQ,EAAE,QAAQ,CAAC;;CAGzC,aAAa,UAAW,QAAoB;EACxC,MAAM,SAAS,MAAM,KAAK,UAAU,OAAO;EAE3C,OAAO,QAAQ,mBAAmB,WAAW,QAAQ,OAAO,iBAAiB,GAAG;;CAGpF,aAAa,UAAW,QAAoB,QAAgB;EACxD,MAAM,KAAK,OAAO,QAAQ,EAAE,kBAAkB,WAAW,QAAQ,OAAO,EAAE,CAAC;;CAG/E,aAAa,YAAa,QAAoB;EAC1C,MAAM,KAAK,OAAO,QAAQ,EAAE,kBAAkB,MAAM,CAAC;;CAGzD,aAAa,aAAc,QAAoB;EAG3C,QAAO,MAFc,KAAK,UAAU,OAAO,GAE5B,WAAW,aAAa,IAAI;;CAG/C,aAAa,aAAc,QAAoB,4BAA2B,IAAI,MAAM,EAAE;EAClF,MAAM,KAAK,OAAO,QAAQ,EACtB,WAAW,OAAO,cAAc,WAAW,IAAI,KAAK,UAAU,GAAG,WACpE,CAAC;;CAGN,aAAa,MAAO,QAAoB;EAGpC,OAAM,MAFc,KAAK,UAAU,EAEvB,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ;;CAGlD,OAAO,oBAAqB,QAAQ,GAAG;EACnC,OAAO,MAAM,KAAK,EAAE,QAAQ,OAAO,QAAQ;GAIvC,OAAO,GAHM,YAAY,EAAE,CAAC,SAAS,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,aAG1C,CAAC,GAFD,YAAY,EAAE,CAAC,SAAS,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,aAElC;IACzB;;CAGN,aAAa,gBAAiB,OAAiB;EAC3C,OAAO,MAAM,QAAQ,IAAI,MAAM,IAAI,OAAM,SAAQ,MAAM,KAAK,KAAK,KAAK,CAAC,CAAC;;CAG5E,aAAa,uBAAwB,QAAoB;EAGrD,QAAO,MAFc,KAAK,UAAU,OAAO,GAE5B,sBAAsB,EAAE;;CAG3C,aAAa,wBAAyB,QAAoB,QAAkB;EACxE,MAAM,KAAK,OAAO,QAAQ,EAAE,oBAAoB,QAAQ,CAAC;;CAG7D,aAAa,oBAAqB,QAAoB,cAAsB;EACxE,MAAM,SAAS,MAAM,KAAK,uBAAuB,OAAO;EAExD,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO,SAAS,EACxC,IAAI,MAAM,KAAK,OAAO,cAAc,KAAK,EAAE;GACvC,MAAM,KAAK,wBACP,QACA,OAAO,QAAQ,GAAG,iBAAiB,iBAAiB,MAAM,CAC7D;GAED,OAAO;;EAIf,OAAO;;CAGX,aAAa,WAAY,QAA8C;EACnE,MAAM,SAAS,MAAM,KAAK,UAAU,OAAO;EAC3C,MAAM,YAAY,QAAQ,WAAW,aAAa,IAAI;EACtD,MAAM,gBAAgB,QAAQ,sBAAsB,EAAE;EAEtD,OAAO;GACH,SAAS,CAAC,CAAC;GACX;GACA,QAAQ,KAAK,gBAAgB,QAAQ,OAAO;GAC5C,wBAAwB,cAAc;GACzC;;CAGL,OAAO,gBAAiB;EACpB,OAAO,KAAK,MAAM,MAAS,KAAK,QAAQ,GAAG,IAAO,CAAC,UAAU;;CAGjE,aAAa,aAAc,MAAY,SAAiD;EACpF,IAAI,CAAE,KAAuB,OACzB,MAAM,IAAI,MAAM,6DAA6D;EAGjF,MAAM,OAAO,KAAK,eAAe;EACjC,MAAM,cAAc,MAAM,KAAK,KAAK,KAAK;EACzC,MAAM,YAAY,IAAI,KAAK,KAAK,KAAK,GAAG,mBAAmB,GAAG,KAAK,IAAK;EAExE,MAAM,KAAK,OAAO,KAAK,IAAI;GACvB;GACA,kBAAkB;GAClB,gBAAgB;GACnB,CAAC;EAEF,OAAO;GACH;GACA;GACA;GACH;;CAGL,aAAa,aAAc,QAAoB;EAC3C,MAAM,KAAK,OAAO,QAAQ;GACtB,aAAa;GACb,kBAAkB;GAClB,gBAAgB;GACnB,CAAC;;CAGN,aAAa,cAAe,QAAoB,MAAc,SAAyB;EACnF,MAAM,SAAS,MAAM,KAAK,UAAU,OAAO;EAE3C,IAAI,CAAC,QAAQ,eAAe,CAAC,OAAO,oBAAoB,OAAO,mBAAmB,SAC9E,OAAO;EAGX,IAAI,OAAO,iBAAiB,SAAS,GAAG,KAAK,KAAK,EAAE;GAChD,MAAM,KAAK,aAAa,OAAO;GAE/B,OAAO;;EAGX,MAAM,UAAU,MAAM,KAAK,OAAO,MAAM,OAAO,YAAY;EAE3D,IAAI,SACA,MAAM,KAAK,aAAa,OAAO;EAGnC,OAAO;;;;;AC/Of,IAAsB,sBAAtB,cAAkD,MAAM;;;ACAxD,IAAsB,OAAtB,cAAmC,MAAM;CAQrC,OAAiB,QAA6B;;;;ACLlD,IAAsB,gBAAtB,cAA4C,MAAM;CAa9C,OAA0B,QAA6B;CAEvD,QAAkB,EACd,oBAAoB,QACvB"}