@asturiu/v0-sdk 0.0.0-stage → 1.0.0

package/dist/recovery.d.ts

@@ -0,0 +1,198 @@
+/**
+ * Recovery contacts and recovery cards (ADR-050): the lists, codes and card
+ * format every surface shares, and what the Interface API answers. Pure and
+ * dependency-free: the Engine validates with these lists and checks a card's
+ * checksum itself; the Customer Portal and a Tenant's app read with them.
+ */
+import { normalizePassCode } from "./passes.js";
+import { RECOVERY_WORDS } from "./recovery-words.js";
+export { RECOVERY_WORDS };
+/** A vault recovery ends in a Grant on that vault; a sign-in recovery in an Account reset (§1). */
+export declare const RECOVERY_SUBJECTS: readonly ["vault", "sign_in"];
+export type RecoverySubject = (typeof RECOVERY_SUBJECTS)[number];
+export declare const RECOVERY_LIMITS: {
+    readonly contactsMin: 2;
+    readonly contactsMax: 7;
+    readonly quorumMin: 2;
+    readonly note: 500;
+    readonly name: 120;
+    readonly notAfterDaysMax: 3650;
+    /** A claim never completes sooner than this after its last card (ADR-050 build note 27), whatever its waiting period. */
+    readonly lastCardHours: 24;
+};
+/** The waiting period in days (§3), counted from the first card (§6), never ending sooner than `lastCardHours` after the last; the owner can cancel during it. */
+export declare const RECOVERY_WAITING_DAYS: readonly [1, 3, 7, 14, 30];
+export type RecoveryWaitingDays = (typeof RECOVERY_WAITING_DAYS)[number];
+export declare const RECOVERY_DEFAULT_WAITING_DAYS: RecoveryWaitingDays;
+/** What a completed vault claim grants unless the owner changes it, and what the owner may add (§3; `transfer` is added, build note 23). */
+export declare const RECOVERY_DEFAULT_CAPABILITIES: readonly ["read", "reveal", "share"];
+export declare const RECOVERY_OPTIONAL_CAPABILITIES: readonly ["transfer", "update", "delete"];
+export declare const RECOVERY_CAPABILITIES: readonly ["read", "reveal", "share", "transfer", "update", "delete"];
+export type RecoveryCapability = (typeof RECOVERY_CAPABILITIES)[number];
+/** What the owner sees per contact (§3). */
+export declare const RECOVERY_CONTACT_STATES: readonly ["invited", "ready", "declined", "expired", "unreachable"];
+export type RecoveryContactState = (typeof RECOVERY_CONTACT_STATES)[number];
+/** A claim's life (§6). `collecting` and `approved` are open; the rest are ends. */
+export declare const RECOVERY_CLAIM_STATES: readonly ["collecting", "approved", "completed", "failed", "cancelled", "expired"];
+export type RecoveryClaimState = (typeof RECOVERY_CLAIM_STATES)[number];
+export declare const RECOVERY_OPEN_CLAIM_STATES: readonly RecoveryClaimState[];
+/**
+ * Why a recovery call answered `409`: `reason` beside the English `detail`, so a frontend words it itself.
+ * `contact_address`: a sign-in claim's new address is one of that recovery's contacts (ADR-050 build notes).
+ */
+export declare const RECOVERY_CONFLICTS: readonly ["not_set_up", "card_saved", "card_declined", "card_state", "claim_closed", "claim_expired", "card_given", "own_recovery", "not_a_claimant", "contact_address", "too_many_failures"];
+export type RecoveryConflict = (typeof RECOVERY_CONFLICTS)[number];
+/**
+ * Why a well-typed card was refused (`card` on `401 recovery-attempt-failed` with `reason: card`; build note 25):
+ * its words don't fit together, no card has its card code (mistyped, or the cards were replaced), it serves the other
+ * kind of recovery or another Tenant's, the claim is bound to someone else's recovery, or its number was removed or
+ * replaced. Each still counts as a wrong try.
+ */
+export declare const RECOVERY_CARD_REFUSALS: readonly ["unreadable", "unknown", "other_kind", "other_product", "other_person", "retired"];
+export type RecoveryCardRefusal = (typeof RECOVERY_CARD_REFUSALS)[number];
+/** The label printed on every card of one recovery: 8 characters from the pass alphabet, never the ARID (§4). */
+export declare const RECOVERY_HANDLE_LENGTH = 8;
+/** The code the claimant gives each contact by phone or in person (§6): 6 characters without look-alikes. */
+export declare const RECOVERY_CLAIM_CODE_LENGTH = 6;
+/** What a person typed, as the Engine compares it: capitals, with spaces, dashes and dots dropped. */
+export declare const normalizeRecoveryCode: typeof normalizePassCode;
+export declare function isRecoveryHandle(value: string): boolean;
+export declare function isRecoveryClaimCode(value: string): boolean;
+/** `ABCDEFGH` → `ABCD-EFGH`; `ABCDEF` → `ABC-DEF`. */
+export declare function formatRecoveryCode(code: string): string;
+/** 12 words: the 128-bit card and a 4-bit checksum, 11 bits a word, as BIP-39 encodes 128 bits (§4). */
+export declare const RECOVERY_CARD_WORDS = 12;
+/** A word's 11-bit value, or -1. Every word of the list is fixed by its first four letters, so a word cut there still counts. */
+export declare function recoveryWordIndex(input: string): number;
+/** The list's spelling of what was typed, or null. */
+export declare function recoveryWord(input: string): string | null;
+/** What a card carries and what the helper page sends back (§4). */
+export interface RecoveryCardFace {
+    label: string;
+    /** The card's Shamir x, 1 to 7. */
+    number: number;
+    words: string[];
+}
+/** The text in a card's QR code. */
+export declare const RECOVERY_CARD_PREFIX = "ASTURIU-CARD";
+export declare function recoveryCardText(card: RecoveryCardFace): string;
+/**
+ * A card from what was scanned or typed: the QR code's text, or label,
+ * number and words in that order, with or without the prefix. Words are
+ * written out from the list; whether they hold a valid card is the Engine's
+ * check (the checksum). Null when the shape is wrong.
+ */
+export declare function parseRecoveryCard(text: string): RecoveryCardFace | null;
+/** What a completed vault claim grants (§3). `claimants` null: any Customer of the Tenant may claim. */
+export interface RecoveryTerms {
+    capabilities: RecoveryCapability[];
+    /** The Grant ends this many days after completion; null for no end. */
+    not_after_days: number | null;
+    claimants: string[] | null;
+}
+export interface RecoveryContact {
+    /** The card's number, once cards are issued. */
+    number: number | null;
+    /** Vault recovery: the contact's Principal, and the owner's Contact for it (ADR-024). */
+    principal?: string;
+    contact?: string | null;
+    /** The name the owner gave (sign-in recovery) or the Principal's display name (vault recovery). */
+    name: string | null;
+    /** Sign-in recovery: the address the invitation goes to. */
+    email?: string;
+    state: RecoveryContactState;
+    invited_at: string | null;
+    collected_at: string | null;
+    /** Too many wrong codes on the invitation; Replace all cards sends a new one. */
+    locked: boolean;
+}
+/** A claim as the owner sees it on the recovery (§7). */
+export interface RecoveryClaimSummary {
+    id: string;
+    state: RecoveryClaimState;
+    received: number;
+    needed: number;
+    opened_at: string;
+    bound_at: string | null;
+    approved_at: string | null;
+    completes_at: string | null;
+}
+/** `GET /v0/recovery`, `/v0/me/recovery`, `/v0/customer/sign-in/recovery`. No answer carries a card. */
+export interface Recovery {
+    configured: boolean;
+    arid: string | null;
+    subject: RecoverySubject;
+    /** Vault recovery: the vault it covers. */
+    vault?: string;
+    contacts: RecoveryContact[];
+    quorum: number;
+    /** Contacts whose card is saved; below `quorum` the page warns. */
+    ready: number;
+    waiting_days: RecoveryWaitingDays;
+    /** Vault recovery only. */
+    terms?: RecoveryTerms;
+    cards_issued_at: string | null;
+    /** Open claims. */
+    claims: RecoveryClaimSummary[];
+}
+/** A claim as its claimant or the owner reads it (`GET /v0/recovery/claims/{id}`, `/v0/recovery/sign-in-claims/{id}`). */
+export interface RecoveryClaim {
+    id: string;
+    kind: RecoverySubject;
+    state: RecoveryClaimState;
+    role: "claimant" | "owner";
+    received: number;
+    /** Null until the first card binds the claim to a recovery. */
+    needed: number | null;
+    /** The display name of the person whose recovery the first card bound the claim to; null before that. */
+    owner_name: string | null;
+    note: string | null;
+    opened_at: string;
+    /** Collecting ends here, when the claim expires. */
+    expires_at: string;
+    bound_at: string | null;
+    approved_at: string | null;
+    completes_at: string | null;
+    closed_at: string | null;
+}
+/** What opening a claim answers, once: the code is never shown again (§6). */
+export interface OpenedRecoveryClaim {
+    claim: string;
+    code: string;
+    expires_at: string;
+}
+/** The contact page (`POST /v0/recovery/invites/open`): who asks, and where the card stands. */
+export interface RecoveryInvite {
+    subject: RecoverySubject;
+    owner_name: string | null;
+    /** The Tenant's product name, for a vault recovery and an `isolated` sign-in recovery. */
+    product: string | null;
+    contact_name: string | null;
+    state: RecoveryContactState;
+    number: number;
+}
+/** A card in transit to its contact (`POST /v0/recovery/invites/accept`). Shown until the contact types two words back. */
+export interface RecoveryCard extends RecoveryCardFace {
+    /** Which kind of recovery the card serves, printed on it: access to a vault, or a sign-in. */
+    subject: RecoverySubject;
+    owner_name: string | null;
+    product: string | null;
+    /** The helper page on the host the recovery belongs to. */
+    help_url: string;
+    /** The two word positions (1-based) the contact types back to confirm it was saved. */
+    confirm: [number, number];
+}
+/** The helper page after the claim code (`POST /v0/recovery/help/claim`). */
+export interface RecoveryHelpClaim {
+    claim: string;
+    kind: RecoverySubject;
+    /** Whose recovery the claim is bound to, so a contact who keeps several cards picks the right one; null before the first card. */
+    owner_name: string | null;
+    /** The product a vault claim's recovery lives in, or the platform's name for a sign-in claim on the shared realm, known before any card. */
+    product: string | null;
+    note: string | null;
+    received: number;
+    needed: number | null;
+    state: RecoveryClaimState;
+}
+//# sourceMappingURL=recovery.d.ts.map

package/dist/recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../src/recovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAsB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B,mGAAmG;AACnG,eAAO,MAAM,iBAAiB,+BAAgC,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,eAAO,MAAM,eAAe;;;;;;;IAO1B,yHAAyH;;CAEjH,CAAC;AAEX,kKAAkK;AAClK,eAAO,MAAM,qBAAqB,4BAA6B,CAAC;AAChE,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AACzE,eAAO,MAAM,6BAA6B,EAAE,mBAAuB,CAAC;AAEpE,4IAA4I;AAC5I,eAAO,MAAM,6BAA6B,sCAAuC,CAAC;AAClF,eAAO,MAAM,8BAA8B,2CAA4C,CAAC;AACxF,eAAO,MAAM,qBAAqB,sEAAiF,CAAC;AACpH,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,4CAA4C;AAC5C,eAAO,MAAM,uBAAuB,qEAAsE,CAAC;AAC3G,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,oFAAqF,CAAC;AACxH,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,eAAO,MAAM,0BAA0B,EAAE,SAAS,kBAAkB,EAA+B,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,kBAAkB,+LAAgM,CAAC;AAChO,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,8FAA+F,CAAC;AACnI,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAI1E,iHAAiH;AACjH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AACxC,6GAA6G;AAC7G,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAI5C,sGAAsG;AACtG,eAAO,MAAM,qBAAqB,0BAAoB,CAAC;AAEvD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIvD;AAID,wGAAwG;AACxG,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAItC,iIAAiI;AACjI,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGzD;AAID,oEAAoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,oCAAoC;AACpC,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAEnD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAUvE;AAID,wGAAwG;AACxG,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,uEAAuE;IACvE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mGAAmG;IACnG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,oBAAoB,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iFAAiF;IACjF,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,wGAAwG;AACxG,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,eAAe,CAAC;IACzB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,mBAAmB,CAAC;IAClC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,mBAAmB;IACnB,MAAM,EAAE,oBAAoB,EAAE,CAAC;CAChC;AAED,0HAA0H;AAC1H,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,yGAAyG;IACzG,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0FAA0F;IAC1F,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2HAA2H;AAC3H,MAAM,WAAW,YAAa,SAAQ,gBAAgB;IACpD,8FAA8F;IAC9F,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3B;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,eAAe,CAAC;IACtB,kIAAkI;IAClI,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,4IAA4I;IAC5I,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,kBAAkB,CAAC;CAC3B"}

package/dist/recovery.js

@@ -0,0 +1,112 @@
+/**
+ * Recovery contacts and recovery cards (ADR-050): the lists, codes and card
+ * format every surface shares, and what the Interface API answers. Pure and
+ * dependency-free: the Engine validates with these lists and checks a card's
+ * checksum itself; the Customer Portal and a Tenant's app read with them.
+ */
+import { PASS_CODE_ALPHABET, normalizePassCode } from "./passes.js";
+import { RECOVERY_WORDS } from "./recovery-words.js";
+export { RECOVERY_WORDS };
+/** A vault recovery ends in a Grant on that vault; a sign-in recovery in an Account reset (§1). */
+export const RECOVERY_SUBJECTS = ["vault", "sign_in"];
+export const RECOVERY_LIMITS = {
+    contactsMin: 2,
+    contactsMax: 7,
+    quorumMin: 2,
+    note: 500,
+    name: 120,
+    notAfterDaysMax: 3650,
+    /** A claim never completes sooner than this after its last card (ADR-050 build note 27), whatever its waiting period. */
+    lastCardHours: 24,
+};
+/** The waiting period in days (§3), counted from the first card (§6), never ending sooner than `lastCardHours` after the last; the owner can cancel during it. */
+export const RECOVERY_WAITING_DAYS = [1, 3, 7, 14, 30];
+export const RECOVERY_DEFAULT_WAITING_DAYS = 3;
+/** What a completed vault claim grants unless the owner changes it, and what the owner may add (§3; `transfer` is added, build note 23). */
+export const RECOVERY_DEFAULT_CAPABILITIES = ["read", "reveal", "share"];
+export const RECOVERY_OPTIONAL_CAPABILITIES = ["transfer", "update", "delete"];
+export const RECOVERY_CAPABILITIES = [...RECOVERY_DEFAULT_CAPABILITIES, ...RECOVERY_OPTIONAL_CAPABILITIES];
+/** What the owner sees per contact (§3). */
+export const RECOVERY_CONTACT_STATES = ["invited", "ready", "declined", "expired", "unreachable"];
+/** A claim's life (§6). `collecting` and `approved` are open; the rest are ends. */
+export const RECOVERY_CLAIM_STATES = ["collecting", "approved", "completed", "failed", "cancelled", "expired"];
+export const RECOVERY_OPEN_CLAIM_STATES = ["collecting", "approved"];
+/**
+ * Why a recovery call answered `409`: `reason` beside the English `detail`, so a frontend words it itself.
+ * `contact_address`: a sign-in claim's new address is one of that recovery's contacts (ADR-050 build notes).
+ */
+export const RECOVERY_CONFLICTS = ["not_set_up", "card_saved", "card_declined", "card_state", "claim_closed", "claim_expired", "card_given", "own_recovery", "not_a_claimant", "contact_address", "too_many_failures"];
+/**
+ * Why a well-typed card was refused (`card` on `401 recovery-attempt-failed` with `reason: card`; build note 25):
+ * its words don't fit together, no card has its card code (mistyped, or the cards were replaced), it serves the other
+ * kind of recovery or another Tenant's, the claim is bound to someone else's recovery, or its number was removed or
+ * replaced. Each still counts as a wrong try.
+ */
+export const RECOVERY_CARD_REFUSALS = ["unreadable", "unknown", "other_kind", "other_product", "other_person", "retired"];
+// ------------------------------------------------------------- codes
+/** The label printed on every card of one recovery: 8 characters from the pass alphabet, never the ARID (§4). */
+export const RECOVERY_HANDLE_LENGTH = 8;
+/** The code the claimant gives each contact by phone or in person (§6): 6 characters without look-alikes. */
+export const RECOVERY_CLAIM_CODE_LENGTH = 6;
+const ofAlphabet = (v, length) => v.length === length && [...v].every((c) => PASS_CODE_ALPHABET.includes(c));
+/** What a person typed, as the Engine compares it: capitals, with spaces, dashes and dots dropped. */
+export const normalizeRecoveryCode = normalizePassCode;
+export function isRecoveryHandle(value) {
+    return ofAlphabet(value, RECOVERY_HANDLE_LENGTH);
+}
+export function isRecoveryClaimCode(value) {
+    return ofAlphabet(value, RECOVERY_CLAIM_CODE_LENGTH);
+}
+/** `ABCDEFGH` → `ABCD-EFGH`; `ABCDEF` → `ABC-DEF`. */
+export function formatRecoveryCode(code) {
+    const c = normalizeRecoveryCode(code);
+    const half = c.length / 2;
+    return c.length === RECOVERY_HANDLE_LENGTH || c.length === RECOVERY_CLAIM_CODE_LENGTH ? `${c.slice(0, half)}-${c.slice(half)}` : c;
+}
+// ------------------------------------------------------------- words
+/** 12 words: the 128-bit card and a 4-bit checksum, 11 bits a word, as BIP-39 encodes 128 bits (§4). */
+export const RECOVERY_CARD_WORDS = 12;
+const WORD_INDEX = new Map(RECOVERY_WORDS.map((w, i) => [w, i]));
+/** A word's 11-bit value, or -1. Every word of the list is fixed by its first four letters, so a word cut there still counts. */
+export function recoveryWordIndex(input) {
+    const w = input.trim().toLowerCase();
+    const exact = WORD_INDEX.get(w);
+    if (exact !== undefined)
+        return exact;
+    if (w.length < 4)
+        return -1;
+    const matches = RECOVERY_WORDS.filter((x) => x.startsWith(w.slice(0, 4)) && (w.length === 4 || x.startsWith(w)));
+    return matches.length === 1 ? (WORD_INDEX.get(matches[0]) ?? -1) : -1;
+}
+/** The list's spelling of what was typed, or null. */
+export function recoveryWord(input) {
+    const i = recoveryWordIndex(input);
+    return i < 0 ? null : RECOVERY_WORDS[i];
+}
+/** The text in a card's QR code. */
+export const RECOVERY_CARD_PREFIX = "ASTURIU-CARD";
+export function recoveryCardText(card) {
+    return [RECOVERY_CARD_PREFIX, formatRecoveryCode(card.label), String(card.number), ...card.words].join(" ");
+}
+/**
+ * A card from what was scanned or typed: the QR code's text, or label,
+ * number and words in that order, with or without the prefix. Words are
+ * written out from the list; whether they hold a valid card is the Engine's
+ * check (the checksum). Null when the shape is wrong.
+ */
+export function parseRecoveryCard(text) {
+    const parts = text.trim().split(/[\s,;]+/).filter(Boolean);
+    if (parts[0]?.toUpperCase() === RECOVERY_CARD_PREFIX)
+        parts.shift();
+    if (parts.length !== RECOVERY_CARD_WORDS + 2)
+        return null;
+    const label = normalizeRecoveryCode(parts[0]);
+    const number = Number.parseInt(parts[1], 10);
+    if (!isRecoveryHandle(label) || !Number.isInteger(number) || number < 1 || number > RECOVERY_LIMITS.contactsMax || String(number) !== parts[1])
+        return null;
+    const words = parts.slice(2).map(recoveryWord);
+    if (words.some((w) => w === null))
+        return null;
+    return { label, number, words: words };
+}
+//# sourceMappingURL=recovery.js.map

package/dist/recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.js","sourceRoot":"","sources":["../src/recovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B,mGAAmG;AACnG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,SAAS,CAAU,CAAC;AAG/D,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,WAAW,EAAE,CAAC;IACd,WAAW,EAAE,CAAC;IACd,SAAS,EAAE,CAAC;IACZ,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,eAAe,EAAE,IAAI;IACrB,yHAAyH;IACzH,aAAa,EAAE,EAAE;CACT,CAAC;AAEX,kKAAkK;AAClK,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAU,CAAC;AAEhE,MAAM,CAAC,MAAM,6BAA6B,GAAwB,CAAC,CAAC;AAEpE,4IAA4I;AAC5I,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AAClF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AACxF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,6BAA6B,EAAE,GAAG,8BAA8B,CAAU,CAAC;AAGpH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAU,CAAC;AAG3G,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAU,CAAC;AAExH,MAAM,CAAC,MAAM,0BAA0B,GAAkC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AAEpG;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,CAAU,CAAC;AAGhO;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,CAAU,CAAC;AAGnI,sEAAsE;AAEtE,iHAAiH;AACjH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACxC,6GAA6G;AAC7G,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7H,sGAAsG;AACtG,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,UAAU,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,UAAU,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;AACvD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC,MAAM,KAAK,sBAAsB,IAAI,CAAC,CAAC,MAAM,KAAK,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACrI,CAAC;AAED,sEAAsE;AAEtE,wGAAwG;AACxG,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,MAAM,UAAU,GAAgC,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F,iIAAiI;AACjI,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjH,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAYD,oCAAoC;AACpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAEnD,MAAM,UAAU,gBAAgB,CAAC,IAAsB;IACrD,OAAO,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,oBAAoB;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,eAAe,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5J,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAiB,EAAE,CAAC;AACrD,CAAC"}

package/dist/reveal.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Reveal levels of a secret Field (ADR-018). Shared by the Engine (Definition
+ * schema, the reveal gate) and every frontend (what to ask of the person):
+ * pure and dependency-free so the Frontend kit can carry it.
+ */
+export declare const REVEAL_LEVELS: readonly ["visible", "click", "captcha", "password", "2fa"];
+export type RevealLevel = (typeof REVEAL_LEVELS)[number];
+/** What the reveal gate needs before it returns the value; `null` = nothing beyond the capability. */
+export type RevealStep = "captcha" | "password" | "mfa";
+export declare function revealStep(level: RevealLevel | null | undefined): RevealStep | null;
+/** The level in effect for a Field Definition: `null` for a plain Field, `click` for a secret one that names none. */
+export declare function revealLevelOf(def: {
+    secret?: boolean;
+    reveal?: RevealLevel | string | null;
+} | null | undefined): RevealLevel | null;
+/** When a session last proved each factor (ISO timestamps). A second factor implies the password. */
+export interface StepUpState {
+    password?: string;
+    mfa?: string;
+}
+/**
+ * What a fresh OIDC token proves (components/11-authentik.md §Step-up flows).
+ * Authentik reports `pwd` for a password stage and `mfa` once an authenticator
+ * was validated in the same login; `auth_time` is that login's moment. A
+ * token whose login is older than `maxAgeSeconds` proves nothing now.
+ */
+export declare function stepUpFromClaims(claims: {
+    amr?: string[];
+    auth_time?: number;
+}, now: Date, maxAgeSeconds: number): StepUpState;
+/** Whether a recorded step-up still satisfies `step` at `now`. */
+export declare function stepUpSatisfies(step: RevealStep | null, state: StepUpState | undefined, now: Date, ttlSeconds: number): boolean;
+/** When a recorded step-up lapses, or `undefined` when there is none. */
+export declare function stepUpUntil(at: string | undefined, ttlSeconds: number): string | undefined;
+//# sourceMappingURL=reveal.d.ts.map

package/dist/reveal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reveal.d.ts","sourceRoot":"","sources":["../src/reveal.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,aAAa,6DAA8D,CAAC;AACzF,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,sGAAsG;AACtG,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAExD,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAWnF;AAED,sHAAsH;AACtH,wBAAgB,aAAa,CAAC,GAAG,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,GAAG,IAAI,CAGpI;AAED,qGAAqG;AACrG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,WAAW,CAY9H;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAO/H;AAED,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI1F"}

package/dist/reveal.js

@@ -0,0 +1,66 @@
+/**
+ * Reveal levels of a secret Field (ADR-018). Shared by the Engine (Definition
+ * schema, the reveal gate) and every frontend (what to ask of the person):
+ * pure and dependency-free so the Frontend kit can carry it.
+ */
+export const REVEAL_LEVELS = ["visible", "click", "captcha", "password", "2fa"];
+export function revealStep(level) {
+    switch (level) {
+        case "captcha":
+            return "captcha";
+        case "password":
+            return "password";
+        case "2fa":
+            return "mfa";
+        default:
+            return null;
+    }
+}
+/** The level in effect for a Field Definition: `null` for a plain Field, `click` for a secret one that names none. */
+export function revealLevelOf(def) {
+    if (!def?.secret)
+        return null;
+    return REVEAL_LEVELS.includes(def.reveal ?? "") ? def.reveal : "click";
+}
+/**
+ * What a fresh OIDC token proves (components/11-authentik.md §Step-up flows).
+ * Authentik reports `pwd` for a password stage and `mfa` once an authenticator
+ * was validated in the same login; `auth_time` is that login's moment. A
+ * token whose login is older than `maxAgeSeconds` proves nothing now.
+ */
+export function stepUpFromClaims(claims, now, maxAgeSeconds) {
+    if (typeof claims.auth_time !== "number" || !Number.isFinite(claims.auth_time))
+        return {};
+    const at = new Date(claims.auth_time * 1000);
+    if (now.getTime() - at.getTime() > maxAgeSeconds * 1000 || at.getTime() - now.getTime() > 60_000)
+        return {};
+    const amr = claims.amr ?? [];
+    const out = {};
+    if (amr.includes("mfa")) {
+        out.mfa = at.toISOString();
+        out.password = at.toISOString();
+    }
+    if (amr.includes("pwd"))
+        out.password = at.toISOString();
+    return out;
+}
+/** Whether a recorded step-up still satisfies `step` at `now`. */
+export function stepUpSatisfies(step, state, now, ttlSeconds) {
+    if (step === null)
+        return true;
+    if (step === "captcha")
+        return false;
+    const at = state?.[step];
+    if (!at)
+        return false;
+    const t = Date.parse(at);
+    return Number.isFinite(t) && now.getTime() - t <= ttlSeconds * 1000;
+}
+/** When a recorded step-up lapses, or `undefined` when there is none. */
+export function stepUpUntil(at, ttlSeconds) {
+    if (!at)
+        return undefined;
+    const t = Date.parse(at);
+    return Number.isFinite(t) ? new Date(t + ttlSeconds * 1000).toISOString() : undefined;
+}
+//# sourceMappingURL=reveal.js.map

package/dist/reveal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reveal.js","sourceRoot":"","sources":["../src/reveal.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAU,CAAC;AAMzF,MAAM,UAAU,UAAU,CAAC,KAAqC;IAC9D,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,aAAa,CAAC,GAAkF;IAC9G,IAAI,CAAC,GAAG,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAQ,aAAmC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAsB,CAAC,CAAC,CAAC,OAAO,CAAC;AACjH,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA8C,EAAE,GAAS,EAAE,aAAqB;IAC/G,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1F,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM;QAAE,OAAO,EAAE,CAAC;IAC5G,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3B,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,KAA8B,EAAE,GAAS,EAAE,UAAkB;IACpH,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,UAAU,GAAG,IAAI,CAAC;AACtE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,WAAW,CAAC,EAAsB,EAAE,UAAkB;IACpE,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxF,CAAC"}

package/dist/seal.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Application-layer sealing for the Frontend layer's ephemeral state — the
+ * PKCE verifier and `state` of one login attempt (components/02-customer-ui-web.md
+ * §Data). AES-256-GCM through Web Crypto; the key is derived from a secret the
+ * Infrastructure layer delivers to the Web UI process. Nothing here is a
+ * resource key: OpenBao holds those, and the Web UI never sees one.
+ */
+export declare class SealError extends Error {
+    constructor(message?: string);
+}
+/** Seal a JSON value under `secret` for `purpose`. Output is URL- and cookie-safe. */
+export declare function seal(value: unknown, secret: string, purpose: string): Promise<string>;
+/** Open a value sealed by {@link seal}. Throws {@link SealError} on any tampering or key mismatch. */
+export declare function unseal<T = unknown>(token: string, secret: string, purpose: string): Promise<T>;
+//# sourceMappingURL=seal.d.ts.map

package/dist/seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../src/seal.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2BH,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,SAAkC;CAItD;AAED,sFAAsF;AACtF,wBAAsB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK3F;AAED,sGAAsG;AACtG,wBAAsB,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAUpG"}

package/dist/seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.js","sourceRoot":"","sources":["../src/seal.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzG,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAID,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,OAAe;IACnD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,GAAG,+BAA+B;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,KAAc,EAAE,MAAc,EAAE,OAAe;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7I,OAAO,MAAM,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,MAAM,CAAc,KAAa,EAAE,MAAc,EAAE,OAAe;IACtF,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACxI,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAM,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,66 @@
+/**
+ * What every Frontend component holds, and how (ADR-003; components/02 §Security):
+ * the opaque session identifier in an `HttpOnly` cookie, forwarded as
+ * `X-Asturiu-Session`. Nothing else — no token, no claims, no resource data.
+ */
+/** The header the Interface API reads on every request except `POST /v0/sessions`. */
+export declare const SESSION_HEADER = "x-asturiu-session";
+export interface CookiePolicy {
+    httpOnly: true;
+    sameSite: "strict" | "lax";
+    path: string;
+    /** `Secure` whenever the page is served over TLS; local development is the only exception. */
+    secure: boolean;
+    maxAge?: number;
+}
+/** The Engine session cookie: `HttpOnly`, `Secure`, `SameSite=Strict`, host-only. */
+export declare function sessionCookiePolicy(opts: {
+    secure: boolean;
+    maxAge?: number;
+}): CookiePolicy;
+/**
+ * The login-attempt cookie (sealed PKCE verifier + `state`). `Lax`, not
+ * `Strict`: the browser arrives at the callback from Authentik's origin and a
+ * `Strict` cookie would not be sent on that top-level navigation.
+ */
+export declare function loginCookiePolicy(opts: {
+    secure: boolean;
+    maxAgeSeconds?: number;
+    path?: string;
+}): CookiePolicy;
+/** What one login attempt needs to remember between `/auth/login` and `/auth/callback`. */
+export interface LoginAttempt {
+    verifier: string;
+    state: string;
+    /** Site-relative path to land on afterwards. */
+    next: string;
+    created_at: string;
+    /** Set when the attempt is a step-up (ADR-018): the callback elevates the existing session instead of starting one. */
+    step_up?: "password" | "2fa";
+}
+/** Only site-relative paths may be used as post-login targets (no open redirect). */
+export declare function safeNextPath(candidate: string | null | undefined, fallback?: string): string;
+/** How `continuePage` writes its page. */
+export interface ContinuePageOptions {
+    /** The label and the page title. Default "Signing in". */
+    text?: string;
+    /** A Content-Security-Policy nonce for the page's one `<style>` element. */
+    nonce?: string;
+}
+/**
+ * The page a login callback answers with once the session cookie is set
+ * (ADR-032). The callback was reached through a redirect chain the sign-in host
+ * started — another site — so a redirect from it is still cross-site and a
+ * `SameSite=Strict` session cookie would not go with the next request: the app
+ * would see no session and start a login again, in a loop. A page that moves on
+ * by itself starts a fresh navigation from the app's own origin, which carries
+ * the cookie. `path` must already be a same-origin path (`safeNextPath`).
+ *
+ * The page is the "Signing in" screen the sign-in host showed while leaving,
+ * picked up at the same point of its animation, so the hand-over reads as one
+ * screen. It carries no script; its one `<style>` takes `nonce`.
+ */
+export declare function continuePage(path: string, options?: string | ContinuePageOptions): string;
+/** Seconds until an ISO timestamp, floored at zero. */
+export declare function secondsUntil(iso: string | undefined, fallbackSeconds?: number): number;
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,sFAAsF;AACtF,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,IAAI,CAAC;IACf,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAE5F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAEhH;AAED,2FAA2F;AAC3F,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,uHAAuH;IACvH,OAAO,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;CAC9B;AAED,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,SAAM,GAAG,MAAM,CAKzF;AAED,0CAA0C;AAC1C,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,GAAG,mBAAwB,GAAG,MAAM,CAW7F;AAED,uDAAuD;AACvD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,eAAe,SAAO,GAAG,MAAM,CAIpF"}

package/dist/session.js

@@ -0,0 +1,61 @@
+/**
+ * What every Frontend component holds, and how (ADR-003; components/02 §Security):
+ * the opaque session identifier in an `HttpOnly` cookie, forwarded as
+ * `X-Asturiu-Session`. Nothing else — no token, no claims, no resource data.
+ */
+import { SIGNING_IN_CSS, signingInMarkup, signingInPhase } from "./signing-in.js";
+/** The header the Interface API reads on every request except `POST /v0/sessions`. */
+export const SESSION_HEADER = "x-asturiu-session";
+/** The Engine session cookie: `HttpOnly`, `Secure`, `SameSite=Strict`, host-only. */
+export function sessionCookiePolicy(opts) {
+    return { httpOnly: true, sameSite: "strict", path: "/", secure: opts.secure, maxAge: opts.maxAge };
+}
+/**
+ * The login-attempt cookie (sealed PKCE verifier + `state`). `Lax`, not
+ * `Strict`: the browser arrives at the callback from Authentik's origin and a
+ * `Strict` cookie would not be sent on that top-level navigation.
+ */
+export function loginCookiePolicy(opts) {
+    return { httpOnly: true, sameSite: "lax", path: opts.path ?? "/auth", secure: opts.secure, maxAge: opts.maxAgeSeconds ?? 600 };
+}
+/** Only site-relative paths may be used as post-login targets (no open redirect). */
+export function safeNextPath(candidate, fallback = "/") {
+    if (!candidate)
+        return fallback;
+    if (!candidate.startsWith("/") || candidate.startsWith("//") || candidate.startsWith("/\\"))
+        return fallback;
+    if (/[\r\n]/.test(candidate))
+        return fallback;
+    return candidate;
+}
+/**
+ * The page a login callback answers with once the session cookie is set
+ * (ADR-032). The callback was reached through a redirect chain the sign-in host
+ * started — another site — so a redirect from it is still cross-site and a
+ * `SameSite=Strict` session cookie would not go with the next request: the app
+ * would see no session and start a login again, in a loop. A page that moves on
+ * by itself starts a fresh navigation from the app's own origin, which carries
+ * the cookie. `path` must already be a same-origin path (`safeNextPath`).
+ *
+ * The page is the "Signing in" screen the sign-in host showed while leaving,
+ * picked up at the same point of its animation, so the hand-over reads as one
+ * screen. It carries no script; its one `<style>` takes `nonce`.
+ */
+export function continuePage(path, options = {}) {
+    const { text = "Signing in", nonce } = typeof options === "string" ? { text: options } : options;
+    const esc = (s) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+    const to = esc(safeNextPath(path, "/"));
+    const css = `html{background:#f4f4f1}@media (prefers-color-scheme:dark){html{background:#0a0b0d}}body{margin:0}.signing-in{--si-phase:${signingInPhase()}}${SIGNING_IN_CSS}`;
+    return (`<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="refresh" content="0;url=${to}">` +
+        `<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover"><meta name="color-scheme" content="light dark"><meta name="robots" content="noindex">` +
+        `<title>${esc(text)}</title><style${nonce ? ` nonce="${esc(nonce)}"` : ""}>${css}</style></head>` +
+        `<body><div class="signing-in" role="status">${signingInMarkup({ text, href: safeNextPath(path, "/") })}</div></body></html>`);
+}
+/** Seconds until an ISO timestamp, floored at zero. */
+export function secondsUntil(iso, fallbackSeconds = 3600) {
+    if (!iso)
+        return fallbackSeconds;
+    const ms = Date.parse(iso) - Date.now();
+    return Number.isFinite(ms) ? Math.max(0, Math.floor(ms / 1000)) : fallbackSeconds;
+}
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAElF,sFAAsF;AACtF,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAWlD,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,IAA0C;IAC5E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AACrG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAgE;IAChG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,IAAI,GAAG,EAAE,CAAC;AACjI,CAAC;AAaD,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,SAAoC,EAAE,QAAQ,GAAG,GAAG;IAC/E,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7G,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,OAAO,SAAS,CAAC;AACnB,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,UAAwC,EAAE;IACnF,MAAM,EAAE,IAAI,GAAG,YAAY,EAAE,KAAK,EAAE,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACjG,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjF,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,4HAA4H,cAAc,EAAE,IAAI,cAAc,EAAE,CAAC;IAC7K,OAAO,CACL,8FAA8F,EAAE,IAAI;QACpG,+KAA+K;QAC/K,UAAU,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,iBAAiB;QACjG,+CAA+C,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,sBAAsB,CAC9H,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,YAAY,CAAC,GAAuB,EAAE,eAAe,GAAG,IAAI;IAC1E,IAAI,CAAC,GAAG;QAAE,OAAO,eAAe,CAAC;IACjC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AACpF,CAAC"}