@betterportal/auth-default 10.6.21 → 10.6.23

package/lib/identity.js

@@ -0,0 +1,315 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import argon2 from "argon2";
+import bcrypt from "bcrypt";
+import * as av from "anyvali";
+import { uuidv7 } from "@betterportal/framework";
+export class AuthError extends Error {
+    status;
+    constructor(message, status = 400) {
+        super(message);
+        this.status = status;
+    }
+}
+const tenantScope = (tenantId) => ({ tenantId, appId: "" });
+export const secretHash = (value) => createHash("sha256").update(value).digest("hex");
+export const newSecret = () => randomBytes(32).toString("base64url");
+export const normalizeAccountIdentifier = (value) => value.trim().toLowerCase();
+const EmailSchema = av.string().maxLength(254).format("email");
+export function isValidEmail(value) {
+    // Bound input before parsing: AnyVali collects issues rather than stopping at maxLength.
+    return value.length <= 254 && EmailSchema.safeParse(value).success;
+}
+export function equalSecret(a, b) {
+    const aa = Buffer.from(secretHash(a));
+    const bb = Buffer.from(secretHash(b));
+    return timingSafeEqual(aa, bb);
+}
+export class SecretCipher {
+    key;
+    constructor(key) {
+        this.key = key;
+        if (key.length !== 32)
+            throw new Error("Invalid auth encryption key");
+    }
+    encrypt(value) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", this.key, iv);
+        const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+        return Buffer.concat([iv, cipher.getAuthTag(), encrypted]).toString("base64url");
+    }
+    decrypt(value) {
+        const input = Buffer.from(value, "base64url");
+        const decipher = createDecipheriv("aes-256-gcm", this.key, input.subarray(0, 12));
+        decipher.setAuthTag(input.subarray(12, 28));
+        return Buffer.concat([decipher.update(input.subarray(28)), decipher.final()]).toString("utf8");
+    }
+}
+export function validatePassword(value) {
+    if (value.length < 12 || Buffer.byteLength(value, "utf8") > 1024)
+        throw new AuthError("Use a password between 12 and 1024 bytes.");
+    if (/^(password|qwerty|letmein|welcome|123456|betterportal|admin)/i.test(value))
+        throw new AuthError("Choose a less common password.");
+}
+export async function hashPassword(value) { validatePassword(value); return argon2.hash(value, { type: argon2.argon2id, memoryCost: 19456, timeCost: 2, parallelism: 1 }); }
+let dummyHash;
+export async function verifyPassword(hash, value) {
+    // Legacy bcrypt accepted UTF-8 input beyond its 72-byte effective key length.
+    if (hash?.startsWith("$2"))
+        return bcrypt.compare(value, hash);
+    if (Buffer.byteLength(value, "utf8") > 1024)
+        return false;
+    if (!hash) {
+        dummyHash ??= hashPassword("unavailable account timing check");
+        await argon2.verify(await dummyHash, value);
+        return false;
+    }
+    if (hash.startsWith("$argon2"))
+        return argon2.verify(hash, value);
+    return false;
+}
+export class IdentityService {
+    storage;
+    cipher;
+    constructor(storage, cipher) {
+        this.storage = storage;
+        this.cipher = cipher;
+    }
+    async directory(tx, scope, isolation, lock = false) {
+        const root = tenantScope(scope.tenantId);
+        const settings = await tx.get("tenant", scope.tenantId, root);
+        if (settings && settings.isolation !== isolation)
+            throw new AuthError("User isolation is locked for this tenant.", 409);
+        if (lock) {
+            if (this.storage.mode === "simple") {
+                const tenants = await tx.list("tenant");
+                if (tenants.some(t => t.id !== scope.tenantId))
+                    throw new AuthError("Simple auth supports one tenant. Upgrade to Advanced.", 426);
+            }
+            await tx.put("tenant", root, { ...settings, id: scope.tenantId, isolation, lockedAt: settings?.lockedAt ?? Date.now() });
+        }
+        return { tenantId: scope.tenantId, appId: (settings?.lockedAt ? settings.isolation : isolation) === "tenant" ? "" : scope.appId };
+    }
+    async effectiveIsolation(tenantId, requested) {
+        return this.storage.transaction(tenantScope(tenantId), async (tx) => {
+            const settings = await tx.get("tenant", tenantId, tenantScope(tenantId));
+            if (settings?.lockedAt && requested && requested !== settings.isolation)
+                throw new AuthError("User isolation cannot change after account creation.", 409);
+            return requested ?? settings?.isolation ?? "app";
+        });
+    }
+    async hasNoUsers() { return this.storage.transaction(tenantScope(""), async (tx) => !(await tx.list("user")).length); }
+    async bootstrapAvailable(scope) {
+        return this.storage.transaction(scope, async (tx) => !(await tx.get("tenant", scope.tenantId, tenantScope(scope.tenantId)))?.bootstrapComplete);
+    }
+    async createUser(scope, policy, input, roles, root = false) {
+        const passwordHash = input.password ? await hashPassword(input.password) : undefined;
+        return this.storage.transaction(scope, async (tx) => this.createInTransaction(tx, scope, policy, input, passwordHash, roles, root));
+    }
+    async createInTransaction(tx, scope, policy, input, passwordHash, roles, root = false) {
+        const dir = await this.directory(tx, scope, policy.isolation, true);
+        if (this.storage.mode === "simple" && (await tx.list("user")).length >= 10)
+            throw new AuthError("Simple auth is limited to 10 stored users. Upgrade to Advanced.", 426);
+        const username = normalizeAccountIdentifier(input.username);
+        const email = input.email ? normalizeAccountIdentifier(input.email) : undefined;
+        if (!username || username.length > 254 || (email !== undefined && !isValidEmail(email)))
+            throw new AuthError("Enter a valid account identifier and email.");
+        for (const id of new Set([username, ...(email ? [email] : [])]))
+            if (await tx.get("identifier", id, dir))
+                throw new AuthError("This account cannot be registered.", 409);
+        if (roles?.includes("*") && !root)
+            throw new AuthError("Root cannot be assigned by account provisioning.", 403);
+        if (root) {
+            if ((await tx.get("tenant", scope.tenantId, tenantScope(scope.tenantId)))?.bootstrapComplete)
+                throw new AuthError("Bootstrap already completed.", 409);
+            const settings = await tx.get("tenant", scope.tenantId, tenantScope(scope.tenantId));
+            await tx.put("tenant", tenantScope(scope.tenantId), { ...settings, bootstrapComplete: true });
+        }
+        const user = { id: uuidv7(), username, tenantId: dir.tenantId, appId: dir.appId, passwordHash, email, emailVerified: input.verified ?? false, name: input.name, enabled: true, bootstrapAdmin: root, refreshVersion: 0, createdAt: Date.now(), updatedAt: Date.now() };
+        await tx.put("user", dir, user);
+        for (const id of new Set([username, ...(email ? [email] : [])]))
+            await tx.put("identifier", dir, { id, userId: user.id });
+        if (roles)
+            await tx.put("roles", scope, { id: user.id, roles, initialized: true });
+        await this.audit(tx, scope, user.id, "user.created");
+        return user;
+    }
+    async findUser(scope, policy, identifier, byId = false) {
+        return this.storage.transaction(scope, async (tx) => {
+            const dir = await this.directory(tx, scope, policy.isolation);
+            const id = byId ? identifier : (await tx.get("identifier", normalizeAccountIdentifier(identifier), dir))?.userId;
+            return id ? tx.get("user", id, dir) : undefined;
+        });
+    }
+    async authenticate(scope, policy, username, password) {
+        const before = await this.storage.transaction(scope, async (tx) => {
+            const dir = await this.directory(tx, scope, policy.isolation);
+            // Only password sign-in accepts exact legacy usernames for ambiguous identifiers.
+            // Email recovery and all other lookups continue to reject ambiguous ownership.
+            const index = await tx.get("legacy-username", username, dir) ?? await tx.get("identifier", normalizeAccountIdentifier(username), dir);
+            return typeof index?.userId === "string" ? tx.get("user", index.userId, dir) : undefined;
+        });
+        const verified = await verifyPassword(before?.passwordHash, password);
+        if (!before?.enabled || !verified)
+            return undefined;
+        const nextHash = before.passwordHash?.startsWith("$2") && Buffer.byteLength(password, "utf8") <= 1024 ? await argon2.hash(password, { type: argon2.argon2id, memoryCost: 19456, timeCost: 2, parallelism: 1 }) : undefined;
+        return this.storage.transaction(scope, async (tx) => {
+            const dir = await this.directory(tx, scope, policy.isolation);
+            const current = await tx.get("user", before.id, dir);
+            if (!current?.enabled || current.passwordHash !== before.passwordHash || current.refreshVersion !== before.refreshVersion)
+                return undefined;
+            if (nextHash) {
+                current.passwordHash = nextHash;
+                await tx.put("user", dir, current);
+            }
+            return current;
+        });
+    }
+    async updateUser(scope, policy, id, update) {
+        return this.storage.transaction(scope, async (tx) => {
+            const dir = await this.directory(tx, scope, policy.isolation);
+            const user = await tx.get("user", id, dir);
+            if (!user)
+                throw new AuthError("Account unavailable.", 404);
+            await update(user, tx);
+            user.updatedAt = Date.now();
+            await tx.put("user", dir, user);
+            return user;
+        });
+    }
+    async roles(tx, scope, user, policy, initialize = false) {
+        let assignment = await tx.get("roles", user.id, scope);
+        if (!assignment?.initialized && initialize) {
+            if (policy.defaultRoleIds.some(id => id === "*" || !policy.allowedRoleIds.includes(id)))
+                throw new AuthError("Default roles reference unavailable roles.", 503);
+            assignment = { id: user.id, roles: [...new Set(policy.defaultRoleIds)], initialized: true };
+            await tx.put("roles", scope, assignment);
+            await this.audit(tx, scope, user.id, "roles.initialized", { roles: assignment.roles });
+        }
+        const groups = await tx.list("group", { tenantId: user.tenantId, appId: user.appId });
+        const groupRoles = groups.filter(g => g.members.includes(user.id)).flatMap(g => g.appRoles[scope.appId] ?? []);
+        return [...new Set([...(assignment?.roles ?? []), ...groupRoles])].filter(id => id === "*" || policy.allowedRoleIds.includes(id));
+    }
+    async issueSession(scope, policy, user, issuer, refreshSeconds) {
+        return this.storage.transaction(scope, async (tx) => {
+            const dir = await this.directory(tx, scope, policy.isolation);
+            const current = await tx.get("user", user.id, dir);
+            if (!current?.enabled || current.refreshVersion !== user.refreshVersion)
+                throw new AuthError("Account changed; sign in again.", 401);
+            await tx.pruneSessions(scope, Date.now());
+            const id = uuidv7();
+            const roles = await this.roles(tx, scope, current, policy, true);
+            const issued = issuer.issueTokenPair({ sub: user.id, ...scope, roles, sessionId: id, sessionVersion: user.refreshVersion, name: current.name ?? current.username, email: current.email, picture: current.picture, authProvider: "betterportal.default", refreshContext: { sessionId: id, version: user.refreshVersion } });
+            await tx.put("session", scope, { id, userId: user.id, userAppId: dir.appId, version: user.refreshVersion, jti: issued.tokenId, previousJtis: [], expiresAt: Date.now() + refreshSeconds * 1000, createdAt: Date.now(), revoked: false });
+            await this.audit(tx, scope, user.id, "login.success");
+            return issued;
+        });
+    }
+    async refresh(scope, policy, claims, issuer) {
+        return this.storage.transaction(scope, async (tx) => {
+            const id = String(claims.refreshContext?.sessionId ?? "");
+            const session = await tx.get("session", id, scope);
+            const dir = await this.directory(tx, scope, policy.isolation);
+            const user = session ? await tx.get("user", session.userId, dir) : undefined;
+            if (!session || !user?.enabled || session.revoked || session.expiresAt <= Date.now() || user.id !== claims.sub || user.refreshVersion !== session.version)
+                return undefined;
+            if (session.jti !== claims.jti) {
+                session.revoked = true;
+                await tx.put("session", scope, session);
+                await this.audit(tx, scope, user.id, "refresh.replay");
+                return undefined;
+            }
+            const roles = await this.roles(tx, scope, user, policy);
+            const issued = issuer.issueTokenPair({ sub: user.id, ...scope, roles, sessionId: id, sessionVersion: user.refreshVersion, name: user.name ?? user.username, email: user.email, picture: user.picture, authProvider: "betterportal.default", refreshContext: { sessionId: id, version: user.refreshVersion } });
+            session.previousJtis = [...session.previousJtis.slice(-4), session.jti];
+            session.jti = issued.tokenId;
+            await tx.put("session", scope, session);
+            return issued;
+        });
+    }
+    async assertActiveSession(tx, scope, claims, user) {
+        const session = await tx.get("session", claims.sessionId ?? "", scope);
+        if (!session || session.revoked || session.expiresAt <= Date.now() || session.userId !== user.id || session.version !== user.refreshVersion
+            || claims.sessionVersion !== user.refreshVersion)
+            throw new AuthError("Session changed; sign in again.", 401);
+    }
+    async revokeSession(scope, claims) {
+        await this.storage.transaction(scope, async (tx) => {
+            const session = await tx.get("session", String(claims.refreshContext?.sessionId ?? ""), scope);
+            if (session?.userId === claims.sub) {
+                session.revoked = true;
+                await tx.put("session", scope, session);
+                await this.audit(tx, scope, claims.sub, "session.revoked");
+            }
+        });
+    }
+    async challenge(scope, purpose, data, userId, lifetimeSeconds = 600) {
+        return this.storage.transaction(scope, async (tx) => this.challengeInTransaction(tx, scope, purpose, data, userId, lifetimeSeconds));
+    }
+    async challengeInTransaction(tx, scope, purpose, data, userId, lifetimeSeconds = 600) {
+        const id = uuidv7();
+        const secret = newSecret();
+        const records = await tx.list("challenge", scope);
+        for (const record of records)
+            if (record.expiresAt <= Date.now())
+                await tx.remove("challenge", record.id, scope);
+        if (records.filter(c => c.expiresAt > Date.now()).length >= 1000)
+            throw new AuthError("Too many pending requests. Try later.", 429);
+        await tx.put("challenge", scope, { id, purpose, data, userId, hash: secretHash(secret), attempts: 0, expiresAt: Date.now() + lifetimeSeconds * 1000 });
+        return { id, secret };
+    }
+    async consume(scope, purpose, id, secret, complete) {
+        return this.consumeWithPreparation(scope, purpose, id, secret, async () => undefined, complete);
+    }
+    async consumeWithPreparation(scope, purpose, id, secret, prepare, complete) {
+        // Charge the attempt independently. The application transaction must roll back
+        // every side effect on failure, while a failed factor still consumes an attempt.
+        const accepted = await this.storage.transaction(scope, async (tx) => {
+            const challenge = await tx.get("challenge", id, scope);
+            if (!challenge || challenge.purpose !== purpose || challenge.expiresAt <= Date.now() || challenge.attempts >= 5)
+                return false;
+            challenge.attempts++;
+            await tx.put("challenge", scope, challenge);
+            return equalSecret(challenge.hash, secretHash(secret)) ? challenge : false;
+        });
+        if (!accepted)
+            throw new AuthError("Verification expired or unavailable.");
+        // Remote work happens without a store/tenant lock. Revalidate and consume only on commit.
+        const prepared = await prepare(accepted);
+        return this.storage.transaction(scope, async (tx) => {
+            const challenge = await tx.get("challenge", id, scope);
+            if (!challenge || challenge.purpose !== purpose || challenge.expiresAt <= Date.now()
+                || !equalSecret(challenge.hash, secretHash(secret)))
+                throw new AuthError("Verification expired or unavailable.");
+            const value = await complete(challenge, tx, prepared);
+            await tx.remove("challenge", id, scope);
+            return value;
+        });
+    }
+    async rateLimit(scope, action, actor, max = 10, seconds = 600) {
+        const allowed = await this.storage.transaction(scope, async (tx) => {
+            const records = await tx.list("limit", scope);
+            for (const row of records)
+                if (Number(row.reset) <= Date.now())
+                    await tx.remove("limit", row.id, scope);
+            if (records.filter(row => Number(row.reset) > Date.now()).length >= 10000)
+                return false;
+            const id = secretHash(`${action}:${actor}`);
+            const old = await tx.get("limit", id, scope);
+            const reset = Number(old?.reset ?? 0) > Date.now() ? Number(old.reset) : Date.now() + seconds * 1000;
+            const count = Number(old?.reset ?? 0) > Date.now() ? Number(old?.count ?? 0) + 1 : 1;
+            await tx.put("limit", scope, { id, reset, count });
+            return count <= max;
+        });
+        if (!allowed)
+            throw new AuthError("Too many attempts. Try again later.", 429);
+    }
+    async audit(tx, scope, actor, event, data = {}) {
+        await tx.put("audit", scope, { id: uuidv7(), actor, event, data, at: Date.now() });
+        if (this.storage.mode === "simple") {
+            const entries = await tx.list("audit", scope);
+            for (const row of entries.slice(0, Math.max(0, entries.length - 1000)))
+                await tx.remove("audit", row.id, scope);
+        }
+    }
+}
+//# sourceMappingURL=identity.js.map

package/lib/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACzG,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAsC,MAAM,yBAAyB,CAAC;AAGrF,MAAM,OAAO,SAAU,SAAQ,KAAK;IACI;IAAtC,YAAY,OAAe,EAAW,SAAS,GAAG;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAA/B,WAAM,GAAN,MAAM,CAAM;IAAoB,CAAC;CACxE;AAyBD,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAS,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9F,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACxF,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/D,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,yFAAyF;IACzF,OAAO,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACrE,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AACD,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;QAAI,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAAC,CAAC;IACpH,OAAO,CAAC,KAAa;QACnB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,CAAC,KAAa;QACnB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACjI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;CACF;AACD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACnI,IAAI,+DAA+D,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;AACzI,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,IAAqB,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACrM,IAAI,SAAsC,CAAC;AAC3C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAwB,EAAE,KAAa;IAC1E,8EAA8E;IAC9E,IAAI,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,SAAS,KAAK,YAAY,CAAC,kCAAkC,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,SAAS,EAAE,KAAK,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IACzI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,eAAe;IACL;IAA+B;IAApD,YAAqB,OAAoB,EAAW,MAAoB;QAAnD,YAAO,GAAP,OAAO,CAAa;QAAW,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAEpE,KAAK,CAAC,SAAS,CAAC,EAAmB,EAAE,KAAY,EAAE,SAAsC,EAAE,IAAI,GAAG,KAAK;QAC7G,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,GAAG,CAAiB,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9E,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;QACxH,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAiB,QAAQ,CAAC,CAAC;gBACxD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC;oBAAE,MAAM,IAAI,SAAS,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;YACpI,CAAC;YACD,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACpI,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,QAAgB,EAAE,SAA4B;QACrE,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAChE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,GAAG,CAAiB,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzF,IAAI,QAAQ,EAAE,QAAQ,IAAI,SAAS,IAAI,SAAS,KAAK,QAAQ,CAAC,SAAS;gBAAE,MAAM,IAAI,SAAS,CAAC,sDAAsD,EAAE,GAAG,CAAC,CAAC;YAC1J,OAAO,SAAS,IAAI,QAAQ,EAAE,SAAS,IAAI,KAAK,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,UAAU,KAAuB,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvI,KAAK,CAAC,kBAAkB,CAAC,KAAY;QACnC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAiB,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAChK,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,KAAY,EAAE,MAAsB,EAAE,KAAiG,EAAE,KAAgB,EAAE,IAAI,GAAG,KAAK;QACtL,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACpI,CAAC;IACD,KAAK,CAAC,mBAAmB,CAAC,EAAmB,EAAE,KAAY,EAAE,MAAsB,EAAE,KAA8E,EAAE,YAAqB,EAAE,KAAgB,EAAE,IAAI,GAAG,KAAK;QACxN,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,iEAAiE,EAAE,GAAG,CAAC,CAAC;QACxK,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAAC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7I,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;QAC5J,KAAK,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,IAAI,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QACzK,IAAI,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAC;QAChH,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAiB,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB;gBAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;YACvK,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,GAAG,CAAiB,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,QAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,IAAI,GAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7Q,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,KAAK,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1H,IAAI,KAAK;YAAE,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,KAAY,EAAE,MAAsB,EAAE,UAAkB,EAAE,IAAI,GAAG,KAAK;QACnF,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,0BAA0B,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,MAA4B,CAAC;YACvI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,YAAY,CAAC,KAAY,EAAE,MAAsB,EAAE,QAAgB,EAAE,QAAgB;QACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9D,kFAAkF;YAClF,+EAA+E;YAC/E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,0BAA0B,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACtI,OAAO,OAAO,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3N,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC3D,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;gBAAE,OAAO,SAAS,CAAC;YAC5I,IAAI,QAAQ,EAAE,CAAC;gBAAC,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC;gBAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAAC,CAAC;YACtF,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,KAAY,EAAE,MAAsB,EAAE,EAAU,EAAE,MAA0D;QAC3H,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QACpG,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,EAAmB,EAAE,KAAY,EAAE,IAAU,EAAE,MAAsB,EAAE,UAAU,GAAG,KAAK;QACnG,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC,GAAG,CAAa,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,EAAE,WAAW,IAAI,UAAU,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;YAChK,UAAU,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YAC5F,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACtF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,OAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,QAAqC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3J,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACpI,CAAC;IACD,KAAK,CAAC,YAAY,CAAC,KAAY,EAAE,MAAsB,EAAE,IAAU,EAAE,MAAqB,EAAE,cAAsB;QAChH,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACzD,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;YACrI,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC3T,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACzO,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;YACtD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,KAAY,EAAE,MAAsB,EAAE,MAAiB,EAAE,MAAqB;QAC1F,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAChD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC5K,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAAC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAAC,OAAO,SAAS,CAAC;YAAC,CAAC;YAC9K,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC/S,OAAO,CAAC,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;YACtG,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,mBAAmB,CAAC,EAAmB,EAAE,KAAY,EAAE,MAAiB,EAAE,IAAU;QACxF,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,cAAc;eACtI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAClH,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,KAAY,EAAE,MAAiB;QACjD,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAC/C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAU,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YACxG,IAAI,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAAC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAAC,CAAC;QACtK,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,KAAY,EAAE,OAAe,EAAE,IAA6B,EAAE,MAAe,EAAE,eAAe,GAAG,GAAG;QAClH,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACrI,CAAC;IACD,KAAK,CAAC,sBAAsB,CAAC,EAAmB,EAAE,KAAY,EAAE,OAAe,EAAE,IAA6B,EAAE,MAAe,EAAE,eAAe,GAAG,GAAG;QACpJ,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAY,WAAW,EAAE,KAAK,CAAC,CAAC;QAC7D,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACjH,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;QACpI,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI,EAAE,CAAC,CAAC;QACvJ,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IACxB,CAAC;IACD,KAAK,CAAC,OAAO,CAAI,KAAY,EAAE,OAAe,EAAE,EAAU,EAAE,MAAc,EAAE,QAAmE;QAC7I,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClG,CAAC;IACD,KAAK,CAAC,sBAAsB,CAAO,KAAY,EAAE,OAAe,EAAE,EAAU,EAAE,MAAc,EAAE,OAA6C,EAAE,QAAgF;QAC3N,+EAA+E;QAC/E,iFAAiF;QACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAChE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,GAAG,CAAY,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAClE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO,IAAI,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,QAAQ,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9H,SAAS,CAAC,QAAQ,EAAE,CAAC;YAAC,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAClE,OAAO,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAC3E,0FAA0F;QAC1F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAChD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,GAAG,CAAY,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAClE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO,IAAI,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;mBAC/E,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;YACnH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YACtD,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAY,EAAE,MAAc,EAAE,KAAa,EAAE,GAAG,GAAG,EAAE,EAAE,OAAO,GAAG,GAAG;QAClF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAC/D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9C,KAAK,MAAM,GAAG,IAAI,OAAO;gBAAE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;oBAAE,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACxG,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxF,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;YAAC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC;YACtG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrF,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,OAAO,KAAK,IAAI,GAAG,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,EAAmB,EAAE,KAAY,EAAE,KAAa,EAAE,KAAa,EAAE,OAAgC,EAAE;QAC7G,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;gBAAE,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;CACF"}

package/lib/index.d.ts

@@ -1,4 +1,8 @@
 export * from "./defaultAuthManifest.js";
 export * from "./userStore.js";
 export * from "./plugins/service-betterportal-auth-default/index.js";
+export * from "./storage.js";
+export * from "./identity.js";
+export * from "./factors.js";
+export * from "./social.js";
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sDAAsD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sDAAsD,CAAC;AAErE,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/lib/index.js

@@ -1,4 +1,8 @@
 export * from "./defaultAuthManifest.js";
 export * from "./userStore.js";
 export * from "./plugins/service-betterportal-auth-default/index.js";
+export * from "./storage.js";
+export * from "./identity.js";
+export * from "./factors.js";
+export * from "./social.js";
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sDAAsD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sDAAsD,CAAC;AAErE,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/lib/mail.d.ts

@@ -0,0 +1,19 @@
+import { type IdentityService } from "./identity.js";
+import type { AuthTransaction, Scope } from "./storage.js";
+export interface MailConfig {
+    transport: "postal" | "http";
+    url: string;
+    from: string;
+    apiKey?: string;
+    headers?: Record<string, string>;
+}
+export declare function parseMailHeaders(configured: unknown): Record<string, string> | undefined;
+export declare function validateMailUrl(value: unknown): void;
+export declare class MailQueue {
+    private readonly identity;
+    private readonly config;
+    constructor(identity: IdentityService, config: (scope: Scope) => MailConfig | undefined);
+    enqueue(tx: AuthTransaction, scope: Scope, to: string, subject: string, text: string): Promise<void>;
+    drain(): Promise<void>;
+}
+//# sourceMappingURL=mail.d.ts.map

package/lib/mail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.d.ts","sourceRoot":"","sources":["../src/mail.ts"],"names":[],"mappings":"AAEA,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAe,KAAK,EAAE,MAAM,cAAc,CAAC;AAExE,MAAM,WAAW,UAAU;IAAG,SAAS,EAAE,QAAQ,GAAG,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE;AAE1I,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAUxF;AAGD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAKpD;AACD,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAmB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAlD,QAAQ,EAAE,eAAe,EAAmB,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,UAAU,GAAG,SAAS;IACnH,OAAO,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAepG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAkC7B"}

package/lib/mail.js

@@ -0,0 +1,102 @@
+import { uuidv7 } from "@betterportal/framework";
+import * as av from "anyvali";
+import { AuthError } from "./identity.js";
+const MailHeadersSchema = av.record(av.string());
+export function parseMailHeaders(configured) {
+    if (configured === undefined || configured === "")
+        return undefined;
+    let value;
+    try {
+        value = typeof configured === "string" ? JSON.parse(configured) : configured;
+    }
+    catch {
+        throw new AuthError("Custom mail headers must be a valid JSON object of strings.", 503);
+    }
+    const result = MailHeadersSchema.safeParse(value);
+    if (!result.success)
+        throw new AuthError("Custom mail headers must be a JSON object of strings.", 503);
+    try {
+        new Headers(result.data);
+    }
+    catch {
+        throw new AuthError("Custom mail headers contain an invalid HTTP header name or value.", 503);
+    }
+    return result.data;
+}
+const MailUrlSchema = av.string().format("url");
+export function validateMailUrl(value) {
+    const result = MailUrlSchema.safeParse(value);
+    if (!result.success)
+        throw new AuthError("Email delivery requires a valid absolute URL.", 503);
+    const url = new URL(result.data);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1"].includes(url.hostname)))
+        throw new AuthError("Email delivery requires HTTPS.", 503);
+}
+export class MailQueue {
+    identity;
+    config;
+    constructor(identity, config) {
+        this.identity = identity;
+        this.config = config;
+    }
+    async enqueue(tx, scope, to, subject, text) {
+        const config = this.config(scope);
+        if (!config)
+            throw new AuthError("Email delivery has not been configured.", 503);
+        validateMailUrl(config.url);
+        if (this.identity.storage.mode === "simple") {
+            const rows = await tx.list("mail", scope);
+            if (rows.filter(row => row.state !== "sent").length >= 500)
+                throw new AuthError("Email queue is full. Contact your administrator.", 503);
+            const sent = rows.filter(row => row.state === "sent");
+            for (const row of sent.slice(0, Math.max(0, sent.length - 99)))
+                await tx.remove("mail", row.id, scope);
+        }
+        await tx.put("mail", scope, {
+            id: uuidv7(), scope, encrypted: this.identity.cipher.encrypt(JSON.stringify({ to, subject, text })),
+            attempts: 0, nextAttempt: Date.now(), state: "pending", updatedAt: Date.now()
+        });
+    }
+    async drain() {
+        const rows = await this.identity.storage.transaction({ tenantId: "", appId: "" }, tx => tx.dueMail(Date.now(), 100));
+        for (const row of rows) {
+            if (row.state === "sent" || row.state === "failed" || row.nextAttempt > Date.now())
+                continue;
+            const lease = uuidv7();
+            const claimed = await this.identity.storage.transaction(row.scope, async (tx) => {
+                const current = await tx.get("mail", row.id, row.scope);
+                if (!current || current.state === "sent" || current.state === "failed" || current.nextAttempt > Date.now())
+                    return false;
+                await tx.put("mail", row.scope, { ...current, lease, state: "sending", nextAttempt: Date.now() + 60000 });
+                return true;
+            });
+            if (!claimed)
+                continue;
+            let success = false;
+            try {
+                const config = this.config(row.scope);
+                if (!config)
+                    throw new Error("Mail not configured");
+                validateMailUrl(config.url);
+                const payload = JSON.parse(this.identity.cipher.decrypt(row.encrypted));
+                const body = { from: config.from, to: payload.to, subject: payload.subject, text: payload.text, html: "" };
+                const url = config.transport === "postal" ? `${config.url.replace(/\/+$/, "")}/api/v1/send/message` : config.url;
+                const response = await fetch(url, {
+                    method: "POST", redirect: "error", signal: AbortSignal.timeout(15000),
+                    headers: { ...config.headers, "Content-Type": "application/json", ...(config.transport === "postal" ? { "X-Server-API-Key": config.apiKey ?? "" } : {}) },
+                    body: JSON.stringify(config.transport === "postal" ? { from: body.from, to: [body.to], subject: body.subject, plain_body: body.text, html_body: body.html } : body)
+                });
+                success = response.ok && (config.transport !== "postal" || (await response.json()).status === "success");
+            }
+            catch { /* Persist a bounded delivery status, never provider bodies or secrets. */ }
+            await this.identity.storage.transaction(row.scope, async (tx) => {
+                const current = await tx.get("mail", row.id, row.scope);
+                if (current?.lease !== lease)
+                    return;
+                const attempts = current.attempts + 1;
+                await tx.put("mail", row.scope, { ...current, encrypted: success ? "" : current.encrypted, attempts, state: success ? "sent" : attempts >= 5 ? "failed" : "pending", nextAttempt: Date.now() + Math.min(3600000, 30000 * 2 ** attempts), updatedAt: Date.now() });
+            });
+        }
+    }
+}
+//# sourceMappingURL=mail.js.map

package/lib/mail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.js","sourceRoot":"","sources":["../src/mail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAwB,MAAM,eAAe,CAAC;AAIhE,MAAM,iBAAiB,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;AACjD,MAAM,UAAU,gBAAgB,CAAC,UAAmB;IAClD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAAC,CAAC;IACrF,MAAM,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAC;IAAC,CAAC;IAClG,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;IACvG,IAAI,CAAC;QAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACjC,MAAM,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,mEAAmE,EAAE,GAAG,CAAC,CAAC;IAAC,CAAC;IACxG,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;AAChL,CAAC;AACD,MAAM,OAAO,SAAS;IACS;IAA4C;IAAzE,YAA6B,QAAyB,EAAmB,MAAgD;QAA5F,aAAQ,GAAR,QAAQ,CAAiB;QAAmB,WAAM,GAAN,MAAM,CAA0C;IAAG,CAAC;IAC7H,KAAK,CAAC,OAAO,CAAC,EAAmB,EAAE,KAAY,EAAE,EAAU,EAAE,OAAe,EAAE,IAAY;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;QACjF,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAO,MAAM,EAAE,KAAK,CAAC,CAAC;YAChD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAC;YACzI,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;YACtD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;gBAAE,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE;YAC1B,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAO,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3H,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,SAAS;YAC7F,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;gBAC5E,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE;oBAAE,OAAO,KAAK,CAAC;gBACzH,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC;YACzH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACpD,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAkD,CAAC;gBACzH,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC3G,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACjH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAChC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;oBACrE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;oBACzJ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBACpK,CAAC,CAAC;gBACH,OAAO,GAAG,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAA0B,CAAA,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;YAClI,CAAC;YAAC,MAAM,CAAC,CAAC,0EAA0E,CAAC,CAAC;YACtF,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;gBAC5D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC9D,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK;oBAAE,OAAO;gBACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACtC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,IAAI,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACpQ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}