@c9up/warden 0.1.4 → 0.1.6

package/dist/mfa/WebauthnProvider.js

@@ -0,0 +1,239 @@
+/**
+ * WebauthnProvider — passkeys / FIDO2 via WebAuthn, implemented in-house on
+ * `node:crypto` (see `webauthn-codec.ts`). No third-party dependency: warden
+ * keeps its zero-runtime-dependency footprint.
+ *
+ * The browser side produces the standard `PublicKeyCredential` JSON; this
+ * provider builds the ceremony options and verifies the responses server-side.
+ *
+ * Attestation statements are NOT verified — this is a deliberate
+ * trust-on-registration posture (request `attestation: "none"` on the client),
+ * which is what the vast majority of relying parties use for 2FA / passkeys.
+ * Full attestation (packed/tpm/apple/MDS cert-chain validation) can be layered
+ * on later without changing this API.
+ *
+ * Both the per-ceremony challenge and the persisted passkeys go through
+ * pluggable stores (in-memory defaults), mirroring the rest of warden.
+ */
+import { randomBytes } from "node:crypto";
+import { WardenError } from "../errors.js";
+import { base64urlToBuffer, bufferToBase64url, coseToKeyObject, decodeCbor, parseAuthenticatorData, sha256, verifyWebauthnSignature, } from "./webauthn-codec.js";
+export class MemoryWebauthnChallengeStore {
+    #store = new Map();
+    async save(state, challenge) {
+        this.#store.set(state, challenge);
+    }
+    async take(state) {
+        const c = this.#store.get(state) ?? null;
+        this.#store.delete(state);
+        return c;
+    }
+}
+export class MemoryWebauthnCredentialStore {
+    #store = new Map();
+    async save(passkey) {
+        this.#store.set(passkey.id, passkey);
+    }
+    async findById(id) {
+        return this.#store.get(id) ?? null;
+    }
+    async findByUser(userId) {
+        return [...this.#store.values()].filter((p) => p.userId === userId);
+    }
+    async updateCounter(id, counter) {
+        const p = this.#store.get(id);
+        if (p) {
+            this.#store.set(id, { ...p, counter });
+        }
+    }
+}
+const DEFAULT_ALGS = [-7, -257, -8];
+export class WebauthnProvider {
+    kind = "webauthn";
+    #rpName;
+    #rpID;
+    #origins;
+    #timeout;
+    #algorithms;
+    #challenges;
+    #credentials;
+    constructor(config) {
+        if (!config?.rpID || !config?.rpName || !config?.origin) {
+            throw new WardenError("INVALID_CONFIG", "WebauthnProvider requires rpName, rpID and origin");
+        }
+        this.#rpName = config.rpName;
+        this.#rpID = config.rpID;
+        this.#origins = Array.isArray(config.origin)
+            ? config.origin
+            : [config.origin];
+        this.#timeout = config.timeout ?? 60_000;
+        this.#algorithms = config.supportedAlgorithms ?? DEFAULT_ALGS;
+        this.#challenges =
+            config.challengeStore ?? new MemoryWebauthnChallengeStore();
+        this.#credentials =
+            config.credentialStore ?? new MemoryWebauthnCredentialStore();
+    }
+    /**
+     * Begin passkey registration. Returns the options to hand to the browser,
+     * plus an opaque `state` token the caller stashes in the session and passes
+     * back to `finishRegistration()`.
+     */
+    async startRegistration(user) {
+        const existing = await this.#credentials.findByUser(user.id);
+        const challenge = bufferToBase64url(randomBytes(32));
+        const options = {
+            challenge,
+            rp: { name: this.#rpName, id: this.#rpID },
+            user: {
+                id: bufferToBase64url(Buffer.from(user.id, "utf8")),
+                name: user.name,
+                displayName: user.displayName ?? user.name,
+            },
+            pubKeyCredParams: this.#algorithms.map((alg) => ({
+                type: "public-key",
+                alg,
+            })),
+            timeout: this.#timeout,
+            attestation: "none",
+            excludeCredentials: existing.map((c) => ({
+                id: c.id,
+                type: "public-key",
+                transports: c.transports,
+            })),
+            authenticatorSelection: {
+                residentKey: "preferred",
+                userVerification: "preferred",
+            },
+        };
+        const state = randomBytes(16).toString("hex");
+        await this.#challenges.save(state, challenge);
+        return { options, state };
+    }
+    /**
+     * Complete registration: validate client data + authenticator data against
+     * the stored challenge and persist the new passkey on success.
+     */
+    async finishRegistration(state, userId, response) {
+        const expectedChallenge = await this.#challenges.take(state);
+        if (!expectedChallenge) {
+            return { verified: false };
+        }
+        if (!this.#validClientData(response.response.clientDataJSON, "webauthn.create", expectedChallenge)) {
+            return { verified: false };
+        }
+        const attestation = decodeCbor(base64urlToBuffer(response.response.attestationObject)).value;
+        if (!(attestation instanceof Map)) {
+            return { verified: false };
+        }
+        const authDataRaw = attestation.get("authData");
+        if (!Buffer.isBuffer(authDataRaw)) {
+            return { verified: false };
+        }
+        const authData = parseAuthenticatorData(authDataRaw);
+        if (!this.#validAuthenticator(authData) ||
+            !authData.cosePublicKey ||
+            !authData.cosePublicKeyBytes ||
+            !authData.credentialId) {
+            return { verified: false };
+        }
+        const { alg } = coseToKeyObject(authData.cosePublicKey);
+        await this.#credentials.save({
+            id: bufferToBase64url(authData.credentialId),
+            userId,
+            publicKey: bufferToBase64url(authData.cosePublicKeyBytes),
+            alg,
+            counter: authData.signCount,
+            transports: response.response.transports,
+        });
+        return { verified: true };
+    }
+    /**
+     * Begin authentication. Pass `userId` to restrict to that user's passkeys
+     * (2FA step); omit it for a usernameless / discoverable-credential sign-in.
+     */
+    async startAuthentication(userId) {
+        const challenge = bufferToBase64url(randomBytes(32));
+        const allow = userId ? await this.#credentials.findByUser(userId) : [];
+        const options = {
+            challenge,
+            timeout: this.#timeout,
+            rpId: this.#rpID,
+            userVerification: "preferred",
+            allowCredentials: userId
+                ? allow.map((c) => ({
+                    id: c.id,
+                    type: "public-key",
+                    transports: c.transports,
+                }))
+                : undefined,
+        };
+        const state = randomBytes(16).toString("hex");
+        await this.#challenges.save(state, challenge);
+        return { options, state };
+    }
+    /**
+     * Complete authentication: look up the asserted credential, verify the
+     * signature against the stored challenge, and advance the replay counter.
+     * Returns the owning `userId` on success.
+     */
+    async finishAuthentication(state, response) {
+        const expectedChallenge = await this.#challenges.take(state);
+        if (!expectedChallenge) {
+            return { verified: false };
+        }
+        if (!this.#validClientData(response.response.clientDataJSON, "webauthn.get", expectedChallenge)) {
+            return { verified: false };
+        }
+        const stored = await this.#credentials.findById(response.id);
+        if (!stored) {
+            return { verified: false };
+        }
+        const authDataRaw = base64urlToBuffer(response.response.authenticatorData);
+        const authData = parseAuthenticatorData(authDataRaw);
+        if (!this.#validAuthenticator(authData)) {
+            return { verified: false };
+        }
+        // Signed payload = authenticatorData ‖ SHA-256(clientDataJSON).
+        const clientHash = sha256(base64urlToBuffer(response.response.clientDataJSON));
+        const signedData = Buffer.concat([authDataRaw, clientHash]);
+        const { key } = coseToKeyObject(expectCoseMap(base64urlToBuffer(stored.publicKey)));
+        const ok = verifyWebauthnSignature(stored.alg, key, signedData, base64urlToBuffer(response.response.signature));
+        if (!ok) {
+            return { verified: false };
+        }
+        // Replay guard: a non-zero counter must strictly advance. Authenticators
+        // that always report 0 (e.g. many platform passkeys) are exempt.
+        if (authData.signCount !== 0 && authData.signCount <= stored.counter) {
+            return { verified: false };
+        }
+        await this.#credentials.updateCounter(stored.id, authData.signCount);
+        return { verified: true, userId: stored.userId };
+    }
+    /** Validate clientDataJSON: type, challenge match, and origin allow-list. */
+    #validClientData(clientDataB64, expectedType, expectedChallenge) {
+        let parsed;
+        try {
+            parsed = JSON.parse(base64urlToBuffer(clientDataB64).toString("utf8"));
+        }
+        catch {
+            return false;
+        }
+        return (parsed.type === expectedType &&
+            parsed.challenge === expectedChallenge &&
+            typeof parsed.origin === "string" &&
+            this.#origins.includes(parsed.origin));
+    }
+    /** Validate authenticator data: rpIdHash match and user-presence flag. */
+    #validAuthenticator(authData) {
+        const expectedRpIdHash = sha256(Buffer.from(this.#rpID, "utf8"));
+        return authData.flags.up && expectedRpIdHash.equals(authData.rpIdHash);
+    }
+}
+function expectCoseMap(bytes) {
+    const decoded = decodeCbor(bytes).value;
+    if (!(decoded instanceof Map)) {
+        throw new WardenError("INVALID_CREDENTIAL", "stored COSE key is malformed");
+    }
+    return decoded;
+}
+//# sourceMappingURL=WebauthnProvider.js.map

package/dist/mfa/WebauthnProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebauthnProvider.js","sourceRoot":"","sources":["../../src/mfa/WebauthnProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACN,iBAAiB,EACjB,iBAAiB,EAEjB,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,MAAM,EACN,uBAAuB,GACvB,MAAM,qBAAqB,CAAC;AAiF7B,MAAM,OAAO,4BAA4B;IACxC,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,SAAiB;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAa;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC;IACV,CAAC;CACD;AAED,MAAM,OAAO,6BAA6B;IACzC,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,OAAsB;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,MAAc;QAC9B,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,OAAe;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;CACD;AA0BD,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAEpC,MAAM,OAAO,gBAAgB;IACnB,IAAI,GAAG,UAAmB,CAAC;IAC3B,OAAO,CAAS;IAChB,KAAK,CAAS;IACd,QAAQ,CAAW;IACnB,QAAQ,CAAS;IACjB,WAAW,CAAW;IACtB,WAAW,CAAyB;IACpC,YAAY,CAA0B;IAE/C,YAAY,MAAsB;QACjC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACzD,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,mDAAmD,CACnD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,mBAAmB,IAAI,YAAY,CAAC;QAC9D,IAAI,CAAC,WAAW;YACf,MAAM,CAAC,cAAc,IAAI,IAAI,4BAA4B,EAAE,CAAC;QAC7D,IAAI,CAAC,YAAY;YAChB,MAAM,CAAC,eAAe,IAAI,IAAI,6BAA6B,EAAE,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACtB,IAAkB;QAElB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAA4B;YACxC,SAAS;YACT,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE;YAC1C,IAAI,EAAE;gBACL,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI;aAC1C;YACD,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAChD,IAAI,EAAE,YAAY;gBAClB,GAAG;aACH,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,WAAW,EAAE,MAAM;YACnB,kBAAkB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;aACxB,CAAC,CAAC;YACH,sBAAsB,EAAE;gBACvB,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,WAAW;aAC7B;SACD,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACvB,KAAa,EACb,MAAc,EACd,QAAkC;QAElC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IACC,CAAC,IAAI,CAAC,gBAAgB,CACrB,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAChC,iBAAiB,EACjB,iBAAiB,CACjB,EACA,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,WAAW,GAAG,UAAU,CAC7B,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CACtD,CAAC,KAAK,CAAC;QACR,IAAI,CAAC,CAAC,WAAW,YAAY,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACrD,IACC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YACnC,CAAC,QAAQ,CAAC,aAAa;YACvB,CAAC,QAAQ,CAAC,kBAAkB;YAC5B,CAAC,QAAQ,CAAC,YAAY,EACrB,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAC5B,EAAE,EAAE,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC5C,MAAM;YACN,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACzD,GAAG;YACH,OAAO,EAAE,QAAQ,CAAC,SAAS;YAC3B,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;SACxC,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CACxB,MAAe;QAEf,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,OAAO,GAA8B;YAC1C,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,gBAAgB,EAAE,WAAW;YAC7B,gBAAgB,EAAE,MAAM;gBACvB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAClB,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;iBACxB,CAAC,CAAC;gBACJ,CAAC,CAAC,SAAS;SACZ,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CACzB,KAAa,EACb,QAAoC;QAEpC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IACC,CAAC,IAAI,CAAC,gBAAgB,CACrB,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAChC,cAAc,EACd,iBAAiB,CACjB,EACA,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAM,CACxB,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CACnD,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAC9B,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAClD,CAAC;QACF,MAAM,EAAE,GAAG,uBAAuB,CACjC,MAAM,CAAC,GAAG,EACV,GAAG,EACH,UAAU,EACV,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9C,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,QAAQ,CAAC,SAAS,KAAK,CAAC,IAAI,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAClD,CAAC;IAED,6EAA6E;IAC7E,gBAAgB,CACf,aAAqB,EACrB,YAAgD,EAChD,iBAAyB;QAEzB,IAAI,MAA8D,CAAC;QACnE,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,CACN,MAAM,CAAC,IAAI,KAAK,YAAY;YAC5B,MAAM,CAAC,SAAS,KAAK,iBAAiB;YACtC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CACrC,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,mBAAmB,CAAC,QAGnB;QACA,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC;CACD;AAED,SAAS,aAAa,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACxC,IAAI,CAAC,CAAC,OAAO,YAAY,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,8BAA8B,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/mfa/base32.d.ts

@@ -0,0 +1,13 @@
+/**
+ * RFC 4648 base32 (no padding) — the encoding authenticator apps expect for
+ * TOTP secrets. Kept dependency-free and local to the MFA subsystem.
+ */
+/** Encode bytes to an unpadded, uppercase base32 string. */
+export declare function base32Encode(bytes: Uint8Array): string;
+/**
+ * Decode a base32 string to bytes. Tolerant of lowercase, spaces, and `=`
+ * padding (authenticator apps and manual entry produce all three). Throws on
+ * any character outside the alphabet.
+ */
+export declare function base32Decode(input: string): Uint8Array;
+//# sourceMappingURL=base32.d.ts.map

package/dist/mfa/base32.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base32.d.ts","sourceRoot":"","sources":["../../src/mfa/base32.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAgBtD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAkBtD"}

package/dist/mfa/base32.js

@@ -0,0 +1,52 @@
+/**
+ * RFC 4648 base32 (no padding) — the encoding authenticator apps expect for
+ * TOTP secrets. Kept dependency-free and local to the MFA subsystem.
+ */
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+const CHAR_TO_VAL = {};
+for (let i = 0; i < ALPHABET.length; i++) {
+    CHAR_TO_VAL[ALPHABET[i]] = i;
+}
+/** Encode bytes to an unpadded, uppercase base32 string. */
+export function base32Encode(bytes) {
+    let bits = 0;
+    let value = 0;
+    let out = "";
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            out += ALPHABET[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0) {
+        out += ALPHABET[(value << (5 - bits)) & 31];
+    }
+    return out;
+}
+/**
+ * Decode a base32 string to bytes. Tolerant of lowercase, spaces, and `=`
+ * padding (authenticator apps and manual entry produce all three). Throws on
+ * any character outside the alphabet.
+ */
+export function base32Decode(input) {
+    const clean = input.replace(/[\s=]/g, "").toUpperCase();
+    let bits = 0;
+    let value = 0;
+    const out = [];
+    for (const ch of clean) {
+        const v = CHAR_TO_VAL[ch];
+        if (v === undefined) {
+            throw new Error(`Invalid base32 character: ${ch}`);
+        }
+        value = (value << 5) | v;
+        bits += 5;
+        if (bits >= 8) {
+            out.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return Uint8Array.from(out);
+}
+//# sourceMappingURL=base32.js.map

package/dist/mfa/base32.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base32.js","sourceRoot":"","sources":["../../src/mfa/base32.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AACpD,MAAM,WAAW,GAA2B,EAAE,CAAC;AAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;IAC1C,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC7C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YAClB,GAAG,IAAI,QAAQ,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,CAAC;QACX,CAAC;IACF,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACd,GAAG,IAAI,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,CAAC;QACX,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/mfa/webauthn-codec.d.ts

@@ -0,0 +1,58 @@
+/**
+ * WebAuthn wire-format codec — the parsing and crypto primitives behind
+ * `WebauthnProvider`, implemented from scratch on `node:crypto` so warden
+ * carries no third-party dependency.
+ *
+ * Scope: the subset of CBOR / COSE / authenticator-data that FIDO2 ceremonies
+ * actually use, with public-key algorithms Node can import via JWK:
+ *   - ES256 / ES384 / ES512 (ECDSA, COSE alg -7 / -35 / -36)
+ *   - RS256 / RS384 / RS512 (RSASSA-PKCS1-v1_5, alg -257 / -258 / -259)
+ *   - EdDSA / Ed25519 (alg -8)
+ *
+ * Attestation *statements* are intentionally not verified (see WebauthnProvider).
+ */
+import { type KeyObject } from "node:crypto";
+export type CborValue = number | string | Buffer | CborValue[] | CborMap | boolean | null;
+export type CborMap = Map<number | string, CborValue>;
+export declare function base64urlToBuffer(s: string): Buffer;
+export declare function bufferToBase64url(b: Buffer | Uint8Array): string;
+export declare function sha256(data: Buffer): Buffer;
+interface Decoded {
+    value: CborValue;
+    /** Byte offset immediately after the decoded item. */
+    next: number;
+}
+/**
+ * Decode a single CBOR item starting at `start`. Definite-length only —
+ * indefinite-length items and floats are rejected (WebAuthn uses neither).
+ */
+export declare function decodeCbor(buf: Buffer, start?: number): Decoded;
+export interface AuthenticatorData {
+    rpIdHash: Buffer;
+    flags: {
+        up: boolean;
+        uv: boolean;
+        at: boolean;
+        ed: boolean;
+    };
+    signCount: number;
+    credentialId?: Buffer;
+    cosePublicKey?: CborMap;
+    /** Raw COSE_Key bytes, ready to persist and re-decode at sign-in time. */
+    cosePublicKeyBytes?: Buffer;
+}
+/** Parse the raw authenticator-data structure (§6.1 of the WebAuthn spec). */
+export declare function parseAuthenticatorData(authData: Buffer): AuthenticatorData;
+/** Convert a COSE_Key map into a Node public key plus its COSE algorithm id. */
+export declare function coseToKeyObject(cose: CborMap): {
+    key: KeyObject;
+    alg: number;
+};
+/**
+ * Verify a WebAuthn assertion signature over `data` (= authenticatorData ‖
+ * SHA-256(clientDataJSON)). ECDSA signatures are DER-encoded, matching what
+ * authenticators emit.
+ */
+export declare function verifyWebauthnSignature(alg: number, key: KeyObject, data: Buffer, signature: Buffer): boolean;
+export {};
+//# sourceMappingURL=webauthn-codec.d.ts.map

package/dist/mfa/webauthn-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-codec.d.ts","sourceRoot":"","sources":["../../src/mfa/webauthn-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAKN,KAAK,SAAS,EACd,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,SAAS,GAClB,MAAM,GACN,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX,OAAO,GACP,OAAO,GACP,IAAI,CAAC;AACR,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,CAAC;AAEtD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAEhE;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,UAAU,OAAO;IAChB,KAAK,EAAE,SAAS,CAAC;IACjB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,OAAO,CAwE1D;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,8EAA8E;AAC9E,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CA+B1E;AAmBD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG;IAC/C,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACZ,CAuCA;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACtC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GACf,OAAO,CAKT"}

package/dist/mfa/webauthn-codec.js

@@ -0,0 +1,221 @@
+/**
+ * WebAuthn wire-format codec — the parsing and crypto primitives behind
+ * `WebauthnProvider`, implemented from scratch on `node:crypto` so warden
+ * carries no third-party dependency.
+ *
+ * Scope: the subset of CBOR / COSE / authenticator-data that FIDO2 ceremonies
+ * actually use, with public-key algorithms Node can import via JWK:
+ *   - ES256 / ES384 / ES512 (ECDSA, COSE alg -7 / -35 / -36)
+ *   - RS256 / RS384 / RS512 (RSASSA-PKCS1-v1_5, alg -257 / -258 / -259)
+ *   - EdDSA / Ed25519 (alg -8)
+ *
+ * Attestation *statements* are intentionally not verified (see WebauthnProvider).
+ */
+import { createHash, createPublicKey, verify as cryptoVerify, } from "node:crypto";
+export function base64urlToBuffer(s) {
+    return Buffer.from(s, "base64url");
+}
+export function bufferToBase64url(b) {
+    return Buffer.from(b).toString("base64url");
+}
+export function sha256(data) {
+    return createHash("sha256").update(data).digest();
+}
+/**
+ * Decode a single CBOR item starting at `start`. Definite-length only —
+ * indefinite-length items and floats are rejected (WebAuthn uses neither).
+ */
+export function decodeCbor(buf, start = 0) {
+    const major = buf[start] >> 5;
+    const info = buf[start] & 0x1f;
+    let len;
+    let p = start + 1;
+    if (info < 24) {
+        len = info;
+    }
+    else if (info === 24) {
+        len = buf[p];
+        p += 1;
+    }
+    else if (info === 25) {
+        len = buf.readUInt16BE(p);
+        p += 2;
+    }
+    else if (info === 26) {
+        len = buf.readUInt32BE(p);
+        p += 4;
+    }
+    else if (info === 27) {
+        len = Number(buf.readBigUInt64BE(p));
+        p += 8;
+    }
+    else {
+        throw new Error("CBOR: indefinite or reserved length is not supported");
+    }
+    switch (major) {
+        case 0: // unsigned int
+            return { value: len, next: p };
+        case 1: // negative int
+            return { value: -1 - len, next: p };
+        case 2: // byte string
+            return { value: buf.subarray(p, p + len), next: p + len };
+        case 3: // text string
+            return { value: buf.toString("utf8", p, p + len), next: p + len };
+        case 4: {
+            // array
+            const arr = [];
+            let cur = p;
+            for (let i = 0; i < len; i++) {
+                const d = decodeCbor(buf, cur);
+                arr.push(d.value);
+                cur = d.next;
+            }
+            return { value: arr, next: cur };
+        }
+        case 5: {
+            // map
+            const map = new Map();
+            let cur = p;
+            for (let i = 0; i < len; i++) {
+                const k = decodeCbor(buf, cur);
+                cur = k.next;
+                const v = decodeCbor(buf, cur);
+                cur = v.next;
+                if (typeof k.value !== "number" && typeof k.value !== "string") {
+                    throw new Error("CBOR: only integer/text map keys are supported");
+                }
+                map.set(k.value, v.value);
+            }
+            return { value: map, next: cur };
+        }
+        case 6: {
+            // tag — decode and surface the tagged content
+            const d = decodeCbor(buf, p);
+            return { value: d.value, next: d.next };
+        }
+        case 7:
+            if (info === 20)
+                return { value: false, next: p };
+            if (info === 21)
+                return { value: true, next: p };
+            if (info === 22)
+                return { value: null, next: p };
+            throw new Error("CBOR: simple/float values are not supported");
+        default:
+            throw new Error(`CBOR: unknown major type ${major}`);
+    }
+}
+/** Parse the raw authenticator-data structure (§6.1 of the WebAuthn spec). */
+export function parseAuthenticatorData(authData) {
+    if (authData.length < 37) {
+        throw new Error("authenticatorData is too short");
+    }
+    const flagsByte = authData[32];
+    const flags = {
+        up: (flagsByte & 0x01) !== 0,
+        uv: (flagsByte & 0x04) !== 0,
+        at: (flagsByte & 0x40) !== 0,
+        ed: (flagsByte & 0x80) !== 0,
+    };
+    const result = {
+        rpIdHash: authData.subarray(0, 32),
+        flags,
+        signCount: authData.readUInt32BE(33),
+    };
+    if (flags.at) {
+        if (authData.length < 55) {
+            throw new Error("attested credential data is truncated");
+        }
+        const credIdLen = authData.readUInt16BE(53);
+        result.credentialId = authData.subarray(55, 55 + credIdLen);
+        const coseStart = 55 + credIdLen;
+        const decoded = decodeCbor(authData, coseStart);
+        if (!(decoded.value instanceof Map)) {
+            throw new Error("COSE public key is not a CBOR map");
+        }
+        result.cosePublicKey = decoded.value;
+        result.cosePublicKeyBytes = authData.subarray(coseStart, decoded.next);
+    }
+    return result;
+}
+// COSE algorithm id → the hash Node should use ( `null` = pre-hashed / Ed25519 ).
+const ALG_HASH = {
+    [-7]: "sha256",
+    [-35]: "sha384",
+    [-36]: "sha512",
+    [-257]: "sha256",
+    [-258]: "sha384",
+    [-259]: "sha512",
+    [-8]: null,
+};
+const EC_CURVES = {
+    1: "P-256",
+    2: "P-384",
+    3: "P-521",
+};
+/** Convert a COSE_Key map into a Node public key plus its COSE algorithm id. */
+export function coseToKeyObject(cose) {
+    const kty = expectNumber(cose.get(1), "COSE kty");
+    const alg = expectNumber(cose.get(3), "COSE alg");
+    let jwk;
+    if (kty === 2) {
+        // EC2
+        const curve = EC_CURVES[expectNumber(cose.get(-1), "EC curve")];
+        if (!curve) {
+            throw new Error("unsupported COSE EC curve");
+        }
+        jwk = {
+            kty: "EC",
+            crv: curve,
+            x: bufferToBase64url(expectBytes(cose.get(-2), "EC x")),
+            y: bufferToBase64url(expectBytes(cose.get(-3), "EC y")),
+        };
+    }
+    else if (kty === 3) {
+        // RSA
+        jwk = {
+            kty: "RSA",
+            n: bufferToBase64url(expectBytes(cose.get(-1), "RSA n")),
+            e: bufferToBase64url(expectBytes(cose.get(-2), "RSA e")),
+        };
+    }
+    else if (kty === 1) {
+        // OKP / Ed25519
+        if (expectNumber(cose.get(-1), "OKP curve") !== 6) {
+            throw new Error("unsupported COSE OKP curve (only Ed25519)");
+        }
+        jwk = {
+            kty: "OKP",
+            crv: "Ed25519",
+            x: bufferToBase64url(expectBytes(cose.get(-2), "OKP x")),
+        };
+    }
+    else {
+        throw new Error(`unsupported COSE key type ${kty}`);
+    }
+    return { key: createPublicKey({ key: jwk, format: "jwk" }), alg };
+}
+/**
+ * Verify a WebAuthn assertion signature over `data` (= authenticatorData ‖
+ * SHA-256(clientDataJSON)). ECDSA signatures are DER-encoded, matching what
+ * authenticators emit.
+ */
+export function verifyWebauthnSignature(alg, key, data, signature) {
+    if (!(alg in ALG_HASH)) {
+        throw new Error(`unsupported COSE algorithm ${alg}`);
+    }
+    return cryptoVerify(ALG_HASH[alg], data, key, signature);
+}
+function expectNumber(v, what) {
+    if (typeof v !== "number") {
+        throw new Error(`${what}: expected an integer`);
+    }
+    return v;
+}
+function expectBytes(v, what) {
+    if (!Buffer.isBuffer(v)) {
+        throw new Error(`${what}: expected a byte string`);
+    }
+    return v;
+}
+//# sourceMappingURL=webauthn-codec.js.map

package/dist/mfa/webauthn-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn-codec.js","sourceRoot":"","sources":["../../src/mfa/webauthn-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACN,UAAU,EACV,eAAe,EACf,MAAM,IAAI,YAAY,GAGtB,MAAM,aAAa,CAAC;AAYrB,MAAM,UAAU,iBAAiB,CAAC,CAAS;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAsB;IACvD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAY;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AACnD,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC;IAChD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC/B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClB,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QACf,GAAG,GAAG,IAAI,CAAC;IACZ,CAAC;SAAM,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACxB,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,IAAI,CAAC,CAAC;IACR,CAAC;SAAM,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACxB,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC,IAAI,CAAC,CAAC;IACR,CAAC;SAAM,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACxB,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC,IAAI,CAAC,CAAC;IACR,CAAC;SAAM,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACxB,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC,IAAI,CAAC,CAAC;IACR,CAAC;SAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;IAED,QAAQ,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,EAAE,eAAe;YACtB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,EAAE,eAAe;YACtB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,EAAE,cAAc;YACrB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC;QAC3D,KAAK,CAAC,EAAE,cAAc;YACrB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC;QACnE,KAAK,CAAC,CAAC,CAAC,CAAC;YACR,QAAQ;YACR,MAAM,GAAG,GAAgB,EAAE,CAAC;YAC5B,IAAI,GAAG,GAAG,CAAC,CAAC;YACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC/B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAClB,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,CAAC,CAAC,CAAC;YACR,MAAM;YACN,MAAM,GAAG,GAAY,IAAI,GAAG,EAAE,CAAC;YAC/B,IAAI,GAAG,GAAG,CAAC,CAAC;YACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC/B,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC;gBACb,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC/B,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAChE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBACnE,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,CAAC,CAAC,CAAC;YACR,8CAA8C;YAC9C,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC7B,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,CAAC;QACD,KAAK,CAAC;YACL,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClD,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAChE;YACC,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;AACF,CAAC;AAYD,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG;QACb,EAAE,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5B,EAAE,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5B,EAAE,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5B,EAAE,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;KAC5B,CAAC;IACF,MAAM,MAAM,GAAsB;QACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;QAClC,KAAK;QACL,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;KACpC,CAAC;IACF,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,EAAE,GAAG,SAAS,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,YAAY,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;QACrC,MAAM,CAAC,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,QAAQ,GAAkC;IAC/C,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ;IACd,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ;IACf,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ;IACf,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ;IAChB,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ;IAChB,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ;IAChB,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI;CACV,CAAC;AAEF,MAAM,SAAS,GAA2B;IACzC,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,OAAO;CACV,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,IAAa;IAI5C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,GAAe,CAAC;IAEpB,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACf,MAAM;QACN,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC9C,CAAC;QACD,GAAG,GAAG;YACL,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,KAAK;YACV,CAAC,EAAE,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC,EAAE,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;SACvD,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM;QACN,GAAG,GAAG;YACL,GAAG,EAAE,KAAK;YACV,CAAC,EAAE,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC,EAAE,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;SACxD,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACtB,gBAAgB;QAChB,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,GAAG;YACL,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;SACxD,CAAC;IACH,CAAC;SAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACtC,GAAW,EACX,GAAc,EACd,IAAY,EACZ,SAAiB;IAEjB,IAAI,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,CAAwB,EAAE,IAAY;IAC3D,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,SAAS,WAAW,CAAC,CAAwB,EAAE,IAAY;IAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC"}