@cogenta/auth 0.1.0

package/dist/audit.d.ts

@@ -0,0 +1,17 @@
+import { type DatabaseHandle } from '@cogenta/core';
+import type { AuditEntry, RecordAuditInput } from './types.js';
+export interface AuditFilter {
+    readonly actorId?: string;
+    readonly action?: string;
+    readonly collection?: string;
+    readonly since?: string;
+    readonly limit?: number;
+}
+export interface AuditLog {
+    record(input: RecordAuditInput): Promise<AuditEntry>;
+    list(filter?: AuditFilter): Promise<readonly AuditEntry[]>;
+    /** Recomputes every hash and compares. Throws `AUDIT_CHAIN_BROKEN` naming the first mismatch. */
+    verify(): Promise<void>;
+}
+export declare function createAuditLog(db: DatabaseHandle, now?: () => number): AuditLog;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AA0D9D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;IAC1D,iGAAiG;IACjG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACxB;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,QAAQ,CA2FzF"}

package/dist/audit.js

@@ -0,0 +1,113 @@
+import { createHash } from 'node:crypto';
+import { CogentaError, identifier, newId, sql } from '@cogenta/core';
+import { TABLES } from './tables.js';
+function fromRow(row) {
+    return {
+        id: row.id,
+        at: row.at,
+        actorId: row.actor_id,
+        actorRoles: JSON.parse(row.actor_roles),
+        action: row.action,
+        collection: row.collection_name,
+        entryId: row.entry_id,
+        diff: row.diff === null ? null : JSON.parse(row.diff),
+        hash: row.hash,
+        previousHash: row.previous_hash,
+    };
+}
+function computeHash(previousHash, fields) {
+    const canonical = JSON.stringify([
+        previousHash,
+        fields.id,
+        fields.at,
+        fields.actor_id,
+        fields.actor_roles,
+        fields.action,
+        fields.collection_name,
+        fields.entry_id,
+        fields.diff,
+    ]);
+    return createHash('sha256').update(canonical).digest('hex');
+}
+export function createAuditLog(db, now = Date.now) {
+    const table = identifier(TABLES.auditLog, db.dialect);
+    // Serialises appends within this process. Two concurrent writers computing
+    // "the current last hash" from a read that has not committed yet would
+    // both chain to the same previous hash and fork the chain — a database
+    // transaction alone does not stop that on every dialect's default isolation
+    // level, so the invariant is enforced here, once, rather than trusted to
+    // whichever caller remembers to lock.
+    let appendQueue = Promise.resolve();
+    async function lastHash() {
+        const result = await db.query(sql `select hash from ${table} order by at desc, id desc limit ${1}`);
+        return result.rows[0]?.hash ?? null;
+    }
+    return {
+        record: (input) => {
+            const task = appendQueue.then(async () => {
+                const previousHash = await lastHash();
+                const base = {
+                    id: newId(now),
+                    at: new Date(now()).toISOString(),
+                    actor_id: input.actorId,
+                    actor_roles: JSON.stringify(input.actorRoles),
+                    action: input.action,
+                    collection_name: input.collection ?? null,
+                    entry_id: input.entryId ?? null,
+                    diff: input.diff === undefined ? null : JSON.stringify(input.diff),
+                    previous_hash: previousHash,
+                };
+                const hash = computeHash(previousHash, base);
+                await db.query(sql `
+          insert into ${table} (id, at, actor_id, actor_roles, action, collection_name, entry_id, diff, hash, previous_hash)
+          values (${base.id}, ${base.at}, ${base.actor_id}, ${base.actor_roles}, ${base.action},
+                  ${base.collection_name}, ${base.entry_id}, ${base.diff}, ${hash}, ${base.previous_hash})`);
+                return fromRow({ ...base, hash });
+            });
+            // The queue must advance even if this append fails, or every append
+            // after a failure would wait on a promise that never resolves.
+            appendQueue = task.catch(() => undefined);
+            return task;
+        },
+        list: async (filter = {}) => {
+            const conditions = [sql `1 = 1`];
+            if (filter.actorId !== undefined)
+                conditions.push(sql `actor_id = ${filter.actorId}`);
+            if (filter.action !== undefined)
+                conditions.push(sql `action = ${filter.action}`);
+            if (filter.collection !== undefined)
+                conditions.push(sql `collection_name = ${filter.collection}`);
+            if (filter.since !== undefined)
+                conditions.push(sql `at >= ${filter.since}`);
+            const where = conditions.reduce((left, right) => sql `${left} and ${right}`);
+            const result = await db.query(sql `
+        select * from ${table} where ${where} order by at desc, id desc limit ${filter.limit ?? 200}`);
+            return result.rows.map(fromRow);
+        },
+        verify: async () => {
+            const result = await db.query(sql `select * from ${table} order by at asc, id asc`);
+            let expectedPrevious = null;
+            for (const row of result.rows) {
+                if (row.previous_hash !== expectedPrevious) {
+                    throw new CogentaError({
+                        code: 'AUDIT_CHAIN_BROKEN',
+                        message: `Audit entry ${row.id} does not chain from the entry before it.`,
+                        hint: 'The audit log has been edited or reordered outside of record(). Treat every entry from this point on as untrusted.',
+                        details: { entryId: row.id },
+                    });
+                }
+                const { hash, ...rest } = row;
+                if (computeHash(row.previous_hash, rest) !== hash) {
+                    throw new CogentaError({
+                        code: 'AUDIT_CHAIN_BROKEN',
+                        message: `Audit entry ${row.id} has been modified since it was recorded.`,
+                        hint: 'Its stored hash no longer matches its content. Treat every entry from this point on as untrusted.',
+                        details: { entryId: row.id },
+                    });
+                }
+                expectedPrevious = hash;
+            }
+        },
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AA6BpC,SAAS,OAAO,CAAC,GAAa;IAC5B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAsB;QAC5D,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,eAAe;QAC/B,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA6B;QAClF,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,GAAG,CAAC,aAAa;KAChC,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,YAA2B,EAAE,MAA8B;IAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,YAAY;QACZ,MAAM,CAAC,EAAE;QACT,MAAM,CAAC,EAAE;QACT,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,eAAe;QACtB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,IAAI;KACZ,CAAC,CAAA;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7D,CAAC;AAiBD,MAAM,UAAU,cAAc,CAAC,EAAkB,EAAE,GAAG,GAAiB,IAAI,CAAC,GAAG;IAC7E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAErD,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,sCAAsC;IACtC,IAAI,WAAW,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAA;IAErD,KAAK,UAAU,QAAQ;QACrB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,oBAAoB,KAAK,oCAAoC,CAAC,EAAE,CACpE,CAAA;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAA;IACrC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,IAAyB,EAAE;gBAC5D,MAAM,YAAY,GAAG,MAAM,QAAQ,EAAE,CAAA;gBACrC,MAAM,IAAI,GAAG;oBACX,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC;oBACd,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;oBACjC,QAAQ,EAAE,KAAK,CAAC,OAAO;oBACvB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC;oBAC7C,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,eAAe,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;oBACzC,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;oBAC/B,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;oBAClE,aAAa,EAAE,YAAY;iBAC5B,CAAA;gBACD,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;gBAE5C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;wBACF,KAAK;oBACT,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM;oBAC1E,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,KAAK,IAAI,CAAC,aAAa,GAAG,CAAC,CAAA;gBAEpG,OAAO,OAAO,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACnC,CAAC,CAAC,CAAA;YAEF,oEAAoE;YACpE,+DAA+D;YAC/D,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACzC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE;YAC1B,MAAM,UAAU,GAAG,CAAC,GAAG,CAAA,OAAO,CAAC,CAAA;YAC/B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAA,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;YACpF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAA,YAAY,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;YAChF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;gBACjC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAA,qBAAqB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;YAC9D,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAA,SAAS,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;YAE3E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAA;YAC3E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAW,GAAG,CAAA;wBACzB,KAAK,UAAU,KAAK,oCAAoC,MAAM,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAA;YAChG,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAED,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAW,GAAG,CAAA,iBAAiB,KAAK,0BAA0B,CAAC,CAAA;YAC5F,IAAI,gBAAgB,GAAkB,IAAI,CAAA;YAE1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,GAAG,CAAC,aAAa,KAAK,gBAAgB,EAAE,CAAC;oBAC3C,MAAM,IAAI,YAAY,CAAC;wBACrB,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,eAAe,GAAG,CAAC,EAAE,2CAA2C;wBACzE,IAAI,EAAE,oHAAoH;wBAC1H,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE;qBAC7B,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAA;gBAC7B,IAAI,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBAClD,MAAM,IAAI,YAAY,CAAC;wBACrB,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,eAAe,GAAG,CAAC,EAAE,2CAA2C;wBACzE,IAAI,EAAE,mGAAmG;wBACzG,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE;qBAC7B,CAAC,CAAA;gBACJ,CAAC;gBAED,gBAAgB,GAAG,IAAI,CAAA;YACzB,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/credentials.d.ts

@@ -0,0 +1,33 @@
+import { type DatabaseHandle } from '@cogenta/core';
+import type { CredentialKind } from './types.js';
+export interface WebAuthnCredentialData {
+    readonly credentialId: string;
+    readonly publicKey: string;
+    readonly counter: number;
+    readonly transports: readonly string[];
+    readonly label: string | undefined;
+}
+export interface CredentialStore {
+    setPassword(userId: string, password: string): Promise<void>;
+    verifyPassword(userId: string, password: string): Promise<boolean>;
+    hasPassword(userId: string): Promise<boolean>;
+    setTotpSecret(userId: string, secret: string): Promise<void>;
+    /** A secret exists but has not completed the "scan and confirm one code" step. */
+    totpSecret(userId: string): Promise<{
+        secret: string;
+        verified: boolean;
+    } | null>;
+    confirmTotp(userId: string): Promise<void>;
+    removeTotp(userId: string): Promise<void>;
+    addWebAuthnCredential(userId: string, data: WebAuthnCredentialData): Promise<void>;
+    webAuthnCredentials(userId: string): Promise<readonly WebAuthnCredentialData[]>;
+    webAuthnCredentialByExternalId(credentialId: string): Promise<{
+        userId: string;
+        data: WebAuthnCredentialData;
+    } | null>;
+    updateWebAuthnCounter(credentialId: string, counter: number): Promise<void>;
+    /** What second factors, if any, this user has set up. */
+    kinds(userId: string): Promise<readonly CredentialKind[]>;
+}
+export declare function createCredentialStore(db: DatabaseHandle, now?: () => number): CredentialStore;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAGzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAUhD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAClE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAE7C,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D,kFAAkF;IAClF,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IACjF,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzC,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClF,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAAC,CAAA;IAC/E,8BAA8B,CAC5B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,sBAAsB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IACnE,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3E,yDAAyD;IACzD,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAA;CAC1D;AAED,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,cAAc,EAClB,GAAG,GAAE,MAAM,MAAiB,GAC3B,eAAe,CAkHjB"}

package/dist/credentials.js

@@ -0,0 +1,95 @@
+import { CogentaError, identifier, newId, sql } from '@cogenta/core';
+import { hashPassword, verifyPassword } from './password.js';
+import { TABLES } from './tables.js';
+export function createCredentialStore(db, now = Date.now) {
+    const table = identifier(TABLES.credentials, db.dialect);
+    async function findOne(userId, kind) {
+        const result = await db.query(sql `select * from ${table} where user_id = ${userId} and kind = ${kind} limit ${1}`);
+        return result.rows[0];
+    }
+    async function upsert(userId, kind, data) {
+        const existing = await findOne(userId, kind);
+        const payload = JSON.stringify(data);
+        if (existing === undefined) {
+            await db.query(sql `
+        insert into ${table} (id, user_id, kind, data, created_at)
+        values (${newId(now)}, ${userId}, ${kind}, ${payload}, ${new Date(now()).toISOString()})`);
+        }
+        else {
+            await db.query(sql `update ${table} set data = ${payload} where id = ${existing.id}`);
+        }
+    }
+    return {
+        setPassword: async (userId, password) => {
+            await upsert(userId, 'password', { hash: await hashPassword(password) });
+        },
+        verifyPassword: async (userId, password) => {
+            const row = await findOne(userId, 'password');
+            if (row === undefined)
+                return false;
+            const { hash } = JSON.parse(row.data);
+            return verifyPassword(password, hash);
+        },
+        hasPassword: async (userId) => (await findOne(userId, 'password')) !== undefined,
+        setTotpSecret: async (userId, secret) => {
+            await upsert(userId, 'totp', { secret, verified: false });
+        },
+        totpSecret: async (userId) => {
+            const row = await findOne(userId, 'totp');
+            if (row === undefined)
+                return null;
+            return JSON.parse(row.data);
+        },
+        confirmTotp: async (userId) => {
+            const row = await findOne(userId, 'totp');
+            if (row === undefined) {
+                throw new CogentaError({
+                    code: 'AUTH_TOTP_INVALID',
+                    message: 'No TOTP secret was set up for this user.',
+                    hint: 'Call setTotpSecret before confirmTotp — there is nothing to confirm yet.',
+                });
+            }
+            const current = JSON.parse(row.data);
+            await db.query(sql `update ${table} set data = ${JSON.stringify({ ...current, verified: true })} where id = ${row.id}`);
+        },
+        removeTotp: async (userId) => {
+            await db.query(sql `delete from ${table} where user_id = ${userId} and kind = ${'totp'}`);
+        },
+        addWebAuthnCredential: async (userId, data) => {
+            await db.query(sql `
+        insert into ${table} (id, user_id, kind, data, created_at)
+        values (${newId(now)}, ${userId}, ${'webauthn'}, ${JSON.stringify(data)}, ${new Date(now()).toISOString()})`);
+        },
+        webAuthnCredentials: async (userId) => {
+            const result = await db.query(sql `select * from ${table} where user_id = ${userId} and kind = ${'webauthn'}`);
+            return result.rows.map((row) => JSON.parse(row.data));
+        },
+        webAuthnCredentialByExternalId: async (credentialId) => {
+            // Every WebAuthn credential is scanned rather than indexed by its wire id:
+            // one admin has a handful of passkeys, not thousands, and an index on a
+            // JSON-embedded field would need a fourth table for one lookup.
+            const result = await db.query(sql `select * from ${table} where kind = ${'webauthn'}`);
+            for (const row of result.rows) {
+                const data = JSON.parse(row.data);
+                if (data.credentialId === credentialId)
+                    return { userId: row.user_id, data };
+            }
+            return null;
+        },
+        updateWebAuthnCounter: async (credentialId, counter) => {
+            const result = await db.query(sql `select * from ${table} where kind = ${'webauthn'}`);
+            for (const row of result.rows) {
+                const data = JSON.parse(row.data);
+                if (data.credentialId === credentialId) {
+                    await db.query(sql `update ${table} set data = ${JSON.stringify({ ...data, counter })} where id = ${row.id}`);
+                    return;
+                }
+            }
+        },
+        kinds: async (userId) => {
+            const result = await db.query(sql `select distinct kind from ${table} where user_id = ${userId}`);
+            return result.rows.map((row) => row.kind);
+        },
+    };
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAyCpC,MAAM,UAAU,qBAAqB,CACnC,EAAkB,EAClB,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAExD,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,IAAoB;QACzD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,oBAAoB,MAAM,eAAe,IAAI,UAAU,CAAC,EAAE,CACpF,CAAA;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,IAAoB,EAAE,IAAa;QACvE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK;kBACT,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,KAAK,IAAI,KAAK,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QAC9F,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,UAAU,KAAK,eAAe,OAAO,eAAe,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YACtC,MAAM,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YAC7C,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAA;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAqB,CAAA;YACzD,OAAO,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACvC,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,KAAK,SAAS;QAEhF,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACzC,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA0C,CAAA;QACtE,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACzC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,0CAA0C;oBACnD,IAAI,EAAE,0EAA0E;iBACjF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAuB,CAAA;YAC1D,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,KAAK,eAAe,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,CACvG,CAAA;QACH,CAAC;QAED,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,KAAK,oBAAoB,MAAM,eAAe,MAAM,EAAE,CAAC,CAAA;QAC1F,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK;kBACT,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,KAAK,UAAU,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QACjH,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,oBAAoB,MAAM,eAAe,UAAU,EAAE,CAC/E,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA2B,CAAC,CAAA;QACjF,CAAC;QAED,8BAA8B,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YACrD,2EAA2E;YAC3E,wEAAwE;YACxE,gEAAgE;YAChE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,iBAAiB,UAAU,EAAE,CACvD,CAAA;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA2B,CAAA;gBAC3D,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY;oBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAA;YAC9E,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE;YACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,iBAAiB,UAAU,EAAE,CACvD,CAAA;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA2B,CAAA;gBAC3D,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACvC,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,KAAK,eAAe,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,CAC7F,CAAA;oBACD,OAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,6BAA6B,KAAK,oBAAoB,MAAM,EAAE,CAClE,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAsB,CAAC,CAAA;QAC7D,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `@cogenta/auth` — identity, sessions, credentials and the audit log.
+ *
+ * Contract A stops at "roles are an open set of names a collection's
+ * permissions declare" and leaves who attaches a role to a real person to L2.
+ * This package is that attachment: users, password/TOTP/WebAuthn credentials,
+ * bearer sessions, login-attempt backoff, MFA enforcement for sensitive
+ * roles, and the hash-chained audit log L4's agents will write to as well.
+ */
+export type { AuditFilter, AuditLog } from './audit.js';
+export { createAuditLog } from './audit.js';
+export type { CredentialStore, WebAuthnCredentialData } from './credentials.js';
+export { createCredentialStore } from './credentials.js';
+export type { AuthService, AuthServiceOptions, LoginResult } from './login.js';
+export { createAuthService } from './login.js';
+export { requiresMfa, sensitiveRoles } from './mfa.js';
+export { hashPassword, verifyPassword } from './password.js';
+export type { RateLimiter } from './rate-limit.js';
+export { createRateLimiter } from './rate-limit.js';
+export type { SessionStore } from './sessions.js';
+export { createSessionStore } from './sessions.js';
+export type { AuthStore, AuthStoreOptions } from './store.js';
+export { createAuthStore } from './store.js';
+export { ensureAuthTables, TABLES as AUTH_TABLES } from './tables.js';
+export type { VerifyTotpOptions } from './totp.js';
+export { assertTotpSecretFormat, generateTotpSecret, totpUri, verifyTotp, } from './totp.js';
+export * from './types.js';
+export type { UserStore } from './users.js';
+export { createUserStore } from './users.js';
+export type { AuthenticationOptions, RegistrationOptions, WebAuthnAuthenticationResult, WebAuthnConfig, } from './webauthn.js';
+export { beginWebAuthnAuthentication, beginWebAuthnRegistration, completeWebAuthnAuthentication, completeWebAuthnRegistration, } from './webauthn.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC5D,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,aAAa,CAAA;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,OAAO,EACP,UAAU,GACX,MAAM,WAAW,CAAA;AAClB,cAAc,YAAY,CAAA;AAC1B,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,YAAY,EACV,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAC5B,cAAc,GACf,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -0,0 +1,23 @@
+/**
+ * `@cogenta/auth` — identity, sessions, credentials and the audit log.
+ *
+ * Contract A stops at "roles are an open set of names a collection's
+ * permissions declare" and leaves who attaches a role to a real person to L2.
+ * This package is that attachment: users, password/TOTP/WebAuthn credentials,
+ * bearer sessions, login-attempt backoff, MFA enforcement for sensitive
+ * roles, and the hash-chained audit log L4's agents will write to as well.
+ */
+export { createAuditLog } from './audit.js';
+export { createCredentialStore } from './credentials.js';
+export { createAuthService } from './login.js';
+export { requiresMfa, sensitiveRoles } from './mfa.js';
+export { hashPassword, verifyPassword } from './password.js';
+export { createRateLimiter } from './rate-limit.js';
+export { createSessionStore } from './sessions.js';
+export { createAuthStore } from './store.js';
+export { ensureAuthTables, TABLES as AUTH_TABLES } from './tables.js';
+export { assertTotpSecretFormat, generateTotpSecret, totpUri, verifyTotp, } from './totp.js';
+export * from './types.js';
+export { createUserStore } from './users.js';
+export { beginWebAuthnAuthentication, beginWebAuthnRegistration, completeWebAuthnAuthentication, completeWebAuthnRegistration, } from './webauthn.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,aAAa,CAAA;AAErE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,OAAO,EACP,UAAU,GACX,MAAM,WAAW,CAAA;AAClB,cAAc,YAAY,CAAA;AAE1B,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAO5C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,eAAe,CAAA"}

package/dist/login.d.ts

@@ -0,0 +1,66 @@
+import { type DatabaseHandle } from '@cogenta/core';
+import type { CollectionDefinition } from '@cogenta/schema';
+import type { AuthenticationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON } from '@simplewebauthn/server';
+import type { IssuedSession, User } from './types.js';
+import { type WebAuthnConfig } from './webauthn.js';
+export type LoginResult = {
+    readonly status: 'session';
+    readonly session: IssuedSession;
+    readonly user: User;
+} | {
+    readonly status: 'mfa_required';
+    readonly ticket: string;
+    readonly availableFactors: readonly ('totp' | 'webauthn')[];
+} | {
+    /**
+     * A sensitive role with no second factor set up yet. Not an error: the
+     * password was correct, and the only thing standing between this
+     * attempt and a session is enrolling TOTP right now, with the ticket
+     * this result carries.
+     */
+    readonly status: 'totp_setup_required';
+    readonly ticket: string;
+};
+export interface TotpSetup {
+    readonly secret: string;
+    /** `otpauth://` URI, for a QR code the authenticator app scans. */
+    readonly uri: string;
+}
+export interface WebAuthnRegistrationChallenge {
+    readonly options: PublicKeyCredentialCreationOptionsJSON;
+    readonly ticket: string;
+}
+export interface WebAuthnAuthenticationChallenge {
+    readonly options: PublicKeyCredentialRequestOptionsJSON;
+    readonly ticket: string;
+}
+export interface AuthServiceOptions {
+    readonly db: DatabaseHandle;
+    /** From `COGENTA_AUTH_SIGNING_KEY`, never from a config file (rule R7). */
+    readonly signingKey: string;
+    /** What decides whether a role needs a second factor (`sensitiveRoles`). */
+    readonly collections: readonly CollectionDefinition[];
+    /** Shown in the authenticator app next to the account name. Defaults to "Cogenta". */
+    readonly issuer?: string;
+    /** Absent means passkeys are off: registration and login both refuse with a clear reason. */
+    readonly webauthn?: WebAuthnConfig;
+    readonly now?: () => number;
+}
+export interface AuthService {
+    passwordLogin(email: string, password: string): Promise<LoginResult>;
+    totpLogin(ticket: string, token: string): Promise<LoginResult>;
+    /** Issues a session directly: a verified passkey already proved a strong second factor. */
+    sessionForVerifiedUser(userId: string): Promise<LoginResult>;
+    /** Generates a fresh TOTP secret for a `totp_setup_required` ticket and stores it, unconfirmed. */
+    beginTotpSetup(ticket: string): Promise<TotpSetup>;
+    /** Confirms the code from the authenticator app and, on success, signs the user in. */
+    confirmTotpSetup(ticket: string, token: string): Promise<LoginResult>;
+    /** Adding a passkey to an already-identified account — `userId` comes from an existing session. */
+    beginWebAuthnRegistration(userId: string): Promise<WebAuthnRegistrationChallenge>;
+    completeWebAuthnRegistration(ticket: string, response: RegistrationResponseJSON, label?: string): Promise<void>;
+    /** Usernameless: no account is named up front, so any resident passkey the browser offers can answer. */
+    beginWebAuthnLogin(): Promise<WebAuthnAuthenticationChallenge>;
+    completeWebAuthnLogin(ticket: string, response: AuthenticationResponseJSON): Promise<LoginResult>;
+}
+export declare function createAuthService(options: AuthServiceOptions): AuthService;
+//# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,KAAK,EACV,0BAA0B,EAC1B,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACzB,MAAM,wBAAwB,CAAA;AAM/B,OAAO,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAErD,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAA;AA6EtB,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACpF;IACE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAA;CAC5D,GACD;IACE;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAEL,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAA;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,qCAAqC,CAAA;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACpE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9D,2FAA2F;IAC3F,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC5D,mGAAmG;IACnG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAClD,uFAAuF;IACvF,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACrE,mGAAmG;IACnG,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAA;IACjF,4BAA4B,CAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,EAClC,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,yGAAyG;IACzG,kBAAkB,IAAI,OAAO,CAAC,+BAA+B,CAAC,CAAA;IAC9D,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,0BAA0B,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CAClG;AAkBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAoQ1E"}