@cogenta/auth 0.3.0 → 0.5.1

package/dist/credentials.js

@@ -1,6 +1,9 @@
 import { CogentaError, identifier, newId, sql } from '@cogenta/core';
 import { hashPassword, verifyPassword } from './password.js';
+import { verifyRecoveryCode } from './recovery-codes.js';
 import { TABLES } from './tables.js';
+/** Retries for `consumeRecoveryCode`'s compare-and-set — covers a genuine concurrent race, not a hostile client (see that function's own comment). */
+const CONSUME_ATTEMPTS = 5;
 export function createCredentialStore(db, now = Date.now) {
     const table = identifier(TABLES.credentials, db.dialect);
     async function findOne(userId, kind) {
@@ -90,6 +93,64 @@ export function createCredentialStore(db, now = Date.now) {
             const result = await db.query(sql `select distinct kind from ${table} where user_id = ${userId}`);
             return result.rows.map((row) => row.kind);
         },
+        setRecoveryCodes: async (userId, hashes) => {
+            const codes = hashes.map((hash) => ({ hash, usedAt: null }));
+            await upsert(userId, 'recovery_codes', { codes });
+        },
+        recoveryCodesStatus: async (userId) => {
+            const row = await findOne(userId, 'recovery_codes');
+            if (row === undefined)
+                return null;
+            const { codes } = JSON.parse(row.data);
+            return {
+                total: codes.length,
+                remaining: codes.filter((entry) => entry.usedAt === null).length,
+            };
+        },
+        consumeRecoveryCode: async (userId, code) => {
+            // Bounded retries: a concurrent redemption can win the compare-and-set
+            // below between our read and our write. When that happens we re-read
+            // the row it just wrote and try again against the fresher data — the
+            // same shape as `resets.ts`'s single-use guarantee, applied to a batch
+            // of codes instead of one token. `CONSUME_ATTEMPTS` only has to cover
+            // genuine races, not a hostile client: a wrong code never enters this
+            // loop more than once, since a miss returns `false` on the first pass.
+            for (let attempt = 0; attempt < CONSUME_ATTEMPTS; attempt += 1) {
+                const row = await findOne(userId, 'recovery_codes');
+                if (row === undefined)
+                    return false;
+                const parsed = JSON.parse(row.data);
+                let matchIndex = -1;
+                // Each candidate is scrypt-hashed; short-circuiting on the first
+                // match is the whole point — a code is a spare password, not a value
+                // worth a constant-time scan over up to ten entries.
+                for (const [index, entry] of parsed.codes.entries()) {
+                    if (entry.usedAt !== null)
+                        continue;
+                    if (await verifyRecoveryCode(code, entry.hash)) {
+                        matchIndex = index;
+                        break;
+                    }
+                }
+                if (matchIndex === -1)
+                    return false;
+                const updated = {
+                    codes: parsed.codes.map((entry, index) => index === matchIndex ? { ...entry, usedAt: new Date(now()).toISOString() } : entry),
+                };
+                // Compare-and-set against the exact bytes this call read: if another
+                // caller already wrote a different version of this batch between our
+                // read and this write — consuming this same code, or a different
+                // one — `rowsAffected` is 0 and we loop to retry against the row
+                // that actually won, rather than clobbering it.
+                const result = await db.query(sql `update ${table} set data = ${JSON.stringify(updated)} where id = ${row.id} and data = ${row.data}`);
+                if (result.rowsAffected > 0)
+                    return true;
+            }
+            return false;
+        },
+        removeRecoveryCodes: async (userId) => {
+            await db.query(sql `delete from ${table} where user_id = ${userId} and kind = ${'recovery_codes'}`);
+        },
     };
 }
 //# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAyCpC,MAAM,UAAU,qBAAqB,CACnC,EAAkB,EAClB,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAExD,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,IAAoB;QACzD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,oBAAoB,MAAM,eAAe,IAAI,UAAU,CAAC,EAAE,CACpF,CAAA;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,IAAoB,EAAE,IAAa;QACvE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK;kBACT,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,KAAK,IAAI,KAAK,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QAC9F,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,UAAU,KAAK,eAAe,OAAO,eAAe,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YACtC,MAAM,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YAC7C,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAA;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAqB,CAAA;YACzD,OAAO,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACvC,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,KAAK,SAAS;QAEhF,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACzC,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA0C,CAAA;QACtE,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACzC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,0CAA0C;oBACnD,IAAI,EAAE,0EAA0E;iBACjF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAuB,CAAA;YAC1D,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,KAAK,eAAe,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,CACvG,CAAA;QACH,CAAC;QAED,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,KAAK,oBAAoB,MAAM,eAAe,MAAM,EAAE,CAAC,CAAA;QAC1F,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK;kBACT,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,KAAK,UAAU,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QACjH,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,oBAAoB,MAAM,eAAe,UAAU,EAAE,CAC/E,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA2B,CAAC,CAAA;QACjF,CAAC;QAED,8BAA8B,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YACrD,2EAA2E;YAC3E,wEAAwE;YACxE,gEAAgE;YAChE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,iBAAiB,UAAU,EAAE,CACvD,CAAA;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA2B,CAAA;gBAC3D,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY;oBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAA;YAC9E,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE;YACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,iBAAiB,UAAU,EAAE,CACvD,CAAA;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA2B,CAAA;gBAC3D,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACvC,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,KAAK,eAAe,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,CAC7F,CAAA;oBACD,OAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,6BAA6B,KAAK,oBAAoB,MAAM,EAAE,CAClE,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAsB,CAAC,CAAA;QAC7D,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAyEpC,sJAAsJ;AACtJ,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B,MAAM,UAAU,qBAAqB,CACnC,EAAkB,EAClB,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAExD,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,IAAoB;QACzD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,oBAAoB,MAAM,eAAe,IAAI,UAAU,CAAC,EAAE,CACpF,CAAA;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,IAAoB,EAAE,IAAa;QACvE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK;kBACT,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,KAAK,IAAI,KAAK,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QAC9F,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,UAAU,KAAK,eAAe,OAAO,eAAe,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YACtC,MAAM,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YAC7C,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAA;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAqB,CAAA;YACzD,OAAO,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACvC,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,KAAK,SAAS;QAEhF,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACzC,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA0C,CAAA;QACtE,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACzC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,0CAA0C;oBACnD,IAAI,EAAE,0EAA0E;iBACjF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAuB,CAAA;YAC1D,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,KAAK,eAAe,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,CACvG,CAAA;QACH,CAAC;QAED,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,KAAK,oBAAoB,MAAM,eAAe,MAAM,EAAE,CAAC,CAAA;QAC1F,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK;kBACT,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,KAAK,UAAU,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QACjH,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,oBAAoB,MAAM,eAAe,UAAU,EAAE,CAC/E,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA2B,CAAC,CAAA;QACjF,CAAC;QAED,8BAA8B,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YACrD,2EAA2E;YAC3E,wEAAwE;YACxE,gEAAgE;YAChE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,iBAAiB,UAAU,EAAE,CACvD,CAAA;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA2B,CAAA;gBAC3D,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY;oBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAA;YAC9E,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE;YACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,iBAAiB,UAAU,EAAE,CACvD,CAAA;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA2B,CAAA;gBAC3D,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACvC,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,KAAK,eAAe,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,CAC7F,CAAA;oBACD,OAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,6BAA6B,KAAK,oBAAoB,MAAM,EAAE,CAClE,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAsB,CAAC,CAAA;QAC7D,CAAC;QAED,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,KAAK,GAAwB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;YACjF,MAAM,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACnD,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;YACnD,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAClC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA4C,CAAA;YACjF,OAAO;gBACL,KAAK,EAAE,KAAK,CAAC,MAAM;gBACnB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM;aACjE,CAAA;QACH,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC1C,uEAAuE;YACvE,qEAAqE;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gBAAgB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;gBAC/D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;gBACnD,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAA;gBAEnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA4C,CAAA;gBAC9E,IAAI,UAAU,GAAG,CAAC,CAAC,CAAA;gBACnB,iEAAiE;gBACjE,qEAAqE;gBACrE,qDAAqD;gBACrD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;oBACpD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;wBAAE,SAAQ;oBACnC,IAAI,MAAM,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/C,UAAU,GAAG,KAAK,CAAA;wBAClB,MAAK;oBACP,CAAC;gBACH,CAAC;gBACD,IAAI,UAAU,KAAK,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAA;gBAEnC,MAAM,OAAO,GAAG;oBACd,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACvC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CACnF;iBACF,CAAA;gBAED,qEAAqE;gBACrE,qEAAqE;gBACrE,iEAAiE;gBACjE,iEAAiE;gBACjE,gDAAgD;gBAChD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,UAAU,KAAK,eAAe,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,GAAG,CAAC,EAAE,eAAe,GAAG,CAAC,IAAI,EAAE,CACvG,CAAA;gBACD,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAA;YAC1C,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,eAAe,KAAK,oBAAoB,MAAM,eAAe,gBAAgB,EAAE,CACnF,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -7,19 +7,22 @@
  * bearer sessions, login-attempt backoff, MFA enforcement for sensitive
  * roles, and the hash-chained audit log L4's agents will write to as well.
  */
-export type { ApiKeyStore } from './api-keys.js';
-export { createApiKeyStore, looksLikeApiKey } from './api-keys.js';
-export type { AuditFilter, AuditLog } from './audit.js';
-export { createAuditLog } from './audit.js';
+export type { ApiKeyStore, ListApiKeysOptions, RotateApiKeyOptions, UpdateApiKeyInput, } from './api-keys.js';
+export { createApiKeyStore, DEFAULT_RATE_LIMIT_PER_MINUTE, looksLikeApiKey, MIN_PURGE_AFTER_REVOKED_DAYS, RECOVERY_WINDOW_MS, } from './api-keys.js';
+export type { AuditChainPoint, AuditFilter, AuditLog, AuditPruneResult, AuditVerifyRangeResult, } from './audit.js';
+export { classifyAuditActor, createAuditLog } from './audit.js';
+export type { AuditIntegrityStatus, AuditIntegrityStore } from './audit-integrity.js';
+export { createAuditIntegrityStore } from './audit-integrity.js';
 export type { CredentialStore, WebAuthnCredentialData } from './credentials.js';
 export { createCredentialStore } from './credentials.js';
-export type { AuthService, AuthServiceOptions, LoginResult } from './login.js';
+export type { AuthService, AuthServiceOptions, LoginContext, LoginResult, RecoveryCodesIssued, } from './login.js';
 export { createAuthService } from './login.js';
 export { requiresMfa, sensitiveRoles } from './mfa.js';
 export { hashPassword, verifyPassword } from './password.js';
 export type { LoginAttemptSummary, RateLimiter } from './rate-limit.js';
 export { createRateLimiter, LOGIN_ATTEMPT_WINDOW_MS } from './rate-limit.js';
-export type { IssuedPasswordReset, PasswordResetOutcome, PasswordResetStore, } from './resets.js';
+export { generateRecoveryCodes, hashRecoveryCode, normaliseRecoveryCode, RECOVERY_CODE_COUNT, verifyRecoveryCode, } from './recovery-codes.js';
+export type { IssuedPasswordReset, PasswordResetOutcome, PasswordResetStore, PendingReset, } from './resets.js';
 export { createPasswordResetStore, PASSWORD_RESET_TTL_MS } from './resets.js';
 export type { SessionStore } from './sessions.js';
 export { createSessionStore } from './sessions.js';
@@ -29,6 +32,8 @@ export { ensureAuthTables, TABLES as AUTH_TABLES } from './tables.js';
 export type { VerifyTotpOptions } from './totp.js';
 export { assertTotpSecretFormat, generateTotpSecret, totpUri, verifyTotp, } from './totp.js';
 export * from './types.js';
+export type { ParsedUserAgent } from './user-agent.js';
+export { parseUserAgent } from './user-agent.js';
 export type { UserStore } from './users.js';
 export { createUserStore } from './users.js';
 export type { AuthenticationOptions, RegistrationOptions, WebAuthnAuthenticationResult, WebAuthnConfig, } from './webauthn.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAClE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC5D,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAC5E,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAC7E,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,aAAa,CAAA;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,OAAO,EACP,UAAU,GACX,MAAM,WAAW,CAAA;AAClB,cAAc,YAAY,CAAA;AAC1B,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,YAAY,EACV,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAC5B,cAAc,GACf,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,eAAe,EACf,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC/D,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChE,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,mBAAmB,GACpB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC5D,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,YAAY,GACb,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAC7E,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,aAAa,CAAA;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,OAAO,EACP,UAAU,GACX,MAAM,WAAW,CAAA;AAClB,cAAc,YAAY,CAAA;AAC1B,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,YAAY,EACV,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAC5B,cAAc,GACf,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -7,19 +7,22 @@
  * bearer sessions, login-attempt backoff, MFA enforcement for sensitive
  * roles, and the hash-chained audit log L4's agents will write to as well.
  */
-export { createApiKeyStore, looksLikeApiKey } from './api-keys.js';
-export { createAuditLog } from './audit.js';
+export { createApiKeyStore, DEFAULT_RATE_LIMIT_PER_MINUTE, looksLikeApiKey, MIN_PURGE_AFTER_REVOKED_DAYS, RECOVERY_WINDOW_MS, } from './api-keys.js';
+export { classifyAuditActor, createAuditLog } from './audit.js';
+export { createAuditIntegrityStore } from './audit-integrity.js';
 export { createCredentialStore } from './credentials.js';
 export { createAuthService } from './login.js';
 export { requiresMfa, sensitiveRoles } from './mfa.js';
 export { hashPassword, verifyPassword } from './password.js';
 export { createRateLimiter, LOGIN_ATTEMPT_WINDOW_MS } from './rate-limit.js';
+export { generateRecoveryCodes, hashRecoveryCode, normaliseRecoveryCode, RECOVERY_CODE_COUNT, verifyRecoveryCode, } from './recovery-codes.js';
 export { createPasswordResetStore, PASSWORD_RESET_TTL_MS } from './resets.js';
 export { createSessionStore } from './sessions.js';
 export { createAuthStore } from './store.js';
 export { ensureAuthTables, TABLES as AUTH_TABLES } from './tables.js';
 export { assertTotpSecretFormat, generateTotpSecret, totpUri, verifyTotp, } from './totp.js';
 export * from './types.js';
+export { parseUserAgent } from './user-agent.js';
 export { createUserStore } from './users.js';
 export { beginWebAuthnAuthentication, beginWebAuthnRegistration, completeWebAuthnAuthentication, completeWebAuthnRegistration, } from './webauthn.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAM5E,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,aAAa,CAAA;AAErE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,OAAO,EACP,UAAU,GACX,MAAM,WAAW,CAAA;AAClB,cAAc,YAAY,CAAA;AAE1B,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAO5C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,eAAe,EACf,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,eAAe,CAAA;AAQtB,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAEhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAQxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAO5B,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,aAAa,CAAA;AAErE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,OAAO,EACP,UAAU,GACX,MAAM,WAAW,CAAA;AAClB,cAAc,YAAY,CAAA;AAE1B,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAO5C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,eAAe,CAAA"}

package/dist/login.d.ts

@@ -26,6 +26,35 @@ export interface TotpSetup {
     /** `otpauth://` URI, for a QR code the authenticator app scans. */
     readonly uri: string;
 }
+/**
+ * What confirming TOTP enrolment (or a later regeneration) hands back —
+ * fiche 18 task 1. `codes` is shown to the person **exactly once**: it is
+ * never returned again by any other call, and only its hash is kept.
+ */
+export interface RecoveryCodesIssued {
+    readonly codes: readonly string[];
+}
+/**
+ * What a caller resolved about the request making a sign-in call — fiche 18
+ * tasks 2 and 5. Optional everywhere: a caller that passes nothing gets
+ * exactly today's behaviour (no metadata, the default sliding session).
+ */
+export interface LoginContext {
+    /**
+     * Raw `User-Agent` header, if any. Distilled to a browser family and a
+     * device type at the point of writing (`sessions.ts`) and never stored
+     * whole — see that file's own comment.
+     */
+    readonly userAgent?: string;
+    /**
+     * Requested session lifetime in milliseconds. Absent means the default
+     * 30-day sliding window; "remember me" being left unchecked is what asks
+     * for a shorter one (fiche 18 task 5). Chosen at the password step and
+     * carried inside the MFA ticket to whichever step actually issues the
+     * session, since no session exists yet to hold it in.
+     */
+    readonly ttlMs?: number;
+}
 export interface WebAuthnRegistrationChallenge {
     readonly options: PublicKeyCredentialCreationOptionsJSON;
     readonly ticket: string;
@@ -53,8 +82,16 @@ export interface AuthServiceOptions {
     readonly now?: () => number;
 }
 export interface AuthService {
-    passwordLogin(email: string, password: string): Promise<LoginResult>;
-    totpLogin(ticket: string, token: string): Promise<LoginResult>;
+    passwordLogin(email: string, password: string, context?: LoginContext): Promise<LoginResult>;
+    totpLogin(ticket: string, token: string, context?: Pick<LoginContext, 'userAgent'>): Promise<LoginResult>;
+    /**
+     * Completes a sign-in with a recovery code instead of a TOTP code —
+     * fiche 18 task 1, the way back in for an account that lost the
+     * authenticator that would have produced one. The code is consumed
+     * atomically: a second attempt with the same code, even seconds later,
+     * fails exactly like a code that was never issued.
+     */
+    recoveryCodeLogin(ticket: string, code: string, context?: Pick<LoginContext, 'userAgent'>): Promise<LoginResult>;
     /** Issues a session directly: a verified passkey already proved a strong second factor. */
     sessionForVerifiedUser(userId: string): Promise<LoginResult>;
     /**
@@ -64,20 +101,40 @@ export interface AuthService {
      * is the one making the call.
      */
     beginTotpEnrolment(userId: string): Promise<TotpSetup>;
-    /** Confirms the code from the authenticator app, which is what makes the factor real. */
-    confirmTotpEnrolment(userId: string, token: string): Promise<void>;
+    /**
+     * Confirms the code from the authenticator app, which is what makes the
+     * factor real — and, in the same step, issues ten recovery codes (fiche 18
+     * task 1). TOTP without recovery codes is a lock with one key: losing the
+     * authenticator becomes a permanent lockout the moment this returns, so the
+     * two are minted together rather than as a second, skippable step.
+     */
+    confirmTotpEnrolment(userId: string, token: string): Promise<RecoveryCodesIssued>;
     /**
      * Turns TOTP back off. No second proof is asked for: the caller already
      * holds a live session for this account, which — if TOTP was on — they could
-     * only have obtained by passing it.
+     * only have obtained by passing it. Recovery codes go with it: they exist
+     * to be a spare key for TOTP, and there is nothing left for them to unlock
+     * once it is off.
      */
     disableTotp(userId: string): Promise<void>;
+    /**
+     * Replaces this account's recovery codes with a fresh batch, invalidating
+     * every code from the previous one (fiche 18 task 1). Requires a confirmed
+     * TOTP factor — a recovery code with nothing to recover from is not a
+     * feature.
+     */
+    regenerateRecoveryCodes(userId: string): Promise<RecoveryCodesIssued>;
+    /** How many recovery codes remain unused, for the profile screen's counter. `{ total: 0, remaining: 0 }` if none were ever issued. */
+    recoveryCodesStatus(userId: string): Promise<{
+        readonly total: number;
+        readonly remaining: number;
+    }>;
     /** Adding a passkey to an already-identified account — `userId` comes from an existing session. */
     beginWebAuthnRegistration(userId: string): Promise<WebAuthnRegistrationChallenge>;
     completeWebAuthnRegistration(ticket: string, response: RegistrationResponseJSON, label?: string): Promise<void>;
     /** Usernameless: no account is named up front, so any resident passkey the browser offers can answer. */
     beginWebAuthnLogin(): Promise<WebAuthnAuthenticationChallenge>;
-    completeWebAuthnLogin(ticket: string, response: AuthenticationResponseJSON): Promise<LoginResult>;
+    completeWebAuthnLogin(ticket: string, response: AuthenticationResponseJSON, context?: Pick<LoginContext, 'userAgent'>): Promise<LoginResult>;
 }
 export declare function createAuthService(options: AuthServiceOptions): AuthService;
 //# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,KAAK,EACV,0BAA0B,EAC1B,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACzB,MAAM,wBAAwB,CAAA;AAK/B,OAAO,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAErD,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAA;AA6EtB;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACpF;IACE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAA;CAC5D,CAAA;AAEL,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAA;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,qCAAqC,CAAA;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACpE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9D,2FAA2F;IAC3F,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC5D;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACtD,yFAAyF;IACzF,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE;;;;OAIG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C,mGAAmG;IACnG,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAA;IACjF,4BAA4B,CAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,EAClC,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,yGAAyG;IACzG,kBAAkB,IAAI,OAAO,CAAC,+BAA+B,CAAC,CAAA;IAC9D,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,0BAA0B,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CAClG;AAkBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CA4P1E"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,KAAK,EACV,0BAA0B,EAC1B,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACzB,MAAM,wBAAwB,CAAA;AAM/B,OAAO,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAErD,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAA;AAsFtB;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACpF;IACE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAA;CAC5D,CAAA;AAEL,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAA;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,qCAAqC,CAAA;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC5F,SAAS,CACP,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,GACxC,OAAO,CAAC,WAAW,CAAC,CAAA;IACvB;;;;;;OAMG;IACH,iBAAiB,CACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,GACxC,OAAO,CAAC,WAAW,CAAC,CAAA;IACvB,2FAA2F;IAC3F,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC5D;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACtD;;;;;;OAMG;IACH,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACjF;;;;;;OAMG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;;;;OAKG;IACH,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACrE,sIAAsI;IACtI,mBAAmB,CACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClE,mGAAmG;IACnG,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAA;IACjF,4BAA4B,CAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,EAClC,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,yGAAyG;IACzG,kBAAkB,IAAI,OAAO,CAAC,+BAA+B,CAAC,CAAA;IAC9D,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,0BAA0B,EACpC,OAAO,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,GACxC,OAAO,CAAC,WAAW,CAAC,CAAA;CACxB;AAkBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CA0V1E"}

package/dist/login.js

@@ -2,6 +2,7 @@ import { createHmac, timingSafeEqual } from 'node:crypto';
 import { CogentaError } from '@cogenta/core';
 import { createCredentialStore } from './credentials.js';
 import { createRateLimiter } from './rate-limit.js';
+import { generateRecoveryCodes, hashRecoveryCode } from './recovery-codes.js';
 import { createSessionStore } from './sessions.js';
 import { generateTotpSecret, totpUri, verifyTotp } from './totp.js';
 import { createUserStore } from './users.js';
@@ -51,7 +52,9 @@ function verifyTicket(key, purpose, ticket, now) {
             return null;
         if (parsed.challenge !== undefined && typeof parsed.challenge !== 'string')
             return null;
-        return { userId: parsed.userId, challenge: parsed.challenge };
+        if (parsed.ttlMs !== undefined && typeof parsed.ttlMs !== 'number')
+            return null;
+        return { userId: parsed.userId, challenge: parsed.challenge, ttlMs: parsed.ttlMs };
     }
     catch {
         return null;
@@ -83,10 +86,33 @@ export function createAuthService(options) {
     const credentials = createCredentialStore(db, now);
     const sessions = createSessionStore(db, now);
     const rateLimit = createRateLimiter(db, now);
-    async function issueSession(user) {
-        const session = await sessions.create(user.id);
+    async function issueSession(user, context) {
+        const session = await sessions.create(user.id, {
+            ...(context?.userAgent === undefined ? {} : { userAgent: context.userAgent }),
+            ...(context?.ttlMs === undefined ? {} : { ttlMs: context.ttlMs }),
+        });
         return { status: 'session', session, user };
     }
+    /**
+     * Builds the `issueSession` context for a step completing an MFA ticket: the
+     * `userAgent` this HTTP request carried, plus the `ttlMs` "remember me"
+     * chose at the password step and which rode inside the ticket ever since.
+     * `exactOptionalPropertyTypes` means an explicit `undefined` is not the same
+     * as an absent key, so each part is added only when it actually has a value.
+     */
+    function sessionContextFrom(context, ttlMs) {
+        return {
+            ...(context?.userAgent === undefined ? {} : { userAgent: context.userAgent }),
+            ...(ttlMs === undefined ? {} : { ttlMs }),
+        };
+    }
+    /** Ten fresh codes, hashed and stored, replacing any still outstanding. */
+    async function issueRecoveryCodes(userId) {
+        const codes = generateRecoveryCodes();
+        const hashes = await Promise.all(codes.map((code) => hashRecoveryCode(code)));
+        await credentials.setRecoveryCodes(userId, hashes);
+        return { codes };
+    }
     /**
      * The second factors this account has actually finished setting up.
      *
@@ -104,19 +130,20 @@ export function createAuthService(options) {
             available.push('webauthn');
         return available;
     }
-    function mfaChallenge(user, available) {
+    function mfaChallenge(user, available, ttlMs) {
         return {
             status: 'mfa_required',
             ticket: signTicket(signingKey, {
                 purpose: 'login',
                 userId: user.id,
                 expiresAt: now() + TICKET_TTL_MS,
+                ...(ttlMs === undefined ? {} : { ttlMs }),
             }),
             availableFactors: available,
         };
     }
     return {
-        passwordLogin: async (email, password) => {
+        passwordLogin: async (email, password, context) => {
             const subject = email.trim().toLowerCase();
             await rateLimit.check(subject);
             const user = await users.byEmail(subject);
@@ -136,9 +163,11 @@ export function createAuthService(options) {
             // ignoring a factor someone deliberately enabled would be a silent
             // downgrade of their own security.
             const factors = await enrolledFactors(user.id);
-            return factors.length === 0 ? issueSession(user) : mfaChallenge(user, factors);
+            return factors.length === 0
+                ? issueSession(user, context)
+                : mfaChallenge(user, factors, context?.ttlMs);
         },
-        totpLogin: async (ticket, token) => {
+        totpLogin: async (ticket, token, context) => {
             const verified = verifyTicket(signingKey, 'login', ticket, now());
             if (verified === null || verified.userId === null)
                 throw invalidTicket();
@@ -165,7 +194,37 @@ export function createAuthService(options) {
                 });
             }
             await rateLimit.clear(`mfa:${userId}`);
-            return issueSession(user);
+            return issueSession(user, sessionContextFrom(context, verified.ttlMs));
+        },
+        recoveryCodeLogin: async (ticket, code, context) => {
+            const verified = verifyTicket(signingKey, 'login', ticket, now());
+            if (verified === null || verified.userId === null)
+                throw invalidTicket();
+            const userId = verified.userId;
+            // Its own rate-limit subject, independent of `mfa:` (the TOTP guess
+            // counter) and `totp-setup:` — a wrong code here is a different event
+            // from a wrong 6-digit code, and neither should give the other a free
+            // pass on attempts.
+            await rateLimit.check(`recovery:${userId}`);
+            const consumed = await credentials.consumeRecoveryCode(userId, code);
+            if (!consumed) {
+                await rateLimit.record(`recovery:${userId}`);
+                throw new CogentaError({
+                    code: 'AUTH_RECOVERY_CODE_INVALID',
+                    message: 'This recovery code is not valid.',
+                    hint: 'Check you typed it exactly as it was shown, dashes included. Each code works once.',
+                });
+            }
+            const user = await users.byId(userId);
+            if (user === null) {
+                throw new CogentaError({
+                    code: 'AUTH_USER_NOT_FOUND',
+                    message: 'This account no longer exists.',
+                    hint: 'It may have been deleted between the password step and this one. Sign in again.',
+                });
+            }
+            await rateLimit.clear(`recovery:${userId}`);
+            return issueSession(user, sessionContextFrom(context, verified.ttlMs));
         },
         sessionForVerifiedUser: async (userId) => {
             const user = await users.byId(userId);
@@ -207,9 +266,30 @@ export function createAuthService(options) {
             }
             await rateLimit.clear(`totp-setup:${userId}`);
             await credentials.confirmTotp(userId);
+            // Minted in the same step, not a follow-up the person could skip: TOTP
+            // with no recovery codes is a lock with exactly one key, and losing the
+            // authenticator would be a permanent lockout the moment this returns.
+            return issueRecoveryCodes(userId);
         },
         disableTotp: async (userId) => {
             await credentials.removeTotp(userId);
+            // Nothing left for them to be a spare key for once TOTP itself is off.
+            await credentials.removeRecoveryCodes(userId);
+        },
+        regenerateRecoveryCodes: async (userId) => {
+            const totp = await credentials.totpSecret(userId);
+            if (totp === null || !totp.verified) {
+                throw new CogentaError({
+                    code: 'AUTH_RECOVERY_CODES_UNAVAILABLE',
+                    message: 'Recovery codes exist to get back in when two-step verification is unusable.',
+                    hint: 'Turn on two-step verification first — recovery codes are issued the moment it is confirmed.',
+                });
+            }
+            return issueRecoveryCodes(userId);
+        },
+        recoveryCodesStatus: async (userId) => {
+            const status = await credentials.recoveryCodesStatus(userId);
+            return status ?? { total: 0, remaining: 0 };
         },
         beginWebAuthnRegistration: async (userId) => {
             if (webauthnConfig === undefined)
@@ -261,7 +341,7 @@ export function createAuthService(options) {
                 }),
             };
         },
-        completeWebAuthnLogin: async (ticket, response) => {
+        completeWebAuthnLogin: async (ticket, response, context) => {
             if (webauthnConfig === undefined)
                 throw webauthnNotConfigured();
             const verified = verifyTicket(signingKey, 'webauthn_login', ticket, now());
@@ -284,7 +364,7 @@ export function createAuthService(options) {
                     message: 'This account no longer exists or is disabled.',
                 });
             }
-            return issueSession(user);
+            return issueSession(user, context);
         },
     };
 }

package/dist/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAA;AAQjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,eAAe,CAAA;AAEtB,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAkBnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAAsB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC/E,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAA;AAClC,CAAC;AAED,SAAS,YAAY,CACnB,GAAW,EACX,OAAsB,EACtB,MAAc,EACd,GAAW;IAEX,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAEjE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC9E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAEhE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAKrE,CAAA;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC5E,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,IAAI,CAAA;QAChF,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACvF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAsFD,SAAS,aAAa;IACpB,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,iDAAiD;QAC1D,IAAI,EAAE,oCAAoC;KAC3C,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,4CAA4C;QACrD,IAAI,EAAE,iFAAiF;KACxF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,sEAAsE;IACtE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,OAAO,CAAA;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAA;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtC,MAAM,WAAW,GAAG,qBAAqB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAE5C,KAAK,UAAU,YAAY,CAAC,IAAU;QACpC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC7C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,eAAe,CAAC,MAAc;QAC3C,MAAM,SAAS,GAA4B,EAAE,CAAA;QAC7C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC1F,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,SAAS,YAAY,CAAC,IAAU,EAAE,SAA2C;QAC3E,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;gBAC7B,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;aACjC,CAAC;YACF,gBAAgB,EAAE,SAAS;SAC5B,CAAA;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC1C,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAE9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACzC,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAA;YAEpF,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAC/B,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,mEAAmE;iBAC1E,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC9B,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,mCAAmC;YACnC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC9C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAChF,CAAC;QAED,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACjE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;gBAAE,MAAM,aAAa,EAAE,CAAA;YACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;YAE9B,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,MAAM,EAAE,CAAC,CAAA;YACtC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACnD,MAAM,EAAE,GACN,MAAM,KAAK,IAAI;gBACf,MAAM,CAAC,QAAQ;gBACf,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;YAErE,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,MAAM,EAAE,CAAC,CAAA;gBACvC,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,6EAA6E;iBACpF,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gCAAgC;oBACzC,IAAI,EAAE,iFAAiF;iBACxF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,MAAM,EAAE,CAAC,CAAA;YACtC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,+CAA+C;iBACzD,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,+CAA+C;oBACxD,IAAI,EAAE,gBAAgB;iBACvB,CAAC,CAAA;YACJ,CAAC;YAED,qEAAqE;YACrE,iEAAiE;YACjE,sEAAsE;YACtE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;YACnC,MAAM,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YAChD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;QAC7D,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;YAC5C,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,MAAM,EAAE,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACnD,MAAM,EAAE,GACN,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;YAExF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,SAAS,CAAC,MAAM,CAAC,cAAc,MAAM,EAAE,CAAC,CAAA;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,6EAA6E;iBACpF,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,MAAM,EAAE,CAAC,CAAA;YAC7C,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACvC,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5B,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACtC,CAAC;QAED,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gCAAgC;iBAC1C,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;YAC9D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,yBAAyB,CAC5D,cAAc,EACd,MAAM,EACN,IAAI,CAAC,KAAK,EACV,QAAQ,CACT,CAAA;YACD,OAAO;gBACL,OAAO;gBACP,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,mBAAmB;oBAC5B,MAAM;oBACN,SAAS;oBACT,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;iBACjC,CAAC;aACH,CAAA;QACH,CAAC;QAED,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9D,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC7E,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACtF,MAAM,aAAa,EAAE,CAAA;YACvB,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,4BAA4B,CACnD,cAAc,EACd,QAAQ,EACR,QAAQ,CAAC,SAAS,EAClB,KAAK,CACN,CAAA;YACD,MAAM,WAAW,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QACtE,CAAC;QAED,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAC7B,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,qDAAqD;YACrD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,2BAA2B,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;YACpF,OAAO;gBACL,OAAO;gBACP,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,gBAAgB;oBACzB,MAAM,EAAE,IAAI;oBACZ,SAAS;oBACT,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;iBACjC,CAAC;aACH,CAAA;QACH,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1E,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,aAAa,EAAE,CAAA;YAEhF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,8BAA8B,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAC3E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,kDAAkD;oBAC3D,IAAI,EAAE,yFAAyF;iBAChG,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,8BAA8B,CACjD,cAAc,EACd,QAAQ,EACR,QAAQ,CAAC,SAAS,EAClB,KAAK,CAAC,IAAI,CACX,CAAA;YACD,MAAM,WAAW,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;YAEnF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,+CAA+C;iBACzD,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAA;AAQjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,eAAe,CAAA;AAEtB,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAyBnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAAsB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC/E,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAA;AAClC,CAAC;AAED,SAAS,YAAY,CACnB,GAAW,EACX,OAAsB,EACtB,MAAc,EACd,GAAW;IAEX,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAEjE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC9E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAEhE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAMrE,CAAA;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC5E,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,IAAI,CAAA;QAChF,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACvF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AA4JD,SAAS,aAAa;IACpB,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,iDAAiD;QAC1D,IAAI,EAAE,oCAAoC;KAC3C,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,4CAA4C;QACrD,IAAI,EAAE,iFAAiF;KACxF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,sEAAsE;IACtE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,OAAO,CAAA;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAA;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtC,MAAM,WAAW,GAAG,qBAAqB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAE5C,KAAK,UAAU,YAAY,CACzB,IAAU,EACV,OAAuE;QAEvE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;YAC7C,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7E,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;SAClE,CAAC,CAAA;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC7C,CAAC;IAED;;;;;;OAMG;IACH,SAAS,kBAAkB,CACzB,OAAoD,EACpD,KAAyB;QAEzB,OAAO;YACL,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7E,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,KAAK,UAAU,kBAAkB,CAAC,MAAc;QAC9C,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAA;QACrC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC7E,MAAM,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAClD,OAAO,EAAE,KAAK,EAAE,CAAA;IAClB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,eAAe,CAAC,MAAc;QAC3C,MAAM,SAAS,GAA4B,EAAE,CAAA;QAC7C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC1F,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,SAAS,YAAY,CACnB,IAAU,EACV,SAA2C,EAC3C,KAAyB;QAEzB,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;gBAC7B,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;gBAChC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C,CAAC;YACF,gBAAgB,EAAE,SAAS;SAC5B,CAAA;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;YAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC1C,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAE9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACzC,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAA;YAEpF,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAC/B,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,mEAAmE;iBAC1E,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC9B,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,mCAAmC;YACnC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC9C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;gBACzB,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;gBAC7B,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACjD,CAAC;QAED,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1C,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACjE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;gBAAE,MAAM,aAAa,EAAE,CAAA;YACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;YAE9B,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,MAAM,EAAE,CAAC,CAAA;YACtC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACnD,MAAM,EAAE,GACN,MAAM,KAAK,IAAI;gBACf,MAAM,CAAC,QAAQ;gBACf,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;YAErE,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,MAAM,EAAE,CAAC,CAAA;gBACvC,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,6EAA6E;iBACpF,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gCAAgC;oBACzC,IAAI,EAAE,iFAAiF;iBACxF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,MAAM,EAAE,CAAC,CAAA;YACtC,OAAO,YAAY,CAAC,IAAI,EAAE,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACxE,CAAC;QAED,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;YACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACjE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;gBAAE,MAAM,aAAa,EAAE,CAAA;YACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;YAE9B,oEAAoE;YACpE,sEAAsE;YACtE,sEAAsE;YACtE,oBAAoB;YACpB,MAAM,SAAS,CAAC,KAAK,CAAC,YAAY,MAAM,EAAE,CAAC,CAAA;YAC3C,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAEpE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,MAAM,EAAE,CAAC,CAAA;gBAC5C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,kCAAkC;oBAC3C,IAAI,EAAE,oFAAoF;iBAC3F,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gCAAgC;oBACzC,IAAI,EAAE,iFAAiF;iBACxF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,SAAS,CAAC,KAAK,CAAC,YAAY,MAAM,EAAE,CAAC,CAAA;YAC3C,OAAO,YAAY,CAAC,IAAI,EAAE,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACxE,CAAC;QAED,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,+CAA+C;iBACzD,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,+CAA+C;oBACxD,IAAI,EAAE,gBAAgB;iBACvB,CAAC,CAAA;YACJ,CAAC;YAED,qEAAqE;YACrE,iEAAiE;YACjE,sEAAsE;YACtE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;YACnC,MAAM,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YAChD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;QAC7D,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;YAC5C,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,MAAM,EAAE,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACnD,MAAM,EAAE,GACN,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;YAExF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,SAAS,CAAC,MAAM,CAAC,cAAc,MAAM,EAAE,CAAC,CAAA;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,6EAA6E;iBACpF,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,MAAM,EAAE,CAAC,CAAA;YAC7C,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACrC,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5B,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACpC,uEAAuE;YACvE,MAAM,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;QAC/C,CAAC;QAED,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACjD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,iCAAiC;oBACvC,OAAO,EAAE,6EAA6E;oBACtF,IAAI,EAAE,6FAA6F;iBACpG,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;YAC5D,OAAO,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAA;QAC7C,CAAC;QAED,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gCAAgC;iBAC1C,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;YAC9D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,yBAAyB,CAC5D,cAAc,EACd,MAAM,EACN,IAAI,CAAC,KAAK,EACV,QAAQ,CACT,CAAA;YACD,OAAO;gBACL,OAAO;gBACP,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,mBAAmB;oBAC5B,MAAM;oBACN,SAAS;oBACT,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;iBACjC,CAAC;aACH,CAAA;QACH,CAAC;QAED,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9D,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC7E,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACtF,MAAM,aAAa,EAAE,CAAA;YACvB,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,4BAA4B,CACnD,cAAc,EACd,QAAQ,EACR,QAAQ,CAAC,SAAS,EAClB,KAAK,CACN,CAAA;YACD,MAAM,WAAW,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QACtE,CAAC;QAED,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAC7B,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,qDAAqD;YACrD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,2BAA2B,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;YACpF,OAAO;gBACL,OAAO;gBACP,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,gBAAgB;oBACzB,MAAM,EAAE,IAAI;oBACZ,SAAS;oBACT,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;iBACjC,CAAC;aACH,CAAA;QACH,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;YACzD,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1E,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,aAAa,EAAE,CAAA;YAEhF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,8BAA8B,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAC3E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,kDAAkD;oBAC3D,IAAI,EAAE,yFAAyF;iBAChG,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,8BAA8B,CACjD,cAAc,EACd,QAAQ,EACR,QAAQ,CAAC,SAAS,EAClB,KAAK,CAAC,IAAI,CACX,CAAA;YACD,MAAM,WAAW,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;YAEnF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,+CAA+C;iBACzD,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACpC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/mfa.d.ts

@@ -1,4 +1,4 @@
-import type { CollectionDefinition } from '@cogenta/schema';
+import { type CollectionDefinition } from '@cogenta/schema';
 export declare function sensitiveRoles(collections: readonly CollectionDefinition[]): ReadonlySet<string>;
 /** Whether this set of roles is one MFA is recommended for. Never a gate — see above. */
 export declare function requiresMfa(userRoles: readonly string[], collections: readonly CollectionDefinition[]): boolean;

package/dist/mfa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AA2B3D,wBAAgB,cAAc,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAMhG;AAED,yFAAyF;AACzF,wBAAgB,WAAW,CACzB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAC3C,OAAO,CAGT"}
+{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,oBAAoB,EAA2B,MAAM,iBAAiB,CAAA;AA2BpF,wBAAgB,cAAc,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAQhG;AAED,yFAAyF;AACzF,wBAAgB,WAAW,CACzB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAC3C,OAAO,CAGT"}

package/dist/mfa.js

@@ -1,3 +1,4 @@
+import { normalisePermissionRule } from '@cogenta/schema';
 /**
  * Which roles are sensitive enough that a second factor is *recommended*.
  *
@@ -25,8 +26,9 @@ const ALWAYS_SENSITIVE_ROLES = new Set(['admin']);
 export function sensitiveRoles(collections) {
     const roles = new Set(ALWAYS_SENSITIVE_ROLES);
     for (const collection of collections) {
-        for (const role of collection.permissions.publish ?? [])
+        for (const role of normalisePermissionRule(collection.permissions.publish).roles) {
             roles.add(role);
+        }
     }
     return roles;
 }

package/dist/mfa.js.map

@@ -1 +1 @@
-{"version":3,"file":"mfa.js","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;AAEjD,MAAM,UAAU,cAAc,CAAC,WAA4C;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAA;IAC7C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,OAAO,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,WAAW,CACzB,SAA4B,EAC5B,WAA4C;IAE5C,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,CAAA;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AACtD,CAAC"}
+{"version":3,"file":"mfa.js","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;AAEjD,MAAM,UAAU,cAAc,CAAC,WAA4C;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAA;IAC7C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,uBAAuB,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC;YACjF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,WAAW,CACzB,SAA4B,EAC5B,WAA4C;IAE5C,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,CAAA;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AACtD,CAAC"}

package/dist/recovery-codes.d.ts

@@ -0,0 +1,25 @@
+/**
+ * TOTP recovery codes (fiche 18 task 1) — the way back in for an account that
+ * enrolled a second factor and then lost the device that produces it.
+ *
+ * Without this, `docs/lots/17-utilisateurs.md`'s deliberate decision not to let
+ * an admin reset somebody else's password, combined with a lost authenticator,
+ * is a permanent lockout. A recovery code is, in every way that matters, a
+ * spare password: ten of them are generated at once, shown to the person
+ * exactly once, and stored **hashed with the same scrypt as a real password**
+ * (`password.ts`) rather than a lighter or reversible encoding — a leaked
+ * credentials table must hand out nothing live here either.
+ */
+export declare const RECOVERY_CODE_COUNT = 10;
+/** `count` fresh, distinct plaintext codes. The caller shows them to the person exactly once and never logs them. */
+export declare function generateRecoveryCodes(count?: number): readonly string[];
+/**
+ * What a person actually types back rarely matches the display exactly —
+ * lowercase, a missing dash, stray whitespace copied along with it. None of
+ * that is part of the secret, so it is normalised away before hashing and
+ * before verifying, on both sides, the same way.
+ */
+export declare function normaliseRecoveryCode(input: string): string;
+export declare function hashRecoveryCode(code: string): Promise<string>;
+export declare function verifyRecoveryCode(code: string, hash: string): Promise<boolean>;
+//# sourceMappingURL=recovery-codes.d.ts.map

package/dist/recovery-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-codes.d.ts","sourceRoot":"","sources":["../src/recovery-codes.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,mBAAmB,KAAK,CAAA;AAoBrC,qHAAqH;AACrH,wBAAgB,qBAAqB,CAAC,KAAK,GAAE,MAA4B,GAAG,SAAS,MAAM,EAAE,CAI5F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK3D;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE/E"}