@gauts/auth 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 GVALFER
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,222 @@
+# `@gauts/auth`
+
+Reusable password and opaque server-side session authentication for Node.js applications.
+
+`@gauts/auth` validates sessions through Redis and records session history through an application-owned database adapter. It does not create endpoints, database models, users, or application authorization rules.
+
+The package is under active development and has not been published yet.
+
+## Design
+
+- Argon2id by default, with explicit bcrypt support.
+- One stable 256-bit opaque browser token per session.
+- SHA-256 token hashes in Redis and the audit database.
+- Redis-authoritative authentication with no database fallback.
+- Sliding inactivity expiration without an absolute lifetime.
+- Exact canonical IP and complete User-Agent session binding.
+- Framework integrations through explicit package exports.
+
+## Installation
+
+```bash
+npm install @gauts/auth redis hono
+```
+
+The package is not on npm yet. During local development, use the tarball produced by `npm pack`.
+
+## Setup
+
+```ts
+import { createAuth, type SessionAudit } from "@gauts/auth";
+import { createHonoAdapter } from "@gauts/auth/hono";
+import { createRedisStore } from "@gauts/auth/redis";
+
+const audit: SessionAudit = {
+  create: (session) => db.sessions.create(session),
+  findActive: (subjectId, now) => db.sessions.findActive(subjectId, now),
+  findForRevoke: (subjectId, sessionId) => db.sessions.findForRevoke(subjectId, sessionId),
+  revoke: (sessionIds, revokedAt) => db.sessions.revoke(sessionIds, revokedAt),
+  touch: (sessionId, expiresAt, updatedAt) => db.sessions.touch(sessionId, expiresAt, updatedAt),
+};
+
+type AccountSession = {
+  email: string;
+  role: "owner" | "admin";
+};
+
+const auth = createAuth<AccountSession>({
+  redis: createRedisStore(redis, { prefix: "my-app:auth" }),
+  audit,
+  session: {
+    ttl: 60 * 60 * 24 * 7,
+    touchAfter: 60 * 60 * 24,
+    max: 10,
+  },
+});
+
+const hono = createHonoAdapter({
+  auth,
+  getClient: (c) => ({
+    ip: getTrustedClientIp(c),
+    userAgent: c.req.header("user-agent") ?? null,
+  }),
+});
+```
+
+The application must obtain the client IP according to its own trusted-proxy configuration. The package canonicalizes the supplied IPv4 or IPv6 value but never decides which forwarding headers are trusted.
+
+## Passwords
+
+Argon2id is the default:
+
+```ts
+const hash = await auth.password.hash(password);
+const valid = await auth.password.verify(password, hash);
+```
+
+Applications whose database contains bcrypt hashes select bcrypt explicitly:
+
+```ts
+const auth = createAuth({
+  password: {
+    algorithm: "bcrypt",
+  },
+  redis: createRedisStore(redis),
+  audit,
+});
+```
+
+The configured algorithm is used for both hashing and verification. The package does not detect, convert, migrate, or fall back to another algorithm.
+
+## Login
+
+The application owns the endpoint and account lookup:
+
+```ts
+app.post("/auth/login", async (c) => {
+  const { email, password } = await c.req.json();
+  const account = await findAccount(email);
+
+  if (!account || !(await auth.password.verify(password, account.passwordHash))) {
+    return c.json({ error: "Invalid credentials." }, 401);
+  }
+
+  const created = await auth.session.create({
+    subjectId: account.id,
+    data: {
+      email: account.email,
+      role: account.role,
+    },
+    client: await getClient(c),
+  });
+
+  hono.setSession(c, created);
+
+  return c.json({ account: created.session.data });
+});
+```
+
+Applications must apply their own login rate limiting and account-enumeration protection.
+
+## Protected routes
+
+```ts
+app.get("/account", hono.requireSession, async (c) => {
+  const session = c.get("authSession");
+  const account = await findAccountById(session.subjectId);
+
+  return c.json({ account });
+});
+```
+
+The middleware reads the cookie, resolves Redis, compares IP and User-Agent, renews expiry when due, and places the typed session in the Hono context. It does not load application data from the database.
+
+## Logout
+
+```ts
+app.post("/auth/logout", async (c) => {
+  const token = hono.getToken(c);
+
+  if (token) {
+    await auth.session.revokeToken(token);
+  }
+
+  hono.clearSession(c);
+  return c.body(null, 204);
+});
+```
+
+## Active sessions
+
+```ts
+const sessions = await auth.session.list(accountId);
+
+await auth.session.revoke({
+  subjectId: accountId,
+  sessionId,
+});
+
+await auth.session.revokeSubject(accountId);
+```
+
+The audit database supplies session history. Redis is checked in a batch before a session is reported as active. Token hashes are never returned by `list`.
+
+## Synchronizing session data
+
+When cached session claims change:
+
+```ts
+await auth.session.sync(accountId, {
+  email: account.email,
+  role: account.role,
+});
+```
+
+Synchronization preserves the existing token and Redis TTL.
+
+## Session audit contract
+
+Each consuming application maps `SessionAudit` to its database. The durable record contains:
+
+- Session ID.
+- Subject ID and relation owned by the application.
+- SHA-256 token hash.
+- Canonical IP.
+- Country and platform metadata.
+- Complete User-Agent.
+- Creation, current expiry, update, and revocation timestamps.
+
+The database never stores the raw browser token.
+
+## Expiration
+
+Defaults:
+
+```ts
+session: {
+  ttl: 7 * 24 * 60 * 60,
+  touchAfter: 24 * 60 * 60,
+  max: 10,
+}
+```
+
+- Inactive sessions expire after seven days.
+- Active sessions renew at most once every 24 hours.
+- Renewal keeps the same browser token.
+- There is no absolute session lifetime.
+
+## Client mismatch
+
+If the canonical IP or complete User-Agent differs, the package deletes the Redis session first and marks its audit record as revoked. Clearing the response cookie is client cleanup; Redis deletion is what removes access.
+
+Strict IP binding can log out legitimate users whose public IP changes. It is defense in depth and does not replace TLS, secure cookies, CSRF protection, XSS prevention, or re-authentication for sensitive actions.
+
+## Package exports
+
+```text
+@gauts/auth        createAuth and public core types
+@gauts/auth/redis  createRedisStore
+@gauts/auth/hono   createHonoAdapter
+```
+
+See [`PLAN.md`](./PLAN.md) for the implementation phases and complete security decisions.

package/SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+
+`@gauts/auth` is not published yet and currently has no supported release.
+
+Do not open a public issue for a suspected vulnerability. Contact the package owner privately with a minimal reproduction and impact description.

package/dist/adapters/hono/index.d.ts

@@ -0,0 +1,30 @@
+import type { Context, Env, MiddlewareHandler } from "hono";
+import type { Auth } from "../../auth.js";
+import type { SessionClientInput } from "../../client/index.js";
+import type { CreatedSession, Session } from "../../session/types.js";
+export type HonoAuthVariables<TData extends object> = {
+    authSession: Session<TData>;
+};
+export type HonoAuthEnv<TData extends object> = Env & {
+    Variables: HonoAuthVariables<TData>;
+};
+export type HonoCookieConfig = {
+    domain?: string;
+    name?: string;
+    path?: string;
+    sameSite?: "Strict" | "Lax" | "None";
+    secure?: boolean;
+};
+export type HonoAdapterConfig<TData extends object> = {
+    auth: Auth<TData>;
+    cookie?: HonoCookieConfig;
+    getClient: (c: Context) => Promise<SessionClientInput> | SessionClientInput;
+};
+export type HonoAdapter<TData extends object> = {
+    clearSession(c: Context): void;
+    getToken(c: Context): string | null;
+    requireSession: MiddlewareHandler<HonoAuthEnv<TData>>;
+    setSession(c: Context, created: CreatedSession<TData>): void;
+};
+export declare const createHonoAdapter: <TData extends object>({ auth, cookie, getClient, }: HonoAdapterConfig<TData>) => HonoAdapter<TData>;
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/hono/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/hono/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG5D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEtE,MAAM,MAAM,iBAAiB,CAAC,KAAK,SAAS,MAAM,IAAI;IACpD,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,IAAI,GAAG,GAAG;IACpD,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,KAAK,SAAS,MAAM,IAAI;IACpD,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;CAC7E,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,IAAI;IAC9C,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,cAAc,EAAE,iBAAiB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACtD,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;CAC9D,CAAC;AA6CF,eAAO,MAAM,iBAAiB,GAAI,KAAK,SAAS,MAAM,EAAE,8BAIrD,iBAAiB,CAAC,KAAK,CAAC,KAAG,WAAW,CAAC,KAAK,CA+D9C,CAAC"}

package/dist/adapters/hono/index.js

@@ -0,0 +1,87 @@
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { createError, isAuthError } from "../../errors.js";
+const COOKIE_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const resolveCookie = (config = {}) => {
+    const name = config.name ?? "__Host-session";
+    const path = config.path ?? "/";
+    const sameSite = config.sameSite ?? "Lax";
+    const secure = config.secure ?? true;
+    if (!COOKIE_NAME_PATTERN.test(name)) {
+        throw createError("AUTH_CONFIG_INVALID", "Session cookie name is invalid.");
+    }
+    if (!path.startsWith("/")) {
+        throw createError("AUTH_CONFIG_INVALID", "Session cookie path must start with /.");
+    }
+    if (name.startsWith("__Host-") && (!secure || path !== "/" || config.domain)) {
+        throw createError("AUTH_CONFIG_INVALID", "__Host- cookies require secure=true, path=/, and no domain.");
+    }
+    if (name.startsWith("__Secure-") && !secure) {
+        throw createError("AUTH_CONFIG_INVALID", "__Secure- cookies require secure=true.");
+    }
+    if (sameSite === "None" && !secure) {
+        throw createError("AUTH_CONFIG_INVALID", "SameSite=None cookies require secure=true.");
+    }
+    return {
+        name,
+        options: {
+            ...(config.domain ? { domain: config.domain } : {}),
+            httpOnly: true,
+            path,
+            sameSite,
+            secure,
+        },
+    };
+};
+export const createHonoAdapter = ({ auth, cookie, getClient, }) => {
+    const resolved = resolveCookie(cookie);
+    const getToken = (c) => {
+        const token = getCookie(c, resolved.name)?.trim();
+        return token?.length ? token : null;
+    };
+    const setToken = (c, token, expiresAt) => {
+        setCookie(c, resolved.name, token, {
+            ...resolved.options,
+            expires: expiresAt,
+        });
+    };
+    const clearSession = (c) => {
+        deleteCookie(c, resolved.name, resolved.options);
+    };
+    const requireSession = async (c, next) => {
+        const token = getToken(c);
+        if (!token) {
+            throw createError("SESSION_INVALID", "Authentication required.");
+        }
+        let resolvedSession;
+        try {
+            resolvedSession = await auth.session.resolve({
+                client: await getClient(c),
+                token,
+            });
+        }
+        catch (error) {
+            if (isAuthError(error) && error.code === "SESSION_CLIENT_MISMATCH") {
+                clearSession(c);
+            }
+            throw error;
+        }
+        if (!resolvedSession) {
+            clearSession(c);
+            throw createError("SESSION_INVALID", "Authentication required.");
+        }
+        if (resolvedSession.renewed) {
+            setToken(c, token, resolvedSession.session.expiresAt);
+        }
+        c.set("authSession", resolvedSession.session);
+        await next();
+    };
+    return {
+        clearSession,
+        getToken,
+        requireSession,
+        setSession: (c, created) => {
+            setToken(c, created.token, created.session.expiresAt);
+        },
+    };
+};
+//# sourceMappingURL=index.js.map

package/dist/adapters/hono/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/hono/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIjE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAgC3D,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AAE7D,MAAM,aAAa,GAAG,CAAC,SAA2B,EAAE,EAAE,EAAE;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC;IAErC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,WAAW,CAAC,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,WAAW,CAAC,qBAAqB,EAAE,wCAAwC,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7E,MAAM,WAAW,CACf,qBAAqB,EACrB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,WAAW,CAAC,qBAAqB,EAAE,wCAAwC,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,WAAW,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IACzF,CAAC;IAED,OAAO;QACL,IAAI;QACJ,OAAO,EAAE;YACP,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,QAAQ,EAAE,IAAa;YACvB,IAAI;YACJ,QAAQ;YACR,MAAM;SACP;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAuB,EACtD,IAAI,EACJ,MAAM,EACN,SAAS,GACgB,EAAsB,EAAE;IACjD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAiB,EAAE;QAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QAElD,OAAO,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,KAAa,EAAE,SAAe,EAAQ,EAAE;QACpE,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;YACjC,GAAG,QAAQ,CAAC,OAAO;YACnB,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,CAAU,EAAQ,EAAE;QACxC,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,MAAM,cAAc,GAA0C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9E,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAE1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,WAAW,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,eAAe,CAAC;QAEpB,IAAI,CAAC;YACH,eAAe,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC3C,MAAM,EAAE,MAAM,SAAS,CAAC,CAAC,CAAC;gBAC1B,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBACnE,YAAY,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,WAAW,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;YAC5B,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;IAEF,OAAO;QACL,YAAY;QACZ,QAAQ;QACR,cAAc;QACd,UAAU,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;YACzB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/adapters/redis/index.d.ts

@@ -0,0 +1,7 @@
+import type { RedisClientType } from "redis";
+import type { RedisSessionStore } from "../../session/types.js";
+export type RedisStoreConfig = {
+    prefix?: string;
+};
+export declare const createRedisStore: (client: RedisClientType, config?: RedisStoreConfig) => RedisSessionStore;
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/redis/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/redis/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAG7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAaF,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,eAAe,EACvB,SAAQ,gBAAqB,KAC5B,iBAsDF,CAAC"}

package/dist/adapters/redis/index.js

@@ -0,0 +1,53 @@
+import { createError } from "../../errors.js";
+const getPrefix = (input) => {
+    const candidate = input?.trim();
+    const prefix = candidate?.length ? candidate : "gauts:auth";
+    if (prefix.length > 128 || !/^[A-Za-z0-9:_-]+$/.test(prefix)) {
+        throw createError("AUTH_CONFIG_INVALID", "Redis key prefix is invalid.");
+    }
+    return prefix.replace(/:+$/g, "");
+};
+export const createRedisStore = (client, config = {}) => {
+    const prefix = getPrefix(config.prefix);
+    const getKey = (tokenHash) => `${prefix}:session:${tokenHash}`;
+    return {
+        create: async (tokenHash, value, ttl) => {
+            const result = await client.set(getKey(tokenHash), value, { EX: ttl, NX: true });
+            if (result !== "OK") {
+                throw new Error("Redis session key already exists.");
+            }
+        },
+        get: async (tokenHash) => {
+            return client.get(getKey(tokenHash));
+        },
+        getMany: async (tokenHashes) => {
+            return tokenHashes.length === 0
+                ? []
+                : client.mGet(tokenHashes.map((tokenHash) => getKey(tokenHash)));
+        },
+        update: async (tokenHash, value, ttl) => {
+            const result = await client.set(getKey(tokenHash), value, { EX: ttl, XX: true });
+            return result === "OK";
+        },
+        keep: async (tokenHash, value) => {
+            const result = await client.set(getKey(tokenHash), value, {
+                KEEPTTL: true,
+                XX: true,
+            });
+            return result === "OK";
+        },
+        delete: async (tokenHashes) => {
+            if (tokenHashes.length > 0) {
+                await client.del(tokenHashes.map((tokenHash) => getKey(tokenHash)));
+            }
+        },
+        exists: async (tokenHashes) => {
+            if (tokenHashes.length === 0) {
+                return [];
+            }
+            const values = await client.mGet(tokenHashes.map((tokenHash) => getKey(tokenHash)));
+            return values.map((value) => value !== null);
+        },
+    };
+};
+//# sourceMappingURL=index.js.map

package/dist/adapters/redis/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/redis/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAO9C,MAAM,SAAS,GAAG,CAAC,KAAc,EAAU,EAAE;IAC3C,MAAM,SAAS,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAE5D,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,WAAW,CAAC,qBAAqB,EAAE,8BAA8B,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAuB,EACvB,SAA2B,EAAE,EACV,EAAE;IACrB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,GAAG,MAAM,YAAY,SAAS,EAAE,CAAC;IAEvE,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAEjF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YACvB,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;YAC7B,OAAO,WAAW,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAEjF,OAAO,MAAM,KAAK,IAAI,CAAC;QACzB,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;YAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE;gBACxD,OAAO,EAAE,IAAI;gBACb,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YAEH,OAAO,MAAM,KAAK,IAAI,CAAC;QACzB,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;YAC5B,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;YAC5B,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAEpF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,17 @@
+import type { PasswordConfig, SessionConfig } from "./config.js";
+import { type PasswordService } from "./password/index.js";
+import type { RedisSessionStore, SessionAudit, SessionService } from "./session/types.js";
+export type AuthConfig = {
+    password?: PasswordConfig;
+    session?: SessionConfig;
+};
+export type AuthDeps = AuthConfig & {
+    audit: SessionAudit;
+    redis: RedisSessionStore;
+};
+export type Auth<TData extends object> = {
+    password: PasswordService;
+    session: SessionService<TData>;
+};
+export declare const createAuth: <TData extends object = Record<string, unknown>>({ audit, password, redis, session, }: AuthDeps) => Auth<TData>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjE,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE1F,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG;IAClC,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,iBAAiB,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,IAAI,CAAC,KAAK,SAAS,MAAM,IAAI;IACvC,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;CAChC,CAAC;AAcF,eAAO,MAAM,UAAU,GAAI,KAAK,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,sCAKxE,QAAQ,KAAG,IAAI,CAAC,KAAK,CAoBvB,CAAC"}

package/dist/auth.js

@@ -0,0 +1,34 @@
+import { resolvePasswordConfig, resolveSessionConfig } from "./config.js";
+import { createError } from "./errors.js";
+import { createPassword } from "./password/index.js";
+import { createSessionService } from "./session/service.js";
+const requireMethods = (name, value, methods) => {
+    if (typeof value !== "object" || value === null) {
+        throw createError("AUTH_CONFIG_INVALID", `${name} adapter is invalid.`);
+    }
+    const adapter = value;
+    if (methods.some((method) => typeof adapter[method] !== "function")) {
+        throw createError("AUTH_CONFIG_INVALID", `${name} adapter is invalid.`);
+    }
+};
+export const createAuth = ({ audit, password, redis, session, }) => {
+    requireMethods("Redis", redis, [
+        "create",
+        "delete",
+        "exists",
+        "get",
+        "getMany",
+        "keep",
+        "update",
+    ]);
+    requireMethods("Audit", audit, ["create", "findActive", "findForRevoke", "revoke", "touch"]);
+    return {
+        password: createPassword(resolvePasswordConfig(password)),
+        session: createSessionService({
+            audit,
+            config: resolveSessionConfig(session),
+            redis,
+        }),
+    };
+};
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAwB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAkB5D,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,KAAc,EAAE,OAAiB,EAAQ,EAAE;IAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,WAAW,CAAC,qBAAqB,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAG,KAAgC,CAAC;IAEjD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,WAAW,CAAC,qBAAqB,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAiD,EACzE,KAAK,EACL,QAAQ,EACR,KAAK,EACL,OAAO,GACE,EAAe,EAAE;IAC1B,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE;QAC7B,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,KAAK;QACL,SAAS;QACT,MAAM;QACN,QAAQ;KACT,CAAC,CAAC;IACH,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAE7F,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACzD,OAAO,EAAE,oBAAoB,CAAC;YAC5B,KAAK;YACL,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC;YACrC,KAAK;SACN,CAAC;KACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/client/index.d.ts

@@ -0,0 +1,19 @@
+export type SessionClientInput = {
+    country?: string | null;
+    ip?: string | null;
+    platform?: string | null;
+    userAgent?: string | null;
+};
+export type SessionIdentityInput = Pick<SessionClientInput, "ip" | "userAgent">;
+export type SessionClient = {
+    country: string | null;
+    ip: string | null;
+    platform: string | null;
+    userAgent: string | null;
+};
+export type SessionIdentity = Pick<SessionClient, "ip" | "userAgent">;
+export declare const normalizeIp: (input?: string | null) => string | null;
+export declare const normalizeClient: (input: SessionClientInput) => SessionClient;
+export declare const normalizeIdentity: (input: SessionIdentityInput) => SessionIdentity;
+export declare const matchesClient: (stored: SessionClient, current: SessionIdentity) => boolean;
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,kBAAkB,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC;AAEtE,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,GAAG,IAAI,KAAG,MAAM,GAAG,IAkB5D,CAAC;AAgBF,eAAO,MAAM,eAAe,GAAI,OAAO,kBAAkB,KAAG,aAK1D,CAAC;AAEH,eAAO,MAAM,iBAAiB,GAAI,OAAO,oBAAoB,KAAG,eAG9D,CAAC;AAEH,eAAO,MAAM,aAAa,GAAI,QAAQ,aAAa,EAAE,SAAS,eAAe,KAAG,OACZ,CAAC"}

package/dist/client/index.js

@@ -0,0 +1,36 @@
+import ipaddr from "ipaddr.js";
+export const normalizeIp = (input) => {
+    let value = input?.trim();
+    if (!value) {
+        return null;
+    }
+    if (value.startsWith("[") && value.endsWith("]")) {
+        value = value.slice(1, -1);
+    }
+    if (!ipaddr.isValid(value)) {
+        return null;
+    }
+    const normalized = ipaddr.process(value).toString();
+    return normalized === "::1" ? "127.0.0.1" : normalized;
+};
+const normalizeCountry = (input) => {
+    const value = input?.trim().toUpperCase();
+    return value && /^[A-Z]{2}$/.test(value) ? value : null;
+};
+const normalizePlatform = (input) => {
+    const value = input?.replace(/^"+|"+$/g, "").trim();
+    return value ? value.slice(0, 255) : null;
+};
+const normalizeUserAgent = (input) => (input?.length ? input : null);
+export const normalizeClient = (input) => ({
+    country: normalizeCountry(input.country),
+    ip: normalizeIp(input.ip),
+    platform: normalizePlatform(input.platform),
+    userAgent: normalizeUserAgent(input.userAgent),
+});
+export const normalizeIdentity = (input) => ({
+    ip: normalizeIp(input.ip),
+    userAgent: normalizeUserAgent(input.userAgent),
+});
+export const matchesClient = (stored, current) => stored.ip === current.ip && stored.userAgent === current.userAgent;
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,WAAW,CAAC;AAoB/B,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAqB,EAAiB,EAAE;IAClE,IAAI,KAAK,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAE1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEpD,OAAO,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAqB,EAAiB,EAAE;IAChE,MAAM,KAAK,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE1C,OAAO,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,KAAqB,EAAiB,EAAE;IACjE,MAAM,KAAK,GAAG,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEpD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,KAAqB,EAAiB,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEpG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAyB,EAAiB,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;IACxC,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;IACzB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC3C,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAA2B,EAAmB,EAAE,CAAC,CAAC;IAClF,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;IACzB,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAqB,EAAE,OAAwB,EAAW,EAAE,CACxF,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,39 @@
+export type Argon2idConfig = {
+    algorithm?: "argon2id";
+    hashLength?: number;
+    maxBytes?: number;
+    memoryCost?: number;
+    parallelism?: number;
+    timeCost?: number;
+};
+export type BcryptConfig = {
+    algorithm: "bcrypt";
+    maxBytes?: number;
+    rounds?: number;
+};
+export type PasswordConfig = Argon2idConfig | BcryptConfig;
+export type SessionConfig = {
+    max?: number;
+    touchAfter?: number;
+    ttl?: number;
+};
+export type ResolvedPasswordConfig = {
+    algorithm: "argon2id";
+    hashLength: number;
+    maxBytes: number;
+    memoryCost: number;
+    parallelism: number;
+    timeCost: number;
+} | {
+    algorithm: "bcrypt";
+    maxBytes: number;
+    rounds: number;
+};
+export type ResolvedSessionConfig = {
+    max: number;
+    touchAfter: number;
+    ttl: number;
+};
+export declare const resolvePasswordConfig: (config?: PasswordConfig) => ResolvedPasswordConfig;
+export declare const resolveSessionConfig: (config?: SessionConfig) => ResolvedSessionConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,QAAQ,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC;AAE3D,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE,SAAS,EAAE,QAAQ,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAkCF,eAAO,MAAM,qBAAqB,GAAI,SAAQ,cAAmB,KAAG,sBAiCnE,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,SAAQ,aAAkB,KAAG,qBAgBjE,CAAC"}