@happyvertical/smrt-users 0.54.0 → 0.54.3

package/dist/services/PasswordCredentialService.d.ts

@@ -0,0 +1,302 @@
+/**
+ * PasswordCredentialService — email + password sign-in for an existing,
+ * active user, and the password's lifecycle (#3274).
+ *
+ * ## Sign-in
+ *
+ * 1. Normalize the submitted identifier exactly as `User.emailKey` is.
+ * 2. Reserve a login attempt: subject = that email key (what the client
+ *    typed, never a resolved user), source = the client address.
+ * 3. Always run one scrypt verification — against the stored hash, or a
+ *    dummy hash when there is no such user or no password — so neither the
+ *    response nor its timing says whether the account or credential exists.
+ * 4. Require an ACTIVE user and, when a tenant is given, an ACTIVE membership
+ *    in it. Never create a user.
+ * 5. Mint a first-class session (`authMethod: 'password'`) through
+ *    `SessionService.createSession`, then re-check that the credential that
+ *    was verified is still the current one (closing the race with a
+ *    concurrent change/reset, whose revocation sweep runs after its write).
+ * 6. Rehash under the current scrypt policy if the stored parameters are
+ *    weaker, as a compare-and-set that never overwrites a newer password.
+ *
+ * Every refusal other than a rate limit is one {@link PasswordCredentialError}
+ * ("Invalid credentials."); a rate limit is {@link LoginRateLimitError}.
+ *
+ * ## Lifecycle and authority
+ *
+ * - `setPassword`: the person sets their own FIRST password from any
+ *   first-class session, or an administrator holding `managePermission` sets
+ *   one for someone else.
+ * - `changePassword`: the person replaces their own, proving the current one
+ *   (through the limiter, so it is no oracle). Ends every other session of
+ *   theirs.
+ * - `resetPassword`: an administrator replaces someone else's and, by
+ *   default, flags `mustChange`. Ends every session of theirs.
+ * - `clearPassword`: an administrator, or the person proving the current one.
+ *
+ * A layered (device PIN) session never manages passwords, and an
+ * administrator may only manage people whose every active membership is in
+ * the administrator's session tenant — the credential is one per person
+ * across tenants, as the PIN is.
+ *
+ * @packageDocumentation
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import { type SessionAuthMethod } from '../models/Session.js';
+import { type ScryptParams } from './credential-hash.js';
+import { InvalidCredentialsError, LoginAttemptLimiter, type LoginAttemptLimiterOptions } from './LoginAttemptLimiter.js';
+import { type PermissionDefinition } from './PermissionCatalogService.js';
+import { type SessionContext } from './SessionService.js';
+/** Login-limiter kind and session `authMethod` for password sign-ins. */
+export declare const PASSWORD_LOGIN_KIND = "password";
+/** Default permission required to set, reset, or clear another person's password. */
+export declare const DEFAULT_PASSWORD_MANAGE_PERMISSION = "users.password.manage";
+/** Default minimum password length, in characters. */
+export declare const DEFAULT_PASSWORD_MIN_LENGTH = 10;
+/** Default maximum password length, in characters. */
+export declare const DEFAULT_PASSWORD_MAX_LENGTH = 256;
+/** No configuration may raise the maximum above this: it bounds hashing work. */
+export declare const PASSWORD_MAX_LENGTH_CEILING = 1024;
+/**
+ * Built-in denylist: a few of the most common passwords that pass a
+ * 10-character minimum. Deliberately small — extend it through
+ * `password.denylist` or `password.reject` (a breached-password check, say).
+ * Compared case-insensitively.
+ */
+export declare const DEFAULT_PASSWORD_DENYLIST: readonly string[];
+/** Catalog definition for {@link DEFAULT_PASSWORD_MANAGE_PERMISSION}. */
+export declare const PASSWORD_PERMISSION_DEFINITIONS: PermissionDefinition[];
+/** Register the password management permission once when the service is used. */
+export declare function ensurePasswordPermissionsRegistered(): void;
+/**
+ * Every sign-in refusal that is not a rate limit: unknown identifier, no
+ * password, wrong password, inactive user, no membership. One message, so
+ * responses cannot enumerate accounts.
+ */
+export declare class PasswordCredentialError extends InvalidCredentialsError {
+    constructor(message?: string);
+}
+/** Thrown by set/change/reset/clear when the actor may not manage the password. */
+export declare class PasswordCredentialForbiddenError extends Error {
+    constructor(message?: string);
+}
+/** Thrown by set/change/reset when the new password fails policy. */
+export declare class PasswordPolicyError extends Error {
+    constructor(message: string);
+}
+/** What a policy hook can see besides the candidate password. */
+export interface PasswordPolicyContext {
+    /** The person the password is for. */
+    userId: string;
+    /** Their normalized email, when they have one. */
+    email: string | null;
+}
+export interface PasswordPolicyOptions {
+    /** Minimum length in characters (Unicode code points, after NFKC). Default 10. */
+    minLength?: number;
+    /**
+     * Maximum length in characters. Default 256; may not exceed
+     * {@link PASSWORD_MAX_LENGTH_CEILING}. Longer input is refused before any
+     * hashing work, at sign-in too.
+     */
+    maxLength?: number;
+    /**
+     * Extra passwords to refuse, added to {@link DEFAULT_PASSWORD_DENYLIST}.
+     * Compared case-insensitively.
+     */
+    denylist?: Iterable<string>;
+    /**
+     * Host hook run after the built-in checks: return a message to refuse the
+     * password, or null to accept it. Use it for a breached-password service
+     * or shop-specific words. There are deliberately no composition rules.
+     */
+    reject?: (password: string, context: PasswordPolicyContext) => string | null | undefined | Promise<string | null | undefined>;
+    /**
+     * Server-side secret mixed into every hash. Optional; changing it
+     * invalidates every stored password.
+     */
+    pepper?: string;
+    /**
+     * scrypt parameters for new hashes. Defaults: N=2^15, r=8, p=1 (32 MiB).
+     * A stored hash with weaker parameters is rehashed on the next successful
+     * sign-in.
+     */
+    scrypt?: Partial<ScryptParams>;
+}
+export interface PasswordCredentialServiceOptions extends SmrtClassOptions {
+    /** Lifetime of a password session in seconds. Default seven days. */
+    sessionTtl?: number;
+    /**
+     * Shared {@link LoginAttemptLimiter}. When omitted one is created from
+     * `limiter` (or defaults). Supplying the host's instance keeps password,
+     * PIN and terminal budgets in one table with one audit sink.
+     */
+    loginLimiter?: LoginAttemptLimiter;
+    /** Options for the private limiter when `loginLimiter` is not supplied. */
+    limiter?: Omit<LoginAttemptLimiterOptions, keyof SmrtClassOptions>;
+    /** Permission slug an administrator needs to manage others' passwords. */
+    managePermission?: string;
+    /** Password policy. */
+    password?: PasswordPolicyOptions;
+}
+export interface PasswordSignInInput {
+    /** What the person typed as their email; normalized like `User.emailKey`. */
+    identifier: string;
+    password: string;
+    /**
+     * Tenant to sign into. When set, the person must hold an ACTIVE membership
+     * in it; when null/omitted the session carries no tenant context (and so
+     * no tenant permissions) until `switchSessionTenant`.
+     */
+    tenantId?: string | null;
+    ipAddress?: string;
+    userAgent?: string;
+    /**
+     * The session id the client presented before signing in (its old cookie),
+     * if any. Revoked after a successful sign-in so a planted or previous
+     * session id never survives authentication (session fixation).
+     */
+    replaceSessionId?: string | null;
+}
+export interface PasswordSignInResult {
+    /** The new session id: the cookie value. Never send it to client script. */
+    sessionId: string;
+    userId: string;
+    tenantId: string | null;
+    authMethod: SessionAuthMethod;
+    expiresAt: string;
+    /**
+     * True when an administrator reset the password: the session resolves to
+     * no permissions and can only call `changePassword`, which ends it; the
+     * person then signs in with the new password.
+     */
+    mustChange: boolean;
+}
+export interface SetPasswordInput {
+    /** Resolved session of whoever is making the change. */
+    actor: SessionContext;
+    userId: string;
+    password: string;
+    ipAddress?: string;
+}
+export interface ChangePasswordInput {
+    /** The person's own session; the password changed is always theirs. */
+    actor: SessionContext;
+    currentPassword: string;
+    newPassword: string;
+    ipAddress?: string;
+}
+export interface ResetPasswordInput {
+    actor: SessionContext;
+    userId: string;
+    password: string;
+    /** Require a change at next sign-in. Default true. */
+    mustChange?: boolean;
+    ipAddress?: string;
+}
+export interface ClearPasswordInput {
+    actor: SessionContext;
+    userId: string;
+    /** Required when a person clears their own password. */
+    currentPassword?: string;
+    ipAddress?: string;
+}
+export declare class PasswordCredentialService {
+    private readonly options;
+    private readonly sessionTtl;
+    private readonly managePermission;
+    private readonly policy;
+    private sessionService;
+    private memberships;
+    private users;
+    private credentials;
+    private limiter;
+    private dummyHash;
+    constructor(options: PasswordCredentialServiceOptions);
+    static create(options: PasswordCredentialServiceOptions): Promise<PasswordCredentialService>;
+    initialize(): Promise<void>;
+    /** The limiter in use (shared or private). */
+    get loginLimiter(): LoginAttemptLimiter;
+    /**
+     * Verify an email and password and mint a session. Throws
+     * {@link PasswordCredentialError} for every refusal that is not a rate
+     * limit and {@link LoginRateLimitError} when the budget is exhausted.
+     */
+    signIn(input: PasswordSignInInput): Promise<PasswordSignInResult>;
+    /**
+     * Set a password where the person has none: the person themself from any
+     * first-class session, or an administrator holding `managePermission` for
+     * someone else (which, if a password already exists, replaces it and ends
+     * every session of theirs like {@link resetPassword} without the
+     * must-change flag). A person who already has one uses
+     * {@link changePassword}.
+     */
+    setPassword(input: SetPasswordInput): Promise<{
+        revokedSessions: number;
+    }>;
+    /**
+     * The person changes their own password, proving the current one. Every
+     * other session of theirs ends — the reason to change may be that it
+     * leaked — and so does this one when it is the restricted session a reset
+     * password signed in to.
+     */
+    changePassword(input: ChangePasswordInput): Promise<{
+        revokedSessions: number;
+        endedCurrentSession: boolean;
+    }>;
+    /**
+     * Administrative reset: replace someone else's password and end every
+     * session they hold. `mustChange` (default true) makes the next sign-in a
+     * restricted session that can only change the password.
+     */
+    resetPassword(input: ResetPasswordInput): Promise<{
+        revokedSessions: number;
+    }>;
+    /**
+     * Remove a person's password and end their password sessions. An
+     * administrator holding `managePermission`, or the person proving the
+     * current password (not from a must-change session).
+     */
+    clearPassword(input: ClearPasswordInput): Promise<{
+        revokedSessions: number;
+    }>;
+    /** Whether the person has a password (for admin UIs; never for sign-in responses). */
+    hasPassword(userId: string): Promise<boolean>;
+    /**
+     * Check a candidate against the policy without storing it — for a form
+     * that wants to say "too short" before submitting. Throws
+     * {@link PasswordPolicyError}.
+     */
+    validatePassword(password: string, userId: string): Promise<void>;
+    private findUserByEmailKey;
+    private requireUser;
+    /**
+     * Prove the current password for a self-service change or clear, through
+     * the limiter on the same subject key as sign-in, so these paths cannot be
+     * used to guess outside the sign-in budget.
+     */
+    private verifyCurrent;
+    private assertNotLayered;
+    private assertCanManage;
+    /** Returns the normalized password to hash, or throws {@link PasswordPolicyError}. */
+    private assertPolicy;
+    private hashPassword;
+    /**
+     * Verify against the stored hash, or the dummy hash when there is none,
+     * doing the same scrypt work either way. A stored hash derived under
+     * weaker parameters than the current policy (before its upgrade rehash)
+     * would otherwise verify faster than the dummy does and reveal that the
+     * credential exists, so its verification is padded up to the policy's
+     * cost.
+     */
+    private verifyEqualWork;
+    /**
+     * Rehash a just-verified password whose stored parameters are below the
+     * current policy. Best effort: a failure here must never turn a completed
+     * sign-in into an error, and the guarded write never replaces a password
+     * that changed after it was verified.
+     */
+    private upgradeHashIfNeeded;
+    private recordManagement;
+}
+//# sourceMappingURL=PasswordCredentialService.d.ts.map

package/dist/services/PasswordCredentialService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordCredentialService.d.ts","sourceRoot":"","sources":["../../src/services/PasswordCredentialService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAMjE,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAIL,KAAK,YAAY,EAGlB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,0BAA0B,EAEhC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAC9C,qFAAqF;AACrF,eAAO,MAAM,kCAAkC,0BAA0B,CAAC;AAC1E,sDAAsD;AACtD,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,sDAAsD;AACtD,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAIhD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAwBrD,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,EAAE,oBAAoB,EAOjE,CAAC;AAIF,iFAAiF;AACjF,wBAAgB,mCAAmC,IAAI,IAAI,CAI1D;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,uBAAuB;gBACtD,OAAO,SAAyB;CAI7C;AAED,mFAAmF;AACnF,qBAAa,gCAAiC,SAAQ,KAAK;gBAC7C,OAAO,SAA2C;CAI/D;AAED,qEAAqE;AACrE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,CACP,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,qBAAqB,KAC3B,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACpE;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,gCAAiC,SAAQ,gBAAgB;IACxE,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,IAAI,CAAC,0BAA0B,EAAE,MAAM,gBAAgB,CAAC,CAAC;IACnE,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,KAAK,EAAE,cAAc,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAOrB;IACF,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,KAAK,CAAkB;IAC/B,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,SAAS,CAAU;gBAEf,OAAO,EAAE,gCAAgC;WAkDxC,MAAM,CACjB,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,yBAAyB,CAAC;IAM/B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BjC,8CAA8C;IAC9C,IAAI,YAAY,IAAI,mBAAmB,CAEtC;IAMD;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgJvE;;;;;;;OAOG;IACG,WAAW,CACf,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IA8CvC;;;;;OAKG;IACG,cAAc,CAClB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,OAAO,CAAA;KAAE,CAAC;IA8CrE;;;;OAIG;IACG,aAAa,CACjB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAoCvC;;;;OAIG;IACG,aAAa,CACjB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAwCvC,sFAAsF;IAChF,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnD;;;;OAIG;IACG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAQzD,kBAAkB;YAKlB,WAAW;IAQzB;;;;OAIG;YACW,aAAa;IAqC3B,OAAO,CAAC,gBAAgB;YAQV,eAAe;IA8B7B,sFAAsF;YACxE,YAAY;IAoC1B,OAAO,CAAC,YAAY;IAIpB;;;;;;;OAOG;YACW,eAAe;IAU7B;;;;;OAKG;YACW,mBAAmB;YAwBnB,gBAAgB;CAY/B"}

package/dist/services/SessionService.d.ts

@@ -189,7 +189,9 @@ export declare class SessionService {
     /**
      * Destroy all sessions for a user (logout from all devices)
      */
-    destroyAllUserSessions(userId: string): Promise<number>;
+    destroyAllUserSessions(userId: string, options?: {
+        exceptSessionId?: string;
+    }): Promise<number>;
     /**
      * Switch tenant context for a session.
      *

package/dist/services/SessionService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionService.d.ts","sourceRoot":"","sources":["../../src/services/SessionService.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAEL,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAG9C;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,sBAAsB;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,oEAAoE;IACpE,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,gCAAgC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE;QACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;KACtC,GAAG,IAAI,CAAC;IACT,sCAAsC;IACtC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mFAAmF;IACnF,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,oBAAoB,CAAwB;IACpD,OAAO,CAAC,kBAAkB,CAAsB;IAChD,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,UAAU,CAAU;gBAEhB,OAAO,EAAE,qBAAqB;IAM1C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;;;;;;OAOG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC;IAelB;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IA4G3E;;OAEG;IACH,WAAW;IAIX;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIzD;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUzD;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKnE;;;OAGG;IACG,oBAAoB,CACxB,eAAe,EAAE,MAAM,EACvB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACzC,OAAO,CAAC,MAAM,CAAC;IAIlB;;;OAGG;IACG,+BAA+B,CACnC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACzC,OAAO,CAAC,MAAM,CAAC;IAQlB;;OAEG;IACG,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7D;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,YAAY,CAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,kBAAkB,CAAC;IA8F9B;;OAEG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM;IAIpC;;OAEG;IACG,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/C;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM5E;;OAEG;IACG,cAAc,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAIzB;;OAEG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,OAAO,CAAC;IAInB;;OAEG;WACU,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;CAK7E"}
+{"version":3,"file":"SessionService.d.ts","sourceRoot":"","sources":["../../src/services/SessionService.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAEL,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAG9C;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,sBAAsB;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,oEAAoE;IACpE,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,gCAAgC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE;QACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;KACtC,GAAG,IAAI,CAAC;IACT,sCAAsC;IACtC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mFAAmF;IACnF,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,oBAAoB,CAAwB;IACpD,OAAO,CAAC,kBAAkB,CAAsB;IAChD,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,UAAU,CAAU;gBAEhB,OAAO,EAAE,qBAAqB;IAM1C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;;;;;;OAOG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC;IAelB;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IA4G3E;;OAEG;IACH,WAAW;IAIX;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIzD;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUzD;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKnE;;;OAGG;IACG,oBAAoB,CACxB,eAAe,EAAE,MAAM,EACvB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACzC,OAAO,CAAC,MAAM,CAAC;IAIlB;;;OAGG;IACG,+BAA+B,CACnC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACzC,OAAO,CAAC,MAAM,CAAC;IAQlB;;OAEG;IACG,sBAAsB,CAC1B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACzC,OAAO,CAAC,MAAM,CAAC;IAIlB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,YAAY,CAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,kBAAkB,CAAC;IA8F9B;;OAEG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM;IAIpC;;OAEG;IACG,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/C;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM5E;;OAEG;IACG,cAAc,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAIzB;;OAEG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,OAAO,CAAC;IAInB;;OAEG;WACU,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;CAK7E"}

package/dist/services/credential-hash.d.ts

@@ -0,0 +1,76 @@
+/**
+ * scrypt hashing shared by the PIN (#3276) and password (#3274) credentials.
+ *
+ * The encoded form is self-describing — `scrypt$N$r$p$saltB64$hashB64` — so
+ * every stored hash carries the parameters it was derived with. Raising the
+ * policy therefore never breaks an existing hash: it still verifies with its
+ * own parameters and is rehashed under the new ones on the next successful
+ * sign-in ({@link scryptHashNeedsUpgrade}).
+ *
+ * The secret is hashed as `pepper || 0x00 || secret`; an empty pepper is
+ * allowed. Comparison uses `timingSafeEqual`.
+ *
+ * Internal module: not exported from the package index.
+ *
+ * @packageDocumentation
+ */
+/** scrypt cost parameters. */
+export interface ScryptParams {
+    /** CPU/memory cost; a power of two. */
+    N: number;
+    /** Block size. */
+    r: number;
+    /** Parallelisation. */
+    p: number;
+}
+/** Derived key length in bytes. */
+export declare const SCRYPT_HASH_BYTES = 32;
+/** Random salt length in bytes, fresh for every hash. */
+export declare const SCRYPT_SALT_BYTES = 16;
+/** True when `params` are structurally valid scrypt parameters within the ceilings. */
+export declare function isValidScryptParams(params: ScryptParams): boolean;
+/** Hash `secret` with a fresh random salt (or `salt`, for verification). */
+export declare function hashSecret(secret: string, pepper: string, params: ScryptParams, salt?: Buffer): Promise<string>;
+interface ParsedScryptHash {
+    params: ScryptParams;
+    salt: Buffer;
+    hash: Buffer;
+}
+/** Parse an encoded hash; null for anything malformed or out of bounds. */
+export declare function parseScryptHash(encoded: string): ParsedScryptHash | null;
+/**
+ * Verify `secret` against an encoded hash in constant time. A malformed
+ * encoding verifies false.
+ */
+export declare function verifySecretHash(secret: string, pepper: string, encoded: string): Promise<boolean>;
+/**
+ * The scrypt derivations whose work makes up the difference between
+ * verifying `encoded` and verifying a hash under `policy` — empty when there
+ * is no meaningful difference. A malformed encoding verifies without
+ * deriving, so it owes the policy's whole cost.
+ *
+ * Every derivation keeps the policy's memory shape, so padding never touches
+ * more memory than one current-policy verification: whole lanes are spent as
+ * one derivation at the policy's own `N` and `r` with `p` lanes (`p` never
+ * exceeds the policy's), and the remainder as up to six single-lane
+ * derivations at the policy's `r` with halving powers of two for `N`. The
+ * total matches the policy's cost to within 1/64 of a lane.
+ */
+export declare function scryptPaddingParams(encoded: string, policy: ScryptParams): ScryptParams[];
+/**
+ * After verifying against `encoded`, spend the work verifying under
+ * `policy` would have cost beyond it ({@link scryptPaddingParams}), so a hash
+ * still carrying weaker parameters costs about what a current-policy hash —
+ * such as the dummy hash a missing credential is compared against — does.
+ */
+export declare function padScryptWork(encoded: string, policy: ScryptParams): Promise<void>;
+/** Relative scrypt work: ROMix runs `2·N` BlockMix rounds of cost `r`, `p` times. */
+export declare function scryptCost(params: ScryptParams): number;
+/**
+ * True when the stored hash was derived with weaker parameters than
+ * `policy` on any axis (or cannot be parsed), so it should be rehashed after
+ * the next successful verification.
+ */
+export declare function scryptHashNeedsUpgrade(encoded: string, policy: ScryptParams): boolean;
+export {};
+//# sourceMappingURL=credential-hash.d.ts.map

package/dist/services/credential-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-hash.d.ts","sourceRoot":"","sources":["../../src/services/credential-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,8BAA8B;AAC9B,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,CAAC,EAAE,MAAM,CAAC;IACV,kBAAkB;IAClB,CAAC,EAAE,MAAM,CAAC;IACV,uBAAuB;IACvB,CAAC,EAAE,MAAM,CAAC;CACX;AAED,mCAAmC;AACnC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAWpC,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAcjE;AA2BD,4EAA4E;AAC5E,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE,MAAuC,GAC5C,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAWxE;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,YAAY,GACnB,YAAY,EAAE,CAkBhB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,qFAAqF;AACrF,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,YAAY,GACnB,OAAO,CAQT"}

package/dist/services/index.d.ts

@@ -10,6 +10,7 @@ export { MagicLinkError, type MagicLinkResult, MagicLinkService, type MagicLinkS
 export { MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, readMobileBearerToken, validateMobileRedirectUri, } from './MobileAuthService.js';
 export { type CreateAuthorizationUrlOptions, decodeOidcTransaction, encodeOidcTransaction, getUsersOidcConfig, type OidcCallbackResult, OidcLoginError, type OidcLoginResult, OidcLoginService, type OidcLoginServiceOptions, type OidcProviderConfig, type OidcProviderKind, type OidcProviderMetadata, type OidcProviderResolution, type OidcProviderResolutionOptions, type OidcTokenEndpointAuthMethod, type OidcTokenSet, type OidcTransaction, type ResolvedOidcProviderConfig, resolveOidcProviderConfig, type UsersOidcConfig, } from './OidcLoginService.js';
 export { assertOperationPermission, checkOperationPermission, hasOperationPermission, type OperationPermissionAllowReason, type OperationPermissionDecision, type OperationPermissionDenyReason, OperationPermissionError, type OperationPermissionOptions, } from './OperationPermissionService.js';
+export { type ChangePasswordInput, type ClearPasswordInput, DEFAULT_PASSWORD_DENYLIST, DEFAULT_PASSWORD_MANAGE_PERMISSION, DEFAULT_PASSWORD_MAX_LENGTH, DEFAULT_PASSWORD_MIN_LENGTH, ensurePasswordPermissionsRegistered, PASSWORD_LOGIN_KIND, PASSWORD_MAX_LENGTH_CEILING, PASSWORD_PERMISSION_DEFINITIONS, PasswordCredentialError, PasswordCredentialForbiddenError, PasswordCredentialService, type PasswordCredentialServiceOptions, type PasswordPolicyContext, PasswordPolicyError, type PasswordPolicyOptions, type PasswordSignInInput, type PasswordSignInResult, type ResetPasswordInput, type SetPasswordInput, } from './PasswordCredentialService.js';
 export { deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, normalizeOperationPermissionAction, type OperationPermissionCollectionInput, type PermissionCatalog, PermissionCatalogService, type PermissionCatalogSource, type PermissionCatalogSyncResult, type PermissionDefinition, type PostgresPermissionAction, type PostgresPermissionBinding, registerPermissionDefinitions, syncPermissionCatalog, type UsersConfig, } from './PermissionCatalogService.js';
 export { type PermissionResolutionOptions, type PermissionResolutionResult, PermissionResolver, type PermissionResolverOptions, type TenantPermissionInheritanceResult, } from './PermissionResolver.js';
 export { applyPostgresPermissionPolicies, type GeneratePostgresPermissionSqlResult, generatePostgresPermissionSql, type PostgresPermissionPolicyReportItem, type PostgresPermissionPolicyTarget, } from './PostgresPermissionPolicies.js';

package/dist/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,+BAA+B,EAC/B,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,4BAA4B,EACjC,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,aAAa,EAClB,kCAAkC,EAClC,6BAA6B,EAC7B,qBAAqB,EACrB,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,8BAA8B,EAC9B,cAAc,EACd,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oCAAoC,EACpC,kCAAkC,EAClC,4BAA4B,EAC5B,iCAAiC,EACjC,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,6BAA6B,EAClC,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,GAChC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,kCAAkC,EAClC,KAAK,kCAAkC,EACvC,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,6BAA6B,EAC7B,qBAAqB,EACrB,KAAK,WAAW,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,GACvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,KAAK,mCAAmC,EACxC,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,GACpC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,0BAA0B,EAC/B,gCAAgC,EAChC,mCAAmC,EACnC,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,+CAA+C,EAC/C,qCAAqC,EACrC,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,2BAA2B,EAC3B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,+BAA+B,EAC/B,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,4BAA4B,EACjC,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,aAAa,EAClB,kCAAkC,EAClC,6BAA6B,EAC7B,qBAAqB,EACrB,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,8BAA8B,EAC9B,cAAc,EACd,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oCAAoC,EACpC,kCAAkC,EAClC,4BAA4B,EAC5B,iCAAiC,EACjC,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,6BAA6B,EAClC,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,GAChC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,2BAA2B,EAC3B,2BAA2B,EAC3B,mCAAmC,EACnC,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,yBAAyB,EACzB,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,kCAAkC,EAClC,KAAK,kCAAkC,EACvC,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,6BAA6B,EAC7B,qBAAqB,EACrB,KAAK,WAAW,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,GACvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,KAAK,mCAAmC,EACxC,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,GACpC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,0BAA0B,EAC/B,gCAAgC,EAChC,mCAAmC,EACnC,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,+CAA+C,EAC/C,qCAAqC,EACrC,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,2BAA2B,EAC3B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,0BAA0B,CAAC"}