@hilbras/keystone 1.1.0

package/dist/routes/setup.js

@@ -0,0 +1,304 @@
+import { z } from "zod";
+import { eq, count } from "drizzle-orm";
+import { migrate } from "drizzle-orm/postgres-js/migrator";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { db, initDb } from "../db/index.js";
+import { users } from "../db/schema.js";
+import { AuthenticationDomainService } from "../services/domain/authentication.js";
+import { DrizzleUserRepository, DrizzleApplicationRepository } from "../repositories/index.js";
+import { validateDatabase, validateRedis, validateEmail, validateSms } from "../services/setup/validation.js";
+import { createConfigWriter } from "../services/setup/configWriter.js";
+import { getSetupToken, validateSetupToken } from "../services/setup/token.js";
+import { runSetupDiagnostics } from "../services/setup/diagnostics.js";
+import { queue } from "../services/queue/index.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const SETUP_MARKER_PATH = path.resolve(__dirname, "../../.keystone-setup-complete");
+const SetupInitSchema = z.object({
+    email: z.string().email(),
+    password: z.string().min(8),
+    name: z.string().optional(),
+    username: z.string().optional(),
+});
+const ValidateDatabaseSchema = z.object({
+    databaseUrl: z.string().min(1),
+});
+const ValidateRedisSchema = z.object({
+    redisUrl: z.string().min(1),
+});
+const ValidateEmailSchema = z.object({
+    provider: z.enum(["none", "console", "smtp", "sendgrid", "mailgun"]),
+    from: z.string().email(),
+    smtpHost: z.string().optional(),
+    smtpPort: z.coerce.number().optional(),
+    smtpUser: z.string().optional(),
+    smtpPass: z.string().optional(),
+    smtpSecure: z.boolean().optional(),
+    sendgridApiKey: z.string().optional(),
+    mailgunApiKey: z.string().optional(),
+    mailgunDomain: z.string().optional(),
+    to: z.string().email(),
+});
+const ValidateSmsSchema = z.object({
+    provider: z.enum(["none", "console", "twilio"]),
+    twilioAccountSid: z.string().optional(),
+    twilioAuthToken: z.string().optional(),
+    twilioFromNumber: z.string().optional(),
+    twilioMessagingServiceSid: z.string().optional(),
+    to: z.string().min(1),
+});
+const SetupConfigSchema = z.object({
+    env: z.record(z.string()),
+});
+function parseBody(schema, body, reply) {
+    const result = schema.safeParse(body);
+    if (!result.success) {
+        const issues = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+        reply.status(400).send({ error: `Invalid input: ${issues}`, code: "VALIDATION_ERROR" });
+        return null;
+    }
+    return result.data;
+}
+async function hasNoUsers() {
+    if (!db)
+        return true;
+    try {
+        const [result] = await db.select({ total: count() }).from(users);
+        return (result?.total ?? 0) === 0;
+    }
+    catch {
+        // Database exists but migrations have not run yet; setup is still required.
+        return true;
+    }
+}
+async function hasNoOwners() {
+    if (!db)
+        return true;
+    try {
+        const [result] = await db.select({ total: count() }).from(users).where(eq(users.role, "owner"));
+        return (result?.total ?? 0) === 0;
+    }
+    catch {
+        return true;
+    }
+}
+async function ensureDbInitialized(request, reply) {
+    if (db)
+        return true;
+    try {
+        const writer = createConfigWriter();
+        const values = await writer.read();
+        const databaseUrl = values.DATABASE_URL;
+        if (!databaseUrl) {
+            request.log.warn({ configKeys: Object.keys(values) }, "DATABASE_URL missing when initializing database");
+            reply.status(400).send({ error: "DATABASE_URL is not configured. Apply configuration first.", code: "DATABASE_URL_MISSING" });
+            return false;
+        }
+        process.env.DATABASE_URL = databaseUrl;
+        initDb();
+        return true;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        request.log.error({ err }, "Database initialization failed");
+        reply.status(500).send({ error: message, code: "DB_INIT_FAILED" });
+        return false;
+    }
+}
+function assertSetupToken(request, reply) {
+    const token = request.headers["x-setup-token"];
+    if (!validateSetupToken(token)) {
+        request.log.warn({ hasToken: Boolean(token), tokenLength: token?.length, expectedLength: getSetupToken()?.length }, "Invalid or missing setup token");
+        reply.status(401).send({ error: "Invalid or missing setup token" });
+        return false;
+    }
+    return true;
+}
+export default async function setupRoutes(app) {
+    app.get("/status", async () => {
+        return {
+            needsSetup: await hasNoOwners(),
+            setupToken: Boolean(getSetupToken()),
+        };
+    });
+    app.get("/diagnostics", async (request, reply) => {
+        if (!assertSetupToken(request, reply))
+            return;
+        const checks = await runSetupDiagnostics();
+        return { checks, ready: checks.every((c) => c.status === "ok" || c.status === "skipped") };
+    });
+    app.post("/config/dry-run", async (request, reply) => {
+        if (!assertSetupToken(request, reply))
+            return;
+        const body = parseBody(SetupConfigSchema, request.body, reply);
+        if (!body)
+            return;
+        const writer = createConfigWriter();
+        const existing = await writer.read();
+        const merged = { ...existing, ...body.env };
+        const validationErrors = [];
+        if (!merged.DATABASE_URL)
+            validationErrors.push("DATABASE_URL is required");
+        if (!merged.REDIS_URL)
+            validationErrors.push("REDIS_URL is required");
+        if (!merged.AUTH_API_PUBLIC_URL)
+            validationErrors.push("AUTH_API_PUBLIC_URL is required");
+        return {
+            ok: validationErrors.length === 0,
+            validationErrors,
+            wouldWrite: Object.keys(body.env),
+            mergedPreview: Object.fromEntries(Object.entries(merged).map(([k, v]) => [k, k.includes("KEY") || k.includes("SECRET") || k.includes("PASS") ? "***" : v])),
+        };
+    });
+    app.post("/validate/db", async (request, reply) => {
+        if (!assertSetupToken(request, reply))
+            return;
+        const body = parseBody(ValidateDatabaseSchema, request.body, reply);
+        if (!body)
+            return;
+        const result = await validateDatabase(body);
+        if (!result.success) {
+            request.log.warn({ code: result.error.code, message: result.error.message }, "Database validation failed");
+            return reply.status(result.error.statusCode || 400).send({ error: result.error.message, code: result.error.code });
+        }
+        return { ok: true };
+    });
+    app.post("/validate/redis", async (request, reply) => {
+        if (!assertSetupToken(request, reply))
+            return;
+        const body = parseBody(ValidateRedisSchema, request.body, reply);
+        if (!body)
+            return;
+        const result = await validateRedis(body);
+        if (!result.success) {
+            request.log.warn({ code: result.error.code, message: result.error.message }, "Redis validation failed");
+            return reply.status(result.error.statusCode || 400).send({ error: result.error.message, code: result.error.code });
+        }
+        return { ok: true };
+    });
+    app.post("/validate/email", async (request, reply) => {
+        if (!assertSetupToken(request, reply))
+            return;
+        const body = parseBody(ValidateEmailSchema, request.body, reply);
+        if (!body)
+            return;
+        const { to, ...input } = body;
+        const result = await validateEmail(input, to);
+        if (!result.success) {
+            return reply.status(result.error.statusCode || 400).send({ error: result.error.message, code: result.error.code });
+        }
+        return { ok: true };
+    });
+    app.post("/validate/sms", async (request, reply) => {
+        if (!assertSetupToken(request, reply))
+            return;
+        const body = parseBody(ValidateSmsSchema, request.body, reply);
+        if (!body)
+            return;
+        const { to, ...input } = body;
+        const result = await validateSms(input, to);
+        if (!result.success) {
+            return reply.status(result.error.statusCode || 400).send({ error: result.error.message, code: result.error.code });
+        }
+        return { ok: true };
+    });
+    app.post("/config", async (request, reply) => {
+        if (!assertSetupToken(request, reply))
+            return;
+        const body = parseBody(SetupConfigSchema, request.body, reply);
+        if (!body)
+            return;
+        const writer = createConfigWriter();
+        const backup = await writer.backup();
+        if (!backup.success) {
+            return reply.status(backup.error.statusCode || 500).send({ error: backup.error.message, code: backup.error.code });
+        }
+        const writeResult = await writer.write(body.env);
+        if (!writeResult.success) {
+            return reply.status(writeResult.error.statusCode || 500).send({ error: writeResult.error.message, code: writeResult.error.code });
+        }
+        return { ok: true, backupPath: backup.data || undefined };
+    });
+    app.post("/migrate", async (request, reply) => {
+        if (!assertSetupToken(request, reply))
+            return;
+        if (!(await ensureDbInitialized(request, reply)))
+            return;
+        try {
+            await migrate(db, { migrationsFolder: path.resolve(__dirname, "../db/migrations") });
+            return { ok: true };
+        }
+        catch (err) {
+            request.log.error({ err }, "Migration failed");
+            const message = err instanceof Error ? err.message : String(err);
+            return reply.status(500).send({ error: message, code: "MIGRATION_FAILED" });
+        }
+    });
+    app.post("/restart", async (request, reply) => {
+        if (!assertSetupToken(request, reply))
+            return;
+        reply.status(202).send({ ok: true, message: "Server is restarting" });
+        try {
+            await queue.close?.();
+        }
+        catch {
+            // ignore
+        }
+        setTimeout(() => process.exit(0), 500);
+    });
+    app.post("/init", async (request, reply) => {
+        if (!assertSetupToken(request, reply))
+            return;
+        if (!(await ensureDbInitialized(request, reply)))
+            return;
+        if (!(await hasNoOwners())) {
+            return reply.status(403).send({ error: "Setup has already been completed" });
+        }
+        const body = parseBody(SetupInitSchema, request.body, reply);
+        if (!body)
+            return;
+        // If a user with this email already exists (e.g. from an interrupted setup),
+        // promote them to owner instead of failing with a duplicate-key error.
+        const [existing] = await db.select().from(users).where(eq(users.email, body.email)).limit(1);
+        let ownerUser;
+        if (existing) {
+            await db.update(users).set({ role: "owner" }).where(eq(users.id, existing.id));
+            ownerUser = existing;
+        }
+        else {
+            const authService = new AuthenticationDomainService(new DrizzleUserRepository(), new DrizzleApplicationRepository());
+            const result = await authService.register({
+                email: body.email,
+                password: body.password,
+                name: body.name,
+                username: body.username ||
+                    body.email
+                        .split("@")[0]
+                        .toLowerCase()
+                        .replace(/[^a-z0-9_-]/g, "-")
+                        .slice(0, 32),
+            });
+            if (!result.success) {
+                return reply.status(400).send({ error: result.error.message });
+            }
+            await db.update(users).set({ role: "owner" }).where(eq(users.id, result.data.user.id));
+            ownerUser = result.data.user;
+        }
+        try {
+            await fs.writeFile(SETUP_MARKER_PATH, new Date().toISOString(), "utf-8");
+        }
+        catch (err) {
+            request.log.warn({ err }, "Could not write setup completion marker");
+        }
+        return {
+            user: {
+                id: ownerUser.id,
+                email: ownerUser.email,
+                username: ownerUser.username,
+                role: "owner",
+            },
+        };
+    });
+}
+//# sourceMappingURL=setup.js.map

package/dist/routes/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/routes/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9G,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAEnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;AAEpF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACpE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CACvB,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC1B,CAAC,CAAC;AAEH,SAAS,SAAS,CAAI,MAAsB,EAAE,IAAa,EAAE,KAAmB;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9F,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAuB,EAAE,KAAmB;IAC7E,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,iDAAiD,CAAC,CAAC;YACzG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4DAA4D,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAC9H,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,WAAW,CAAC;QACvC,MAAM,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC7D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB,EAAE,KAAmB;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAuB,CAAC;IACrE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,EACjG,gCAAgC,CACjC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,WAAW,CAAC,GAAoB;IAC5D,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAC5B,OAAO;YACL,UAAU,EAAE,MAAM,WAAW,EAAE;YAC/B,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC7E,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO;QAC9C,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACjF,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO;QAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE5C,MAAM,gBAAgB,GAAa,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,gBAAgB,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,gBAAgB,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,gBAAgB,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAE1F,OAAO;YACL,EAAE,EAAE,gBAAgB,CAAC,MAAM,KAAK,CAAC;YACjC,gBAAgB;YAChB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACjC,aAAa,EAAE,MAAM,CAAC,WAAW,CAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzH;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC9E,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO;QAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,sBAAsB,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,4BAA4B,CAAC,CAAC;YAC3G,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACjF,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO;QAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,mBAAmB,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAC;YACxG,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACjF,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO;QAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,mBAAmB,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC/E,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO;QAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACzE,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO;QAE9C,MAAM,IAAI,GAAG,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrH,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpI,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC1E,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO;QAC9C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO;QACzD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACrF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC1E,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO;QAC9C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACvE,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO;QAC9C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO;QACzD,IAAI,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE7F,IAAI,SAAS,CAAC;QACd,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/E,SAAS,GAAG,QAAQ,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,IAAI,2BAA2B,CAAC,IAAI,qBAAqB,EAAE,EAAE,IAAI,4BAA4B,EAAE,CAAC,CAAC;YACrH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;gBACxC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EACN,IAAI,CAAC,QAAQ;oBACb,IAAI,CAAC,KAAK;yBACP,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;yBACb,WAAW,EAAE;yBACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;yBAC5B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aAClB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACvF,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,yCAAyC,CAAC,CAAC;QACvE,CAAC;QAED,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,IAAI,EAAE,OAAO;aACd;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/smsOtp.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function smsOtpRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=smsOtp.d.ts.map

package/dist/routes/smsOtp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smsOtp.d.ts","sourceRoot":"","sources":["../../src/routes/smsOtp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAa7E,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAoD9D"}

package/dist/routes/smsOtp.js

@@ -0,0 +1,50 @@
+import { z } from "zod";
+import { sendSmsOtp, verifySmsOtp, markPhoneVerified } from "../services/smsOtp.js";
+import { rateLimit } from "../plugins/rateLimit.js";
+const SendSchema = z.object({
+    phoneNumber: z.string().min(5).max(32),
+});
+const VerifySchema = z.object({
+    phoneNumber: z.string().min(5).max(32),
+    code: z.string().min(4).max(8),
+});
+export default async function smsOtpRoutes(app) {
+    app.post("/sms-otp/send", {
+        preHandler: [
+            app.authenticate,
+            rateLimit({
+                keyPrefix: "sms-otp-send",
+                maxAttempts: 3,
+                windowSeconds: 300,
+            }),
+        ],
+    }, async (request, reply) => {
+        const user = request.user;
+        const body = SendSchema.parse(request.body);
+        await sendSmsOtp(user, body.phoneNumber);
+        await request.audit("sms_otp_sent", { userId: user.id, phoneNumber: body.phoneNumber });
+        return { success: true };
+    });
+    app.post("/sms-otp/verify", {
+        preHandler: [
+            app.authenticate,
+            rateLimit({
+                keyPrefix: "sms-otp-verify",
+                maxAttempts: 5,
+                windowSeconds: 300,
+            }),
+        ],
+    }, async (request, reply) => {
+        const user = request.user;
+        const body = VerifySchema.parse(request.body);
+        const valid = await verifySmsOtp(user.id, body.code);
+        if (!valid) {
+            await request.audit("sms_otp_verify_failed", { userId: user.id });
+            return reply.status(400).send({ error: "Invalid or expired code" });
+        }
+        await markPhoneVerified(user.id, body.phoneNumber);
+        await request.audit("sms_otp_verified", { userId: user.id, phoneNumber: body.phoneNumber });
+        return { success: true };
+    });
+}
+//# sourceMappingURL=smsOtp.js.map

package/dist/routes/smsOtp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smsOtp.js","sourceRoot":"","sources":["../../src/routes/smsOtp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,GAAG,CAAC,IAAI,CACN,eAAe,EACf;QACE,UAAU,EAAE;YACV,GAAG,CAAC,YAAY;YAChB,SAAS,CAAC;gBACR,SAAS,EAAE,cAAc;gBACzB,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;aACnB,CAAC;SACH;KACF,EACD,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAExF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,iBAAiB,EACjB;QACE,UAAU,EAAE;YACV,GAAG,CAAC,YAAY;YAChB,SAAS,CAAC;gBACR,SAAS,EAAE,gBAAgB;gBAC3B,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;aACnB,CAAC;SACH;KACF,EACD,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAE5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/totp.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function totpRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=totp.d.ts.map

package/dist/routes/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/routes/totp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAqB7E,wBAA8B,UAAU,CAAC,GAAG,EAAE,eAAe,iBAmG5D"}

package/dist/routes/totp.js

@@ -0,0 +1,78 @@
+import { z } from "zod";
+import { config } from "../config.js";
+import { generateSecret, buildProvisioningUri, verifyTOTP, encryptSecret, decryptSecret, generateBackupCodes, storeBackupCodes, verifyBackupCode, } from "../services/totp.js";
+const CodeSchema = z.object({
+    code: z.string().min(6).max(8),
+});
+const BackupCodeSchema = z.object({
+    code: z.string().min(8).max(16),
+});
+export default async function totpRoutes(app) {
+    app.post("/totp/enroll", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const user = request.user;
+        if (user.totpEnabled) {
+            return reply.status(409).send({ error: "TOTP already enrolled" });
+        }
+        const secret = generateSecret();
+        const encrypted = encryptSecret(secret);
+        const { codes, hashes } = generateBackupCodes();
+        await app.container.userRepository.setTotpSecret(user.id, encrypted);
+        await storeBackupCodes(user.id, hashes);
+        const provisioningUri = buildProvisioningUri({
+            secret,
+            email: user.email,
+            issuer: config.TOTP_ISSUER,
+        });
+        await request.audit("totp_enrolled", { userId: user.id });
+        return {
+            secret,
+            provisioningUri,
+            backupCodes: codes,
+        };
+    });
+    app.post("/totp/backup", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const user = request.user;
+        if (!user.totpSecret || !user.totpEnabled) {
+            return reply.status(400).send({ error: "TOTP not enabled" });
+        }
+        const body = BackupCodeSchema.parse(request.body);
+        const valid = await verifyBackupCode(user.id, body.code);
+        if (!valid) {
+            await request.audit("totp_verify_failed", { userId: user.id, method: "backup_code" });
+            return reply.status(400).send({ error: "Invalid backup code" });
+        }
+        await request.audit("totp_enabled", { userId: user.id, method: "backup_code" });
+        return { success: true };
+    });
+    app.post("/totp/verify", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const user = request.user;
+        if (!user.totpSecret) {
+            return reply.status(400).send({ error: "TOTP not enrolled" });
+        }
+        const body = CodeSchema.parse(request.body);
+        const secret = decryptSecret(user.totpSecret);
+        if (!verifyTOTP(secret, body.code)) {
+            await request.audit("totp_verify_failed", { userId: user.id });
+            return reply.status(400).send({ error: "Invalid code" });
+        }
+        await app.container.userRepository.enableTotp(user.id);
+        await request.audit("totp_enabled", { userId: user.id });
+        return { success: true };
+    });
+    app.post("/totp/disable", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const user = request.user;
+        if (!user.totpSecret || !user.totpEnabled) {
+            return reply.status(400).send({ error: "TOTP not enabled" });
+        }
+        const body = CodeSchema.parse(request.body);
+        const secret = decryptSecret(user.totpSecret);
+        if (!verifyTOTP(secret, body.code)) {
+            await request.audit("totp_disable_failed", { userId: user.id });
+            return reply.status(400).send({ error: "Invalid code" });
+        }
+        await app.container.userRepository.disableTotp(user.id);
+        await request.audit("totp_disabled", { userId: user.id });
+        return { success: true };
+    });
+}
+//# sourceMappingURL=totp.js.map

package/dist/routes/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/routes/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC3D,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QAEhD,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAExC,MAAM,eAAe,GAAG,oBAAoB,CAAC;YAC3C,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,MAAM,CAAC,WAAW;SAC3B,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1D,OAAO;YACL,MAAM;YACN,eAAe;YACf,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,cAAc,EACd,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,eAAe,EACf,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/webauthn.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function webauthnRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/routes/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/routes/webauthn.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAkD7E,wBAA8B,cAAc,CAAC,GAAG,EAAE,eAAe,iBA+FhE"}

package/dist/routes/webauthn.js

@@ -0,0 +1,100 @@
+import { z } from "zod";
+import { buildRegistrationOptions, verifyAndStoreRegistration, buildAuthenticationOptions, verifyAuthentication, consumeChallenge, } from "../services/webauthn.js";
+import { createTokenSet } from "../services/tokens.js";
+import { setSessionCookies } from "../plugins/auth.js";
+import { fingerprintFromRequest, recordDevice } from "../services/devices.js";
+import { toPublicUser } from "../types.js";
+const ChallengeCookieName = "keystone_webauthn_challenge";
+function setChallengeCookie(reply, challenge) {
+    reply.setCookie(ChallengeCookieName, challenge, {
+        path: "/",
+        httpOnly: true,
+        secure: process.env.COOKIE_SECURE === "true",
+        sameSite: "lax",
+        maxAge: 300,
+    });
+}
+function getChallengeCookie(request) {
+    return request.cookies[ChallengeCookieName];
+}
+function clearChallengeCookie(reply) {
+    reply.clearCookie(ChallengeCookieName, { path: "/" });
+}
+const RegisterVerifySchema = z.object({
+    response: z.record(z.unknown()),
+    deviceName: z.string().max(100).optional(),
+});
+const AuthenticateOptionsSchema = z.object({
+    email: z.string().email().optional(),
+});
+const AuthenticateVerifySchema = z.object({
+    response: z.record(z.unknown()),
+});
+export default async function webauthnRoutes(app) {
+    app.get("/webauthn/register/options", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const user = request.user;
+        const options = await buildRegistrationOptions(user);
+        setChallengeCookie(reply, options.challenge);
+        return options;
+    });
+    app.post("/webauthn/register/verify", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const user = request.user;
+        const body = RegisterVerifySchema.parse(request.body);
+        const challenge = getChallengeCookie(request);
+        if (!challenge) {
+            return reply.status(400).send({ error: "Challenge expired or missing" });
+        }
+        const stored = consumeChallenge(challenge);
+        if (!stored || stored.userId !== user.id) {
+            clearChallengeCookie(reply);
+            return reply.status(400).send({ error: "Invalid challenge" });
+        }
+        try {
+            await verifyAndStoreRegistration(user, body.response, challenge, body.deviceName);
+            clearChallengeCookie(reply);
+            await request.audit("webauthn_registered", { userId: user.id });
+            return { success: true };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Registration failed";
+            return reply.status(400).send({ error: message });
+        }
+    });
+    app.post("/webauthn/authenticate/options", async (request, reply) => {
+        const body = AuthenticateOptionsSchema.parse(request.body);
+        const options = await buildAuthenticationOptions(body.email);
+        setChallengeCookie(reply, options.challenge);
+        return options;
+    });
+    app.post("/webauthn/authenticate/verify", async (request, reply) => {
+        const body = AuthenticateVerifySchema.parse(request.body);
+        const challenge = getChallengeCookie(request);
+        if (!challenge) {
+            return reply.status(400).send({ error: "Challenge expired or missing" });
+        }
+        const stored = consumeChallenge(challenge);
+        if (!stored) {
+            clearChallengeCookie(reply);
+            return reply.status(400).send({ error: "Invalid challenge" });
+        }
+        try {
+            const { user } = await verifyAuthentication(body.response, challenge);
+            clearChallengeCookie(reply);
+            const fingerprint = fingerprintFromRequest(request);
+            await recordDevice(user.id, fingerprint, request.ip, request.headers["user-agent"]);
+            const tokens = await createTokenSet(user, request.ip, request.headers["user-agent"], {}, fingerprint);
+            setSessionCookies(reply, tokens.accessToken, tokens.refreshToken);
+            await request.audit("webauthn_authenticated", { userId: user.id });
+            return {
+                user: toPublicUser(user),
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken,
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Authentication failed";
+            return reply.status(400).send({ error: message });
+        }
+    });
+}
+//# sourceMappingURL=webauthn.js.map

package/dist/routes/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/routes/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAE1D,SAAS,kBAAkB,CAAC,KAAmB,EAAE,SAAiB;IAChE,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,SAAS,EAAE;QAC9C,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM;QAC5C,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuB;IACjD,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmB;IAC/C,KAAK,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IAC/D,GAAG,CAAC,GAAG,CACL,4BAA4B,EAC5B,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACrD,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,2BAA2B,EAC3B,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YACzC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,0BAA0B,CAC9B,IAAI,EACJ,IAAI,CAAC,QAA+C,EACpD,SAAS,EACT,IAAI,CAAC,UAAU,CAChB,CAAC;YACF,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;YAC3E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChG,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC/F,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,oBAAoB,CACzC,IAAI,CAAC,QAAiD,EACtD,SAAS,CACV,CAAC;YACF,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAC7B,EAAE,EACF,WAAW,CACZ,CAAC;YACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAElE,MAAM,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO;gBACL,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;gBACxB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAC7E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/workflows.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function workflowRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=workflows.d.ts.map

package/dist/routes/workflows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../src/routes/workflows.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAuC7E,wBAA8B,cAAc,CAAC,GAAG,EAAE,eAAe,iBAoHhE"}