@hilbras/keystone 1.1.0

package/dist/services/connectors/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA8CrE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAkDpG;AAED,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAEjD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAAC,CAepG"}

package/dist/services/connectors/registry.js

@@ -0,0 +1,109 @@
+import { config, isZitadelConfigured } from "../../config.js";
+import { getConnectorFactory } from "../plugins/registry.js";
+import { OidcConnector } from "./oidc.js";
+import { GoogleConnector } from "./google.js";
+import { ZitadelConnector } from "./zitadel.js";
+const wellKnownIssuers = {
+    google: {
+        issuer: "https://accounts.google.com",
+        authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
+        tokenEndpoint: "https://oauth2.googleapis.com/token",
+        userinfoEndpoint: "https://openidconnect.googleapis.com/v1/userinfo",
+        jwksUri: "https://www.googleapis.com/oauth2/v3/certs",
+    },
+    github: {
+        issuer: "https://github.com",
+        authorizationEndpoint: "https://github.com/login/oauth/authorize",
+        tokenEndpoint: "https://github.com/login/oauth/access_token",
+        userinfoEndpoint: "https://api.github.com/user",
+    },
+    azure: {
+        issuer: "https://login.microsoftonline.com/common/v2.0",
+        authorizationEndpoint: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+        tokenEndpoint: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+        userinfoEndpoint: "https://graph.microsoft.com/oidc/userinfo",
+        jwksUri: "https://login.microsoftonline.com/common/discovery/v2.0/keys",
+    },
+    okta: {
+        issuer: process.env.OKTA_ISSUER || "",
+        authorizationEndpoint: process.env.OKTA_AUTHORIZATION_ENDPOINT || "",
+        tokenEndpoint: process.env.OKTA_TOKEN_ENDPOINT || "",
+        userinfoEndpoint: process.env.OKTA_USERINFO_ENDPOINT || "",
+        jwksUri: process.env.OKTA_JWKS_URI || "",
+    },
+    keycloak: {
+        issuer: process.env.KEYCLOAK_ISSUER || "",
+        authorizationEndpoint: process.env.KEYCLOAK_AUTHORIZATION_ENDPOINT || "",
+        tokenEndpoint: process.env.KEYCLOAK_TOKEN_ENDPOINT || "",
+        userinfoEndpoint: process.env.KEYCLOAK_USERINFO_ENDPOINT || "",
+        jwksUri: process.env.KEYCLOAK_JWKS_URI || "",
+    },
+};
+function getProviderEnvPrefix(type) {
+    return type.toUpperCase();
+}
+export function buildConnector(type, overrides) {
+    const pluginFactory = getConnectorFactory(type);
+    if (pluginFactory) {
+        return pluginFactory(overrides);
+    }
+    if (type === "zitadel") {
+        if (!isZitadelConfigured()) {
+            throw new Error("Zitadel connector is not configured. Set ZITADEL_DOMAIN and ZITADEL_CLIENT_ID.");
+        }
+        return new ZitadelConnector({
+            issuer: config.ZITADEL_DOMAIN,
+            clientId: config.ZITADEL_CLIENT_ID,
+            clientSecret: config.ZITADEL_CLIENT_SECRET || "",
+            scopes: ["openid", "profile", "email"],
+            ...overrides,
+        });
+    }
+    const prefix = getProviderEnvPrefix(type);
+    const envClientId = process.env[`${prefix}_CLIENT_ID`] || "";
+    const envClientSecret = process.env[`${prefix}_CLIENT_SECRET`] || "";
+    const envIssuer = process.env[`${prefix}_ISSUER`] || "";
+    const wellKnown = wellKnownIssuers[type];
+    if (!wellKnown && !envIssuer) {
+        throw new Error(`${type} connector is not configured. Set ${prefix}_ISSUER, ${prefix}_CLIENT_ID, and ${prefix}_CLIENT_SECRET.`);
+    }
+    const cfg = {
+        issuer: envIssuer || wellKnown?.issuer,
+        authorizationEndpoint: process.env[`${prefix}_AUTHORIZATION_ENDPOINT`] || wellKnown?.authorizationEndpoint,
+        tokenEndpoint: process.env[`${prefix}_TOKEN_ENDPOINT`] || wellKnown?.tokenEndpoint,
+        userinfoEndpoint: process.env[`${prefix}_USERINFO_ENDPOINT`] || wellKnown?.userinfoEndpoint,
+        jwksUri: process.env[`${prefix}_JWKS_URI`] || wellKnown?.jwksUri,
+        clientId: envClientId || overrides?.clientId || "",
+        clientSecret: envClientSecret || overrides?.clientSecret || "",
+        scopes: ["openid", "profile", "email"],
+        ...overrides,
+    };
+    if (!cfg.clientId || !cfg.clientSecret || !cfg.issuer) {
+        throw new Error(`${type} connector is not fully configured. Set ${prefix}_CLIENT_ID, ${prefix}_CLIENT_SECRET, and ${prefix}_ISSUER.`);
+    }
+    if (type === "google") {
+        return new GoogleConnector(type, type, type, cfg);
+    }
+    return new OidcConnector(type, type, type, cfg);
+}
+export function listSupportedProviders() {
+    return ["zitadel", "google", "github", "azure", "okta", "keycloak"];
+}
+/**
+ * Returns supported providers annotated with whether they are currently
+ * configured with client credentials in the environment.
+ */
+export function listConfiguredProviders() {
+    return listSupportedProviders().map((type) => {
+        const prefix = type.toUpperCase();
+        let configured = false;
+        if (type === "zitadel") {
+            configured = Boolean(process.env.ZITADEL_DOMAIN && process.env.ZITADEL_CLIENT_ID);
+        }
+        else {
+            configured = Boolean(process.env[`${prefix}_CLIENT_ID`] && process.env[`${prefix}_CLIENT_SECRET`]);
+        }
+        return { type, name: type.charAt(0).toUpperCase() + type.slice(1), configured };
+    });
+}
+//# sourceMappingURL=registry.js.map

package/dist/services/connectors/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/services/connectors/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,gBAAgB,GAA4I;IAChK,MAAM,EAAE;QACN,MAAM,EAAE,6BAA6B;QACrC,qBAAqB,EAAE,8CAA8C;QACrE,aAAa,EAAE,qCAAqC;QACpD,gBAAgB,EAAE,kDAAkD;QACpE,OAAO,EAAE,4CAA4C;KACtD;IACD,MAAM,EAAE;QACN,MAAM,EAAE,oBAAoB;QAC5B,qBAAqB,EAAE,0CAA0C;QACjE,aAAa,EAAE,6CAA6C;QAC5D,gBAAgB,EAAE,6BAA6B;KAChD;IACD,KAAK,EAAE;QACL,MAAM,EAAE,+CAA+C;QACvD,qBAAqB,EAAE,gEAAgE;QACvF,aAAa,EAAE,4DAA4D;QAC3E,gBAAgB,EAAE,2CAA2C;QAC7D,OAAO,EAAE,8DAA8D;KACxE;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE;QACrC,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE;QACpE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE;QACpD,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE;QAC1D,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE;KACzC;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE;QACzC,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE;QACxE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE;QACxD,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE;QAC9D,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE;KAC7C;CACF,CAAC;AAEF,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,SAAoC;IAC/E,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,IAAI,gBAAgB,CAAC;YAC1B,MAAM,EAAE,MAAM,CAAC,cAAc;YAC7B,QAAQ,EAAE,MAAM,CAAC,iBAAkB;YACnC,YAAY,EAAE,MAAM,CAAC,qBAAqB,IAAI,EAAE;YAChD,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YACtC,GAAG,SAAS;SACb,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;IAExD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,MAAM,YAAY,MAAM,mBAAmB,MAAM,iBAAiB,CAAC,CAAC;IAClI,CAAC;IAED,MAAM,GAAG,GAAoB;QAC3B,MAAM,EAAE,SAAS,IAAI,SAAS,EAAE,MAAM;QACtC,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,yBAAyB,CAAC,IAAI,SAAS,EAAE,qBAAqB;QAC1G,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,iBAAiB,CAAC,IAAI,SAAS,EAAE,aAAa;QAClF,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,oBAAoB,CAAC,IAAI,SAAS,EAAE,gBAAgB;QAC3F,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,WAAW,CAAC,IAAI,SAAS,EAAE,OAAO;QAChE,QAAQ,EAAE,WAAW,IAAI,SAAS,EAAE,QAAQ,IAAI,EAAE;QAClD,YAAY,EAAE,eAAe,IAAI,SAAS,EAAE,YAAY,IAAI,EAAE;QAC9D,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;QACtC,GAAG,SAAS;KACb,CAAC;IAEF,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2CAA2C,MAAM,eAAe,MAAM,uBAAuB,MAAM,UAAU,CAAC,CAAC;IACxI,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,sBAAsB,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,UAAU,GAAG,KAAK,CAAC;QAEvB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACpF,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,OAAO,CAClB,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAC7E,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/connectors/types.d.ts

@@ -0,0 +1,36 @@
+export interface ExternalIdentity {
+    sub: string;
+    email: string;
+    emailVerified?: boolean;
+    name?: string;
+    picture?: string;
+    username?: string;
+    raw?: Record<string, unknown>;
+}
+export interface AuthorizeUrlOptions {
+    state: string;
+    redirectUri: string;
+    scopes?: string[];
+    extraParams?: Record<string, string>;
+}
+export interface IdentityConnector {
+    id: string;
+    name: string;
+    type: string;
+    getAuthorizeUrl(opts: AuthorizeUrlOptions): string | Promise<string>;
+    exchangeCode(code: string, redirectUri: string): Promise<ExternalIdentity>;
+    verifyToken?(token: string): Promise<ExternalIdentity>;
+}
+export interface ConnectorConfig {
+    issuer?: string;
+    authorizationEndpoint?: string;
+    tokenEndpoint?: string;
+    userinfoEndpoint?: string;
+    jwksUri?: string;
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[];
+    idpHint?: string;
+    attributeMapping?: Record<string, string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/services/connectors/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3E,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C"}

package/dist/services/connectors/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/services/connectors/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/connectors/types.ts"],"names":[],"mappings":""}

package/dist/services/connectors/zitadel.d.ts

@@ -0,0 +1,14 @@
+import type { IdentityConnector, ExternalIdentity, AuthorizeUrlOptions, ConnectorConfig } from "./types.js";
+export declare class ZitadelConnector implements IdentityConnector {
+    id: string;
+    name: string;
+    type: string;
+    private cfg;
+    private cachedJwksUrl;
+    constructor(cfg: ConnectorConfig);
+    getAuthorizeUrl(opts: AuthorizeUrlOptions): string;
+    exchangeCode(code: string, redirectUri: string): Promise<ExternalIdentity>;
+    verifyToken(token: string): Promise<ExternalIdentity>;
+    private getJwksUrl;
+}
+//# sourceMappingURL=zitadel.d.ts.map

package/dist/services/connectors/zitadel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadel.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/zitadel.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG5G,qBAAa,gBAAiB,YAAW,iBAAiB;IACxD,EAAE,SAAa;IACf,IAAI,SAAa;IACjB,IAAI,SAAa;IACjB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,aAAa,CAAuB;gBAEhC,GAAG,EAAE,eAAe;IAIhC,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM;IAe5C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAwB1E,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAa7C,UAAU;CAQzB"}

package/dist/services/connectors/zitadel.js

@@ -0,0 +1,70 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { config, zitadelBaseUrl } from "../../config.js";
+import { normalizePayload } from "./oidc.js";
+export class ZitadelConnector {
+    id = "zitadel";
+    name = "Zitadel";
+    type = "zitadel";
+    cfg;
+    cachedJwksUrl = null;
+    constructor(cfg) {
+        this.cfg = cfg;
+    }
+    getAuthorizeUrl(opts) {
+        const redirectUri = opts.redirectUri;
+        const params = new URLSearchParams({
+            client_id: this.cfg.clientId,
+            redirect_uri: redirectUri,
+            response_type: "code",
+            scope: (opts.scopes ?? ["openid", "profile", "email"]).join(" "),
+            state: opts.state,
+        });
+        if (this.cfg.idpHint) {
+            params.set("idp_hint", this.cfg.idpHint);
+        }
+        return `${zitadelBaseUrl()}/oauth/v2/authorize?${params.toString()}`;
+    }
+    async exchangeCode(code, redirectUri) {
+        const params = new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: this.cfg.clientId,
+            client_secret: this.cfg.clientSecret,
+            code,
+            redirect_uri: redirectUri,
+        });
+        const res = await fetch(`${zitadelBaseUrl()}/oauth/v2/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: params.toString(),
+        });
+        if (!res.ok) {
+            const text = await res.text();
+            throw new Error(`Zitadel token exchange failed: ${res.status} ${text}`);
+        }
+        const data = (await res.json());
+        return this.verifyToken(data.id_token);
+    }
+    async verifyToken(token) {
+        const jwksUrl = await this.getJwksUrl();
+        const JWKS = createRemoteJWKSet(new URL(jwksUrl));
+        const issuer = config.ZITADEL_DOMAIN.startsWith("http")
+            ? config.ZITADEL_DOMAIN
+            : `https://${config.ZITADEL_DOMAIN}`;
+        const { payload } = await jwtVerify(token, JWKS, {
+            issuer,
+            audience: this.cfg.clientId,
+        });
+        return normalizePayload(payload, this.cfg.attributeMapping);
+    }
+    async getJwksUrl() {
+        if (this.cachedJwksUrl)
+            return this.cachedJwksUrl;
+        const res = await fetch(`${zitadelBaseUrl()}/.well-known/openid-configuration`);
+        if (!res.ok)
+            throw new Error(`Zitadel discovery failed: ${res.status}`);
+        const discovery = (await res.json());
+        this.cachedJwksUrl = discovery.jwks_uri || `${zitadelBaseUrl()}/oauth/v2/keys`;
+        return this.cachedJwksUrl;
+    }
+}
+//# sourceMappingURL=zitadel.js.map

package/dist/services/connectors/zitadel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zitadel.js","sourceRoot":"","sources":["../../../src/services/connectors/zitadel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,OAAO,gBAAgB;IAC3B,EAAE,GAAG,SAAS,CAAC;IACf,IAAI,GAAG,SAAS,CAAC;IACjB,IAAI,GAAG,SAAS,CAAC;IACT,GAAG,CAAkB;IACrB,aAAa,GAAkB,IAAI,CAAC;IAE5C,YAAY,GAAoB;QAC9B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,eAAe,CAAC,IAAyB;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAChE,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,cAAc,EAAE,uBAAuB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAClD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;YACpC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,iBAAiB,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAe,CAAC,UAAU,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,MAAM,CAAC,cAAe;YACxB,CAAC,CAAC,WAAW,MAAM,CAAC,cAAe,EAAE,CAAC;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,OAAkC,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,mCAAmC,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,IAAI,CAAC,aAAa,GAAI,SAAS,CAAC,QAAmB,IAAI,GAAG,cAAc,EAAE,gBAAgB,CAAC;QAC3F,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF"}

package/dist/services/devices.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyRequest } from "fastify";
+export declare function fingerprintFromRequest(request: FastifyRequest): string;
+export declare function recordDevice(userId: string, fingerprint: string, ip?: string, userAgent?: string): Promise<string>;
+//# sourceMappingURL=devices.d.ts.map

package/dist/services/devices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.d.ts","sourceRoot":"","sources":["../../src/services/devices.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAM9C,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAMtE;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,EAAE,CAAC,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,mBAwDnB"}

package/dist/services/devices.js

@@ -0,0 +1,59 @@
+import crypto from "node:crypto";
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { userDevices, users } from "../db/schema.js";
+import { sendNewDeviceAlert } from "./email.js";
+export function fingerprintFromRequest(request) {
+    const ip = request.ip || "unknown";
+    const userAgent = request.headers["user-agent"] || "unknown";
+    const acceptLanguage = request.headers["accept-language"] || "unknown";
+    const value = `${ip}:${userAgent}:${acceptLanguage}`;
+    return crypto.createHash("sha256").update(value).digest("hex");
+}
+export async function recordDevice(userId, fingerprint, ip, userAgent) {
+    const now = new Date();
+    const [existing] = await db
+        .select({ id: userDevices.id })
+        .from(userDevices)
+        .where(and(eq(userDevices.userId, userId), eq(userDevices.fingerprintHash, fingerprint)))
+        .limit(1);
+    if (existing) {
+        await db
+            .update(userDevices)
+            .set({
+            lastSeenAt: now,
+            ipAddress: ip ?? null,
+            userAgent: userAgent ?? null,
+        })
+            .where(eq(userDevices.id, existing.id));
+        return existing.id;
+    }
+    const [record] = await db
+        .insert(userDevices)
+        .values({
+        userId,
+        fingerprintHash: fingerprint,
+        ipAddress: ip ?? null,
+        userAgent: userAgent ?? null,
+        firstSeenAt: now,
+        lastSeenAt: now,
+    })
+        .returning();
+    // Send new-device alert asynchronously; do not block the login flow.
+    const [user] = await db.select().from(users).where(eq(users.id, userId)).limit(1);
+    if (user && !record.newDeviceAlertSent) {
+        sendNewDeviceAlert({
+            email: user.email,
+            ipAddress: ip,
+            userAgent: userAgent,
+        }).catch((err) => {
+            console.error("[devices] failed to send new-device alert:", err);
+        });
+        await db
+            .update(userDevices)
+            .set({ newDeviceAlertSent: true })
+            .where(eq(userDevices.id, record.id));
+    }
+    return record.id;
+}
+//# sourceMappingURL=devices.js.map

package/dist/services/devices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.js","sourceRoot":"","sources":["../../src/services/devices.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,UAAU,sBAAsB,CAAC,OAAuB;IAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;IAC7D,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;IACvE,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;IACrD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,WAAmB,EACnB,EAAW,EACX,SAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;SAC9B,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,WAAW,CAAC,CAC7C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC;YACH,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,EAAE,IAAI,IAAI;YACrB,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,WAAW,CAAC;SACnB,MAAM,CAAC;QACN,MAAM;QACN,eAAe,EAAE,WAAW;QAC5B,SAAS,EAAE,EAAE,IAAI,IAAI;QACrB,SAAS,EAAE,SAAS,IAAI,IAAI;QAC5B,WAAW,EAAE,GAAG;QAChB,UAAU,EAAE,GAAG;KAChB,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,qEAAqE;IACrE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACvC,kBAAkB,CAAC;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACxB,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,MAAM,EAAE;aACL,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;aACjC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,MAAM,CAAC,EAAE,CAAC;AACnB,CAAC"}

package/dist/services/domain/authentication.d.ts

@@ -0,0 +1,51 @@
+import { type User } from "../../db/schema.js";
+import { type TokenSet } from "../tokens.js";
+import type { UserRepository, ApplicationRepository } from "../../repositories/types.js";
+import { type Result } from "../../lib/result.js";
+export interface AuthContext {
+    app?: {
+        id: string;
+        clientId: string;
+        orgId: string;
+    };
+    org?: {
+        id: string;
+    };
+}
+export interface RegisterInput {
+    username: string;
+    email: string;
+    password: string;
+    name?: string;
+    clientId?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface LoginInput {
+    email: string;
+    password: string;
+    clientId?: string;
+}
+export interface TokenResponse {
+    user: User;
+    tokens: TokenSet;
+    context: AuthContext;
+}
+export declare class AuthenticationDomainService {
+    private readonly users;
+    private readonly applications;
+    constructor(users: UserRepository, applications: ApplicationRepository);
+    private loadAppContext;
+    register(input: RegisterInput): Promise<Result<TokenResponse>>;
+    login(input: LoginInput): Promise<Result<TokenResponse>>;
+    refresh(refreshToken: string, clientId?: string): Promise<Result<{
+        tokens: TokenSet;
+        userId?: string;
+    }>>;
+    logout(refreshToken?: string): Promise<Result<void>>;
+    createPasswordResetToken(email: string): Promise<Result<{
+        token: string;
+        user: User;
+    } | null>>;
+    resetPasswordWithToken(token: string, newPassword: string): Promise<Result<User>>;
+}
+//# sourceMappingURL=authentication.d.ts.map

package/dist/services/domain/authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,KAAK,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE3E,OAAO,EAA0D,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAIrG,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,qBAAa,2BAA2B;IAEpC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,KAAK,EAAE,cAAc,EACrB,YAAY,EAAE,qBAAqB;YAGxC,cAAc;IAUtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA8E9D,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA6DxD,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAWxG,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAOpD,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAkB9F,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CA+CxF"}

package/dist/services/domain/authentication.js

@@ -0,0 +1,218 @@
+import crypto from "node:crypto";
+import { eq, and, gt, isNull } from "drizzle-orm";
+import { config, isZitadelConfigured } from "../../config.js";
+import { db } from "../../db/index.js";
+import { users, passwordResetTokens } from "../../db/schema.js";
+import { createHumanUser, verifyPassword as verifyZitadelPassword } from "../zitadel.js";
+import { createTokenSet, rotateRefreshToken, revokeRefreshToken } from "../tokens.js";
+import { isPasswordBreached } from "../hibp.js";
+import { recordFailedLogin, isFailedLoginAnomaly } from "../anomalyDetection.js";
+import { emit } from "../events/bus.js";
+import { ok, err } from "../../lib/result.js";
+import { hashPassword, verifyPassword } from "../secrets/index.js";
+export class AuthenticationDomainService {
+    users;
+    applications;
+    constructor(users, applications) {
+        this.users = users;
+        this.applications = applications;
+    }
+    async loadAppContext(clientId) {
+        if (!clientId)
+            return {};
+        const app = await this.applications.findByClientId(clientId);
+        if (!app)
+            return {};
+        return {
+            app: { id: app.id, clientId: app.clientId, orgId: app.orgId },
+            org: { id: app.orgId },
+        };
+    }
+    async register(input) {
+        if (config.HIBP_CHECK_ENABLED) {
+            const breached = await isPasswordBreached(input.password);
+            if (breached) {
+                return err({ code: "BREACHED_PASSWORD", message: "This password has appeared in a data breach.", statusCode: 400 });
+            }
+        }
+        const existing = await this.users.findByEmail(input.email);
+        if (existing) {
+            return err({ code: "EMAIL_EXISTS", message: "An account with this email already exists.", statusCode: 409 });
+        }
+        const passwordHash = await hashPassword(input.password);
+        const username = await this.users.ensureUniqueUsername(input.username.toLowerCase().trim().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32));
+        let zitadelUserId;
+        if (isZitadelConfigured()) {
+            try {
+                zitadelUserId = await createHumanUser({
+                    username: input.username,
+                    email: input.email,
+                    name: input.name || input.username,
+                    password: input.password,
+                });
+            }
+            catch (err) {
+                console.warn("Zitadel user mirror failed; continuing with local user", err);
+            }
+        }
+        const user = await this.users.create({
+            email: input.email,
+            username,
+            name: input.name || input.username,
+            passwordHash,
+            provider: "password",
+            emailVerified: !config.EMAIL_VERIFICATION_REQUIRED,
+            zitadelUserId,
+            metadata: input.metadata,
+        });
+        if (config.EMAIL_VERIFICATION_REQUIRED) {
+            try {
+                const { sendVerificationEmail } = await import("../emailVerification.js");
+                sendVerificationEmail(user).catch((err) => {
+                    console.error("[auth] failed to send verification email:", err);
+                });
+            }
+            catch {
+                // emailVerification module may not be available in all configurations
+            }
+        }
+        const context = await this.loadAppContext(input.clientId);
+        const tokens = await createTokenSet(user, undefined, undefined, {
+            appId: context.app?.id,
+            orgId: context.org?.id,
+            clientId: context.app?.clientId,
+        });
+        await emit({
+            type: "user_registered",
+            payload: {
+                provider: "password",
+                zitadelUserId,
+                userId: user.id,
+                username: user.username,
+                email: user.email,
+                client_id: input.clientId,
+                appId: context.app?.id,
+                orgId: context.org?.id,
+            },
+        });
+        return ok({ user, tokens, context });
+    }
+    async login(input) {
+        const user = await this.users.findByEmail(input.email);
+        if (!user) {
+            if (isZitadelConfigured()) {
+                await verifyZitadelPassword(input.email, input.password).catch(() => { });
+            }
+            await recordFailedLogin(input.email);
+            await emit({ type: "user_login_failed", payload: { reason: "unknown_user" } });
+            if (await isFailedLoginAnomaly(input.email)) {
+                return err({ code: "TOO_MANY_ATTEMPTS", message: "Too many failed attempts. Please try again later.", statusCode: 429 });
+            }
+            return err({ code: "INVALID_CREDENTIALS", message: "Invalid email or password.", statusCode: 401 });
+        }
+        if (user.lockedUntil && user.lockedUntil > new Date()) {
+            await emit({ type: "user_login_failed", payload: { reason: "account_locked", userId: user.id } });
+            return err({ code: "ACCOUNT_LOCKED", message: "Account is temporarily locked due to too many failed attempts. Try again later.", statusCode: 403 });
+        }
+        let valid = false;
+        if (user.passwordHash) {
+            valid = await verifyPassword(input.password, user.passwordHash);
+        }
+        else if (user.provider === "zitadel" && isZitadelConfigured()) {
+            valid = await verifyZitadelPassword(input.email, input.password);
+        }
+        if (!valid) {
+            const updated = await this.users.recordFailedLogin(user.id);
+            await emit({ type: "user_login_failed", payload: { reason: "invalid_password", userId: user.id } });
+            const attempts = updated?.failedLoginAttempts ?? 0;
+            if (attempts >= config.ACCOUNT_LOCKOUT_THRESHOLD) {
+                const lockedUntil = new Date(Date.now() + config.ACCOUNT_LOCKOUT_DURATION_SECONDS * 1000);
+                await this.users.lockAccount(user.id, lockedUntil);
+                return err({ code: "ACCOUNT_LOCKED", message: "Account locked due to too many failed attempts. Try again later.", statusCode: 403 });
+            }
+            if (await isFailedLoginAnomaly(user.id)) {
+                return err({ code: "TOO_MANY_ATTEMPTS", message: "Too many failed attempts. Please try again later.", statusCode: 429 });
+            }
+            return err({ code: "INVALID_CREDENTIALS", message: "Invalid email or password.", statusCode: 401 });
+        }
+        await this.users.resetFailedLogins(user.id);
+        await this.users.updateLastSeen(user.id);
+        const context = await this.loadAppContext(input.clientId);
+        const tokens = await createTokenSet(user, undefined, undefined, {
+            appId: context.app?.id,
+            orgId: context.org?.id,
+            clientId: context.app?.clientId,
+        });
+        await emit({
+            type: "user_login",
+            payload: { provider: user.provider, userId: user.id, appId: context.app?.id, orgId: context.org?.id },
+        });
+        return ok({ user, tokens, context });
+    }
+    async refresh(refreshToken, clientId) {
+        const tokens = await rotateRefreshToken(refreshToken, undefined, undefined);
+        if (!tokens) {
+            await emit({ type: "token_refresh_failed", payload: { reason: "invalid_refresh_token" } });
+            return err({ code: "INVALID_REFRESH_TOKEN", message: "Invalid or expired session.", statusCode: 401 });
+        }
+        await emit({ type: "token_refresh", payload: {} });
+        return ok({ tokens, userId: undefined });
+    }
+    async logout(refreshToken) {
+        if (refreshToken) {
+            await revokeRefreshToken(refreshToken);
+        }
+        return ok(undefined);
+    }
+    async createPasswordResetToken(email) {
+        const user = await this.users.findByEmail(email);
+        if (!user)
+            return ok(null);
+        const token = crypto.randomBytes(48).toString("base64url");
+        const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
+        const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
+        await db.insert(passwordResetTokens).values({
+            userId: user.id,
+            tokenHash,
+            expiresAt,
+        });
+        await emit({ type: "password_reset_requested", payload: { userId: user.id } });
+        return ok({ token, user });
+    }
+    async resetPasswordWithToken(token, newPassword) {
+        const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
+        const now = new Date();
+        const [record] = await db
+            .select()
+            .from(passwordResetTokens)
+            .where(and(eq(passwordResetTokens.tokenHash, tokenHash), gt(passwordResetTokens.expiresAt, now), isNull(passwordResetTokens.usedAt)))
+            .limit(1);
+        if (!record) {
+            return err({ code: "INVALID_TOKEN", message: "Invalid or expired reset token.", statusCode: 400 });
+        }
+        const user = await this.users.findById(record.userId);
+        if (!user) {
+            return err({ code: "USER_NOT_FOUND", message: "User not found.", statusCode: 400 });
+        }
+        if (config.HIBP_CHECK_ENABLED) {
+            const breached = await isPasswordBreached(newPassword);
+            if (breached) {
+                return err({ code: "BREACHED_PASSWORD", message: "This password has appeared in a data breach.", statusCode: 400 });
+            }
+        }
+        const passwordHash = await hashPassword(newPassword);
+        await db.transaction(async (tx) => {
+            await tx
+                .update(passwordResetTokens)
+                .set({ usedAt: now })
+                .where(eq(passwordResetTokens.id, record.id));
+            await tx
+                .update(users)
+                .set({ passwordHash, updatedAt: now })
+                .where(eq(users.id, user.id));
+        });
+        await emit({ type: "password_reset_completed", payload: { userId: user.id } });
+        return ok(user);
+    }
+}
+//# sourceMappingURL=authentication.js.map

package/dist/services/domain/authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAa,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,cAAc,IAAI,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAiB,MAAM,cAAc,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA4BnE,MAAM,OAAO,2BAA2B;IAEnB;IACA;IAFnB,YACmB,KAAqB,EACrB,YAAmC;QADnC,UAAK,GAAL,KAAK,CAAgB;QACrB,iBAAY,GAAZ,YAAY,CAAuB;IACnD,CAAC;IAEI,KAAK,CAAC,cAAc,CAAC,QAAiB;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE;YAC7D,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE;SACvB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1D,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4CAA4C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CACpD,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CACvG,CAAC;QAEF,IAAI,aAAiC,CAAC;QACtC,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,eAAe,CAAC;oBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;oBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,GAAG,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;YAClC,YAAY;YACZ,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,CAAC,MAAM,CAAC,2BAA2B;YAClD,aAAa;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;gBAC1E,qBAAqB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACjD,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAClE,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ;SAChC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE;gBACP,QAAQ,EAAE,UAAU;gBACpB,aAAa;gBACb,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;gBACtB,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,mBAAmB,EAAE,EAAE,CAAC;gBAC1B,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,MAAM,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iFAAiF,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtJ,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAEpG,MAAM,QAAQ,GAAG,OAAO,EAAE,mBAAmB,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACjD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;gBAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;gBACnD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kEAAkE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACvI,CAAC;YAED,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ;SAChC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE;SACtG,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC3F,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAqB;QAChC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAE3B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QAElE,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;YAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS;YACT,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,mBAAmB,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,EAC5C,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,EACtC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iCAAiC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAChC,MAAM,EAAE;iBACL,MAAM,CAAC,mBAAmB,CAAC;iBAC3B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;iBACpB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD,MAAM,EAAE;iBACL,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACrC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;CACF"}