@hilbras/keystone 1.1.0

package/dist/services/tokens.js

@@ -0,0 +1,205 @@
+import crypto from "node:crypto";
+import { SignJWT, importPKCS8, importSPKI, jwtVerify, decodeProtectedHeader, exportJWK, } from "jose";
+import { eq, and, gt, isNull } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { refreshTokens, users, } from "../db/schema.js";
+import { config } from "../config.js";
+import { getActiveSigningKey, listValidSigningKeys, } from "./secrets.js";
+import { SessionRepository } from "../repositories/session.js";
+/** Active signing key used to issue new tokens. */
+let activeKey = null;
+/** All valid signing keys (active + grace-period keys) used for verification. */
+const validKeys = new Map();
+export async function loadSigningKeys() {
+    if (config.JWT_PRIVATE_KEY && config.JWT_PUBLIC_KEY) {
+        const privateKey = await importPKCS8(config.JWT_PRIVATE_KEY, "RS256");
+        const publicKey = await importSPKI(config.JWT_PUBLIC_KEY, "RS256");
+        activeKey = { keyId: "env", privateKey, publicKey };
+        validKeys.set(activeKey.keyId, activeKey);
+        return;
+    }
+    activeKey = await getActiveSigningKey();
+    const keys = await listValidSigningKeys();
+    validKeys.clear();
+    for (const key of keys) {
+        validKeys.set(key.keyId, key);
+    }
+}
+/**
+ * Return the public JWK for the active signing key. Kept for backwards
+ * compatibility; new code should prefer `getPublicJwks()`.
+ */
+export async function getPublicJWK() {
+    if (!activeKey)
+        await loadSigningKeys();
+    return exportJWK(activeKey.publicKey);
+}
+/**
+ * Return the JWKS document containing every valid public key, including
+ * recently rotated keys still within the grace period.
+ */
+export async function getPublicJwks() {
+    if (validKeys.size === 0)
+        await loadSigningKeys();
+    const keys = await Promise.all(Array.from(validKeys.values()).map(async (key) => {
+        const jwk = await exportJWK(key.publicKey);
+        return { ...jwk, kid: key.keyId, use: "sig", key_ops: ["verify"] };
+    }));
+    return { keys };
+}
+function issuer() {
+    return process.env.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}`;
+}
+export function createAccessToken(user, opts = {}) {
+    if (!activeKey)
+        throw new Error("JWT signing keys not loaded");
+    const claims = {
+        sub: user.id,
+        email: user.email,
+        username: user.username,
+        name: user.name ?? undefined,
+        plan: user.plan,
+        role: user.role,
+        provider: user.provider,
+    };
+    if (opts.orgId)
+        claims.org_id = opts.orgId;
+    if (opts.appId)
+        claims.app_id = opts.appId;
+    if (opts.clientId)
+        claims.client_id = opts.clientId;
+    if (opts.deviceFingerprint)
+        claims.device_fingerprint = opts.deviceFingerprint;
+    return new SignJWT(claims)
+        .setProtectedHeader({ alg: "RS256", typ: "JWT", kid: activeKey.keyId })
+        .setIssuedAt()
+        .setIssuer(issuer())
+        .setAudience("hilbras")
+        .setExpirationTime(`${config.ACCESS_TOKEN_TTL_SECONDS}s`)
+        .sign(activeKey.privateKey);
+}
+export function createApplicationAccessToken(opts) {
+    if (!activeKey)
+        throw new Error("JWT signing keys not loaded");
+    const claims = {
+        sub: opts.clientId,
+        client_id: opts.clientId,
+        app_id: opts.appId,
+        org_id: opts.orgId,
+    };
+    if (opts.scopes && opts.scopes.length > 0) {
+        claims.scope = opts.scopes.join(" ");
+    }
+    return new SignJWT(claims)
+        .setProtectedHeader({ alg: "RS256", typ: "JWT", kid: activeKey.keyId })
+        .setIssuedAt()
+        .setIssuer(issuer())
+        .setAudience("hilbras")
+        .setExpirationTime(`${config.ACCESS_TOKEN_TTL_SECONDS}s`)
+        .sign(activeKey.privateKey);
+}
+export async function createIdToken(user, app, nonce) {
+    if (!activeKey)
+        throw new Error("JWT signing keys not loaded");
+    const claims = {
+        sub: user.id,
+        email: user.email,
+        email_verified: user.emailVerified,
+        username: user.username,
+        name: user.name,
+        picture: user.avatarUrl,
+        aud: app.clientId,
+        azp: app.clientId,
+    };
+    if (nonce)
+        claims.nonce = nonce;
+    return new SignJWT(claims)
+        .setProtectedHeader({ alg: "RS256", typ: "JWT", kid: activeKey.keyId })
+        .setIssuedAt()
+        .setIssuer(issuer())
+        .setExpirationTime(`${config.ACCESS_TOKEN_TTL_SECONDS}s`)
+        .sign(activeKey.privateKey);
+}
+export async function createTokenSet(user, ip, userAgent, opts = {}, deviceFingerprint) {
+    const accessToken = await createAccessToken(user, opts);
+    const refreshToken = crypto.randomBytes(48).toString("base64url");
+    const refreshTokenHash = hashToken(refreshToken);
+    const expiresAt = new Date(Date.now() + config.REFRESH_TOKEN_TTL_SECONDS * 1000);
+    const [inserted] = await db.insert(refreshTokens).values({
+        userId: user.id,
+        appId: opts.appId ?? null,
+        tokenHash: refreshTokenHash,
+        expiresAt,
+        ipAddress: ip ?? null,
+        userAgent: userAgent ?? null,
+        deviceFingerprint: deviceFingerprint ?? null,
+    }).returning();
+    try {
+        const sessions = new SessionRepository();
+        await sessions.create({
+            userId: user.id,
+            refreshTokenId: inserted.id,
+            deviceFingerprint,
+            ipAddress: ip,
+            userAgent,
+            expiresAt,
+        });
+    }
+    catch {
+        // Session tracking is best-effort; token creation must not fail because of it.
+    }
+    return { accessToken, refreshToken, refreshTokenHash, expiresAt };
+}
+export async function verifyAccessToken(token) {
+    if (!activeKey)
+        await loadSigningKeys();
+    const header = decodeProtectedHeader(token);
+    const keyPair = header.kid ? validKeys.get(header.kid) : undefined;
+    const publicKey = keyPair?.publicKey ?? activeKey?.publicKey;
+    if (!publicKey) {
+        throw new Error("JWT signing keys not loaded");
+    }
+    const { payload } = await jwtVerify(token, publicKey, {
+        issuer: issuer(),
+        audience: "hilbras",
+    });
+    return payload;
+}
+export async function rotateRefreshToken(token, ip, userAgent) {
+    const hash = hashToken(token);
+    const now = new Date();
+    const [existing] = await db
+        .select()
+        .from(refreshTokens)
+        .where(and(eq(refreshTokens.tokenHash, hash), gt(refreshTokens.expiresAt, now), isNull(refreshTokens.revokedAt)))
+        .limit(1);
+    if (!existing)
+        return null;
+    // Revoke old token immediately.
+    await db
+        .update(refreshTokens)
+        .set({ revokedAt: now })
+        .where(eq(refreshTokens.id, existing.id));
+    const [user] = await db.select().from(users).where(eq(users.id, existing.userId)).limit(1);
+    if (!user)
+        return null;
+    return createTokenSet(user, ip, userAgent, {
+        appId: existing.appId ?? undefined,
+        orgId: undefined,
+        clientId: undefined,
+        deviceFingerprint: existing.deviceFingerprint ?? undefined,
+    }, existing.deviceFingerprint ?? undefined);
+}
+export async function revokeRefreshToken(token) {
+    const hash = hashToken(token);
+    await db.update(refreshTokens).set({ revokedAt: new Date() }).where(eq(refreshTokens.tokenHash, hash));
+}
+export async function revokeAllUserRefreshTokens(userId) {
+    await db.update(refreshTokens).set({ revokedAt: new Date() }).where(eq(refreshTokens.userId, userId));
+}
+function hashToken(token) {
+    return crypto.createHash("sha256").update(token).digest("hex");
+}
+// Re-exported from secrets service for backwards compatibility.
+export { hashApiKey, generateApiKey } from "./secrets.js";
+//# sourceMappingURL=tokens.js.map

package/dist/services/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/services/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,OAAO,EACP,WAAW,EACX,UAAU,EACV,SAAS,EACT,qBAAqB,EACrB,SAAS,GAGV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,aAAa,EACb,KAAK,GAIN,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,mDAAmD;AACnD,IAAI,SAAS,GAA0B,IAAI,CAAC;AAC5C,iFAAiF;AACjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACnE,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACpD,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IAED,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,CAAC,SAAS;QAAE,MAAM,eAAe,EAAE,CAAC;IACxC,OAAO,SAAS,CAAC,SAAU,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,eAAe,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,MAAM;IACb,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9E,CAAC;AASD,MAAM,UAAU,iBAAiB,CAAC,IAAU,EAAE,OAA2B,EAAE;IACzE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAgB;QAC1B,GAAG,EAAE,IAAI,CAAC,EAAE;QACZ,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3C,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;IACpD,IAAI,IAAI,CAAC,iBAAiB;QAAE,MAAM,CAAC,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAC/E,OAAO,IAAI,OAAO,CAAC,MAA4C,CAAC;SAC7D,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SACtE,WAAW,EAAE;SACb,SAAS,CAAC,MAAM,EAAE,CAAC;SACnB,WAAW,CAAC,SAAS,CAAC;SACtB,iBAAiB,CAAC,GAAG,MAAM,CAAC,wBAAwB,GAAG,CAAC;SACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AASD,MAAM,UAAU,4BAA4B,CAC1C,IAAmC;IAEnC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,MAAM,EAAE,IAAI,CAAC,KAAK;KACnB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SACtE,WAAW,EAAE;SACb,SAAS,CAAC,MAAM,EAAE,CAAC;SACnB,WAAW,CAAC,SAAS,CAAC;SACtB,iBAAiB,CAAC,GAAG,MAAM,CAAC,wBAAwB,GAAG,CAAC;SACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAU,EACV,GAAgB,EAChB,KAAc;IAEd,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,IAAI,CAAC,EAAE;QACZ,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,aAAa;QAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,GAAG,EAAE,GAAG,CAAC,QAAQ;KAClB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAChC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SACtE,WAAW,EAAE;SACb,SAAS,CAAC,MAAM,EAAE,CAAC;SACnB,iBAAiB,CAAC,GAAG,MAAM,CAAC,wBAAwB,GAAG,CAAC;SACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAU,EACV,EAAW,EACX,SAAkB,EAClB,OAA2B,EAAE,EAC7B,iBAA0B;IAE1B,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAEjF,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;QACvD,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,SAAS,EAAE,gBAAgB;QAC3B,SAAS;QACT,SAAS,EAAE,EAAE,IAAI,IAAI;QACrB,SAAS,EAAE,SAAS,IAAI,IAAI;QAC5B,iBAAiB,EAAE,iBAAiB,IAAI,IAAI;KAC7C,CAAC,CAAC,SAAS,EAAE,CAAC;IAEf,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,QAAQ,CAAC,MAAM,CAAC;YACpB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,cAAc,EAAE,QAAQ,CAAC,EAAE;YAC3B,iBAAiB;YACjB,SAAS,EAAE,EAAE;YACb,SAAS;YACT,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;IACjF,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa;IACnD,IAAI,CAAC,SAAS;QAAE,MAAM,eAAe,EAAE,CAAC;IAExC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,SAAS,EAAE,SAAS,CAAC;IAE7D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE;QACpD,MAAM,EAAE,MAAM,EAAE;QAChB,QAAQ,EAAE,SAAS;KACpB,CAAC,CAAC;IACH,OAAO,OAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,EAAW,EACX,SAAkB;IAElB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,aAAa,CAAC;SACnB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,EACjC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,EAChC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAChC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,gCAAgC;IAChC,MAAM,EAAE;SACL,MAAM,CAAC,aAAa,CAAC;SACrB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACvB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,OAAO,cAAc,CACnB,IAAI,EACJ,EAAE,EACF,SAAS,EACT;QACE,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,SAAS;QAClC,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,IAAI,SAAS;KAC3D,EACD,QAAQ,CAAC,iBAAiB,IAAI,SAAS,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa;IACpD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,MAAc;IAC7D,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/services/totp.d.ts

@@ -0,0 +1,16 @@
+export declare function generateSecret(): string;
+export declare function buildProvisioningUri(input: {
+    secret: string;
+    email: string;
+    issuer?: string;
+}): string;
+export declare function verifyTOTP(secret: string, code: string, window?: number): boolean;
+export declare function encryptSecret(secret: string): string;
+export declare function decryptSecret(encrypted: string): string;
+export declare function generateBackupCodes(): {
+    codes: string[];
+    hashes: string[];
+};
+export declare function storeBackupCodes(userId: string, codeHashes: string[]): Promise<void>;
+export declare function verifyBackupCode(userId: string, code: string): Promise<boolean>;
+//# sourceMappingURL=totp.d.ts.map

package/dist/services/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/services/totp.ts"],"names":[],"mappings":"AAkBA,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAWtG;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,OAAO,CAa5E;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CASvD;AAED,wBAAgB,mBAAmB,IAAI;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAS3E;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1F;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBrF"}

package/dist/services/totp.js

@@ -0,0 +1,96 @@
+import crypto from "node:crypto";
+import { eq, and, isNull } from "drizzle-orm";
+import { Secret, TOTP } from "otpauth";
+import { config } from "../config.js";
+import { db } from "../db/index.js";
+import { totpBackupCodes } from "../db/schema.js";
+const ALGORITHM = "aes-256-cbc";
+const IV_LENGTH = 16;
+function getEncryptionKey() {
+    const raw = config.TOTP_ENCRYPTION_KEY || config.INTERNAL_API_KEY;
+    if (raw && raw.length >= 32) {
+        return Buffer.from(raw.slice(0, 32));
+    }
+    return crypto.createHash("sha256").update(raw || "keystone-totp-default").digest();
+}
+export function generateSecret() {
+    return new Secret({ size: 20 }).base32;
+}
+export function buildProvisioningUri(input) {
+    const issuer = input.issuer || config.TOTP_ISSUER;
+    const totp = new TOTP({
+        issuer,
+        label: input.email,
+        algorithm: "SHA1",
+        digits: 6,
+        period: 30,
+        secret: Secret.fromBase32(input.secret),
+    });
+    return totp.toString();
+}
+export function verifyTOTP(secret, code, window = 1) {
+    try {
+        const totp = new TOTP({
+            algorithm: "SHA1",
+            digits: 6,
+            period: 30,
+            secret: Secret.fromBase32(secret),
+        });
+        const delta = totp.validate({ token: code, window });
+        return delta !== null;
+    }
+    catch {
+        return false;
+    }
+}
+export function encryptSecret(secret) {
+    const key = getEncryptionKey();
+    const iv = crypto.randomBytes(IV_LENGTH);
+    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+    const encrypted = Buffer.concat([cipher.update(secret, "utf8"), cipher.final()]);
+    return `${iv.toString("base64url")}:${encrypted.toString("base64url")}`;
+}
+export function decryptSecret(encrypted) {
+    const [ivBase64, dataBase64] = encrypted.split(":");
+    if (!ivBase64 || !dataBase64)
+        throw new Error("Invalid encrypted secret format");
+    const key = getEncryptionKey();
+    const iv = Buffer.from(ivBase64, "base64url");
+    const encryptedData = Buffer.from(dataBase64, "base64url");
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+    const decrypted = Buffer.concat([decipher.update(encryptedData), decipher.final()]);
+    return decrypted.toString("utf8");
+}
+export function generateBackupCodes() {
+    const codes = [];
+    const hashes = [];
+    for (let i = 0; i < 10; i++) {
+        const code = crypto.randomBytes(4).toString("hex").toLowerCase();
+        codes.push(code);
+        hashes.push(crypto.createHash("sha256").update(code).digest("hex"));
+    }
+    return { codes, hashes };
+}
+export async function storeBackupCodes(userId, codeHashes) {
+    if (codeHashes.length === 0)
+        return;
+    await db.delete(totpBackupCodes).where(eq(totpBackupCodes.userId, userId));
+    await db.insert(totpBackupCodes).values(codeHashes.map((hash) => ({ userId, codeHash: hash })));
+}
+export async function verifyBackupCode(userId, code) {
+    const codeHash = crypto.createHash("sha256").update(code).digest("hex");
+    const now = new Date();
+    const [record] = await db
+        .select()
+        .from(totpBackupCodes)
+        .where(and(eq(totpBackupCodes.userId, userId), eq(totpBackupCodes.codeHash, codeHash), isNull(totpBackupCodes.usedAt)))
+        .limit(1);
+    if (!record)
+        return false;
+    await db
+        .update(totpBackupCodes)
+        .set({ usedAt: now })
+        .where(eq(totpBackupCodes.id, record.id));
+    return true;
+}
+//# sourceMappingURL=totp.js.map

package/dist/services/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/services/totp.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,SAAS,gBAAgB;IACvB,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAClE,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC,MAAM,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAyD;IAC5F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,MAAM;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;KACxC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,MAAM,GAAG,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;YACpB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,UAAoB;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3E,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CACrC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAC/B,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,EAAE;SACL,MAAM,CAAC,eAAe,CAAC;SACvB,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/users.d.ts

@@ -0,0 +1,39 @@
+import { type User } from "../db/schema.js";
+export interface OAuthClaims {
+    sub: string;
+    email: string;
+    username?: string;
+    name?: string;
+    picture?: string;
+    email_verified?: boolean;
+}
+export declare function findUserByEmail(email: string): Promise<User | undefined>;
+export declare function findUserById(id: string): Promise<User | undefined>;
+export declare function findUserByZitadelId(zitadelUserId: string): Promise<User | undefined>;
+export declare function createPasswordUser(input: {
+    zitadelUserId?: string;
+    passwordHash?: string;
+    username: string;
+    email: string;
+    name: string;
+    emailVerified?: boolean;
+}): Promise<User>;
+export declare function upsertOAuthUser(claims: OAuthClaims, providerType: string, providerId?: string): Promise<User>;
+export declare function linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string, profile?: Record<string, unknown>): Promise<void>;
+export declare function updateUserLastSeen(id: string): Promise<void>;
+export declare function findOrCreateUserByEmail(input: {
+    email: string;
+    name?: string;
+    username?: string;
+}): Promise<User>;
+export declare function listUsersByOrg(orgId: string): Promise<User[]>;
+export declare function updateUser(userId: string, updates: Partial<{
+    name: string;
+    username: string;
+    role: string;
+    emailVerified: boolean;
+}>): Promise<User | undefined>;
+export declare function deactivateUser(userId: string): Promise<void>;
+export declare function slugifyUsername(input: string): string;
+export declare function ensureUniqueUsername(base: string, excludeId?: string): Promise<string>;
+//# sourceMappingURL=users.d.ts.map

package/dist/services/users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/services/users.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4D,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEtG,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAG9E;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAGxE;AAED,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAG1F;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAchB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CA2Ef;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBhB;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAOnE;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC,GACD,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAO3B;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe5F"}

package/dist/services/users.js

@@ -0,0 +1,181 @@
+import { eq, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { users, userIdentities, identityProviders, orgMemberships } from "../db/schema.js";
+export async function findUserByEmail(email) {
+    const [user] = await db.select().from(users).where(eq(users.email, email.toLowerCase())).limit(1);
+    return user;
+}
+export async function findUserById(id) {
+    const [user] = await db.select().from(users).where(eq(users.id, id)).limit(1);
+    return user;
+}
+export async function findUserByZitadelId(zitadelUserId) {
+    const [user] = await db.select().from(users).where(eq(users.zitadelUserId, zitadelUserId)).limit(1);
+    return user;
+}
+export async function createPasswordUser(input) {
+    const [user] = await db
+        .insert(users)
+        .values({
+        zitadelUserId: input.zitadelUserId ?? null,
+        passwordHash: input.passwordHash ?? null,
+        username: slugifyUsername(input.username),
+        email: input.email.toLowerCase().trim(),
+        name: input.name.trim() || input.username,
+        provider: "password",
+        emailVerified: input.emailVerified ?? true,
+    })
+        .returning();
+    return user;
+}
+export async function upsertOAuthUser(claims, providerType, providerId) {
+    const username = slugifyUsername(claims.username || claims.name || claims.email.split("@")[0]);
+    const email = claims.email.toLowerCase().trim();
+    // Prefer linking by external identity when a provider record is available.
+    if (providerId) {
+        const [existingLink] = await db
+            .select({ user: users })
+            .from(userIdentities)
+            .where(eq(userIdentities.externalSub, claims.sub))
+            .innerJoin(users, eq(userIdentities.userId, users.id))
+            .limit(1);
+        if (existingLink) {
+            const existing = existingLink.user;
+            const [updated] = await db
+                .update(users)
+                .set({
+                email,
+                username: await ensureUniqueUsername(username, existing.id),
+                name: claims.name || existing.name,
+                avatarUrl: claims.picture || existing.avatarUrl,
+                emailVerified: claims.email_verified ?? existing.emailVerified ?? true,
+                provider: providerType,
+                updatedAt: sql `now()`,
+            })
+                .where(eq(users.id, existing.id))
+                .returning();
+            return updated;
+        }
+    }
+    // Fall back to email-based matching.
+    const existing = await findUserByEmail(email);
+    if (existing) {
+        const [updated] = await db
+            .update(users)
+            .set({
+            email,
+            username: await ensureUniqueUsername(username, existing.id),
+            name: claims.name || existing.name,
+            avatarUrl: claims.picture || existing.avatarUrl,
+            emailVerified: claims.email_verified ?? existing.emailVerified ?? true,
+            provider: providerType,
+            updatedAt: sql `now()`,
+        })
+            .where(eq(users.id, existing.id))
+            .returning();
+        return updated;
+    }
+    const [user] = await db
+        .insert(users)
+        .values({
+        email,
+        username: await ensureUniqueUsername(username),
+        name: claims.name || username,
+        avatarUrl: claims.picture,
+        emailVerified: claims.email_verified ?? true,
+        provider: providerType,
+    })
+        .returning();
+    if (providerId) {
+        await db.insert(userIdentities).values({
+            userId: user.id,
+            providerId,
+            providerType,
+            externalSub: claims.sub,
+            email,
+            profile: { name: claims.name, picture: claims.picture, username: claims.username },
+        });
+    }
+    return user;
+}
+export async function linkUserIdentity(userId, providerId, providerType, externalSub, email, profile) {
+    const [provider] = await db.select().from(identityProviders).where(eq(identityProviders.id, providerId)).limit(1);
+    if (!provider)
+        throw new Error("Identity provider not found");
+    await db
+        .insert(userIdentities)
+        .values({
+        userId,
+        providerId,
+        providerType,
+        externalSub,
+        email,
+        profile: profile ?? {},
+    })
+        .onConflictDoNothing({ target: [userIdentities.providerId, userIdentities.externalSub] });
+}
+export async function updateUserLastSeen(id) {
+    await db.update(users).set({ updatedAt: sql `now()` }).where(eq(users.id, id));
+}
+export async function findOrCreateUserByEmail(input) {
+    const existing = await findUserByEmail(input.email);
+    if (existing)
+        return existing;
+    const baseUsername = input.username || input.email.split("@")[0];
+    const username = await ensureUniqueUsername(slugifyUsername(baseUsername));
+    const [user] = await db
+        .insert(users)
+        .values({
+        email: input.email.toLowerCase().trim(),
+        username,
+        name: input.name || username,
+        provider: "password",
+        emailVerified: false,
+    })
+        .returning();
+    return user;
+}
+export async function listUsersByOrg(orgId) {
+    const rows = await db
+        .select({ user: users })
+        .from(users)
+        .innerJoin(orgMemberships, eq(users.id, orgMemberships.userId))
+        .where(eq(orgMemberships.orgId, orgId));
+    return rows.map((r) => r.user);
+}
+export async function updateUser(userId, updates) {
+    const [updated] = await db
+        .update(users)
+        .set({ ...updates, updatedAt: sql `now()` })
+        .where(eq(users.id, userId))
+        .returning();
+    return updated;
+}
+export async function deactivateUser(userId) {
+    await db.update(users).set({ emailVerified: false, updatedAt: sql `now()` }).where(eq(users.id, userId));
+}
+export function slugifyUsername(input) {
+    return input
+        .toLowerCase()
+        .trim()
+        .replace(/[^a-z0-9_-]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 32);
+}
+export async function ensureUniqueUsername(base, excludeId) {
+    let username = base || "user";
+    let counter = 2;
+    while (true) {
+        const existing = await db
+            .select({ id: users.id })
+            .from(users)
+            .where(eq(users.username, username))
+            .limit(1);
+        if (existing.length === 0 || existing[0].id === excludeId) {
+            return username;
+        }
+        username = `${base}-${counter}`;
+        counter++;
+    }
+}
+//# sourceMappingURL=users.js.map

package/dist/services/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/services/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAa,MAAM,iBAAiB,CAAC;AAWtG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAOxC;IACC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;QAC1C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;QACzC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ;QACzC,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;KAC3C,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAmB,EACnB,YAAoB,EACpB,UAAmB;IAEnB,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,2EAA2E;IAC3E,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,EAAE;aAC5B,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;aACjD,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACrD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC;gBACH,KAAK;gBACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC3D,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;gBAClC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS;gBAC/C,aAAa,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,aAAa,IAAI,IAAI;gBACtE,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,GAAG,CAAA,OAAO;aACtB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;iBAChC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC;YACH,KAAK;YACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;YAClC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS;YAC/C,aAAa,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,aAAa,IAAI,IAAI;YACtE,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,GAAG,CAAA,OAAO;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;aAChC,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,KAAK;QACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,CAAC;QAC9C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;QAC7B,SAAS,EAAE,MAAM,CAAC,OAAO;QACzB,aAAa,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;QAC5C,QAAQ,EAAE,YAAY;KACvB,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU;YACV,YAAY;YACZ,WAAW,EAAE,MAAM,CAAC,GAAG;YACvB,KAAK;YACL,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;SACnF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,UAAkB,EAClB,YAAoB,EACpB,WAAmB,EACnB,KAAc,EACd,OAAiC;IAEjC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClH,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,MAAM,EAAE;SACL,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,MAAM;QACN,UAAU;QACV,YAAY;QACZ,WAAW;QACX,KAAK;QACL,OAAO,EAAE,OAAO,IAAI,EAAE;KACvB,CAAC;SACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;IAE3E,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;QACvC,QAAQ;QACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ;QAC5B,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,KAAK;KACrB,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SACvB,IAAI,CAAC,KAAK,CAAC;SACX,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;SAC9D,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,OAKE;IAEF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;SAC1C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC3B,SAAS,EAAE,CAAC;IACf,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK;SACT,WAAW,EAAE;SACb,IAAI,EAAE;SACN,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,SAAkB;IACzE,IAAI,QAAQ,GAAG,IAAI,IAAI,MAAM,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;aACxB,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/services/webauthn.d.ts

@@ -0,0 +1,45 @@
+import { type RegistrationResponseJSON, type AuthenticationResponseJSON } from "@simplewebauthn/server";
+import { type User, type WebAuthnCredential as DbWebAuthnCredential } from "../db/schema.js";
+export interface WebAuthnChallenge {
+    challenge: string;
+    userId?: string;
+    expiresAt: number;
+}
+export declare function createChallenge(userId?: string): string;
+export declare function consumeChallenge(challenge: string): WebAuthnChallenge | undefined;
+export declare function listCredentialsByUser(userId: string): Promise<DbWebAuthnCredential[]>;
+export declare function findCredentialById(credentialId: string): Promise<DbWebAuthnCredential | undefined>;
+export declare function buildRegistrationOptions(user: User): Promise<import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON>;
+export declare function verifyAndStoreRegistration(user: User, response: RegistrationResponseJSON, expectedChallenge: string, deviceName?: string): Promise<{
+    verified: boolean;
+}>;
+export declare function buildAuthenticationOptions(email?: string): Promise<import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON>;
+export declare function verifyAuthentication(response: AuthenticationResponseJSON, expectedChallenge: string): Promise<{
+    verified: boolean;
+    user: {
+        id: string;
+        name: string | null;
+        plan: string;
+        createdAt: Date;
+        updatedAt: Date;
+        zitadelUserId: string | null;
+        email: string;
+        username: string;
+        avatarUrl: string | null;
+        emailVerified: boolean;
+        emailVerifiedToken: string | null;
+        provider: string;
+        role: string;
+        defaultOrgId: string | null;
+        phoneNumber: string | null;
+        phoneVerified: boolean;
+        metadata: unknown;
+        passwordHash: string | null;
+        totpSecret: string | null;
+        totpEnabled: boolean;
+        totpVerifiedAt: Date | null;
+        failedLoginAttempts: number;
+        lockedUntil: Date | null;
+    };
+}>;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/services/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/services/webauthn.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAEhC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAGL,KAAK,IAAI,EACT,KAAK,kBAAkB,IAAI,oBAAoB,EAChD,MAAM,iBAAiB,CAAC;AAczB,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAWD,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAMjF;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAE3F;AAED,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAOxG;AAED,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,IAAI,oFAexD;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,wBAAwB,EAClC,iBAAiB,EAAE,MAAM,EACzB,UAAU,CAAC,EAAE,MAAM;;GA2BpB;AAED,wBAAsB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,mFA2B9D;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCzG"}