@hilbras/keystone 1.9.0 → 2.5.0

package/dist/services/singleUse.js

@@ -0,0 +1,54 @@
+import { and, eq, gt, isNull } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { magicLinks, passwordResetTokens, smsOtpCodes } from "../db/schema.js";
+async function claimAndClassify(table, hashColumn, hashValue, now, extra) {
+    const predicate = and(eq(hashColumn, hashValue), gt(table.expiresAt, now), isNull(table.usedAt), extra);
+    const claimed = (await db
+        .update(table)
+        .set({ usedAt: now })
+        .where(predicate)
+        .returning());
+    if (claimed.length === 1) {
+        return { outcome: "consumed", record: claimed[0] };
+    }
+    if (claimed.length > 1) {
+        // The hash column is not unique, so "single use" cannot mean anything.
+        throw new Error(`atomic claim matched ${claimed.length} rows; the hash column must be unique`);
+    }
+    // Why could we not claim it? Only worth distinguishing a replay, because that
+    // means the credential leaked and somebody came back with it.
+    const [existing] = (await db
+        .select()
+        .from(table)
+        .where(and(eq(hashColumn, hashValue), extra))
+        .limit(1));
+    if (!existing)
+        return { outcome: "not_found" };
+    if (existing.usedAt)
+        return { outcome: "replayed", reason: "replayed" };
+    if (existing.expiresAt.getTime() <= now.getTime()) {
+        return { outcome: "expired", reason: "expired" };
+    }
+    // Present, unused, and unexpired, yet the claim matched nothing: another
+    // transaction won the race between the two statements. From here that is a
+    // replay.
+    return { outcome: "replayed", reason: "replayed" };
+}
+/** Atomically consume a magic link. */
+export function consumeMagicLinkRow(tokenHash, now) {
+    return claimAndClassify(magicLinks, magicLinks.tokenHash, tokenHash, now);
+}
+/** Atomically consume a password reset token. */
+export function consumePasswordResetTokenRow(tokenHash, now) {
+    return claimAndClassify(passwordResetTokens, passwordResetTokens.tokenHash, tokenHash, now);
+}
+/**
+ * Atomically consume an SMS OTP code.
+ *
+ * Scoped to the user as well as the code. A code is six digits, so a lookup on
+ * the hash alone could let one user's code be spent against another's row.
+ */
+export function consumeSmsOtpCodeRow(userId, codeHash, now) {
+    return claimAndClassify(smsOtpCodes, smsOtpCodes.codeHash, codeHash, now, eq(smsOtpCodes.userId, userId));
+}
+//# sourceMappingURL=singleUse.js.map

package/dist/services/singleUse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"singleUse.js","sourceRoot":"","sources":["../../src/services/singleUse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAY,MAAM,aAAa,CAAC;AAE5D,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA4E/E,KAAK,UAAU,gBAAgB,CAC7B,KAAqB,EACrB,UAAoB,EACpB,SAAiB,EACjB,GAAS,EACT,KAAW;IAEX,MAAM,SAAS,GAAG,GAAG,CACnB,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,EACzB,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,EACxB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EACpB,KAAK,CACN,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE;SACtB,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CAAC,SAAS,CAAC;SAChB,SAAS,EAAE,CAAQ,CAAC;IAEvB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,uEAAuE;QACvE,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,CAAC,MAAM,uCAAuC,CAC9E,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,8DAA8D;IAC9D,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE;SACzB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;SAC5C,KAAK,CAAC,CAAC,CAAC,CAAQ,CAAC;IAEpB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACxE,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,UAAU;IACV,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACrD,CAAC;AAMD,uCAAuC;AACvC,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,GAAS;IAET,OAAO,gBAAgB,CAAe,UAAU,EAAE,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,4BAA4B,CAC1C,SAAiB,EACjB,GAAS;IAET,OAAO,gBAAgB,CACrB,mBAAmB,EACnB,mBAAmB,CAAC,SAAS,EAC7B,SAAS,EACT,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,QAAgB,EAChB,GAAS;IAET,OAAO,gBAAgB,CACrB,WAAW,EACX,WAAW,CAAC,QAAQ,EACpB,QAAQ,EACR,GAAG,EACH,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAC/B,CAAC;AACJ,CAAC"}

package/dist/services/smsOtp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"smsOtp.d.ts","sourceRoot":"","sources":["../../src/services/smsOtp.ts"],"names":[],"mappings":"AAGA,OAAO,EAAsB,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAMhE,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAMD,wBAAsB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBjF;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBjF;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOvE;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1F"}
+{"version":3,"file":"smsOtp.d.ts","sourceRoot":"","sources":["../../src/services/smsOtp.ts"],"names":[],"mappings":"AAGA,OAAO,EAAsB,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAQhE,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAMD,wBAAsB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBjF;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAejF;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOvE;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1F"}

package/dist/services/smsOtp.js

@@ -1,8 +1,10 @@
 import crypto from "node:crypto";
-import { eq, and, gt, isNull } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { smsOtpCodes, users } from "../db/schema.js";
 import { smsProvider } from "./sms.js";
+import { consumeSmsOtpCodeRow } from "./singleUse.js";
+import { emit } from "./events/bus.js";
 const CODE_TTL_SECONDS = 300;
 const CODE_LENGTH = 6;
 export function generateSmsCode() {
@@ -29,14 +31,16 @@ export async function sendSmsOtp(user, phoneNumber) {
 export async function verifySmsOtp(userId, code) {
     const codeHash = hashCode(code);
     const now = new Date();
-    const [record] = await db
-        .select()
-        .from(smsOtpCodes)
-        .where(and(eq(smsOtpCodes.userId, userId), eq(smsOtpCodes.codeHash, codeHash), gt(smsOtpCodes.expiresAt, now), isNull(smsOtpCodes.usedAt)))
-        .limit(1);
-    if (!record)
+    // Claim atomically, so a code cannot be spent by two parallel verifications.
+    // Scoped to the user as well as the hash: a six-digit code is short enough
+    // that a global lookup could collide across accounts.
+    const result = await consumeSmsOtpCodeRow(userId, codeHash, now);
+    if (result.outcome !== "consumed") {
+        if (result.reason === "replayed") {
+            emit({ type: "sms_otp_replayed", payload: { userId } });
+        }
         return false;
-    await db.update(smsOtpCodes).set({ usedAt: now }).where(eq(smsOtpCodes.id, record.id));
+    }
     return true;
 }
 export async function hasVerifiedPhone(userId) {

package/dist/services/smsOtp.js.map

@@ -1 +1 @@
-{"version":3,"file":"smsOtp.js","sourceRoot":"","sources":["../../src/services/smsOtp.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAa,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAU,EAAE,WAAmB;IAC9D,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAEjE,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QAClC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,WAAW;QACX,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;QACxB,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,sCAAsC,IAAI,EAAE;KACnD,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAClC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,EAC9B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAC3B,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;SAC9C,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,EAAE,aAAa,IAAI,KAAK,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,WAAmB;IACzE,MAAM,EAAE;SACL,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACzC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"smsOtp.js","sourceRoot":"","sources":["../../src/services/smsOtp.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAa,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEvC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAU,EAAE,WAAmB;IAC9D,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAEjE,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QAClC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,WAAW;QACX,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;QACxB,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,sCAAsC,IAAI,EAAE;KACnD,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,6EAA6E;IAC7E,2EAA2E;IAC3E,sDAAsD;IACtD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;SAC9C,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,EAAE,aAAa,IAAI,KAAK,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,WAAmB;IACzE,MAAM,EAAE;SACL,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACzC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AACjC,CAAC"}

package/dist/services/tokens.d.ts

@@ -66,6 +66,8 @@ export interface AccessTokenOptions {
     deviceFingerprint?: string;
     /** Proof that the MFA requirement for this user was satisfied. */
     mfaFactor?: MfaAssertion;
+    /** Scopes granted at the authorization step, carried on the refresh token. */
+    scopes?: string[];
 }
 export declare function createAccessToken(user: User, opts?: AccessTokenOptions): Promise<string>;
 export interface ApplicationAccessTokenOptions {

package/dist/services/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/services/tokens.ts"],"names":[],"mappings":"AAWA,OAAO,EAKL,KAAK,IAAI,EACT,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAa/C,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAerD;AAED;;;GAGG;AACH,wBAAsB,YAAY,gCAGjC;AAED;;;GAGG;AACH,wBAAsB,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GASlC;AAMD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAC;AAE3E;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAG,cAAc,CAAU;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,MAAM,EAAE,MAAM,EAIzB;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B5F;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,WAAW,EAChB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,EACV,EAAE,CAAC,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,GAAE,kBAAuB,EAC7B,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,QAAQ,CAAC,CAgCnB;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAgB3E;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,EAAE,CAAC,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA+E1B;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrE;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9E;AAOD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/services/tokens.ts"],"names":[],"mappings":"AAWA,OAAO,EAKL,KAAK,IAAI,EACT,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAa/C,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAerD;AAED;;;GAGG;AACH,wBAAsB,YAAY,gCAGjC;AAED;;;GAGG;AACH,wBAAsB,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GASlC;AAMD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAC;AAE3E;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAG,cAAc,CAAU;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,MAAM,EAAE,MAAM,EAIzB;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B5F;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,WAAW,EAChB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,EACV,EAAE,CAAC,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,GAAE,kBAAuB,EAC7B,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,QAAQ,CAAC,CAiCnB;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAgB3E;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,EAAE,CAAC,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAmF1B;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrE;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9E;AAOD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/services/tokens.js

@@ -157,6 +157,7 @@ export async function createTokenSet(user, ip, userAgent, opts = {}, deviceFinge
         userAgent: userAgent ?? null,
         deviceFingerprint: deviceFingerprint ?? null,
         mfaFactor: opts.mfaFactor ?? null,
+        scopes: opts.scopes ?? [],
     }).returning();
     try {
         const sessions = new SessionRepository();
@@ -246,6 +247,10 @@ export async function rotateRefreshToken(token, ip, userAgent, clientId, expecte
         orgId,
         clientId,
         deviceFingerprint: claimed.deviceFingerprint ?? undefined,
+        // Carried forward from the token being rotated. A refresh may narrow the
+        // grant but never widen it, so the stored set is authoritative rather than
+        // anything the caller supplies.
+        ...(claimed.scopes?.length ? { scopes: claimed.scopes } : {}),
         ...(claimed.mfaFactor
             ? { mfaFactor: claimed.mfaFactor }
             : {}),

package/dist/services/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/services/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,OAAO,EACP,WAAW,EACX,UAAU,EACV,SAAS,EACT,qBAAqB,EACrB,SAAS,GACV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,aAAa,EACb,KAAK,EACL,YAAY,EACZ,cAAc,GAGf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,mDAAmD;AACnD,IAAI,SAAS,GAA0B,IAAI,CAAC;AAC5C,iFAAiF;AACjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACnE,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACpD,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IAED,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,CAAC,SAAS;QAAE,MAAM,eAAe,EAAE,CAAC;IACxC,OAAO,SAAS,CAAC,SAAU,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,eAAe,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,MAAM;IACb,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9E,CAAC;AASD;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,GAAG,cAAuB,CAAC;IAC/B,MAAM,CAAS;IAExB,YAAY,MAAc;QACxB,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAWD,MAAM,UAAU,iBAAiB,CAAC,IAAU,EAAE,IAAI,GAAuB,EAAE;IACzE,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACtF,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAgB;QAC1B,GAAG,EAAE,IAAI,CAAC,EAAE;QACZ,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3C,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;IACpD,IAAI,IAAI,CAAC,iBAAiB;QAAE,MAAM,CAAC,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAC/E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QACnC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,MAA4C,CAAC;SAC7D,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SACtE,WAAW,EAAE;SACb,SAAS,CAAC,MAAM,EAAE,CAAC;SACnB,WAAW,CAAC,SAAS,CAAC;SACtB,iBAAiB,CAAC,GAAG,MAAM,CAAC,wBAAwB,GAAG,CAAC;SACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AASD,MAAM,UAAU,4BAA4B,CAC1C,IAAmC;IAEnC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,MAAM,EAAE,IAAI,CAAC,KAAK;KACnB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SACtE,WAAW,EAAE;SACb,SAAS,CAAC,MAAM,EAAE,CAAC;SACnB,WAAW,CAAC,SAAS,CAAC;SACtB,iBAAiB,CAAC,GAAG,MAAM,CAAC,wBAAwB,GAAG,CAAC;SACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAU,EACV,GAAgB,EAChB,KAAc;IAEd,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,IAAI,CAAC,EAAE;QACZ,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,aAAa;QAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,GAAG,EAAE,GAAG,CAAC,QAAQ;KAClB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAChC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SACtE,WAAW,EAAE;SACb,SAAS,CAAC,MAAM,EAAE,CAAC;SACnB,iBAAiB,CAAC,GAAG,MAAM,CAAC,wBAAwB,GAAG,CAAC;SACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAU,EACV,EAAW,EACX,SAAkB,EAClB,IAAI,GAAuB,EAAE,EAC7B,iBAA0B;IAE1B,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAEjF,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;QACvD,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,SAAS,EAAE,gBAAgB;QAC3B,SAAS;QACT,SAAS,EAAE,EAAE,IAAI,IAAI;QACrB,SAAS,EAAE,SAAS,IAAI,IAAI;QAC5B,iBAAiB,EAAE,iBAAiB,IAAI,IAAI;QAC5C,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC,SAAS,EAAE,CAAC;IAEf,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,QAAQ,CAAC,MAAM,CAAC;YACpB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,cAAc,EAAE,QAAQ,CAAC,EAAE;YAC3B,iBAAiB;YACjB,SAAS,EAAE,EAAE;YACb,SAAS;YACT,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;IACjF,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa;IACnD,IAAI,CAAC,SAAS;QAAE,MAAM,eAAe,EAAE,CAAC;IAExC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,SAAS,EAAE,SAAS,CAAC;IAE7D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE;QACpD,MAAM,EAAE,MAAM,EAAE;QAChB,QAAQ,EAAE,SAAS;KACpB,CAAC,CAAC;IACH,OAAO,OAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,EAAW,EACX,SAAkB,EAClB,QAAiB,EACjB,aAAsB;IAEtB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,aAAa,CAAC;SACnB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,EACjC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,EAChC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAChC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,qBAAqB;QAAE,OAAO,IAAI,CAAC;IAE/D,6EAA6E;IAC7E,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAEzD,IAAI,KAAyB,CAAC;IAC9B,IAAI,KAAyB,CAAC;IAC9B,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,aAAa,IAAI,aAAa,KAAK,QAAQ,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACnE,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,EAAE;aAC3B,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC;aAC3F,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;aAChF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEhF,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;aACjC,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3F,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC;QACvB,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;IAC5B,CAAC;SAAM,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,aAAa,CAAC;SACrB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EACjC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,EACjC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,EAChC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAChC,CACF;SACA,SAAS,EAAE,CAAC;IACf,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,cAAc,CACnB,IAAI,EACJ,EAAE,EACF,SAAS,EACT;QACE,KAAK;QACL,KAAK;QACL,QAAQ;QACR,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,SAAS;QACzD,GAAG,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAyB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,EACD,OAAO,CAAC,iBAAiB,IAAI,SAAS,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa;IACpD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,MAAc;IAC7D,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/services/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,OAAO,EACP,WAAW,EACX,UAAU,EACV,SAAS,EACT,qBAAqB,EACrB,SAAS,GACV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,aAAa,EACb,KAAK,EACL,YAAY,EACZ,cAAc,GAGf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,mDAAmD;AACnD,IAAI,SAAS,GAA0B,IAAI,CAAC;AAC5C,iFAAiF;AACjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACnE,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACpD,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IAED,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,CAAC,SAAS;QAAE,MAAM,eAAe,EAAE,CAAC;IACxC,OAAO,SAAS,CAAC,SAAU,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,eAAe,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,MAAM;IACb,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9E,CAAC;AASD;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,GAAG,cAAuB,CAAC;IAC/B,MAAM,CAAS;IAExB,YAAY,MAAc;QACxB,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAaD,MAAM,UAAU,iBAAiB,CAAC,IAAU,EAAE,IAAI,GAAuB,EAAE;IACzE,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACtF,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAgB;QAC1B,GAAG,EAAE,IAAI,CAAC,EAAE;QACZ,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QAC9C,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3C,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;IACpD,IAAI,IAAI,CAAC,iBAAiB;QAAE,MAAM,CAAC,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAC/E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QACnC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,MAA4C,CAAC;SAC7D,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SACtE,WAAW,EAAE;SACb,SAAS,CAAC,MAAM,EAAE,CAAC;SACnB,WAAW,CAAC,SAAS,CAAC;SACtB,iBAAiB,CAAC,GAAG,MAAM,CAAC,wBAAwB,GAAG,CAAC;SACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AASD,MAAM,UAAU,4BAA4B,CAC1C,IAAmC;IAEnC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,MAAM,EAAE,IAAI,CAAC,KAAK;KACnB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SACtE,WAAW,EAAE;SACb,SAAS,CAAC,MAAM,EAAE,CAAC;SACnB,WAAW,CAAC,SAAS,CAAC;SACtB,iBAAiB,CAAC,GAAG,MAAM,CAAC,wBAAwB,GAAG,CAAC;SACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAU,EACV,GAAgB,EAChB,KAAc;IAEd,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,IAAI,CAAC,EAAE;QACZ,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,aAAa;QAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,GAAG,EAAE,GAAG,CAAC,QAAQ;KAClB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAChC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;SACtE,WAAW,EAAE;SACb,SAAS,CAAC,MAAM,EAAE,CAAC;SACnB,iBAAiB,CAAC,GAAG,MAAM,CAAC,wBAAwB,GAAG,CAAC;SACxD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAU,EACV,EAAW,EACX,SAAkB,EAClB,IAAI,GAAuB,EAAE,EAC7B,iBAA0B;IAE1B,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAEjF,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;QACvD,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,SAAS,EAAE,gBAAgB;QAC3B,SAAS;QACT,SAAS,EAAE,EAAE,IAAI,IAAI;QACrB,SAAS,EAAE,SAAS,IAAI,IAAI;QAC5B,iBAAiB,EAAE,iBAAiB,IAAI,IAAI;QAC5C,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;KAC1B,CAAC,CAAC,SAAS,EAAE,CAAC;IAEf,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,QAAQ,CAAC,MAAM,CAAC;YACpB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,cAAc,EAAE,QAAQ,CAAC,EAAE;YAC3B,iBAAiB;YACjB,SAAS,EAAE,EAAE;YACb,SAAS;YACT,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;IACjF,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa;IACnD,IAAI,CAAC,SAAS;QAAE,MAAM,eAAe,EAAE,CAAC;IAExC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,SAAS,EAAE,SAAS,CAAC;IAE7D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE;QACpD,MAAM,EAAE,MAAM,EAAE;QAChB,QAAQ,EAAE,SAAS;KACpB,CAAC,CAAC;IACH,OAAO,OAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,EAAW,EACX,SAAkB,EAClB,QAAiB,EACjB,aAAsB;IAEtB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,aAAa,CAAC;SACnB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,EACjC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,EAChC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAChC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,qBAAqB;QAAE,OAAO,IAAI,CAAC;IAE/D,6EAA6E;IAC7E,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAEzD,IAAI,KAAyB,CAAC;IAC9B,IAAI,KAAyB,CAAC;IAC9B,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,aAAa,IAAI,aAAa,KAAK,QAAQ,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACnE,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,EAAE;aAC3B,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC;aAC3F,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;aAChF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEhF,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;aACjC,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAC3F,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC;QACvB,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;IAC5B,CAAC;SAAM,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,aAAa,CAAC;SACrB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EACjC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,EACjC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,EAChC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAChC,CACF;SACA,SAAS,EAAE,CAAC;IACf,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,cAAc,CACnB,IAAI,EACJ,EAAE,EACF,SAAS,EACT;QACE,KAAK;QACL,KAAK;QACL,QAAQ;QACR,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,SAAS;QACzD,yEAAyE;QACzE,2EAA2E;QAC3E,gCAAgC;QAChC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAyB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,EACD,OAAO,CAAC,iBAAiB,IAAI,SAAS,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa;IACpD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,MAAc;IAC7D,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/services/trustedProxies.d.ts

@@ -0,0 +1,90 @@
+import type { FastifyRequest } from "fastify";
+/**
+ * Trusted-proxy model.
+ *
+ * ```text
+ * Internet  →  trusted reverse proxy  →  Keystone
+ * ```
+ *
+ * Two rules follow from that diagram, and everything else in this module exists
+ * to enforce them:
+ *
+ *  1. Only a request whose **peer** address is a configured trusted proxy may
+ *     have its forwarded headers believed. `request.ip` cannot be used for this
+ *     decision, because Fastify derives it from `x-forwarded-for` when
+ *     `trustProxy` is on — which is exactly the attacker-controlled value.
+ *  2. The peer address is the only value that cannot be spoofed. Forwarded
+ *     headers are only consulted when (1) holds.
+ *
+ * With no trusted proxies configured, nothing is trusted: the peer address is
+ * used for rate limiting and client-certificate headers are ignored entirely.
+ * The default is therefore fail-closed.
+ */
+/** Headers that carry client identity and must never be believed from an untrusted peer. */
+export declare const IDENTITY_HEADERS: readonly ["x-forwarded-client-cert", "x-client-cert-fingerprint", "x-service-account-id", "x-forwarded-client-cert-chain"];
+/**
+ * Normalize an address so every spelling of the same host compares equal.
+ *
+ * IPv4-mapped IPv6 arrives in two forms — the dotted form `::ffff:127.0.0.1`
+ * and the hex form `::ffff:7f00:1`. Both must collapse to `127.0.0.1`,
+ * otherwise a mapped address slips past an IPv4 CIDR allowlist.
+ */
+export declare function normalizeAddress(address: string | undefined): string;
+/** Does `address` fall inside `cidr`? Supports IPv4 CIDR and exact IPv6. */
+export declare function addressInCidr(address: string, cidr: string): boolean;
+/** Reset the parse cache. Exists for tests that change configuration. */
+export declare function resetTrustedProxyCache(): void;
+/**
+ * Is at least one trusted proxy configured? False means client-identity headers
+ * are stripped from every request and rate limits key on the peer address.
+ */
+export declare function hasTrustedProxies(): boolean;
+export declare function isTrustedProxy(address: string | undefined): boolean;
+/**
+ * The socket's peer address. This is the only value a client cannot forge,
+ * because it is established by the TCP connection rather than by a header.
+ */
+export declare function peerAddress(request: FastifyRequest): string;
+/** True when the immediate peer is a configured trusted proxy. */
+export declare function isFromTrustedProxy(request: FastifyRequest): boolean;
+/**
+ * The client address to use for rate limiting and logging.
+ *
+ * Behind a trusted proxy this is the left-most forwarded address, because the
+ * proxy is the one that appended it. From any other peer the forwarded headers
+ * are ignored, so a client cannot rotate `x-forwarded-for` to obtain a fresh
+ * rate-limit budget.
+ */
+export declare function clientAddress(request: FastifyRequest): string;
+/**
+ * Remove identity and forwarded headers from a request that did not arrive via
+ * a trusted proxy. Stripping rather than merely ignoring means no downstream
+ * route, plugin, or future feature can accidentally read them.
+ *
+ * @returns whether the request was trusted (and therefore kept its headers)
+ */
+export declare function stripUntrustedHeaders(request: FastifyRequest): boolean;
+/** The value Fastify's `trustProxy` option should be given. */
+export declare function fastifyTrustProxySetting(): boolean | string[];
+/**
+ * Does this address look like infrastructure rather than a public client?
+ *
+ * Loopback, RFC 1918, link-local, and unique-local ranges are where reverse
+ * proxies, load balancers, and service meshes live. A request arriving from one
+ * of these while no trusted proxy is configured is the signature of a proxied
+ * deployment that forgot `KEYSTONE_TRUSTED_PROXIES` — which fails silently, as
+ * every client collapsing into a single rate-limit budget.
+ */
+export declare function isInfrastructureAddress(address: string): boolean;
+/**
+ * Why no forwarded headers were believed, or `null` when the peer was trusted.
+ *
+ * Returned so the caller can log a warning only in the case that indicates a
+ * misconfiguration, rather than on every stripped request.
+ */
+export declare function describeUntrustedPeer(address: string): string | null;
+/** A SHA-256 fingerprint, in hex or the colon-separated form AWS ALB emits. */
+export declare function isValidFingerprint(value: string | undefined): value is string;
+/** Canonical fingerprint form used for storage and comparison. */
+export declare function canonicalFingerprint(value: string): string;
+//# sourceMappingURL=trustedProxies.d.ts.map

package/dist/services/trustedProxies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxies.d.ts","sourceRoot":"","sources":["../../src/services/trustedProxies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB,YAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,+BAA+B,CACvB,CAAC;AAKX;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAwBpE;AAeD,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAwCpE;AAoBD,yEAAyE;AACzE,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMnE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE3D;AAED,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAEnE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAW7D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAMtE;AAED,+DAA+D;AAC/D,wBAAgB,wBAAwB,IAAI,OAAO,GAAG,MAAM,EAAE,CAG7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAmBhE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASpE;AAKD,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAI7E;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D"}

package/dist/services/trustedProxies.js

@@ -0,0 +1,283 @@
+import { config } from "../config.js";
+/**
+ * Trusted-proxy model.
+ *
+ * ```text
+ * Internet  →  trusted reverse proxy  →  Keystone
+ * ```
+ *
+ * Two rules follow from that diagram, and everything else in this module exists
+ * to enforce them:
+ *
+ *  1. Only a request whose **peer** address is a configured trusted proxy may
+ *     have its forwarded headers believed. `request.ip` cannot be used for this
+ *     decision, because Fastify derives it from `x-forwarded-for` when
+ *     `trustProxy` is on — which is exactly the attacker-controlled value.
+ *  2. The peer address is the only value that cannot be spoofed. Forwarded
+ *     headers are only consulted when (1) holds.
+ *
+ * With no trusted proxies configured, nothing is trusted: the peer address is
+ * used for rate limiting and client-certificate headers are ignored entirely.
+ * The default is therefore fail-closed.
+ */
+/** Headers that carry client identity and must never be believed from an untrusted peer. */
+export const IDENTITY_HEADERS = [
+    "x-forwarded-client-cert",
+    "x-client-cert-fingerprint",
+    "x-service-account-id",
+    "x-forwarded-client-cert-chain",
+];
+/** Headers that influence the apparent client address. */
+const FORWARDED_HEADERS = ["x-forwarded-for", "x-real-ip", "forwarded"];
+/**
+ * Normalize an address so every spelling of the same host compares equal.
+ *
+ * IPv4-mapped IPv6 arrives in two forms — the dotted form `::ffff:127.0.0.1`
+ * and the hex form `::ffff:7f00:1`. Both must collapse to `127.0.0.1`,
+ * otherwise a mapped address slips past an IPv4 CIDR allowlist.
+ */
+export function normalizeAddress(address) {
+    if (!address)
+        return "";
+    let value = address.trim().toLowerCase();
+    if (value.startsWith("[") && value.endsWith("]"))
+        value = value.slice(1, -1);
+    // Strip a zone index and any port suffix on bare IPv6.
+    const zone = value.indexOf("%");
+    if (zone !== -1)
+        value = value.slice(0, zone);
+    if (value.startsWith("::ffff:")) {
+        const tail = value.slice(7);
+        if (tail.includes("."))
+            return tail;
+        // Hex form: the final two hextets are the IPv4 address.
+        const hextets = tail.split(":");
+        if (hextets.length === 2 && hextets.every((h) => /^[0-9a-f]{1,4}$/.test(h))) {
+            const high = parseInt(hextets[0], 16);
+            const low = parseInt(hextets[1], 16);
+            if (Number.isInteger(high) && Number.isInteger(low)) {
+                return [high >> 8, high & 0xff, low >> 8, low & 0xff].join(".");
+            }
+        }
+        return tail;
+    }
+    return value;
+}
+function toIPv4Octets(address) {
+    const parts = address.split(".");
+    if (parts.length !== 4)
+        return null;
+    const octets = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const n = Number(part);
+        if (n < 0 || n > 255)
+            return null;
+        octets.push(n);
+    }
+    return octets;
+}
+/** Does `address` fall inside `cidr`? Supports IPv4 CIDR and exact IPv6. */
+export function addressInCidr(address, cidr) {
+    const target = normalizeAddress(address);
+    const range = cidr.trim().toLowerCase();
+    if (!target || !range)
+        return false;
+    if (!range.includes("/"))
+        return target === normalizeAddress(range);
+    const [network, bitsRaw] = range.split("/");
+    const bits = Number(bitsRaw);
+    if (!Number.isInteger(bits))
+        return false;
+    const targetOctets = toIPv4Octets(normalizeAddress(network));
+    const boundOctets = toIPv4Octets(normalizeAddress(network));
+    if (!targetOctets || !boundOctets) {
+        // IPv6: compare the leading `bits` of the hextets. Anything not an exact
+        // or prefix match is treated as outside the range.
+        if (bits < 0 || bits > 128)
+            return false;
+        const left = normalizeAddress(network).split(":");
+        const right = normalizeAddress(target).split(":");
+        if (left.length !== right.length)
+            return false;
+        const hextets = bits / 16;
+        for (let i = 0; i < Math.floor(hextets); i++) {
+            if (left[i] !== right[i])
+                return false;
+        }
+        return true;
+    }
+    if (bits < 0 || bits > 32)
+        return false;
+    const targetV4 = toIPv4Octets(normalizeAddress(target));
+    if (!targetV4)
+        return false;
+    let remaining = bits;
+    for (let i = 0; i < 4; i++) {
+        if (remaining <= 0)
+            break;
+        const take = Math.min(8, remaining);
+        const mask = take === 0 ? 0 : (0xff << (8 - take)) & 0xff;
+        if ((targetV4[i] & mask) !== (boundOctets[i] & mask))
+            return false;
+        remaining -= take;
+    }
+    return true;
+}
+let cachedConfig = null;
+/**
+ * Read the setting at call time rather than from the `config` snapshot, which
+ * is built once at import. Cached on the raw string, so this is cheap while
+ * still picking up a reload.
+ */
+function trustedEntries() {
+    const raw = (process.env.KEYSTONE_TRUSTED_PROXIES ?? config.TRUSTED_PROXIES ?? "").trim();
+    if (cachedConfig?.raw === raw)
+        return cachedConfig.entries;
+    const entries = raw
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    cachedConfig = { raw, entries };
+    return entries;
+}
+/** Reset the parse cache. Exists for tests that change configuration. */
+export function resetTrustedProxyCache() {
+    cachedConfig = null;
+}
+/**
+ * Is at least one trusted proxy configured? False means client-identity headers
+ * are stripped from every request and rate limits key on the peer address.
+ */
+export function hasTrustedProxies() {
+    return trustedEntries().length > 0;
+}
+export function isTrustedProxy(address) {
+    const entries = trustedEntries();
+    if (entries.length === 0)
+        return false;
+    const target = normalizeAddress(address);
+    if (!target)
+        return false;
+    return entries.some((entry) => addressInCidr(target, entry));
+}
+/**
+ * The socket's peer address. This is the only value a client cannot forge,
+ * because it is established by the TCP connection rather than by a header.
+ */
+export function peerAddress(request) {
+    return normalizeAddress(request.socket?.remoteAddress ?? request.ip);
+}
+/** True when the immediate peer is a configured trusted proxy. */
+export function isFromTrustedProxy(request) {
+    return isTrustedProxy(peerAddress(request));
+}
+/**
+ * The client address to use for rate limiting and logging.
+ *
+ * Behind a trusted proxy this is the left-most forwarded address, because the
+ * proxy is the one that appended it. From any other peer the forwarded headers
+ * are ignored, so a client cannot rotate `x-forwarded-for` to obtain a fresh
+ * rate-limit budget.
+ */
+export function clientAddress(request) {
+    if (!isFromTrustedProxy(request))
+        return peerAddress(request);
+    const xff = request.headers["x-forwarded-for"];
+    if (typeof xff === "string" && xff.trim()) {
+        const first = xff.split(",")[0]?.trim();
+        if (first)
+            return normalizeAddress(first);
+    }
+    const realIp = request.headers["x-real-ip"];
+    if (typeof realIp === "string" && realIp.trim())
+        return normalizeAddress(realIp);
+    return peerAddress(request);
+}
+/**
+ * Remove identity and forwarded headers from a request that did not arrive via
+ * a trusted proxy. Stripping rather than merely ignoring means no downstream
+ * route, plugin, or future feature can accidentally read them.
+ *
+ * @returns whether the request was trusted (and therefore kept its headers)
+ */
+export function stripUntrustedHeaders(request) {
+    if (isFromTrustedProxy(request))
+        return true;
+    for (const header of [...IDENTITY_HEADERS, ...FORWARDED_HEADERS]) {
+        delete request.headers[header];
+    }
+    return false;
+}
+/** The value Fastify's `trustProxy` option should be given. */
+export function fastifyTrustProxySetting() {
+    const entries = trustedEntries();
+    return entries.length > 0 ? entries : false;
+}
+/**
+ * Does this address look like infrastructure rather than a public client?
+ *
+ * Loopback, RFC 1918, link-local, and unique-local ranges are where reverse
+ * proxies, load balancers, and service meshes live. A request arriving from one
+ * of these while no trusted proxy is configured is the signature of a proxied
+ * deployment that forgot `KEYSTONE_TRUSTED_PROXIES` — which fails silently, as
+ * every client collapsing into a single rate-limit budget.
+ */
+export function isInfrastructureAddress(address) {
+    const target = normalizeAddress(address);
+    if (!target)
+        return false;
+    if (target === "127.0.0.1" || target === "::1" || target === "0.0.0.0" || target === "::") {
+        return true;
+    }
+    if (target.startsWith("10."))
+        return true;
+    if (/^172\.(1[6-9]|2\d|3[01])\./.test(target))
+        return true;
+    if (target.startsWith("192.168."))
+        return true;
+    if (target.startsWith("169.254."))
+        return true;
+    // IPv6: fe80::/10 link-local, fc00::/7 unique-local. Compare the first
+    // hextet regardless of how many there are, so a fully expanded address
+    // (`fe80:0000:...:0001`) is classified the same as the compressed form.
+    const first = parseInt(target.split(":")[0] ?? "", 16);
+    if (Number.isInteger(first)) {
+        if ((first & 0xffc0) === 0xfe80)
+            return true;
+        if ((first & 0xfe00) === 0xfc00)
+            return true;
+    }
+    return false;
+}
+/**
+ * Why no forwarded headers were believed, or `null` when the peer was trusted.
+ *
+ * Returned so the caller can log a warning only in the case that indicates a
+ * misconfiguration, rather than on every stripped request.
+ */
+export function describeUntrustedPeer(address) {
+    if (hasTrustedProxies())
+        return null;
+    if (!isInfrastructureAddress(address))
+        return null;
+    return ("client-identity headers were stripped from an infrastructure address while " +
+        "KEYSTONE_TRUSTED_PROXIES is unset. If Keystone is behind a reverse proxy, " +
+        "set it to the proxy's address: until then every client shares one rate-limit " +
+        "budget and forwarded client addresses are ignored. See docs/security/proxy-security.md");
+}
+const FINGERPRINT_HEX = /^[0-9a-f]{64}$/i;
+const FINGERPRINT_COLON = /^(?:[0-9a-f]{2}:){31}[0-9a-f]{2}$/i;
+/** A SHA-256 fingerprint, in hex or the colon-separated form AWS ALB emits. */
+export function isValidFingerprint(value) {
+    if (!value)
+        return false;
+    const normalized = value.trim();
+    return FINGERPRINT_HEX.test(normalized) || FINGERPRINT_COLON.test(normalized);
+}
+/** Canonical fingerprint form used for storage and comparison. */
+export function canonicalFingerprint(value) {
+    return value.trim().replace(/:/g, "").toLowerCase();
+}
+//# sourceMappingURL=trustedProxies.js.map

package/dist/services/trustedProxies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxies.js","sourceRoot":"","sources":["../../src/services/trustedProxies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAGtC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,yBAAyB;IACzB,2BAA2B;IAC3B,sBAAsB;IACtB,+BAA+B;CACvB,CAAC;AAEX,0DAA0D;AAC1D,MAAM,iBAAiB,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,WAAW,CAAU,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA2B;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,uDAAuD;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAE9C,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,wDAAwD;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,IAAY;IACzD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEpC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEpE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,MAAM,YAAY,GAAG,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,yEAAyE;QACzE,mDAAmD;QACnD,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,SAAS,IAAI,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAI,YAAY,GAA8C,IAAI,CAAC;AAEnE;;;;GAIG;AACH,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,YAAY,EAAE,GAAG,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,YAAY,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,sBAAsB;IACpC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA2B;IACxD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAuB;IACjD,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,OAAuB;IACxD,OAAO,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IAE9D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK;YAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACjF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAuB;IAC3D,IAAI,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,gBAAgB,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,wBAAwB;IACtC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,IAAI,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,CACL,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,wFAAwF,CACzF,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAC1C,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAChF,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC"}

package/dist/setup-server.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { fastifyTrustProxySetting } from "./services/trustedProxies.js";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import fs from "node:fs/promises";
 import fastify from "fastify";
@@ -10,7 +11,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 async function buildSetupApp() {
     const app = fastify({
         logger: { level: config.NODE_ENV === "production" ? "info" : "debug" },
-        trustProxy: true,
+        trustProxy: fastifyTrustProxySetting(),
         genReqId: () => crypto.randomUUID(),
     });
     await app.register(cors, {

package/dist/setup-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-server.js","sourceRoot":"","sources":["../src/setup-server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,KAAK,UAAU,aAAa;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QACtE,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEtD,+CAA+C;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE;gBACtC,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAEtD,GAAG,CAAC,eAAe,CAAC,CAAC,KAAc,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,kBAAkB,EAAE,CAAC;IACrB,eAAe,EAAE,CAAC;IAElB,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,KAAK,EAAE,CAAC;AACV,CAAC"}
+{"version":3,"file":"setup-server.js","sourceRoot":"","sources":["../src/setup-server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,KAAK,UAAU,aAAa;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QACtE,UAAU,EAAE,wBAAwB,EAAE;QACtC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEtD,+CAA+C;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE;gBACtC,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAEtD,GAAG,CAAC,eAAe,CAAC,CAAC,KAAc,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,kBAAkB,EAAE,CAAC;IACrB,eAAe,EAAE,CAAC;IAElB,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,KAAK,EAAE,CAAC;AACV,CAAC"}