@hilbras/keystone 2.5.0 → 3.0.0

package/CHANGELOG.md

@@ -5,6 +5,429 @@ All notable changes to Hilbras Keystone are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.0] - 2026-09-27
+
+### Security
+
+- **Two registry entries withdrawn, because they were not real.** `SEC-043` and
+  `SEC-044` were added during the 2.9.0 release with fixes at
+  `src/services/saml/validator.ts` and `src/routes/sso.ts` — a directory that does
+  not exist and a file that does not exist — and with issue descriptions the tests
+  do not cover. `saml-validator.test.ts` exercises the *valid* signed-response
+  path; it does not test a missing audience or issuer requirement.
+  `sso-endpoint.test.ts` tests `isPrivateAddress`, a guard on operator-supplied
+  endpoint addresses; it does not test an unregistered host alias. Neither had an
+  evidenced defect behind it, so neither was a finding. Both are now recorded
+  under `withdrawn` with the reason, and their suites under a new `coverage`
+  section — a suite that asserts a property is coverage, not a vulnerability.
+- **The registry validator never checked the `fix` field**, which is how the two
+  above passed. It verified that the named *test* existed and that the *test* had
+  a test in it; nothing confirmed the entry's claim about where the fix lives. It
+  now resolves the fix site against the repository. Four entries named paths that
+  do not exist; two were the invented ones, and the other two named
+  `src/services/saml/*` for SAML logic that lives in `src/routes/saml.ts`. All
+  four corrected.
+- **Contiguity was the wrong rule for ids.** Renumbering after a withdrawal would
+  change every id other documents already cite, and a registry whose ids shift is
+  one nobody can reference. Ids may now gap, and a gap must be explained by a
+  withdrawal carrying a reason. Set-based, not positional, so withdrawing one id
+  does not invalidate the rest of the tail.
+
+### Added
+
+- `docs/RE-AUDIT.md` — the v3.0.0 re-audit matrix, **generated and verified**
+  rather than written. Every cell is checked against the repository when the file
+  is produced: `Fixed` only if the fix site exists, `Regression Test` only if the
+  named file exists *and contains a test*. Deleting a test turns the cell red on
+  the next run instead of leaving a stale assurance in a release document.
+- `scripts/render-reaudit-matrix.mjs`, wired into `npm run reaudit:check`, the
+  test suite, and the release gate. `npm run reaudit:render` regenerates it.
+- `coverage` and `withdrawn` sections in the registry, so a suite with no finding
+  behind it is recorded honestly and a removed finding is explained.
+
+### Verified
+
+- **Multi-tenant isolation, re-audited.** Every organization-scoped admin route
+  was checked for a membership guard in the requested organization rather than
+  the caller's own. `requireOrganizationRole` resolves `orgId` from
+  `request.params.id` and checks membership in *that* organization, so the pattern
+  is sound. Routes using only `app.authenticate` were traced into the
+  application layer: `GET /organizations/:id` calls `getOrganization`, which
+  enforces `requireOrganizationPermission` before returning. SAML and OIDC
+  connection routes use org-scoped repository methods (`listByOrgId`,
+  `findByIdAndOrgId`) rather than bare id lookups. No cross-tenant path found.
+
+### Gate results
+
+| Gate | Result |
+| --- | --- |
+| `npm run lint` | 0 warnings, 0 errors |
+| `npm run typecheck` | pass |
+| `npm run registry:check` | 44 entries, 18 suites, 12 of 12 attack classes |
+| `npm run reaudit:check` | 18 plan findings, every claim verified |
+| `npm test` | 450 pass, 1 skipped, 0 fail |
+| `npm run test:security` | 402/402 |
+
+## [2.9.0] - 2026-09-27
+
+### Security
+
+- **The security regression registry is now machine-enforced.** All 46 findings
+  from the hardening programme are recorded in `docs/security/registry.json` with
+  the issue, the fix, the test that fails without it, the documentation and the
+  release. `npm run registry:check` fails when an entry names a test that does not
+  exist, when a security suite is claimed by no entry, or when a mandatory attack
+  class is uncovered. The registry is generated into
+  `docs/security/registry.md` so the prose cannot drift from the data.
+
+  This matters because a registry that is allowed to become false is worse than no
+  registry: it converts "I don't know whether this is covered" into "yes,
+  covered". Four of the 44 entries exist because an event, a test or a rule was
+  present but never actually exercised.
+
+- **48 security tests were not running, and the run reported success.**
+  `node --test` expands `**` as a single directory level rather than as globstar,
+  so the discovery patterns stopped matching as soon as the security suites gained
+  a directory level. The entire authorization suite dropped out; everything that
+  remained passed, so the job went green. There is now one pattern per directory
+  depth, spelled out, with no overlap between them.
+
+- **A deleted security test would have kept running.** `tsc` does not remove
+  output for sources that are renamed or deleted, so a moved suite ran twice under
+  two paths and a deleted suite continued to pass in CI. The build now cleans
+  `dist` first.
+
+- **Secret scanning added over the full history.** Gitleaks, on push and pull
+  request, scanning every commit rather than the tip. The repository history is
+  clean — no npm token, no signing key, no private key. A deliberately planted
+  private key under `src/tests/` is still caught, so the test-fixture allowlist
+  does not become a hole.
+
+- **CodeQL added** for JavaScript/TypeScript and Actions, on push, pull request
+  and weekly, failing on `error` severity.
+
+- **8 project-specific Semgrep rules**, each mapped to a registry entry. They
+  encode defects this codebase actually shipped, including two that are ordering
+  and completeness problems no general rule can see: `requireHumanPrincipal`
+  placed before `app.authenticate` sees no service account and permits everything,
+  and a secret-denylist where an allowlist is the only correct shape. Each rule
+  was verified to fire on a deliberately vulnerable fixture and to stay silent on
+  the real backend.
+
+### Added
+
+- `docs/security/registry.json` — 44 findings, machine-readable and enforced.
+- `docs/security/registry.md` — generated from the above.
+- `docs/security/registry-exceptions.md` — the only place a release gate may be
+  waived, and an entry without an expiry does not count.
+- `docs/security/{rate-limiting,scopes,configuration,audit,supply-chain}.md`.
+- `scripts/verify-security-registry.mjs` and `scripts/render-security-registry.mjs`.
+- `src/tests/helpers/paths.ts` — resolves paths from the nearest `package.json`,
+  so a suite can be moved without its paths silently breaking.
+- `src/tests/security/registry.test.ts` — the registry check runs as part of
+  `npm test`, not only at release time.
+- `src/tests/security/authentication/login-abuse.test.ts` — 7 tests for 2.8.0
+  behaviour that shipped untested.
+- `src/tests/security/audit-export.test.ts` — 5 tests for the CSV export.
+- `src/tests/security/service-accounts/audit-attribution.test.ts` — 5 tests for
+  audit attribution of a machine principal.
+- `.github/workflows/{codeql,sast}.yml`, `.semgrep.yml`, `.gitleaks.toml`.
+- 7 release-gate steps in `release.yml`, replacing a single audit call.
+
+### Fixed
+
+- `mfa.test.ts` now connects Redis, so it exercises the rate limiter rather than
+  passing because the limiter failed open. (Shipped in 2.8.0; the connection is
+  what makes the suite meaningful.)
+
+### Testing
+
+`npm test` and `npm run test:security` are unchanged in count where the change was
+organisational, which is the point: 430 tests before the restructure, 430 after,
+381 security tests before, 381 after. The 7 new authentication tests are on top.
+
+### Fixed
+
+- **The audit log export did not neutralise spreadsheet formula injection.** The
+  CSV export quoted a value containing a delimiter or a quote, but a value whose
+  first character is `=`, `+`, `-` or `@` is evaluated as a formula by Excel,
+  LibreOffice and Google Sheets when the file is opened. Several exported columns
+  are attacker-supplied — the user agent above all — and an audit export is
+  precisely the file an operator opens in a spreadsheet, so that is the expected
+  consumer rather than an edge case. A `User-Agent` of `=cmd|'/c calc'!A1`
+  reached the export intact. A leading apostrophe is now applied before quoting,
+  and a value with no formula prefix is left untouched. (SEC-045)
+
+  It came out of triaging Semgrep's advisory findings. The rule that pointed at
+  the code, `direct-response-write`, is a false positive — the content type is set
+  explicitly and every field is escaped — but the code it flagged was not sound.
+- **Every service-account request produced no audit record at all.** A machine
+  principal carries a sentinel id of `sa:<uuid>` so that routes expecting
+  `request.user` keep working without a matching user row. The audit subscriber
+  passed that sentinel into `audit_log.user_id`, which is a uuid column. Postgres
+  rejected the insert, the subscriber's `catch` logged `failed to write event`, and
+  the record was lost. The request succeeded, so nothing failed visibly, and a
+  missing audit record is indistinguishable from a request that never happened.
+
+  So every request authenticated by an API key or an mTLS service account left no
+  audit trail. The privileged, non-human path was the one that was invisible,
+  which is the wrong direction for that gap to point. The sentinel is now stripped,
+  `user_id` is left null, and the service account is recorded in
+  `metadata.serviceAccountId`. (SEC-046)
+
+  It surfaced in CI and not locally: a new test's fixture passed on this machine
+  and failed in CI, and the reason was visible in the log above the failure.
+
+### Fixed
+
+- **The published package could not be imported.** `dist/index.js` and
+  `dist/index.d.ts` shipped with no `main` and no `types`, so
+  `import "@hilbras/keystone"` did not resolve. The `bin` worked, so the CLI was
+  usable and the library surface was not — and nothing failed, which is why it
+  went unnoticed. `main` and `types` are now declared. Deliberately *not* `exports`:
+  that would be the more complete fix but is a breaking change for anyone
+  deep-importing `dist/` paths, and 2.6.0 is already published.
+- **The migration guides did not ship.** `docs/` was never in `files`, so the
+  instructions for the breaking changes in 2.4.0, 2.6.0 and 2.7.0 were reachable
+  only on GitHub. Someone upgrading via npm received the changelog but not the
+  document it referred to.
+- **`npm run verify:release` had a gap that allowed both.** It checked version,
+  license and repository, and a package with no entry point and no documentation
+  passed. It now also requires `main`/`types` to exist on disk, requires the
+  migration docs in `files`, requires `dist/tests` to stay excluded, and refuses
+  to publish credential material. Verified by reverting: each of the three
+  defects is caught with a message naming the problem.
+
+### Known limitations
+
+- The Semgrep scan covers the backend. Semgrep's TypeScript support fails on a
+  `.tsx` file in the frontend dashboard (TSX generics versus JSX ambiguity) and
+  aborts the whole scan rather than skipping one file, so the frontend is not
+  scanned. This is a tool limitation, recorded rather than papered over.
+- The `keystone-cookie-without-secure` rule stays silent when a cookie's options
+  are spread from another variable, because the rule cannot substantiate a finding
+  there. `auth.ts` builds its options in a helper and spreads them.
+- The Semgrep community rulesets (`p/default`, `p/security-audit`,
+  `p/owasp-top-ten`) run **advisory**, not blocking. Their 15 findings against
+  `src/` have been triaged: four are `escapeXml` output the rule cannot see
+  through, six are `console.*` log-forging at worst, four are AES-GCM where Node
+  enforces the tag length through `setAuthTag`, and one was the `direct-response-write`
+  false positive that led to SEC-045. Gating on a community ruleset nobody has
+  worked through means either a permanently red build or a gate that gets switched
+  off, so they report and the triage is recorded here instead. The project ruleset
+  in `.semgrep.yml` is the blocking gate.
+- Two suites span two domains rather than being split: `proxy/trust-boundary.test.ts`
+  also covers mTLS certificate binding, and `oauth/oauth2-hardening.test.ts` also
+  covers OIDC ID token verification. Splitting them is mechanical but every split
+  copies the whole import header into each partition, and the resulting churn
+  risks removing a live import. The registry records the mapping instead.
+
+## [2.8.0] - 2026-09-27
+
+### Security
+
+- **A Redis outage removed rate limiting entirely.** Every limiter checked
+  `isRedisReady()` and returned `true` when Redis was down. During an outage
+  `login`, `mfa/verify`, `sms-otp/verify` and the OAuth token exchange had no limit
+  at all — and an outage is exactly when unlimited attempts are worth having,
+  because it is the moment an attacker cannot be traced to a single event stream.
+  Sensitive endpoints now fall back to a bounded in-process budget. The fallback
+  is strictly weaker: a client gets one budget per instance. That is a
+  degradation worth having; unbounded is not. The store is capped, because an
+  unbounded map keyed by client address is itself a denial-of-service vector.
+- **MFA verification shared one budget across all users behind an address.** The
+  key was `mfa-verify:<address>:<body.email>`, and that endpoint does not carry
+  an email, so every second-factor verification from one address drew on the same
+  budget of 20. An attacker got 20 guesses; so did an office behind a single NAT,
+  where one busy office could lock out every legitimate second-factor login. The
+  key now includes the challenge, which identifies one login attempt, giving an
+  attacker 20 guesses at the code they are actually attacking without spending
+  anyone else's budget.
+- **Second-factor management shared one budget per address.** The TOTP routes
+  allowed 10 attempts keyed on the address alone, with the same consequence.
+  Brute-forcing a TOTP code is per-account, since the code is checked against one
+  user's secret, so the budget is now keyed on the user.
+- **Credential spraying was unbounded.** The login budget was keyed on address
+  *and* submitted address, so it stopped repeated guesses at one account and did
+  nothing about an attacker who varied the address on every request and guessed
+  across a thousand accounts from one host. A second, address-keyed budget bounds
+  that independently.
+- **A refused request left no record.** A rate-limit trip produced a `429` and
+  nothing else, so sustained guessing at `login` or `mfa/verify` was invisible
+  except in aggregate. `rate_limit_triggered` now records the endpoint, the client
+  address, and **which limiter decided** — a degraded in-process control is a
+  different operational situation from a healthy distributed one, and conflating
+  them would hide it.
+- **Failed logins were never audited.** `user_login_failed` existed in the event
+  vocabulary and was never emitted, on either `/login` or `/token-login`.
+- **A replayed refresh token was indistinguishable from an unknown one.** It is now
+  detected, emits `refresh_token_replayed`, and revokes the account's remaining
+  credentials — a replay means the token is known to somebody else, so answering
+  only that one request leaves the rest of what it could mint intact.
+- **API key creation had no rate limit.** Minting a credential is an
+  authentication event and is now bounded.
+
+### Already sound, verified rather than assumed
+
+`X-Forwarded-For` handling, the trusted-proxy model, and the address-based rate
+limit keys were delivered in v2.0.0. Item 3 of this phase is therefore
+verification rather than new work: a spoofed header from an untrusted peer, a
+multi-entry header, `x-real-ip`, `Forwarded`, IPv4, IPv6, and both spellings of
+IPv4-mapped IPv6 are now covered by tests.
+
+### Added
+
+- `src/services/localRateLimit.ts` — the in-process fallback, bounded and swept.
+- `refresh_token_state` inspection, distinguishing a spent token from an unknown
+  one.
+- 16 tests: the emergency limiter's accounting, bounding and eviction behaviour;
+  proxy spoofing across IPv4, IPv6, mapped IPv6, and multi-entry headers; an
+  enumeration check that every sensitive limiter carries the emergency flag,
+  including the ones built by a factory; and the abuse event payloads.
+
+### A test suite that was not testing what it appeared to
+
+`mfa.test.ts` never connected Redis. The shared client is created with
+`lazyConnect`, so every rate limit in that suite was evaluated against a limiter
+that was not running, and the suite passed **only because the limiter failed
+open** — the behaviour this phase removes. It now connects Redis explicitly, and
+surfaced two real keying defects that had been hidden by fail-open. Fixing those
+took the suite from 12 failures to 55/55.
+
+## [2.7.0] - 2026-09-27
+
+### Security
+
+- **The admin configuration endpoint leaked secrets it did not recognise.**
+  Redaction was a denylist: a set of known-sensitive names plus a regex. Run
+  against 24 secret-looking key names it missed 12, among them `SIGNING_KEY`,
+  `JWT_SIGNING_KEY`, `SENDGRID_KEY`, `PROVIDER_APIKEY`, `SAML_CERT`, `TLS_KEY`,
+  `CERT_PRIVATE`, `HMAC_KEY`, `KMS_KEY` and `DB_URL`. The endpoint returned their
+  values in the clear to an owner-authenticated caller. A denylist is a losing
+  game here: the next person to add a secret-bearing variable leaks it and
+  nothing fails. Redaction is now an **allowlist**, so a key is private until
+  someone deliberately decides otherwise.
+- **CORS allowed every origin when `ALLOWED_ORIGINS` was empty.** The origin
+  callback returned true for an empty allowlist, so an unset variable was
+  equivalent to "permit every origin" on a server that sends credentialed
+  cookies. It now fails closed and logs a warning at boot, so a misconfiguration
+  is visible before a browser is turned away rather than after.
+- **The setup server reflected any origin with credentials.** It creates the owner
+  account and writes configuration, and was registered with `origin: true`. Any
+  page a browser visited could attempt a credentialed request against the
+  bootstrap surface. Origins must now be listed, defaulting to its own loopback
+  addresses.
+- **The setup token was written to stdout in cleartext.** It appeared in
+  container logs, in journald, and in whatever ships logs off the host, where it
+  remains readable long after the bootstrap it was for. It is a full
+  account-initialisation credential. It is now printed only on an explicit
+  `KEYSTONE_PRINT_SETUP_TOKEN=true`, and never in production. The rejection path
+  also no longer logs the presented and expected token lengths, which disclosed
+  the length of the expected token.
+- **Webhook signing secrets were stored in plaintext.** A database dump yielded a
+  working signing key for every endpoint, letting an attacker forge deliveries
+  that the receiving service would accept as genuine. They are now encrypted with
+  AES-256-GCM under the existing key. **Encrypted rather than hashed**, because
+  Keystone signs outbound payloads with the secret and therefore has to be able
+  to recover it; hashing would make signing impossible. Rows written before this
+  change are read unchanged, and re-saving or rotating an endpoint upgrades them.
+- **Session cookies were not `Secure` by default in production.** The default was
+  `false`, so an operator who did not set `COOKIE_SECURE` received cookies that
+  would be sent over plain HTTP. Production now defaults to `true`; development
+  still defaults to `false` and either can be set explicitly.
+- **The setup server bound to all interfaces.** It inherited `HOST`, which
+  defaults to `0.0.0.0` — correct for the main server and wrong for the one that
+  creates the owner account. It now defaults to loopback, honours a private
+  interface, and warns if explicitly told to bind to everything.
+
+### Changed
+
+- CORS policy extracted to `isOriginAllowed` in `src/services/trustedProxies.ts`,
+  shared by the main and setup servers.
+- `EXPOSABLE_CONFIG_KEYS` is the allowlist. `isSensitiveConfigurationKey` is
+  retained for the write path, where a client may legitimately send a value that
+  must be recognised as "preserve this, do not overwrite it".
+
+### Added
+
+- 27 tests: configuration redaction against the 12 previously-leaked names, the
+  setup token's logging behaviour in all three modes, webhook secret encryption
+  including the legacy plaintext read path and signature stability, the CORS
+  policy, and the production deployment defaults.
+
+## [2.6.0] - 2026-09-27
+
+### Security
+
+- **The API key scope guard had a bypass by construction.** It read
+  `scopes.includes(scope) || scopes.includes("service_account")`, so a key whose
+  scope list contained the literal string `"service_account"` satisfied *every*
+  scope requirement. That string was client-suppliable: `POST /api-keys` stored
+  whatever `scopes` it was given, with no validation against any list.
+- **The same guard also failed open.** It returned early whenever
+  `apiKeyScopes` was absent, which is indistinguishable from "this is a session".
+  A key that resolved without a scope list therefore skipped the check entirely.
+- **The guard was never referenced.** `requireScopes` was defined and decorated
+  onto the Fastify instance, but no route in the repository used it. Scopes were
+  stored, returned to callers, and enforced nowhere.
+
+### How exploitable this actually was
+
+Stated precisely, because it matters for prioritising: `app.authenticate` is
+JWT-only and returns 401 for anything that is not a valid access token.
+`authenticateOrApiKey` is the handler with the API key path, and before this
+release exactly one route used it — `GET /auth/validate`. A leaked API key
+therefore reached one endpoint, which returns the caller's own public profile.
+
+So the exposure was a credential whose stated limits were fiction, on a
+credential that could be used almost nowhere. That is a real defect and worth
+fixing, but it is not an authentication bypass, and describing it as one would
+mislead anyone deciding what to do first.
+
+### Changed
+
+- `src/services/scopes.ts` — a scope registry: the canonical names, their
+  descriptions, per-principal defaults, validation, and the allow-list grant
+  check. A scope that is not defined cannot be granted.
+- Unknown or forbidden scopes are refused at key creation with a `400` naming
+  what was rejected and what is allowed, instead of being stored verbatim.
+- `requireScopes` now fails closed, keyed off a new `request.apiKeyId` that is
+  set only when a machine credential authenticated the request. A session is
+  still exempt, since it carries a person's authority and is governed by the
+  permission system.
+- Applied to the routes where a credential's limits matter most: API key
+  creation, listing and revocation, session listing and revocation, and profile
+  read and write.
+- `profile:read`, `profile:write`, and `mfa:manage` are human-only. A service
+  account's profile is a synthesized object with an id of `sa:<uuid>` that
+  matches no user row, so the scope is meaningless for a machine and misleading
+  in an audit log.
+- A service account's default grant is now `organizations:read` only. A personal
+  key's default is read-only on the caller's own resources; the previous
+  `api:read` default was not in any registry, which is a fair indication that
+  nothing was checking it.
+
+### Added
+
+- `src/plugins/machinePrincipal.ts` — `requireHumanPrincipal`, refusing a service
+  account on TOTP, WebAuthn, SMS OTP, identity linking, OAuth consent, and
+  userinfo routes with an explicit `403` and an audit record. This is a backstop
+  rather than a fix for a live hole: those routes are JWT-only today, so a
+  machine credential is refused with a 401 before the guard is reached. It exists
+  so that switching a route to `authenticateOrApiKey` does not silently make a
+  machine principal acceptable somewhere a person was assumed.
+- 25 tests covering the registry, validation, intersection, the grant check, the
+  fail-closed behaviour, HTTP enforcement on the one key-reachable route, and
+  the machine-principal boundary.
+
+### Fixed
+
+- Scope enforcement is keyed on `apiKeyId` rather than the presence of a scope
+  list, closing the fail-open path.
+- The `service_account` wildcard no longer grants anything.
+- Scope ordering is normalised, so two equivalent requests produce identical
+  rows.
+
 ## [2.5.0] - 2026-09-27
 
 ### Security

package/README.md

@@ -1,6 +1,6 @@
 # Hilbras Keystone
 
-**Current version: `2.5.0`**
+**Current version: `2.9.0`**
 
 > A provider-agnostic, API-first identity platform for Hilbras products and third-party applications.
 
@@ -22,6 +22,90 @@ Keystone is a **standalone identity platform**, not a wrapper around another ide
 
 ---
 
+## Using the published package
+
+```bash
+npm install @hilbras/keystone
+```
+
+```ts
+import { buildApp } from "@hilbras/keystone";
+
+const app = await buildApp();
+await app.listen({ port: 3000 });
+// Close it when done: importing the package opens the database pool.
+await app.close();
+```
+
+Or run the server directly with `npx keystone serve`.
+
+The migration guides and security documentation are included in the package, so
+they are available without a network round trip to the repository.
+
+## What's new in v3.0.0
+
+- **The re-audit matrix is generated, not written.** `docs/RE-AUDIT.md` covers all 18 findings the plan names. Every cell is verified against the repository when the file is produced: `Fixed` only if the fix site exists, `Regression test` only if the named file exists *and* contains a test. Deleting a test turns the cell red on the next run rather than leaving a stale assurance in a release document. **`npm run reaudit:check` fails the release gate if any claim cannot be verified.**
+- **Zero unresolved Critical findings**, and that is checked rather than asserted.
+- **Two registry entries withdrawn.** I added `SEC-043` and `SEC-044` in 2.9.0 with fixes at paths that do not exist and issue descriptions the tests do not cover — they were not findings. They are now recorded as withdrawn with the reason, and their suites as coverage.
+- **The registry validator now checks the `fix` field**, which it never did. It verified the named *test* existed and contained a test; nothing confirmed the claim about where the fix lives. That is how two invented entries passed. Four entries named paths that do not exist; all corrected.
+- **Multi-tenant isolation re-audited** across every organization-scoped admin route. No cross-tenant path found — see the CHANGELOG for the specific traces.
+
+## What's new in v2.9.0
+
+- **The published package is importable.** It shipped `dist/index.js` and `dist/index.d.ts` with **no `main` and no `types`**, so `import "@hilbras/keystone"` did not resolve for anyone installing from npm. The `bin` worked, so the CLI was usable and the library surface was not — nothing failed, the package simply could not be imported.
+- **The migration guides now ship.** `docs/` was never in the tarball, so the instructions for the breaking changes in 2.4.0, 2.6.0 and 2.7.0 were reachable only on GitHub. Someone upgrading via npm got the changelog but not what it referred to.
+- **`npm run verify:release` now checks both.** It verified version, license and repository, and let a package with no entry point and no documentation pass. It now also requires `main`/`types` to exist, requires the migration docs to be in `files`, and refuses to ship credential material. Verified by reverting: all three defects are caught.
+- **A permanent regression registry for every finding.** `docs/security/registry.json` records all **46** vulnerabilities found across the hardening programme — the issue, the fix, the test that fails without it, the documentation, and the release. It is machine-readable, so `npm run registry:check` **fails** if an entry names a test that does not exist, if a security suite is claimed by no entry, or if a mandatory attack class is uncovered. A registry that can quietly become false is worse than none.
+- **A security test suite per domain.** Tests moved from 14 flat files into 16 suites grouped by area — authentication, authorization, mfa, oauth, oidc, saml, scim, mtls, sessions, tokens, api-keys, configuration, proxy, rate-limiting. Verified lossless: 381 security tests before and after.
+- **Two test harnesses that were reporting on less than the repository contained.**
+  - **`tsc` never cleaned `dist`.** Output for a renamed or deleted source file survived, so a moved suite ran twice and a *deleted* suite kept running. Test discovery did not reflect the source tree.
+  - **`node --test` expands `**` as a single directory level, not globstar.** When the suites gained a directory level, the discovery patterns stopped matching — **48 security tests, the entire authorization suite, silently stopped running, and the run still reported success** because everything that remained passed. A green run was reporting on less than the repository contained. One pattern per depth now, with no overlap.
+- **A stale fixture path that was correct at only one directory depth.** A suite reached its fixture by counting parent directories, which resolved from `src` and not from `dist`. Paths are now anchored on the nearest `package.json`.
+- **CI now runs CodeQL, Semgrep and Gitleaks.** CodeQL on push, pull request and weekly. Gitleaks over the **full history** — verified clean, and verified to still catch a planted private key under `src/tests/`.
+- **8 project-specific Semgrep rules**, each mapped to a registry entry. They encode what actually went wrong *here*, which no general ruleset can know — including the ordering trap that silently disabled `requireHumanPrincipal` (a guard placed before `app.authenticate` sees nothing and permits everything). Verified in both directions: **8 of 8 fire** on a deliberately vulnerable fixture, **0 findings** on the real backend.
+- **The release gate is now explicit.** A release fails on a critical or high advisory without a documented, time-bounded exception; on secret scanning; on a registry that does not validate; or on any of lint, typecheck, build, tests, security tests and the audit.
+- **A failed login is audited on both login routes**, and **a replayed refresh token is detected** and revokes the account's remaining credentials — while an unknown token revokes nothing. Both shipped in 2.8.0 with no test.
+- **The audit log export no longer evaluates as a spreadsheet formula.** It quoted values containing a delimiter, but a value beginning with `=`, `+`, `-` or `@` is evaluated as a formula when the file is opened — and the exported user agent is attacker-supplied. An audit export is exactly the file an operator opens in a spreadsheet. Found while triaging Semgrep's advisory findings; the rule that pointed at it was a false positive, but the code was not.
+- **Service-account requests are no longer invisible in the audit log.** A machine principal carries a sentinel id of `sa:<uuid>`, which the audit subscriber was writing into a **uuid** column. Postgres rejected the insert, the subscriber logged a failure, and the record was lost — so **every request authenticated by an API key or an mTLS service account left no audit trail at all.** The request succeeded, so nothing failed visibly, and a missing record looks exactly like a request that never happened. The privileged machine path was the one that left no trace. (SEC-046)
+- **17 new tests** covering the above, each verified by reverting the fix.
+
+## What's new in v2.8.0
+
+- **A Redis outage no longer removes rate limiting.** When Redis was unavailable every limiter returned "allowed" — so during an outage, `login`, `mfa/verify`, `sms-otp/verify`, and the OAuth token exchange had **no limit at all**. An outage is precisely when unlimited attempts are worth having. Sensitive endpoints now fall back to a bounded in-process budget.
+- **MFA verification is limited per login attempt, not per address.** The budget key included the submitted email, which that endpoint does not carry, so *every* second-factor verification from one address shared a single budget of 20. An attacker got 20 guesses, but so did an office behind one NAT — one busy office could lock out every legitimate MFA login. The key now includes the challenge.
+- **Second-factor management is limited per user, not per address.** Same problem on the TOTP routes: 10 attempts shared across everyone behind an address. Brute-forcing a code is per-account, so a per-user budget is the right unit.
+- **Credential spraying is capped.** The login budget was keyed on address *and* submitted address, so it stopped repeated guesses at one account but did nothing against an attacker varying the address across a thousand accounts from one host. A second, address-keyed budget bounds that.
+- **A refused request is now recorded.** A rate-limit trip previously left no trace — a 429 and nothing else — so sustained guessing at `login` or `mfa/verify` was invisible except in aggregate. `rate_limit_triggered` records the endpoint, the client address, and **which limiter decided**, so a degraded local control is distinguishable from a healthy distributed one.
+- **Failed logins are audited.** `user_login_failed` existed in the event vocabulary and was never emitted, so password guessing left no record. Now emitted for both `/login` and `/token-login`, without a user id, since the submitted address may match no account.
+- **A replayed refresh token is detected and answered.** A second presentation of a consumed refresh token was indistinguishable from an unknown one. It now emits `refresh_token_replayed` and revokes the account's remaining credentials, because a replay means the token leaked.
+- **API key creation is rate limited** like any other authentication event.
+- **16 tests** covering the emergency limiter, proxy spoofing, and the abuse events.
+
+## What's new in v2.7.0
+
+> **Behavioural.** CORS now fails closed: with no `ALLOWED_ORIGINS` configured, browser origins are **refused** in production rather than allowed. Session cookies also default to `Secure` in production. If you relied on either default, set them explicitly before upgrading.
+
+- **The admin config endpoint no longer leaks secrets** — redaction was a *denylist*, and it missed 12 of 24 secret-looking keys, including `SIGNING_KEY`, `JWT_SIGNING_KEY`, `SENDGRID_KEY`, `SAML_CERT`, `HMAC_KEY`, `KMS_KEY` and `DB_URL`. It is now an allowlist, so a key nobody has thought about is private by default rather than public.
+- **CORS fails closed in production** — an empty `ALLOWED_ORIGINS` previously returned "allow", making an unset variable equivalent to permitting every origin on a server that sends credentialed cookies. It now refuses, and logs a warning at boot so a misconfiguration is visible before a browser is turned away.
+- **The setup server no longer reflects any origin** — it creates the owner account and writes configuration, and was registered with `origin: true` plus credentials. Origins must now be listed, defaulting to its own loopback addresses.
+- **The setup token is no longer printed to stdout** — it landed in container logs, journald, and whatever ships logs off the host, permanently, and is a full account-initialisation credential. It is now printed only on explicit `KEYSTONE_PRINT_SETUP_TOKEN=true`, and never in production.
+- **Webhook signing secrets are encrypted at rest** — stored in plaintext, a database dump yielded a working signing key for every endpoint, letting an attacker forge deliveries the receiver would accept. Encrypted rather than hashed, because Keystone *signs* with the secret and so must be able to recover it. Existing plaintext rows keep working and upgrade on rotation.
+- **Session cookies are `Secure` by default in production** — the default was `false`, so an operator who did not set it got cookies that would be sent over plain HTTP.
+- **The setup server binds to loopback by default** — it inherited `0.0.0.0` from the main server, which is right for the main server and wrong for the one that creates the owner account.
+
+## What's new in v2.6.0
+
+- **API key scopes are now a real registry** — a single list of scope names with descriptions. A scope not in the registry cannot be granted, so there is no string a caller can invent, and a route that needs a scope names it from the list so enforcement cannot quietly drift out of date again.
+- **Unknown scopes are refused, not dropped** — key creation previously stored whatever strings it was given. Silently discarding an unrecognised one hides a typo and leaves the caller believing they hold something they do not, so it now returns `400` listing what was rejected and what is allowed.
+- **The `service_account` wildcard is gone** — the scope guard treated a key as holding *every* scope if its scope list merely contained the string `"service_account"`, and that string was client-suppliable at key creation. It is no longer a scope, and a key holding only it satisfies nothing.
+- **The scope guard fails closed** — it previously returned early whenever `apiKeyScopes` was absent, which is indistinguishable from "this is a session", so a key that resolved without a scope list skipped the check entirely. It now keys off `apiKeyId`, which is set only when a machine credential authenticated.
+- **Scopes are enforced** on key, session, and profile routes, so a key is limited to the operations its grant covers.
+- **Profile and MFA scopes cannot be granted to a service account** — a machine's "profile" is a synthesized object with an id of `sa:<uuid>` that matches no user row, and it has no authenticator to enrol a second factor with.
+- **A stated boundary for machine principals** — `requireHumanPrincipal` refuses a service account on TOTP, WebAuthn, SMS OTP, identity linking, consent, and userinfo routes, with an explicit `403` and an audit record, rather than relying on the synthetic principal happening to match no row.
+- **Personal keys default to read-only** on the caller's own resources. The previous default, `api:read`, was not in any registry — a fair sign that nothing was checking it.
+
+> **Note on reachability.** `app.authenticate` is JWT-only, so almost every route still refuses an API key outright. `GET /auth/validate` is the one route that accepts one, and it is where scope enforcement is observable end to end. What this release fixes is the enforcement machinery, so the next route to adopt key authentication inherits a real check.
+
 ## What's new in v2.5.0
 
 - **The OIDC nonce now reaches the Google connector** — `GoogleConnector.exchangeCode` overrode the base method without forwarding its options, so the nonce added in 2.4.0 was silently discarded for the default provider. Every non-Google OIDC provider validated the nonce; Google, the most likely to be in use, did not.

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA6DA,eAAO,MAAM,MAAM;aACjB,QAAQ;aACR,IAAI;aACJ,IAAI;aAEJ,YAAY;aACZ,SAAS;aAGT,cAAc;aACd,cAAc;aACd,kBAAkB;aAGlB,yBAAyB;aACzB,6BAA6B;aAC7B,mBAAmB;aAGnB,iBAAiB;aACjB,qBAAqB;aAGrB,qBAAqB;aACrB,qBAAqB;aAErB,WAAW;aACX,aAAa;aACb,aAAa;aACb,gBAAgB,EAAuG,QAAQ,GAAG,KAAK,GAAG,MAAM;aAChJ,2BAA2B;aAE3B,mBAAmB;aACnB,wBAAwB;aACxB,yBAAyB;aAGzB,eAAe;aACf,cAAc;aAGd,uBAAuB;aAGvB,yBAAyB;aAGzB,uBAAuB;aAGvB,gBAAgB;aAGhB,gBAAgB;aAEhB,gBAAgB;aAEhB,gBAAgB;aAEhB,eAAe;aAEf,mBAAmB;aACnB,yBAAyB;aACzB,qBAAqB;aACrB,wBAAwB;aAExB,yBAAyB;aACzB,gCAAgC;aAEhC,kBAAkB;aAIlB,2BAA2B;aAC3B,sBAAsB;aACtB,sBAAsB;aACtB,WAAW;aACX,mBAAmB;aAInB,iBAAiB;aACjB,WAAW;IACX,uDAAuD;aAGvD,2BAA2B;IAC3B,qEAAqE;aACrE,mBAAmB;aACnB,8BAA8B;IAC9B,yFAAyF;aACzF,qBAAqB;aACrB,gCAAgC;IAChC;;;;;;OAMG;aACH,eAAe;aACf,yBAAyB;aACzB,gBAAgB;aAChB,4BAA4B;aAC5B,cAAc;aACd,UAAU;aACV,SAAS;aACT,SAAS;aACT,SAAS;aACT,SAAS;aACT,WAAW;aACX,gBAAgB;aAChB,eAAe;aACf,cAAc;aACd,YAAY;aACZ,kBAAkB;aAClB,iBAAiB;aACjB,kBAAkB;aAClB,4BAA4B;aAC5B,2BAA2B;aAC3B,iBAAiB;aACjB,oBAAoB;aACpB,sBAAsB;CACd,CAAC;AAEX,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA6DA,eAAO,MAAM,MAAM;aACjB,QAAQ;aACR,IAAI;aACJ,IAAI;aAEJ,YAAY;aACZ,SAAS;aAGT,cAAc;aACd,cAAc;aACd,kBAAkB;aAGlB,yBAAyB;aACzB,6BAA6B;aAC7B,mBAAmB;aAGnB,iBAAiB;aACjB,qBAAqB;aAGrB,qBAAqB;aACrB,qBAAqB;aAErB,WAAW;aACX,aAAa;aAMb,aAAa;aAGb,gBAAgB,EAAuG,QAAQ,GAAG,KAAK,GAAG,MAAM;aAChJ,2BAA2B;aAE3B,mBAAmB;aACnB,wBAAwB;aACxB,yBAAyB;aAGzB,eAAe;aACf,cAAc;aAGd,uBAAuB;aAGvB,yBAAyB;aAGzB,uBAAuB;aAGvB,gBAAgB;aAGhB,gBAAgB;aAEhB,gBAAgB;aAEhB,gBAAgB;aAEhB,eAAe;aAEf,mBAAmB;aACnB,yBAAyB;aACzB,qBAAqB;aACrB,wBAAwB;aAExB,yBAAyB;aACzB,gCAAgC;aAEhC,kBAAkB;aAIlB,2BAA2B;aAC3B,sBAAsB;aACtB,sBAAsB;aACtB,WAAW;aACX,mBAAmB;aAInB,iBAAiB;aACjB,WAAW;IACX,uDAAuD;aAGvD,2BAA2B;IAC3B,qEAAqE;aACrE,mBAAmB;aACnB,8BAA8B;IAC9B,yFAAyF;aACzF,qBAAqB;aACrB,gCAAgC;IAChC;;;;;;OAMG;aACH,eAAe;aACf,yBAAyB;aACzB,gBAAgB;aAChB,4BAA4B;aAC5B,cAAc;aACd,UAAU;aACV,SAAS;aACT,SAAS;aACT,SAAS;aACT,SAAS;aACT,WAAW;aACX,gBAAgB;aAChB,eAAe;aACf,cAAc;aACd,YAAY;aACZ,kBAAkB;aAClB,iBAAiB;aACjB,kBAAkB;aAClB,4BAA4B;aAC5B,2BAA2B;aAC3B,iBAAiB;aACjB,oBAAoB;aACpB,sBAAsB;CACd,CAAC;AAEX,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}

package/dist/config.js

@@ -67,7 +67,13 @@ export const config = {
     ZITADEL_GITHUB_IDP_ID: getEnv("ZITADEL_GITHUB_IDP_ID"),
     COOKIE_NAME: cookieName,
     COOKIE_DOMAIN: isHostCookie ? undefined : getEnv("COOKIE_DOMAIN", ".local.hilbras.ai"),
-    COOKIE_SECURE: isHostCookie || getEnv("COOKIE_SECURE", "false") === "true",
+    // Secure by default in production. The previous default was "false", so an
+    // operator who did not set it explicitly got session cookies without the
+    // Secure attribute, which are then sent over plain HTTP. A __Host- prefixed
+    // cookie name implies Secure and still wins; otherwise production defaults to
+    // true and development to false, with an explicit override either way.
+    COOKIE_SECURE: isHostCookie ||
+        getEnv("COOKIE_SECURE", getEnv("NODE_ENV", "development") === "production" ? "true" : "false") === "true",
     COOKIE_SAME_SITE: getEnv("COOKIE_SAME_SITE", getEnv("NODE_ENV", "development") === "production" ? "strict" : "lax"),
     ALLOW_PRIVATE_SSO_ENDPOINTS: getEnv("ALLOW_PRIVATE_SSO_ENDPOINTS", "false") === "true",
     AUTH_API_PUBLIC_URL: getEnv("AUTH_API_PUBLIC_URL"),

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,MAAM,CAAC,IAAY,EAAE,QAAQ,GAAG,EAAE;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,wCAAwC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAClG,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,oCAAoC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAC9F,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,GAAG,MAAM,CACvB,aAAa,EACb,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CACpG,CAAC;AACF,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;IAE/B,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAExD,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAEhD,6DAA6D;IAC7D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAC9D,6BAA6B,EAAE,MAAM,CAAC,+BAA+B,CAAC;IACtE,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAElD,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,wFAAwF;IACxF,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IACtD,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,WAAW,EAAE,UAAU;IACvB,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;IACtF,aAAa,EAAE,YAAY,IAAI,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,MAAM;IAC1E,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAA8B;IAChJ,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IAEtF,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACvE,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IAE5E,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IAExC,sGAAsG;IACtG,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,CAAC;IAE1D,2DAA2D;IAC3D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,EAAE,UAAU,CAAC;IAE1E,gHAAgH;IAChH,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,EAAE,YAAY,CAAC;IAExE,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,CAAC;IAEzD,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAE5C,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC,IAAI,MAAM,CAAC,0BAA0B,EAAE,EAAE,CAAC;IAE/F,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAErD,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC;IAE3C,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAC7E,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IACrE,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;IAE1E,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAC3E,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAE5F,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,KAAK,MAAM;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IACtF,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IACvE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC;IAC7C,mBAAmB,EAAE,MAAM,CAAC,8BAA8B,CAAC;IAC3D,8EAA8E;IAC9E,0EAA0E;IAC1E,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;IAClC,uDAAuD;IACvD,yEAAyE;IACzE,oEAAoE;IACpE,2BAA2B,EAAE,cAAc,CAAC,6BAA6B,EAAE,GAAG,CAAC;IAC/E,qEAAqE;IACrE,mBAAmB,EAAE,WAAW,CAAC,qBAAqB,EAAE,KAAK,CAAC;IAC9D,8BAA8B,EAAE,WAAW,CAAC,gCAAgC,EAAE,IAAI,CAAC;IACnF,yFAAyF;IACzF,qBAAqB,EAAE,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC;IACjE,gCAAgC,EAAE,WAAW,CAAC,kCAAkC,EAAE,IAAI,CAAC;IACvF;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC,0BAA0B,CAAC;IACnD,yBAAyB,EAAE,WAAW,CAAC,2BAA2B,EAAE,KAAK,CAAC;IAC1E,gBAAgB,EAAE,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC;IACtD,4BAA4B,EAAE,WAAW,CAAC,8BAA8B,EAAE,SAAS,CAAC;IACpF,cAAc,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;IAC7D,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,MAAM;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC;IAC5C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,4BAA4B,EAAE,MAAM,CAAC,8BAA8B,CAAC;IACpE,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,CAAC;IAClE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,oBAAoB,EAAE,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAC7D,sBAAsB,EAAE,MAAM,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,iCAAiC,CAAC;CAC7F,CAAC;AAEX,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,MAAM,CAAC,IAAY,EAAE,QAAQ,GAAG,EAAE;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,wCAAwC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAClG,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,oCAAoC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAC9F,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,GAAG,MAAM,CACvB,aAAa,EACb,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CACpG,CAAC;AACF,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;IAE/B,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAExD,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAEhD,6DAA6D;IAC7D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAC9D,6BAA6B,EAAE,MAAM,CAAC,+BAA+B,CAAC;IACtE,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAElD,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,wFAAwF;IACxF,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IACtD,qBAAqB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAEtD,WAAW,EAAE,UAAU;IACvB,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;IACtF,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,8EAA8E;IAC9E,uEAAuE;IACvE,aAAa,EACX,YAAY;QACZ,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,MAAM;IAC3G,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAA8B;IAChJ,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IAEtF,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACvE,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IAE5E,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IAExC,sGAAsG;IACtG,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,CAAC;IAE1D,2DAA2D;IAC3D,yBAAyB,EAAE,MAAM,CAAC,2BAA2B,EAAE,UAAU,CAAC;IAE1E,gHAAgH;IAChH,uBAAuB,EAAE,MAAM,CAAC,yBAAyB,EAAE,YAAY,CAAC;IAExE,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,CAAC;IAEzD,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAE5C,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC,IAAI,MAAM,CAAC,0BAA0B,EAAE,EAAE,CAAC;IAE/F,gBAAgB,EAAE,MAAM,CAAC,2BAA2B,CAAC;IAErD,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC;IAE3C,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAC7E,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IACrE,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;IAE1E,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAC3E,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAE5F,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,KAAK,MAAM;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,MAAM;IACtF,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IACvE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC;IAC7C,mBAAmB,EAAE,MAAM,CAAC,8BAA8B,CAAC;IAC3D,8EAA8E;IAC9E,0EAA0E;IAC1E,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;IAClC,uDAAuD;IACvD,yEAAyE;IACzE,oEAAoE;IACpE,2BAA2B,EAAE,cAAc,CAAC,6BAA6B,EAAE,GAAG,CAAC;IAC/E,qEAAqE;IACrE,mBAAmB,EAAE,WAAW,CAAC,qBAAqB,EAAE,KAAK,CAAC;IAC9D,8BAA8B,EAAE,WAAW,CAAC,gCAAgC,EAAE,IAAI,CAAC;IACnF,yFAAyF;IACzF,qBAAqB,EAAE,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC;IACjE,gCAAgC,EAAE,WAAW,CAAC,kCAAkC,EAAE,IAAI,CAAC;IACvF;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC,0BAA0B,CAAC;IACnD,yBAAyB,EAAE,WAAW,CAAC,2BAA2B,EAAE,KAAK,CAAC;IAC1E,gBAAgB,EAAE,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC;IACtD,4BAA4B,EAAE,WAAW,CAAC,8BAA8B,EAAE,SAAS,CAAC;IACpF,cAAc,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;IAC7D,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,MAAM;IACtD,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC;IAC5C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAChD,4BAA4B,EAAE,MAAM,CAAC,8BAA8B,CAAC;IACpE,2BAA2B,EAAE,MAAM,CAAC,6BAA6B,CAAC;IAClE,iBAAiB,EAAE,MAAM,CAAC,mBAAmB,CAAC;IAC9C,oBAAoB,EAAE,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAC7D,sBAAsB,EAAE,MAAM,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,iCAAiC,CAAC;CAC7F,CAAC;AAEX,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;AACpE,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,EAAE,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAqFxD,wBAAsB,QAAQ,+RA2M7B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,EAAE,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAsFxD,wBAAsB,QAAQ,+RAsN7B"}