@indecisivedev/openplan 0.2.0-alpha.2

package/dist/generated/annotation-client.js

@@ -0,0 +1,2 @@
+export const ANNOTATION_CLIENT = "/*!\nOpenplan browser annotation bundle — third-party notices\n\n@drauu/core 1.0.0\nhttps://github.com/antfu/drauu/tree/v1.0.0\n\nMIT License\n\nCopyright (c) 2020-2021 Anthony Fu\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n------------------------------------------------------------\n\nnanoevents 9.1.0 (bundled by @drauu/core)\nhttps://www.npmjs.com/package/nanoevents/v/9.1.0\n\nThe MIT License (MIT)\n\nCopyright 2016 Andrey Sitnik <andrey@sitnik.ru>\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n\n------------------------------------------------------------\n\nperfect-freehand 1.2.2 (bundled by @drauu/core)\nhttps://www.npmjs.com/package/perfect-freehand/v/1.2.2\n\nMIT License\n\nCopyright (c) 2021 Stephen Ruiz Ltd\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n------------------------------------------------------------\n\nSimplify.js (adapted by @drauu/core)\nhttps://github.com/mourner/simplify-js/tree/v1.2.4\n\nCopyright (c) 2017, Vladimir Agafonkin\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without modification, are\npermitted provided that the following conditions are met:\n\n   1. Redistributions of source code must retain the above copyright notice, this list of\n      conditions and the following disclaimer.\n\n   2. Redistributions in binary form must reproduce the above copyright notice, this list\n      of conditions and the following disclaimer in the documentation and/or other materials\n      provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND ANY\nEXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF\nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE\nCOPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,\nEXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF\nSUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)\nHOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR\nTORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n*/\n\"use strict\";(()=>{var Kt=()=>({emit(t,...e){for(let n=this.events[t]||[],s=0,i=n.length;s<i;s++)n[s](...e)},events:{},on(t,e){return(this.events[t]||=[]).push(e),()=>{this.events[t]=this.events[t]?.filter(n=>e!==n)}}});function Q(t,e){return t-e}function Wt(t){return t<0?-1:1}function tt(t){return[Math.abs(t),Wt(t)]}function kt(){let t=()=>((1+Math.random())*65536|0).toString(16).substring(1);return`${t()+t()}-${t()}-${t()}-${t()}-${t()}${t()}${t()}`}var Xt=2,L=Xt;function It(t,e){let n=document.createElementNS(\"http://www.w3.org/2000/svg\",\"defs\"),s=document.createElementNS(\"http://www.w3.org/2000/svg\",\"marker\"),i=document.createElementNS(\"http://www.w3.org/2000/svg\",\"path\");return i.setAttribute(\"fill\",e),s.setAttribute(\"id\",t),s.setAttribute(\"viewBox\",\"0 -5 10 10\"),s.setAttribute(\"refX\",\"5\"),s.setAttribute(\"refY\",\"0\"),s.setAttribute(\"markerWidth\",\"4\"),s.setAttribute(\"markerHeight\",\"4\"),s.setAttribute(\"orient\",\"auto\"),i.setAttribute(\"d\",\"M0,-5L10,0L0,5\"),s.appendChild(i),n.appendChild(s),n}function Yt(t,e){let n=t.x-e.x,s=t.y-e.y;return n*n+s*s}function Zt(t,e,n){let s=e.x,i=e.y,r=n.x-s,a=n.y-i;if(r!==0||a!==0){let o=((t.x-s)*r+(t.y-i)*a)/(r*r+a*a);o>1?(s=n.x,i=n.y):o>0&&(s+=r*o,i+=a*o)}return r=t.x-s,a=t.y-i,r*r+a*a}function Jt(t,e){let n=t[0],s=[n],i;for(let r=1,a=t.length;r<a;r++)i=t[r],Yt(i,n)>e&&(s.push(i),n=i);return n!==i&&i&&s.push(i),s}function dt(t,e,n,s,i){let r=s,a=0;for(let o=e+1;o<n;o++){let h=Zt(t[o],t[e],t[n]);h>r&&(a=o,r=h)}r>s&&(a-e>1&&dt(t,e,a,s,i),i.push(t[a]),n-a>1&&dt(t,a,n,s,i))}function Qt(t,e){let n=t.length-1,s=[t[0]];return dt(t,0,n,e,s),s.push(t[n]),s}function Pt(t,e,n=!1){if(t.length<=2)return t;let s=e!==void 0?e*e:1;return t=n?t:Jt(t,s),t=Qt(t,s),t}var O=class{constructor(t){this.drauu=t,this.event=void 0,this.point=void 0,this.start=void 0,this.el=null}onSelected(t){}onUnselected(){}onStart(t){}onMove(t){return!1}onEnd(t){}get brush(){return this.drauu.brush}get shiftPressed(){return this.drauu.shiftPressed}get altPressed(){return this.drauu.altPressed}get svgElement(){return this.drauu.el}getMousePosition(t){let e=this.drauu.el,n=this.drauu.options.cssZoom??1,s=this.drauu.options.coordinateScale??1,i=this.drauu.options.offset??{x:0,y:0};if(this.drauu.options.coordinateTransform===!1){let r=this.drauu.el.getBoundingClientRect();return{x:(t.pageX/n-r.left+i.x)*s,y:(t.pageY/n-r.top+i.y)*s,pressure:t.pressure}}else{let r=this.drauu.svgPoint;r.x=t.clientX/n+i.x,r.y=t.clientY/n+i.y;let a=r.matrixTransform(e.getScreenCTM()?.inverse());return{x:a.x*s,y:a.y*s,pressure:t.pressure}}}createElement(t,e){let n=document.createElementNS(\"http://www.w3.org/2000/svg\",t),s=e?{...this.brush,...e}:this.brush;return n.setAttribute(\"fill\",s.fill??\"transparent\"),n.setAttribute(\"stroke\",s.color),n.setAttribute(\"stroke-width\",s.size.toString()),n.setAttribute(\"stroke-linecap\",\"round\"),s.dasharray&&n.setAttribute(\"stroke-dasharray\",s.dasharray),n}attr(t,e){this.el.setAttribute(t,typeof e==\"string\"?e:e.toFixed(L))}_setEvent(t){this.event=t,this.point=this.getMousePosition(t)}_eventDown(t){return this._setEvent(t),this.start=this.point,this.onStart(this.point)}_eventMove(t){return this._setEvent(t),this.onMove(this.point)}_eventUp(t){return this._setEvent(t),this.onEnd(this.point)}},te=class $ extends O{constructor(...e){super(...e),this.points=[],this.count=0}onStart(e){if(this.el=this.createElement(\"path\",{fill:\"transparent\"}),this.points=[e],this.brush.arrowEnd){this.arrowId=kt();let n=It(this.arrowId,this.brush.color);this.el.appendChild(n)}return this.el}onMove(e){return this.el||this.onStart(e),this.points[this.points.length-1]!==e&&(this.points.push(e),this.count+=1),this.count>5&&(this.points=Pt(this.points,1,!0),this.count=0),this.attr(\"d\",$.toSvgData(this.points)),!0}onEnd(){let e=this.el;if(this.el=null,!e)return!1;if(e.setAttribute(\"d\",$.toSvgData(Pt(this.points,1,!0))),!e.getTotalLength()){let{x:n,y:s}=this.points[0],i=this.brush.size/2;e.setAttribute(\"d\",`M ${n-i} ${s} a ${i},${i} 0 1,0 ${i*2},0 a ${i},${i} 0 1,0 ${-i*2},0`),e.setAttribute(\"fill\",this.brush.color),e.setAttribute(\"stroke-width\",\"0\")}return!0}static line(e,n){let s=n.x-e.x,i=n.y-e.y;return{length:Math.sqrt(s**2+i**2),angle:Math.atan2(i,s)}}static controlPoint(e,n,s,i){let r=n||e,a=s||e,o=.2,h=$.line(r,a),p=h.angle+(i?Math.PI:0),w=h.length*o;return{x:e.x+Math.cos(p)*w,y:e.y+Math.sin(p)*w}}static bezierCommand(e,n,s){let i=$.controlPoint(s[n-1],s[n-2],e),r=$.controlPoint(e,s[n-1],s[n+1],!0);return`C ${i.x.toFixed(L)},${i.y.toFixed(L)} ${r.x.toFixed(L)},${r.y.toFixed(L)} ${e.x.toFixed(L)},${e.y.toFixed(L)}`}static toSvgData(e){return e.reduce((n,s,i,r)=>i===0?`M ${s.x.toFixed(L)},${s.y.toFixed(L)}`:`${n} ${$.bezierCommand(s,i,r)}`,\"\")}},ee=class extends O{onStart(t){return this.el=this.createElement(\"ellipse\"),this.attr(\"cx\",t.x),this.attr(\"cy\",t.y),this.el}onMove(t){if(!this.el||!this.start)return!1;let[e,n]=tt(t.x-this.start.x),[s,i]=tt(t.y-this.start.y);if(this.shiftPressed){let r=Math.min(e,s);e=r,s=r}if(this.altPressed)this.attr(\"cx\",this.start.x),this.attr(\"cy\",this.start.y),this.attr(\"rx\",e),this.attr(\"ry\",s);else{let[r,a]=[this.start.x,this.start.x+e*n].sort(Q),[o,h]=[this.start.y,this.start.y+s*i].sort(Q);this.attr(\"cx\",(r+a)/2),this.attr(\"cy\",(o+h)/2),this.attr(\"rx\",(a-r)/2),this.attr(\"ry\",(h-o)/2)}return!0}onEnd(){let t=this.el;if(this.el=null,!t)return!1;try{if(!t.getTotalLength())return!1}catch{return!1}return!0}},ne=class extends O{constructor(...t){super(...t),this.pathSubFactor=20,this.pathFragments=[],this._erased=[]}onSelected(t){let e=(n,s)=>{if(n&&n.length)for(let i=0;i<n.length;i++){let r=n[i];if(r.getTotalLength){let a=r.getTotalLength();for(let o=0;o<this.pathSubFactor;o++){let h=r.getPointAtLength(a*o/this.pathSubFactor),p=r.getPointAtLength(a*(o+1)/this.pathSubFactor);this.pathFragments.push({x1:h.x,x2:p.x,y1:h.y,y2:p.y,segment:o,element:s||r})}}else r.children&&e(r.children,r)}};t&&e(t.children)}onUnselected(){this.pathFragments=[]}onStart(t){this.svgPointPrevious=this.svgElement.createSVGPoint(),this.svgPointPrevious.x=t.x,this.svgPointPrevious.y=t.y}onMove(t){this.svgPointCurrent=this.svgElement.createSVGPoint(),this.svgPointCurrent.x=t.x,this.svgPointCurrent.y=t.y;let e=this.checkAndEraseElement();return this.svgPointPrevious=this.svgPointCurrent,e}onEnd(){this.svgPointPrevious=void 0,this.svgPointCurrent=void 0;let t=this._erased;return this._erased=[],{undo:()=>t.forEach(e=>this.drauu._restoreNode(e)),redo:()=>t.forEach(e=>this.drauu._removeNode(e))}}checkAndEraseElement(){if(this.pathFragments.length)for(let t=0;t<this.pathFragments.length;t++){let e=this.pathFragments[t];if(this.svgPointPrevious&&this.svgPointCurrent){let n={x1:this.svgPointPrevious.x,x2:this.svgPointCurrent.x,y1:this.svgPointPrevious.y,y2:this.svgPointCurrent.y};this.lineLineIntersect(e,n)&&(this.drauu._removeNode(e.element),this._erased.push(e.element))}}return this._erased.length&&(this.pathFragments=this.pathFragments.filter(t=>!this._erased.includes(t.element))),this._erased.length>0}lineLineIntersect(t,e){let n=t.x1,s=t.x2,i=e.x1,r=e.x2,a=t.y1,o=t.y2,h=e.y1,p=e.y2,w=(n-s)*(h-p)-(a-o)*(i-r),E=(n*o-a*s)*(i-r)-(n-s)*(i*p-h*r),F=(n*o-a*s)*(h-p)-(a-o)*(i*p-h*r),m=(u,b,D)=>u>=b&&u<=D?!0:u>=D&&u<=b;if(w===0)return!1;{let u={x:E/w,y:F/w};return m(u.x,n,s)&&m(u.y,a,o)&&m(u.x,i,r)&&m(u.y,h,p)}}},se=class extends O{onStart(t){if(this.el=this.createElement(\"line\",{fill:\"transparent\"}),this.attr(\"x1\",t.x),this.attr(\"y1\",t.y),this.attr(\"x2\",t.x),this.attr(\"y2\",t.y),this.brush.arrowEnd){let e=kt(),n=document.createElementNS(\"http://www.w3.org/2000/svg\",\"g\");return n.append(It(e,this.brush.color)),n.append(this.el),this.attr(\"marker-end\",`url(#${e})`),n}return this.el}onMove(t){if(!this.el)return!1;let{x:e,y:n}=t;if(this.shiftPressed){let s=t.x-this.start.x,i=t.y-this.start.y;if(i!==0){let r=s/i;r=Math.round(r),Math.abs(r)<=1?(e=this.start.x+i*r,n=this.start.y+i):(e=this.start.x+s,n=this.start.y)}}return this.altPressed?(this.attr(\"x1\",this.start.x*2-e),this.attr(\"y1\",this.start.y*2-n),this.attr(\"x2\",e),this.attr(\"y2\",n)):(this.attr(\"x1\",this.start.x),this.attr(\"y1\",this.start.y),this.attr(\"x2\",e),this.attr(\"y2\",n)),!0}onEnd(){let t=this.el;if(this.el=null,!t)return!1;try{if(t.getTotalLength()<5)return!1}catch{return!1}return!0}},ie=class extends O{onStart(t){return this.el=this.createElement(\"rect\"),this.brush.cornerRadius&&(this.attr(\"rx\",this.brush.cornerRadius),this.attr(\"ry\",this.brush.cornerRadius)),this.attr(\"x\",t.x),this.attr(\"y\",t.y),this.el}onMove(t){if(!this.el||!this.start)return!1;let[e,n]=tt(t.x-this.start.x),[s,i]=tt(t.y-this.start.y);if(this.shiftPressed){let r=Math.min(e,s);e=r,s=r}if(this.altPressed)this.attr(\"x\",this.start.x-e),this.attr(\"y\",this.start.y-s),this.attr(\"width\",e*2),this.attr(\"height\",s*2);else{let[r,a]=[this.start.x,this.start.x+e*n].sort(Q),[o,h]=[this.start.y,this.start.y+s*i].sort(Q);this.attr(\"x\",r),this.attr(\"y\",o),this.attr(\"width\",a-r),this.attr(\"height\",h-o)}return!0}onEnd(){let t=this.el;if(this.el=null,!t)return!1;try{if(!t.getTotalLength())return!1}catch{return!1}return!0}};function Mt(t,e,n,s=i=>i){return t*s(.5-e*(.5-n))}function re(t){return[-t[0],-t[1]]}function M(t,e){return[t[0]+e[0],t[1]+e[1]]}function _(t,e){return[t[0]-e[0],t[1]-e[1]]}function P(t,e){return[t[0]*e,t[1]*e]}function oe(t,e){return[t[0]/e,t[1]/e]}function U(t){return[t[1],-t[0]]}function Lt(t,e){return t[0]*e[0]+t[1]*e[1]}function ae(t,e){return t[0]===e[0]&&t[1]===e[1]}function he(t){return Math.hypot(t[0],t[1])}function le(t){return t[0]*t[0]+t[1]*t[1]}function Dt(t,e){return le(_(t,e))}function Tt(t){return oe(t,he(t))}function ue(t,e){return Math.hypot(t[1]-e[1],t[0]-e[0])}function G(t,e,n){let s=Math.sin(n),i=Math.cos(n),r=t[0]-e[0],a=t[1]-e[1],o=r*i-a*s,h=r*s+a*i;return[o+e[0],h+e[1]]}function gt(t,e,n){return M(t,P(_(e,t),n))}function At(t,e,n){return M(t,P(e,n))}var{min:z,PI:ce}=Math,Nt=.275,V=ce+1e-4;function de(t,e={}){let{size:n=16,smoothing:s=.5,thinning:i=.5,simulatePressure:r=!0,easing:a=l=>l,start:o={},end:h={},last:p=!1}=e,{cap:w=!0,easing:E=l=>l*(2-l)}=o,{cap:F=!0,easing:m=l=>--l*l*l+1}=h;if(t.length===0||n<=0)return[];let u=t[t.length-1].runningLength,b=o.taper===!1?0:o.taper===!0?Math.max(n,u):o.taper,D=h.taper===!1?0:h.taper===!0?Math.max(n,u):h.taper,bt=Math.pow(n*s,2),B=[],R=[],rt=t.slice(0,10).reduce((l,v)=>{let d=v.pressure;if(r){let f=z(1,v.distance/n);d=z(1,l+(z(1,1-f)-l)*(f*Nt))}return(l+d)/2},t[0].pressure),x=Mt(n,i,t[t.length-1].pressure,a),ot,at=t[0].vector,j=t[0].point,Y=j,T=j,C=Y,ht=!1;for(let l=0;l<t.length;l++){let{pressure:v}=t[l],{point:d,vector:f,distance:qt,runningLength:q}=t[l];if(l<t.length-1&&u-q<3)continue;if(i){if(r){let k=z(1,qt/n),ct=z(1,1-k);v=z(1,rt+(ct-rt)*(k*Nt))}x=Mt(n,i,v,a)}else x=n/2;ot===void 0&&(ot=x);let Ut=q<b?E(q/b):1,Gt=u-q<D?m((u-q)/D):1;x=Math.max(.01,x*Math.min(Ut,Gt));let St=(l<t.length-1?t[l+1]:t[l]).vector,ut=l<t.length-1?Lt(f,St):1,Vt=Lt(f,at)<0&&!ht,Et=ut!==null&&ut<0;if(Vt||Et){let k=P(U(at),x);for(let ct=1/13,J=0;J<=1;J+=ct)T=G(_(d,k),d,V*J),B.push(T),C=G(M(d,k),d,V*-J),R.push(C);j=T,Y=C,Et&&(ht=!0);continue}if(ht=!1,l===t.length-1){let k=P(U(f),x);B.push(_(d,k)),R.push(M(d,k));continue}let _t=P(U(gt(St,f,ut)),x);T=_(d,_t),(l<=1||Dt(j,T)>bt)&&(B.push(T),j=T),C=M(d,_t),(l<=1||Dt(Y,C)>bt)&&(R.push(C),Y=C),rt=v,at=f}let A=t[0].point.slice(0,2),N=t.length>1?t[t.length-1].point.slice(0,2):M(t[0].point,[1,1]),lt=[],Z=[];if(t.length===1){if(!(b||D)||p){let l=At(A,Tt(U(_(A,N))),-(ot||x)),v=[];for(let d=1/13,f=d;f<=1;f+=d)v.push(G(l,A,V*2*f));return v}}else{if(!(b||D&&t.length===1))if(w)for(let v=1/13,d=v;d<=1;d+=v){let f=G(R[0],A,V*d);lt.push(f)}else{let v=_(B[0],R[0]),d=P(v,.5),f=P(v,.51);lt.push(_(A,d),_(A,f),M(A,f),M(A,d))}let l=U(re(t[t.length-1].vector));if(D||b&&t.length===1)Z.push(N);else if(F){let v=At(N,l,x);for(let d=1/29,f=d;f<1;f+=d)Z.push(G(v,N,V*3*f))}else Z.push(M(N,P(l,x)),M(N,P(l,x*.99)),_(N,P(l,x*.99)),_(N,P(l,x)))}return B.concat(Z,R.reverse(),lt)}function ge(t,e={}){var n;let{streamline:s=.5,size:i=16,last:r=!1}=e;if(t.length===0)return[];let a=.15+(1-s)*.85,o=Array.isArray(t[0])?t:t.map(({x:m,y:u,pressure:b=.5})=>[m,u,b]);if(o.length===2){let m=o[1];o=o.slice(0,-1);for(let u=1;u<5;u++)o.push(gt(o[0],m,u/4))}o.length===1&&(o=[...o,[...M(o[0],[1,1]),...o[0].slice(2)]]);let h=[{point:[o[0][0],o[0][1]],pressure:o[0][2]>=0?o[0][2]:.25,vector:[1,1],distance:0,runningLength:0}],p=!1,w=0,E=h[0],F=o.length-1;for(let m=1;m<o.length;m++){let u=r&&m===F?o[m].slice(0,2):gt(E.point,o[m],a);if(ae(E.point,u))continue;let b=ue(u,E.point);if(w+=b,m<F&&!p){if(w<i)continue;p=!0}E={point:u,pressure:o[m][2]>=0?o[m][2]:.5,vector:Tt(_(E.point,u)),distance:b,runningLength:w},h.push(E)}return h[0].vector=((n=h[1])==null?void 0:n.vector)||[0,0],h}function fe(t,e={}){return de(ge(t,e),e)}var pe=class Ct extends O{constructor(...e){super(...e),this.points=[]}onStart(e){return this.el=document.createElementNS(\"http://www.w3.org/2000/svg\",\"path\"),this.points=[e],this.attr(\"fill\",this.brush.color),this.attr(\"d\",this.getSvgData(this.points)),this.el}onMove(e){return this.el||this.onStart(e),this.points[this.points.length-1]!==e&&this.points.push(e),this.attr(\"d\",this.getSvgData(this.points)),!0}onEnd(){let e=this.el;return this.el=null,!!e}getSvgData(e){return Ct.getSvgData(e,this.brush)}static getSvgData(e,n){let s=fe(e,{size:n.size,thinning:.9,simulatePressure:!1,start:{taper:5},end:{taper:5},...n.stylusOptions});if(!s.length)return\"\";let i=s.reduce((r,[a,o],h,p)=>{let[w,E]=p[(h+1)%p.length];return r.push(a,o,(a+w)/2,(o+E)/2),r},[\"M\",...s[0],\"Q\"]);return i.push(\"Z\"),i.map(r=>typeof r==\"number\"?r.toFixed(2):r).join(\" \")}};function me(t){return{draw:new te(t),stylus:new pe(t),line:new se(t),rectangle:new ie(t),ellipse:new ee(t),eraseLine:new ne(t)}}var ve=class{constructor(t={}){this.options=t,this.el=null,this.svgPoint=null,this.eventEl=null,this.shiftPressed=!1,this.altPressed=!1,this.drawing=!1,this._emitter=Kt(),this._originalPointerId=null,this._models=me(this),this._opStack=[],this._opIndex=0,this._disposables=[],this._elements=[],this.options.brush||(this.options.brush={color:\"black\",size:3,mode:\"stylus\"}),t.el&&this.mount(t.el,t.eventTarget,t.window)}get model(){return this._models[this.mode]}get mounted(){return!!this.el}get mode(){return this.options.brush.mode||\"stylus\"}set mode(t){this._models[this.mode].onUnselected(),this.options.brush.mode=t,this.model.onSelected(this.el)}get brush(){return this.options.brush}set brush(t){this.options.brush=t}resolveSelector(t){return typeof t==\"string\"?document.querySelector(t):t||null}mount(t,e,n=window){if(this.el)throw new Error(\"[drauu] already mounted, unmount previous target first\");if(this.el=this.resolveSelector(t),!this.el)throw new Error(\"[drauu] target element not found\");if(this.el.tagName.toLocaleLowerCase()!==\"svg\")throw new Error(\"[drauu] can only mount to a SVG element\");if(!this.el.createSVGPoint)throw new Error(\"[drauu] SVG element must be create by document.createElementNS('http://www.w3.org/2000/svg', 'svg')\");this.svgPoint=this.el.createSVGPoint();let s=this.resolveSelector(e)||this.el,i=this.eventStart.bind(this),r=this.eventMove.bind(this),a=this.eventEnd.bind(this),o=this.eventKeyboard.bind(this),h=this.touchMove.bind(this);s.addEventListener(\"pointerdown\",i,{passive:!1}),n.addEventListener(\"pointermove\",r,{passive:!1}),n.addEventListener(\"pointerup\",a,{passive:!1}),n.addEventListener(\"pointercancel\",a,{passive:!1}),n.addEventListener(\"keydown\",o,!1),n.addEventListener(\"keyup\",o,!1),n.addEventListener(\"touchmove\",h,{passive:!1}),this._disposables.push(()=>{s.removeEventListener(\"pointerdown\",i),n.removeEventListener(\"pointermove\",r),n.removeEventListener(\"pointerup\",a),n.removeEventListener(\"pointercancel\",a),n.removeEventListener(\"keydown\",o,!1),n.removeEventListener(\"keyup\",o,!1),n.removeEventListener(\"touchmove\",h)}),this._emitter.emit(\"mounted\")}unmount(){this._disposables.forEach(t=>t()),this._disposables.length=0,this._elements.length=0,this.el=null,this._emitter.emit(\"unmounted\")}on(t,e){return this._emitter.on(t,e)}undo(){return!this.canUndo()||this.drawing?!1:(this._opStack[--this._opIndex].undo(),this._emitter.emit(\"changed\"),!0)}redo(){return!this.canRedo()||this.drawing?!1:(this._opStack[this._opIndex++].redo(),this._emitter.emit(\"changed\"),!0)}canRedo(){return this._opIndex<this._opStack.length}canUndo(){return this._opIndex>0}eventMove(t){!this.acceptsInput(t)||!this.drawing||this.model._eventMove(t)&&(t.stopPropagation(),t.preventDefault(),this._emitter.emit(\"changed\"))}eventStart(t){this.acceptsInput(t)&&(t.stopPropagation(),t.preventDefault(),this._currentNode&&this.cancel(),this.drawing=!0,this._originalPointerId=t.pointerId,this._emitter.emit(\"start\"),this._currentNode=this.model._eventDown(t),this._currentNode&&this.mode!==\"eraseLine\"&&this.el.appendChild(this._currentNode),this._emitter.emit(\"changed\"))}eventEnd(t){if(!this.acceptsInput(t)||!this.drawing)return;let e=this.model._eventUp(t);if(!e)this.cancel();else if(e===!0){let n=this._currentNode;n&&(this._appendNode(n),this.commit({undo:()=>this._removeNode(n),redo:()=>this._restoreNode(n)}))}else this.commit(e);this.drawing=!1,this._emitter.emit(\"end\"),this._emitter.emit(\"changed\"),this._originalPointerId=null}touchMove(t){Array.from(t.touches).some(e=>e.touchType===\"stylus\"&&e.identifier===this._originalPointerId)&&t.preventDefault()}acceptsInput(t){return(!this.options.acceptsInputTypes||this.options.acceptsInputTypes.includes(t.pointerType))&&!(this._originalPointerId&&this._originalPointerId!==t.pointerId)}eventKeyboard(t){this.shiftPressed===t.shiftKey&&this.altPressed===t.altKey||(this.shiftPressed=t.shiftKey,this.altPressed=t.altKey,this.model.point&&this.model.onMove(this.model.point)&&this._emitter.emit(\"changed\"))}commit(t){this._opStack.length=this._opIndex,this._opStack.push(t),this._opIndex++;let e=this._currentNode;this._currentNode=void 0,this._emitter.emit(\"committed\",e)}clear(){this._opStack.length=0,this._opIndex=0,this._elements=[],this.cancel(),this.el.innerHTML=\"\",this._emitter.emit(\"changed\")}cancel(){this._currentNode&&(this.el.removeChild(this._currentNode),this._currentNode=void 0,this._emitter.emit(\"canceled\"))}dump(){return this.el.innerHTML}load(t){this.clear(),this.el.innerHTML=t}_appendNode(t){let e=this._elements.at(-1);e?e.after(t):this.el.append(t);let n=this._elements.push(t)-1;t.dataset.drauu_index=n.toString()}_removeNode(t){t.remove(),this._elements[+t.dataset.drauu_index]=null}_restoreNode(t){let e=+t.dataset.drauu_index;this._elements[e]=t;for(let n=e-1;n>=0;n--){let s=this._elements[n];if(s){s.after(t);return}}this.el.prepend(t)}};function $t(t){return new ve(t)}var ft=document.body,H=X(\"#openplan-plan-frame\"),ye=X(\"#openplan-annotation-status\"),et=X(\"#openplan-annotation-color\"),mt=X(\"#openplan-annotation-width\"),Ot=X(\"#openplan-annotation-toolbar\"),vt=[\"openplan-annotations-v1\",ft.dataset.draftId,ft.dataset.versionId,ft.dataset.contentHash].join(\":\"),S=null,g=null,c=null,I=null,nt=\"pan\",K=!0,W=[],pt=null;H.addEventListener(\"load\",()=>void Bt());H.contentDocument?.readyState===\"complete\"&&Bt();Ot.addEventListener(\"click\",t=>{let e=t.target?.closest(\"button[data-action]\");e&&we(e.dataset.action||\"\")});et.addEventListener(\"input\",wt);mt.addEventListener(\"input\",wt);async function Bt(){if(!H.contentDocument||!H.contentWindow||!H.contentDocument.body)return;c=H.contentDocument,I=H.contentWindow,c.documentElement.style.position=\"relative\",c.body.style.position||=\"relative\",g?.remove(),g=c.createElementNS(\"http://www.w3.org/2000/svg\",\"svg\"),g.setAttribute(\"aria-hidden\",\"true\"),g.style.position=\"absolute\",g.style.inset=\"0 auto auto 0\",g.style.zIndex=\"2147483646\",g.style.pointerEvents=\"none\",g.style.touchAction=\"none\",g.style.overflow=\"visible\",c.body.append(g),Ht();let t=new ResizeObserver(Ht);t.observe(c.documentElement),t.observe(c.body),S?.unmount(),S=$t({el:g,eventTarget:g,window:I,brush:{mode:\"draw\",color:et.value,size:Number(mt.value)}}),S.on(\"changed\",it),Se(),c.addEventListener(\"mouseup\",xe);let e=await Ee();e?(S.load(e.svg),W=e.highlights||[],st(),e.viewportWidth&&Math.abs(e.viewportWidth-c.documentElement.clientWidth)>240?y(\"Restored annotations; this plan is displayed at a different width, so drawings may have shifted.\"):y(\"Restored annotations from this browser.\")):y(\"Annotations are stored only in this browser.\"),yt(\"pan\")}async function we(t){if(!(!S||!g)){if(t===\"pan\"||t===\"pen\"||t===\"highlighter\"||t===\"text\"){yt(t);return}if(t===\"undo\"){S.undo(),it();return}if(t===\"redo\"){S.redo(),it();return}if(t===\"visibility\"){K=!K,g.style.display=K?\"block\":\"none\",st(),y(K?\"Annotations shown.\":\"Annotations hidden.\");return}if(t===\"clear\"){if(!window.confirm(\"Clear drawings and highlights stored for this plan version in this browser?\"))return;S.clear(),W=[],st(),await Pe(),y(\"Local annotations cleared.\");return}if(t===\"export-json\"){zt(\"openplan-annotations.json\",JSON.stringify(jt(),null,2),\"application/json\"),y(\"Exported annotation data.\");return}if(t===\"export-svg\"){let e=g.getAttribute(\"width\")||\"0\",n=g.getAttribute(\"height\")||\"0\";zt(\"openplan-annotations.svg\",`<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"${e}\" height=\"${n}\" viewBox=\"0 0 ${e} ${n}\">${S.dump()}</svg>`,\"image/svg+xml\"),y(\"Exported drawing SVG.\")}}}function yt(t){if(!S||!g)return;nt=t;let e=t===\"pen\"||t===\"highlighter\";if(g.style.pointerEvents=e?\"auto\":\"none\",c?.documentElement.classList.toggle(\"openplan-annotation-drawing\",e),Ot.querySelectorAll(\"button[data-action]\").forEach(n=>{n.classList.toggle(\"active\",n.dataset.action===t),n.setAttribute(\"aria-pressed\",String(n.dataset.action===t))}),wt(),t===\"text\"){let n=I?.CSS?.highlights;y(n?\"Select text in the plan to highlight it.\":\"Native text highlights are unavailable in this browser; use the marker tool instead.\")}else y(e?`${t===\"pen\"?\"Pen\":\"Highlighter\"} active. Press Escape or choose Browse to stop drawing.`:\"Browse mode active.\")}function wt(){if(!S)return;let t=\"draw\",e=nt===\"highlighter\"?`${et.value}66`:et.value,n=Number(mt.value)*(nt===\"highlighter\"?3:1);S.brush={mode:t,color:e,size:n}}function Ht(){if(!g||!c)return;let t=c.documentElement,e=c.body,n=Math.max(t.scrollWidth,t.clientWidth,e.scrollWidth),s=Math.max(t.scrollHeight,t.clientHeight,e.scrollHeight);g.setAttribute(\"width\",String(n)),g.setAttribute(\"height\",String(s)),g.setAttribute(\"viewBox\",`0 0 ${n} ${s}`)}function xe(){if(nt!==\"text\"||!I||!c)return;let t=I.getSelection();if(!t||t.rangeCount===0||t.isCollapsed)return;let e=t.getRangeAt(0),n=be(e);!n||!n.text.trim()||(W.push(n),t.removeAllRanges(),st(),it(),y(\"Text highlight saved in this browser.\"))}function be(t){if(!c?.body)return null;let e=Ft(c.body,t.startContainer),n=Ft(c.body,t.endContainer);return!e||!n?null:{startPath:e,startOffset:t.startOffset,endPath:n,endOffset:t.endOffset,text:t.toString()}}function Ft(t,e){let n=[],s=e;for(;s&&s!==t;){let i=s.parentNode;if(!i)return null;n.unshift(Array.prototype.indexOf.call(i.childNodes,s)),s=i}return s===t?n:null}function Rt(t,e){let n=t;for(let s of e)n=n?.childNodes.item(s)||null;return n}function st(){if(!I||!c?.body)return;let e=I.CSS?.highlights;if(!e||(e.delete(\"openplan-local-annotations\"),!K))return;let n=W.flatMap(i=>{let r=Rt(c.body,i.startPath),a=Rt(c.body,i.endPath);if(!r||!a)return[];try{let o=c.createRange();return o.setStart(r,i.startOffset),o.setEnd(a,i.endOffset),o.toString()===i.text?[o]:[]}catch{return[]}}),s=I.Highlight;s&&n.length&&e.set(\"openplan-local-annotations\",new s(...n))}function Se(){if(!c||c.getElementById(\"openplan-annotation-highlight-style\"))return;let t=c.createElement(\"style\");t.id=\"openplan-annotation-highlight-style\",t.textContent=`\n    ::highlight(openplan-local-annotations) { background: rgba(250, 204, 21, .48); color: inherit; }\n    html.openplan-annotation-drawing, html.openplan-annotation-drawing * { cursor: crosshair !important; user-select: none !important; }\n  `,c.head.append(t)}function it(){pt!==null&&window.clearTimeout(pt),pt=window.setTimeout(()=>void _e(jt()),180)}function jt(){return{schema:1,svg:S?.dump()||\"\",viewportWidth:c?.documentElement.clientWidth||0,highlights:W}}function y(t){ye.textContent=t}function zt(t,e,n){let s=URL.createObjectURL(new Blob([e],{type:n})),i=document.createElement(\"a\");i.href=s,i.download=t,i.click(),window.setTimeout(()=>URL.revokeObjectURL(s),0)}function xt(){return new Promise((t,e)=>{let n=indexedDB.open(\"openplan-browser-annotations\",1);n.onupgradeneeded=()=>{n.result.objectStoreNames.contains(\"documents\")||n.result.createObjectStore(\"documents\")},n.onsuccess=()=>t(n.result),n.onerror=()=>e(n.error)})}async function Ee(){try{let t=await xt();return await new Promise((e,n)=>{let s=t.transaction(\"documents\",\"readonly\").objectStore(\"documents\").get(vt);s.onsuccess=()=>e(s.result||null),s.onerror=()=>n(s.error)})}catch{return y(\"Browser storage is unavailable; annotations will last only until this page closes.\"),null}}async function _e(t){try{let e=await xt();await new Promise((n,s)=>{let i=e.transaction(\"documents\",\"readwrite\").objectStore(\"documents\").put(t,vt);i.onsuccess=()=>n(),i.onerror=()=>s(i.error)}),y(\"Saved in this browser.\")}catch{y(\"Could not save annotations in browser storage. Export them before leaving this page.\")}}async function Pe(){try{let t=await xt();await new Promise((e,n)=>{let s=t.transaction(\"documents\",\"readwrite\").objectStore(\"documents\").delete(vt);s.onsuccess=()=>e(),s.onerror=()=>n(s.error)})}catch{y(\"The drawing was cleared, but browser storage could not be updated.\")}}window.addEventListener(\"keydown\",t=>{t.key===\"Escape\"&&yt(\"pan\")});function X(t){let e=document.querySelector(t);if(!e)throw new Error(`Annotation viewer is missing ${t}.`);return e}})();\n";
+//# sourceMappingURL=annotation-client.js.map

package/dist/generated/annotation-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotation-client.js","sourceRoot":"","sources":["../../src/generated/annotation-client.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAW,6t9BAA6t9B,CAAC"}

package/dist/html-policy.d.ts

@@ -0,0 +1,15 @@
+export interface HtmlStats {
+    hasInlineScript: boolean;
+    externalImageHosts: string[];
+}
+export interface HtmlValidationResult {
+    ok: boolean;
+    errors: string[];
+    warnings: string[];
+    title: string | null;
+    hasScripts: boolean;
+    stats: HtmlStats;
+}
+export declare function validateHtml(html: unknown, options?: {
+    maxBytes?: number;
+}): HtmlValidationResult;

package/dist/html-policy.js

@@ -0,0 +1,172 @@
+import * as parse5 from "parse5";
+const BLOCKED_TAGS = new Set([
+    "form",
+    "iframe",
+    "object",
+    "embed",
+    "applet",
+    "base",
+    "link"
+]);
+const URL_ATTRS = new Set([
+    "href",
+    "src",
+    "action",
+    "formaction",
+    "poster",
+    "srcdoc",
+    "xlink:href"
+]);
+const BLOCKED_PROTOCOLS = ["javascript:", "vbscript:", "file:"];
+const ALLOWED_SCRIPT_TYPES = new Set(["", "text/javascript", "application/javascript"]);
+// Far above any real document (browsers themselves flatten around 512), but
+// well below where the recursive parse5 serializer used for the framed view
+// would overflow the call stack (~2000+ levels).
+const MAX_DEPTH = 512;
+export function validateHtml(html, options = {}) {
+    const maxBytes = options.maxBytes ?? 512 * 1024;
+    const errors = [];
+    const warnings = [];
+    if (typeof html !== "string" || html.trim() === "") {
+        errors.push("HTML document is empty.");
+        return { ok: false, errors, warnings, title: null, hasScripts: false, stats: emptyStats() };
+    }
+    const byteLength = Buffer.byteLength(html, "utf8");
+    if (byteLength > maxBytes) {
+        errors.push(`HTML document is ${byteLength} bytes; maximum is ${maxBytes} bytes.`);
+    }
+    let document;
+    try {
+        // scriptingEnabled: false so <noscript> children parse as real elements:
+        // the hosted viewer renders drafts in an iframe without allow-scripts
+        // unless consented, and the policy must see what that frame shows.
+        document = parse5.parse(html, { scriptingEnabled: false });
+    }
+    catch {
+        errors.push("HTML document could not be parsed.");
+        return { ok: false, errors, warnings, title: null, hasScripts: false, stats: emptyStats() };
+    }
+    let title = null;
+    let hasScripts = false;
+    const externalImageHosts = new Set();
+    function visit(node) {
+        if (node.tagName) {
+            const tagName = node.tagName.toLowerCase();
+            if (BLOCKED_TAGS.has(tagName)) {
+                errors.push(`Blocked <${tagName}> tag found.`);
+            }
+            if (tagName === "script") {
+                hasScripts = true;
+                const attributes = new Map((node.attrs || []).map((attr) => [attr.name.toLowerCase(), String(attr.value || "").trim()]));
+                if (attributes.has("src")) {
+                    errors.push("External script sources are not allowed.");
+                }
+                const scriptType = (attributes.get("type") || "").toLowerCase();
+                if (!ALLOWED_SCRIPT_TYPES.has(scriptType)) {
+                    errors.push(`Unsupported script type "${scriptType}" found.`);
+                }
+            }
+            for (const attr of node.attrs || []) {
+                const name = attr.name.toLowerCase();
+                const value = String(attr.value || "").trim();
+                if (name.startsWith("on")) {
+                    errors.push(`Blocked inline event handler attribute "${name}" found.`);
+                }
+                if (name === "srcdoc") {
+                    errors.push('Blocked "srcdoc" attribute found.');
+                }
+                if (URL_ATTRS.has(name)) {
+                    const normalized = value.replace(/[\u0000-\u0020]+/g, "").toLowerCase();
+                    if (BLOCKED_PROTOCOLS.some((protocol) => normalized.startsWith(protocol))) {
+                        errors.push(`Blocked unsafe URL in "${name}" attribute.`);
+                    }
+                }
+                if (name === "style" && /expression\s*\(|behavior\s*:|url\s*\(\s*javascript:/i.test(value)) {
+                    errors.push("Blocked unsafe inline CSS.");
+                }
+            }
+            if (tagName === "meta") {
+                const httpEquiv = (node.attrs || []).find((attr) => attr.name.toLowerCase() === "http-equiv");
+                if (httpEquiv && httpEquiv.value.trim().toLowerCase() === "refresh") {
+                    errors.push("Blocked meta refresh tag found.");
+                }
+            }
+            // Images are the one external resource the serving CSP allows (img-src
+            // https: data:), so record which hosts a draft pulls from for later review.
+            if (tagName === "img") {
+                const src = (node.attrs || []).find((attr) => attr.name.toLowerCase() === "src");
+                const host = externalHost(src?.value);
+                if (host)
+                    externalImageHosts.add(host);
+            }
+        }
+        if (node.tagName === "title" && !title) {
+            title = collectText(node).trim().slice(0, 140) || null;
+        }
+    }
+    let tooDeep = false;
+    const stack = [{ node: document, depth: 0 }];
+    while (stack.length) {
+        const current = stack.pop();
+        if (!current)
+            break;
+        const { node, depth } = current;
+        visit(node);
+        if (depth >= MAX_DEPTH) {
+            tooDeep = true;
+            continue;
+        }
+        const children = node.childNodes || [];
+        for (let i = children.length - 1; i >= 0; i--) {
+            stack.push({ node: children[i], depth: depth + 1 });
+        }
+    }
+    if (tooDeep) {
+        errors.push(`HTML is nested more than ${MAX_DEPTH} levels deep.`);
+    }
+    if (!title) {
+        warnings.push("No <title> found; Openplan will use a generic title.");
+    }
+    return {
+        ok: errors.length === 0,
+        errors: [...new Set(errors)],
+        warnings: [...new Set(warnings)],
+        title,
+        hasScripts,
+        stats: {
+            hasInlineScript: hasScripts,
+            externalImageHosts: [...externalImageHosts].sort()
+        }
+    };
+}
+function emptyStats() {
+    return { hasInlineScript: false, externalImageHosts: [] };
+}
+// Returns the lowercased host of an absolute http(s) (or protocol-relative) URL,
+// or null for relative paths, data: URIs, and anything unparseable.
+function externalHost(value) {
+    const raw = String(value || "").trim();
+    if (!raw)
+        return null;
+    const candidate = raw.startsWith("//") ? `https:${raw}` : raw;
+    try {
+        const url = new URL(candidate);
+        if (url.protocol === "http:" || url.protocol === "https:") {
+            return url.hostname.toLowerCase();
+        }
+    }
+    catch {
+        // relative path, data: URI, etc. — not an external host
+    }
+    return null;
+}
+function collectText(node) {
+    let value = "";
+    for (const child of node.childNodes || []) {
+        if (child.nodeName === "#text")
+            value += child.value || "";
+        value += collectText(child);
+    }
+    return value;
+}
+//# sourceMappingURL=html-policy.js.map

package/dist/html-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-policy.js","sourceRoot":"","sources":["../src/html-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM;IACN,KAAK;IACL,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAChE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAExF,4EAA4E;AAC5E,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,SAAS,GAAG,GAAG,CAAC;AA6BtB,MAAM,UAAU,YAAY,CAC1B,IAAa,EACb,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,GAAG,IAAI,CAAC;IAChD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,oBAAoB,UAAU,sBAAsB,QAAQ,SAAS,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,yEAAyE;QACzE,sEAAsE;QACtE,mEAAmE;QACnE,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAwB,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE7C,SAAS,KAAK,CAAC,IAAc;QAC3B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAE3C,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,YAAY,OAAO,cAAc,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACzB,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAC7F,CAAC;gBACF,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;gBAC1D,CAAC;gBAED,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAChE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,4BAA4B,UAAU,UAAU,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAE9C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,2CAA2C,IAAI,UAAU,CAAC,CAAC;gBACzE,CAAC;gBAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;gBACnD,CAAC;gBAED,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;oBACxE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;wBAC1E,MAAM,CAAC,IAAI,CAAC,0BAA0B,IAAI,cAAc,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBAED,IAAI,IAAI,KAAK,OAAO,IAAI,sDAAsD,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC3F,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,CAAC;gBAC9F,IAAI,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;oBACpE,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;YAED,uEAAuE;YACvE,4EAA4E;YAC5E,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;gBACjF,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACtC,IAAI,IAAI;oBAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;QACzD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,KAAK,GAA6C,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,MAAM;QACpB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;YACvB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,4BAA4B,SAAS,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QACvB,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,KAAK;QACL,UAAU;QACV,KAAK,EAAE;YACL,eAAe,EAAE,UAAU;YAC3B,kBAAkB,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,EAAE;SACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;AAC5D,CAAC;AAED,iFAAiF;AACjF,oEAAoE;AACpE,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAc;IACjC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;YAAE,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3D,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/ids.d.ts

@@ -0,0 +1,2 @@
+export declare function newDraftId(): string;
+export declare function newInternalId(): string;

package/dist/ids.js

@@ -0,0 +1,10 @@
+import { customAlphabet } from "nanoid";
+const draftId = customAlphabet("0123456789abcdefghijklmnopqrstuvwxyz", 12);
+const internalId = customAlphabet("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", 20);
+export function newDraftId() {
+    return draftId();
+}
+export function newInternalId() {
+    return internalId();
+}
+//# sourceMappingURL=ids.js.map

package/dist/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAExC,MAAM,OAAO,GAAG,cAAc,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;AAC3E,MAAM,UAAU,GAAG,cAAc,CAAC,gEAAgE,EAAE,EAAE,CAAC,CAAC;AAExG,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}

package/dist/local-auth.d.ts

@@ -0,0 +1,36 @@
+import type { Request } from "express";
+import type { SessionPayload } from "./types.js";
+export interface LocalAccount {
+    accountId: string;
+    accountName: string;
+    username: string;
+    isAdmin: boolean;
+    sessionVersion: number;
+}
+export interface LocalUserSummary {
+    accountId: string;
+    accountName: string;
+    username: string;
+    isAdmin: boolean;
+    createdAt: string;
+}
+export declare function bootstrapLocalAdministrator(input: {
+    username: string;
+    password: string;
+    displayName?: string;
+}): Promise<LocalAccount>;
+export declare function createLocalUser(input: {
+    username: string;
+    password: string;
+    displayName?: string;
+    isAdmin?: boolean;
+}): Promise<LocalAccount>;
+export declare function authenticateLocalUser(req: Request, username: string, password: string): Promise<LocalAccount | null>;
+export declare function readWebSession(req: Request): Promise<SessionPayload | null>;
+export declare function changeLocalPassword(input: {
+    accountId: string;
+    currentPassword: string;
+    newPassword: string;
+}): Promise<number>;
+export declare function listLocalUsers(): Promise<LocalUserSummary[]>;
+export declare function normalizeUsername(value: string): string;

package/dist/local-auth.js

@@ -0,0 +1,215 @@
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { clientIp } from "./client-ip.js";
+import { browserAuthProvider, config, requireOidcSettings } from "./config.js";
+import { oidcSessionBinding } from "./oidc.js";
+import { pool, withTransaction } from "./db.js";
+import { newInternalId } from "./ids.js";
+import { readSession } from "./web-auth.js";
+const PASSWORD_ALGORITHM = "scrypt-v1";
+const SCRYPT_PARAMETERS = { N: 16_384, r: 8, p: 1, keyLength: 64, maxmem: 64 * 1024 * 1024 };
+const MAX_FAILED_ATTEMPTS = 10;
+const LOCKOUT_MS = 15 * 60 * 1000;
+export async function bootstrapLocalAdministrator(input) {
+    assertSelfHosted();
+    return withTransaction(async (client) => {
+        const count = await client.query("SELECT COUNT(*) AS count FROM local_credentials");
+        if (Number(count.rows[0]?.count || 0) > 0) {
+            throw new Error("A local Openplan account already exists; bootstrap is disabled.");
+        }
+        return createLocalAccount(client, { ...input, isAdmin: true });
+    });
+}
+export async function createLocalUser(input) {
+    assertSelfHosted();
+    return withTransaction((client) => createLocalAccount(client, {
+        ...input,
+        isAdmin: input.isAdmin === true
+    }));
+}
+export async function authenticateLocalUser(req, username, password) {
+    assertSelfHosted();
+    const normalized = normalizeUsername(username);
+    const result = await pool.query(`
+      SELECT lc.*, a.name AS account_name, a.is_admin
+      FROM local_credentials lc
+      JOIN accounts a ON a.id = lc.account_id
+      WHERE lc.username_normalized = $1
+      LIMIT 1
+    `, [normalized]);
+    const row = result.rows[0];
+    if (!row) {
+        await recordAuthEvent(null, normalized, "login_failed_unknown", clientIp(req));
+        await burnPasswordWork(password);
+        return null;
+    }
+    if (row.locked_until && new Date(row.locked_until).getTime() > Date.now()) {
+        await recordAuthEvent(row.account_id, normalized, "login_rejected_locked", clientIp(req));
+        return null;
+    }
+    const valid = await verifyPassword(password, row);
+    if (!valid) {
+        const attempts = Number(row.failed_attempts || 0) + 1;
+        const lockedUntil = attempts >= MAX_FAILED_ATTEMPTS
+            ? new Date(Date.now() + LOCKOUT_MS).toISOString()
+            : null;
+        await pool.query(`
+        UPDATE local_credentials
+        SET failed_attempts = $1, locked_until = $2, updated_at = CURRENT_TIMESTAMP
+        WHERE account_id = $3
+      `, [attempts, lockedUntil, row.account_id]);
+        await recordAuthEvent(row.account_id, normalized, "login_failed", clientIp(req));
+        return null;
+    }
+    await pool.query(`
+      UPDATE local_credentials
+      SET failed_attempts = 0, locked_until = NULL, updated_at = CURRENT_TIMESTAMP
+      WHERE account_id = $1
+    `, [row.account_id]);
+    await recordAuthEvent(row.account_id, normalized, "login_succeeded", clientIp(req));
+    return mapLocalAccount(row);
+}
+export async function readWebSession(req) {
+    const session = readSession(req);
+    if (!session)
+        return null;
+    const provider = browserAuthProvider();
+    if (provider === "oidc") {
+        if (!config.oidc)
+            return null;
+        return session.authProvider === "oidc" && session.oidcBinding === oidcSessionBinding(requireOidcSettings())
+            ? session : null;
+    }
+    if (provider === "shoo") {
+        // Legacy Shoo cookies omitted authProvider. Local cookies must never gain
+        // stateless Shoo authority after a runtime-profile change.
+        return session.authProvider === undefined || session.authProvider === "shoo" ? session : null;
+    }
+    if (session.authProvider !== "local" || !Number.isInteger(session.sessionVersion))
+        return null;
+    const result = await pool.query("SELECT session_version FROM local_credentials WHERE account_id = $1 LIMIT 1", [session.accountId]);
+    return Number(result.rows[0]?.session_version) === Number(session.sessionVersion) ? session : null;
+}
+export async function changeLocalPassword(input) {
+    assertSelfHosted();
+    validatePassword(input.newPassword);
+    return withTransaction(async (client) => {
+        const result = await client.query(`
+        SELECT lc.*, a.name AS account_name, a.is_admin
+        FROM local_credentials lc
+        JOIN accounts a ON a.id = lc.account_id
+        WHERE lc.account_id = $1
+        LIMIT 1
+      `, [input.accountId]);
+        const row = result.rows[0];
+        if (!row || !await verifyPassword(input.currentPassword, row)) {
+            throw new Error("Current password is incorrect.");
+        }
+        const password = await derivePassword(input.newPassword);
+        const nextVersion = Number(row.session_version) + 1;
+        await client.query(`
+        UPDATE local_credentials
+        SET password_algorithm = $1, password_salt = $2, password_hash = $3,
+            password_parameters = $4, session_version = $5,
+            failed_attempts = 0, locked_until = NULL,
+            password_changed_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP
+        WHERE account_id = $6
+      `, [PASSWORD_ALGORITHM, password.salt, password.hash, JSON.stringify(SCRYPT_PARAMETERS), nextVersion, input.accountId]);
+        await client.query("INSERT INTO local_auth_events (id, account_id, event_type) VALUES ($1, $2, $3)", [newInternalId(), input.accountId, "password_changed"]);
+        return nextVersion;
+    });
+}
+export async function listLocalUsers() {
+    assertSelfHosted();
+    const result = await pool.query(`
+      SELECT lc.account_id, a.name AS account_name, lc.username, a.is_admin, lc.created_at
+      FROM local_credentials lc
+      JOIN accounts a ON a.id = lc.account_id
+      ORDER BY lc.created_at ASC
+    `);
+    return result.rows.map((row) => ({
+        accountId: row.account_id,
+        accountName: row.account_name,
+        username: row.username,
+        isAdmin: Boolean(row.is_admin),
+        createdAt: row.created_at
+    }));
+}
+export function normalizeUsername(value) {
+    const normalized = String(value || "").trim().toLowerCase();
+    if (!/^[a-z0-9][a-z0-9._-]{2,63}$/.test(normalized)) {
+        throw new Error("Username must be 3-64 characters using letters, numbers, dots, dashes, or underscores.");
+    }
+    return normalized;
+}
+function assertSelfHosted() {
+    if (config.runtimeProfile !== "self-hosted") {
+        throw new Error("Local account operations require OPENPLAN_RUNTIME_PROFILE=self-hosted.");
+    }
+}
+async function createLocalAccount(client, input) {
+    const username = String(input.username || "").trim();
+    const normalized = normalizeUsername(username);
+    validatePassword(input.password);
+    const existing = await client.query("SELECT account_id FROM local_credentials WHERE username_normalized = $1 LIMIT 1", [normalized]);
+    if (existing.rowCount)
+        throw new Error("Username is already in use.");
+    const password = await derivePassword(input.password);
+    const accountId = `acct_${newInternalId()}`;
+    const accountName = String(input.displayName || username).trim().slice(0, 120) || username;
+    await client.query("INSERT INTO accounts (id, name, is_admin) VALUES ($1, $2, $3)", [accountId, accountName, input.isAdmin]);
+    await client.query(`
+      INSERT INTO local_credentials (
+        account_id, username, username_normalized, password_algorithm,
+        password_salt, password_hash, password_parameters
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7)
+    `, [accountId, username, normalized, PASSWORD_ALGORITHM, password.salt, password.hash, JSON.stringify(SCRYPT_PARAMETERS)]);
+    await client.query("INSERT INTO local_auth_events (id, account_id, username_normalized, event_type) VALUES ($1, $2, $3, $4)", [newInternalId(), accountId, normalized, input.isAdmin ? "administrator_bootstrapped" : "user_created"]);
+    return { accountId, accountName, username, isAdmin: input.isAdmin, sessionVersion: 1 };
+}
+function validatePassword(password) {
+    if (typeof password !== "string" || password.length < 12 || password.length > 512) {
+        throw new Error("Password must be between 12 and 512 characters.");
+    }
+}
+async function derivePassword(password) {
+    const salt = randomBytes(16);
+    const hash = await scryptBuffer(password, salt, SCRYPT_PARAMETERS);
+    return { salt: salt.toString("base64url"), hash: hash.toString("base64url") };
+}
+async function verifyPassword(password, row) {
+    if (row.password_algorithm !== PASSWORD_ALGORITHM)
+        return false;
+    const parameters = JSON.parse(row.password_parameters);
+    const expected = Buffer.from(row.password_hash, "base64url");
+    const actual = await scryptBuffer(password, Buffer.from(row.password_salt, "base64url"), parameters);
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+async function burnPasswordWork(password) {
+    await scryptBuffer(password || "invalid", Buffer.alloc(16), SCRYPT_PARAMETERS);
+}
+function scryptBuffer(password, salt, parameters) {
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, parameters.keyLength, parameters, (error, derivedKey) => {
+            if (error)
+                reject(error);
+            else
+                resolve(derivedKey);
+        });
+    });
+}
+async function recordAuthEvent(accountId, usernameNormalized, eventType, sourceIp) {
+    await pool.query(`
+      INSERT INTO local_auth_events (id, account_id, username_normalized, event_type, source_ip)
+      VALUES ($1, $2, $3, $4, $5)
+    `, [newInternalId(), accountId, usernameNormalized, eventType, sourceIp]);
+}
+function mapLocalAccount(row) {
+    return {
+        accountId: row.account_id,
+        accountName: row.account_name,
+        username: row.username,
+        isAdmin: Boolean(row.is_admin),
+        sessionVersion: Number(row.session_version)
+    };
+}
+//# sourceMappingURL=local-auth.js.map

package/dist/local-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-auth.js","sourceRoot":"","sources":["../src/local-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,MAAM,kBAAkB,GAAG,WAAW,CAAC;AACvC,MAAM,iBAAiB,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC7F,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAiClC,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,gBAAgB,EAAE,CAAC;IACnB,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B,iDAAiD,CAClD,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAKrC;IACC,gBAAgB,EAAE,CAAC;IACnB,OAAO,eAAe,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC5D,GAAG,KAAK;QACR,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI;KAChC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAY,EACZ,QAAgB,EAChB,QAAgB;IAEhB,gBAAgB,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;KAMC,EACD,CAAC,UAAU,CAAC,CACb,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC1E,MAAM,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,uBAAuB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,QAAQ,IAAI,mBAAmB;YACjD,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;YACjD,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,CACd;;;;OAIC,EACD,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,CACxC,CAAC;QACF,MAAM,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,CAAC,KAAK,CACd;;;;KAIC,EACD,CAAC,GAAG,CAAC,UAAU,CAAC,CACjB,CAAC;IACF,MAAM,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY;IAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,OAAO,CAAC,YAAY,KAAK,MAAM,IAAI,OAAO,CAAC,WAAW,KAAK,kBAAkB,CAAC,mBAAmB,EAAE,CAAC;YACzG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,0EAA0E;QAC1E,2DAA2D;QAC3D,OAAO,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,6EAA6E,EAC7E,CAAC,OAAO,CAAC,SAAS,CAAC,CACpB,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACrG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAIzC;IACC,gBAAgB,EAAE,CAAC;IACnB,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpC,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;;;;;;OAMC,EACD,CAAC,KAAK,CAAC,SAAS,CAAC,CAClB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;;;OAOC,EACD,CAAC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CACpH,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAChB,gFAAgF,EAChF,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,kBAAkB,CAAC,CACvD,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,gBAAgB,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAO7B;;;;;KAKC,CACF,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,MAAM,CAAC,cAAc,KAAK,aAAa,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAyH,EACzH,KAAqF;IAErF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,iFAAiF,EACjF,CAAC,UAAU,CAAC,CACb,CAAC;IACF,IAAI,QAAQ,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,QAAQ,aAAa,EAAE,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC3F,MAAM,MAAM,CAAC,KAAK,CAChB,+DAA+D,EAC/D,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CACxC,CAAC;IACF,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;KAKC,EACD,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CACvH,CAAC;IACF,MAAM,MAAM,CAAC,KAAK,CAChB,yGAAyG,EACzG,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,cAAc,CAAC,CACxG,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,GAAuB;IACrE,IAAI,GAAG,CAAC,kBAAkB,KAAK,kBAAkB;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAA6B,CAAC;IACnF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,UAAU,CAAC,CAAC;IACrG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,MAAM,YAAY,CAAC,QAAQ,IAAI,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,YAAY,CACnB,QAAgB,EAChB,IAAY,EACZ,UAAoC;IAEpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YAC7E,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACpB,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAwB,EACxB,kBAA0B,EAC1B,SAAiB,EACjB,QAAuB;IAEvB,MAAM,IAAI,CAAC,KAAK,CACd;;;KAGC,EACD,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAuB;IAC9C,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/maintenance.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/maintenance.js

@@ -0,0 +1,18 @@
+import { assertRuntimeConfigured } from "./config.js";
+import { database } from "./database.js";
+import { initDb } from "./db.js";
+import { runReconciliation } from "./reconcile.js";
+import { assertStorageConfigured } from "./storage.js";
+async function main() {
+    assertRuntimeConfigured();
+    assertStorageConfigured();
+    await initDb();
+    console.log(JSON.stringify(await runReconciliation()));
+}
+main()
+    .catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+})
+    .finally(() => database.close());
+//# sourceMappingURL=maintenance.js.map

package/dist/maintenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.js","sourceRoot":"","sources":["../src/maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,KAAK,UAAU,IAAI;IACjB,uBAAuB,EAAE,CAAC;IAC1B,uBAAuB,EAAE,CAAC;IAC1B,MAAM,MAAM,EAAE,CAAC;IACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACf,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC;KACD,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,39 @@
+export interface OidcEnvironment {
+    OPENPLAN_OIDC_ISSUER?: string | undefined;
+    OPENPLAN_OIDC_CLIENT_ID?: string | undefined;
+    OPENPLAN_OIDC_CLIENT_SECRET?: string | undefined;
+    OPENPLAN_OIDC_SCOPES?: string | undefined;
+    OPENPLAN_OIDC_TOKEN_ENDPOINT_AUTH_METHOD?: string | undefined;
+}
+export interface OidcSettings {
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    scopes: string;
+    tokenEndpointAuthMethod: "client_secret_basic" | "client_secret_post" | "none";
+}
+export interface OidcTransaction {
+    state: string;
+    verifier: string;
+    nonce: string;
+}
+export interface OidcIdentity {
+    issuer: string;
+    subject: string;
+    profile: {
+        email: string | null;
+        emailVerified: boolean;
+        displayName: string | null;
+        pictureUrl: string | null;
+    };
+}
+/** Parse deployment-owned configuration; no issuer or client comes from a request. */
+export declare function parseOidcSettings(env: OidcEnvironment): OidcSettings;
+/** OIDC subjects are unique within an exact issuer, never by email address. */
+export declare function oidcProviderKey(settings: OidcSettings): string;
+/** Changing the issuer or client registration invalidates existing browser sessions. */
+export declare function oidcSessionBinding(settings: OidcSettings): string;
+export declare function beginOidcLogin(settings: OidcSettings, redirectUri: string): Promise<OidcTransaction & {
+    url: string;
+}>;
+export declare function completeOidcLogin(settings: OidcSettings, callbackUrl: URL, transaction: OidcTransaction, redirectUri: string): Promise<OidcIdentity>;