@nacre.work/api 0.18.0 → 0.20.0

package/dist/login.d.ts

@@ -1,5 +1,6 @@
 import type { KeyObject } from 'node:crypto';
 import type { Pool } from 'pg';
+import type { WebAuthnAssertionOptions } from './second-factor.js';
 export interface LoginRequest {
     readonly email: string;
     readonly password: string;
@@ -62,7 +63,33 @@ export interface LoginDeps {
 export interface SecondFactorGate {
     required(orgId: string, userId: string): Promise<boolean>;
     verify(orgId: string, userId: string, code: string): Promise<boolean>;
+    beginWebAuthnAssertion(orgId: string, userId: string): Promise<WebAuthnAssertionOptions | undefined>;
+    verifyWebAuthnAssertion(orgId: string, userId: string, response: WebAuthnProof): Promise<boolean>;
 }
+/** What a browser hands back from `navigator.credentials.get`. */
+export interface WebAuthnProof {
+    readonly credentialId: string;
+    readonly authenticatorData: Uint8Array;
+    readonly clientDataJSON: Uint8Array;
+    readonly signature: Uint8Array;
+    readonly challenge: string;
+}
+/**
+ * The proof the second half of a sign-in takes, and it is a union on purpose.
+ *
+ * A six-digit code and an assertion are not two spellings of one argument: the
+ * first is a string a person read off a screen and the second is a signature
+ * over an origin. Making the parameter a union means a caller has to say which
+ * it holds, and a handler that forgot the new kind is a compile error rather
+ * than a route that silently only ever accepts the old one.
+ */
+export type SecondFactorProof = {
+    readonly kind: 'code';
+    readonly code: string;
+} | {
+    readonly kind: 'webauthn';
+    readonly response: WebAuthnProof;
+};
 /**
  * Sign-in has three outcomes now, and a union rather than a nullable pair.
  *
@@ -71,10 +98,44 @@ export interface SecondFactorGate {
  * a caller can ignore, and ignoring it here means issuing a session to somebody
  * who has not produced their second factor.
  */
-export type LoginOutcome = {
+export type SessionOutcome = {
     readonly kind: 'tokens';
     readonly tokens: Tokens;
 } | {
+    /**
+     * A gate admitted this person only as far as enrolling a second factor.
+     *
+     * The challenge reaches the enrolment routes and nothing else, and
+     * confirming a factor is what turns it into a session. Without this
+     * outcome a policy requiring a factor would lock out everybody who had
+     * not already enrolled on the day it was turned on, and the route back
+     * would be the database.
+     */
+    readonly kind: 'enrol-second-factor';
+    readonly challenge: string;
+    readonly expiresIn: number;
+    /** The gate's own words, shown to the person. Never an internal detail. */
+    readonly reason: string;
+} | {
+    /** A gate refused, and no action by this person changes that. */
+    readonly kind: 'refused';
+    readonly reason: string;
+};
+/**
+ * Sign-in's outcomes, which are the ones above plus the second-factor
+ * challenge.
+ *
+ * Split so that every path minting a session shares the first three: the union
+ * came from `issue`, which is the one place a session is made, and a caller
+ * that can reach `issue` can reach all of its answers. Only `login` can ask for
+ * a factor that already exists, so only `login` carries that member.
+ *
+ * A union rather than a nullable pair for the reason it always was: it turns
+ * every call site into a compile error until it says which outcome it means,
+ * and the alternative is an optional field a caller can ignore — where ignoring
+ * it means issuing a session to somebody a policy says may not have one.
+ */
+export type LoginOutcome = SessionOutcome | {
     readonly kind: 'second-factor';
     /** Short-lived, single-purpose, and useless as an access token. */
     readonly challenge: string;
@@ -92,7 +153,15 @@ export type ChangePasswordOutcome = {
     readonly kind: 'changed';
     readonly tokens: Tokens;
     readonly email: string;
-} | 'wrong-password' | 'no-user';
+}
+/**
+ * A shared account: a credential more than one person holds, so none of them
+ * may change it for the rest. Distinct from `wrong-password` because the two
+ * are different facts and only one of them is fixed by retyping.
+ */
+ | 'shared' | Exclude<SessionOutcome, {
+    readonly kind: 'tokens';
+}> | 'wrong-password' | 'no-user';
 export declare class Login {
     private readonly deps;
     constructor(deps: LoginDeps);
@@ -126,7 +195,53 @@ export declare class Login {
      * all of them into one refusal. Which of the four it was is not something a
      * client needs and is something an attacker would use.
      */
-    completeSecondFactor(challenge: string, code: string): Promise<Tokens | undefined>;
+    completeSecondFactor(challenge: string, proof: SecondFactorProof): Promise<SessionOutcome | undefined>;
+    /**
+     * The options a browser needs for the assertion half of a sign-in.
+     *
+     * It takes the same challenge `login` handed back, and that is the whole
+     * reason this method is here rather than on the store: the JWT is what says
+     * who is signing in, and it is signed by a key the store does not have. An
+     * endpoint that took a user id instead would answer "which authenticators
+     * does this person hold" to anybody who asked.
+     *
+     * `undefined` where the challenge is not one of ours, where it has expired,
+     * and where the person has no key enrolled — one refusal, for the reason
+     * every refusal on this path is one.
+     */
+    beginSecondFactorWebAuthn(challenge: string): Promise<WebAuthnAssertionOptions | undefined>;
+    /**
+     * Who a sign-in challenge names, or nothing.
+     *
+     * One reader for the two halves that consult it, because a challenge whose
+     * audience is checked on one path and not the other is an access token
+     * accepted as a challenge — which is exactly what `challengeAudience` exists
+     * to stop.
+     */
+    private readChallenge;
+    /**
+     * Read an enrolment challenge, for the routes that accept one.
+     *
+     * Public because the enrolment surface is in `server.ts` and this is the only
+     * thing that may turn that token into a person. It answers the org and the
+     * user and nothing else — no role, no permissions — because the only thing
+     * such a token is allowed to do is add a factor to the account it names.
+     */
+    readEnrolmentChallenge(challenge: string): Promise<{
+        readonly orgId: string;
+        readonly userId: string;
+    } | undefined>;
+    /**
+     * A confirmed factor turns an enrolment challenge into a session.
+     *
+     * Called by the enrolment route once a factor is confirmed, so the person who
+     * was sent to enrol is not then asked to sign in again — which is the moment
+     * they would give up. It re-reads the account and runs the gates again rather
+     * than trusting that enrolling was enough: a gate that wanted a *particular*
+     * kind is entitled to refuse the one that was just added, and assuming
+     * otherwise would be this file deciding what a policy means.
+     */
+    sessionAfterEnrolment(orgId: string, userId: string): Promise<SessionOutcome | undefined>;
     /**
      * A person changes their own password, having proved the current one.
      *
@@ -193,7 +308,7 @@ export declare class Login {
      * took it. Which one is unknowable from here, so the whole family is revoked
      * and both sign in again.
      */
-    refresh(token: string): Promise<Tokens | undefined>;
+    refresh(token: string): Promise<SessionOutcome | undefined>;
     /** Sign out. Ends the family, not just this token. */
     logout(token: string): Promise<boolean>;
     /**
@@ -216,6 +331,27 @@ export declare class Login {
      * revoked together; a fresh login starts a new one, so signing out of one
      * device does not sign out of the others.
      */
+    /**
+     * Mint a session, unless a gate says this authentication is not enough.
+     *
+     * **The gates are consulted here rather than beside each caller, and that is
+     * the whole of why this returns a union.** There are four paths from a
+     * verified credential to a session — a password with no factor asked for, a
+     * completed second factor, a spent refresh token, and a password change — and
+     * a check placed beside them is a check the fifth one forgets. That is this
+     * repository's most repeated defect, so the gate goes at the single point all
+     * four already reach, and every caller becomes a compile error until it says
+     * what it does with a refusal.
+     *
+     * A **refresh** is gated too, deliberately. A policy turned on while people
+     * are signed in would otherwise do nothing for any of them for as long as
+     * they kept renewing — authority renewed without the person present is the
+     * same case a delegation's `disabled` check exists for.
+     *
+     * `path` is what the caller is doing, passed rather than inferred: a gate
+     * that wants to demand a factor on sign-in and not interrupt a password
+     * change can only tell those apart if it is told.
+     */
     private issue;
 }
 //# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAG5C,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAqD1C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CAAA;IACpC,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IACtC,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,qEAAqE;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACzD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACtE;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,CAAA;AAEL;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7E,gBAAgB,GAChB,SAAS,CAAA;AAeb,qBAAa,KAAK;IACJ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,SAAS;IAE5C,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;OAKG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA8CrE;;;;;;;;;;;OAWG;YACW,SAAS;IAevB;;;;;;;OAOG;IACG,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAiCxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC;YAoDnB,QAAQ;IAgBtB;;;;;;OAMG;IACH,OAAO,KAAK,eAAe,GAG1B;IAED;;;;;;;;OAQG;YACW,IAAI;YAuBJ,YAAY;YAaZ,SAAS;YAYT,MAAM;IAgBpB;;;;;;;;OAQG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IA+FzD,sDAAsD;IAChD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB7C;;;;;;;;;;;OAWG;YACW,YAAY;IAe1B;;;;;;OAMG;YACW,KAAK;CAoDpB"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAG5C,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAI1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AA+ElE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CAAA;IACpC,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IACtC,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,qEAAqE;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACzD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrE,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACpG,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAClG;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,UAAU,CAAA;IACtC,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAA;AAEnE;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IACE;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,GACD;IACE,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAEL;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,YAAY,GACpB,cAAc,GACd;IACE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,CAAA;AAEL;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC/E;;;;GAIG;GACD,QAAQ,GASR,OAAO,CAAC,cAAc,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GACpD,gBAAgB,GAChB,SAAS,CAAA;AAeb,qBAAa,KAAK;IACJ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,SAAS;IAE5C,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;OAKG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAkDrE;;;;;;;;;;;OAWG;YACW,SAAS;IAevB;;;;;;;OAOG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IA0BtC;;;;;;;;;;;;OAYG;IACG,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAQjG;;;;;;;OAOG;YACW,aAAa;IAsB3B;;;;;;;OAOG;IACG,sBAAsB,CAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAI3E;;;;;;;;;OASG;IACG,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAM/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC;YAyEnB,QAAQ;IAgBtB;;;;;;OAMG;IACH,OAAO,KAAK,eAAe,GAG1B;IAED;;;;;;;;OAQG;YACW,IAAI;YAuBJ,YAAY;YAaZ,SAAS;YAYT,MAAM;IAgBpB;;;;;;;;OAQG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IA+FjE,sDAAsD;IAChD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB7C;;;;;;;;;;;OAWG;YACW,YAAY;IAe1B;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,KAAK;CAiFpB"}

package/dist/login.js

@@ -1,5 +1,5 @@
 import { createHash, createPublicKey, randomBytes, timingSafeEqual } from 'node:crypto';
-import { hashPassword, needsRehash, spendVerificationTime, verifyPassword, whileAuthenticating, withOrg, } from '@nacre.work/core';
+import { admitSignIn, hashPassword, needsRehash, spendVerificationTime, verifyPassword, whileAuthenticating, withOrg, } from '@nacre.work/core';
 import { jwtVerify, SignJWT } from 'jose';
 /**
  * Email and password sign-in.
@@ -40,6 +40,16 @@ import { jwtVerify, SignJWT } from 'jose';
 const ACCESS_MIN_SECONDS = 60;
 /** Long enough to read a phone, short enough not to survive walking away. */
 const CHALLENGE_SECONDS = 300;
+/**
+ * The enrolment challenge's lifetime, and deliberately longer than the one
+ * above.
+ *
+ * That one is "read six digits off a screen you are already holding". This one
+ * is "install an authenticator, scan a code, and write down ten recovery codes"
+ * — or find a security key in a drawer. Five minutes is a person being told to
+ * start over halfway through the one flow they were sent to complete.
+ */
+const ENROL_SECONDS = 900;
 /**
  * The challenge's audience, which is deliberately not the API's.
  *
@@ -99,9 +109,13 @@ export class Login {
          * for this.
          */
         if (this.deps.secondFactors !== undefined && (await this.deps.secondFactors.required(candidate.org_id, candidate.id))) {
-            return { kind: 'second-factor', challenge: await this.challenge(candidate), expiresIn: CHALLENGE_SECONDS };
+            return {
+                kind: 'second-factor',
+                challenge: await this.challenge(candidate, 'second-factor', CHALLENGE_SECONDS),
+                expiresIn: CHALLENGE_SECONDS,
+            };
         }
-        return { kind: 'tokens', tokens: await this.issue(candidate, undefined) };
+        return this.issue(candidate, undefined, 'password');
     }
     /**
      * The token that says "this password was correct", and nothing else.
@@ -115,9 +129,9 @@ export class Login {
      * well, the code is single-use through `last_step`, and a person holding both
      * has finished signing in anyway.
      */
-    async challenge(user) {
+    async challenge(user, purpose, seconds) {
         const now = this.clock;
-        return new SignJWT({ org: user.org_id, purpose: 'second-factor' })
+        return new SignJWT({ org: user.org_id, purpose })
             .setProtectedHeader({
             alg: this.deps.algorithm ?? 'HS256',
             ...(this.deps.keyId === undefined ? {} : { kid: this.deps.keyId }),
@@ -126,7 +140,7 @@ export class Login {
             .setIssuer(this.deps.issuer)
             .setAudience(challengeAudience(this.deps.audience))
             .setIssuedAt(Math.floor(now.getTime() / 1000))
-            .setExpirationTime(Math.floor(now.getTime() / 1000) + CHALLENGE_SECONDS)
+            .setExpirationTime(Math.floor(now.getTime() / 1000) + seconds)
             .sign(this.deps.key);
     }
     /**
@@ -137,12 +151,61 @@ export class Login {
      * all of them into one refusal. Which of the four it was is not something a
      * client needs and is something an attacker would use.
      */
-    async completeSecondFactor(challenge, code) {
+    async completeSecondFactor(challenge, proof) {
+        const gate = this.deps.secondFactors;
+        if (gate === undefined)
+            return undefined;
+        const who = await this.readChallenge(challenge, 'second-factor');
+        if (who === undefined)
+            return undefined;
+        const { orgId, userId } = who;
+        const proved = proof.kind === 'code'
+            ? await gate.verify(orgId, userId, proof.code)
+            : await gate.verifyWebAuthnAssertion(orgId, userId, proof.response);
+        if (!proved)
+            return undefined;
+        // Re-read the row rather than trusting the challenge for anything but
+        // identity: five minutes is long enough to be disabled, and the role in the
+        // token has to be the one the database holds now.
+        const user = await this.userById(orgId, userId);
+        if (user === undefined || user.disabled_at !== null)
+            return undefined;
+        // The kind that was proved goes to the gates, because "a second factor" and
+        // "a factor whose signature covers the origin" are not the same claim and a
+        // policy may want the second.
+        return this.issue(user, undefined, 'second-factor', undefined, proof.kind === 'code' ? 'totp' : 'webauthn');
+    }
+    /**
+     * The options a browser needs for the assertion half of a sign-in.
+     *
+     * It takes the same challenge `login` handed back, and that is the whole
+     * reason this method is here rather than on the store: the JWT is what says
+     * who is signing in, and it is signed by a key the store does not have. An
+     * endpoint that took a user id instead would answer "which authenticators
+     * does this person hold" to anybody who asked.
+     *
+     * `undefined` where the challenge is not one of ours, where it has expired,
+     * and where the person has no key enrolled — one refusal, for the reason
+     * every refusal on this path is one.
+     */
+    async beginSecondFactorWebAuthn(challenge) {
         const gate = this.deps.secondFactors;
         if (gate === undefined)
             return undefined;
-        let userId;
-        let orgId;
+        const who = await this.readChallenge(challenge, 'second-factor');
+        if (who === undefined)
+            return undefined;
+        return gate.beginWebAuthnAssertion(who.orgId, who.userId);
+    }
+    /**
+     * Who a sign-in challenge names, or nothing.
+     *
+     * One reader for the two halves that consult it, because a challenge whose
+     * audience is checked on one path and not the other is an access token
+     * accepted as a challenge — which is exactly what `challengeAudience` exists
+     * to stop.
+     */
+    async readChallenge(challenge, purpose) {
         try {
             const { payload } = await jwtVerify(challenge, this.verificationKey, {
                 issuer: this.deps.issuer,
@@ -150,24 +213,43 @@ export class Login {
                 algorithms: [this.deps.algorithm ?? 'HS256'],
                 currentDate: this.clock,
             });
-            if (payload.purpose !== 'second-factor' || typeof payload.sub !== 'string' || typeof payload.org !== 'string') {
+            // The purpose is a required argument rather than a default, so a second
+            // reader written later has to say which kind of challenge it takes.
+            if (payload.purpose !== purpose || typeof payload.sub !== 'string' || typeof payload.org !== 'string') {
                 return undefined;
             }
-            userId = payload.sub;
-            orgId = payload.org;
+            return { orgId: payload.org, userId: payload.sub };
         }
         catch {
             return undefined;
         }
-        if (!(await gate.verify(orgId, userId, code)))
-            return undefined;
-        // Re-read the row rather than trusting the challenge for anything but
-        // identity: five minutes is long enough to be disabled, and the role in the
-        // token has to be the one the database holds now.
+    }
+    /**
+     * Read an enrolment challenge, for the routes that accept one.
+     *
+     * Public because the enrolment surface is in `server.ts` and this is the only
+     * thing that may turn that token into a person. It answers the org and the
+     * user and nothing else — no role, no permissions — because the only thing
+     * such a token is allowed to do is add a factor to the account it names.
+     */
+    async readEnrolmentChallenge(challenge) {
+        return this.readChallenge(challenge, 'enrol');
+    }
+    /**
+     * A confirmed factor turns an enrolment challenge into a session.
+     *
+     * Called by the enrolment route once a factor is confirmed, so the person who
+     * was sent to enrol is not then asked to sign in again — which is the moment
+     * they would give up. It re-reads the account and runs the gates again rather
+     * than trusting that enrolling was enough: a gate that wanted a *particular*
+     * kind is entitled to refuse the one that was just added, and assuming
+     * otherwise would be this file deciding what a policy means.
+     */
+    async sessionAfterEnrolment(orgId, userId) {
         const user = await this.userById(orgId, userId);
         if (user === undefined || user.disabled_at !== null)
             return undefined;
-        return this.issue(user, undefined);
+        return this.issue(user, undefined, 'second-factor');
     }
     /**
      * A person changes their own password, having proved the current one.
@@ -205,7 +287,7 @@ export class Login {
      */
     async changePassword(orgId, userId, current, next) {
         const row = await withOrg(this.deps.pool, orgId, async (client) => {
-            const { rows } = await client.query(`SELECT id, org_id, role, email, password_hash, disabled_at
+            const { rows } = await client.query(`SELECT id, org_id, role, email, password_hash, disabled_at, shared
              FROM users WHERE org_id = $1 AND id = $2`, [orgId, userId]);
             return rows[0];
         }, this.scope);
@@ -215,6 +297,22 @@ export class Login {
         // branch anybody sees.
         if (row === undefined || row.disabled_at !== null || row.password_hash === null)
             return 'no-user';
+        /*
+         * A credential more than one person holds is not one of them may change.
+         *
+         * Refused **before** the current password is verified, which is the one
+         * ordering decision here: checking it first would make this endpoint say
+         * whether the published password is still current, and the whole point is
+         * that the password is public. It costs nothing either, since a shared
+         * account can never pass.
+         *
+         * Here as well as at the route, and that is not a second copy of one check.
+         * The route is what answers `404` to a caller; this is what holds when a
+         * second route is written — the same argument the trigger on
+         * `user_second_factors` makes for the other half of this surface.
+         */
+        if (row.shared)
+            return 'shared';
         // Outside the transaction on purpose: scrypt at OWASP's minimum takes long
         // enough that holding a row lock across it is a lock held on arithmetic.
         if (!(await verifyPassword(current, row.password_hash)))
@@ -229,9 +327,15 @@ export class Login {
             // A new family. Carrying the old one would put the session that
             // replaces every other one in the same chain as the tokens just
             // revoked.
-            return this.issue(row, undefined, client);
+            return this.issue(row, undefined, 'password-change', client);
         }, this.scope);
-        return { kind: 'changed', tokens, email: row.email };
+        // A gate may interrupt a password change as readily as a sign-in, and the
+        // outcome is carried out rather than flattened: a person who has just
+        // proved their current password and is being told to enrol needs the
+        // challenge, not a failure with no next step.
+        if (tokens.kind !== 'tokens')
+            return tokens;
+        return { kind: 'changed', tokens: tokens.tokens, email: row.email };
     }
     async userById(orgId, userId) {
         return withOrg(this.deps.pool, orgId, async (client) => {
@@ -366,7 +470,7 @@ export class Login {
             const user = rows[0];
             if (user === undefined || user.disabled_at !== null)
                 return 'gone';
-            return this.issue(user, row.family_id, client);
+            return this.issue(user, row.family_id, 'refresh', client);
         }, this.scope);
         if (outcome === 'lost') {
             // Someone already spent this one. Two parties hold the same token and
@@ -419,7 +523,52 @@ export class Login {
      * revoked together; a fresh login starts a new one, so signing out of one
      * device does not sign out of the others.
      */
-    async issue(user, family, client) {
+    /**
+     * Mint a session, unless a gate says this authentication is not enough.
+     *
+     * **The gates are consulted here rather than beside each caller, and that is
+     * the whole of why this returns a union.** There are four paths from a
+     * verified credential to a session — a password with no factor asked for, a
+     * completed second factor, a spent refresh token, and a password change — and
+     * a check placed beside them is a check the fifth one forgets. That is this
+     * repository's most repeated defect, so the gate goes at the single point all
+     * four already reach, and every caller becomes a compile error until it says
+     * what it does with a refusal.
+     *
+     * A **refresh** is gated too, deliberately. A policy turned on while people
+     * are signed in would otherwise do nothing for any of them for as long as
+     * they kept renewing — authority renewed without the person present is the
+     * same case a delegation's `disabled` check exists for.
+     *
+     * `path` is what the caller is doing, passed rather than inferred: a gate
+     * that wants to demand a factor on sign-in and not interrupt a password
+     * change can only tell those apart if it is told.
+     */
+    async issue(user, family, path, client, proved) {
+        const refusal = await admitSignIn({
+            orgId: user.org_id,
+            userId: user.id,
+            role: user.role,
+            path,
+            secondFactor: proved,
+            // Asked rather than assumed. `required` answers whether the account holds
+            // a confirmed factor, which is a different question from whether one was
+            // proved on this request — a refresh proves none and the account may
+            // still have one.
+            enrolled: this.deps.secondFactors === undefined
+                ? false
+                : await this.deps.secondFactors.required(user.org_id, user.id),
+        });
+        if (refusal !== undefined) {
+            if (refusal.kind === 'refuse')
+                return { kind: 'refused', reason: refusal.reason };
+            return {
+                kind: 'enrol-second-factor',
+                challenge: await this.challenge(user, 'enrol', ENROL_SECONDS),
+                expiresIn: ENROL_SECONDS,
+                reason: refusal.reason,
+            };
+        }
         const ttl = Math.max(ACCESS_MIN_SECONDS, this.deps.accessTokenTtl);
         const now = this.clock;
         const accessToken = await new SignJWT({
@@ -453,7 +602,10 @@ export class Login {
             await insert(client);
         else
             await withOrg(this.deps.pool, user.org_id, insert, this.scope);
-        return { accessToken, refreshToken, expiresIn: ttl, orgId: user.org_id, userId: user.id };
+        return {
+            kind: 'tokens',
+            tokens: { accessToken, refreshToken, expiresIn: ttl, orgId: user.org_id, userId: user.id },
+        };
     }
 }
 //# sourceMappingURL=login.js.map

package/dist/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,OAAO,GACR,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAGzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAE7B,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAE7B;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,GAAG,QAAQ,gBAAgB,CAAA;AA2GnF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE1F,wEAAwE;AACxE,MAAM,IAAI,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEhE,MAAM,OAAO,KAAK;IACa;IAA7B,YAA6B,IAAe;QAAf,SAAI,GAAJ,IAAI,CAAW;IAAG,CAAC;IAEhD,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACrE,CAAC;IAED,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAA;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAChD,IAAI,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,0EAA0E;YAC1E,oCAAoC;YACpC,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAClG,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAExF,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,WAAW,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACrD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,SAAS,CAAC,MAAM,EAChB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAC7F,IAAI,CAAC,KAAK,CACX,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC1B,CAAC;QAED;;;;;;;;WAQG;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACtH,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAA;QAC5G,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAA;IAC3E,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,SAAS,CAAC,IAAa;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAA;QACtB,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;aAC/D,kBAAkB,CAAC;YAClB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO;YACnC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;SACnE,CAAC;aACD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aAClD,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;aAC7C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,iBAAiB,CAAC;aACvE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CAAC,SAAiB,EAAE,IAAY;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAExC,IAAI,MAAc,CAAA;QAClB,IAAI,KAAa,CAAA;QACjB,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE;gBACnE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;gBACxB,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC/C,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;gBAC5C,WAAW,EAAE,IAAI,CAAC,KAAK;aACxB,CAAC,CAAA;YACF,IAAI,OAAO,CAAC,OAAO,KAAK,eAAe,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC9G,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,GAAG,OAAO,CAAC,GAAG,CAAA;YACpB,KAAK,GAAG,OAAO,CAAC,GAAG,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAE/D,sEAAsE;QACtE,4EAA4E;QAC5E,kDAAkD;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAErE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACpC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,MAAc,EACd,OAAe,EACf,IAAY;QAEZ,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,4EAA4E;QAC5E,wEAAwE;QACxE,uEAAuE;QACvE,uBAAuB;QACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAEjG,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,gBAAgB,CAAA;QAChF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QAErC,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAChB,mEAAmE,EACnE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CACtB,CAAA;YACD,kEAAkE;YAClE,sEAAsE;YACtE,MAAM,MAAM,CAAC,KAAK,CAChB;sEAC4D,EAC5D,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,gEAAgE;YAChE,gEAAgE;YAChE,WAAW;YACX,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QAC3C,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;IACtD,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,IAAY,eAAe;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,UAAU;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QAC7D,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,YAAgC;QAChE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;YACxE,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACrC,MAAM,KAAK,GAAc,EAAE,CAAA;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YAC3C,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtC,wEAAwE;YACxE,uEAAuE;YACvE,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;QACxC,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAY;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,qEAAqE,EACrE,CAAC,IAAI,CAAC,CACP,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,uDAAuD,CACxD,CAAA;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC9B,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAa;QAC/C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;yDAC+C,EAC/C,CAAC,KAAK,EAAE,KAAK,CAAC,CACf,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAUjC;uDAC6C,EAC7C,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAEvC,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAClD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAE/F,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAE7C,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAAE,OAAO,SAAS,CAAA;QAEtE,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,8DAA8D;QAC9D,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,4CAA4C;QAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,MAAM,EAAqC,EAAE;YAClD,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;YAEjF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;yBAEe,EACf,CAAC,GAAG,CAAC,EAAE,CAAC,CACT,CAAA;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAA;YAEhD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAC1B,CAAA;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACpB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAA;YAElE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAChD,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,qEAAqE;YACrE,yEAAyE;YACzE,+CAA+C;YAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,2FAA2F,EAC3F,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACnC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACxD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC5E,MAAM,MAAM,CAAC,KAAK,CAChB,0FAA0F,EAC1F,CAAC,QAAQ,CAAC,CACX,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,KAAK,CACjB,IAAa,EACb,MAA0B,EAC1B,MAAmB;QAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAA;QAEtB,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC;YACpC,uEAAuE;YACvE,8BAA8B;YAC9B,GAAG,EAAE,IAAI,CAAC,MAAM;YAChB,cAAc,EAAE,MAAM;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;aACC,kBAAkB,CAAC;YAClB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO;YACnC,qEAAqE;YACrE,4CAA4C;YAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;SACnE,CAAC;aACD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC/B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;aAC7C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;aACzD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEtB,MAAM,YAAY,GAAG,IAAI,EAAE,CAAA;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;QAE5E,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAoB,EAAE,CACtD,MAAM,CAAC,KAAK,CACV;wEACgE,EAChE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,CAAC,CACxE,CAAA;QAEH,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;;YACzC,MAAM,OAAO,CAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,IAAI,CAAC,MAAM,EACX,MAAM,EACN,IAAI,CAAC,KAAK,CACX,CAAA;QAED,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;IAC3F,CAAC;CACF"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EACL,WAAW,EACX,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,OAAO,GACR,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAQzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAE7B,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAE7B;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,GAAG,QAAQ,gBAAgB,CAAA;AAsMnF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE1F,wEAAwE;AACxE,MAAM,IAAI,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEhE,MAAM,OAAO,KAAK;IACa;IAA7B,YAA6B,IAAe;QAAf,SAAI,GAAJ,IAAI,CAAW;IAAG,CAAC;IAEhD,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACrE,CAAC;IAED,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAA;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAChD,IAAI,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,0EAA0E;YAC1E,oCAAoC;YACpC,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAClG,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAExF,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,WAAW,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACrD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,SAAS,CAAC,MAAM,EAChB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAC7F,IAAI,CAAC,KAAK,CACX,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC1B,CAAC;QAED;;;;;;;;WAQG;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACtH,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,iBAAiB,CAAC;gBAC9E,SAAS,EAAE,iBAAiB;aAC7B,CAAA;QACH,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,SAAS,CAAC,IAAa,EAAE,OAAyB,EAAE,OAAe;QAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAA;QACtB,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;aAC9C,kBAAkB,CAAC;YAClB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO;YACnC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;SACnE,CAAC;aACD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aAClD,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;aAC7C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;aAC7D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CACxB,SAAiB,EACjB,KAAwB;QAExB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAExC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QAChE,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACvC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;QAE7B,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,MAAM;YACnB,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;YAC9C,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QACvE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAE7B,sEAAsE;QACtE,4EAA4E;QAC5E,kDAAkD;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAErE,4EAA4E;QAC5E,4EAA4E;QAC5E,8BAA8B;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IAC7G,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,yBAAyB,CAAC,SAAiB;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QAChE,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACvC,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3D,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,SAAiB,EACjB,OAAyB;QAEzB,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE;gBACnE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;gBACxB,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC/C,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;gBAC5C,WAAW,EAAE,IAAI,CAAC,KAAK;aACxB,CAAC,CAAA;YACF,wEAAwE;YACxE,oEAAoE;YACpE,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACtG,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,sBAAsB,CAC1B,SAAiB;QAEjB,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC/C,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,qBAAqB,CAAC,KAAa,EAAE,MAAc;QACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QACrE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,MAAc,EACd,OAAe,EACf,IAAY;QAEZ,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,4EAA4E;QAC5E,wEAAwE;QACxE,uEAAuE;QACvE,uBAAuB;QACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAEjG;;;;;;;;;;;;;WAaG;QACH,IAAI,GAAG,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAA;QAE/B,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,gBAAgB,CAAA;QAChF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QAErC,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAChB,mEAAmE,EACnE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CACtB,CAAA;YACD,kEAAkE;YAClE,sEAAsE;YACtE,MAAM,MAAM,CAAC,KAAK,CAChB;sEAC4D,EAC5D,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,gEAAgE;YAChE,gEAAgE;YAChE,WAAW;YACX,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAA;QAC9D,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,qEAAqE;QACrE,8CAA8C;QAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAA;QAC3C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;IACrE,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,IAAY,eAAe;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,UAAU;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QAC7D,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,YAAgC;QAChE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;YACxE,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACrC,MAAM,KAAK,GAAc,EAAE,CAAA;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YAC3C,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtC,wEAAwE;YACxE,uEAAuE;YACvE,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;QACxC,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAY;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,qEAAqE,EACrE,CAAC,IAAI,CAAC,CACP,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,uDAAuD,CACxD,CAAA;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC9B,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAa;QAC/C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;yDAC+C,EAC/C,CAAC,KAAK,EAAE,KAAK,CAAC,CACf,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAUjC;uDAC6C,EAC7C,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAEvC,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAClD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAE/F,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAE7C,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAAE,OAAO,SAAS,CAAA;QAEtE,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,8DAA8D;QAC9D,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,4CAA4C;QAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,MAAM,EAA6C,EAAE;YAC1D,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;YAEjF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;yBAEe,EACf,CAAC,GAAG,CAAC,EAAE,CAAC,CACT,CAAA;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAA;YAEhD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAC1B,CAAA;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACpB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAA;YAElE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QAC3D,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,qEAAqE;YACrE,yEAAyE;YACzE,+CAA+C;YAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,2FAA2F,EAC3F,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACnC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACxD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC5E,MAAM,MAAM,CAAC,KAAK,CAChB,0FAA0F,EAC1F,CAAC,QAAQ,CAAC,CACX,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,KAAK,CACjB,IAAa,EACb,MAA0B,EAC1B,IAA2B,EAC3B,MAAmB,EACnB,MAA4B;QAE5B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,IAAI,CAAC,IAA6B;YACxC,IAAI;YACJ,YAAY,EAAE,MAAM;YACpB,0EAA0E;YAC1E,yEAAyE;YACzE,qEAAqE;YACrE,kBAAkB;YAClB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;gBAC7C,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;SACjE,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;YACjF,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,SAAS,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC7D,SAAS,EAAE,aAAa;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAA;QAEtB,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC;YACpC,uEAAuE;YACvE,8BAA8B;YAC9B,GAAG,EAAE,IAAI,CAAC,MAAM;YAChB,cAAc,EAAE,MAAM;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;aACC,kBAAkB,CAAC;YAClB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO;YACnC,qEAAqE;YACrE,4CAA4C;YAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;SACnE,CAAC;aACD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC/B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;aAC7C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;aACzD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEtB,MAAM,YAAY,GAAG,IAAI,EAAE,CAAA;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;QAE5E,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAoB,EAAE,CACtD,MAAM,CAAC,KAAK,CACV;wEACgE,EAChE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,CAAC,CACxE,CAAA;QAEH,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;;YACzC,MAAM,OAAO,CAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,IAAI,CAAC,MAAM,EACX,MAAM,EACN,IAAI,CAAC,KAAK,CACX,CAAA;QAED,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;SAC3F,CAAA;IACH,CAAC;CACF"}

package/dist/main.js

@@ -95,24 +95,50 @@ async function main() {
         },
     });
     /*
-     * The second factor, when a key was configured.
+     * The second factor, and the two kinds are configured differently.
      *
-     * `undefined` otherwise, and that is a supported deployment: the surface
-     * answers 404 and sign-in issues tokens exactly as it always did. There is no
-     * mode where a secret is stored unsealed.
+     * TOTP needs `NACRE_2FA_KEY` — its secret is shared, so it has to be kept and
+     * therefore sealed, and there is no mode where one is stored unsealed.
+     * WebAuthn needs no key at all: what is stored is a public key and a counter,
+     * and a dump of those produces no assertion. So this is constructed on every
+     * deployment, and `SecondFactors.kinds` is what decides which of the two a
+     * screen may offer.
+     *
+     * The relying party comes from `NACRE_CANONICAL_URL`, which every deployment
+     * already sets, rather than from a variable of its own. A `NACRE_WEBAUTHN_*`
+     * would be a second answer to "what is this installation's address", and a
+     * second answer to that is how a deployment ends up with credentials bound to
+     * a name it no longer serves.
      */
     const secondFactorKey = loadSecondFactorKey();
-    const secondFactors = secondFactorKey === undefined
-        ? undefined
-        : new SecondFactors({
-            pool,
-            key: secondFactorKey,
-            // What an authenticator prints above the account. The issuer of the
-            // tokens is what this installation already calls itself, so a person
-            // with two Nacre deployments sees two distinguishable entries.
-            issuer: config.jwtIssuer,
-            role: APP_ROLE,
-        });
+    const canonical = new URL(config.canonicalUrl);
+    const secondFactors = new SecondFactors({
+        pool,
+        key: secondFactorKey,
+        // What an authenticator prints above the account. The issuer of the
+        // tokens is what this installation already calls itself, so a person
+        // with two Nacre deployments sees two distinguishable entries.
+        issuer: config.jwtIssuer,
+        relyingParty: {
+            // The **host** and never the origin: a relying party id is a registrable
+            // domain, so a scheme or a port in it is a credential no authenticator
+            // will make.
+            id: canonical.hostname,
+            name: canonical.hostname,
+            /*
+             * Where a page may run the ceremony from. The canonical origin, plus the
+             * browser origins this API already admits — the console is served from
+             * the API's own origin unless a deployment has said otherwise, and if it
+             * has, it has said so in `NACRE_API_ALLOWED_ORIGINS`.
+             *
+             * Compared for equality by the verifier. A suffix match would admit
+             * `evil-nacre.work`, which is the hole a phishing-resistant factor exists
+             * to close.
+             */
+            origins: [canonical.origin, ...config.apiAllowedOrigins],
+        },
+        role: APP_ROLE,
+    });
     /*
      * The sender, when the deployment configured one.
      *