@nio-cli/cli 0.3.7 → 0.6.0

package/dist/gateway/services/login.js

@@ -2,12 +2,16 @@ import jwt from 'jsonwebtoken';
 import { createUserRepository } from '../../adapters/pg/user-repository.js';
 import { createAuthSessionRepository } from '../../adapters/pg/auth-session-repository.js';
 import { createLoginChallengeRepository } from '../../adapters/pg/login-challenge-repository.js';
-import { createHttpSmsSender } from '../../adapters/sms/http-generic.js';
+import { createWhatsAppSender, smsMode } from '../../adapters/sms/whatsapp.js';
 import { generateOtp, hashOtp, verifyOtp } from '../../lib/auth/otp.js';
 import { verifyBackupCode, markUsed, countRemaining } from '../../lib/auth/backup-codes.js';
-import { getJwtSecret, JWT_EXPIRES_IN } from '../config.js';
+import { JWT_EXPIRES_IN, JWT_ISSUER, JWT_AUDIENCE } from '../config.js';
+import { jwtSigningKey } from '../../lib/auth/secrets.js';
+import { smsAllowed } from '../throttle.js';
 export const OTP_TTL_MS = 5 * 60 * 1000;
 export const OTP_MAX_ATTEMPTS = 3;
+export const CHALLENGE_MAX_ATTEMPTS = OTP_MAX_ATTEMPTS * 2;
+export const MAX_SESSIONS_PER_USER = Math.max(1, Number(process.env.NIO_MAX_SESSIONS_PER_USER) || 5);
 export function expiresInMs(spec) {
     const m = /^(\d+)(s|m|h|d)$/.exec(spec.trim());
     if (!m) {
@@ -31,12 +35,29 @@ export function challengeUsable(ch) {
         return { ok: false, reason: 'expired' };
     return { ok: true, ch };
 }
+async function pruneExcessSessions(sessions, userId) {
+    try {
+        const active = await sessions.listActiveByUser(userId);
+        await Promise.all(active.slice(MAX_SESSIONS_PER_USER).map((s) => sessions.revoke(s.id)));
+    }
+    catch {
+    }
+}
 export async function issueSession(user) {
     await createUserRepository().touchLastSession(user.id);
     const ms = expiresInMs(JWT_EXPIRES_IN);
     const expiresAt = new Date(Date.now() + ms);
-    const session = await createAuthSessionRepository().create({ userId: user.id, expiresAt });
-    const token = jwt.sign({ sub: String(user.id), jti: session.id }, getJwtSecret(), { algorithm: 'HS256', expiresIn: Math.floor(ms / 1000) });
+    const sessions = createAuthSessionRepository();
+    const session = await sessions.create({ userId: user.id, expiresAt });
+    await pruneExcessSessions(sessions, user.id);
+    const { kid, secret } = jwtSigningKey();
+    const token = jwt.sign({ sub: String(user.id), jti: session.id }, secret, {
+        algorithm: 'HS256',
+        expiresIn: Math.floor(ms / 1000),
+        issuer: JWT_ISSUER,
+        audience: JWT_AUDIENCE,
+        ...(kid ? { keyid: kid } : {}),
+    });
     return { token, userId: user.id, name: user.name, sessionId: session.id, expiresAt };
 }
 export async function login(name, password, deps = {}) {
@@ -47,30 +68,36 @@ export async function login(name, password, deps = {}) {
     if (!user.auth2 || !user.phone) {
         return { ok: true, step: 'done', session: await issueSession(user) };
     }
+    if (!smsAllowed(user.id, user.phone)) {
+        return { ok: false, reason: 'server_error', error: 'muitos códigos solicitados — aguarde alguns minutos.' };
+    }
     const challenges = deps.challenges ?? createLoginChallengeRepository();
-    const sms = deps.sms ?? createHttpSmsSender();
+    const sms = deps.sms ?? createWhatsAppSender();
     const code = generateOtp();
     const challenge = await challenges.create({
         userId: user.id,
         purpose: 'login',
         codeHash: hashOtp(code),
-        channel: 'sms',
+        channel: 'whatsapp',
         expiresAt: new Date(Date.now() + OTP_TTL_MS),
     });
-    const sent = await sms.send(user.phone, `NIO: seu código de confirmação é ${code} (expira em 5 min).`);
+    const sent = await sms.sendOtp(user.phone, code);
     if (sent.status === 'skipped') {
         await challenges.consume(challenge.id).catch(() => { });
-        return { ok: false, reason: 'server_error', error: '2FA não configurado no servidor (SMS_*).' };
+        return { ok: false, reason: 'server_error', error: '2FA não configurado no servidor (WHATSAPP_*).' };
     }
     if (sent.status === 'failed') {
         await challenges.consume(challenge.id).catch(() => { });
-        return { ok: false, reason: 'server_error', error: `falha ao enviar o SMS: ${sent.error ?? ''}`.trim() };
+        return { ok: false, reason: 'server_error', error: `falha ao enviar o WhatsApp: ${sent.error ?? ''}`.trim() };
     }
+    const mode = smsMode();
     return {
         ok: true,
         step: '2fa_required',
         challengeId: challenge.id,
         phoneHint: maskPhone(user.phone),
+        smsMode: mode,
+        ...(mode === 'echo' ? { devCode: code } : {}),
     };
 }
 export async function verifyLogin(challengeId, code, type, deps = {}) {
@@ -82,18 +109,23 @@ export async function verifyLogin(challengeId, code, type, deps = {}) {
     const ch = usable.ch;
     const user = await users.findById(ch.userId);
     if (!user)
-        return { ok: false, reason: 'not_found' };
+        return { ok: false, reason: 'not_found', userId: ch.userId };
     if (type === 'backup') {
         const stored = await users.getBackupCodes(ch.userId);
-        const idx = await verifyBackupCode(code, stored);
-        if (idx < 0)
-            return { ok: false, reason: 'invalid' };
-        await users.updateBackupCodes(ch.userId, markUsed(stored, idx));
+        const idx = await verifyBackupCode(code, stored.codes, stored.pepperId);
+        if (idx < 0) {
+            const attempts = await challenges.incrementAttempts(ch.id);
+            if (attempts >= CHALLENGE_MAX_ATTEMPTS)
+                return { ok: false, reason: 'attempts_exhausted', userId: ch.userId };
+            return { ok: false, reason: 'invalid', remaining: CHALLENGE_MAX_ATTEMPTS - attempts, userId: ch.userId };
+        }
+        const used = markUsed(stored.codes, idx);
+        await users.updateBackupCodes(ch.userId, used, stored.pepperId);
         await challenges.consume(ch.id);
         return {
             ok: true,
             session: await issueSession(user),
-            backupCodesRemaining: countRemaining(markUsed(stored, idx)),
+            backupCodesRemaining: countRemaining(used),
         };
     }
     if (verifyOtp(code, ch.codeHash)) {
@@ -102,11 +134,14 @@ export async function verifyLogin(challengeId, code, type, deps = {}) {
     }
     const attempts = await challenges.incrementAttempts(ch.id);
     if (attempts >= OTP_MAX_ATTEMPTS) {
-        return { ok: false, reason: 'attempts_exhausted', requiresBackupCode: true };
+        return { ok: false, reason: 'attempts_exhausted', requiresBackupCode: true, userId: ch.userId };
     }
-    return { ok: false, reason: 'invalid', remaining: OTP_MAX_ATTEMPTS - attempts };
+    return { ok: false, reason: 'invalid', remaining: OTP_MAX_ATTEMPTS - attempts, userId: ch.userId };
 }
 export async function logout(sessionId) {
     await createAuthSessionRepository().revoke(sessionId);
 }
+export async function logoutAll(userId) {
+    await createAuthSessionRepository().revokeAllByUser(userId);
+}
 //# sourceMappingURL=login.js.map

package/dist/gateway/services/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/gateway/services/login.ts"],"names":[],"mappings":"AAKA,OAAO,GAAG,MAAM,cAAc,CAAC;AAI/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAW5D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAwBlC,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,4CAA4C,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAA0B,CAAC,CAAC;IACjG,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;AAC7B,CAAC;AAGD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAGD,MAAM,UAAU,eAAe,CAC7B,EAAyB;IAEzB,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACnD,IAAI,EAAE,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC5D,IAAI,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC1B,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAa;IAC9C,MAAM,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,2BAA2B,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAG3F,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CACpB,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EACzC,YAAY,EAAE,EACd,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CACzD,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;AACvF,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,IAAY,EACZ,QAAgB,EAChB,OAAkB,EAAE;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE3D,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,8BAA8B,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;QACxC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC;QACvB,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;KAC7C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,oCAAoC,IAAI,qBAAqB,CAAC,CAAC;IACvG,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,0BAA0B,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;IAC3G,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,SAAS,CAAC,EAAE;QACzB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;KACjC,CAAC;AACJ,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,WAAmB,EACnB,IAAY,EACZ,IAAsB,EACtB,OAAkB,EAAE;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,8BAA8B,EAAE,CAAC;IAEvE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5D,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IAErB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAErD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACrD,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC;YACjC,oBAAoB,EAAE,cAAc,CAAC,QAAQ,CAAC,MAAO,EAAE,GAAG,CAAC,CAAC;SAC7D,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3D,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,GAAG,QAAQ,EAAE,CAAC;AAClF,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,SAAiB;IAC5C,MAAM,2BAA2B,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/gateway/services/login.ts"],"names":[],"mappings":"AAKA,OAAO,GAAG,MAAM,cAAc,CAAC;AAQ/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAgB,MAAM,gCAAgC,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAW5C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAMlC,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,CAAC,CAAC;AAO3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAC3C,CAAC,EACD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,CAAC,CACnD,CAAC;AAmCF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,4CAA4C,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAA0B,CAAC,CAAC;IACjG,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;AAC7B,CAAC;AAGD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAGD,MAAM,UAAU,eAAe,CAC7B,EAAyB;IAEzB,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACnD,IAAI,EAAE,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC5D,IAAI,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC1B,CAAC;AAOD,KAAK,UAAU,mBAAmB,CAAC,QAA+B,EAAE,MAAc;IAChF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;AACH,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAa;IAC9C,MAAM,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAG7C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CACpB,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EACzC,MAAM,EACN;QACE,SAAS,EAAE,OAAO;QAClB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC;QAChC,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,YAAY;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/B,CACF,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;AACvF,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,IAAY,EACZ,QAAgB,EAChB,OAAkB,EAAE;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE3D,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACvE,CAAC;IAID,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;IAC9G,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,8BAA8B,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;QACxC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC;QACvB,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;KAC7C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,+BAA+B,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;IAChH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,SAAS,CAAC,EAAE;QACzB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAChC,OAAO,EAAE,IAAI;QACb,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,WAAmB,EACnB,IAAY,EACZ,IAAsB,EACtB,OAAkB,EAAE;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,8BAA8B,EAAE,CAAC;IAEvE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5D,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IAErB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;IAExE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxE,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YAGZ,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3D,IAAI,QAAQ,IAAI,sBAAsB;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;YAC9G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,sBAAsB,GAAG,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3G,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAM,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC;YACjC,oBAAoB,EAAE,cAAc,CAAC,IAAI,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3D,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,GAAG,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;AACrG,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,SAAiB;IAC5C,MAAM,2BAA2B,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc;IAC5C,MAAM,2BAA2B,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC"}

package/dist/gateway/services/register.js

@@ -0,0 +1,20 @@
+import { createUserRepository } from '../../adapters/pg/user-repository.js';
+import { hashPassword, MIN_PASSWORD_LENGTH } from '../../lib/auth/password.js';
+import { checkPasswordBreach } from '../../lib/auth/breach-check.js';
+export async function register(name, password, deps = {}) {
+    const users = deps.users ?? createUserRepository();
+    const clean = name.trim();
+    if (!clean || clean.length > 64)
+        return { ok: false, reason: 'invalid_name' };
+    if (password.length < MIN_PASSWORD_LENGTH)
+        return { ok: false, reason: 'weak_password' };
+    if ((await checkPasswordBreach(password)).breached)
+        return { ok: false, reason: 'breached_password' };
+    if (await users.findByName(clean)) {
+        await hashPassword(password).catch(() => { });
+        return { ok: false, reason: 'name_taken' };
+    }
+    const user = await users.create({ name: clean, password });
+    return { ok: true, userId: user.id, name: user.name };
+}
+//# sourceMappingURL=register.js.map

package/dist/gateway/services/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../src/gateway/services/register.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAMrE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,QAAgB,EAChB,OAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC9E,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAGzF,IAAI,CAAC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACtG,IAAI,MAAM,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAIlC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC"}

package/dist/gateway/services/security.js

@@ -1,35 +1,73 @@
 import { createUserRepository } from '../../adapters/pg/user-repository.js';
 import { createLoginChallengeRepository } from '../../adapters/pg/login-challenge-repository.js';
-import { createHttpSmsSender } from '../../adapters/sms/http-generic.js';
+import { createLoginIpRepository } from '../../adapters/pg/login-ip-repository.js';
+import { createAuthEventRepository } from '../../adapters/pg/auth-event-repository.js';
+import { createAuthSessionRepository } from '../../adapters/pg/auth-session-repository.js';
+import { createWhatsAppSender, smsMode, smsProviderHost } from '../../adapters/sms/whatsapp.js';
+import { hashPassword, MIN_PASSWORD_LENGTH } from '../../lib/auth/password.js';
+import { checkPasswordBreach } from '../../lib/auth/breach-check.js';
 import { generateOtp, hashOtp, verifyOtp } from '../../lib/auth/otp.js';
 import { generateBackupCodes, verifyBackupCode, markUsed, countRemaining, } from '../../lib/auth/backup-codes.js';
 import { challengeUsable, maskPhone, OTP_TTL_MS, OTP_MAX_ATTEMPTS } from './login.js';
+import { smsAllowed } from '../throttle.js';
+import { currentPepperId } from '../../lib/auth/secrets.js';
+export async function changePassword(userId, currentPassword, newPassword, deps = {}) {
+    if (newPassword.length < MIN_PASSWORD_LENGTH) {
+        return { ok: false, error: `senha nova muito curta (mínimo ${MIN_PASSWORD_LENGTH} caracteres)` };
+    }
+    if (newPassword === currentPassword) {
+        return { ok: false, error: 'a senha nova é igual à atual' };
+    }
+    if ((await checkPasswordBreach(newPassword)).breached) {
+        return { ok: false, error: 'senha nova apareceu em vazamento de dados conhecido — escolha outra' };
+    }
+    const users = deps.users ?? createUserRepository();
+    const user = await users.findById(userId);
+    if (!user)
+        return { ok: false, error: 'usuário não encontrado' };
+    if (!(await users.verifyCredentials(user.name, currentPassword))) {
+        return { ok: false, error: 'senha atual incorreta' };
+    }
+    const { phc, pepperId } = await hashPassword(newPassword);
+    await users.updatePasswordHash(userId, phc, pepperId);
+    await (deps.authSessions ?? createAuthSessionRepository()).revokeAllByUser(userId);
+    return { ok: true };
+}
 export function isE164(phone) {
     return /^\+\d{8,15}$/.test(phone.trim());
 }
 export async function startSecurityChallenge(userId, toPhone, deps = {}) {
     if (!isE164(toPhone))
         return { ok: false, error: 'número inválido (use E.164, ex.: +5511999998888)' };
+    if (!smsAllowed(userId, toPhone)) {
+        return { ok: false, error: 'muitos códigos solicitados — aguarde alguns minutos.' };
+    }
     const challenges = deps.challenges ?? createLoginChallengeRepository();
-    const sms = deps.sms ?? createHttpSmsSender();
+    const sms = deps.sms ?? createWhatsAppSender();
     const code = generateOtp();
     const challenge = await challenges.create({
         userId,
         purpose: 'enable_2fa',
         codeHash: hashOtp(code),
-        channel: 'sms',
+        channel: 'whatsapp',
         expiresAt: new Date(Date.now() + OTP_TTL_MS),
     });
-    const sent = await sms.send(toPhone, `NIO: seu código de confirmação é ${code} (expira em 5 min).`);
+    const sent = await sms.sendOtp(toPhone, code);
     if (sent.status === 'skipped') {
         await challenges.consume(challenge.id).catch(() => { });
-        return { ok: false, error: '2FA não configurado no servidor (SMS_*).' };
+        return { ok: false, error: '2FA não configurado no servidor (WHATSAPP_*).' };
     }
     if (sent.status === 'failed') {
         await challenges.consume(challenge.id).catch(() => { });
-        return { ok: false, error: `falha ao enviar o SMS: ${sent.error ?? ''}`.trim() };
+        return { ok: false, error: `falha ao enviar o WhatsApp: ${sent.error ?? ''}`.trim() };
     }
-    return { ok: true, challengeId: challenge.id };
+    const mode = smsMode();
+    return {
+        ok: true,
+        challengeId: challenge.id,
+        smsMode: mode,
+        ...(mode === 'echo' ? { devCode: code } : {}),
+    };
 }
 async function consumeSecurityCode(userId, challengeId, code, type, deps) {
     const challenges = deps.challenges ?? createLoginChallengeRepository();
@@ -43,10 +81,10 @@ async function consumeSecurityCode(userId, challengeId, code, type, deps) {
     }
     if (type === 'backup') {
         const stored = await users.getBackupCodes(userId);
-        const idx = await verifyBackupCode(code, stored);
+        const idx = await verifyBackupCode(code, stored.codes, stored.pepperId);
         if (idx < 0)
             return { ok: false, error: 'código de backup inválido' };
-        await users.updateBackupCodes(userId, markUsed(stored, idx));
+        await users.updateBackupCodes(userId, markUsed(stored.codes, idx), stored.pepperId);
     }
     else {
         if (!verifyOtp(code, ch.codeHash)) {
@@ -65,8 +103,8 @@ export async function confirmEnable2fa(userId, challengeId, code, phone, deps =
     if (!res.ok)
         return res;
     const users = deps.users ?? createUserRepository();
-    const { codes, hashes } = await generateBackupCodes();
-    await users.enable2fa(userId, phone.trim(), hashes);
+    const { codes, hashes, pepperId } = await generateBackupCodes();
+    await users.enable2fa(userId, phone.trim(), hashes, pepperId);
     return { ok: true, backupCodes: codes };
 }
 export async function disable2fa(userId, challengeId, code, type, deps = {}) {
@@ -81,19 +119,34 @@ export async function regenerateBackupCodes(userId, challengeId, code, type, dep
     if (!res.ok)
         return res;
     const users = deps.users ?? createUserRepository();
-    const { codes, hashes } = await generateBackupCodes();
-    await users.updateBackupCodes(userId, hashes);
+    const { codes, hashes, pepperId } = await generateBackupCodes();
+    await users.updateBackupCodes(userId, hashes, pepperId);
     return { ok: true, backupCodes: codes };
 }
 export async function status(userId, deps = {}) {
     const users = deps.users ?? createUserRepository();
+    const loginIps = deps.loginIps ?? createLoginIpRepository();
+    const authEvents = deps.authEvents ?? createAuthEventRepository();
+    const recentIps = (await loginIps.recent(userId, 10).catch(() => [])).map((e) => ({
+        ip: e.ip,
+        lastSeen: e.lastSeen.toISOString(),
+        count: e.count,
+    }));
+    const recentFailedAttempts = (await authEvents.recentFailures({ userId, limit: 5 }).catch(() => [])).map((f) => ({ at: f.at.toISOString(), event: f.event, ip: f.ip }));
+    const sms = { mode: smsMode(), host: smsProviderHost() };
     const user = await users.findById(userId);
-    if (!user || !user.auth2)
-        return { enabled: false, phoneHint: null, backupCodesRemaining: 0 };
+    if (!user || !user.auth2) {
+        return { enabled: false, phoneHint: null, backupCodesRemaining: 0, recentIps, recentFailedAttempts, sms };
+    }
+    const stored = await users.getBackupCodes(userId);
     return {
         enabled: true,
         phoneHint: user.phone ? maskPhone(user.phone) : null,
-        backupCodesRemaining: countRemaining(await users.getBackupCodes(userId)),
+        backupCodesRemaining: countRemaining(stored.codes),
+        regenerateBackupCodesRecommended: stored.codes != null && stored.pepperId !== currentPepperId() ? true : undefined,
+        recentIps,
+        recentFailedAttempts,
+        sms,
     };
 }
 //# sourceMappingURL=security.js.map

package/dist/gateway/services/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/gateway/services/security.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,8BAA8B,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,QAAQ,EACR,cAAc,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAStF,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAKD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,OAAe,EACf,OAAqB,EAAE;IAEvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;IACtG,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,8BAA8B,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;QACxC,MAAM;QACN,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC;QACvB,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,oCAAoC,IAAI,qBAAqB,CAAC,CAAC;IACpG,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;AACjD,CAAC;AAGD,KAAK,UAAU,mBAAmB,CAChC,MAAc,EACd,WAAmB,EACnB,IAAY,EACZ,IAAsB,EACtB,IAAkB;IAElB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,8BAA8B,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IACxE,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IACrB,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QACtE,MAAM,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,iBAAiB;aAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,WAAmB,EACnB,IAAY,EACZ,KAAa,EACb,OAAqB,EAAE;IAEvB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACtD,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,WAAmB,EACnB,IAAY,EACZ,IAAsB,EACtB,OAAqB,EAAE;IAEvB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,WAAmB,EACnB,IAAY,EACZ,IAAsB,EACtB,OAAqB,EAAE;IAEvB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACtD,MAAM,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,MAAc,EACd,OAAqB,EAAE;IAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC;IAC9F,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QACpD,oBAAoB,EAAE,cAAc,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/gateway/services/security.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,8BAA8B,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,eAAe,EAAgB,MAAM,gCAAgC,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,QAAQ,EACR,cAAc,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAgB5D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,eAAuB,EACvB,WAAmB,EACnB,OAAqB,EAAE;IAEvB,IAAI,WAAW,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,mBAAmB,cAAc,EAAE,CAAC;IACnG,CAAC;IACD,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qEAAqE,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IACjE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,2BAA2B,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACnF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAGD,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,OAAe,EACf,OAAqB,EAAE;IAEvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;IAGtG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,8BAA8B,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;QACxC,MAAM;QACN,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC;QACvB,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,OAAO;QACL,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,SAAS,CAAC,EAAE;QACzB,OAAO,EAAE,IAAI;QACb,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAGD,KAAK,UAAU,mBAAmB,CAChC,MAAc,EACd,WAAmB,EACnB,IAAY,EACZ,IAAsB,EACtB,IAAkB;IAElB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,8BAA8B,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IACxE,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IACrB,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxE,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QACtE,MAAM,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,iBAAiB;aAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,WAAmB,EACnB,IAAY,EACZ,KAAa,EACb,OAAqB,EAAE;IAEvB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAChE,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,WAAmB,EACnB,IAAY,EACZ,IAAsB,EACtB,OAAqB,EAAE;IAEvB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,WAAmB,EACnB,IAAY,EACZ,IAAsB,EACtB,OAAqB,EAAE;IAEvB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAChE,MAAM,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,OAAqB,EAAE;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,uBAAuB,EAAE,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,yBAAyB,EAAE,CAAC;IAElE,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE;QAClC,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,CAAC;IACJ,MAAM,oBAAoB,GAAG,CAC3B,MAAM,UAAU,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CACtE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAErE,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC;IAEzD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC;IAC5G,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QACpD,oBAAoB,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC;QAClD,gCAAgC,EAC9B,MAAM,CAAC,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAClF,SAAS;QACT,oBAAoB;QACpB,GAAG;KACJ,CAAC;AACJ,CAAC"}

package/dist/gateway/throttle.js

@@ -0,0 +1,57 @@
+const windows = new Map();
+export function hit(key, limit, windowMs, now = Date.now()) {
+    const w = windows.get(key);
+    if (!w || now >= w.resetAt) {
+        windows.set(key, { count: 1, resetAt: now + windowMs });
+        return { ok: true, retryAfterMs: 0 };
+    }
+    w.count++;
+    if (w.count <= limit)
+        return { ok: true, retryAfterMs: 0 };
+    return { ok: false, retryAfterMs: w.resetAt - now };
+}
+export const SMS_PER_USER = 3;
+export const SMS_USER_WINDOW_MS = 15 * 60 * 1000;
+export const SMS_PHONE_WINDOW_MS = 60 * 1000;
+export function smsAllowed(userId, phone, now = Date.now()) {
+    const perUser = hit(`sms:u:${userId}`, SMS_PER_USER, SMS_USER_WINDOW_MS, now);
+    const perPhone = hit(`sms:p:${phone}`, 1, SMS_PHONE_WINDOW_MS, now);
+    return perUser.ok && perPhone.ok;
+}
+const loginFails = new Map();
+const LOGIN_FAIL_TTL_MS = 60 * 60 * 1000;
+const LOGIN_MAX_DELAY_MS = 20_000;
+const LOGIN_FREE_ATTEMPTS = 4;
+export function loginDelayMs(key, now = Date.now()) {
+    const f = loginFails.get(key);
+    if (!f || now >= f.expiresAt || f.n <= LOGIN_FREE_ATTEMPTS)
+        return 0;
+    const step = f.n - LOGIN_FREE_ATTEMPTS;
+    return Math.min(2 ** (step - 1) * 500, LOGIN_MAX_DELAY_MS);
+}
+export function recordLoginFail(key, now = Date.now()) {
+    const f = loginFails.get(key);
+    if (f && now < f.expiresAt) {
+        f.n++;
+        f.expiresAt = now + LOGIN_FAIL_TTL_MS;
+    }
+    else {
+        loginFails.set(key, { n: 1, expiresAt: now + LOGIN_FAIL_TTL_MS });
+    }
+}
+export function recordLoginOk(key) {
+    loginFails.delete(key);
+}
+export function sweep(now = Date.now()) {
+    for (const [k, w] of windows)
+        if (now >= w.resetAt)
+            windows.delete(k);
+    for (const [k, f] of loginFails)
+        if (now >= f.expiresAt)
+            loginFails.delete(k);
+}
+export function __clear() {
+    windows.clear();
+    loginFails.clear();
+}
+//# sourceMappingURL=throttle.js.map

package/dist/gateway/throttle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"throttle.js","sourceRoot":"","sources":["../../src/gateway/throttle.ts"],"names":[],"mappings":"AAmBA,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;AAa/C,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACxF,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,CAAC,CAAC,KAAK,EAAE,CAAC;IACV,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;AACtD,CAAC;AAKD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AAO7C,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAChF,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,MAAM,EAAE,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC;AACnC,CAAC;AASD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsB,CAAC;AAGjD,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAS9B,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAChE,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,IAAI,mBAAmB;QAAE,OAAO,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC;IACvC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,kBAAkB,CAAC,CAAC;AAC7D,CAAC;AAGD,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACnE,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC,EAAE,CAAC;QACN,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,iBAAiB,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,iBAAiB,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAGD,MAAM,UAAU,KAAK,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO;QAAE,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU;QAAE,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;YAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAGD,MAAM,UAAU,OAAO;IACrB,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC"}

package/dist/lib/auth/backup-codes.js

@@ -12,10 +12,10 @@ function randomCode() {
 }
 export async function generateBackupCodes() {
     const codes = Array.from({ length: COUNT }, randomCode);
-    const hashes = await Promise.all(codes.map((c) => hashPassword(c)));
-    return { codes, hashes: hashes.join('|') };
+    const hashed = await Promise.all(codes.map((c) => hashPassword(c)));
+    return { codes, hashes: hashed.map((h) => h.phc).join('|'), pepperId: hashed[0].pepperId };
 }
-export async function verifyBackupCode(input, joined) {
+export async function verifyBackupCode(input, joined, pepperId) {
     if (!joined)
         return -1;
     const normalized = input.trim().toUpperCase();
@@ -24,7 +24,7 @@ export async function verifyBackupCode(input, joined) {
         const h = parts[i];
         if (!h || h === USED)
             continue;
-        if (await verifyPassword(h, normalized))
+        if (await verifyPassword(h, normalized, pepperId))
             return i;
     }
     return -1;

package/dist/lib/auth/backup-codes.js.map

@@ -1 +1 @@
-{"version":3,"file":"backup-codes.js","sourceRoot":"","sources":["../../../src/lib/auth/backup-codes.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D,MAAM,KAAK,GAAG,EAAE,CAAC;AACjB,MAAM,MAAM,GAAG,CAAC,CAAC;AAEjB,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AACnD,MAAM,IAAI,GAAG,QAAQ,CAAC;AAEtB,SAAS,UAAU;IACjB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7C,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,MAAqB;IACzE,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,CAAC;IACvB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,MAAM,cAAc,CAAC,CAAC,EAAE,UAAU,CAAC;YAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAGD,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,GAAW;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAGD,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAGD,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"backup-codes.js","sourceRoot":"","sources":["../../../src/lib/auth/backup-codes.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D,MAAM,KAAK,GAAG,EAAE,CAAC;AACjB,MAAM,MAAM,GAAG,CAAC,CAAC;AAEjB,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AACnD,MAAM,IAAI,GAAG,QAAQ,CAAC;AAEtB,SAAS,UAAU;IACjB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,EAAE,CAAC;AAC9F,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,MAAqB,EACrB,QAAgB;IAEhB,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,CAAC;IACvB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,MAAM,cAAc,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAGD,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,GAAW;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAGD,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAGD,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC"}

package/dist/lib/auth/breach-check.js

@@ -0,0 +1,58 @@
+import { createHash } from 'node:crypto';
+const COMMON = new Set([
+    '123456', '123456789', '12345678', '1234567', '12345', '1234567890', '123123', '111111',
+    '000000', '654321', '666666', '888888', '1234', '12345678910', '121212', '112233',
+    'password', 'password1', 'password123', 'passw0rd', 'senha', 'senha123', 'minhasenha',
+    'qwerty', 'qwerty123', 'qwertyuiop', 'asdfghjkl', 'zxcvbnm', '1q2w3e4r', '1q2w3e4r5t',
+    'admin', 'admin123', 'administrator', 'root', 'toor', 'user', 'guest', 'test', 'test123',
+    'welcome', 'welcome1', 'letmein', 'iloveyou', 'monkey', 'dragon', 'sunshine', 'princess',
+    'football', 'baseball', 'superman', 'batman', 'trustno1', 'master', 'shadow', 'michael',
+    'jennifer', 'jordan', 'harley', 'hunter', 'ranger', 'buster', 'thomas', 'robert', 'daniel',
+    'ashley', 'nicole', 'chelsea', 'matthew', 'access', 'flower', 'hottie', 'loveme', 'zaq1zaq1',
+    'abc123', 'abcd1234', 'abcdef', 'a1b2c3d4', 'qazwsx', 'qazwsxedc', 'asdf1234', 'p@ssw0rd',
+    'changeme', 'secret', 'whatever', 'freedom', 'starwars', 'computer', 'internet', 'samsung',
+    'google', 'facebook', 'linkedin', 'nintendo', 'pokemon', 'mustang', 'corvette', 'ferrari',
+    'brasil', 'brazil', 'flamengo', 'corinthians', 'palmeiras', 'saopaulo', 'gremio',
+    'deus', 'jesus', 'amor', 'familia', 'cachorro', 'gabriel', 'rafael', 'fernanda', 'juliana',
+]);
+function hibpTimeoutMs() {
+    return Math.max(200, Number(process.env.NIO_HIBP_TIMEOUT_MS) || 1500);
+}
+function hibpDisabled() {
+    return /^(1|true|yes|on)$/i.test((process.env.NIO_HIBP_DISABLE ?? '').trim());
+}
+function sha1Upper(input) {
+    return createHash('sha1').update(input, 'utf8').digest('hex').toUpperCase();
+}
+export async function checkPasswordBreach(password) {
+    if (COMMON.has(password.toLowerCase()))
+        return { breached: true, source: 'common' };
+    if (hibpDisabled())
+        return { breached: false };
+    const hash = sha1Upper(password);
+    const prefix = hash.slice(0, 5);
+    const suffix = hash.slice(5);
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), hibpTimeoutMs());
+    try {
+        const res = await fetch(`https://api.pwnedpasswords.com/range/${prefix}`, {
+            signal: ac.signal,
+            headers: { 'Add-Padding': 'true' },
+        });
+        if (!res.ok)
+            return { breached: false };
+        for (const line of (await res.text()).split('\n')) {
+            const [lineSuffix, countStr] = line.trim().split(':');
+            if (lineSuffix === suffix && Number(countStr) > 0)
+                return { breached: true, source: 'pwned' };
+        }
+        return { breached: false };
+    }
+    catch {
+        return { breached: false };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=breach-check.js.map

package/dist/lib/auth/breach-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"breach-check.js","sourceRoot":"","sources":["../../../src/lib/auth/breach-check.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS;IAC7B,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ;IACvF,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ;IACjF,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY;IACrF,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY;IACrF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;IACxF,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU;IACxF,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;IACvF,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IAC1F,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU;IAC5F,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU;IACzF,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS;IAC1F,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS;IACzF,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ;IAChF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS;CAC3F,CAAC,CAAC;AAGH,SAAS,aAAa;IACpB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,CAAC;AACxE,CAAC;AACD,SAAS,YAAY;IACnB,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAKD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9E,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACpF,IAAI,YAAY,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAE/C,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE7B,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,wCAAwC,MAAM,EAAE,EAAE;YACxE,MAAM,EAAE,EAAE,CAAC,MAAM;YAGjB,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,UAAU,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAChG,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/lib/auth/gateway-client.js

@@ -33,6 +33,15 @@ async function post(path, body, headers) {
         throw await errorFromResponse(res);
     return (await res.json());
 }
+export async function gatewayRegister(name, password) {
+    const res = await gwFetch('POST', '/register', {
+        headers: await baseHeaders(),
+        body: JSON.stringify({ name, password }),
+    });
+    if (!res.ok)
+        throw await errorFromResponse(res);
+    return (await res.json());
+}
 export async function gatewayLogin(name, password) {
     const res = await gwFetch('POST', '/login', {
         headers: await baseHeaders(),
@@ -62,14 +71,19 @@ export async function gatewayVerify2fa(challengeId, code, type) {
         throw new Error(body.error ?? `gateway respondeu ${res.status}`);
     return { ok: true, ...body, backupCodesRemaining: body.backupCodesRemaining };
 }
-export async function gatewayLogout(sessionId) {
+export async function gatewayLogout(sessionId, token) {
     const res = await gwFetch('POST', '/logout', {
-        headers: await baseHeaders(),
+        headers: await authedHeaders(token),
         body: JSON.stringify({ sessionId }),
     });
     if (!res.ok)
         throw await errorFromResponse(res);
 }
+export async function gatewayLogoutAll(token) {
+    const res = await gwFetch('POST', '/logout-all', { headers: await authedHeaders(token) });
+    if (!res.ok)
+        throw await errorFromResponse(res);
+}
 export const gatewaySecurity = {
     status: async (token) => {
         const res = await gwFetch('GET', '/security/status', { headers: await authedHeaders(token) });
@@ -82,5 +96,6 @@ export const gatewaySecurity = {
     challenge: async (token) => post('/security/challenge', {}, await authedHeaders(token)),
     disable: async (token, challengeId, code, type) => post('/security/disable-2fa', { challengeId, code, type }, await authedHeaders(token)),
     regenerateBackupCodes: async (token, challengeId, code, type) => post('/security/regenerate-backup-codes', { challengeId, code, type }, await authedHeaders(token)),
+    changePassword: async (token, currentPassword, newPassword) => post('/security/change-password', { currentPassword, newPassword }, await authedHeaders(token)),
 };
 //# sourceMappingURL=gateway-client.js.map

package/dist/lib/auth/gateway-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-client.js","sourceRoot":"","sources":["../../../src/lib/auth/gateway-client.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAyBnC,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,IAAI,KAAK,CACd,2CAA2C,WAAW,uBAAuB;QAC3E,oEAAqE,KAAe,CAAC,OAAO,IAAI,KAAK,GAAG,CAC3G,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAa;IAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAc,CAAC;IAC/D,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,EAAE,EAAE,CAAC;AACxG,CAAC;AAGD,KAAK,UAAU,aAAa,CAAC,KAAa;IACxC,OAAO,EAAE,GAAG,CAAC,MAAM,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AACxE,CAAC;AAGD,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,OAAoB,EAAE;IACzE,IAAI,CAAC,GAAG,MAAM,IAAI,WAAW,GAAG,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI,CAAI,IAAY,EAAE,IAAa,EAAE,OAA+B;IACjF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE;QAC1C,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;AAClD,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,IAAY,EACZ,IAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE;QAC/C,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;YACxC,SAAS,EAAE,IAAI,CAAC,SAA+B;YAC/C,kBAAkB,EAAE,IAAI,CAAC,kBAAyC;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAE,IAAI,CAAC,KAAgB,IAAI,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAI,IAAkC,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAA8B,EAAE,CAAC;AACzH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE;QAC3C,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAGD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,MAAM,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiF,CAAC;IAC5G,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE,CAC7C,IAAI,CAA0B,sBAAsB,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAE9F,aAAa,EAAE,KAAK,EAAE,KAAa,EAAE,WAAmB,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE,CACvF,IAAI,CACF,uBAAuB,EACvB,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAC5B,MAAM,aAAa,CAAC,KAAK,CAAC,CAC3B;IAEH,SAAS,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE,CACjC,IAAI,CAA0B,qBAAqB,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAEtF,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,WAAmB,EAAE,IAAY,EAAE,IAAsB,EAAE,EAAE,CAC1F,IAAI,CAAe,uBAAuB,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAEtG,qBAAqB,EAAE,KAAK,EAAE,KAAa,EAAE,WAAmB,EAAE,IAAY,EAAE,IAAsB,EAAE,EAAE,CACxG,IAAI,CACF,mCAAmC,EACnC,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,EAC3B,MAAM,aAAa,CAAC,KAAK,CAAC,CAC3B;CACJ,CAAC"}
+{"version":3,"file":"gateway-client.js","sourceRoot":"","sources":["../../../src/lib/auth/gateway-client.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AA+BnC,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,IAAI,KAAK,CACd,2CAA2C,WAAW,uBAAuB;QAC3E,oEAAqE,KAAe,CAAC,OAAO,IAAI,KAAK,GAAG,CAC3G,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAa;IAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAc,CAAC;IAC/D,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,EAAE,EAAE,CAAC;AACxG,CAAC;AAGD,KAAK,UAAU,aAAa,CAAC,KAAa;IACxC,OAAO,EAAE,GAAG,CAAC,MAAM,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AACxE,CAAC;AAGD,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,OAAoB,EAAE;IACzE,IAAI,CAAC,GAAG,MAAM,IAAI,WAAW,GAAG,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI,CAAI,IAAY,EAAE,IAAa,EAAE,OAA+B;IACjF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE;QAC7C,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE;QAC1C,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;AAClD,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,IAAY,EACZ,IAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE;QAC/C,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;YACxC,SAAS,EAAE,IAAI,CAAC,SAA+B;YAC/C,kBAAkB,EAAE,IAAI,CAAC,kBAAyC;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAE,IAAI,CAAC,KAAgB,IAAI,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAI,IAAkC,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAA8B,EAAE,CAAC;AACzH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,KAAa;IAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE;QAC3C,OAAO,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC;QACnC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAaD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,MAAM,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAQvB,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE,CAC7C,IAAI,CAAmB,sBAAsB,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAEvF,aAAa,EAAE,KAAK,EAAE,KAAa,EAAE,WAAmB,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE,CACvF,IAAI,CACF,uBAAuB,EACvB,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAC5B,MAAM,aAAa,CAAC,KAAK,CAAC,CAC3B;IAEH,SAAS,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE,CACjC,IAAI,CAAmB,qBAAqB,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAE/E,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,WAAmB,EAAE,IAAY,EAAE,IAAsB,EAAE,EAAE,CAC1F,IAAI,CAAe,uBAAuB,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAEtG,qBAAqB,EAAE,KAAK,EAAE,KAAa,EAAE,WAAmB,EAAE,IAAY,EAAE,IAAsB,EAAE,EAAE,CACxG,IAAI,CACF,mCAAmC,EACnC,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,EAC3B,MAAM,aAAa,CAAC,KAAK,CAAC,CAC3B;IAGH,cAAc,EAAE,KAAK,EAAE,KAAa,EAAE,eAAuB,EAAE,WAAmB,EAAE,EAAE,CACpF,IAAI,CACF,2BAA2B,EAC3B,EAAE,eAAe,EAAE,WAAW,EAAE,EAChC,MAAM,aAAa,CAAC,KAAK,CAAC,CAC3B;CACJ,CAAC"}