@owlmeans/server-auth 0.1.18-rc.51 → 0.1.18-rc.53

package/build/manager/types.d.ts

@@ -1,4 +1,4 @@
-import type { AllowanceRequest, AllowanceResponse, Auth, AuthCredentials, AuthToken, RelyToken } from '@owlmeans/auth';
+import type { AllowanceRequest, AllowanceResponse, Auth, AuthCredentials, AuthToken, RelyToken, AuthPayload } from '@owlmeans/auth';
 import type { KlusterConfig } from '@owlmeans/kluster';
 import type { GuardService } from '@owlmeans/entrypoint';
 import type { ApiServerAppend } from '@owlmeans/server-api';
@@ -30,4 +30,44 @@ export interface RelyCarrier {
     source: RelyToken;
     rely: RelyToken;
 }
+/**
+ * What a `SupervisorUserResolver` returns: the identity the supervisor-minted
+ * token will represent. Only `userId` is required - the rest default sensibly.
+ */
+export interface SupervisorUserResolution extends Partial<Pick<AuthPayload, 'profileId' | 'entitySlug' | 'role' | 'scopes'>> {
+    userId: string;
+}
+/**
+ * Find-or-create the target identity for a supervisor login. `register` reflects
+ * `allowRegistration`; when false the resolver should only look existing users up.
+ * Wire this to the project's identity store (e.g. `@owlmeans/server-auth-identity`).
+ */
+export interface SupervisorUserResolver {
+    <C extends AppConfig, T extends AppContext<C>>(userId: string, context: T, opts: {
+        register: boolean;
+    }): Promise<SupervisorUserResolution>;
+}
+/** Resolved options handed to the plugin factory. */
+export interface SupervisorPluginOptions {
+    supervisors: string[];
+    allowRegistration: boolean;
+    resolveUser?: SupervisorUserResolver;
+}
+export interface SupervisorAuthOptions {
+    /** Trusted-record aliases authorized to act as supervisor. Default: master + superuser. */
+    supervisors?: string[];
+    /** Find-or-create the target user by id/email. Default: trust the id as-is. */
+    resolveUser?: SupervisorUserResolver;
+    /** Allow minting a token for an unknown user (registration). Default: true. */
+    allowRegistration?: boolean;
+    /** Force enable/disable. Default: development only (cfg.debug.all || cfg.debug.supervisor). */
+    enabled?: boolean;
+    /**
+     * Also accept internal owlmeans `Ed25519BasicToken`s even when another guard
+     * (e.g. OIDC) is the primary guard on protected entrypoints. Default: true.
+     */
+    acceptInternalTokens?: boolean;
+    /** The internal-token guard to add as a coguard. Default: DEFAULT_GUARD ('auth'). */
+    guard?: string;
+}
 //# sourceMappingURL=types.d.ts.map

package/build/manager/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/manager/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACtH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAErE,MAAM,WAAW,SAAU,SAAQ,YAAY,EAAE,aAAa;IAC5D,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACvC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAE/D,YAAY,EAAE,CAAC,UAAU,EAAE,eAAe,KAAK,OAAO,CAAC,SAAS,CAAC,CAAA;IAEjE,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACjF,eAAe,EACf,oBAAoB;CAAI;AAE5B,MAAM,WAAW,WAAY,SAAQ,YAAY;CAChD;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,WAAW,CAAC,EAAE,UAAU,CAAA;IACxB,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,IAAI,EAAE,SAAS,CAAA;CAChB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/manager/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACnI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAErE,MAAM,WAAW,SAAU,SAAQ,YAAY,EAAE,aAAa;IAC5D,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACvC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAE/D,YAAY,EAAE,CAAC,UAAU,EAAE,eAAe,KAAK,OAAO,CAAC,SAAS,CAAC,CAAA;IAEjE,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACjF,eAAe,EACf,oBAAoB;CAAI;AAE5B,MAAM,WAAW,WAAY,SAAQ,YAAY;CAChD;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,WAAW,CAAC,EAAE,UAAU,CAAA;IACxB,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,IAAI,EAAE,SAAS,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAyB,SAAQ,OAAO,CAAC,IAAI,CAAC,WAAW,EACxE,WAAW,GAAG,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC;IAChD,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,EAC3C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,GACtD,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,WAAW,CAAC,EAAE,sBAAsB,CAAA;CACrC;AAED,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,sBAAsB,CAAA;IACpC,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}

package/build/manager/types.local.d.ts

@@ -0,0 +1,4 @@
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context';
+export type Config = ServerConfig;
+export type Context = ServerContext<Config>;
+//# sourceMappingURL=types.local.d.ts.map

package/build/manager/types.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.d.ts","sourceRoot":"","sources":["../../src/manager/types.local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE3E,MAAM,MAAM,MAAM,GAAG,YAAY,CAAA;AAEjC,MAAM,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA"}

package/build/manager/types.local.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.local.js.map

package/build/manager/types.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.js","sourceRoot":"","sources":["../../src/manager/types.local.ts"],"names":[],"mappings":""}

package/build/service.d.ts

@@ -1,7 +1,6 @@
-import type { ServerContext, ServerConfig } from '@owlmeans/server-context';
+import type { ServerContext } from '@owlmeans/server-context';
 import type { AuthServiceAppend, AuthService } from './types.js';
-type Config = ServerConfig;
+import type { Config } from './types.local.js';
 export declare const makeAuthService: (alias?: string) => AuthService;
 export declare const appendAuthService: <C extends Config, T extends ServerContext<C>>(ctx: T, alias?: string) => T & AuthServiceAppend;
-export {};
 //# sourceMappingURL=service.d.ts.map

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAG3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAa,MAAM,YAAY,CAAA;AAoB3E,KAAK,MAAM,GAAG,YAAY,CAAA;AAG1B,eAAO,MAAM,eAAe,WAAW,MAAM,KAAmB,WAqL/D,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,OACvE,CAAC,UAAS,MAAM,KACpB,CAAC,GAAG,iBAiBN,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAG7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAa,MAAM,YAAY,CAAA;AAa3E,OAAO,KAAK,EAAE,MAAM,EAAW,MAAM,kBAAkB,CAAA;AAgBvD,eAAO,MAAM,eAAe,WAAW,MAAM,KAAmB,WAqL/D,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,OACvE,CAAC,UAAS,MAAM,KACpB,CAAC,GAAG,iBAiBN,CAAA"}

package/build/service.js

@@ -5,11 +5,22 @@ import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
 import { AuthenFailed, AuthorizationError, AuthroizationType, AuthUnavailable } from '@owlmeans/auth';
 import { createStaticResource } from '@owlmeans/static-resource';
 import { trust, extractAuthToken } from '@owlmeans/auth-common/utils';
-import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
+import { ENTITY_RESOLVER, TOKEN_UPDATE } from '@owlmeans/auth-common';
 import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity';
 import { appendMemoryAuthSessionManager, AUTH_SESSION_MANAGER, AUTH_SESSION_TTL } from '@owlmeans/server-auth-session';
 import { uuid } from '@owlmeans/basic-ids';
-import { TOKEN_UPDATE } from '@owlmeans/auth-common';
+import { logger } from '@owlmeans/log';
+const log = logger('server-auth');
+/**
+ * A refused token exchange — the manager's token presented to open a session. Logged with the
+ * reason and the account id only; returns the error for the caller to throw.
+ */
+const refuse = (reason, error, userId) => {
+    const accountId = userId == null ? undefined
+        : userId.includes('@') ? `*@${userId.slice(userId.lastIndexOf('@') + 1)}` : userId;
+    log.warn('Session exchange refused', { reason, ...(accountId != null ? { accountId } : {}) }, { event: 'auth.refused' });
+    return error;
+};
 export const makeAuthService = (alias = DEFAULT_ALIAS) => {
     const location = `server-auth:${alias}`;
     const cache = (context) => context.resource(AUTH_CACHE);
@@ -131,7 +142,7 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
             const envelope = makeEnvelopeModel(token.token, EnvelopeKind.Token);
             const authService = await trust(context, TRUSTED, AUTH_SRV_KEY);
             if (!await envelope.verify(authService.key)) {
-                throw new AuthenFailed();
+                throw refuse('signature', new AuthenFailed());
             }
             const credentials = envelope.message();
             const msg = credentials.challenge;
@@ -140,10 +151,10 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
                 await cache(context).create({ id: msg }, { ttl: AUTHEN_TIMEFRAME / 1000 });
             }
             catch {
-                throw new AuthenFailed();
+                throw refuse('replay', new AuthenFailed(), credentials.userId);
             }
             if (credentials.credential !== authService.user.id) {
-                throw new AuthenFailed();
+                throw refuse('issuer', new AuthenFailed(), credentials.userId);
             }
             // @TODO Move to a plugin
             const issuedAt = Date.now();
@@ -167,13 +178,13 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
             if (manager != null) {
                 const entityId = await entityIdFor(context, auth.entitySlug);
                 if (entityId == null || auth.profileId == null)
-                    throw new AuthenFailed('session');
+                    throw refuse('session', new AuthenFailed('session'), auth.userId);
                 const decision = await manager.register({
                     id: auth.sessionId, kind: 'bearer', entityId, profileId: auth.profileId,
                     issuedAt, expiresAt: expiresAt.getTime()
                 });
                 if (decision.state !== 'active')
-                    throw new AuthenFailed('session');
+                    throw refuse('session', new AuthenFailed('session'), auth.userId);
                 auth.authorizationVersion = decision.version;
             }
             return { token: await sign(context, auth) };

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,gBAAgB,EACvE,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAKpD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAA6B,EAAE,CAC/D,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAqB,oBAAoB,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAA;IAEV,MAAM,WAAW,GAAG,KAAK,EAAE,OAAgB,EAAE,UAA8B,EAA0B,EAAE;QACrG,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QACxD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,UAAU,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAChG,OAAO,MAAM,EAAE,EAAE,IAAI,IAAI,CAAA;IAC3B,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAE,OAAe,EAAwB,EAAE;QAC5F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAA;QAC1G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;QACjF,IAAI,OAAO,GAA2B,IAAI,CAAA;QAC1C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,4EAA4E;YAC5E,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACtH,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,oBAAoB,EAAE,OAAO;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAmB,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxG,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACpH,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,iBAAiB,CAAC,iBAAiB,CAAC;aACrF,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QACxD,OAAO,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,CAAA;IAChF,CAAC,CAAA;IAED,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAEtF,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAY,CAAA;YACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;YAChF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,OAAO,KAAU,CAAA;gBAC7C,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,0FAA0F;oBAC1F,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAU,CAAA;gBAClF,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBAChE,IAAI,SAAS,IAAI,IAAI;wBAAE,OAAO,KAAU,CAAA;oBACxC,IAAI,GAAG,SAAS,CAAA;oBAChB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;oBAC7C,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;oBACvD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;gBAC9D,CAAC;YACH,CAAC;YAED,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAEjB,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACnE,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YAC1E,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,QAAQ,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEpF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAChF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACtC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAA;YAEjC,6EAA6E;YAE7E,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,yBAAyB;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,CAAA;YACvD,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,WAAW,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAC7B,SAAS;gBACT,SAAS,EAAE,IAAI,EAAE;gBACjB,oBAAoB,EAAE,CAAC;aACxB,CAAA;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,IAAI,YAAY,CAAC,SAAS,CAAC,CAAA;gBACjF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;oBACtC,EAAE,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;oBACxE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE;iBACzC,CAAC,CAAA;gBACF,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,YAAY,CAAC,SAAS,CAAC,CAAA;gBAClE,IAAI,CAAC,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAA;YAC9C,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAA;QAC7C,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IAEzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,8FAA8F;IAC9F,oEAAoE;IACpE,8BAA8B,CAAC,GAAG,CAAC,CAAA;IAEnC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAmC,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGtI,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,eAAe,EAA8B,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAsD,MAAM,gCAAgC,CAAA;AAC1H,OAAO,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,gBAAgB,EAA2B,MAAM,+BAA+B,CAAA;AAC/I,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAItC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;AAEjC;;;GAGG;AACH,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAmB,EAAE,MAAe,EAAgB,EAAE;IACpF,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;QAC1C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IACpF,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;IACxH,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAA6B,EAAE,CAC/D,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAqB,oBAAoB,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAA;IAEV,MAAM,WAAW,GAAG,KAAK,EAAE,OAAgB,EAAE,UAA8B,EAA0B,EAAE;QACrG,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QACxD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,UAAU,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAChG,OAAO,MAAM,EAAE,EAAE,IAAI,IAAI,CAAA;IAC3B,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAE,OAAe,EAAwB,EAAE;QAC5F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAA;QAC1G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;QACjF,IAAI,OAAO,GAA2B,IAAI,CAAA;QAC1C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,4EAA4E;YAC5E,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACtH,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,oBAAoB,EAAE,OAAO;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAmB,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxG,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACpH,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,iBAAiB,CAAC,iBAAiB,CAAC;aACrF,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QACxD,OAAO,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,CAAA;IAChF,CAAC,CAAA;IAED,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAEtF,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAY,CAAA;YACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;YAChF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,OAAO,KAAU,CAAA;gBAC7C,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,0FAA0F;oBAC1F,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAU,CAAA;gBAClF,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBAChE,IAAI,SAAS,IAAI,IAAI;wBAAE,OAAO,KAAU,CAAA;oBACxC,IAAI,GAAG,SAAS,CAAA;oBAChB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;oBAC7C,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;oBACvD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;gBAC9D,CAAC;YACH,CAAC;YAED,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAEjB,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACnE,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YAC1E,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,QAAQ,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEpF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAChF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,MAAM,CAAC,WAAW,EAAE,IAAI,YAAY,EAAE,CAAC,CAAA;YAC/C,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACtC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAA;YAEjC,6EAA6E;YAE7E,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YAChE,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YAChE,CAAC;YAED,yBAAyB;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,CAAA;YACvD,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,WAAW,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAC7B,SAAS;gBACT,SAAS,EAAE,IAAI,EAAE;gBACjB,oBAAoB,EAAE,CAAC;aACxB,CAAA;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;gBACjH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;oBACtC,EAAE,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;oBACxE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE;iBACzC,CAAC,CAAA;gBACF,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;gBAClG,IAAI,CAAC,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAA;YAC9C,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAA;QAC7C,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IAEzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,8FAA8F;IAC9F,oEAAoE;IACpE,8BAA8B,CAAC,GAAG,CAAC,CAAA;IAEnC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/types.local.d.ts

@@ -0,0 +1,4 @@
+import type { ServerContext, ServerConfig } from '@owlmeans/server-context';
+export type Config = ServerConfig;
+export type Context = ServerContext<Config>;
+//# sourceMappingURL=types.local.d.ts.map

package/build/types.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.d.ts","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE3E,MAAM,MAAM,MAAM,GAAG,YAAY,CAAA;AAEjC,MAAM,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA"}

package/build/types.local.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.local.js.map

package/build/types.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.js","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth",
-  "version": "0.1.18-rc.51",
+  "version": "0.1.18-rc.53",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -36,42 +36,43 @@
     }
   },
   "dependencies": {
-    "@noble/hashes": "^1.5.0",
-    "@owlmeans/api": "^0.1.18-rc.44",
-    "@owlmeans/api-config-server": "^0.1.18-rc.48",
-    "@owlmeans/auth": "^0.1.18-rc.38",
-    "@owlmeans/auth-common": "^0.1.18-rc.44",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.43",
-    "@owlmeans/basic-ids": "^0.1.18-rc.34",
-    "@owlmeans/basic-keys": "^0.1.18-rc.45",
-    "@owlmeans/client-config": "^0.1.18-rc.41",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.44",
-    "@owlmeans/config": "^0.1.18-rc.41",
-    "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/kluster": "^0.1.18-rc.40",
-    "@owlmeans/entrypoint": "^0.1.18-rc.39",
-    "@owlmeans/redis-resource": "^0.1.18-rc.41",
-    "@owlmeans/resource": "^0.1.18-rc.37",
-    "@owlmeans/route": "^0.1.18-rc.33",
-    "@owlmeans/server-api": "^0.1.18-rc.48",
-    "@owlmeans/server-auth-identity": "^0.1.18-rc.44",
-    "@owlmeans/server-auth-session": "^0.1.18-rc.13",
-    "@owlmeans/server-context": "^0.1.18-rc.40",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.38",
-    "@owlmeans/server-route": "^0.1.18-rc.32",
-    "@owlmeans/server-socket": "^0.1.18-rc.51",
-    "@owlmeans/socket": "^0.1.18-rc.37",
-    "@owlmeans/static-resource": "^0.1.18-rc.36",
-    "@scure/base": "^2.3.0"
+    "@noble/hashes": "^2.4.0",
+    "@owlmeans/api": "^0.1.18-rc.46",
+    "@owlmeans/api-config-server": "^0.1.18-rc.50",
+    "@owlmeans/auth": "^0.1.18-rc.39",
+    "@owlmeans/auth-common": "^0.1.18-rc.46",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.45",
+    "@owlmeans/basic-ids": "^0.1.18-rc.36",
+    "@owlmeans/basic-keys": "^0.1.18-rc.47",
+    "@owlmeans/client-config": "^0.1.18-rc.43",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.46",
+    "@owlmeans/config": "^0.1.18-rc.43",
+    "@owlmeans/context": "^0.1.18-rc.33",
+    "@owlmeans/kluster": "^0.1.18-rc.42",
+    "@owlmeans/log": "^0.1.18-rc.1",
+    "@owlmeans/entrypoint": "^0.1.18-rc.40",
+    "@owlmeans/redis-resource": "^0.1.18-rc.43",
+    "@owlmeans/resource": "^0.1.18-rc.39",
+    "@owlmeans/route": "^0.1.18-rc.34",
+    "@owlmeans/server-api": "^0.1.18-rc.50",
+    "@owlmeans/server-auth-identity": "^0.1.18-rc.46",
+    "@owlmeans/server-auth-session": "^0.1.18-rc.15",
+    "@owlmeans/server-context": "^0.1.18-rc.42",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.39",
+    "@owlmeans/server-route": "^0.1.18-rc.33",
+    "@owlmeans/server-socket": "^0.1.18-rc.53",
+    "@owlmeans/socket": "^0.1.18-rc.39",
+    "@owlmeans/static-resource": "^0.1.18-rc.38",
+    "@scure/base": "^2.4.0"
   },
   "peerDependencies": {
     "ajv": "*"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.43",
-    "@types/bun": "^1.4.0",
-    "@types/node": "^26.1.0",
+    "@owlmeans/test-auth": "^0.1.18-rc.45",
+    "@types/bun": "^1.4.2",
+    "@types/node": "^26.6.4",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/actions/service.ts

@@ -1,12 +1,9 @@
 import { handlers } from '@owlmeans/server-api'
 import type { EntrypointProtocol } from '@owlmeans/entrypoint'
 import type { AuthToken } from '@owlmeans/auth'
-import { AuthServiceAppend } from '../types.js'
-import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
 import { assertContext } from '@owlmeans/context'
+import type { Context } from './types.local.js'
 
-type Config = ServerConfig
-type Context = ServerContext<Config> & AuthServiceAppend
 const api = handlers<Context>()
 
 export const authenticate = (protocol: EntrypointProtocol<{ body: AuthToken }, AuthToken>) =>

package/src/actions/types.local.ts

@@ -0,0 +1,6 @@
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import { AuthServiceAppend } from '../types.js'
+
+export type Config = ServerConfig
+
+export type Context = ServerContext<Config> & AuthServiceAppend

package/src/manager/README.md

@@ -38,7 +38,7 @@ The manager is built on the OwlMeans entrypoint system, providing:
 This manager app is part of the `@owlmeans/server-auth` package:
 
 ```bash
-npm install @owlmeans/server-auth@^0.1.18-rc.51
+npm install @owlmeans/server-auth@^0.1.18-rc.53
 ```
 
 ## API Reference

package/src/manager/consts.local.ts

@@ -0,0 +1 @@
+export const DEFAULT_SUPERVISORS = ['master', 'superuser']

package/src/manager/model.ts

@@ -1,21 +1,26 @@
 import type { AuthModel, AppConfig, AppContext } from './types.js'
-import { AuthenFailed, AuthenPayloadError, entitySlugOf } from '@owlmeans/auth'
-import type { AuthCredentials } from '@owlmeans/auth'
-import type { EntityResolverService } from '@owlmeans/auth-common'
-import { ENTITY_RESOLVER } from '@owlmeans/auth-common'
+import { AuthenFailed, AuthenPayloadError, AuthError, AuthUnavailable, entitySlugOf, type AuthCredentials } from '@owlmeans/auth'
+import { logger } from '@owlmeans/log'
+import { type EntityResolverService, ENTITY_RESOLVER } from '@owlmeans/auth-common'
 import { getPlugin } from './plugins/utils.js'
 import { AUTH_CACHE, AUTHEN_TIMEFRAME } from '../consts.js'
-import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
-import type { EnvelopeModel } from '@owlmeans/basic-envelope'
+import { EnvelopeKind, makeEnvelopeModel, type EnvelopeModel } from '@owlmeans/basic-envelope'
 import { createRelyFlow } from './rely/flow.js'
 import { trusted } from './utils/trusted.js'
-import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
 import type { Resource } from '@owlmeans/resource'
 import type { AuthSpent } from '../types.js'
 import { AuthChallengeReplayPolicy } from './plugins/replay-policy.js'
+import type { Context } from './types.local.js'
 
-type Config = ServerConfig
-type Context = ServerContext<Config>
+
+const log = logger('server-auth')
+
+/** An account id as a log may carry it: an e-mail is reduced to its domain. */
+const accountOf = (userId: string | undefined): string | undefined =>
+  userId == null ? undefined : userId.includes('@') ? `*@${userId.slice(userId.lastIndexOf('@') + 1)}` : userId
+
+const compact = <T extends Record<string, unknown>>(value: T): Partial<T> =>
+  Object.fromEntries(Object.entries(value).filter(([, entry]) => entry != null)) as Partial<T>
 
 export const makeAuthModel = (context: AppContext<AppConfig>): AuthModel => {
   const cache = (context: Context): Resource<AuthSpent> =>
@@ -44,61 +49,79 @@ export const makeAuthModel = (context: AppContext<AppConfig>): AuthModel => {
     },
 
     authenticate: async credential => {
-      const [trustedUser, keyPair] = await trusted(context)
-      const envelope: EnvelopeModel = makeEnvelopeModel(credential.challenge, EnvelopeKind.Wrap)
-      if (!await envelope.verify(keyPair)) {
-        throw new AuthenFailed('challenge')
-      }
+      // The one place every manager sign-in method (each plugin) is decided — logged once here.
+      const method = credential.type
+      try {
+        const [trustedUser, keyPair] = await trusted(context)
+        const envelope: EnvelopeModel = makeEnvelopeModel(credential.challenge, EnvelopeKind.Wrap)
+        if (!await envelope.verify(keyPair)) {
+          throw new AuthenFailed('challenge')
+        }
 
-      const msg: string = envelope.message(true)
+        const msg: string = envelope.message(true)
 
-      const plugin = await getPlugin(envelope.type(), context)
+        const plugin = await getPlugin(envelope.type(), context)
 
-      if (plugin.challengeReplayPolicy !== AuthChallengeReplayPolicy.Plugin) {
-        try {
-          await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 })
-        } catch (e) {
-          const error = new AuthenFailed('challenge')
-          if (e instanceof Error) {
-            error.oiriginalStack = `${e} : ${e.stack}`
+        if (plugin.challengeReplayPolicy !== AuthChallengeReplayPolicy.Plugin) {
+          try {
+            await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 })
+          } catch (e) {
+            const error = new AuthenFailed('challenge')
+            if (e instanceof Error) {
+              error.oiriginalStack = `${e} : ${e.stack}`
+            }
+            throw error
           }
-          throw error
         }
-      }
 
-      if (credential.userId == null) {
-        throw new AuthenPayloadError('userId')
-      }
+        if (credential.userId == null) {
+          throw new AuthenPayloadError('userId')
+        }
 
-      // @TODO this token PROBABLY needs to be registered somewhere and rechecked
-      // from time to time to make sure that the session is not deleted 
-      // or permission hasn't changed.
-      // Alternative solution is to have permissions cached and cleaned 
-      // when some broadcast message is sent from authentication system.
-
-      const challenge = credential.challenge
-      const { token } = await plugin.authenticate(Object.assign(credential, { challenge: msg }))
-      credential.challenge = token === '' ? challenge : token
-
-      // Plugins accept whatever the caller typed — a current slug, a slug the organization has
-      // since retired, or (for a token minted before slugs existed) its stable key. The token is
-      // signed once and read for as long as it lives, so the value is canonicalized here rather
-      // than at every place that later reads it back.
-      const entitySlug = entitySlugOf(credential)
-      if (entitySlug != null && context.hasService(ENTITY_RESOLVER)) {
-        const entity = await context.service<EntityResolverService>(ENTITY_RESOLVER).resolve(entitySlug)
-        if (entity == null) {
-          throw new AuthenFailed('entity')
+        // @TODO this token PROBABLY needs to be registered somewhere and rechecked
+        // from time to time to make sure that the session is not deleted 
+        // or permission hasn't changed.
+        // Alternative solution is to have permissions cached and cleaned 
+        // when some broadcast message is sent from authentication system.
+
+        const challenge = credential.challenge
+        const { token } = await plugin.authenticate(Object.assign(credential, { challenge: msg }))
+        credential.challenge = token === '' ? challenge : token
+
+        // Plugins accept whatever the caller typed — a current slug, a slug the organization has
+        // since retired, or (for a token minted before slugs existed) its stable key. The token is
+        // signed once and read for as long as it lives, so the value is canonicalized here rather
+        // than at every place that later reads it back.
+        const entitySlug = entitySlugOf(credential)
+        if (entitySlug != null && context.hasService(ENTITY_RESOLVER)) {
+          const entity = await context.service<EntityResolverService>(ENTITY_RESOLVER).resolve(entitySlug)
+          if (entity == null) {
+            throw new AuthenFailed('entity')
+          }
+          credential.entitySlug = entity.slug
         }
-        credential.entitySlug = entity.slug
-      }
 
-      credential.credential = trustedUser.id
+        credential.credential = trustedUser.id
 
-      return {
-        token: await makeEnvelopeModel<AuthCredentials>(credential.type)
-          .send(credential, AUTHEN_TIMEFRAME)
-          .sign(keyPair, EnvelopeKind.Token)
+        const result = {
+          token: await makeEnvelopeModel<AuthCredentials>(credential.type)
+            .send(credential, AUTHEN_TIMEFRAME)
+            .sign(keyPair, EnvelopeKind.Token)
+        }
+        log.info('Signed in', compact({
+          method, accountId: accountOf(credential.userId), profileId: credential.profileId,
+          entitySlug: credential.entitySlug,
+        }), { event: 'auth.signed-in' })
+
+        return result
+      } catch (error) {
+        // An outage (`AuthUnavailable`) is not a refusal; it propagates and is logged as a failure.
+        if (error instanceof AuthError && !(error instanceof AuthUnavailable)) {
+          log.warn('Sign-in refused', compact({
+            method, accountId: accountOf(credential.userId), reason: error.message,
+          }), { event: 'auth.refused' })
+        }
+        throw error
       }
     },
 

package/src/manager/plugins/basic-ed25519.ts

@@ -1,7 +1,7 @@
 import { AuthenticationType, AuthenFailed, ALL_SCOPES, AuthRole } from '@owlmeans/auth'
 import type { AuthPlugin } from './types.js'
 import { assertType } from './utils.js'
-import { randomBytes } from '@noble/hashes/utils'
+import { randomBytes } from '@noble/hashes/utils.js'
 import { base64 } from '@scure/base'
 import { fromPubKey } from '@owlmeans/basic-keys'
 import type { AppConfig, AppContext } from '../types.js'

package/src/manager/plugins/basic-rely.ts

@@ -9,6 +9,9 @@ import { AUTH_CACHE } from '../../consts.js'
 import { ResourceError } from '@owlmeans/resource'
 import type { Unsubscribe } from '@owlmeans/resource'
 import { RELY_CALL_TIMEOUT, RELY_PIN_PERFIX, RELY_TOKEN_PREFIX } from '@owlmeans/auth-common'
+import { logger } from '@owlmeans/log'
+
+const log = logger('server-auth:rely')
 
 const _subscriptions: Record<string, Unsubscribe> = {}
 export const basicRely = (context: AppContext, type?: string): AuthPlugin => {
@@ -75,7 +78,7 @@ export const basicRely = (context: AppContext, type?: string): AuthPlugin => {
           return response
         } catch (e) {
           if (e instanceof ResourceError) {
-            console.error('COLISION ON TRY TO CREATE RELY PIN\TOKEN...', e)
+            log.warn('Rely pin/token collision; retrying', e)
           } else {
             throw e
           }
@@ -118,7 +121,8 @@ export const basicRely = (context: AppContext, type?: string): AuthPlugin => {
         rely = envelop.message()
       } catch (e) {
         if (e instanceof ResourceError) {
-          console.error(e)
+          // The peer's pin/token is unknown; the refusal itself is logged where sign-in is decided.
+          log.debug('Rely peer lookup failed', e)
           throw new AuthorizationError('rely')
         } else {
           throw e

package/src/manager/plugins/re-captcha.ts

@@ -7,7 +7,7 @@ import { PluginMissconfigured } from '@owlmeans/config'
 import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
 import { EntrypointOutcome } from '@owlmeans/entrypoint'
 import { base64 } from '@scure/base'
-import { randomBytes } from '@noble/hashes/utils'
+import { randomBytes } from '@noble/hashes/utils.js'
 import { assertType } from './utils.js'
 
 export const reCaptcha = <C extends AppConfig, T extends AppContext<C>>(context: T): AuthPlugin => {

package/src/manager/plugins/supervisor.ts

@@ -1,13 +1,11 @@
-import { AuthenticationType, AuthenFailed, AuthRole, ALL_SCOPES, buildSupervisorPayload } from '@owlmeans/auth'
-import type { SupervisorCredentialPayload } from '@owlmeans/auth'
+import { AuthenticationType, AuthenFailed, AuthRole, ALL_SCOPES, buildSupervisorPayload, type SupervisorCredentialPayload } from '@owlmeans/auth'
 import type { AuthPlugin } from './types.js'
 import { base64 } from '@scure/base'
-import { randomBytes } from '@noble/hashes/utils'
+import { randomBytes } from '@noble/hashes/utils.js'
 import { fromPubKey } from '@owlmeans/basic-keys'
 import { TRUSTED } from '@owlmeans/config'
 import type { TrustedRecord } from '@owlmeans/auth-common'
-import type { AppConfig, AppContext } from '../types.js'
-import type { SupervisorPluginOptions } from '../supervisor.js'
+import type { AppConfig, AppContext, SupervisorPluginOptions } from '../types.js'
 
 /**
  * PK-based supervisor authentication plugin. A privileged operator (or an e2e

package/src/manager/rely/flow.ts

@@ -9,6 +9,7 @@ import { trusted } from '../utils/trusted.js'
 import { RELY_TUNNEL } from '../consts.js'
 import type { RedisResource } from '@owlmeans/redis-resource'
 import { RELY_ACTION_TIMEOUT } from '@owlmeans/auth-common'
+import { logger } from '@owlmeans/log'
 
 // 1. There is a difference between privileged (provider)
 //    and non-privileged (consumer) request 
@@ -20,6 +21,8 @@ import { RELY_ACTION_TIMEOUT } from '@owlmeans/auth-common'
 //    process can be started from scratch following same stages
 //    and using the same plugins but via socket
 
+const log = logger('server-auth:rely')
+
 export const createRelyFlow = (context: AppContext, conn: Connection, auth?: Auth | null): AuthenticateMethod => {
   const auhtenticate = conn.authenticate
 
@@ -40,9 +43,9 @@ export const createRelyFlow = (context: AppContext, conn: Connection, auth?: Aut
       }
     }, { channel: source.nonce })
     // We allow to just forward call messages back and forth
-    conn._receiveCall = async msg => { console.info(source.nonce, 'Forward call', msg.method, msg.id) }
-    conn._receiveResult = async msg => { console.info(source.nonce, 'Forward result', msg.id) }
-    conn._receiveError = async msg => { console.info(source.nonce, 'Forward error', msg.id) }
+    conn._receiveCall = async msg => { log.debug('Forward call', { nonce: source.nonce, method: msg.method, id: msg.id }) }
+    conn._receiveResult = async msg => { log.debug('Forward result', { nonce: source.nonce, id: msg.id }) }
+    conn._receiveError = async msg => { log.debug('Forward error', { nonce: source.nonce, id: msg.id }) }
     conn.defaultCallTimeout = RELY_ACTION_TIMEOUT * 1000
     const closeSender = conn.listen(async message => {
       if (isMessage(message, true)) {
@@ -94,7 +97,7 @@ export const createRelyFlow = (context: AppContext, conn: Connection, auth?: Aut
         try {
           return [stage, await model.init(_payload as AllowanceRequest) as any]
         } catch (e) {
-          console.error(e)
+          log.warn('Rely init failed; connection closed', e)
           await conn.close()
         }
         break
@@ -118,7 +121,7 @@ export const createRelyFlow = (context: AppContext, conn: Connection, auth?: Aut
 
           return [AuthenticationStage.Authenticated, internalAuth as any]
         } catch (e) {
-          console.error(e)
+          log.warn('Rely authentication failed; connection closed', e)
           await conn.close()
         }
         break