@pattern-js/mod-identity 0.2.0

package/dist/store/sqlite.js

@@ -0,0 +1,254 @@
+/**
+ * @pattern-js/mod-identity — node:sqlite store driver.
+ *
+ * Hand-written SQL, no ORM (decided): the schema is five boring tables and the
+ * security-critical statements should read as literal SQL. CAS is a single
+ * conditional UPDATE — `WHERE id=? AND version=?` (+ `consumed_at IS NULL` for
+ * tokens), checked via `changes === 1` — which is atomic in SQLite and ports
+ * verbatim to Postgres, so a future driver is a file, not a redesign.
+ *
+ * `node:sqlite` is imported dynamically with a helpful error (same pattern as
+ * runtime-node's sqlite trace sink); the in-memory store covers builds
+ * without it.
+ */
+import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { UniqueViolationError, } from "./types.js";
+import { runMigrations } from "./migrations.js";
+const toUser = (r) => ({
+    id: String(r.id),
+    email: String(r.email),
+    emailNorm: String(r.email_norm),
+    name: r.name ?? null,
+    roles: JSON.parse(String(r.roles ?? "[]")),
+    disabled: Number(r.disabled) === 1,
+    version: Number(r.version),
+    createdAt: Number(r.created_at),
+    updatedAt: Number(r.updated_at),
+});
+const toSession = (r) => ({
+    id: String(r.id),
+    tokenHash: String(r.token_hash),
+    userId: String(r.user_id),
+    createdAt: Number(r.created_at),
+    lastSeenAt: Number(r.last_seen_at),
+    expiresAt: Number(r.expires_at),
+    revokedAt: r.revoked_at == null ? null : Number(r.revoked_at),
+    version: Number(r.version),
+    userAgent: r.user_agent ?? null,
+    ip: r.ip ?? null,
+});
+const toToken = (r) => ({
+    id: String(r.id),
+    tokenHash: String(r.token_hash),
+    purpose: String(r.purpose),
+    emailNorm: r.email_norm ?? null,
+    data: r.data == null ? null : JSON.parse(String(r.data)),
+    createdAt: Number(r.created_at),
+    expiresAt: Number(r.expires_at),
+    consumedAt: r.consumed_at == null ? null : Number(r.consumed_at),
+    version: Number(r.version),
+});
+/* ── stores ────────────────────────────────────────────────────────────── */
+class SqliteUserStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async countUsers() {
+        const r = this.db.prepare("SELECT COUNT(*) AS n FROM users").get();
+        return Number(r.n);
+    }
+    async findById(id) {
+        const r = this.db.prepare("SELECT * FROM users WHERE id = ?").get(id);
+        return r ? toUser(r) : null;
+    }
+    async findByEmailNorm(emailNorm) {
+        const r = this.db.prepare("SELECT * FROM users WHERE email_norm = ?").get(emailNorm);
+        return r ? toUser(r) : null;
+    }
+    async findByIdentity(provider, subject) {
+        const r = this.db
+            .prepare("SELECT u.* FROM users u JOIN identities i ON i.user_id = u.id WHERE i.provider = ? AND i.subject = ?")
+            .get(provider, subject);
+        return r ? toUser(r) : null;
+    }
+    async createUser(input) {
+        const id = crypto.randomUUID();
+        const now = Date.now();
+        this.db.exec("BEGIN");
+        try {
+            this.db
+                .prepare("INSERT INTO users (id, email, email_norm, name, roles, disabled, version, created_at, updated_at) VALUES (?,?,?,?,?,0,1,?,?)")
+                .run(id, input.email, input.emailNorm, input.name ?? null, JSON.stringify(input.roles), now, now);
+            this.db
+                .prepare("INSERT INTO identities (provider, subject, user_id, created_at) VALUES (?,?,?,?)")
+                .run(input.identity.provider, input.identity.subject, id, now);
+            this.db.exec("COMMIT");
+        }
+        catch (err) {
+            this.db.exec("ROLLBACK");
+            if (String(err).includes("UNIQUE"))
+                throw new UniqueViolationError("email");
+            throw err;
+        }
+        return (await this.findById(id));
+    }
+    async linkIdentity(userId, provider, subject) {
+        this.db
+            .prepare("INSERT OR IGNORE INTO identities (provider, subject, user_id, created_at) VALUES (?,?,?,?)")
+            .run(provider, subject, userId, Date.now());
+    }
+    async updateUser(id, expectedVersion, patch) {
+        const current = await this.findById(id);
+        if (!current)
+            return null;
+        const next = { ...current, ...patch };
+        const info = this.db
+            .prepare("UPDATE users SET name=?, roles=?, disabled=?, version=version+1, updated_at=? WHERE id=? AND version=?")
+            .run(next.name, JSON.stringify(next.roles), next.disabled ? 1 : 0, Date.now(), id, expectedVersion);
+        return Number(info.changes) === 1 ? this.findById(id) : null;
+    }
+    async listUsers(opts = {}) {
+        const rows = this.db
+            .prepare("SELECT * FROM users ORDER BY created_at ASC LIMIT ? OFFSET ?")
+            .all(opts.limit ?? 500, opts.offset ?? 0);
+        return rows.map(toUser);
+    }
+}
+class SqliteSessionStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async create(row) {
+        this.db
+            .prepare("INSERT INTO sessions (id, token_hash, user_id, created_at, last_seen_at, expires_at, revoked_at, version, user_agent, ip) VALUES (?,?,?,?,?,?,?,1,?,?)")
+            .run(row.id, row.tokenHash, row.userId, row.createdAt, row.lastSeenAt, row.expiresAt, row.revokedAt, row.userAgent, row.ip);
+        return (await this.findById(row.id));
+    }
+    async findByTokenHash(tokenHash) {
+        const r = this.db.prepare("SELECT * FROM sessions WHERE token_hash = ?").get(tokenHash);
+        return r ? toSession(r) : null;
+    }
+    async findById(id) {
+        const r = this.db.prepare("SELECT * FROM sessions WHERE id = ?").get(id);
+        return r ? toSession(r) : null;
+    }
+    async touch(id, expectedVersion, lastSeenAt, expiresAt) {
+        const info = this.db
+            .prepare("UPDATE sessions SET last_seen_at=?, expires_at=?, version=version+1 WHERE id=? AND version=?")
+            .run(lastSeenAt, expiresAt, id, expectedVersion);
+        return Number(info.changes) === 1 ? this.findById(id) : null;
+    }
+    async rotate(id, expectedVersion, newTokenHash) {
+        const info = this.db
+            .prepare("UPDATE sessions SET token_hash=?, version=version+1 WHERE id=? AND version=?")
+            .run(newTokenHash, id, expectedVersion);
+        return Number(info.changes) === 1 ? this.findById(id) : null;
+    }
+    async revoke(id, at) {
+        this.db.prepare("UPDATE sessions SET revoked_at=?, version=version+1 WHERE id=? AND revoked_at IS NULL").run(at, id);
+    }
+    async revokeAllForUser(userId, at) {
+        const ids = this.db.prepare("SELECT id FROM sessions WHERE user_id=? AND revoked_at IS NULL").all(userId).map((r) => String(r.id));
+        this.db
+            .prepare("UPDATE sessions SET revoked_at=?, version=version+1 WHERE user_id=? AND revoked_at IS NULL")
+            .run(at, userId);
+        return ids;
+    }
+    async listForUser(userId) {
+        const rows = this.db
+            .prepare("SELECT * FROM sessions WHERE user_id=? ORDER BY created_at DESC")
+            .all(userId);
+        return rows.map(toSession);
+    }
+    async listAll(opts = {}) {
+        const rows = this.db
+            .prepare("SELECT * FROM sessions ORDER BY created_at DESC LIMIT ?")
+            .all(opts.limit ?? 500);
+        return rows.map(toSession);
+    }
+}
+class SqliteTokenStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async create(row) {
+        this.db
+            .prepare("INSERT INTO tokens (id, token_hash, purpose, email_norm, data, created_at, expires_at, consumed_at, version) VALUES (?,?,?,?,?,?,?,?,1)")
+            .run(row.id, row.tokenHash, row.purpose, row.emailNorm, row.data == null ? null : JSON.stringify(row.data), row.createdAt, row.expiresAt, row.consumedAt);
+        return (await this.findById(row.id));
+    }
+    async findById(id) {
+        const r = this.db.prepare("SELECT * FROM tokens WHERE id = ?").get(id);
+        return r ? toToken(r) : null;
+    }
+    async findByTokenHash(tokenHash) {
+        const r = this.db.prepare("SELECT * FROM tokens WHERE token_hash = ?").get(tokenHash);
+        return r ? toToken(r) : null;
+    }
+    async consume(id, expectedVersion, at) {
+        // The load-bearing CAS: `consumed_at IS NULL` in the WHERE means exactly
+        // one of N concurrent consumers sees changes === 1.
+        const info = this.db
+            .prepare("UPDATE tokens SET consumed_at=?, version=version+1 WHERE id=? AND version=? AND consumed_at IS NULL")
+            .run(at, id, expectedVersion);
+        return Number(info.changes) === 1 ? this.findById(id) : null;
+    }
+    async deleteExpired(now) {
+        const info = this.db.prepare("DELETE FROM tokens WHERE expires_at < ?").run(now);
+        return Number(info.changes);
+    }
+}
+class SqliteSettingsStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async get(key) {
+        const r = this.db.prepare("SELECT value FROM settings WHERE key = ?").get(key);
+        return r ? String(r.value) : null;
+    }
+    async set(key, value) {
+        this.db
+            .prepare("INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value")
+            .run(key, value);
+    }
+}
+/* ── factory ───────────────────────────────────────────────────────────── */
+/**
+ * Open (or create) the identity database at `filePath` (":memory:" works too).
+ * Throws a helpful error when this Node build lacks `node:sqlite`.
+ */
+export async function sqliteIdentityStores(filePath) {
+    // process.getBuiltinModule (Node ≥22.3) loads the optional builtin without
+    // going through the module graph — bundlers and vite-node leave it alone.
+    let DatabaseSync;
+    try {
+        DatabaseSync = process.getBuiltinModule("node:sqlite")
+            ?.DatabaseSync;
+    }
+    catch {
+        /* fall through to the helpful error */
+    }
+    if (!DatabaseSync) {
+        throw new Error("node:sqlite is not available in this Node build — @pattern-js/mod-identity needs Node ≥22.5 " +
+            "(≥24 recommended). For tests, use memoryIdentityStores().");
+    }
+    if (filePath !== ":memory:")
+        mkdirSync(dirname(filePath), { recursive: true });
+    const db = new DatabaseSync(filePath);
+    db.exec("PRAGMA journal_mode = WAL");
+    db.exec("PRAGMA foreign_keys = ON");
+    runMigrations(db);
+    return {
+        users: new SqliteUserStore(db),
+        sessions: new SqliteSessionStore(db),
+        tokens: new SqliteTokenStore(db),
+        settings: new SqliteSettingsStore(db),
+        close: async () => db.close(),
+    };
+}
+//# sourceMappingURL=sqlite.js.map

package/dist/store/sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../../src/store/sqlite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,oBAAoB,GAQrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAoB,MAAM,iBAAiB,CAAC;AAMlE,MAAM,MAAM,GAAG,CAAC,CAAM,EAAW,EAAE,CAAC,CAAC;IACnC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/B,IAAI,EAAG,CAAC,CAAC,IAAsB,IAAI,IAAI;IACvC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAa;IACtD,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,CAAM,EAAc,EAAE,CAAC,CAAC;IACzC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1B,SAAS,EAAG,CAAC,CAAC,UAA4B,IAAI,IAAI;IAClD,EAAE,EAAG,CAAC,CAAC,EAAoB,IAAI,IAAI;CACpC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,CAAM,EAAY,EAAE,CAAC,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAwB;IACjD,SAAS,EAAG,CAAC,CAAC,UAA4B,IAAI,IAAI;IAClD,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAA6B;IACrF,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;IAChE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;CAC3B,CAAC,CAAC;AAEH,8EAA8E;AAE9E,MAAM,eAAe;IACU;IAA7B,YAA6B,EAAe;QAAf,OAAE,GAAF,EAAE,CAAa;IAAG,CAAC;IAEhD,KAAK,CAAC,UAAU;QACd,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAS,CAAC;QAC1E,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAoB,CAAC;QACzF,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,SAAS,CAAoB,CAAC;QACxG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,OAAe;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE;aACd,OAAO,CACN,sGAAsG,CACvG;aACA,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAoB,CAAC;QAC7C,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAMhB;QACC,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN,8HAA8H,CAC/H;iBACA,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACpG,IAAI,CAAC,EAAE;iBACJ,OAAO,CAAC,kFAAkF,CAAC;iBAC3F,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACjE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACzB,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC5E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,QAAgB,EAAE,OAAe;QAClE,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,4FAA4F,CAAC;aACrG,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,UAAU,CACd,EAAU,EACV,eAAuB,EACvB,KAA4D;QAE5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,wGAAwG,CACzG;aACA,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QACtG,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAA4C,EAAE;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,8DAA8D,CAAC;aACvE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAU,CAAC;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,kBAAkB;IACO;IAA7B,YAA6B,EAAe;QAAf,OAAE,GAAF,EAAE,CAAa;IAAG,CAAC;IAEhD,KAAK,CAAC,MAAM,CAAC,GAAgC;QAC3C,IAAI,CAAC,EAAE;aACJ,OAAO,CACN,wJAAwJ,CACzJ;aACA,GAAG,CACF,GAAG,CAAC,EAAE,EACN,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,EAAE,CACP,CAAC;QACJ,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,SAAS,CAAoB,CAAC;QAC3G,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAoB,CAAC;QAC5F,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,eAAuB,EAAE,UAAkB,EAAE,SAAiB;QACpF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,8FAA8F,CAAC;aACvG,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,eAAuB,EAAE,YAAoB;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,8EAA8E,CAAC;aACvF,GAAG,CAAC,YAAY,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,EAAU;QACjC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uFAAuF,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,EAAU;QAC/C,MAAM,GAAG,GACP,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC,GAAG,CAAC,MAAM,CAC7F,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,4FAA4F,CAAC;aACrG,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACnB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,iEAAiE,CAAC;aAC1E,GAAG,CAAC,MAAM,CAAU,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAA2B,EAAE;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,yDAAyD,CAAC;aAClE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAU,CAAC;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,gBAAgB;IACS;IAA7B,YAA6B,EAAe;QAAf,OAAE,GAAF,EAAE,CAAa;IAAG,CAAC;IAEhD,KAAK,CAAC,MAAM,CAAC,GAA8B;QACzC,IAAI,CAAC,EAAE;aACJ,OAAO,CACN,yIAAyI,CAC1I;aACA,GAAG,CACF,GAAG,CAAC,EAAE,EACN,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAClD,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;QACJ,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAE,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,EAAU;QAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAoB,CAAC;QAC1F,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,SAAS,CAAoB,CAAC;QACzG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,eAAuB,EAAE,EAAU;QAC3D,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,qGAAqG,CAAC;aAC9G,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,mBAAmB;IACM;IAA7B,YAA6B,EAAe;QAAf,OAAE,GAAF,EAAE,CAAa;IAAG,CAAC;IAEhD,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAoB,CAAC;QAClG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,uGAAuG,CAAC;aAChH,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrB,CAAC;CACF;AAED,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,YAAiF,CAAC;IACtF,IAAI,CAAC;QACH,YAAY,GAAI,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAkD;YACtG,EAAE,YAAY,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,8FAA8F;YAC5F,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,UAAU;QAAE,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACpC,aAAa,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO;QACL,KAAK,EAAE,IAAI,eAAe,CAAC,EAAE,CAAC;QAC9B,QAAQ,EAAE,IAAI,kBAAkB,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,IAAI,gBAAgB,CAAC,EAAE,CAAC;QAChC,QAAQ,EAAE,IAAI,mBAAmB,CAAC,EAAE,CAAC;QACrC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE;KAC9B,CAAC;AACJ,CAAC"}

package/dist/store/types.d.ts

@@ -0,0 +1,135 @@
+/**
+ * @pattern-js/mod-identity — store contracts.
+ *
+ * Three small stores behind interfaces so the persistence layer is swappable
+ * (sqlite ships built-in, in-memory for tests, Postgres later as a driver).
+ * Every mutation that can race is **compare-and-swap**: rows carry a `version`,
+ * writers pass the version they read, and a `null` return means "lost the
+ * race — re-read and retry". On SQL backends CAS is a single conditional
+ * UPDATE, which is what makes single-use tokens and session rotation hold
+ * across multiple instances; the in-process mutex on top only trims redundant
+ * retries on a single node.
+ *
+ * Secrets never hit storage: sessions and tokens store the sha256 of the
+ * opaque secret, so a leaked database can't impersonate anyone.
+ */
+export type TokenPurpose = "login" | "invite" | "bootstrap";
+export interface UserRow {
+    id: string;
+    email: string;
+    /** lower(trim(email)) — the uniqueness key. */
+    emailNorm: string;
+    name: string | null;
+    roles: string[];
+    disabled: boolean;
+    version: number;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface IdentityLink {
+    provider: string;
+    /** Provider-scoped subject (for magic-link this is the emailNorm). */
+    subject: string;
+    userId: string;
+    createdAt: number;
+}
+export interface SessionRow {
+    /** Stable session id (NOT the secret) — safe in principals, rooms, logs. */
+    id: string;
+    /** sha256 hex of the opaque cookie token. */
+    tokenHash: string;
+    userId: string;
+    createdAt: number;
+    /** Sliding-expiry bookkeeping; touches are throttled by the service. */
+    lastSeenAt: number;
+    expiresAt: number;
+    revokedAt: number | null;
+    version: number;
+    userAgent: string | null;
+    ip: string | null;
+}
+export interface TokenRow {
+    id: string;
+    /** sha256 hex of the single-use secret. */
+    tokenHash: string;
+    purpose: TokenPurpose;
+    /** Target email (login/invite); null for an open bootstrap token. */
+    emailNorm: string | null;
+    /** Extra payload: roles to grant on invite, a `next` url, … */
+    data: Record<string, unknown> | null;
+    createdAt: number;
+    expiresAt: number;
+    /** Set exactly once via CAS — null means unconsumed. */
+    consumedAt: number | null;
+    version: number;
+}
+/** Thrown when an insert hits the one-user-per-email constraint. */
+export declare class UniqueViolationError extends Error {
+    constructor(field: string);
+}
+export interface UserStore {
+    countUsers(): Promise<number>;
+    findById(id: string): Promise<UserRow | null>;
+    findByEmailNorm(emailNorm: string): Promise<UserRow | null>;
+    findByIdentity(provider: string, subject: string): Promise<UserRow | null>;
+    /** Insert user + identity link atomically. Throws UniqueViolationError on a taken email. */
+    createUser(input: {
+        email: string;
+        emailNorm: string;
+        name?: string | null;
+        roles: string[];
+        identity: {
+            provider: string;
+            subject: string;
+        };
+    }): Promise<UserRow>;
+    /** Link an existing user to a provider identity (idempotent). */
+    linkIdentity(userId: string, provider: string, subject: string): Promise<void>;
+    /** CAS update. Returns the new row, or null on version mismatch (re-read & retry). */
+    updateUser(id: string, expectedVersion: number, patch: Partial<Pick<UserRow, "name" | "roles" | "disabled">>): Promise<UserRow | null>;
+    listUsers(opts?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<UserRow[]>;
+}
+export interface SessionStore {
+    create(row: Omit<SessionRow, "version">): Promise<SessionRow>;
+    findByTokenHash(tokenHash: string): Promise<SessionRow | null>;
+    findById(id: string): Promise<SessionRow | null>;
+    /** Sliding touch (CAS). Null on version mismatch — safe to ignore, the read was fresh. */
+    touch(id: string, expectedVersion: number, lastSeenAt: number, expiresAt: number): Promise<SessionRow | null>;
+    /** Swap the secret on privilege change (CAS): new hash, same session id. */
+    rotate(id: string, expectedVersion: number, newTokenHash: string): Promise<SessionRow | null>;
+    revoke(id: string, at: number): Promise<void>;
+    /** Revoke every active session of a user; returns the revoked ids. */
+    revokeAllForUser(userId: string, at: number): Promise<string[]>;
+    listForUser(userId: string): Promise<SessionRow[]>;
+    /** All sessions, newest first (admin screen). */
+    listAll(opts?: {
+        limit?: number;
+    }): Promise<SessionRow[]>;
+}
+export interface TokenStore {
+    create(row: Omit<TokenRow, "version">): Promise<TokenRow>;
+    findByTokenHash(tokenHash: string): Promise<TokenRow | null>;
+    /**
+     * Single-use consume (CAS): sets consumed_at only when it is still null AND
+     * the version matches. Exactly one of N concurrent consumers gets the row;
+     * the rest get null.
+     */
+    consume(id: string, expectedVersion: number, at: number): Promise<TokenRow | null>;
+    deleteExpired(now: number): Promise<number>;
+}
+/** Small persisted key/value bag for runtime-mutable identity settings (signup policy…). */
+export interface SettingsStore {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+}
+export interface IdentityStores {
+    users: UserStore;
+    sessions: SessionStore;
+    tokens: TokenStore;
+    settings: SettingsStore;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/store/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE5D,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,YAAY,CAAC;IACtB,qEAAqE;IACrE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oEAAoE;AACpE,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,KAAK,EAAE,MAAM;CAI1B;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC9C,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC5D,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC3E,4FAA4F;IAC5F,UAAU,CAAC,KAAK,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,QAAQ,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;KACjD,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrB,iEAAiE;IACjE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,sFAAsF;IACtF,UAAU,CACR,EAAE,EAAE,MAAM,EACV,eAAe,EAAE,MAAM,EACvB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC,CAAC,GAC3D,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC3B,SAAS,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC/D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjD,0FAA0F;IAC1F,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC9G,4EAA4E;IAC5E,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC9F,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,sEAAsE;IACtE,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,iDAAiD;IACjD,OAAO,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACnF,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED,4FAA4F;AAC5F,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}

package/dist/store/types.js

@@ -0,0 +1,23 @@
+/**
+ * @pattern-js/mod-identity — store contracts.
+ *
+ * Three small stores behind interfaces so the persistence layer is swappable
+ * (sqlite ships built-in, in-memory for tests, Postgres later as a driver).
+ * Every mutation that can race is **compare-and-swap**: rows carry a `version`,
+ * writers pass the version they read, and a `null` return means "lost the
+ * race — re-read and retry". On SQL backends CAS is a single conditional
+ * UPDATE, which is what makes single-use tokens and session rotation hold
+ * across multiple instances; the in-process mutex on top only trims redundant
+ * retries on a single node.
+ *
+ * Secrets never hit storage: sessions and tokens store the sha256 of the
+ * opaque secret, so a leaked database can't impersonate anyone.
+ */
+/** Thrown when an insert hits the one-user-per-email constraint. */
+export class UniqueViolationError extends Error {
+    constructor(field) {
+        super(`unique constraint violated: ${field}`);
+        this.name = "UniqueViolationError";
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/store/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAyDH,oEAAoE;AACpE,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,KAAa;QACvB,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF"}

package/dist/tokens.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @pattern-js/mod-identity — secret helpers.
+ *
+ * Secrets are 256-bit random, base64url on the wire, sha256 at rest. Lookup
+ * is by hash (an exact index hit), so no constant-time comparison is needed —
+ * there is nothing secret-shaped to compare against.
+ */
+/** A fresh 256-bit secret, base64url (cookie- and URL-safe). */
+export declare function randomToken(): string;
+/** sha256 hex — the only form a secret takes in storage. */
+export declare function sha256hex(value: string): string;
+/** Normalize an email for identity purposes. */
+export declare function normalizeEmail(email: string): string;
+/** Loose-but-useful email shape check (real validation is the delivery). */
+export declare function looksLikeEmail(email: string): boolean;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,gEAAgE;AAChE,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,4DAA4D;AAC5D,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,gDAAgD;AAChD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD"}

package/dist/tokens.js

@@ -0,0 +1,25 @@
+/**
+ * @pattern-js/mod-identity — secret helpers.
+ *
+ * Secrets are 256-bit random, base64url on the wire, sha256 at rest. Lookup
+ * is by hash (an exact index hit), so no constant-time comparison is needed —
+ * there is nothing secret-shaped to compare against.
+ */
+import { createHash, randomBytes } from "node:crypto";
+/** A fresh 256-bit secret, base64url (cookie- and URL-safe). */
+export function randomToken() {
+    return randomBytes(32).toString("base64url");
+}
+/** sha256 hex — the only form a secret takes in storage. */
+export function sha256hex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+/** Normalize an email for identity purposes. */
+export function normalizeEmail(email) {
+    return email.trim().toLowerCase();
+}
+/** Loose-but-useful email shape check (real validation is the delivery). */
+export function looksLikeEmail(email) {
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim());
+}
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,gEAAgE;AAChE,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACzD,CAAC"}

package/dist/workflows.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @pattern-js/mod-identity — endpoint workflows.
+ *
+ * The auth surface IS a set of Pattern workflows (same self-reflection as the
+ * admin API): each route is `http.request → identity.<op> → http.response`.
+ * HTTP ops get the full status/headers/body wiring (cookies and redirects are
+ * the result); JSON ops wire a single body. All of these are public — the
+ * pages must be reachable logged-out, and the privileged surface is ops-only
+ * (admin-stamped invoke), not routes.
+ */
+import type { Workflow } from "@pattern-js/core";
+/** The identity routes under `mount` (default /auth). */
+export declare function endpointWorkflows(mount: string): Workflow[];
+//# sourceMappingURL=workflows.d.ts.map

package/dist/workflows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../src/workflows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAsFjD,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,EAAE,CAW3D"}

package/dist/workflows.js

@@ -0,0 +1,96 @@
+/**
+ * @pattern-js/mod-identity — endpoint workflows.
+ *
+ * The auth surface IS a set of Pattern workflows (same self-reflection as the
+ * admin API): each route is `http.request → identity.<op> → http.response`.
+ * HTTP ops get the full status/headers/body wiring (cookies and redirects are
+ * the result); JSON ops wire a single body. All of these are public — the
+ * pages must be reachable logged-out, and the privileged surface is ops-only
+ * (admin-stamped invoke), not routes.
+ */
+import { authOpRoutes } from "./ops.js";
+function endpoint(spec) {
+    if (spec.shape === "http") {
+        // Auth pages + redirects: decompose the request into the PURE op's discrete
+        // ports (query/body fields + the user-agent), run it, and wire its
+        // { body, redirect, cookies, status } onto the out-gate. The op never sees
+        // HTTP — Set-Cookie / Location are produced from its domain outputs here.
+        const io = authOpRoutes[spec.op];
+        if (!io)
+            throw new Error(`identity route "${spec.id}": no auth I/O for op "${spec.op}"`);
+        const nodes = [
+            { id: "in", op: "boundary.http.request", config: { method: spec.method, path: spec.path } },
+            { id: "call", op: spec.op },
+            { id: "ct", op: "core.const.object", config: { value: { "content-type": "text/html; charset=utf-8" } } },
+            { id: "out", op: "boundary.http.response", config: { mode: "buffered" } },
+        ];
+        const edges = [];
+        let wired = false;
+        if (io.query.length) {
+            wired = true;
+            nodes.push({ id: "ex_query", op: "core.object.extract", config: { keys: io.query } });
+            edges.push({ from: { node: "in", port: "query" }, to: { node: "ex_query", port: "object" } });
+            for (const k of io.query)
+                edges.push({ from: { node: "ex_query", port: k }, to: { node: "call", port: k } });
+        }
+        if (io.body.length) {
+            wired = true;
+            nodes.push({ id: "ex_body", op: "core.object.extract", config: { keys: io.body } });
+            edges.push({ from: { node: "in", port: "body" }, to: { node: "ex_body", port: "object" } });
+            for (const k of io.body)
+                edges.push({ from: { node: "ex_body", port: k }, to: { node: "call", port: k } });
+        }
+        if (io.userAgent) {
+            wired = true;
+            nodes.push({ id: "ex_ua", op: "core.object.get", config: { path: "user-agent" } });
+            edges.push({ from: { node: "in", port: "headers" }, to: { node: "ex_ua", port: "object" } });
+            edges.push({ from: { node: "ex_ua", port: "out" }, to: { node: "call", port: "userAgent" } });
+        }
+        if (!wired)
+            edges.push({ from: { node: "in", port: "out" }, to: { node: "call", port: "in" } });
+        edges.push({ from: { node: "call", port: "body" }, to: { node: "out", port: "body" } });
+        edges.push({ from: { node: "call", port: "redirect" }, to: { node: "out", port: "redirect" } });
+        edges.push({ from: { node: "call", port: "cookies" }, to: { node: "out", port: "cookies" } });
+        edges.push({ from: { node: "call", port: "status" }, to: { node: "out", port: "status" } });
+        edges.push({ from: { node: "ct", port: "out" }, to: { node: "out", port: "headers" } });
+        return { id: spec.id, name: `Identity · ${spec.method} ${spec.path}`, source: "code", nodes, edges };
+    }
+    // JSON route: decompose the query into the pure op's ports, run it, map its
+    // outcome with boundary.http.status (the op never sees HTTP).
+    const out = spec.out ?? "out";
+    const query = spec.query ?? [];
+    const nodes = [
+        { id: "in", op: "boundary.http.request", config: { method: spec.method, path: spec.path } },
+        { id: "call", op: spec.op },
+        { id: "status", op: "boundary.http.status" },
+        { id: "out", op: "boundary.http.response", config: { mode: "buffered" } },
+    ];
+    const edges = [];
+    if (query.length) {
+        nodes.push({ id: "ex_query", op: "core.object.extract", config: { keys: query } });
+        edges.push({ from: { node: "in", port: "query" }, to: { node: "ex_query", port: "object" } });
+        for (const k of query)
+            edges.push({ from: { node: "ex_query", port: k }, to: { node: "call", port: k } });
+    }
+    else {
+        edges.push({ from: { node: "in", port: "out" }, to: { node: "call", port: "in" } });
+    }
+    edges.push({ from: { node: "call", port: out }, to: { node: "status", port: "result" } });
+    edges.push({ from: { node: "status", port: "status" }, to: { node: "out", port: "status" } });
+    edges.push({ from: { node: "status", port: "body" }, to: { node: "out", port: "body" } });
+    return { id: spec.id, name: `Identity · ${spec.method} ${spec.path}`, source: "code", nodes, edges };
+}
+/** The identity routes under `mount` (default /auth). */
+export function endpointWorkflows(mount) {
+    const specs = [
+        { id: "identity.route.login", method: "GET", path: `${mount}/login`, op: "identity.login.page", shape: "http" },
+        { id: "identity.route.token", method: "GET", path: `${mount}/token`, op: "identity.token.callback", shape: "http" },
+        { id: "identity.route.logout", method: "POST", path: `${mount}/logout`, op: "identity.logout", shape: "http" },
+        { id: "identity.route.whoami", method: "GET", path: `${mount}/whoami`, op: "identity.whoami", shape: "json", out: "whoami" },
+        { id: "identity.route.welcome", method: "GET", path: `${mount}/welcome`, op: "identity.welcome.page", shape: "http" },
+        { id: "identity.route.bootstrap", method: "GET", path: `${mount}/bootstrap`, op: "identity.bootstrap.page", shape: "http" },
+        { id: "identity.route.bootstrap.submit", method: "POST", path: `${mount}/bootstrap`, op: "identity.bootstrap.submit", shape: "http" },
+    ];
+    return specs.map(endpoint);
+}
+//# sourceMappingURL=workflows.js.map

package/dist/workflows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../src/workflows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAkBxC,SAAS,QAAQ,CAAC,IAAkB;IAClC,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC1B,4EAA4E;QAC5E,mEAAmE;QACnE,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,EAAE,0BAA0B,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACzF,MAAM,KAAK,GAAsB;YAC/B,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE;YAC3F,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YAC3B,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,EAAE,EAAE;YACxG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;SAC1E,CAAC;QACF,MAAM,KAAK,GAAsB,EAAE,CAAC;QACpC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,GAAG,IAAI,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9F,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,GAAG,IAAI,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5F,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;YACjB,KAAK,GAAG,IAAI,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC7F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAChG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAChG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACvG,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAsB;QAC/B,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE;QAC3F,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,sBAAsB,EAAE;QAC5C,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;KAC1E,CAAC;IACF,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9F,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC1F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACvG,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAmB;QAC5B,EAAE,EAAE,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,QAAQ,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE;QAC/G,EAAE,EAAE,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,QAAQ,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE;QACnH,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE;QAC9G,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE;QAC5H,EAAE,EAAE,EAAE,wBAAwB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE;QACrH,EAAE,EAAE,EAAE,0BAA0B,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE;QAC3H,EAAE,EAAE,EAAE,iCAAiC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE;KACtI,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC"}