@raybase/core 0.0.2 → 0.3.3

package/dist/auth-password-secret.js

@@ -0,0 +1,409 @@
+import { actorAuditRef, recordAudit } from "./audit.js";
+import { backupProviderLimits, RaybaseBackupError } from "./backup-crypto.js";
+import { nowIso } from "./sql.js";
+export const raybaseAuthPasswordSecretStateTableName = "_auth_password_secret_state";
+export const raybaseAuthPasswordProviderStateTableName = "_auth_password_provider_state";
+export const raybasePasswordSecretPurpose = "backup-key-provider";
+export const raybasePasswordSecretKdfProfile = {
+    algorithm: "PBKDF2-SHA-256",
+    version: 1,
+    iterations: 600_000,
+    outputBytes: 32,
+    saltBytes: 16
+};
+const encoder = new TextEncoder();
+const providerStateKeyPattern = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/;
+const providerIdPattern = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
+const lifecycleFailureCode = "PASSWORD_SECRET_PROVIDER_HOOK_FAILED";
+function encodeBase64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function decodeBase64Url(value) {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+    const binary = atob(padded);
+    return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+function ownedBuffer(value) {
+    const copy = new Uint8Array(value.byteLength);
+    copy.set(value);
+    return copy.buffer;
+}
+function purposeForProvider(providerId) {
+    const normalized = providerId.trim();
+    if (!providerIdPattern.test(normalized) ||
+        encoder.encode(normalized).byteLength > backupProviderLimits.identifierBytes) {
+        throw new Error("Backup password-secret provider id is invalid");
+    }
+    return `${raybasePasswordSecretPurpose}:${normalized}`;
+}
+function providerVersion(registration) {
+    const value = registration.lifecycle.version.trim();
+    if (!providerIdPattern.test(value) ||
+        encoder.encode(value).byteLength > backupProviderLimits.identifierBytes) {
+        throw new Error("Backup password-secret lifecycle version is invalid");
+    }
+    return value;
+}
+function kdfDescriptor(row) {
+    if (row.kdfAlgorithm !== raybasePasswordSecretKdfProfile.algorithm ||
+        !Number.isSafeInteger(row.kdfVersion) ||
+        row.kdfVersion < 1 ||
+        !Number.isSafeInteger(row.kdfIterations) ||
+        row.kdfIterations < 100_000 ||
+        row.kdfIterations > 2_000_000 ||
+        row.kdfOutputBytes !== 32) {
+        throw new Error("Stored password-secret KDF descriptor is invalid");
+    }
+    let salt;
+    try {
+        salt = decodeBase64Url(row.salt);
+    }
+    catch {
+        throw new Error("Stored password-secret KDF descriptor is invalid");
+    }
+    try {
+        if (salt.byteLength < 1 ||
+            salt.byteLength > backupProviderLimits.saltBytes ||
+            encodeBase64Url(salt) !== row.salt) {
+            throw new Error("Stored password-secret KDF descriptor is invalid");
+        }
+    }
+    finally {
+        salt.fill(0);
+    }
+    return {
+        algorithm: "PBKDF2-SHA-256",
+        version: row.kdfVersion,
+        salt: row.salt,
+        iterations: row.kdfIterations,
+        outputBytes: 32
+    };
+}
+export async function deriveRaybasePasswordSecret(password, descriptor) {
+    if (descriptor.algorithm !== "PBKDF2-SHA-256" ||
+        !Number.isSafeInteger(descriptor.version) ||
+        descriptor.version < 1 ||
+        !Number.isSafeInteger(descriptor.iterations) ||
+        descriptor.iterations < 100_000 ||
+        descriptor.iterations > 2_000_000 ||
+        descriptor.outputBytes !== 32) {
+        throw new Error("Password-secret KDF descriptor is invalid");
+    }
+    const salt = decodeBase64Url(descriptor.salt);
+    if (!salt.byteLength || salt.byteLength > backupProviderLimits.saltBytes) {
+        throw new Error("Stored password-secret salt is invalid");
+    }
+    const domainSeparatedPassword = encoder.encode(`raybase:${raybasePasswordSecretPurpose}:v${descriptor.version}\u0000${password}`);
+    try {
+        const key = await crypto.subtle.importKey("raw", ownedBuffer(domainSeparatedPassword), { name: "PBKDF2" }, false, ["deriveBits"]);
+        const bits = await crypto.subtle.deriveBits({
+            name: "PBKDF2",
+            hash: "SHA-256",
+            salt: ownedBuffer(salt),
+            iterations: descriptor.iterations
+        }, key, descriptor.outputBytes * 8);
+        return new Uint8Array(bits);
+    }
+    finally {
+        domainSeparatedPassword.fill(0);
+        salt.fill(0);
+    }
+}
+async function ensureStateRow(db, registration, userId, event, occurredAt) {
+    const purpose = purposeForProvider(registration.providerId);
+    const salt = encodeBase64Url(crypto.getRandomValues(new Uint8Array(raybasePasswordSecretKdfProfile.saltBytes)));
+    await db.run(`INSERT OR IGNORE INTO "${raybaseAuthPasswordSecretStateTableName}"
+      ("userId", "purpose", "salt", "kdfAlgorithm", "kdfVersion", "kdfIterations", "kdfOutputBytes",
+       "passwordVersion", "pendingEvent", "readiness", "createdAt", "updatedAt")
+     VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?, 'needs-login', ?, ?)`, [
+        userId,
+        purpose,
+        salt,
+        raybasePasswordSecretKdfProfile.algorithm,
+        raybasePasswordSecretKdfProfile.version,
+        raybasePasswordSecretKdfProfile.iterations,
+        raybasePasswordSecretKdfProfile.outputBytes,
+        event,
+        occurredAt,
+        occurredAt
+    ]);
+    const row = await db.first(`SELECT * FROM "${raybaseAuthPasswordSecretStateTableName}" WHERE "userId" = ? AND "purpose" = ?`, [userId, purpose]);
+    if (!row)
+        throw new Error("Unable to provision password-secret lifecycle state");
+    return row;
+}
+function providerStateStore(db, registration, userId, purpose) {
+    const checkedKey = (key) => {
+        if (!providerStateKeyPattern.test(key) || encoder.encode(key).byteLength > 128) {
+            throw new Error("Backup password-secret provider state key is invalid");
+        }
+        return key;
+    };
+    return {
+        async get(key) {
+            const row = await db.first(`SELECT "value" FROM "${raybaseAuthPasswordProviderStateTableName}"
+         WHERE "userId" = ? AND "purpose" = ? AND "providerId" = ? AND "stateKey" = ?`, [userId, purpose, registration.providerId, checkedKey(key)]);
+            return row ? decodeBase64Url(row.value) : null;
+        },
+        async put(key, value) {
+            if (!(value instanceof Uint8Array))
+                throw new Error("Backup password-secret provider state must be bytes");
+            if (value.byteLength > backupProviderLimits.providerStateBytes) {
+                throw new Error(`Backup password-secret provider state exceeds ${backupProviderLimits.providerStateBytes} bytes`);
+            }
+            await db.run(`INSERT INTO "${raybaseAuthPasswordProviderStateTableName}"
+          ("userId", "purpose", "providerId", "stateKey", "value", "updatedAt")
+         VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT ("userId", "purpose", "providerId", "stateKey")
+         DO UPDATE SET "value" = excluded."value", "updatedAt" = excluded."updatedAt"`, [userId, purpose, registration.providerId, checkedKey(key), encodeBase64Url(value), nowIso()]);
+        },
+        async delete(key) {
+            await db.run(`DELETE FROM "${raybaseAuthPasswordProviderStateTableName}"
+         WHERE "userId" = ? AND "purpose" = ? AND "providerId" = ? AND "stateKey" = ?`, [userId, purpose, registration.providerId, checkedKey(key)]);
+        }
+    };
+}
+function providerStateReader(db, registration, userId, purpose, retained, active) {
+    const checkedKey = (key) => {
+        if (!providerStateKeyPattern.test(key) || encoder.encode(key).byteLength > 128) {
+            throw new Error("Backup password-secret provider state key is invalid");
+        }
+        return key;
+    };
+    return Object.freeze({
+        async get(key) {
+            if (!active())
+                throw new Error("Backup wrap participant state is no longer available");
+            const row = await db.first(`SELECT "value" FROM "${raybaseAuthPasswordProviderStateTableName}"
+         WHERE "userId" = ? AND "purpose" = ? AND "providerId" = ? AND "stateKey" = ?`, [userId, purpose, registration.providerId, checkedKey(key)]);
+            if (!active())
+                throw new Error("Backup wrap participant state is no longer available");
+            if (!row)
+                return null;
+            const value = decodeBase64Url(row.value);
+            if (value.byteLength > backupProviderLimits.providerStateBytes) {
+                value.fill(0);
+                throw new Error("Stored backup password-secret provider state exceeds its byte limit");
+            }
+            retained.push(value);
+            return value;
+        }
+    });
+}
+/**
+ * Resolve selected ready subjects into fresh wrap-time KDF/state views. The
+ * caller must release the result immediately after `wrapDek` settles.
+ */
+export async function createRaybasePasswordWrapParticipants(db, registration, userIds) {
+    const purpose = purposeForProvider(registration.providerId);
+    const ids = [...userIds];
+    if (!ids.length || new Set(ids).size !== ids.length) {
+        throw new RaybaseBackupError("BACKUP_THRESHOLD_UNMET", "Backup password-secret participant ids are invalid");
+    }
+    const rows = await db.all(`SELECT * FROM "${raybaseAuthPasswordSecretStateTableName}"
+     WHERE "purpose" = ? AND "userId" IN (${ids.map(() => "?").join(", ")})`, [purpose, ...ids]);
+    const byUser = new Map(rows.map((row) => [row.userId, row]));
+    const retained = [];
+    let active = true;
+    const participants = [];
+    try {
+        for (const userId of ids) {
+            const row = byUser.get(userId);
+            if (!row ||
+                row.providerId !== registration.providerId ||
+                row.providerVersion !== providerVersion(registration) ||
+                row.lastFailureCode !== null ||
+                (row.readiness !== "ready" && row.readiness !== "reset-destructive")) {
+                throw new RaybaseBackupError("BACKUP_THRESHOLD_UNMET", "Backup password-secret participants are not ready");
+            }
+            participants.push(Object.freeze({
+                userId,
+                kdf: Object.freeze(kdfDescriptor(row)),
+                state: providerStateReader(db, registration, userId, purpose, retained, () => active)
+            }));
+        }
+    }
+    catch (error) {
+        active = false;
+        for (const value of retained)
+            value.fill(0);
+        throw error;
+    }
+    return {
+        participants: Object.freeze(participants),
+        release() {
+            if (!active)
+                return;
+            active = false;
+            for (const value of retained)
+                value.fill(0);
+            retained.length = 0;
+        }
+    };
+}
+async function auditLifecycle(db, userId, registration, event, outcome, metadata) {
+    await recordAudit(db, {
+        actor: actorAuditRef(userId),
+        action: `auth.password_secret.lifecycle.${outcome}`,
+        target: { type: raybaseAuthPasswordSecretStateTableName, id: userId },
+        metadata: {
+            event,
+            providerId: registration.providerId,
+            providerVersion: providerVersion(registration),
+            ...metadata
+        }
+    });
+}
+/**
+ * Runs only after Core has observed a successful password lifecycle operation.
+ * Every failure is reduced to an audit-safe code and swallowed so auth success
+ * is never rewritten as an HTTP failure.
+ */
+export async function runRaybasePasswordSecretLifecycle(input) {
+    if (!input.registration)
+        return "not-configured";
+    const occurredAt = nowIso();
+    let secret;
+    let previousSecret;
+    let row;
+    try {
+        row = await ensureStateRow(input.db, input.registration, input.userId, input.event, occurredAt);
+        const purpose = row.purpose;
+        const transition = input.event === "password-change" || input.event === "password-reset"
+            ? input.event
+            : row.pendingEvent ?? (row.passwordVersion === 0 ? input.event : null);
+        await input.db.run(`UPDATE "${raybaseAuthPasswordSecretStateTableName}"
+       SET "pendingEvent" = ?, "readiness" = 'needs-login',
+           "destructiveResetAt" = CASE WHEN ? = 'password-reset' THEN ? ELSE "destructiveResetAt" END,
+           "updatedAt" = ?
+       WHERE "userId" = ? AND "purpose" = ?`, [transition, input.event, occurredAt, occurredAt, input.userId, purpose]);
+        const descriptor = kdfDescriptor(row);
+        secret = await deriveRaybasePasswordSecret(input.password, descriptor);
+        if (input.event === "password-change" && input.previousPassword !== undefined) {
+            previousSecret = await deriveRaybasePasswordSecret(input.previousPassword, descriptor);
+        }
+        await input.registration.lifecycle.onPasswordSecret({
+            event: input.event,
+            userId: input.userId,
+            occurredAt,
+            ...(input.environment ? { environment: input.environment } : {}),
+            kdf: descriptor,
+            secret,
+            ...(previousSecret ? { previousSecret } : {}),
+            state: providerStateStore(input.db, input.registration, input.userId, purpose),
+            signal: input.signal ?? new AbortController().signal
+        });
+        const advancesPasswordVersion = Boolean(transition);
+        const nextPasswordVersion = advancesPasswordVersion
+            ? Math.max(1, row.passwordVersion + 1)
+            : Math.max(1, row.passwordVersion);
+        const destructiveReset = transition === "password-reset" || Boolean(row.destructiveResetAt);
+        await input.db.run(`UPDATE "${raybaseAuthPasswordSecretStateTableName}"
+       SET "passwordVersion" = ?, "pendingEvent" = NULL, "providerId" = ?, "providerVersion" = ?,
+           "readiness" = ?, "lastSuccessEvent" = ?, "lastSuccessAt" = ?,
+           "lastFailureCode" = NULL, "lastFailureAt" = NULL, "updatedAt" = ?
+       WHERE "userId" = ? AND "purpose" = ?`, [
+            nextPasswordVersion,
+            input.registration.providerId,
+            providerVersion(input.registration),
+            destructiveReset ? "reset-destructive" : "ready",
+            input.event,
+            occurredAt,
+            occurredAt,
+            input.userId,
+            purpose
+        ]);
+        await auditLifecycle(input.db, input.userId, input.registration, input.event, "succeeded", {
+            kdfVersion: descriptor.version,
+            passwordVersion: nextPasswordVersion,
+            destructiveReset
+        }).catch(() => undefined);
+        return "succeeded";
+    }
+    catch {
+        if (row) {
+            await input.db.run(`UPDATE "${raybaseAuthPasswordSecretStateTableName}"
+         SET "readiness" = CASE
+               WHEN "destructiveResetAt" IS NOT NULL THEN 'reset-destructive'
+               WHEN "pendingEvent" = 'password-change' THEN 'change-destructive'
+               ELSE 'needs-login'
+             END,
+             "lastFailureCode" = ?, "lastFailureAt" = ?, "updatedAt" = ?
+         WHERE "userId" = ? AND "purpose" = ?`, [lifecycleFailureCode, occurredAt, occurredAt, input.userId, row.purpose]).catch(() => undefined);
+        }
+        await auditLifecycle(input.db, input.userId, input.registration, input.event, "failed", {
+            failureCode: lifecycleFailureCode
+        }).catch(() => undefined);
+        return "failed";
+    }
+    finally {
+        secret?.fill(0);
+        previousSecret?.fill(0);
+    }
+}
+function readinessFromRow(row, registration) {
+    const providerMatches = row.providerId === registration.providerId &&
+        row.providerVersion === providerVersion(registration);
+    const status = row.purpose === null
+        ? row.hasCredential
+            ? "needs-login"
+            : "no-password-lifecycle"
+        : !providerMatches
+            ? "needs-login"
+            : row.readiness === "ready"
+                ? "ready"
+                : row.readiness === "change-destructive"
+                    ? "change-destructive"
+                    : row.readiness === "reset-destructive"
+                        ? "reset-destructive"
+                        : "needs-login";
+    return {
+        userId: row.userId,
+        providerId: registration.providerId,
+        providerVersion: providerVersion(registration),
+        status,
+        readyForNewBackups: providerMatches &&
+            row.lastFailureCode === null &&
+            (status === "ready" || status === "reset-destructive"),
+        passwordVersion: Number(row.passwordVersion ?? 0),
+        lastSuccessEvent: row.lastSuccessEvent ?? null,
+        lastSuccessAt: row.lastSuccessAt ?? null,
+        lastFailureCode: row.lastFailureCode ?? null,
+        lastFailureAt: row.lastFailureAt ?? null,
+        destructiveResetAt: row.destructiveResetAt ?? null
+    };
+}
+export async function listRaybasePasswordSecretReadiness(db, registration, userIds) {
+    const purpose = purposeForProvider(registration.providerId);
+    const ids = userIds?.filter(Boolean) ?? [];
+    const where = ids.length ? `WHERE u."id" IN (${ids.map(() => "?").join(", ")})` : "";
+    const rows = await db.all(`SELECT
+       u."id" AS "userId",
+       s."purpose", s."salt", s."kdfAlgorithm", s."kdfVersion", s."kdfIterations", s."kdfOutputBytes",
+       s."passwordVersion", s."pendingEvent", s."providerId", s."providerVersion", s."readiness",
+       s."lastSuccessEvent", s."lastSuccessAt", s."lastFailureCode", s."lastFailureAt", s."destructiveResetAt",
+       EXISTS(
+         SELECT 1 FROM "_auth_accounts" a
+         WHERE a."userId" = u."id" AND a."providerId" = 'credential' AND a."password" IS NOT NULL
+       ) AS "hasCredential"
+     FROM "_auth_users" u
+     LEFT JOIN "${raybaseAuthPasswordSecretStateTableName}" s
+       ON s."userId" = u."id" AND s."purpose" = ?
+     ${where}
+     ORDER BY u."id"`, [purpose, ...ids]);
+    return rows.map((row) => readinessFromRow(row, registration));
+}
+export async function assertRaybasePasswordSecretParticipantsReady(db, registration, requiredUserIds) {
+    const uniqueIds = Array.from(new Set(requiredUserIds.filter(Boolean)));
+    const readiness = await listRaybasePasswordSecretReadiness(db, registration, uniqueIds);
+    const byUser = new Map(readiness.map((item) => [item.userId, item]));
+    const unavailable = uniqueIds.filter((userId) => !byUser.get(userId)?.readyForNewBackups);
+    if (unavailable.length) {
+        throw new RaybaseBackupError("BACKUP_THRESHOLD_UNMET", `Backup password-secret participants are not ready (${unavailable.length} unavailable)`);
+    }
+    return readiness;
+}
+//# sourceMappingURL=auth-password-secret.js.map

package/dist/auth-password-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-password-secret.js","sourceRoot":"","sources":["../src/auth-password-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAOnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,MAAM,CAAC,MAAM,uCAAuC,GAAG,6BAA6B,CAAC;AACrF,MAAM,CAAC,MAAM,yCAAyC,GAAG,+BAA+B,CAAC;AACzF,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC;AAElE,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,SAAS,EAAE,gBAAgB;IAC3B,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,OAAO;IACnB,WAAW,EAAE,EAAE;IACf,SAAS,EAAE,EAAE;CACL,CAAC;AAgDX,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AACvE,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAC3D,MAAM,oBAAoB,GAAG,sCAAsC,CAAC;AAEpE,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IACrC,IACE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,GAAG,oBAAoB,CAAC,eAAe,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,4BAA4B,IAAI,UAAU,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,YAAwD;IAC/E,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACpD,IACE,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,oBAAoB,CAAC,eAAe,EACvE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAA2B;IAChD,IACE,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,SAAS;QAC9D,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;QACrC,GAAG,CAAC,UAAU,GAAG,CAAC;QAClB,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;QACxC,GAAG,CAAC,aAAa,GAAG,OAAO;QAC3B,GAAG,CAAC,aAAa,GAAG,SAAS;QAC7B,GAAG,CAAC,cAAc,KAAK,EAAE,EACzB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC;QACH,IACE,IAAI,CAAC,UAAU,GAAG,CAAC;YACnB,IAAI,CAAC,UAAU,GAAG,oBAAoB,CAAC,SAAS;YAChD,eAAe,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IACD,OAAO;QACL,SAAS,EAAE,gBAAgB;QAC3B,OAAO,EAAE,GAAG,CAAC,UAAU;QACvB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAgB,EAChB,UAAyE;IAEzE,IACE,UAAU,CAAC,SAAS,KAAK,gBAAgB;QACzC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;QACzC,UAAU,CAAC,OAAO,GAAG,CAAC;QACtB,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC;QAC5C,UAAU,CAAC,UAAU,GAAG,OAAO;QAC/B,UAAU,CAAC,UAAU,GAAG,SAAS;QACjC,UAAU,CAAC,WAAW,KAAK,EAAE,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAC5C,WAAW,4BAA4B,KAAK,UAAU,CAAC,OAAO,SAAS,QAAQ,EAAE,CAClF,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,WAAW,CAAC,uBAAuB,CAAC,EACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;YACE,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;YACvB,UAAU,EAAE,UAAU,CAAC,UAAU;SAClC,EACD,GAAG,EACH,UAAU,CAAC,WAAW,GAAG,CAAC,CAC3B,CAAC;QACF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,EAAe,EACf,YAAwD,EACxD,MAAc,EACd,KAAoC,EACpC,UAAkB;IAElB,MAAM,OAAO,GAAG,kBAAkB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,+BAA+B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAChH,MAAM,EAAE,CAAC,GAAG,CACV,0BAA0B,uCAAuC;;;6DAGR,EACzD;QACE,MAAM;QACN,OAAO;QACP,IAAI;QACJ,+BAA+B,CAAC,SAAS;QACzC,+BAA+B,CAAC,OAAO;QACvC,+BAA+B,CAAC,UAAU;QAC1C,+BAA+B,CAAC,WAAW;QAC3C,KAAK;QACL,UAAU;QACV,UAAU;KACX,CACF,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CACxB,kBAAkB,uCAAuC,wCAAwC,EACjG,CAAC,MAAM,EAAE,OAAO,CAAC,CAClB,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CACzB,EAAe,EACf,YAAwD,EACxD,MAAc,EACd,OAAe;IAEf,MAAM,UAAU,GAAG,CAAC,GAAW,EAAU,EAAE;QACzC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CACxB,wBAAwB,yCAAyC;sFACa,EAC9E,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAC5D,CAAC;YACF,OAAO,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;YAClB,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YAC3G,IAAI,KAAK,CAAC,UAAU,GAAG,oBAAoB,CAAC,kBAAkB,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,iDAAiD,oBAAoB,CAAC,kBAAkB,QAAQ,CAAC,CAAC;YACpH,CAAC;YACD,MAAM,EAAE,CAAC,GAAG,CACV,gBAAgB,yCAAyC;;;;sFAIqB,EAC9E,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAC9F,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,EAAE,CAAC,GAAG,CACV,gBAAgB,yCAAyC;sFACqB,EAC9E,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAC5D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,EAAe,EACf,YAAwD,EACxD,MAAc,EACd,OAAe,EACf,QAAsB,EACtB,MAAqB;IAErB,MAAM,UAAU,GAAG,CAAC,GAAW,EAAU,EAAE;QACzC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,GAAW;YACnB,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YACvF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CACxB,wBAAwB,yCAAyC;sFACa,EAC9E,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAC5D,CAAC;YACF,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YACvF,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,UAAU,GAAG,oBAAoB,CAAC,kBAAkB,EAAE,CAAC;gBAC/D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACzF,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,EAAe,EACf,YAAwD,EACxD,OAA0B;IAK1B,MAAM,OAAO,GAAG,kBAAkB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,oDAAoD,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CACvB,kBAAkB,uCAAuC;4CACjB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACxE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,CAClB,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IACE,CAAC,GAAG;gBACJ,GAAG,CAAC,UAAU,KAAK,YAAY,CAAC,UAAU;gBAC1C,GAAG,CAAC,eAAe,KAAK,eAAe,CAAC,YAAY,CAAC;gBACrD,GAAG,CAAC,eAAe,KAAK,IAAI;gBAC5B,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO,IAAI,GAAG,CAAC,SAAS,KAAK,mBAAmB,CAAC,EACpE,CAAC;gBACD,MAAM,IAAI,kBAAkB,CAC1B,wBAAwB,EACxB,mDAAmD,CACpD,CAAC;YACJ,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC9B,MAAM;gBACN,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBACtC,KAAK,EAAE,mBAAmB,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;aACtF,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,KAAK,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,OAAO;YACL,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,GAAG,KAAK,CAAC;YACf,KAAK,MAAM,KAAK,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,EAAe,EACf,MAAc,EACd,YAAwD,EACxD,KAAoC,EACpC,OAA+B,EAC/B,QAAiC;IAEjC,MAAM,WAAW,CAAC,EAAE,EAAE;QACpB,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC;QAC5B,MAAM,EAAE,kCAAkC,OAAO,EAAE;QACnD,MAAM,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE,EAAE,EAAE,MAAM,EAAE;QACrE,QAAQ,EAAE;YACR,KAAK;YACL,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,eAAe,EAAE,eAAe,CAAC,YAAY,CAAC;YAC9C,GAAG,QAAQ;SACZ;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KASvD;IACC,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,gBAAgB,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;IAC5B,IAAI,MAA8B,CAAC;IACnC,IAAI,cAAsC,CAAC;IAC3C,IAAI,GAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,MAAM,UAAU,GACd,KAAK,CAAC,KAAK,KAAK,iBAAiB,IAAI,KAAK,CAAC,KAAK,KAAK,gBAAgB;YACnE,CAAC,CAAC,KAAK,CAAC,KAAK;YACb,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,CAChB,WAAW,uCAAuC;;;;4CAIZ,EACtC,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CACzE,CAAC;QAEF,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,KAAK,KAAK,iBAAiB,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC9E,cAAc,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,gBAAgB,CAAC;YAClD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU;YACV,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,EAAE,UAAU;YACf,MAAM;YACN,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC;YAC9E,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM;SACrD,CAAC,CAAC;QAEH,MAAM,uBAAuB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACpD,MAAM,mBAAmB,GAAG,uBAAuB;YACjD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,eAAe,GAAG,CAAC,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,gBAAgB,GAAG,UAAU,KAAK,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC5F,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,CAChB,WAAW,uCAAuC;;;;4CAIZ,EACtC;YACE,mBAAmB;YACnB,KAAK,CAAC,YAAY,CAAC,UAAU;YAC7B,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC;YACnC,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO;YAChD,KAAK,CAAC,KAAK;YACX,UAAU;YACV,UAAU;YACV,KAAK,CAAC,MAAM;YACZ,OAAO;SACR,CACF,CAAC;QACF,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE;YACzF,UAAU,EAAE,UAAU,CAAC,OAAO;YAC9B,eAAe,EAAE,mBAAmB;YACpC,gBAAgB;SACjB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,WAAW,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,CAChB,WAAW,uCAAuC;;;;;;;8CAOZ,EACtC,CAAC,oBAAoB,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAC1E,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE;YACtF,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAOD,SAAS,gBAAgB,CACvB,GAAsB,EACtB,YAAwD;IAExD,MAAM,eAAe,GACnB,GAAG,CAAC,UAAU,KAAK,YAAY,CAAC,UAAU;QAC1C,GAAG,CAAC,eAAe,KAAK,eAAe,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,MAAM,GACV,GAAG,CAAC,OAAO,KAAK,IAAI;QAClB,CAAC,CAAC,GAAG,CAAC,aAAa;YACjB,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,uBAAuB;QAC3B,CAAC,CAAC,CAAC,eAAe;YAChB,CAAC,CAAC,aAAa;YACjB,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO;gBACzB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,oBAAoB;oBACtC,CAAC,CAAC,oBAAoB;oBACxB,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,mBAAmB;wBACrC,CAAC,CAAC,mBAAmB;wBACrB,CAAC,CAAC,aAAa,CAAC;IACxB,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,YAAY,CAAC,UAAU;QACnC,eAAe,EAAE,eAAe,CAAC,YAAY,CAAC;QAC9C,MAAM;QACN,kBAAkB,EAChB,eAAe;YACf,GAAG,CAAC,eAAe,KAAK,IAAI;YAC5B,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,mBAAmB,CAAC;QACxD,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC;QACjD,gBAAgB,EAAG,GAAG,CAAC,gBAAyD,IAAI,IAAI;QACxF,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;QACxC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;QACxC,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,IAAI;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,EAAe,EACf,YAAwD,EACxD,OAA2B;IAE3B,MAAM,OAAO,GAAG,kBAAkB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CACvB;;;;;;;;;;kBAUc,uCAAuC;;OAElD,KAAK;qBACS,EACjB,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,CAClB,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,EAAe,EACf,YAAwD,EACxD,eAAkC;IAElC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,kCAAkC,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC1F,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAC1B,wBAAwB,EACxB,sDAAsD,WAAW,CAAC,MAAM,eAAe,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/auth-schema.d.ts

@@ -0,0 +1,120 @@
+export type UserRow = {
+    id: string;
+    name: string;
+    email: string;
+    emailVerified: number | boolean;
+    image: string | null;
+    createdAt: number | string;
+    updatedAt: number | string;
+    operatorRole: string | null;
+    appRoles: string | null;
+    banned: number | boolean | null;
+    banReason: string | null;
+    banExpires: number | string | null;
+};
+export type SessionRow = {
+    id: string;
+    userId: string;
+    token: string;
+    expiresAt: number | string;
+    ipAddress: string | null;
+    userAgent: string | null;
+    createdAt: number | string;
+    updatedAt: number | string;
+    impersonatedBy: string | null;
+};
+export type AccountRow = {
+    id: string;
+    accountId: string;
+    providerId: string;
+    userId: string;
+    accessToken: string | null;
+    refreshToken: string | null;
+    idToken: string | null;
+    accessTokenExpiresAt: number | string | null;
+    refreshTokenExpiresAt: number | string | null;
+    scope: string | null;
+    password: string | null;
+    createdAt: number | string;
+    updatedAt: number | string;
+};
+export type VerificationRow = {
+    id: string;
+    identifier: string;
+    value: string;
+    expiresAt: number | string;
+    createdAt: number | string | null;
+    updatedAt: number | string | null;
+};
+export type PasskeyRow = {
+    id: string;
+    name: string | null;
+    publicKey: string;
+    userId: string;
+    credentialID: string;
+    counter: number;
+    deviceType: string;
+    backedUp: number | boolean;
+    transports: string | null;
+    createdAt: number | string | null;
+    aaguid: string | null;
+};
+export type RaybaseAuthPendingRow = {
+    id: string;
+    purpose: string;
+    tokenJti: string;
+    tokenHash: string;
+    providerId: string;
+    expectedEmail: string | null;
+    operatorRole: string | null;
+    appRoles: string;
+    nonceHash: string;
+    status: string;
+    updatesChoice: string | null;
+    createdAt: string;
+    expiresAt: string;
+    consumedAt: string | null;
+    error: string | null;
+};
+export declare const authUserTableName = "_auth_users";
+export declare const authSessionTableName = "_auth_sessions";
+export declare const authAccountTableName = "_auth_accounts";
+export declare const authVerificationTableName = "_auth_verifications";
+export declare const authPasskeyTableName = "_auth_passkeys";
+export declare const authPasswordSecretStateTableName = "_auth_password_secret_state";
+export declare const authPasswordProviderStateTableName = "_auth_password_provider_state";
+export declare const raybaseSystemTableSql = "\nCREATE TABLE IF NOT EXISTS \"_auth_users\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"name\" TEXT NOT NULL,\n  \"email\" TEXT NOT NULL,\n  \"emailVerified\" INTEGER NOT NULL DEFAULT false,\n  \"image\" TEXT,\n  \"createdAt\" INTEGER NOT NULL,\n  \"updatedAt\" INTEGER NOT NULL,\n  \"operatorRole\" TEXT,\n  \"appRoles\" TEXT,\n  \"banned\" INTEGER DEFAULT false,\n  \"banReason\" TEXT,\n  \"banExpires\" INTEGER\n);\n\nCREATE UNIQUE INDEX IF NOT EXISTS \"_auth_users_email_unique\" ON \"_auth_users\" (\"email\");\nCREATE INDEX IF NOT EXISTS \"_auth_users_email_idx\" ON \"_auth_users\" (\"email\");\n\nCREATE TABLE IF NOT EXISTS \"_auth_sessions\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"userId\" TEXT NOT NULL,\n  \"token\" TEXT NOT NULL,\n  \"expiresAt\" INTEGER NOT NULL,\n  \"ipAddress\" TEXT,\n  \"userAgent\" TEXT,\n  \"createdAt\" INTEGER NOT NULL,\n  \"updatedAt\" INTEGER NOT NULL,\n  \"impersonatedBy\" TEXT,\n  FOREIGN KEY (\"userId\") REFERENCES \"_auth_users\"(\"id\") ON UPDATE no action ON DELETE cascade\n);\n\nCREATE UNIQUE INDEX IF NOT EXISTS \"_auth_sessions_token_unique\" ON \"_auth_sessions\" (\"token\");\nCREATE INDEX IF NOT EXISTS \"_auth_sessions_user_id_idx\" ON \"_auth_sessions\" (\"userId\");\nCREATE INDEX IF NOT EXISTS \"_auth_sessions_token_idx\" ON \"_auth_sessions\" (\"token\");\n\nCREATE TABLE IF NOT EXISTS \"_auth_accounts\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"accountId\" TEXT NOT NULL,\n  \"providerId\" TEXT NOT NULL,\n  \"userId\" TEXT NOT NULL,\n  \"accessToken\" TEXT,\n  \"refreshToken\" TEXT,\n  \"idToken\" TEXT,\n  \"accessTokenExpiresAt\" INTEGER,\n  \"refreshTokenExpiresAt\" INTEGER,\n  \"scope\" TEXT,\n  \"password\" TEXT,\n  \"createdAt\" INTEGER NOT NULL,\n  \"updatedAt\" INTEGER NOT NULL,\n  FOREIGN KEY (\"userId\") REFERENCES \"_auth_users\"(\"id\") ON UPDATE no action ON DELETE cascade\n);\n\nCREATE INDEX IF NOT EXISTS \"_auth_accounts_user_id_idx\" ON \"_auth_accounts\" (\"userId\");\nCREATE INDEX IF NOT EXISTS \"_auth_accounts_provider_idx\" ON \"_auth_accounts\" (\"providerId\",\"accountId\");\n\nCREATE TABLE IF NOT EXISTS \"_auth_verifications\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"identifier\" TEXT NOT NULL,\n  \"value\" TEXT NOT NULL,\n  \"expiresAt\" INTEGER NOT NULL,\n  \"createdAt\" INTEGER,\n  \"updatedAt\" INTEGER\n);\n\nCREATE INDEX IF NOT EXISTS \"_auth_verifications_identifier_idx\" ON \"_auth_verifications\" (\"identifier\");\n\nCREATE TABLE IF NOT EXISTS \"_auth_passkeys\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"name\" TEXT,\n  \"publicKey\" TEXT NOT NULL,\n  \"userId\" TEXT NOT NULL,\n  \"credentialID\" TEXT NOT NULL,\n  \"counter\" INTEGER NOT NULL,\n  \"deviceType\" TEXT NOT NULL,\n  \"backedUp\" INTEGER NOT NULL,\n  \"transports\" TEXT,\n  \"createdAt\" INTEGER,\n  \"aaguid\" TEXT,\n  FOREIGN KEY (\"userId\") REFERENCES \"_auth_users\"(\"id\") ON UPDATE no action ON DELETE cascade\n);\n\nCREATE UNIQUE INDEX IF NOT EXISTS \"_auth_passkeys_credentialID_unique\" ON \"_auth_passkeys\" (\"credentialID\");\nCREATE INDEX IF NOT EXISTS \"_auth_passkeys_user_id_idx\" ON \"_auth_passkeys\" (\"userId\");\nCREATE INDEX IF NOT EXISTS \"_auth_passkeys_credential_id_idx\" ON \"_auth_passkeys\" (\"credentialID\");\n\nCREATE TABLE IF NOT EXISTS \"_auth_password_secret_state\" (\n  \"userId\" TEXT NOT NULL,\n  \"purpose\" TEXT NOT NULL,\n  \"salt\" TEXT NOT NULL,\n  \"kdfAlgorithm\" TEXT NOT NULL,\n  \"kdfVersion\" INTEGER NOT NULL,\n  \"kdfIterations\" INTEGER NOT NULL,\n  \"kdfOutputBytes\" INTEGER NOT NULL,\n  \"passwordVersion\" INTEGER NOT NULL DEFAULT 0,\n  \"pendingEvent\" TEXT,\n  \"providerId\" TEXT,\n  \"providerVersion\" TEXT,\n  \"readiness\" TEXT NOT NULL DEFAULT 'needs-login',\n  \"lastSuccessEvent\" TEXT,\n  \"lastSuccessAt\" TEXT,\n  \"lastFailureCode\" TEXT,\n  \"lastFailureAt\" TEXT,\n  \"destructiveResetAt\" TEXT,\n  \"createdAt\" TEXT NOT NULL,\n  \"updatedAt\" TEXT NOT NULL,\n  PRIMARY KEY (\"userId\", \"purpose\"),\n  FOREIGN KEY (\"userId\") REFERENCES \"_auth_users\"(\"id\") ON DELETE CASCADE\n);\n\nCREATE INDEX IF NOT EXISTS \"_auth_password_secret_readiness_idx\"\n  ON \"_auth_password_secret_state\" (\"providerId\", \"providerVersion\", \"readiness\");\n\nCREATE TABLE IF NOT EXISTS \"_auth_password_provider_state\" (\n  \"userId\" TEXT NOT NULL,\n  \"purpose\" TEXT NOT NULL,\n  \"providerId\" TEXT NOT NULL,\n  \"stateKey\" TEXT NOT NULL,\n  \"value\" TEXT NOT NULL,\n  \"updatedAt\" TEXT NOT NULL,\n  PRIMARY KEY (\"userId\", \"purpose\", \"providerId\", \"stateKey\"),\n  FOREIGN KEY (\"userId\", \"purpose\") REFERENCES \"_auth_password_secret_state\"(\"userId\", \"purpose\") ON DELETE CASCADE\n);\n\nCREATE TABLE IF NOT EXISTS \"_invites\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"tokenHash\" TEXT NOT NULL UNIQUE,\n  \"email\" TEXT,\n  \"role\" TEXT NOT NULL,\n  \"roles\" TEXT NOT NULL DEFAULT '[\"user\"]',\n  \"status\" TEXT NOT NULL DEFAULT 'pending',\n  \"createdBy\" TEXT,\n  \"note\" TEXT,\n  \"expiresAt\" TEXT NOT NULL,\n  \"usedAt\" TEXT,\n  \"createdAt\" TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,\n  FOREIGN KEY (\"createdBy\") REFERENCES \"_auth_users\"(\"id\") ON DELETE SET NULL\n);\n\nCREATE TABLE IF NOT EXISTS \"_used_tokens\" (\n  \"jti\" TEXT PRIMARY KEY NOT NULL,\n  \"purpose\" TEXT NOT NULL,\n  \"usedAt\" TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS \"_auth_pending\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"purpose\" TEXT NOT NULL,\n  \"tokenJti\" TEXT NOT NULL,\n  \"tokenHash\" TEXT NOT NULL,\n  \"providerId\" TEXT NOT NULL,\n  \"expectedEmail\" TEXT,\n  \"operatorRole\" TEXT,\n  \"appRoles\" TEXT NOT NULL,\n  \"nonceHash\" TEXT NOT NULL,\n  \"status\" TEXT NOT NULL DEFAULT 'started',\n  \"updatesChoice\" TEXT,\n  \"createdAt\" TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,\n  \"expiresAt\" TEXT NOT NULL,\n  \"consumedAt\" TEXT,\n  \"error\" TEXT\n);\n\nCREATE INDEX IF NOT EXISTS \"_auth_pending_token_jti_idx\" ON \"_auth_pending\" (\"tokenJti\");\nCREATE INDEX IF NOT EXISTS \"_auth_pending_nonce_hash_idx\" ON \"_auth_pending\" (\"nonceHash\");\nCREATE INDEX IF NOT EXISTS \"_auth_pending_expires_at_idx\" ON \"_auth_pending\" (\"expiresAt\");\nCREATE INDEX IF NOT EXISTS \"_auth_pending_provider_id_idx\" ON \"_auth_pending\" (\"providerId\");\n\nCREATE TABLE IF NOT EXISTS \"_audit\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"actorKind\" TEXT,\n  \"actorId\" TEXT,\n  \"runAsKind\" TEXT,\n  \"runAsId\" TEXT,\n  \"action\" TEXT NOT NULL,\n  \"targetType\" TEXT NOT NULL,\n  \"targetId\" TEXT,\n  \"metadata\" TEXT,\n  \"createdAt\" TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,\n  FOREIGN KEY (\"actorId\") REFERENCES \"_auth_users\"(\"id\") ON DELETE SET NULL\n);\n\nCREATE INDEX IF NOT EXISTS \"_audit_created_at_idx\" ON \"_audit\" (\"createdAt\");\nCREATE INDEX IF NOT EXISTS \"_audit_actor_idx\" ON \"_audit\" (\"actorId\");\n\nCREATE TABLE IF NOT EXISTS \"_audit_archives\" (\n  \"windowStart\" TEXT PRIMARY KEY NOT NULL,\n  \"windowEnd\" TEXT NOT NULL,\n  \"objectKey\" TEXT NOT NULL,\n  \"rowCount\" INTEGER NOT NULL,\n  \"firstCreatedAt\" TEXT,\n  \"lastCreatedAt\" TEXT,\n  \"sha256\" TEXT NOT NULL,\n  \"archivedAt\" TEXT NOT NULL,\n  \"prunedAt\" TEXT\n);\n\nCREATE UNIQUE INDEX IF NOT EXISTS \"_audit_archives_object_key_idx\" ON \"_audit_archives\" (\"objectKey\");\n\nCREATE TABLE IF NOT EXISTS \"_changes\" (\n  \"seq\" INTEGER PRIMARY KEY AUTOINCREMENT,\n  \"tableName\" TEXT NOT NULL,\n  \"op\" TEXT NOT NULL,\n  \"rowId\" TEXT NOT NULL,\n  \"oldRow\" TEXT,\n  \"newRow\" TEXT,\n  \"actorId\" TEXT,\n  \"adminOverride\" INTEGER NOT NULL DEFAULT 0,\n  \"createdAt\" TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP\n);\n\nCREATE INDEX IF NOT EXISTS \"_changes_created_at_idx\" ON \"_changes\" (\"createdAt\");\nCREATE INDEX IF NOT EXISTS \"_changes_table_seq_idx\" ON \"_changes\" (\"tableName\", \"seq\");\n\nCREATE TABLE IF NOT EXISTS \"_state\" (\n  \"key\" TEXT PRIMARY KEY NOT NULL,\n  \"value\" TEXT,\n  \"updatedAt\" TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS \"_settings\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"appId\" TEXT NOT NULL,\n  \"scope\" TEXT NOT NULL,\n  \"subjectId\" TEXT NOT NULL,\n  \"key\" TEXT NOT NULL,\n  \"valueJson\" TEXT NOT NULL,\n  \"createdAt\" TEXT NOT NULL,\n  \"updatedAt\" TEXT NOT NULL,\n  \"updatedBy\" TEXT,\n  FOREIGN KEY (\"updatedBy\") REFERENCES \"_auth_users\"(\"id\") ON DELETE SET NULL\n);\n\nCREATE INDEX IF NOT EXISTS \"_settings_app_scope_subject_idx\" ON \"_settings\" (\"appId\", \"scope\", \"subjectId\");\nCREATE INDEX IF NOT EXISTS \"_settings_scope_subject_idx\" ON \"_settings\" (\"scope\", \"subjectId\");\nCREATE INDEX IF NOT EXISTS \"_settings_key_idx\" ON \"_settings\" (\"key\");\nCREATE INDEX IF NOT EXISTS \"_settings_updated_at_idx\" ON \"_settings\" (\"updatedAt\");\n\nCREATE TABLE IF NOT EXISTS \"_schema_versions\" (\n  \"targetId\" TEXT PRIMARY KEY NOT NULL,\n  \"kind\" TEXT NOT NULL,\n  \"version\" TEXT NOT NULL,\n  \"updatedAt\" TEXT NOT NULL\n);\n";
+/**
+ * Core's non-auth system tables. A layered runtime can place these unchanged
+ * declarations in a physically isolated app store while keeping identity,
+ * session, invite, and token tables in its own control plane.
+ */
+export declare const raybaseApplicationSystemTableSql: string;
+export declare const systemTableSql = "\nCREATE TABLE IF NOT EXISTS \"_auth_users\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"name\" TEXT NOT NULL,\n  \"email\" TEXT NOT NULL,\n  \"emailVerified\" INTEGER NOT NULL DEFAULT false,\n  \"image\" TEXT,\n  \"createdAt\" INTEGER NOT NULL,\n  \"updatedAt\" INTEGER NOT NULL,\n  \"operatorRole\" TEXT,\n  \"appRoles\" TEXT,\n  \"banned\" INTEGER DEFAULT false,\n  \"banReason\" TEXT,\n  \"banExpires\" INTEGER\n);\n\nCREATE UNIQUE INDEX IF NOT EXISTS \"_auth_users_email_unique\" ON \"_auth_users\" (\"email\");\nCREATE INDEX IF NOT EXISTS \"_auth_users_email_idx\" ON \"_auth_users\" (\"email\");\n\nCREATE TABLE IF NOT EXISTS \"_auth_sessions\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"userId\" TEXT NOT NULL,\n  \"token\" TEXT NOT NULL,\n  \"expiresAt\" INTEGER NOT NULL,\n  \"ipAddress\" TEXT,\n  \"userAgent\" TEXT,\n  \"createdAt\" INTEGER NOT NULL,\n  \"updatedAt\" INTEGER NOT NULL,\n  \"impersonatedBy\" TEXT,\n  FOREIGN KEY (\"userId\") REFERENCES \"_auth_users\"(\"id\") ON UPDATE no action ON DELETE cascade\n);\n\nCREATE UNIQUE INDEX IF NOT EXISTS \"_auth_sessions_token_unique\" ON \"_auth_sessions\" (\"token\");\nCREATE INDEX IF NOT EXISTS \"_auth_sessions_user_id_idx\" ON \"_auth_sessions\" (\"userId\");\nCREATE INDEX IF NOT EXISTS \"_auth_sessions_token_idx\" ON \"_auth_sessions\" (\"token\");\n\nCREATE TABLE IF NOT EXISTS \"_auth_accounts\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"accountId\" TEXT NOT NULL,\n  \"providerId\" TEXT NOT NULL,\n  \"userId\" TEXT NOT NULL,\n  \"accessToken\" TEXT,\n  \"refreshToken\" TEXT,\n  \"idToken\" TEXT,\n  \"accessTokenExpiresAt\" INTEGER,\n  \"refreshTokenExpiresAt\" INTEGER,\n  \"scope\" TEXT,\n  \"password\" TEXT,\n  \"createdAt\" INTEGER NOT NULL,\n  \"updatedAt\" INTEGER NOT NULL,\n  FOREIGN KEY (\"userId\") REFERENCES \"_auth_users\"(\"id\") ON UPDATE no action ON DELETE cascade\n);\n\nCREATE INDEX IF NOT EXISTS \"_auth_accounts_user_id_idx\" ON \"_auth_accounts\" (\"userId\");\nCREATE INDEX IF NOT EXISTS \"_auth_accounts_provider_idx\" ON \"_auth_accounts\" (\"providerId\",\"accountId\");\n\nCREATE TABLE IF NOT EXISTS \"_auth_verifications\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"identifier\" TEXT NOT NULL,\n  \"value\" TEXT NOT NULL,\n  \"expiresAt\" INTEGER NOT NULL,\n  \"createdAt\" INTEGER,\n  \"updatedAt\" INTEGER\n);\n\nCREATE INDEX IF NOT EXISTS \"_auth_verifications_identifier_idx\" ON \"_auth_verifications\" (\"identifier\");\n\nCREATE TABLE IF NOT EXISTS \"_auth_passkeys\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"name\" TEXT,\n  \"publicKey\" TEXT NOT NULL,\n  \"userId\" TEXT NOT NULL,\n  \"credentialID\" TEXT NOT NULL,\n  \"counter\" INTEGER NOT NULL,\n  \"deviceType\" TEXT NOT NULL,\n  \"backedUp\" INTEGER NOT NULL,\n  \"transports\" TEXT,\n  \"createdAt\" INTEGER,\n  \"aaguid\" TEXT,\n  FOREIGN KEY (\"userId\") REFERENCES \"_auth_users\"(\"id\") ON UPDATE no action ON DELETE cascade\n);\n\nCREATE UNIQUE INDEX IF NOT EXISTS \"_auth_passkeys_credentialID_unique\" ON \"_auth_passkeys\" (\"credentialID\");\nCREATE INDEX IF NOT EXISTS \"_auth_passkeys_user_id_idx\" ON \"_auth_passkeys\" (\"userId\");\nCREATE INDEX IF NOT EXISTS \"_auth_passkeys_credential_id_idx\" ON \"_auth_passkeys\" (\"credentialID\");\n\nCREATE TABLE IF NOT EXISTS \"_auth_password_secret_state\" (\n  \"userId\" TEXT NOT NULL,\n  \"purpose\" TEXT NOT NULL,\n  \"salt\" TEXT NOT NULL,\n  \"kdfAlgorithm\" TEXT NOT NULL,\n  \"kdfVersion\" INTEGER NOT NULL,\n  \"kdfIterations\" INTEGER NOT NULL,\n  \"kdfOutputBytes\" INTEGER NOT NULL,\n  \"passwordVersion\" INTEGER NOT NULL DEFAULT 0,\n  \"pendingEvent\" TEXT,\n  \"providerId\" TEXT,\n  \"providerVersion\" TEXT,\n  \"readiness\" TEXT NOT NULL DEFAULT 'needs-login',\n  \"lastSuccessEvent\" TEXT,\n  \"lastSuccessAt\" TEXT,\n  \"lastFailureCode\" TEXT,\n  \"lastFailureAt\" TEXT,\n  \"destructiveResetAt\" TEXT,\n  \"createdAt\" TEXT NOT NULL,\n  \"updatedAt\" TEXT NOT NULL,\n  PRIMARY KEY (\"userId\", \"purpose\"),\n  FOREIGN KEY (\"userId\") REFERENCES \"_auth_users\"(\"id\") ON DELETE CASCADE\n);\n\nCREATE INDEX IF NOT EXISTS \"_auth_password_secret_readiness_idx\"\n  ON \"_auth_password_secret_state\" (\"providerId\", \"providerVersion\", \"readiness\");\n\nCREATE TABLE IF NOT EXISTS \"_auth_password_provider_state\" (\n  \"userId\" TEXT NOT NULL,\n  \"purpose\" TEXT NOT NULL,\n  \"providerId\" TEXT NOT NULL,\n  \"stateKey\" TEXT NOT NULL,\n  \"value\" TEXT NOT NULL,\n  \"updatedAt\" TEXT NOT NULL,\n  PRIMARY KEY (\"userId\", \"purpose\", \"providerId\", \"stateKey\"),\n  FOREIGN KEY (\"userId\", \"purpose\") REFERENCES \"_auth_password_secret_state\"(\"userId\", \"purpose\") ON DELETE CASCADE\n);\n\nCREATE TABLE IF NOT EXISTS \"_invites\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"tokenHash\" TEXT NOT NULL UNIQUE,\n  \"email\" TEXT,\n  \"role\" TEXT NOT NULL,\n  \"roles\" TEXT NOT NULL DEFAULT '[\"user\"]',\n  \"status\" TEXT NOT NULL DEFAULT 'pending',\n  \"createdBy\" TEXT,\n  \"note\" TEXT,\n  \"expiresAt\" TEXT NOT NULL,\n  \"usedAt\" TEXT,\n  \"createdAt\" TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,\n  FOREIGN KEY (\"createdBy\") REFERENCES \"_auth_users\"(\"id\") ON DELETE SET NULL\n);\n\nCREATE TABLE IF NOT EXISTS \"_used_tokens\" (\n  \"jti\" TEXT PRIMARY KEY NOT NULL,\n  \"purpose\" TEXT NOT NULL,\n  \"usedAt\" TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS \"_auth_pending\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"purpose\" TEXT NOT NULL,\n  \"tokenJti\" TEXT NOT NULL,\n  \"tokenHash\" TEXT NOT NULL,\n  \"providerId\" TEXT NOT NULL,\n  \"expectedEmail\" TEXT,\n  \"operatorRole\" TEXT,\n  \"appRoles\" TEXT NOT NULL,\n  \"nonceHash\" TEXT NOT NULL,\n  \"status\" TEXT NOT NULL DEFAULT 'started',\n  \"updatesChoice\" TEXT,\n  \"createdAt\" TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,\n  \"expiresAt\" TEXT NOT NULL,\n  \"consumedAt\" TEXT,\n  \"error\" TEXT\n);\n\nCREATE INDEX IF NOT EXISTS \"_auth_pending_token_jti_idx\" ON \"_auth_pending\" (\"tokenJti\");\nCREATE INDEX IF NOT EXISTS \"_auth_pending_nonce_hash_idx\" ON \"_auth_pending\" (\"nonceHash\");\nCREATE INDEX IF NOT EXISTS \"_auth_pending_expires_at_idx\" ON \"_auth_pending\" (\"expiresAt\");\nCREATE INDEX IF NOT EXISTS \"_auth_pending_provider_id_idx\" ON \"_auth_pending\" (\"providerId\");\n\nCREATE TABLE IF NOT EXISTS \"_audit\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"actorKind\" TEXT,\n  \"actorId\" TEXT,\n  \"runAsKind\" TEXT,\n  \"runAsId\" TEXT,\n  \"action\" TEXT NOT NULL,\n  \"targetType\" TEXT NOT NULL,\n  \"targetId\" TEXT,\n  \"metadata\" TEXT,\n  \"createdAt\" TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,\n  FOREIGN KEY (\"actorId\") REFERENCES \"_auth_users\"(\"id\") ON DELETE SET NULL\n);\n\nCREATE INDEX IF NOT EXISTS \"_audit_created_at_idx\" ON \"_audit\" (\"createdAt\");\nCREATE INDEX IF NOT EXISTS \"_audit_actor_idx\" ON \"_audit\" (\"actorId\");\n\nCREATE TABLE IF NOT EXISTS \"_audit_archives\" (\n  \"windowStart\" TEXT PRIMARY KEY NOT NULL,\n  \"windowEnd\" TEXT NOT NULL,\n  \"objectKey\" TEXT NOT NULL,\n  \"rowCount\" INTEGER NOT NULL,\n  \"firstCreatedAt\" TEXT,\n  \"lastCreatedAt\" TEXT,\n  \"sha256\" TEXT NOT NULL,\n  \"archivedAt\" TEXT NOT NULL,\n  \"prunedAt\" TEXT\n);\n\nCREATE UNIQUE INDEX IF NOT EXISTS \"_audit_archives_object_key_idx\" ON \"_audit_archives\" (\"objectKey\");\n\nCREATE TABLE IF NOT EXISTS \"_changes\" (\n  \"seq\" INTEGER PRIMARY KEY AUTOINCREMENT,\n  \"tableName\" TEXT NOT NULL,\n  \"op\" TEXT NOT NULL,\n  \"rowId\" TEXT NOT NULL,\n  \"oldRow\" TEXT,\n  \"newRow\" TEXT,\n  \"actorId\" TEXT,\n  \"adminOverride\" INTEGER NOT NULL DEFAULT 0,\n  \"createdAt\" TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP\n);\n\nCREATE INDEX IF NOT EXISTS \"_changes_created_at_idx\" ON \"_changes\" (\"createdAt\");\nCREATE INDEX IF NOT EXISTS \"_changes_table_seq_idx\" ON \"_changes\" (\"tableName\", \"seq\");\n\nCREATE TABLE IF NOT EXISTS \"_state\" (\n  \"key\" TEXT PRIMARY KEY NOT NULL,\n  \"value\" TEXT,\n  \"updatedAt\" TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS \"_settings\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"appId\" TEXT NOT NULL,\n  \"scope\" TEXT NOT NULL,\n  \"subjectId\" TEXT NOT NULL,\n  \"key\" TEXT NOT NULL,\n  \"valueJson\" TEXT NOT NULL,\n  \"createdAt\" TEXT NOT NULL,\n  \"updatedAt\" TEXT NOT NULL,\n  \"updatedBy\" TEXT,\n  FOREIGN KEY (\"updatedBy\") REFERENCES \"_auth_users\"(\"id\") ON DELETE SET NULL\n);\n\nCREATE INDEX IF NOT EXISTS \"_settings_app_scope_subject_idx\" ON \"_settings\" (\"appId\", \"scope\", \"subjectId\");\nCREATE INDEX IF NOT EXISTS \"_settings_scope_subject_idx\" ON \"_settings\" (\"scope\", \"subjectId\");\nCREATE INDEX IF NOT EXISTS \"_settings_key_idx\" ON \"_settings\" (\"key\");\nCREATE INDEX IF NOT EXISTS \"_settings_updated_at_idx\" ON \"_settings\" (\"updatedAt\");\n\nCREATE TABLE IF NOT EXISTS \"_schema_versions\" (\n  \"targetId\" TEXT PRIMARY KEY NOT NULL,\n  \"kind\" TEXT NOT NULL,\n  \"version\" TEXT NOT NULL,\n  \"updatedAt\" TEXT NOT NULL\n);\n";
+export declare const authSchema: {
+    readonly user: "_auth_users";
+    readonly session: "_auth_sessions";
+    readonly account: "_auth_accounts";
+    readonly verification: "_auth_verifications";
+    readonly passkey: "_auth_passkeys";
+    readonly raybaseAuthPasswordSecretState: "_auth_password_secret_state";
+    readonly raybaseAuthPasswordProviderState: "_auth_password_provider_state";
+    readonly raybaseInvites: "_invites";
+    readonly raybaseUsedTokens: "_used_tokens";
+    readonly raybaseAuthPending: "_auth_pending";
+    readonly raybaseAudit: "_audit";
+    readonly raybaseAuditArchives: "_audit_archives";
+    readonly raybaseChanges: "_changes";
+    readonly raybaseState: "_state";
+    readonly raybaseSettings: "_settings";
+    readonly raybaseSchemaVersions: "_schema_versions";
+};
+export declare const betterAuthSchema: {
+    readonly user: "_auth_users";
+    readonly session: "_auth_sessions";
+    readonly account: "_auth_accounts";
+    readonly verification: "_auth_verifications";
+    readonly passkey: "_auth_passkeys";
+};
+export type BetterAuthSchema = typeof betterAuthSchema;
+//# sourceMappingURL=auth-schema.d.ts.map

package/dist/auth-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,OAAO,GAAG;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,oBAAoB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC7C,qBAAqB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAClC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAEF,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAC/C,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAC/D,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,eAAO,MAAM,gCAAgC,gCAAgC,CAAC;AAC9E,eAAO,MAAM,kCAAkC,kCAAkC,CAAC;AAElF,eAAO,MAAM,qBAAqB,4vRAoPjC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,QAK5C,CAAC;AAEF,eAAO,MAAM,cAAc,4vRAAwB,CAAC;AAEpD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAiBb,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;;CAMnB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC"}