@schlessera/brain-ui-server 0.13.1 → 0.15.0

package/dist/index.js

@@ -5,24 +5,34 @@
  * decides the port/idleTimeout, wires SIGTERM, and injects deployment-only
  * pieces (static client build, PNG/PDF renderer). Everything else — routes,
  * auth, passkeys, the WebSocket turn coordinator, the session catalog — lives
- * behind createApp().
+ * behind createApp(), which returns a handle carrying the app's own resources
+ * (config, database, ws host) instead of module-level singletons.
  */
-export { createApp } from "./app.js";
-// Process lifecycle helpers for the bin entry.
-export { websocket, cancelActiveTurn, isTurnActive } from "./ws/handler.js";
-export { getDb, closeDb, configureDb } from "./db/client.js";
+export { createApp, } from "./app.js";
+// Configuration: the package's single environment chokepoint. The descriptor
+// (ENV_VARS) is the artifact the env-parity gate diffs against documentation.
+export { ENV_VARS, resolveServerConfig, } from "./config/env.js";
 // Boot-time diagnostics (fail fast on a bad AGENT_BACKEND / profile config,
 // log the resolved auth mode).
-export { getBackends, getBackendsInfo } from "./agent/backend.js";
-export { resolveAuthMode } from "./middleware/auth.js";
+export { assertBackendResolvable, createBackendRegistry, createStaticBackendRegistry, } from "./agent/backend.js";
+export { resolveAuthMode, } from "./middleware/auth.js";
+// The app's own SQLite database (sessions, passkeys, settings).
+export { createUiDb } from "./db/client.js";
+// Brain database access (read-only, schema-gated) for embedders adding
+// their own readers.
+export { openBrainDb, withBrainDb, BrainDbUnavailableError, MIN_BRAIN_SCHEMA_VERSION, } from "./db/brain-db.js";
 // WebSocket internals for embedders and tests.
-export { WsHost, defaultWsHost, configureWsHost, handleClientMessage, resetForTests, resolveTurnTarget, createSessionCatalog, } from "./ws/handler.js";
+export { WsHost } from "./ws/host.js";
+export { createWsUpgrade, websocket } from "./ws/connection.js";
+export { handleClientMessage } from "./ws/dispatch.js";
+export { resolveTurnTarget } from "./ws/routing.js";
+export { createSessionCatalog, } from "./ws/session-catalog.js";
 // Brain repo access (spawned CLI wrapper) — useful for embedders that add
 // their own routes on top.
-export * as brainClient from "./brain/client.js";
+export { createBrainClient } from "./brain/client.js";
 // Share staging: a deployment can sweep expired staging dirs at boot; the
 // intake route also sweeps opportunistically on every share.
 export { pruneShareStaging, shareStagingRoot } from "./share/staging.js";
 // Voice keyterm cache rebuild (used by deployments after `brain sync`).
-export { buildKeyterms, writeCache } from "./voice/keyterm-builder.js";
+export { buildKeyterms, writeCache, } from "./voice/keyterm-builder.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAA2C,MAAM,UAAU,CAAC;AAE9E,+CAA+C;AAC/C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7D,4EAA4E;AAC5E,+BAA+B;AAC/B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAiB,MAAM,sBAAsB,CAAC;AAEtE,+CAA+C;AAC/C,OAAO,EACL,MAAM,EAEN,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AAEzB,0EAA0E;AAC1E,2BAA2B;AAC3B,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AAEjD,0EAA0E;AAC1E,6DAA6D;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEzE,wEAAwE;AACxE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,SAAS,GAIV,MAAM,UAAU,CAAC;AAElB,6EAA6E;AAC7E,8EAA8E;AAC9E,OAAO,EACL,QAAQ,EACR,mBAAmB,GAOpB,MAAM,iBAAiB,CAAC;AAEzB,4EAA4E;AAC5E,+BAA+B;AAC/B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,GAI5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,GAGhB,MAAM,sBAAsB,CAAC;AAE9B,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,uEAAuE;AACvE,qBAAqB;AACrB,OAAO,EACL,WAAW,EACX,WAAW,EACX,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,+CAA+C;AAC/C,OAAO,EAAE,MAAM,EAAsB,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,oBAAoB,GAErB,MAAM,yBAAyB,CAAC;AAEjC,0EAA0E;AAC1E,2BAA2B;AAC3B,OAAO,EAAE,iBAAiB,EAAoB,MAAM,mBAAmB,CAAC;AAExE,0EAA0E;AAC1E,6DAA6D;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEzE,wEAAwE;AACxE,OAAO,EACL,aAAa,EACb,UAAU,GAEX,MAAM,4BAA4B,CAAC"}

package/dist/middleware/auth.d.ts

@@ -1,5 +1,6 @@
 import { Hono } from "hono";
 import type { Context, MiddlewareHandler } from "hono";
+import type { AuthConfig } from "../config/env.js";
 /**
  * Authentication for a remote surface to an agent with write access to the
  * user's files. Modes (AUTH_MODE):
@@ -17,18 +18,28 @@ import type { Context, MiddlewareHandler } from "hono";
  *                 explicit BRAIN_UI_DANGEROUSLY_DISABLE_AUTH=1 escape hatch.
  *
  * Default: `password` when BRAIN_UI_PASSWORD_HASH is set, else `tailscale`.
+ *
+ * All configuration is injected as the resolved {@link AuthRuntime} — this
+ * module never reads the environment, so two apps with different auth
+ * configuration can coexist and tests vary it without global mutation. The
+ * validation semantics themselves are unchanged.
  */
 export type AuthMode = "password" | "tailscale" | "proxy" | "none";
+/** What the auth layer needs from the resolved server config. */
+export interface AuthRuntime extends AuthConfig {
+    /** Bind host, for the loopback check on AUTH_MODE=none. */
+    host: string;
+}
 export declare const LOGIN_RATE_LIMIT = 5;
 export declare const GLOBAL_LOGIN_RATE_LIMIT = 20;
-export declare function resolveAuthMode(): AuthMode;
+export declare function resolveAuthMode(auth: AuthRuntime): AuthMode;
 /**
  * Validate the auth configuration at startup. Throws (refusing to boot) on an
  * unsafe or unusable configuration.
  */
-export declare function assertAuthConfig(mode: AuthMode): void;
+export declare function assertAuthConfig(mode: AuthMode, auth: AuthRuntime): void;
 /** Middleware guarding /api/* according to the resolved mode. */
-export declare function authGuard(mode: AuthMode): MiddlewareHandler;
+export declare function authGuard(mode: AuthMode, auth: AuthRuntime): MiddlewareHandler;
 /**
  * Authorize a WebSocket upgrade. The upgrade handler must call this itself —
  * browsers can't set headers on the WS handshake, so the session cookie (sent
@@ -36,18 +47,18 @@ export declare function authGuard(mode: AuthMode): MiddlewareHandler;
  * middleware may sit on the WS route (immutable-header errors). Mirrors
  * {@link authGuard} without emitting a response.
  */
-export declare function isWsAuthorized(c: Context, mode: AuthMode): Promise<boolean>;
+export declare function isWsAuthorized(c: Context, mode: AuthMode, auth: AuthRuntime): Promise<boolean>;
 /**
  * Mint the session cookie. The single place a session comes into existence —
  * both password login and passkey login (middleware/passkeys.ts) call this, so
  * authGuard / isWsAuthorized / TTL semantics stay identical across methods.
  */
-export declare function issueSessionCookie(c: Context): Promise<void>;
+export declare function issueSessionCookie(c: Context, auth: AuthRuntime): Promise<void>;
 /** Test-only: clear all rate-limit buckets (they are module-global state). */
 export declare function resetLoginRateLimiter(): void;
 export declare function consumeLoginToken(key: string, limit: number): boolean;
 /** Login/logout routes. Only functional in `password` mode. */
-export declare function authRoutes(mode: AuthMode, deps?: {
+export declare function authRoutes(mode: AuthMode, auth: AuthRuntime, deps?: {
     /**
      * When provided and returning true, password login is refused (the app
      * injects passkeys' passwordLoginDisabled so the shared password dies

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAIvD;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;AAInE,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAQlC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAG1C,wBAAgB,eAAe,IAAI,QAAQ,CAe1C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAwDrD;AAED,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAqC3D;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAWjF;AAID;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAYlE;AA4CD,8EAA8E;AAC9E,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAUrE;AAED,+DAA+D;AAC/D,wBAAgB,UAAU,CACxB,IAAI,EAAE,QAAQ,EACd,IAAI,GAAE;IACJ;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;CACvC,GACL,IAAI,CAkDN"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;AAEnE,iEAAiE;AACjE,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAID,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAQlC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAS3D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAwDxE;AAED,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,GAAG,iBAAiB,CAqC9E;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,CAAC,EAAE,OAAO,EACV,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,OAAO,CAAC,CAWlB;AAID;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAYrF;AAwCD,8EAA8E;AAC9E,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAUrE;AAED,+DAA+D;AAC/D,wBAAgB,UAAU,CACxB,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;IACJ;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;CACvC,GACL,IAAI,CAkDN"}

package/dist/middleware/auth.js

@@ -12,19 +12,13 @@ const LOGIN_RATE_WINDOW_MS = 60_000; // per minute
 // verify cost, makes online guessing infeasible without being a lockout an
 // attacker could weaponize to deny the owner access.
 export const GLOBAL_LOGIN_RATE_LIMIT = 20; // attempts per window, all IPs combined
-const DEFAULT_PROXY_HEADER = "x-forwarded-user";
-export function resolveAuthMode() {
-    const explicit = process.env.AUTH_MODE?.trim().toLowerCase();
-    if (explicit === "password" ||
-        explicit === "tailscale" ||
-        explicit === "proxy" ||
-        explicit === "none") {
-        return explicit;
+export function resolveAuthMode(auth) {
+    if (auth.mode)
+        return auth.mode;
+    if (auth.invalidMode) {
+        console.warn(`[auth] Unknown AUTH_MODE="${auth.invalidMode}"; auto-detecting instead.`);
     }
-    if (explicit) {
-        console.warn(`[auth] Unknown AUTH_MODE="${explicit}"; auto-detecting instead.`);
-    }
-    if (process.env.BRAIN_UI_PASSWORD_HASH)
+    if (auth.passwordHash)
         return "password";
     return "tailscale";
 }
@@ -32,15 +26,15 @@ export function resolveAuthMode() {
  * Validate the auth configuration at startup. Throws (refusing to boot) on an
  * unsafe or unusable configuration.
  */
-export function assertAuthConfig(mode) {
-    const host = process.env.HOST ?? "";
+export function assertAuthConfig(mode, auth) {
+    const host = auth.host;
     const loopback = host === "127.0.0.1" || host === "::1" || host === "localhost";
     if (mode === "password") {
-        if (!process.env.BRAIN_UI_PASSWORD_HASH) {
+        if (!auth.passwordHash) {
             throw new Error("AUTH_MODE=password requires BRAIN_UI_PASSWORD_HASH. Generate one with:\n" +
                 "  bun -e 'console.log(await Bun.password.hash(process.argv[1]))' 'your-password'");
         }
-        if (!process.env.COOKIE_SECRET) {
+        if (!auth.cookieSecret) {
             throw new Error("AUTH_MODE=password requires COOKIE_SECRET (a long random string used to " +
                 "sign the session cookie). Generate one with:\n  openssl rand -hex 32");
         }
@@ -49,7 +43,7 @@ export function assertAuthConfig(mode) {
     // difference between "auth required" and "agent with file-write access
     // exposed to the network".
     if (mode === "none" && !loopback) {
-        if (process.env.BRAIN_UI_DANGEROUSLY_DISABLE_AUTH === "1") {
+        if (auth.dangerouslyDisableAuth) {
             console.warn("[auth] AUTH_MODE=none on a non-loopback host, allowed by " +
                 "BRAIN_UI_DANGEROUSLY_DISABLE_AUTH=1 — every network peer has full " +
                 "agent access. Do not run this on anything but a trusted network.");
@@ -64,23 +58,23 @@ export function assertAuthConfig(mode) {
         }
     }
     if (mode === "proxy") {
-        if (process.env.TRUST_PROXY !== "1") {
+        if (!auth.trustProxy) {
             throw new Error("AUTH_MODE=proxy requires TRUST_PROXY=1 — the proxy-auth header is only " +
                 "trustworthy when a fronting proxy is guaranteed to set it and strip " +
                 "any client-supplied copy. Set TRUST_PROXY=1 once that holds.");
         }
-        console.log(`[auth] mode: proxy (trusting header "${proxyHeaderName()}"; ensure your ` +
+        console.log(`[auth] mode: proxy (trusting header "${auth.proxyAuthHeader}"; ensure your ` +
             "upstream proxy sets it and strips any client-supplied copy)");
         return;
     }
     console.log(`[auth] mode: ${mode}`);
 }
 /** Middleware guarding /api/* according to the resolved mode. */
-export function authGuard(mode) {
+export function authGuard(mode, auth) {
     switch (mode) {
         case "tailscale":
             return async (c, next) => {
-                if (isTailscaleAllowed(c, process.env.TRUST_PROXY === "1")) {
+                if (isTailscaleAllowed(c, auth.trustProxy, auth.trustProxyHops)) {
                     await next();
                 }
                 else {
@@ -89,7 +83,7 @@ export function authGuard(mode) {
             };
         case "proxy":
             return async (c, next) => {
-                if (hasProxyAuth(c)) {
+                if (hasProxyAuth(c, auth)) {
                     await next();
                 }
                 else {
@@ -98,7 +92,7 @@ export function authGuard(mode) {
             };
         case "password":
             return async (c, next) => {
-                if (await hasValidSession(c)) {
+                if (await hasValidSession(c, auth)) {
                     await next();
                 }
                 else {
@@ -118,16 +112,16 @@ export function authGuard(mode) {
  * middleware may sit on the WS route (immutable-header errors). Mirrors
  * {@link authGuard} without emitting a response.
  */
-export async function isWsAuthorized(c, mode) {
+export async function isWsAuthorized(c, mode, auth) {
     switch (mode) {
         case "none":
             return true;
         case "tailscale":
-            return isTailscaleAllowed(c, process.env.TRUST_PROXY === "1");
+            return isTailscaleAllowed(c, auth.trustProxy, auth.trustProxyHops);
         case "proxy":
-            return hasProxyAuth(c);
+            return hasProxyAuth(c, auth);
         case "password":
-            return hasValidSession(c);
+            return hasValidSession(c, auth);
     }
 }
 // --- password mode helpers ---
@@ -136,8 +130,8 @@ export async function isWsAuthorized(c, mode) {
  * both password login and passkey login (middleware/passkeys.ts) call this, so
  * authGuard / isWsAuthorized / TTL semantics stay identical across methods.
  */
-export async function issueSessionCookie(c) {
-    const secret = process.env.COOKIE_SECRET ?? "";
+export async function issueSessionCookie(c, auth) {
+    const secret = auth.cookieSecret ?? "";
     await setSignedCookie(c, COOKIE_NAME, String(Date.now()), secret, {
         httpOnly: true,
         sameSite: "Strict",
@@ -149,8 +143,8 @@ export async function issueSessionCookie(c) {
         maxAge: SESSION_TTL_SECONDS,
     });
 }
-async function hasValidSession(c) {
-    const secret = process.env.COOKIE_SECRET ?? "";
+async function hasValidSession(c, auth) {
+    const secret = auth.cookieSecret ?? "";
     if (!secret)
         return false;
     try {
@@ -171,17 +165,14 @@ async function hasValidSession(c) {
     }
 }
 // --- proxy mode helpers ---
-function proxyHeaderName() {
-    return (process.env.PROXY_AUTH_HEADER || DEFAULT_PROXY_HEADER).toLowerCase();
-}
-function hasProxyAuth(c) {
+function hasProxyAuth(c, auth) {
     // The proxy-auth header is only meaningful when a trusted proxy fronts the app
     // and TRUST_PROXY says so; otherwise a client could set it directly. Gate on
-    // TRUST_PROXY, consistent with tailscale-mode XFF trust. (assertAuthConfig
+    // trustProxy, consistent with tailscale-mode XFF trust. (assertAuthConfig
     // already refuses to boot proxy mode without it — this is belt-and-braces.)
-    if (process.env.TRUST_PROXY !== "1")
+    if (!auth.trustProxy)
         return false;
-    const user = c.req.header(proxyHeaderName());
+    const user = c.req.header(auth.proxyAuthHeader);
     return !!user && user.trim().length > 0;
 }
 const loginBuckets = new Map();
@@ -202,13 +193,13 @@ export function consumeLoginToken(key, limit) {
     return true;
 }
 /** Login/logout routes. Only functional in `password` mode. */
-export function authRoutes(mode, deps = {}) {
+export function authRoutes(mode, auth, deps = {}) {
     const app = new Hono();
     app.post("/auth/login", async (c) => {
         if (mode !== "password") {
             return c.json({ error: "Password login is not enabled" }, 400);
         }
-        const key = clientIp(c, process.env.TRUST_PROXY === "1") || "unknown";
+        const key = clientIp(c, auth.trustProxy, auth.trustProxyHops) || "unknown";
         const perIpOk = consumeLoginToken(`ip:${key}`, LOGIN_RATE_LIMIT);
         const globalOk = consumeLoginToken("global", GLOBAL_LOGIN_RATE_LIMIT);
         if (!perIpOk || !globalOk) {
@@ -217,8 +208,8 @@ export function authRoutes(mode, deps = {}) {
         if (deps.passwordDisabled?.(c)) {
             return c.json({ error: "Password login is disabled — sign in with a passkey." }, 403);
         }
-        const hash = process.env.BRAIN_UI_PASSWORD_HASH ?? "";
-        const secret = process.env.COOKIE_SECRET ?? "";
+        const hash = auth.passwordHash ?? "";
+        const secret = auth.cookieSecret ?? "";
         let body;
         try {
             body = await c.req.json();
@@ -234,7 +225,7 @@ export function authRoutes(mode, deps = {}) {
         if (!ok) {
             return c.json({ error: "Invalid credentials" }, 401);
         }
-        await issueSessionCookie(c);
+        await issueSessionCookie(c, auth);
         return c.json({ ok: true });
     });
     app.post("/auth/logout", (c) => {

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAuB9D,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,qCAAqC;AACxE,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,aAAa;AAClD,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,qDAAqD;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC,CAAC,wCAAwC;AACnF,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEhD,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7D,IACE,QAAQ,KAAK,UAAU;QACvB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,MAAM,EACnB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,6BAA6B,QAAQ,4BAA4B,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAAE,OAAO,UAAU,CAAC;IAC1D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAc;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;IAEhF,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,kFAAkF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,sEAAsE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,2BAA2B;IAC3B,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,iCAAiC,KAAK,GAAG,EAAE,CAAC;YAC1D,OAAO,CAAC,IAAI,CACV,2DAA2D;gBACzD,oEAAoE;gBACpE,kEAAkE,CACrE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,0DAA0D;gBACxD,cAAc,IAAI,sDAAsD;gBACxE,0EAA0E;gBAC1E,kEAAkE;gBAClE,iEAAiE;gBACjE,sCAAsC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,sEAAsE;gBACtE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CACT,wCAAwC,eAAe,EAAE,iBAAiB;YACxE,6DAA6D,CAChE,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,EAAE,CAAC;oBAC3D,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpB,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,MAAM,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,MAAM;YACT,OAAO,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;gBACxB,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAU,EAAE,IAAc;IAC7D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,WAAW;YACd,OAAO,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC;QAChE,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;QACzB,KAAK,UAAU;YACb,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,CAAU;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,MAAM,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE;QAChE,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,mBAAmB;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,CAAU;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,yEAAyE;QACzE,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;QAClD,OAAO,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,mBAAmB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,6BAA6B;AAE7B,SAAS,eAAe;IACtB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1C,CAAC;AAQD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB;IACnC,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;QAChE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CACxB,IAAc,EACd,OAQI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI,SAAS,CAAC;QACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,GAAG,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,sDAAsD,EAAE,EACjE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;QAC/C,IAAI,IAA4B,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAmC9D,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,qCAAqC;AACxE,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,aAAa;AAClD,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,qDAAqD;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC,CAAC,wCAAwC;AAEnF,MAAM,UAAU,eAAe,CAAC,IAAiB;IAC/C,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CACV,6BAA6B,IAAI,CAAC,WAAW,4BAA4B,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,UAAU,CAAC;IACzC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,IAAiB;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;IAEhF,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,kFAAkF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,sEAAsE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,2BAA2B;IAC3B,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CACV,2DAA2D;gBACzD,oEAAoE;gBACpE,kEAAkE,CACrE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,0DAA0D;gBACxD,cAAc,IAAI,sDAAsD;gBACxE,0EAA0E;gBAC1E,kEAAkE;gBAClE,iEAAiE;gBACjE,sCAAsC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,sEAAsE;gBACtE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CACT,wCAAwC,IAAI,CAAC,eAAe,iBAAiB;YAC3E,6DAA6D,CAChE,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,SAAS,CAAC,IAAc,EAAE,IAAiB;IACzD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;oBAChE,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,MAAM;YACT,OAAO,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;gBACxB,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,CAAU,EACV,IAAc,EACd,IAAiB;IAEjB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,WAAW;YACd,OAAO,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACrE,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,CAAU,EAAE,IAAiB;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACvC,MAAM,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE;QAChE,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,mBAAmB;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,CAAU,EAAE,IAAiB;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,yEAAyE;QACzE,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;QAClD,OAAO,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,mBAAmB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,6BAA6B;AAE7B,SAAS,YAAY,CAAC,CAAU,EAAE,IAAiB;IACjD,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1C,CAAC;AAQD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB;IACnC,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;QAChE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CACxB,IAAc,EACd,IAAiB,EACjB,OAQI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QAC3E,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,GAAG,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,sDAAsD,EAAE,EACjE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACvC,IAAI,IAA4B,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/middleware/origin.d.ts

@@ -12,6 +12,5 @@ import type { Context } from "hono";
  * The check is free because the routes that use it are only ever called by the
  * app itself, same-origin. Same shape as the WebSocket upgrade's origin guard.
  */
-export declare function allowedOriginList(): string[];
-export declare function isSameOriginRequest(c: Context, allowed?: string[]): boolean;
+export declare function isSameOriginRequest(c: Context, allowed: string[]): boolean;
 //# sourceMappingURL=origin.d.ts.map

package/dist/middleware/origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../../src/middleware/origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAK5C;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,WAAsB,GAAG,OAAO,CAgBtF"}
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../../src/middleware/origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAgB1E"}

package/dist/middleware/origin.js

@@ -11,13 +11,7 @@
  * The check is free because the routes that use it are only ever called by the
  * app itself, same-origin. Same shape as the WebSocket upgrade's origin guard.
  */
-export function allowedOriginList() {
-    return (process.env.ALLOWED_ORIGINS ?? "")
-        .split(",")
-        .map((origin) => origin.trim())
-        .filter(Boolean);
-}
-export function isSameOriginRequest(c, allowed = allowedOriginList()) {
+export function isSameOriginRequest(c, allowed) {
     // Chromium and Firefox send this, and it is not settable by script.
     const site = c.req.header("sec-fetch-site");
     if (site)

package/dist/middleware/origin.js.map

@@ -1 +1 @@
-{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/middleware/origin.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;SACvC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAU,EAAE,OAAO,GAAG,iBAAiB,EAAE;IAC3E,oEAAoE;IACpE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,IAAI;QAAE,OAAO,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM,CAAC;IAE3D,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,6CAA6C;IACvE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/middleware/origin.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAU,EAAE,OAAiB;IAC/D,oEAAoE;IACpE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,IAAI;QAAE,OAAO,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM,CAAC;IAE3D,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,6CAA6C;IACvE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/middleware/passkeys.d.ts

@@ -1,13 +1,37 @@
 import { Hono } from "hono";
 import type { Context } from "hono";
+import type { Database } from "bun:sqlite";
 import { verifyAuthenticationResponse as realVerifyAuthentication, verifyRegistrationResponse as realVerifyRegistration } from "@simplewebauthn/server";
-import { type AuthMode } from "./auth.js";
+import { type AuthMode, type AuthRuntime } from "./auth.js";
+import type { WebAuthnConfig } from "../config/env.js";
+/**
+ * WebAuthn passkeys as an extension of `password` mode: the password bootstraps
+ * the first registration (and stays as recovery), passkeys are the day-to-day
+ * login. A successful assertion mints the same session cookie as password login
+ * (issueSessionCookie), so authGuard / isWsAuthorized / TTL are untouched.
+ *
+ * Everything environmental is injected as a {@link PasskeyContext} — the
+ * resolved WebAuthn identity, the auth runtime (for trust/proxy semantics and
+ * the cookie secret), the origin allowlist, and the app's own database.
+ *
+ * Credentials are RP-scoped: a credential registered on localhost does not
+ * exist for the production domain and vice versa. Rows carry rp_id so all
+ * environments share the table.
+ */
+/** Injected per-app dependencies for every passkey route and helper. */
+export interface PasskeyContext {
+    db: Database;
+    webauthn: WebAuthnConfig;
+    auth: AuthRuntime;
+    /** ALLOWED_ORIGINS — split-topology origins also valid for ceremonies. */
+    allowedOrigins: string[];
+}
 /**
  * Refuse to boot on a WebAuthn user handle the browser would reject. Called
  * from createApp(): an oversized handle otherwise produces registration
  * options that look fine server-side and fail silently in every browser.
  */
-export declare function assertPasskeyConfig(): void;
+export declare function assertPasskeyConfig(webauthn: WebAuthnConfig): void;
 /** Injectable seams for tests; production callers pass nothing. */
 export interface PasskeyDeps {
     verifyRegistrationResponse?: typeof realVerifyRegistration;
@@ -22,15 +46,15 @@ export interface PasskeyDeps {
  * until it has its own credential. Host-derived rpID is fine here: a forged
  * Host can at most re-enable password auth, which still requires the password.
  */
-export declare function passwordLoginDisabled(c: Context): boolean;
+export declare function passwordLoginDisabled(c: Context, ctx: PasskeyContext): boolean;
 /**
  * Unauthenticated passkey routes. Mount BEFORE the auth guard, next to
  * authRoutes.
  */
-export declare function passkeyPublicRoutes(mode: AuthMode, deps?: PasskeyDeps): Hono;
+export declare function passkeyPublicRoutes(mode: AuthMode, ctx: PasskeyContext, deps?: PasskeyDeps): Hono;
 /**
  * Session-gated passkey routes. Mount AFTER the auth guard — gating comes from
  * mount position, not per-route checks.
  */
-export declare function passkeyManagementRoutes(mode: AuthMode, deps?: PasskeyDeps): Hono;
+export declare function passkeyManagementRoutes(mode: AuthMode, ctx: PasskeyContext, deps?: PasskeyDeps): Hono;
 //# sourceMappingURL=passkeys.d.ts.map

package/dist/middleware/passkeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passkeys.d.ts","sourceRoot":"","sources":["../../src/middleware/passkeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAGL,4BAA4B,IAAI,wBAAwB,EACxD,0BAA0B,IAAI,sBAAsB,EACrD,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EACL,KAAK,QAAQ,EAKd,MAAM,WAAW,CAAC;AAkDnB;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAQ1C;AAQD,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,0BAA0B,CAAC,EAAE,OAAO,sBAAsB,CAAC;IAC3D,4BAA4B,CAAC,EAAE,OAAO,wBAAwB,CAAC;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAkKD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAMzD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAE,WAAgB,GAAG,IAAI,CAqGhF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAE,WAAgB,GAAG,IAAI,CA6HpF"}
+{"version":3,"file":"passkeys.d.ts","sourceRoot":"","sources":["../../src/middleware/passkeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAGL,4BAA4B,IAAI,wBAAwB,EACxD,0BAA0B,IAAI,sBAAsB,EACrD,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,WAAW,EAKjB,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AAEH,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,QAAQ,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAyBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAQlE;AAQD,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,0BAA0B,CAAC,EAAE,OAAO,sBAAsB,CAAC;IAC3D,4BAA4B,CAAC,EAAE,OAAO,wBAAwB,CAAC;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AA0JD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAM9E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,cAAc,EACnB,IAAI,GAAE,WAAgB,GACrB,IAAI,CAsGN;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,cAAc,EACnB,IAAI,GAAE,WAAgB,GACrB,IAAI,CA6HN"}