@schlessera/brain-ui-server 0.31.0 → 0.32.0

package/dist/index.d.ts

@@ -11,7 +11,7 @@
 export { createApp, type CreateAppOptions, type BrainUiApp, type AppRenderer, } from "./app.js";
 export { ENV_VARS, resolveServerConfig, type EnvVarDescriptor, type ServerConfig, type AuthConfig, type WebAuthnConfig, type AgentConfig, type VoiceConfig, } from "./config/env.js";
 export { assertBackendResolvable, createBackendRegistry, createStaticBackendRegistry, type BackendLogFn, type BackendRegistry, type ModelDiscoverySource, type ModelDiscoveryState, } from "./agent/backend.js";
-export { resolveAuthMode, type AuthMode, type AuthRuntime, } from "./middleware/auth.js";
+export { authGuard, bumpSessionsEpoch, isWsAuthorized, resolveAuthMode, type AuthMode, type AuthRuntime, } from "./middleware/auth.js";
 export { createUiDb } from "./db/client.js";
 export { openBrainDb, withBrainDb, BrainDbUnavailableError, MIN_BRAIN_SCHEMA_VERSION, } from "./db/brain-db.js";
 export { WsHost, type WsHostOptions } from "./ws/host.js";
@@ -26,6 +26,7 @@ export { createActivityStream, type ActivityStream } from "./activity/stream.js"
 export { ingestSpanSink } from "./activity/span-sink.js";
 export { generateActivityDigest, latestActivityDigest, DIGEST_JOB_NAME, type ActivityDigest, } from "./activity/digest.js";
 export { pruneShareStaging, shareStagingRoot } from "./share/staging.js";
+export { MAX_ARCHIVE_BYTES } from "./skills/install.js";
 export { createObservability, createRecordingObservability, createSilentObservability, createConsoleLoggerProvider, createRecordingLoggerProvider, createSilentLoggerProvider, createInMemoryMeterProvider, SEVERITIES, severityRank, seriesKey, } from "./observability/index.js";
 export type { Observability, ObservabilityOptions, RecordingObservability, RecordingLoggerProvider, InMemoryMeterProvider, LogReader, LogWriter, MetricsReader, Severity, CapturedLog, LogQuery, MetricPoint, MetricSnapshot, } from "./observability/index.js";
 export { buildKeyterms, writeCache, type KeytermSettings, } from "./voice/keyterm-builder.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,KAAK,QAAQ,EACb,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAI5C,OAAO,EACL,WAAW,EACX,WAAW,EACX,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,GACpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKxE,OAAO,EAAE,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKxE,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,KAAK,cAAc,GACpB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAKzE,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,2BAA2B,EAC3B,UAAU,EACV,YAAY,EACZ,SAAS,GACV,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,SAAS,EACT,SAAS,EACT,aAAa,EACb,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,WAAW,EACX,cAAc,GACf,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,aAAa,EACb,UAAU,EACV,KAAK,eAAe,GACrB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,KAAK,QAAQ,EACb,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAI5C,OAAO,EACL,WAAW,EACX,WAAW,EACX,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,GACpB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKxE,OAAO,EAAE,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKxE,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,KAAK,cAAc,GACpB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAKzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,2BAA2B,EAC3B,UAAU,EACV,YAAY,EACZ,SAAS,GACV,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,SAAS,EACT,SAAS,EACT,aAAa,EACb,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,WAAW,EACX,cAAc,GACf,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,aAAa,EACb,UAAU,EACV,KAAK,eAAe,GACrB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -15,7 +15,7 @@ export { ENV_VARS, resolveServerConfig, } from "./config/env.js";
 // Boot-time diagnostics (fail fast on a bad AGENT_BACKEND / profile config,
 // log the resolved auth mode).
 export { assertBackendResolvable, createBackendRegistry, createStaticBackendRegistry, } from "./agent/backend.js";
-export { resolveAuthMode, } from "./middleware/auth.js";
+export { authGuard, bumpSessionsEpoch, isWsAuthorized, resolveAuthMode, } from "./middleware/auth.js";
 // The app's own SQLite database (sessions, passkeys, settings).
 export { createUiDb } from "./db/client.js";
 // Brain database access (read-only, schema-gated) for embedders adding
@@ -44,6 +44,10 @@ export { generateActivityDigest, latestActivityDigest, DIGEST_JOB_NAME, } from "
 // Share staging: a deployment can sweep expired staging dirs at boot; the
 // intake route also sweeps opportunistically on every share.
 export { pruneShareStaging, shareStagingRoot } from "./share/staging.js";
+// Skill archive transport sizing for deployment shells. The route keeps the
+// application-level check; consumers use this value only to avoid setting a
+// smaller process-level request ceiling.
+export { MAX_ARCHIVE_BYTES } from "./skills/install.js";
 // Observability: the producing side is the OpenTelemetry API, the consuming
 // side is ours. Swap the consumer to change where a deployment reports; a test
 // swaps in the recording one and asserts on what the server actually said.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,SAAS,GAIV,MAAM,UAAU,CAAC;AAElB,6EAA6E;AAC7E,8EAA8E;AAC9E,OAAO,EACL,QAAQ,EACR,mBAAmB,GAOpB,MAAM,iBAAiB,CAAC;AAEzB,4EAA4E;AAC5E,+BAA+B;AAC/B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,GAK5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,GAGhB,MAAM,sBAAsB,CAAC;AAE9B,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,uEAAuE;AACvE,qBAAqB;AACrB,OAAO,EACL,WAAW,EACX,WAAW,EACX,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,+CAA+C;AAC/C,OAAO,EAAE,MAAM,EAAsB,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EACL,mBAAmB,EACnB,aAAa,GAEd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,oBAAoB,GAErB,MAAM,yBAAyB,CAAC;AAEjC,0EAA0E;AAC1E,2BAA2B;AAC3B,OAAO,EAAE,iBAAiB,EAAoB,MAAM,mBAAmB,CAAC;AAExE,8EAA8E;AAC9E,yEAAyE;AACzE,yCAAyC;AACzC,OAAO,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAExE,0EAA0E;AAC1E,6EAA6E;AAC7E,oCAAoC;AACpC,OAAO,EACL,mBAAmB,EACnB,aAAa,GAQd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAuB,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,GAEhB,MAAM,sBAAsB,CAAC;AAE9B,0EAA0E;AAC1E,6DAA6D;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEzE,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,2BAA2B,EAC3B,UAAU,EACV,YAAY,EACZ,SAAS,GACV,MAAM,0BAA0B,CAAC;AAiBlC,wEAAwE;AACxE,OAAO,EACL,aAAa,EACb,UAAU,GAEX,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,SAAS,GAIV,MAAM,UAAU,CAAC;AAElB,6EAA6E;AAC7E,8EAA8E;AAC9E,OAAO,EACL,QAAQ,EACR,mBAAmB,GAOpB,MAAM,iBAAiB,CAAC;AAEzB,4EAA4E;AAC5E,+BAA+B;AAC/B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,GAK5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,eAAe,GAGhB,MAAM,sBAAsB,CAAC;AAE9B,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,uEAAuE;AACvE,qBAAqB;AACrB,OAAO,EACL,WAAW,EACX,WAAW,EACX,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,+CAA+C;AAC/C,OAAO,EAAE,MAAM,EAAsB,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EACL,mBAAmB,EACnB,aAAa,GAEd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,oBAAoB,GAErB,MAAM,yBAAyB,CAAC;AAEjC,0EAA0E;AAC1E,2BAA2B;AAC3B,OAAO,EAAE,iBAAiB,EAAoB,MAAM,mBAAmB,CAAC;AAExE,8EAA8E;AAC9E,yEAAyE;AACzE,yCAAyC;AACzC,OAAO,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAExE,0EAA0E;AAC1E,6EAA6E;AAC7E,oCAAoC;AACpC,OAAO,EACL,mBAAmB,EACnB,aAAa,GAQd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAuB,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,GAEhB,MAAM,sBAAsB,CAAC;AAE9B,0EAA0E;AAC1E,6DAA6D;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEzE,4EAA4E;AAC5E,4EAA4E;AAC5E,yCAAyC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,2BAA2B,EAC3B,UAAU,EACV,YAAY,EACZ,SAAS,GACV,MAAM,0BAA0B,CAAC;AAiBlC,wEAAwE;AACxE,OAAO,EACL,aAAa,EACb,UAAU,GAEX,MAAM,4BAA4B,CAAC"}

package/dist/middleware/auth.d.ts

@@ -2,7 +2,9 @@ import type { Counter } from "@opentelemetry/api";
 import type { Logger } from "@opentelemetry/api-logs";
 import { Hono } from "hono";
 import type { Context, MiddlewareHandler } from "hono";
+import type { Database } from "bun:sqlite";
 import type { AuthConfig } from "../config/env.js";
+import type { ClientSet } from "../ws/clients.js";
 /**
  * Authentication for a remote surface to an agent with write access to the
  * user's files. Modes (AUTH_MODE):
@@ -33,7 +35,8 @@ export interface AuthRuntime extends AuthConfig {
     host: string;
 }
 export declare const LOGIN_RATE_LIMIT = 5;
-export declare const GLOBAL_LOGIN_RATE_LIMIT = 20;
+export declare const GLOBAL_LOGIN_RATE_LIMIT = 100;
+export declare const PASSKEY_LOGIN_RATE_LIMIT = 5;
 export declare function resolveAuthMode(auth: AuthRuntime, log?: Logger): AuthMode;
 /**
  * Validate the auth configuration at startup. Throws (refusing to boot) on an
@@ -41,7 +44,7 @@ export declare function resolveAuthMode(auth: AuthRuntime, log?: Logger): AuthMo
  */
 export declare function assertAuthConfig(mode: AuthMode, auth: AuthRuntime, log?: Logger): void;
 /** Middleware guarding /api/* according to the resolved mode. */
-export declare function authGuard(mode: AuthMode, auth: AuthRuntime): MiddlewareHandler;
+export declare function authGuard(mode: AuthMode, auth: AuthRuntime, db: Database): MiddlewareHandler;
 /**
  * Authorize a WebSocket upgrade. The upgrade handler must call this itself —
  * browsers can't set headers on the WS handshake, so the session cookie (sent
@@ -49,18 +52,33 @@ export declare function authGuard(mode: AuthMode, auth: AuthRuntime): Middleware
  * middleware may sit on the WS route (immutable-header errors). Mirrors
  * {@link authGuard} without emitting a response.
  */
-export declare function isWsAuthorized(c: Context, mode: AuthMode, auth: AuthRuntime): Promise<boolean>;
+export declare function isWsAuthorized(c: Context, mode: AuthMode, auth: AuthRuntime, db: Database): Promise<boolean>;
 /**
  * Mint the session cookie. The single place a session comes into existence —
  * both password login and passkey login (middleware/passkeys.ts) call this, so
  * authGuard / isWsAuthorized / TTL semantics stay identical across methods.
  */
-export declare function issueSessionCookie(c: Context, auth: AuthRuntime): Promise<void>;
+export declare function issueSessionCookie(c: Context, auth: AuthRuntime, db: Database): Promise<void>;
+/** Invalidate every issued session and disconnect every attached client. */
+export declare function bumpSessionsEpoch(db: Database, clients: ClientSet): number;
+/** Record one genuine authentication failure in a fixed one-minute window. */
+export declare function recordLoginFailure(key: string, limit: number): void;
+/** Read without allocating: junk requests cannot grow the failure map. */
+export declare function isLoginBlocked(key: string, limit: number): boolean;
+/** Internal middleware coordination; not exported from the package root. */
+export declare function acquirePasskeyVerification(ip: string): boolean;
+/** Internal middleware coordination; not exported from the package root. */
+export declare function releasePasskeyVerification(ip: string): void;
 /** Test-only: clear all rate-limit buckets (they are module-global state). */
 export declare function resetLoginRateLimiter(): void;
+/** Attempt-counting bucket retained for passkey option generation. */
 export declare function consumeLoginToken(key: string, limit: number): boolean;
 /** Login/logout routes. Only functional in `password` mode. */
-export declare function authRoutes(mode: AuthMode, auth: AuthRuntime, deps?: {
+export declare function authRoutes(mode: AuthMode, auth: AuthRuntime, deps: {
+    /** Authoritative session state. */
+    db: Database;
+    /** Live sockets closed whenever the global session epoch advances. */
+    clients: ClientSet;
     /**
      * When provided and returning true, password login is refused (the app
      * injects passkeys' passwordLoginDisabled so the shared password dies
@@ -72,5 +90,7 @@ export declare function authRoutes(mode: AuthMode, auth: AuthRuntime, deps?: {
     log?: Logger;
     /** Failed-login counter — the same `auth.failures` instrument passkeys use. */
     failures?: Counter;
+    /** Test-only password verifier; production uses Bun.password.verify. */
+    verifyPassword?: (password: string, hash: string) => Promise<boolean>;
 }): Hono;
 //# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;AAEnE,iEAAiE;AACjE,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAID,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAQlC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,QAAQ,CAWzE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAqEtF;AAED,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,GAAG,iBAAiB,CAqC9E;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,CAAC,EAAE,OAAO,EACV,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,OAAO,CAAC,CAWlB;AAID;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAYrF;AAwCD,8EAA8E;AAC9E,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAUrE;AAED,+DAA+D;AAC/D,wBAAgB,UAAU,CACxB,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;IACJ;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;IAC3C,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACf,GACL,IAAI,CA8FN"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;AAEnE,iEAAiE;AACjE,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAOD,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAiBlC,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAa1C,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,QAAQ,CAWzE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAqEtF;AAED,iEAAiE;AACjE,wBAAgB,SAAS,CACvB,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,QAAQ,GACX,iBAAiB,CAqCnB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,CAAC,EAAE,OAAO,EACV,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,QAAQ,GACX,OAAO,CAAC,OAAO,CAAC,CAWlB;AAID;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,CAAC,EAAE,OAAO,EACV,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,QAAQ,GACX,OAAO,CAAC,IAAI,CAAC,CAaf;AAyDD,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,CAS1E;AA8DD,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAKnE;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CASlE;AAoED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,+DAA+D;AAC/D,wBAAgB,UAAU,CACxB,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE;IACJ,mCAAmC;IACnC,EAAE,EAAE,QAAQ,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,SAAS,CAAC;IACnB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;IAC3C,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wEAAwE;IACxE,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE,GACA,IAAI,CAkIN"}

package/dist/middleware/auth.js

@@ -1,17 +1,44 @@
 import { Hono } from "hono";
 import { getSignedCookie, setSignedCookie, deleteCookie } from "hono/cookie";
 import { isTailscaleAllowed, clientIp } from "./tailscale.js";
+import { readJsonBody } from "./body-limit.js";
+import { requireJson } from "./origin.js";
+import { setSetting } from "../db/settings.js";
 const COOKIE_NAME = "brain_ui_session";
 const SESSION_TTL_SECONDS = 30 * 24 * 60 * 60; // 30 days
-export const LOGIN_RATE_LIMIT = 5; // attempts per window, per client IP
+const SESSIONS_EPOCH_KEY = "auth.sessionsEpoch";
+const SESSION_REVOKED_CLOSE_CODE = 1008;
+const SESSION_REVOKED_CLOSE_REASON = "Sessions invalidated";
+export const LOGIN_RATE_LIMIT = 5; // failures per window, per client IP
 const LOGIN_RATE_WINDOW_MS = 60_000; // per minute
 // A global cap in addition to the per-IP one: the per-IP key is derived from
 // X-Forwarded-For, which a client behind a trusted proxy can rotate to mint a
 // fresh bucket per request. The global cap bounds brute force across rotated
-// IPs. It stays well above a human's needs and, combined with the argon2id
-// verify cost, makes online guessing infeasible without being a lockout an
-// attacker could weaponize to deny the owner access.
-export const GLOBAL_LOGIN_RATE_LIMIT = 20; // attempts per window, all IPs combined
+// IPs. At 100 genuine failures/minute it stays well above a human's needs and
+// makes a global lockout substantially harder to weaponize, while still
+// bounding distributed online guessing. Per-IP failures remain at 5/minute.
+// Passkeys get 5 matched-but-invalid assertions/minute in an independent
+// `pk:` bucket: assertions are not guessable, but verification still consumes
+// resources. Password and passkey verification therefore each allow two
+// in-flight operations per IP and eight process-wide. Two tolerates a browser
+// retry/double-submit; eight bounds either verifier's comparable CPU cost.
+// Keeping the reservation pools separate preserves passkeys' independent
+// admission path while each pool still has a process-wide ceiling. The failure
+// map and both reservation maps cap at 1,024 source keys, comfortably above
+// the global password-failure budget while bounding forged-IP memory growth.
+export const GLOBAL_LOGIN_RATE_LIMIT = 100; // failures per window, all IPs combined
+export const PASSKEY_LOGIN_RATE_LIMIT = 5;
+const PASSWORD_VERIFY_IN_FLIGHT_PER_IP = 2;
+const PASSWORD_VERIFY_IN_FLIGHT_GLOBAL = 8;
+const PASSKEY_VERIFY_IN_FLIGHT_PER_IP = 2;
+const PASSKEY_VERIFY_IN_FLIGHT_GLOBAL = 8;
+const LOGIN_BUCKET_CAP = 1_024;
+// Client-derived password buckets always start `pw:ip:`, which cannot equal
+// the fixed `pw:global` key for any client-controlled key suffix. Keeping these
+// namespaces disjoint prevents a per-IP saturated write from clamping the
+// authoritative global failure counter to the smaller per-IP limit.
+const PASSWORD_IP_BUCKET_PREFIX = "pw:ip:";
+const PASSWORD_GLOBAL_BUCKET = "pw:global";
 export function resolveAuthMode(auth, log) {
     if (auth.mode)
         return auth.mode;
@@ -89,7 +116,7 @@ export function assertAuthConfig(mode, auth, log) {
     });
 }
 /** Middleware guarding /api/* according to the resolved mode. */
-export function authGuard(mode, auth) {
+export function authGuard(mode, auth, db) {
     switch (mode) {
         case "tailscale":
             return async (c, next) => {
@@ -111,7 +138,7 @@ export function authGuard(mode, auth) {
             };
         case "password":
             return async (c, next) => {
-                if (await hasValidSession(c, auth)) {
+                if (await hasValidSession(c, auth, db)) {
                     await next();
                 }
                 else {
@@ -131,7 +158,7 @@ export function authGuard(mode, auth) {
  * middleware may sit on the WS route (immutable-header errors). Mirrors
  * {@link authGuard} without emitting a response.
  */
-export async function isWsAuthorized(c, mode, auth) {
+export async function isWsAuthorized(c, mode, auth, db) {
     switch (mode) {
         case "none":
             return true;
@@ -140,7 +167,7 @@ export async function isWsAuthorized(c, mode, auth) {
         case "proxy":
             return hasProxyAuth(c, auth);
         case "password":
-            return hasValidSession(c, auth);
+            return hasValidSession(c, auth, db);
     }
 }
 // --- password mode helpers ---
@@ -149,9 +176,10 @@ export async function isWsAuthorized(c, mode, auth) {
  * both password login and passkey login (middleware/passkeys.ts) call this, so
  * authGuard / isWsAuthorized / TTL semantics stay identical across methods.
  */
-export async function issueSessionCookie(c, auth) {
+export async function issueSessionCookie(c, auth, db) {
     const secret = auth.cookieSecret ?? "";
-    await setSignedCookie(c, COOKIE_NAME, String(Date.now()), secret, {
+    const epoch = sessionsEpoch(db);
+    await setSignedCookie(c, COOKIE_NAME, `${Date.now()}.${epoch}`, secret, {
         httpOnly: true,
         sameSite: "Strict",
         // Always Secure — every real deployment serves over HTTPS, and we do not
@@ -162,26 +190,69 @@ export async function issueSessionCookie(c, auth) {
         maxAge: SESSION_TTL_SECONDS,
     });
 }
-async function hasValidSession(c, auth) {
+async function hasValidSession(c, auth, db) {
     const secret = auth.cookieSecret ?? "";
     if (!secret)
         return false;
+    let value;
     try {
-        const value = await getSignedCookie(c, secret, COOKIE_NAME);
-        if (typeof value !== "string" || value.length === 0)
-            return false;
-        // The cookie value is the issue timestamp. Validate its age server-side:
-        // Max-Age is client-discardable, so the signature alone does not bound a
-        // session's lifetime — this does.
-        const issuedAt = Number(value);
-        if (!Number.isFinite(issuedAt))
-            return false;
-        const ageSeconds = (Date.now() - issuedAt) / 1000;
-        return ageSeconds >= 0 && ageSeconds < SESSION_TTL_SECONDS;
+        value = await getSignedCookie(c, secret, COOKIE_NAME);
     }
     catch {
         return false;
     }
+    if (typeof value !== "string" || value.length === 0)
+        return false;
+    // Both fields are decimal integers. Requiring the exact shape rejects every
+    // pre-epoch cookie instead of accidentally interpreting its timestamp as a
+    // current session.
+    const match = /^(\d+)\.(\d+)$/.exec(value);
+    if (!match)
+        return false;
+    const issuedAt = Number(match[1]);
+    const cookieEpoch = Number(match[2]);
+    if (!Number.isSafeInteger(issuedAt) || !Number.isSafeInteger(cookieEpoch)) {
+        return false;
+    }
+    const ageSeconds = (Date.now() - issuedAt) / 1000;
+    if (ageSeconds < 0 || ageSeconds >= SESSION_TTL_SECONDS)
+        return false;
+    // Deliberately outside the cookie-parser catch: corrupt authoritative auth
+    // state refuses loudly and must never degrade to epoch zero.
+    return cookieEpoch === sessionsEpoch(db);
+}
+/**
+ * Read authoritative session state. A missing row is first-run epoch zero;
+ * any present row that is not a non-negative safe integer is corruption.
+ */
+function sessionsEpoch(db) {
+    const row = db
+        .query("SELECT value FROM settings WHERE key = ?")
+        .get(SESSIONS_EPOCH_KEY);
+    if (!row)
+        return 0;
+    let value;
+    try {
+        value = JSON.parse(row.value);
+    }
+    catch {
+        throw new Error(`Corrupt ${SESSIONS_EPOCH_KEY}: expected a JSON integer`);
+    }
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new Error(`Corrupt ${SESSIONS_EPOCH_KEY}: expected a non-negative integer`);
+    }
+    return value;
+}
+/** Invalidate every issued session and disconnect every attached client. */
+export function bumpSessionsEpoch(db, clients) {
+    const current = sessionsEpoch(db);
+    if (current === Number.MAX_SAFE_INTEGER) {
+        throw new Error(`${SESSIONS_EPOCH_KEY} cannot be advanced safely`);
+    }
+    const next = current + 1;
+    setSetting(db, SESSIONS_EPOCH_KEY, next);
+    clients.closeAll(SESSION_REVOKED_CLOSE_CODE, SESSION_REVOKED_CLOSE_REASON);
+    return next;
 }
 // --- proxy mode helpers ---
 function hasProxyAuth(c, auth) {
@@ -195,63 +266,190 @@ function hasProxyAuth(c, auth) {
     return !!user && user.trim().length > 0;
 }
 const loginBuckets = new Map();
+function pruneExpiredBuckets(now) {
+    for (const [key, bucket] of loginBuckets) {
+        if (now >= bucket.resetAt)
+            loginBuckets.delete(key);
+    }
+}
+function makeBucketRoom() {
+    while (loginBuckets.size >= LOGIN_BUCKET_CAP) {
+        // Keep the global password bucket authoritative. The cap is larger than
+        // its maximum number of per-IP contributors in one window, so ordinary
+        // password traffic never needs to evict an active per-IP failure record.
+        const oldest = [...loginBuckets.keys()].find((key) => key !== PASSWORD_GLOBAL_BUCKET);
+        if (oldest === undefined)
+            break;
+        loginBuckets.delete(oldest);
+    }
+}
+function bucketForWrite(key, now) {
+    pruneExpiredBuckets(now);
+    const existing = loginBuckets.get(key);
+    if (existing)
+        return existing;
+    makeBucketRoom();
+    const bucket = { failures: 0, resetAt: now + LOGIN_RATE_WINDOW_MS };
+    loginBuckets.set(key, bucket);
+    return bucket;
+}
+/** Record one genuine authentication failure in a fixed one-minute window. */
+export function recordLoginFailure(key, limit) {
+    const bucket = bucketForWrite(key, Date.now());
+    // Saturate: callers only care whether the limit was reached, and this avoids
+    // an unbounded counter if a test or future caller records after blocking.
+    bucket.failures = Math.min(limit, bucket.failures + 1);
+}
+/** Read without allocating: junk requests cannot grow the failure map. */
+export function isLoginBlocked(key, limit) {
+    const now = Date.now();
+    const bucket = loginBuckets.get(key);
+    if (!bucket)
+        return false;
+    if (now >= bucket.resetAt) {
+        loginBuckets.delete(key);
+        return false;
+    }
+    return bucket.failures >= limit;
+}
+function createVerificationReservations(perIpLimit, globalLimit) {
+    const buckets = new Map();
+    let totalInFlight = 0;
+    function prune(now) {
+        for (const [key, bucket] of buckets) {
+            if (bucket.count === 0 && now >= bucket.expiresAt)
+                buckets.delete(key);
+        }
+    }
+    return {
+        acquire(ip) {
+            const now = Date.now();
+            prune(now);
+            if (totalInFlight >= globalLimit)
+                return false;
+            let bucket = buckets.get(ip);
+            if (bucket && bucket.count >= perIpLimit)
+                return false;
+            if (!bucket) {
+                while (buckets.size >= LOGIN_BUCKET_CAP) {
+                    const idle = [...buckets].find(([, entry]) => entry.count === 0);
+                    if (!idle)
+                        return false;
+                    buckets.delete(idle[0]);
+                }
+                bucket = { count: 0, expiresAt: now + LOGIN_RATE_WINDOW_MS };
+                buckets.set(ip, bucket);
+            }
+            bucket.count++;
+            bucket.expiresAt = now + LOGIN_RATE_WINDOW_MS;
+            totalInFlight++;
+            return true;
+        },
+        release(ip) {
+            const bucket = buckets.get(ip);
+            if (!bucket || bucket.count === 0)
+                return;
+            bucket.count--;
+            bucket.expiresAt = Date.now() + LOGIN_RATE_WINDOW_MS;
+            totalInFlight--;
+        },
+        reset() {
+            buckets.clear();
+            totalInFlight = 0;
+        },
+    };
+}
+const passwordVerifications = createVerificationReservations(PASSWORD_VERIFY_IN_FLIGHT_PER_IP, PASSWORD_VERIFY_IN_FLIGHT_GLOBAL);
+const passkeyVerifications = createVerificationReservations(PASSKEY_VERIFY_IN_FLIGHT_PER_IP, PASSKEY_VERIFY_IN_FLIGHT_GLOBAL);
+function acquirePasswordVerification(ip) {
+    return passwordVerifications.acquire(ip);
+}
+function releasePasswordVerification(ip) {
+    passwordVerifications.release(ip);
+}
+/** Internal middleware coordination; not exported from the package root. */
+export function acquirePasskeyVerification(ip) {
+    return passkeyVerifications.acquire(ip);
+}
+/** Internal middleware coordination; not exported from the package root. */
+export function releasePasskeyVerification(ip) {
+    passkeyVerifications.release(ip);
+}
 /** Test-only: clear all rate-limit buckets (they are module-global state). */
 export function resetLoginRateLimiter() {
     loginBuckets.clear();
+    passwordVerifications.reset();
+    passkeyVerifications.reset();
 }
+/** Attempt-counting bucket retained for passkey option generation. */
 export function consumeLoginToken(key, limit) {
-    const now = Date.now();
-    let bucket = loginBuckets.get(key);
-    if (!bucket || now >= bucket.resetAt) {
-        bucket = { tokens: limit, resetAt: now + LOGIN_RATE_WINDOW_MS };
-        loginBuckets.set(key, bucket);
-    }
-    if (bucket.tokens <= 0)
+    if (isLoginBlocked(key, limit))
         return false;
-    bucket.tokens--;
+    recordLoginFailure(key, limit);
     return true;
 }
 /** Login/logout routes. Only functional in `password` mode. */
-export function authRoutes(mode, auth, deps = {}) {
+export function authRoutes(mode, auth, deps) {
     const app = new Hono();
     const { log, failures } = deps;
-    app.post("/auth/login", async (c) => {
+    const verifyPassword = deps.verifyPassword ?? Bun.password.verify;
+    let warnedUntrustedForwardedFor = false;
+    app.post("/auth/login", requireJson(), async (c) => {
         if (mode !== "password") {
             return c.json({ error: "Password login is not enabled" }, 400);
         }
+        if (!auth.trustProxy &&
+            !warnedUntrustedForwardedFor &&
+            c.req.header("x-forwarded-for")) {
+            warnedUntrustedForwardedFor = true;
+            log?.emit({
+                severityText: "WARN",
+                body: "X-Forwarded-For ignored in password mode",
+                attributes: { "auth.mode": "password", "auth.trust_proxy": false },
+            });
+        }
         const key = clientIp(c, auth.trustProxy, auth.trustProxyHops) || "unknown";
-        const perIpOk = consumeLoginToken(`ip:${key}`, LOGIN_RATE_LIMIT);
-        const globalOk = consumeLoginToken("global", GLOBAL_LOGIN_RATE_LIMIT);
-        if (!perIpOk || !globalOk) {
+        const perIpBucket = `${PASSWORD_IP_BUCKET_PREFIX}${key}`;
+        if (deps.passwordDisabled?.(c)) {
+            return c.json({ error: "Password login is disabled — sign in with a passkey." }, 403);
+        }
+        // Refuse a blocked client before reading its body: admission control is
+        // cheapest when it costs no parsing.
+        const perIpBlocked = isLoginBlocked(perIpBucket, LOGIN_RATE_LIMIT);
+        const globalBlocked = isLoginBlocked(PASSWORD_GLOBAL_BUCKET, GLOBAL_LOGIN_RATE_LIMIT);
+        if (perIpBlocked || globalBlocked) {
             failures?.add(1, { reason: "rate_limited", method: "password" });
             log?.emit({
                 severityText: "WARN",
                 body: "login rate limited",
-                attributes: { ip: key, limit: perIpOk ? "global" : "ip" },
+                attributes: { ip: key, limit: perIpBlocked ? "ip" : "global" },
             });
             return c.json({ error: "Too many attempts. Try again in a minute." }, 429);
         }
-        if (deps.passwordDisabled?.(c)) {
-            return c.json({ error: "Password login is disabled — sign in with a passkey." }, 403);
-        }
         const hash = auth.passwordHash ?? "";
         const secret = auth.cookieSecret ?? "";
         let body;
         try {
-            body = await c.req.json();
+            const result = await readJsonBody(c);
+            if (result instanceof Response)
+                return result;
+            body = result;
         }
         catch {
             return c.json({ error: "Invalid request body" }, 400);
         }
         const password = typeof body.password === "string" ? body.password : "";
         if (!password || !hash || !secret) {
-            failures?.add(1, { reason: "invalid_password", method: "password" });
+            return c.json({ error: "Invalid credentials" }, 401);
+        }
+        if (!acquirePasswordVerification(key)) {
+            failures?.add(1, { reason: "in_flight_limited", method: "password" });
             log?.emit({
                 severityText: "WARN",
-                body: "login failed",
+                body: "password verification capacity reached",
                 attributes: { ip: key },
             });
-            return c.json({ error: "Invalid credentials" }, 401);
+            return c.json({ error: "Too many login verifications in progress." }, 429);
         }
         // A verify that THROWS is not a wrong password — it is a hash Bun cannot
         // parse (a corrupt BRAIN_UI_PASSWORD_HASH locks the owner out of every
@@ -259,11 +457,14 @@ export function authRoutes(mode, auth, deps = {}) {
         let ok = false;
         let verifyError = null;
         try {
-            ok = await Bun.password.verify(password, hash);
+            ok = await verifyPassword(password, hash);
         }
         catch (err) {
             verifyError = err;
         }
+        finally {
+            releasePasswordVerification(key);
+        }
         if (verifyError) {
             failures?.add(1, { reason: "verify_error", method: "password" });
             log?.emit({
@@ -276,6 +477,8 @@ export function authRoutes(mode, auth, deps = {}) {
             return c.json({ error: "Invalid credentials" }, 401);
         }
         if (!ok) {
+            recordLoginFailure(perIpBucket, LOGIN_RATE_LIMIT);
+            recordLoginFailure(PASSWORD_GLOBAL_BUCKET, GLOBAL_LOGIN_RATE_LIMIT);
             failures?.add(1, { reason: "invalid_password", method: "password" });
             log?.emit({
                 severityText: "WARN",
@@ -284,7 +487,7 @@ export function authRoutes(mode, auth, deps = {}) {
             });
             return c.json({ error: "Invalid credentials" }, 401);
         }
-        await issueSessionCookie(c, auth);
+        await issueSessionCookie(c, auth, deps.db);
         log?.emit({
             severityText: "INFO",
             body: "login succeeded",
@@ -292,7 +495,12 @@ export function authRoutes(mode, auth, deps = {}) {
         });
         return c.json({ ok: true });
     });
-    app.post("/auth/logout", (c) => {
+    app.post("/auth/logout", async (c) => {
+        if (mode === "password" && !(await hasValidSession(c, auth, deps.db))) {
+            return c.json({ error: "Authentication required", authRequired: true }, 401);
+        }
+        if (mode === "password")
+            bumpSessionsEpoch(deps.db, deps.clients);
         deleteCookie(c, COOKIE_NAME, { path: "/" });
         return c.json({ ok: true });
     });

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAmC9D,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,qCAAqC;AACxE,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,aAAa;AAClD,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,qDAAqD;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC,CAAC,wCAAwC;AAEnF,MAAM,UAAU,eAAe,CAAC,IAAiB,EAAE,GAAY;IAC7D,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EAAE,2CAA2C;YACjD,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,UAAU,CAAC;IACzC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,IAAiB,EAAE,GAAY;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;IAEhF,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,kFAAkF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,sEAAsE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,2BAA2B;IAC3B,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,wEAAwE;YACxE,wEAAwE;YACxE,sDAAsD;YACtD,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,OAAO;gBACrB,IAAI,EACF,oDAAoD;oBACpD,oEAAoE;oBACpE,kEAAkE;gBACpE,UAAU,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,0DAA0D;gBACxD,cAAc,IAAI,sDAAsD;gBACxE,0EAA0E;gBAC1E,kEAAkE;gBAClE,iEAAiE;gBACjE,sCAAsC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,sEAAsE;gBACtE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EACF,yEAAyE;gBACzE,qCAAqC;YACvC,UAAU,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE;SACnE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,GAAG,EAAE,IAAI,CAAC;QACR,YAAY,EAAE,MAAM;QACpB,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;KAClC,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,SAAS,CAAC,IAAc,EAAE,IAAiB;IACzD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;oBAChE,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,MAAM;YACT,OAAO,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;gBACxB,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,CAAU,EACV,IAAc,EACd,IAAiB;IAEjB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,WAAW;YACd,OAAO,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACrE,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,CAAU,EAAE,IAAiB;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACvC,MAAM,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE;QAChE,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,mBAAmB;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,CAAU,EAAE,IAAiB;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,yEAAyE;QACzE,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;QAClD,OAAO,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,mBAAmB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,6BAA6B;AAE7B,SAAS,YAAY,CAAC,CAAU,EAAE,IAAiB;IACjD,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1C,CAAC;AAQD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB;IACnC,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;QAChE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CACxB,IAAc,EACd,IAAiB,EACjB,OAYI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE/B,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QAC3E,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,GAAG,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACjE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,oBAAoB;gBAC1B,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE;aAC1D,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,sDAAsD,EAAE,EACjE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACvC,IAAI,IAA4B,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACrE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,EAAE,GAAG,KAAK,CAAC;QACf,IAAI,WAAW,GAAY,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,GAAG,GAAG,CAAC;QACpB,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACjE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,8DAA8D;gBACpE,UAAU,EAAE;oBACV,KAAK,EAAE,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;iBAChF;aACF,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACrE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAmC/C,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AACzD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,qCAAqC;AACxE,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,aAAa;AAClD,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,2EAA2E;AAC3E,yEAAyE;AACzE,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC,CAAC,wCAAwC;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAC1C,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC3C,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC3C,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAC1C,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,4EAA4E;AAC5E,gFAAgF;AAChF,0EAA0E;AAC1E,oEAAoE;AACpE,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAC3C,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAE3C,MAAM,UAAU,eAAe,CAAC,IAAiB,EAAE,GAAY;IAC7D,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EAAE,2CAA2C;YACjD,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,UAAU,CAAC;IACzC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,IAAiB,EAAE,GAAY;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;IAEhF,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,kFAAkF,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,sEAAsE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,2BAA2B;IAC3B,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,wEAAwE;YACxE,wEAAwE;YACxE,sDAAsD;YACtD,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,OAAO;gBACrB,IAAI,EACF,oDAAoD;oBACpD,oEAAoE;oBACpE,kEAAkE;gBACpE,UAAU,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,0DAA0D;gBACxD,cAAc,IAAI,sDAAsD;gBACxE,0EAA0E;gBAC1E,kEAAkE;gBAClE,iEAAiE;gBACjE,sCAAsC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,sEAAsE;gBACtE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EACF,yEAAyE;gBACzE,qCAAqC;YACvC,UAAU,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE;SACnE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,GAAG,EAAE,IAAI,CAAC;QACR,YAAY,EAAE,MAAM;QACpB,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;KAClC,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,SAAS,CACvB,IAAc,EACd,IAAiB,EACjB,EAAY;IAEZ,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;oBAChE,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,IAAI,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,EAAE,CAAC;gBACf,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EACxD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;QACJ,KAAK,MAAM;YACT,OAAO,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;gBACxB,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,CAAU,EACV,IAAc,EACd,IAAiB,EACjB,EAAY;IAEZ,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,WAAW;YACd,OAAO,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACrE,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,CAAU,EACV,IAAiB,EACjB,EAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,EAAE,EAAE,MAAM,EAAE;QACtE,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;QAClB,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,mBAAmB;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,CAAU,EACV,IAAiB,EACjB,EAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAElE,4EAA4E;IAC5E,2EAA2E;IAC3E,mBAAmB;IACnB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC;IAClD,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAEtE,2EAA2E;IAC3E,6DAA6D;IAC7D,OAAO,WAAW,KAAK,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,EAAY;IACjC,MAAM,GAAG,GAAG,EAAE;SACX,KAAK,CAAC,0CAA0C,CAAC;SACjD,GAAG,CAAC,kBAAkB,CAA6B,CAAC;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IAEnB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,WAAW,kBAAkB,2BAA2B,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,WAAW,kBAAkB,mCAAmC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAe,CAAC;AACzB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,EAAY,EAAE,OAAkB;IAChE,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,GAAG,kBAAkB,4BAA4B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,CAAC;IACzB,UAAU,CAAC,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACzC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,EAAE,4BAA4B,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6BAA6B;AAE7B,SAAS,YAAY,CAAC,CAAU,EAAE,IAAiB;IACjD,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1C,CAAC;AAQD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAa/C,SAAS,mBAAmB,CAAC,GAAW;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QACzC,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO;YAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,YAAY,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAC7C,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,sBAAsB,CACxC,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,GAAW;IAC9C,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,cAAc,EAAE,CAAC;IACjB,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;IACpE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,KAAa;IAC3D,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,KAAa;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1B,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;AAClC,CAAC;AAED,SAAS,8BAA8B,CACrC,UAAkB,EAClB,WAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,SAAS,KAAK,CAAC,GAAW;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,SAAS;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,CAAC,EAAE;YACR,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,CAAC,GAAG,CAAC,CAAC;YACX,IAAI,aAAa,IAAI,WAAW;gBAAE,OAAO,KAAK,CAAC;YAE/C,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,UAAU;gBAAE,OAAO,KAAK,CAAC;YACvD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;oBACxC,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;oBACjE,IAAI,CAAC,IAAI;wBAAE,OAAO,KAAK,CAAC;oBACxB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1B,CAAC;gBACD,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;gBAC7D,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,SAAS,GAAG,GAAG,GAAG,oBAAoB,CAAC;YAC9C,aAAa,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,EAAE;YACR,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC;gBAAE,OAAO;YAC1C,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;YACrD,aAAa,EAAE,CAAC;QAClB,CAAC;QACD,KAAK;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,aAAa,GAAG,CAAC,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GAAG,8BAA8B,CAC1D,gCAAgC,EAChC,gCAAgC,CACjC,CAAC;AACF,MAAM,oBAAoB,GAAG,8BAA8B,CACzD,+BAA+B,EAC/B,+BAA+B,CAChC,CAAC;AAEF,SAAS,2BAA2B,CAAC,EAAU;IAC7C,OAAO,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,2BAA2B,CAAC,EAAU;IAC7C,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,0BAA0B,CAAC,EAAU;IACnD,OAAO,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,0BAA0B,CAAC,EAAU;IACnD,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB;IACnC,YAAY,CAAC,KAAK,EAAE,CAAC;IACrB,qBAAqB,CAAC,KAAK,EAAE,CAAC;IAC9B,oBAAoB,CAAC,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IAC1D,IAAI,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CACxB,IAAc,EACd,IAAiB,EACjB,IAkBC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IAClE,IAAI,2BAA2B,GAAG,KAAK,CAAC;IAExC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,IACE,CAAC,IAAI,CAAC,UAAU;YAChB,CAAC,2BAA2B;YAC5B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAC/B,CAAC;YACD,2BAA2B,GAAG,IAAI,CAAC;YACnC,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,0CAA0C;gBAChD,UAAU,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,KAAK,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QAC3E,MAAM,WAAW,GAAG,GAAG,yBAAyB,GAAG,GAAG,EAAE,CAAC;QAEzD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,sDAAsD,EAAE,EACjE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,qCAAqC;QACrC,MAAM,YAAY,GAAG,cAAc,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACnE,MAAM,aAAa,GAAG,cAAc,CAClC,sBAAsB,EACtB,uBAAuB,CACxB,CAAC;QACF,IAAI,YAAY,IAAI,aAAa,EAAE,CAAC;YAClC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACjE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,oBAAoB;gBAC1B,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;aAC/D,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACvC,IAAI,IAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAyB,CAAC,CAAC,CAAC;YAC7D,IAAI,MAAM,YAAY,QAAQ;gBAAE,OAAO,MAAM,CAAC;YAC9C,IAAI,GAAG,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACtE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,wCAAwC;gBAC9C,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,EAAE,GAAG,KAAK,CAAC;QACf,IAAI,WAAW,GAAY,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,GAAG,GAAG,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACjE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,8DAA8D;gBACpE,UAAU,EAAE;oBACV,KAAK,EAAE,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;iBAChF;aACF,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,kBAAkB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YAClD,kBAAkB,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;YACpE,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACrE,GAAG,EAAE,IAAI,CAAC;gBACR,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;aACxB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3C,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,IAAI,KAAK,UAAU;YAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}