@shipfox/api-auth 18.0.0 → 20.0.0

package/dist/core/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/auth.ts"],"sourcesContent":["import {type AdminRole, emailSchema} from '@shipfox/api-auth-dto';\nimport {\n  confirmEmailChallenge,\n  consumeEmailChallengeProof,\n  createEmailChallenge,\n  resendEmailChallenge,\n} from '@shipfox/api-email-challenges';\nimport {\n  type WorkspacesInterModuleClient,\n  workspacesInterModuleContract,\n} from '@shipfox/api-workspaces-dto/inter-module';\nimport {isInterModuleKnownError} from '@shipfox/inter-module';\nimport {userAccessTokenKey} from '@shipfox/node-auth-root-key';\nimport {durationToSeconds} from '@shipfox/node-jwt';\nimport {generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {config} from '#config.js';\nimport {consumePasswordReset, createPasswordReset} from '#db/password-resets.js';\nimport {\n  createRefreshTokenForActiveUser,\n  findActiveRefreshTokenByHash,\n  findRefreshTokenByHash,\n  revokeRefreshSession,\n  revokeRefreshTokensForUser,\n  rotateRefreshToken,\n} from '#db/refresh-tokens.js';\nimport {\n  createUser as createDbUser,\n  findUserByEmail,\n  findUserById,\n  markEmailVerified,\n  provisionUser as provisionDbUser,\n  updateUserPassword,\n} from '#db/users.js';\nimport {type AuthTokenRefreshOutcome, recordTokenRefreshed} from '#metrics/index.js';\nimport {getCurrentAdminRole} from './admin-role.js';\nimport type {RefreshToken} from './entities/refresh-token.js';\nimport type {User} from './entities/user.js';\nimport {\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  EmailTakenError,\n  ImpersonationDisabledError,\n  InvalidCredentialsError,\n  InvitationEmailMismatchError,\n  SignupNotAllowedError,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  TokenInvalidError,\n  UserNotFoundError,\n} from './errors.js';\nimport {signUserToken, type TokenMembership, verifyUserToken} from './jwt.js';\nimport {hashPassword, verifyPassword} from './password.js';\nimport type {SignupPolicy} from './ports.js';\nimport {createEnvironmentSignupPolicy} from './signup-policy.js';\n\nconst RESET_TTL_HOURS = 1;\nconst PASSWORD_VERIFICATION_PURPOSE = 'password-verification';\nconst DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE =\n  'This Shipfox deployment does not accept new accounts right now.';\n\nconst defaultSignupPolicy: SignupPolicy = createEnvironmentSignupPolicy();\n\nasync function assertSignupAllowed(params: {\n  signupPolicy?: SignupPolicy | undefined;\n  email: string;\n  emailVerified: boolean;\n  source: string;\n}): Promise<void> {\n  const result = await (params.signupPolicy ?? defaultSignupPolicy).isSignupAllowed({\n    email: params.email,\n    emailVerified: params.emailVerified,\n    source: params.source,\n  });\n\n  if (!result.allowed) {\n    throw new SignupNotAllowedError(\n      result.message ?? DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,\n      result.format,\n    );\n  }\n}\n\nlet dummyHashCache: string | undefined;\nasync function getDummyHash(): Promise<string> {\n  if (!dummyHashCache) {\n    dummyHashCache = await hashPassword({password: 'dummy-for-timing-parity'});\n  }\n  return dummyHashCache;\n}\n\nfunction hoursFromNow(hours: number): Date {\n  return new Date(Date.now() + hours * 60 * 60 * 1000);\n}\n\nfunction daysFromNow(days: number): Date {\n  return new Date(Date.now() + days * 24 * 60 * 60 * 1000);\n}\n\nfunction recordRefreshOutcome(outcome: AuthTokenRefreshOutcome): void {\n  recordTokenRefreshed(outcome);\n}\n\ntype TokenMemberships = TokenMembership[];\n\nasync function loadTokenMemberships(\n  userId: string,\n  workspaces: WorkspacesInterModuleClient,\n): Promise<TokenMemberships> {\n  const memberships = await workspaces\n    .listMembershipsForTokenClaims({userId})\n    .catch((error: unknown) => {\n      throw new AuthDependencyUnavailableError('workspaces', error);\n    });\n  return memberships.memberships;\n}\n\nasync function signAccessToken(\n  user: User,\n  memberships: TokenMemberships,\n  refreshSessionId: string,\n): Promise<string> {\n  return await signUserToken({\n    userId: user.id,\n    email: user.email,\n    name: user.name,\n    memberships,\n    refreshSessionId,\n    secret: userAccessTokenKey(),\n    expiresIn: config.AUTH_JWT_EXPIRES_IN,\n  });\n}\n\nfunction isWithinRotationGrace(refreshToken: RefreshToken): boolean {\n  if (!refreshToken.rotatedAt) return false;\n  const graceMs = config.AUTH_REFRESH_ROTATION_GRACE_SECONDS * 1000;\n  return Date.now() - refreshToken.rotatedAt.getTime() <= graceMs;\n}\n\nasync function createRefreshSession(\n  user: User,\n  refreshSessionId: string,\n): Promise<{refreshToken: string; refreshSessionId: string}> {\n  const refreshToken = generateOpaqueToken('refreshToken');\n  const session = await createRefreshTokenForActiveUser({\n    sessionId: refreshSessionId,\n    userId: user.id,\n    hashedToken: hashOpaqueToken(refreshToken),\n    expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS),\n  });\n  if (!session) throw new InvalidCredentialsError();\n  return {refreshToken, refreshSessionId: session.sessionId};\n}\n\nasync function createSessionTokens(\n  user: User,\n  workspaces: WorkspacesInterModuleClient,\n): Promise<{token: string; refreshToken: string; adminRole: AdminRole | null}> {\n  const refreshSessionId = crypto.randomUUID();\n  const memberships = await loadTokenMemberships(user.id, workspaces);\n  const token = await signAccessToken(user, memberships, refreshSessionId);\n  const adminRole = await getCurrentAdminRole({userId: user.id});\n  const {refreshToken} = await createRefreshSession(user, refreshSessionId);\n  return {token, refreshToken, adminRole};\n}\n\nfunction passwordResetLink(rawToken: string): string {\n  return `${config.CLIENT_BASE_URL}/auth/reset?token=${rawToken}`;\n}\n\nfunction invitationErrorFromKnownError(\n  error: unknown,\n  method: 'preflightInvitationAcceptance' | 'acceptInvitation',\n): Error {\n  const contractMethod = workspacesInterModuleContract.methods[method];\n  if (!isInterModuleKnownError(contractMethod, error)) return error as Error;\n\n  if (error.code === 'invitation-token-invalid')\n    return new TokenInvalidError('Invitation token is invalid');\n  if (error.code === 'invitation-token-used') return new TokenAlreadyUsedError();\n  if (error.code === 'invitation-token-expired') return new TokenExpiredError();\n  return new InvitationEmailMismatchError();\n}\n\nfunction invitationErrorMessage(\n  code:\n    | 'invitation-token-invalid'\n    | 'invitation-token-used'\n    | 'invitation-token-expired'\n    | 'invitation-email-mismatch',\n): string {\n  if (code === 'invitation-token-invalid') return 'Invitation token is invalid';\n  if (code === 'invitation-token-used') return 'Invitation has already been accepted';\n  if (code === 'invitation-token-expired') return 'Invitation has expired';\n  return 'Signup email does not match the invitation';\n}\n\nexport interface SignupParams {\n  email: string;\n  password: string;\n  name?: string | undefined;\n  signupPolicy?: SignupPolicy | undefined;\n}\n\nexport interface ProvisionUserParams {\n  email: string;\n  name?: string | null | undefined;\n  signupPolicy?: SignupPolicy | undefined;\n}\n\n/**\n * Creates a verified, password-less user for an external identity provider.\n * Existing users are returned unchanged, including their password and profile.\n */\nexport async function provisionUser(params: ProvisionUserParams): Promise<User> {\n  const email = emailSchema.parse(params.email);\n  const existing = await findUserByEmail({email});\n  if (existing) return existing;\n\n  await assertSignupAllowed({\n    signupPolicy: params.signupPolicy,\n    email,\n    emailVerified: true,\n    source: 'external-identity',\n  });\n\n  return await provisionDbUser({\n    email,\n    name: params.name ?? null,\n  });\n}\n\nexport type SignupResult = User & {\n  emailChallenge: {id: string; nextResendAvailableAt: Date};\n};\n\nexport async function signup(params: SignupParams & {sourceIp?: string}): Promise<SignupResult> {\n  const email = emailSchema.parse(params.email);\n  const existing = await findUserByEmail({email});\n  if (existing) {\n    const canResumeVerification =\n      existing.status === 'active' &&\n      existing.emailVerifiedAt === null &&\n      existing.hashedPassword !== null &&\n      (await verifyPassword({password: params.password, hash: existing.hashedPassword}));\n    if (canResumeVerification) {\n      const emailChallenge = await createEmailChallenge({\n        email: existing.email,\n        purpose: PASSWORD_VERIFICATION_PURPOSE,\n        continuation: existing.id,\n        idempotencyKey: existing.id,\n        sourceIp: params.sourceIp ?? '0.0.0.0',\n      });\n      return {...existing, emailChallenge};\n    }\n    throw new EmailTakenError(email);\n  }\n\n  await assertSignupAllowed({\n    signupPolicy: params.signupPolicy,\n    email,\n    emailVerified: false,\n    source: 'password',\n  });\n\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email,\n    hashedPassword,\n    name: params.name ?? null,\n    signedUp: {viaInvitation: false},\n  });\n\n  const emailChallenge = await createEmailChallenge({\n    email: user.email,\n    purpose: PASSWORD_VERIFICATION_PURPOSE,\n    continuation: user.id,\n    idempotencyKey: user.id,\n    sourceIp: params.sourceIp ?? '0.0.0.0',\n  });\n\n  return {...user, emailChallenge};\n}\n\nexport interface SignupWithInvitationParams extends SignupParams {\n  invitationToken: string;\n  workspaces: WorkspacesInterModuleClient;\n}\n\nexport interface SignupWithInvitationResult extends LoginResult {\n  membership: {id: string; userId: string; workspaceId: string} | null;\n  acceptError?: {code: string; message: string};\n}\n\nexport async function signupWithInvitation(\n  params: SignupWithInvitationParams,\n): Promise<SignupWithInvitationResult> {\n  // Step 1: Pre-validate the invitation BEFORE any user write so an invalid\n  // token never produces an orphan user. Re-validation happens again inside\n  // acceptWorkspaceInvitation (race-safe) after the user is created.\n  try {\n    await params.workspaces.preflightInvitationAcceptance({\n      token: params.invitationToken,\n      email: params.email,\n    });\n  } catch (error) {\n    throw invitationErrorFromKnownError(error, 'preflightInvitationAcceptance');\n  }\n\n  // Step 2: Create the user as verified. The invitation email is the proof of\n  // ownership, and this avoids a second auth-table write just to mark verified.\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) {\n    throw new EmailTakenError(params.email);\n  }\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email: params.email,\n    hashedPassword,\n    name: params.name ?? null,\n    emailVerifiedAt: new Date(),\n    signedUp: {viaInvitation: true},\n  });\n\n  // Step 3: Accept the invitation through the workspaces module boundary.\n  // This is intentionally not one database transaction with auth; treat it like\n  // calling another service. If it fails after user creation, return a verified\n  // signed-in user and an explicit retryable accept error.\n  let membership: SignupWithInvitationResult['membership'] = null;\n  let acceptError: SignupWithInvitationResult['acceptError'];\n  try {\n    const result = await params.workspaces.acceptInvitation({\n      token: params.invitationToken,\n      userId: user.id,\n      email: user.email,\n      name: user.name,\n    });\n    membership = {\n      id: result.membership.id,\n      userId: result.membership.userId,\n      workspaceId: result.membership.workspaceId,\n    };\n  } catch (error) {\n    if (isInterModuleKnownError(workspacesInterModuleContract.methods.acceptInvitation, error)) {\n      acceptError = {code: error.code, message: invitationErrorMessage(error.code)};\n    } else {\n      acceptError = {\n        code: 'AcceptFailed',\n        message: 'Could not accept the invitation; please retry from the invite link.',\n      };\n    }\n  }\n\n  // Step 4: Issue session. createSessionTokens reads memberships through the\n  // workspaces module API, so a successful accept is reflected in the JWT.\n  const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);\n\n  if (acceptError) {\n    return {token, refreshToken, user, membership, acceptError, adminRole};\n  }\n  return {token, refreshToken, user, membership, adminRole};\n}\n\nexport interface CreateUserParams extends SignupParams {\n  verified: boolean;\n}\n\nexport async function createUser(params: CreateUserParams): Promise<User> {\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) {\n    throw new EmailTakenError(params.email);\n  }\n\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email: params.email,\n    hashedPassword,\n    name: params.name ?? null,\n    emailVerifiedAt: params.verified ? new Date() : null,\n  });\n\n  return user;\n}\n\nexport interface LoginParams {\n  email: string;\n  password: string;\n  workspaces: WorkspacesInterModuleClient;\n}\n\nexport interface LoginResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport async function login(params: LoginParams): Promise<LoginResult> {\n  const user = await findUserByEmail({email: params.email});\n\n  if (!user) {\n    await verifyPassword({password: params.password, hash: await getDummyHash()});\n    throw new InvalidCredentialsError();\n  }\n\n  const hasPassword = user.hashedPassword !== null;\n  const ok = await verifyPassword({\n    password: params.password,\n    hash: user.hashedPassword ?? (await getDummyHash()),\n  });\n  if (!hasPassword || !ok || user.status !== 'active') {\n    throw new InvalidCredentialsError();\n  }\n\n  if (user.emailVerifiedAt === null) {\n    throw new EmailNotVerifiedError();\n  }\n\n  const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);\n\n  return {token, refreshToken, user, adminRole};\n}\n\nexport interface CreateSessionForUserParams {\n  userId?: string | undefined;\n  email?: string | undefined;\n  workspaces: WorkspacesInterModuleClient;\n}\n\nexport interface CreateSessionForUserResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport type CreateSessionForUserError =\n  | AuthDependencyUnavailableError\n  | EmailNotVerifiedError\n  | InvalidCredentialsError\n  | UserNotFoundError;\n\nexport async function createSessionForUser(\n  params: CreateSessionForUserParams,\n): Promise<CreateSessionForUserResult> {\n  const user = params.userId\n    ? await findUserById({id: params.userId})\n    : params.email\n      ? await findUserByEmail({email: emailSchema.parse(params.email)})\n      : undefined;\n\n  if (!user) {\n    throw new UserNotFoundError(params.userId ?? params.email ?? 'unknown');\n  }\n  if (user.emailVerifiedAt === null) {\n    throw new EmailNotVerifiedError();\n  }\n  if (user.status !== 'active') {\n    throw new InvalidCredentialsError();\n  }\n\n  const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);\n\n  return {token, refreshToken, user, adminRole};\n}\n\n/**\n * Cap for impersonated session tokens: the TTL is min(`AUTH_JWT_EXPIRES_IN`,\n * this), so an impersonated window can never outlive 15 minutes no matter how\n * the deployment configures ordinary access tokens.\n */\nexport const IMPERSONATION_MAX_TTL_SECONDS = 15 * 60;\n\nexport interface CreateImpersonatedSessionTokenParams {\n  targetUserId: string;\n  /** The administrator the token is minted for; signed into the `impersonatorId` claim. */\n  impersonatorId: string;\n  workspaces: WorkspacesInterModuleClient;\n  /**\n   * Re-sign lifetime override used by an idempotent replay: the remaining\n   * lifetime to the stored `expires_at`, so a replay never extends the window.\n   * Defaults to min(`AUTH_JWT_EXPIRES_IN`, 15 minutes).\n   */\n  expiresIn?: string | undefined;\n}\n\nexport interface CreateImpersonatedSessionTokenResult {\n  token: string;\n  expiresAt: Date;\n  user: User;\n}\n\nfunction impersonationTtlSeconds(): number {\n  const configuredSeconds = durationToSeconds(config.AUTH_JWT_EXPIRES_IN);\n  const ttlSeconds = Math.min(configuredSeconds, IMPERSONATION_MAX_TTL_SECONDS);\n  if (ttlSeconds <= 0) {\n    throw new TypeError(\n      `AUTH_JWT_EXPIRES_IN must be a valid duration of at least 1 second, got ${config.AUTH_JWT_EXPIRES_IN}`,\n    );\n  }\n  return ttlSeconds;\n}\n\n/**\n * Mints an access-token-only impersonated session for a target user: the same\n * eligibility as login (active account, verified email), the target's real\n * membership claims, a capped TTL, the `impersonatorId` claim, and **no**\n * `refreshSessionId`. It creates no refresh session and sets no cookie, so\n * nothing persisted can resurrect the session after the token window.\n */\nexport async function createImpersonatedSessionToken(\n  params: CreateImpersonatedSessionTokenParams,\n): Promise<CreateImpersonatedSessionTokenResult> {\n  // Rule 1 lives in the mint primitive as well as the command entry, so the\n  // exported package API can never bypass the kill switch: the flag is a\n  // configuration read that also holds on the in-transaction replay path.\n  if (!config.AUTH_IMPERSONATION_ENABLED) throw new ImpersonationDisabledError();\n\n  const user = await findUserById({id: params.targetUserId});\n  if (!user) {\n    throw new UserNotFoundError(params.targetUserId);\n  }\n  if (user.emailVerifiedAt === null) {\n    throw new EmailNotVerifiedError();\n  }\n  if (user.status !== 'active') {\n    throw new InvalidCredentialsError();\n  }\n\n  const memberships = await loadTokenMemberships(user.id, params.workspaces);\n  const ttlSeconds =\n    params.expiresIn === undefined\n      ? impersonationTtlSeconds()\n      : Math.min(durationToSeconds(params.expiresIn), IMPERSONATION_MAX_TTL_SECONDS);\n  if (ttlSeconds <= 0) {\n    throw new TypeError(\n      `Impersonation token TTL must be at least 1 second, got ${params.expiresIn}`,\n    );\n  }\n\n  const token = await signUserToken({\n    userId: user.id,\n    email: user.email,\n    name: user.name,\n    memberships,\n    impersonatorId: params.impersonatorId,\n    secret: userAccessTokenKey(),\n    expiresIn: `${ttlSeconds}s`,\n  });\n\n  // The advertised expiry is the token's actual signed `exp`, never a\n  // clock-derived estimate: the signer stamps `iat`/`exp` in whole seconds, so\n  // `Date.now() + ttl` could drift up to a second from the signed claims in\n  // either direction. Deriving `expiresAt` from the signed token keeps the\n  // response, the stored command result, and the bearer token exactly aligned,\n  // which is what lets a replay re-sign with a TTL that never extends the\n  // window (`exp` of the re-signed token is at most the original `exp`).\n  const claims = await verifyUserToken({token, secret: userAccessTokenKey()});\n  return {token, expiresAt: new Date(claims.exp * 1000), user};\n}\n\nexport interface RefreshAccessTokenResult {\n  token: string;\n  /** Undefined on a grace-window hit: keep the existing cookie instead of rotating it. */\n  refreshToken: string | undefined;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport async function refreshAccessToken(params: {\n  refreshToken: string;\n  workspaces: WorkspacesInterModuleClient;\n}): Promise<RefreshAccessTokenResult> {\n  const currentHashedToken = hashOpaqueToken(params.refreshToken);\n  const current = await findRefreshTokenByHash({hashedToken: currentHashedToken});\n  if (!current) {\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token is invalid or expired');\n  }\n\n  const user = await findUserById({id: current.userId});\n  if (user?.status !== 'active') {\n    await revokeRefreshSession({sessionId: current.sessionId, userId: current.userId});\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token is invalid or expired');\n  }\n  const adminRole = await getCurrentAdminRole({userId: user.id});\n\n  // Within the grace window a rotated token means a concurrent refresh (e.g. a\n  // second tab); past it, reuse of a retired token means a compromised session.\n  if (current.rotatedAt) {\n    if (isWithinRotationGrace(current)) {\n      const memberships = await loadTokenMemberships(user.id, params.workspaces);\n      const token = await signAccessToken(user, memberships, current.sessionId);\n      recordRefreshOutcome('grace');\n      return {token, refreshToken: undefined, user, adminRole};\n    }\n    await revokeRefreshTokensForUser({userId: user.id});\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token reused after rotation');\n  }\n\n  // Keep the external membership snapshot ahead of rotation so an outage\n  // cannot retire a refresh token that the caller can still retry.\n  const memberships = await loadTokenMemberships(user.id, params.workspaces);\n\n  // Losing the CAS requires a state check: another request may have rotated,\n  // revoked, or expired the token before this refresh could claim it.\n  const nextRefreshToken = generateOpaqueToken('refreshToken');\n  const rotated = await rotateRefreshToken({\n    userId: current.userId,\n    id: current.id,\n    currentHashedToken,\n    nextHashedToken: hashOpaqueToken(nextRefreshToken),\n    expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS),\n  });\n  if (!rotated) {\n    const latestUser = await findUserById({id: current.userId});\n    if (latestUser?.status !== 'active') {\n      recordRefreshOutcome('rejected');\n      throw new TokenInvalidError('Refresh token is invalid or expired');\n    }\n    const latest = await findRefreshTokenByHash({hashedToken: currentHashedToken});\n    if (!latest || !isWithinRotationGrace(latest)) {\n      recordRefreshOutcome('rejected');\n      throw new TokenInvalidError('Refresh token is invalid or expired');\n    }\n    const token = await signAccessToken(user, memberships, latest.sessionId);\n    recordRefreshOutcome('grace');\n    return {token, refreshToken: undefined, user, adminRole};\n  }\n\n  const token = await signAccessToken(user, memberships, current.sessionId);\n  recordRefreshOutcome('rotated');\n  return {token, refreshToken: nextRefreshToken, user, adminRole};\n}\n\nexport interface ConfirmEmailVerificationResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport interface ResendEmailVerificationResult {\n  nextResendAvailableAt: Date;\n}\n\nexport async function confirmEmailVerification(params: {\n  email: string;\n  challengeId: string;\n  code: string;\n  workspaces: WorkspacesInterModuleClient;\n}): Promise<ConfirmEmailVerificationResult> {\n  const user = await findUserByEmail({email: emailSchema.parse(params.email)});\n  if (!user) throw new TokenInvalidError('Verification code is invalid or expired');\n  await confirmEmailChallenge({id: params.challengeId, code: params.code, continuation: user.id});\n  await consumeEmailChallengeProof({\n    id: params.challengeId,\n    purpose: PASSWORD_VERIFICATION_PURPOSE,\n    continuation: user.id,\n  });\n\n  const verifiedUser = await markEmailVerified({userId: user.id});\n  if (verifiedUser?.status !== 'active') {\n    throw new TokenInvalidError('Verification code is invalid or expired');\n  }\n\n  const {token, refreshToken, adminRole} = await createSessionTokens(\n    verifiedUser,\n    params.workspaces,\n  );\n\n  return {token, refreshToken, user: verifiedUser, adminRole};\n}\n\nexport async function resendEmailVerification(params: {\n  email: string;\n  challengeId: string;\n  sourceIp: string;\n}): Promise<ResendEmailVerificationResult> {\n  const user = await findUserByEmail({email: emailSchema.parse(params.email)});\n  if (!user || user.emailVerifiedAt || user.status !== 'active') {\n    return {nextResendAvailableAt: new Date()};\n  }\n  const result = await resendEmailChallenge({\n    id: params.challengeId,\n    continuation: user.id,\n    sourceIp: params.sourceIp,\n  });\n\n  return {nextResendAvailableAt: result.nextResendAvailableAt};\n}\n\nexport async function requestPasswordReset(params: {email: string}): Promise<void> {\n  const user = await findUserByEmail({email: params.email});\n  if (user?.status !== 'active' || user.hashedPassword === null) {\n    return;\n  }\n\n  const rawToken = generateOpaqueToken('passwordReset');\n  await createPasswordReset({\n    userId: user.id,\n    hashedToken: hashOpaqueToken(rawToken),\n    expiresAt: hoursFromNow(RESET_TTL_HOURS),\n    sendEmail: {\n      email: user.email,\n      resetLink: passwordResetLink(rawToken),\n      expiresInHours: RESET_TTL_HOURS,\n    },\n  });\n}\n\nexport interface ConfirmPasswordResetResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport async function confirmPasswordReset(params: {\n  token: string;\n  newPassword: string;\n  workspaces: WorkspacesInterModuleClient;\n}): Promise<ConfirmPasswordResetResult> {\n  const consumed = await consumePasswordReset({hashedToken: hashOpaqueToken(params.token)});\n  if (!consumed) {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  const existingUser = await findUserById({id: consumed.userId});\n  if (existingUser?.status !== 'active' || existingUser.hashedPassword === null) {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  const hashedPassword = await hashPassword({password: params.newPassword});\n  const user = await updateUserPassword({userId: consumed.userId, hashedPassword});\n  if (user?.status !== 'active') {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  await revokeRefreshTokensForUser({userId: consumed.userId});\n\n  const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);\n\n  return {token, refreshToken, user, adminRole};\n}\n\nexport async function changePassword(params: {\n  userId: string;\n  currentPassword: string;\n  newPassword: string;\n  refreshToken?: string | undefined;\n}): Promise<void> {\n  const user = await findUserById({id: params.userId});\n  if (!user) {\n    throw new UserNotFoundError(params.userId);\n  }\n\n  const hasPassword = user.hashedPassword !== null;\n  const ok = await verifyPassword({\n    password: params.currentPassword,\n    hash: user.hashedPassword ?? (await getDummyHash()),\n  });\n  if (!hasPassword || !ok) {\n    throw new InvalidCredentialsError();\n  }\n\n  const hashedPassword = await hashPassword({password: params.newPassword});\n  const currentRefreshSession = params.refreshToken\n    ? await findActiveRefreshTokenByHash({hashedToken: hashOpaqueToken(params.refreshToken)})\n    : undefined;\n  const exceptRefreshTokenId =\n    currentRefreshSession?.userId === user.id ? currentRefreshSession.id : undefined;\n\n  await updateUserPassword({userId: user.id, hashedPassword});\n  await revokeRefreshTokensForUser({userId: user.id, exceptRefreshTokenId});\n}\n\nexport async function logout(params: {refreshToken?: string | undefined}): Promise<void> {\n  if (!params.refreshToken) return;\n  const refreshToken = await findRefreshTokenByHash({\n    hashedToken: hashOpaqueToken(params.refreshToken),\n  });\n  if (!refreshToken) return;\n  await revokeRefreshSession({sessionId: refreshToken.sessionId, userId: refreshToken.userId});\n}\n\nexport interface GetCurrentUserResult {\n  user: User;\n}\n\nexport async function getCurrentUser(params: {userId: string}): Promise<GetCurrentUserResult> {\n  const user = await findUserById({id: params.userId});\n  if (!user) {\n    throw new UserNotFoundError(params.userId);\n  }\n\n  return {user};\n}\n"],"names":["emailSchema","confirmEmailChallenge","consumeEmailChallengeProof","createEmailChallenge","resendEmailChallenge","workspacesInterModuleContract","isInterModuleKnownError","userAccessTokenKey","durationToSeconds","generateOpaqueToken","hashOpaqueToken","config","consumePasswordReset","createPasswordReset","createRefreshTokenForActiveUser","findActiveRefreshTokenByHash","findRefreshTokenByHash","revokeRefreshSession","revokeRefreshTokensForUser","rotateRefreshToken","createUser","createDbUser","findUserByEmail","findUserById","markEmailVerified","provisionUser","provisionDbUser","updateUserPassword","recordTokenRefreshed","getCurrentAdminRole","AuthDependencyUnavailableError","EmailNotVerifiedError","EmailTakenError","ImpersonationDisabledError","InvalidCredentialsError","InvitationEmailMismatchError","SignupNotAllowedError","TokenAlreadyUsedError","TokenExpiredError","TokenInvalidError","UserNotFoundError","signUserToken","verifyUserToken","hashPassword","verifyPassword","createEnvironmentSignupPolicy","RESET_TTL_HOURS","PASSWORD_VERIFICATION_PURPOSE","DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE","defaultSignupPolicy","assertSignupAllowed","params","result","signupPolicy","isSignupAllowed","email","emailVerified","source","allowed","message","format","dummyHashCache","getDummyHash","password","hoursFromNow","hours","Date","now","daysFromNow","days","recordRefreshOutcome","outcome","loadTokenMemberships","userId","workspaces","memberships","listMembershipsForTokenClaims","catch","error","signAccessToken","user","refreshSessionId","id","name","secret","expiresIn","AUTH_JWT_EXPIRES_IN","isWithinRotationGrace","refreshToken","rotatedAt","graceMs","AUTH_REFRESH_ROTATION_GRACE_SECONDS","getTime","createRefreshSession","session","sessionId","hashedToken","expiresAt","AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS","createSessionTokens","crypto","randomUUID","token","adminRole","passwordResetLink","rawToken","CLIENT_BASE_URL","invitationErrorFromKnownError","method","contractMethod","methods","code","invitationErrorMessage","parse","existing","signup","canResumeVerification","status","emailVerifiedAt","hashedPassword","hash","emailChallenge","purpose","continuation","idempotencyKey","sourceIp","signedUp","viaInvitation","signupWithInvitation","preflightInvitationAcceptance","invitationToken","membership","acceptError","acceptInvitation","workspaceId","verified","login","hasPassword","ok","createSessionForUser","undefined","IMPERSONATION_MAX_TTL_SECONDS","impersonationTtlSeconds","configuredSeconds","ttlSeconds","Math","min","TypeError","createImpersonatedSessionToken","AUTH_IMPERSONATION_ENABLED","targetUserId","impersonatorId","claims","exp","refreshAccessToken","currentHashedToken","current","nextRefreshToken","rotated","nextHashedToken","latestUser","latest","confirmEmailVerification","challengeId","verifiedUser","resendEmailVerification","nextResendAvailableAt","requestPasswordReset","sendEmail","resetLink","expiresInHours","confirmPasswordReset","consumed","existingUser","newPassword","changePassword","currentPassword","currentRefreshSession","exceptRefreshTokenId","logout","getCurrentUser"],"mappings":"AAAA,SAAwBA,WAAW,QAAO,wBAAwB;AAClE,SACEC,qBAAqB,EACrBC,0BAA0B,EAC1BC,oBAAoB,EACpBC,oBAAoB,QACf,gCAAgC;AACvC,SAEEC,6BAA6B,QACxB,2CAA2C;AAClD,SAAQC,uBAAuB,QAAO,wBAAwB;AAC9D,SAAQC,kBAAkB,QAAO,8BAA8B;AAC/D,SAAQC,iBAAiB,QAAO,oBAAoB;AACpD,SAAQC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAC1E,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,oBAAoB,EAAEC,mBAAmB,QAAO,yBAAyB;AACjF,SACEC,+BAA+B,EAC/BC,4BAA4B,EAC5BC,sBAAsB,EACtBC,oBAAoB,EACpBC,0BAA0B,EAC1BC,kBAAkB,QACb,wBAAwB;AAC/B,SACEC,cAAcC,YAAY,EAC1BC,eAAe,EACfC,YAAY,EACZC,iBAAiB,EACjBC,iBAAiBC,eAAe,EAChCC,kBAAkB,QACb,eAAe;AACtB,SAAsCC,oBAAoB,QAAO,oBAAoB;AACrF,SAAQC,mBAAmB,QAAO,kBAAkB;AAGpD,SACEC,8BAA8B,EAC9BC,qBAAqB,EACrBC,eAAe,EACfC,0BAA0B,EAC1BC,uBAAuB,EACvBC,4BAA4B,EAC5BC,qBAAqB,EACrBC,qBAAqB,EACrBC,iBAAiB,EACjBC,iBAAiB,EACjBC,iBAAiB,QACZ,cAAc;AACrB,SAAQC,aAAa,EAAwBC,eAAe,QAAO,WAAW;AAC9E,SAAQC,YAAY,EAAEC,cAAc,QAAO,gBAAgB;AAE3D,SAAQC,6BAA6B,QAAO,qBAAqB;AAEjE,MAAMC,kBAAkB;AACxB,MAAMC,gCAAgC;AACtC,MAAMC,qCACJ;AAEF,MAAMC,sBAAoCJ;AAE1C,eAAeK,oBAAoBC,MAKlC;IACC,MAAMC,SAAS,MAAM,AAACD,CAAAA,OAAOE,YAAY,IAAIJ,mBAAkB,EAAGK,eAAe,CAAC;QAChFC,OAAOJ,OAAOI,KAAK;QACnBC,eAAeL,OAAOK,aAAa;QACnCC,QAAQN,OAAOM,MAAM;IACvB;IAEA,IAAI,CAACL,OAAOM,OAAO,EAAE;QACnB,MAAM,IAAItB,sBACRgB,OAAOO,OAAO,IAAIX,oCAClBI,OAAOQ,MAAM;IAEjB;AACF;AAEA,IAAIC;AACJ,eAAeC;IACb,IAAI,CAACD,gBAAgB;QACnBA,iBAAiB,MAAMlB,aAAa;YAACoB,UAAU;QAAyB;IAC1E;IACA,OAAOF;AACT;AAEA,SAASG,aAAaC,KAAa;IACjC,OAAO,IAAIC,KAAKA,KAAKC,GAAG,KAAKF,QAAQ,KAAK,KAAK;AACjD;AAEA,SAASG,YAAYC,IAAY;IAC/B,OAAO,IAAIH,KAAKA,KAAKC,GAAG,KAAKE,OAAO,KAAK,KAAK,KAAK;AACrD;AAEA,SAASC,qBAAqBC,OAAgC;IAC5D3C,qBAAqB2C;AACvB;AAIA,eAAeC,qBACbC,MAAc,EACdC,UAAuC;IAEvC,MAAMC,cAAc,MAAMD,WACvBE,6BAA6B,CAAC;QAACH;IAAM,GACrCI,KAAK,CAAC,CAACC;QACN,MAAM,IAAIhD,+BAA+B,cAAcgD;IACzD;IACF,OAAOH,YAAYA,WAAW;AAChC;AAEA,eAAeI,gBACbC,IAAU,EACVL,WAA6B,EAC7BM,gBAAwB;IAExB,OAAO,MAAMxC,cAAc;QACzBgC,QAAQO,KAAKE,EAAE;QACf3B,OAAOyB,KAAKzB,KAAK;QACjB4B,MAAMH,KAAKG,IAAI;QACfR;QACAM;QACAG,QAAQ7E;QACR8E,WAAW1E,OAAO2E,mBAAmB;IACvC;AACF;AAEA,SAASC,sBAAsBC,YAA0B;IACvD,IAAI,CAACA,aAAaC,SAAS,EAAE,OAAO;IACpC,MAAMC,UAAU/E,OAAOgF,mCAAmC,GAAG;IAC7D,OAAOzB,KAAKC,GAAG,KAAKqB,aAAaC,SAAS,CAACG,OAAO,MAAMF;AAC1D;AAEA,eAAeG,qBACbb,IAAU,EACVC,gBAAwB;IAExB,MAAMO,eAAe/E,oBAAoB;IACzC,MAAMqF,UAAU,MAAMhF,gCAAgC;QACpDiF,WAAWd;QACXR,QAAQO,KAAKE,EAAE;QACfc,aAAatF,gBAAgB8E;QAC7BS,WAAW7B,YAAYzD,OAAOuF,kCAAkC;IAClE;IACA,IAAI,CAACJ,SAAS,MAAM,IAAI5D;IACxB,OAAO;QAACsD;QAAcP,kBAAkBa,QAAQC,SAAS;IAAA;AAC3D;AAEA,eAAeI,oBACbnB,IAAU,EACVN,UAAuC;IAEvC,MAAMO,mBAAmBmB,OAAOC,UAAU;IAC1C,MAAM1B,cAAc,MAAMH,qBAAqBQ,KAAKE,EAAE,EAAER;IACxD,MAAM4B,QAAQ,MAAMvB,gBAAgBC,MAAML,aAAaM;IACvD,MAAMsB,YAAY,MAAM1E,oBAAoB;QAAC4C,QAAQO,KAAKE,EAAE;IAAA;IAC5D,MAAM,EAACM,YAAY,EAAC,GAAG,MAAMK,qBAAqBb,MAAMC;IACxD,OAAO;QAACqB;QAAOd;QAAce;IAAS;AACxC;AAEA,SAASC,kBAAkBC,QAAgB;IACzC,OAAO,GAAG9F,OAAO+F,eAAe,CAAC,kBAAkB,EAAED,UAAU;AACjE;AAEA,SAASE,8BACP7B,KAAc,EACd8B,MAA4D;IAE5D,MAAMC,iBAAiBxG,8BAA8ByG,OAAO,CAACF,OAAO;IACpE,IAAI,CAACtG,wBAAwBuG,gBAAgB/B,QAAQ,OAAOA;IAE5D,IAAIA,MAAMiC,IAAI,KAAK,4BACjB,OAAO,IAAIxE,kBAAkB;IAC/B,IAAIuC,MAAMiC,IAAI,KAAK,yBAAyB,OAAO,IAAI1E;IACvD,IAAIyC,MAAMiC,IAAI,KAAK,4BAA4B,OAAO,IAAIzE;IAC1D,OAAO,IAAIH;AACb;AAEA,SAAS6E,uBACPD,IAI+B;IAE/B,IAAIA,SAAS,4BAA4B,OAAO;IAChD,IAAIA,SAAS,yBAAyB,OAAO;IAC7C,IAAIA,SAAS,4BAA4B,OAAO;IAChD,OAAO;AACT;AAeA;;;CAGC,GACD,OAAO,eAAetF,cAAc0B,MAA2B;IAC7D,MAAMI,QAAQvD,YAAYiH,KAAK,CAAC9D,OAAOI,KAAK;IAC5C,MAAM2D,WAAW,MAAM5F,gBAAgB;QAACiC;IAAK;IAC7C,IAAI2D,UAAU,OAAOA;IAErB,MAAMhE,oBAAoB;QACxBG,cAAcF,OAAOE,YAAY;QACjCE;QACAC,eAAe;QACfC,QAAQ;IACV;IAEA,OAAO,MAAM/B,gBAAgB;QAC3B6B;QACA4B,MAAMhC,OAAOgC,IAAI,IAAI;IACvB;AACF;AAMA,OAAO,eAAegC,OAAOhE,MAA0C;IACrE,MAAMI,QAAQvD,YAAYiH,KAAK,CAAC9D,OAAOI,KAAK;IAC5C,MAAM2D,WAAW,MAAM5F,gBAAgB;QAACiC;IAAK;IAC7C,IAAI2D,UAAU;QACZ,MAAME,wBACJF,SAASG,MAAM,KAAK,YACpBH,SAASI,eAAe,KAAK,QAC7BJ,SAASK,cAAc,KAAK,QAC3B,MAAM3E,eAAe;YAACmB,UAAUZ,OAAOY,QAAQ;YAAEyD,MAAMN,SAASK,cAAc;QAAA;QACjF,IAAIH,uBAAuB;YACzB,MAAMK,iBAAiB,MAAMtH,qBAAqB;gBAChDoD,OAAO2D,SAAS3D,KAAK;gBACrBmE,SAAS3E;gBACT4E,cAAcT,SAAShC,EAAE;gBACzB0C,gBAAgBV,SAAShC,EAAE;gBAC3B2C,UAAU1E,OAAO0E,QAAQ,IAAI;YAC/B;YACA,OAAO;gBAAC,GAAGX,QAAQ;gBAAEO;YAAc;QACrC;QACA,MAAM,IAAIzF,gBAAgBuB;IAC5B;IAEA,MAAML,oBAAoB;QACxBG,cAAcF,OAAOE,YAAY;QACjCE;QACAC,eAAe;QACfC,QAAQ;IACV;IAEA,MAAM8D,iBAAiB,MAAM5E,aAAa;QAACoB,UAAUZ,OAAOY,QAAQ;IAAA;IACpE,MAAMiB,OAAO,MAAM3D,aAAa;QAC9BkC;QACAgE;QACApC,MAAMhC,OAAOgC,IAAI,IAAI;QACrB2C,UAAU;YAACC,eAAe;QAAK;IACjC;IAEA,MAAMN,iBAAiB,MAAMtH,qBAAqB;QAChDoD,OAAOyB,KAAKzB,KAAK;QACjBmE,SAAS3E;QACT4E,cAAc3C,KAAKE,EAAE;QACrB0C,gBAAgB5C,KAAKE,EAAE;QACvB2C,UAAU1E,OAAO0E,QAAQ,IAAI;IAC/B;IAEA,OAAO;QAAC,GAAG7C,IAAI;QAAEyC;IAAc;AACjC;AAYA,OAAO,eAAeO,qBACpB7E,MAAkC;IAElC,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI;QACF,MAAMA,OAAOuB,UAAU,CAACuD,6BAA6B,CAAC;YACpD3B,OAAOnD,OAAO+E,eAAe;YAC7B3E,OAAOJ,OAAOI,KAAK;QACrB;IACF,EAAE,OAAOuB,OAAO;QACd,MAAM6B,8BAA8B7B,OAAO;IAC7C;IAEA,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAMoC,WAAW,MAAM5F,gBAAgB;QAACiC,OAAOJ,OAAOI,KAAK;IAAA;IAC3D,IAAI2D,UAAU;QACZ,MAAM,IAAIlF,gBAAgBmB,OAAOI,KAAK;IACxC;IACA,MAAMgE,iBAAiB,MAAM5E,aAAa;QAACoB,UAAUZ,OAAOY,QAAQ;IAAA;IACpE,MAAMiB,OAAO,MAAM3D,aAAa;QAC9BkC,OAAOJ,OAAOI,KAAK;QACnBgE;QACApC,MAAMhC,OAAOgC,IAAI,IAAI;QACrBmC,iBAAiB,IAAIpD;QACrB4D,UAAU;YAACC,eAAe;QAAI;IAChC;IAEA,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,yDAAyD;IACzD,IAAII,aAAuD;IAC3D,IAAIC;IACJ,IAAI;QACF,MAAMhF,SAAS,MAAMD,OAAOuB,UAAU,CAAC2D,gBAAgB,CAAC;YACtD/B,OAAOnD,OAAO+E,eAAe;YAC7BzD,QAAQO,KAAKE,EAAE;YACf3B,OAAOyB,KAAKzB,KAAK;YACjB4B,MAAMH,KAAKG,IAAI;QACjB;QACAgD,aAAa;YACXjD,IAAI9B,OAAO+E,UAAU,CAACjD,EAAE;YACxBT,QAAQrB,OAAO+E,UAAU,CAAC1D,MAAM;YAChC6D,aAAalF,OAAO+E,UAAU,CAACG,WAAW;QAC5C;IACF,EAAE,OAAOxD,OAAO;QACd,IAAIxE,wBAAwBD,8BAA8ByG,OAAO,CAACuB,gBAAgB,EAAEvD,QAAQ;YAC1FsD,cAAc;gBAACrB,MAAMjC,MAAMiC,IAAI;gBAAEpD,SAASqD,uBAAuBlC,MAAMiC,IAAI;YAAC;QAC9E,OAAO;YACLqB,cAAc;gBACZrB,MAAM;gBACNpD,SAAS;YACX;QACF;IACF;IAEA,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,EAAC2C,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAAoBnB,MAAM7B,OAAOuB,UAAU;IAE1F,IAAI0D,aAAa;QACf,OAAO;YAAC9B;YAAOd;YAAcR;YAAMmD;YAAYC;YAAa7B;QAAS;IACvE;IACA,OAAO;QAACD;QAAOd;QAAcR;QAAMmD;QAAY5B;IAAS;AAC1D;AAMA,OAAO,eAAenF,WAAW+B,MAAwB;IACvD,MAAM+D,WAAW,MAAM5F,gBAAgB;QAACiC,OAAOJ,OAAOI,KAAK;IAAA;IAC3D,IAAI2D,UAAU;QACZ,MAAM,IAAIlF,gBAAgBmB,OAAOI,KAAK;IACxC;IAEA,MAAMgE,iBAAiB,MAAM5E,aAAa;QAACoB,UAAUZ,OAAOY,QAAQ;IAAA;IACpE,MAAMiB,OAAO,MAAM3D,aAAa;QAC9BkC,OAAOJ,OAAOI,KAAK;QACnBgE;QACApC,MAAMhC,OAAOgC,IAAI,IAAI;QACrBmC,iBAAiBnE,OAAOoF,QAAQ,GAAG,IAAIrE,SAAS;IAClD;IAEA,OAAOc;AACT;AAeA,OAAO,eAAewD,MAAMrF,MAAmB;IAC7C,MAAM6B,OAAO,MAAM1D,gBAAgB;QAACiC,OAAOJ,OAAOI,KAAK;IAAA;IAEvD,IAAI,CAACyB,MAAM;QACT,MAAMpC,eAAe;YAACmB,UAAUZ,OAAOY,QAAQ;YAAEyD,MAAM,MAAM1D;QAAc;QAC3E,MAAM,IAAI5B;IACZ;IAEA,MAAMuG,cAAczD,KAAKuC,cAAc,KAAK;IAC5C,MAAMmB,KAAK,MAAM9F,eAAe;QAC9BmB,UAAUZ,OAAOY,QAAQ;QACzByD,MAAMxC,KAAKuC,cAAc,IAAK,MAAMzD;IACtC;IACA,IAAI,CAAC2E,eAAe,CAACC,MAAM1D,KAAKqC,MAAM,KAAK,UAAU;QACnD,MAAM,IAAInF;IACZ;IAEA,IAAI8C,KAAKsC,eAAe,KAAK,MAAM;QACjC,MAAM,IAAIvF;IACZ;IAEA,MAAM,EAACuE,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAAoBnB,MAAM7B,OAAOuB,UAAU;IAE1F,OAAO;QAAC4B;QAAOd;QAAcR;QAAMuB;IAAS;AAC9C;AAqBA,OAAO,eAAeoC,qBACpBxF,MAAkC;IAElC,MAAM6B,OAAO7B,OAAOsB,MAAM,GACtB,MAAMlD,aAAa;QAAC2D,IAAI/B,OAAOsB,MAAM;IAAA,KACrCtB,OAAOI,KAAK,GACV,MAAMjC,gBAAgB;QAACiC,OAAOvD,YAAYiH,KAAK,CAAC9D,OAAOI,KAAK;IAAC,KAC7DqF;IAEN,IAAI,CAAC5D,MAAM;QACT,MAAM,IAAIxC,kBAAkBW,OAAOsB,MAAM,IAAItB,OAAOI,KAAK,IAAI;IAC/D;IACA,IAAIyB,KAAKsC,eAAe,KAAK,MAAM;QACjC,MAAM,IAAIvF;IACZ;IACA,IAAIiD,KAAKqC,MAAM,KAAK,UAAU;QAC5B,MAAM,IAAInF;IACZ;IAEA,MAAM,EAACoE,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAAoBnB,MAAM7B,OAAOuB,UAAU;IAE1F,OAAO;QAAC4B;QAAOd;QAAcR;QAAMuB;IAAS;AAC9C;AAEA;;;;CAIC,GACD,OAAO,MAAMsC,gCAAgC,KAAK,GAAG;AAqBrD,SAASC;IACP,MAAMC,oBAAoBvI,kBAAkBG,OAAO2E,mBAAmB;IACtE,MAAM0D,aAAaC,KAAKC,GAAG,CAACH,mBAAmBF;IAC/C,IAAIG,cAAc,GAAG;QACnB,MAAM,IAAIG,UACR,CAAC,uEAAuE,EAAExI,OAAO2E,mBAAmB,EAAE;IAE1G;IACA,OAAO0D;AACT;AAEA;;;;;;CAMC,GACD,OAAO,eAAeI,+BACpBjG,MAA4C;IAE5C,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,CAACxC,OAAO0I,0BAA0B,EAAE,MAAM,IAAIpH;IAElD,MAAM+C,OAAO,MAAMzD,aAAa;QAAC2D,IAAI/B,OAAOmG,YAAY;IAAA;IACxD,IAAI,CAACtE,MAAM;QACT,MAAM,IAAIxC,kBAAkBW,OAAOmG,YAAY;IACjD;IACA,IAAItE,KAAKsC,eAAe,KAAK,MAAM;QACjC,MAAM,IAAIvF;IACZ;IACA,IAAIiD,KAAKqC,MAAM,KAAK,UAAU;QAC5B,MAAM,IAAInF;IACZ;IAEA,MAAMyC,cAAc,MAAMH,qBAAqBQ,KAAKE,EAAE,EAAE/B,OAAOuB,UAAU;IACzE,MAAMsE,aACJ7F,OAAOkC,SAAS,KAAKuD,YACjBE,4BACAG,KAAKC,GAAG,CAAC1I,kBAAkB2C,OAAOkC,SAAS,GAAGwD;IACpD,IAAIG,cAAc,GAAG;QACnB,MAAM,IAAIG,UACR,CAAC,uDAAuD,EAAEhG,OAAOkC,SAAS,EAAE;IAEhF;IAEA,MAAMiB,QAAQ,MAAM7D,cAAc;QAChCgC,QAAQO,KAAKE,EAAE;QACf3B,OAAOyB,KAAKzB,KAAK;QACjB4B,MAAMH,KAAKG,IAAI;QACfR;QACA4E,gBAAgBpG,OAAOoG,cAAc;QACrCnE,QAAQ7E;QACR8E,WAAW,GAAG2D,WAAW,CAAC,CAAC;IAC7B;IAEA,oEAAoE;IACpE,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,uEAAuE;IACvE,MAAMQ,SAAS,MAAM9G,gBAAgB;QAAC4D;QAAOlB,QAAQ7E;IAAoB;IACzE,OAAO;QAAC+F;QAAOL,WAAW,IAAI/B,KAAKsF,OAAOC,GAAG,GAAG;QAAOzE;IAAI;AAC7D;AAUA,OAAO,eAAe0E,mBAAmBvG,MAGxC;IACC,MAAMwG,qBAAqBjJ,gBAAgByC,OAAOqC,YAAY;IAC9D,MAAMoE,UAAU,MAAM5I,uBAAuB;QAACgF,aAAa2D;IAAkB;IAC7E,IAAI,CAACC,SAAS;QACZtF,qBAAqB;QACrB,MAAM,IAAI/B,kBAAkB;IAC9B;IAEA,MAAMyC,OAAO,MAAMzD,aAAa;QAAC2D,IAAI0E,QAAQnF,MAAM;IAAA;IACnD,IAAIO,MAAMqC,WAAW,UAAU;QAC7B,MAAMpG,qBAAqB;YAAC8E,WAAW6D,QAAQ7D,SAAS;YAAEtB,QAAQmF,QAAQnF,MAAM;QAAA;QAChFH,qBAAqB;QACrB,MAAM,IAAI/B,kBAAkB;IAC9B;IACA,MAAMgE,YAAY,MAAM1E,oBAAoB;QAAC4C,QAAQO,KAAKE,EAAE;IAAA;IAE5D,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI0E,QAAQnE,SAAS,EAAE;QACrB,IAAIF,sBAAsBqE,UAAU;YAClC,MAAMjF,cAAc,MAAMH,qBAAqBQ,KAAKE,EAAE,EAAE/B,OAAOuB,UAAU;YACzE,MAAM4B,QAAQ,MAAMvB,gBAAgBC,MAAML,aAAaiF,QAAQ7D,SAAS;YACxEzB,qBAAqB;YACrB,OAAO;gBAACgC;gBAAOd,cAAcoD;gBAAW5D;gBAAMuB;YAAS;QACzD;QACA,MAAMrF,2BAA2B;YAACuD,QAAQO,KAAKE,EAAE;QAAA;QACjDZ,qBAAqB;QACrB,MAAM,IAAI/B,kBAAkB;IAC9B;IAEA,uEAAuE;IACvE,iEAAiE;IACjE,MAAMoC,cAAc,MAAMH,qBAAqBQ,KAAKE,EAAE,EAAE/B,OAAOuB,UAAU;IAEzE,2EAA2E;IAC3E,oEAAoE;IACpE,MAAMmF,mBAAmBpJ,oBAAoB;IAC7C,MAAMqJ,UAAU,MAAM3I,mBAAmB;QACvCsD,QAAQmF,QAAQnF,MAAM;QACtBS,IAAI0E,QAAQ1E,EAAE;QACdyE;QACAI,iBAAiBrJ,gBAAgBmJ;QACjC5D,WAAW7B,YAAYzD,OAAOuF,kCAAkC;IAClE;IACA,IAAI,CAAC4D,SAAS;QACZ,MAAME,aAAa,MAAMzI,aAAa;YAAC2D,IAAI0E,QAAQnF,MAAM;QAAA;QACzD,IAAIuF,YAAY3C,WAAW,UAAU;YACnC/C,qBAAqB;YACrB,MAAM,IAAI/B,kBAAkB;QAC9B;QACA,MAAM0H,SAAS,MAAMjJ,uBAAuB;YAACgF,aAAa2D;QAAkB;QAC5E,IAAI,CAACM,UAAU,CAAC1E,sBAAsB0E,SAAS;YAC7C3F,qBAAqB;YACrB,MAAM,IAAI/B,kBAAkB;QAC9B;QACA,MAAM+D,QAAQ,MAAMvB,gBAAgBC,MAAML,aAAasF,OAAOlE,SAAS;QACvEzB,qBAAqB;QACrB,OAAO;YAACgC;YAAOd,cAAcoD;YAAW5D;YAAMuB;QAAS;IACzD;IAEA,MAAMD,QAAQ,MAAMvB,gBAAgBC,MAAML,aAAaiF,QAAQ7D,SAAS;IACxEzB,qBAAqB;IACrB,OAAO;QAACgC;QAAOd,cAAcqE;QAAkB7E;QAAMuB;IAAS;AAChE;AAaA,OAAO,eAAe2D,yBAAyB/G,MAK9C;IACC,MAAM6B,OAAO,MAAM1D,gBAAgB;QAACiC,OAAOvD,YAAYiH,KAAK,CAAC9D,OAAOI,KAAK;IAAC;IAC1E,IAAI,CAACyB,MAAM,MAAM,IAAIzC,kBAAkB;IACvC,MAAMtC,sBAAsB;QAACiF,IAAI/B,OAAOgH,WAAW;QAAEpD,MAAM5D,OAAO4D,IAAI;QAAEY,cAAc3C,KAAKE,EAAE;IAAA;IAC7F,MAAMhF,2BAA2B;QAC/BgF,IAAI/B,OAAOgH,WAAW;QACtBzC,SAAS3E;QACT4E,cAAc3C,KAAKE,EAAE;IACvB;IAEA,MAAMkF,eAAe,MAAM5I,kBAAkB;QAACiD,QAAQO,KAAKE,EAAE;IAAA;IAC7D,IAAIkF,cAAc/C,WAAW,UAAU;QACrC,MAAM,IAAI9E,kBAAkB;IAC9B;IAEA,MAAM,EAAC+D,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAC7CiE,cACAjH,OAAOuB,UAAU;IAGnB,OAAO;QAAC4B;QAAOd;QAAcR,MAAMoF;QAAc7D;IAAS;AAC5D;AAEA,OAAO,eAAe8D,wBAAwBlH,MAI7C;IACC,MAAM6B,OAAO,MAAM1D,gBAAgB;QAACiC,OAAOvD,YAAYiH,KAAK,CAAC9D,OAAOI,KAAK;IAAC;IAC1E,IAAI,CAACyB,QAAQA,KAAKsC,eAAe,IAAItC,KAAKqC,MAAM,KAAK,UAAU;QAC7D,OAAO;YAACiD,uBAAuB,IAAIpG;QAAM;IAC3C;IACA,MAAMd,SAAS,MAAMhD,qBAAqB;QACxC8E,IAAI/B,OAAOgH,WAAW;QACtBxC,cAAc3C,KAAKE,EAAE;QACrB2C,UAAU1E,OAAO0E,QAAQ;IAC3B;IAEA,OAAO;QAACyC,uBAAuBlH,OAAOkH,qBAAqB;IAAA;AAC7D;AAEA,OAAO,eAAeC,qBAAqBpH,MAAuB;IAChE,MAAM6B,OAAO,MAAM1D,gBAAgB;QAACiC,OAAOJ,OAAOI,KAAK;IAAA;IACvD,IAAIyB,MAAMqC,WAAW,YAAYrC,KAAKuC,cAAc,KAAK,MAAM;QAC7D;IACF;IAEA,MAAMd,WAAWhG,oBAAoB;IACrC,MAAMI,oBAAoB;QACxB4D,QAAQO,KAAKE,EAAE;QACfc,aAAatF,gBAAgB+F;QAC7BR,WAAWjC,aAAalB;QACxB0H,WAAW;YACTjH,OAAOyB,KAAKzB,KAAK;YACjBkH,WAAWjE,kBAAkBC;YAC7BiE,gBAAgB5H;QAClB;IACF;AACF;AASA,OAAO,eAAe6H,qBAAqBxH,MAI1C;IACC,MAAMyH,WAAW,MAAMhK,qBAAqB;QAACoF,aAAatF,gBAAgByC,OAAOmD,KAAK;IAAC;IACvF,IAAI,CAACsE,UAAU;QACb,MAAM,IAAIrI,kBAAkB;IAC9B;IAEA,MAAMsI,eAAe,MAAMtJ,aAAa;QAAC2D,IAAI0F,SAASnG,MAAM;IAAA;IAC5D,IAAIoG,cAAcxD,WAAW,YAAYwD,aAAatD,cAAc,KAAK,MAAM;QAC7E,MAAM,IAAIhF,kBAAkB;IAC9B;IAEA,MAAMgF,iBAAiB,MAAM5E,aAAa;QAACoB,UAAUZ,OAAO2H,WAAW;IAAA;IACvE,MAAM9F,OAAO,MAAMrD,mBAAmB;QAAC8C,QAAQmG,SAASnG,MAAM;QAAE8C;IAAc;IAC9E,IAAIvC,MAAMqC,WAAW,UAAU;QAC7B,MAAM,IAAI9E,kBAAkB;IAC9B;IAEA,MAAMrB,2BAA2B;QAACuD,QAAQmG,SAASnG,MAAM;IAAA;IAEzD,MAAM,EAAC6B,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAAoBnB,MAAM7B,OAAOuB,UAAU;IAE1F,OAAO;QAAC4B;QAAOd;QAAcR;QAAMuB;IAAS;AAC9C;AAEA,OAAO,eAAewE,eAAe5H,MAKpC;IACC,MAAM6B,OAAO,MAAMzD,aAAa;QAAC2D,IAAI/B,OAAOsB,MAAM;IAAA;IAClD,IAAI,CAACO,MAAM;QACT,MAAM,IAAIxC,kBAAkBW,OAAOsB,MAAM;IAC3C;IAEA,MAAMgE,cAAczD,KAAKuC,cAAc,KAAK;IAC5C,MAAMmB,KAAK,MAAM9F,eAAe;QAC9BmB,UAAUZ,OAAO6H,eAAe;QAChCxD,MAAMxC,KAAKuC,cAAc,IAAK,MAAMzD;IACtC;IACA,IAAI,CAAC2E,eAAe,CAACC,IAAI;QACvB,MAAM,IAAIxG;IACZ;IAEA,MAAMqF,iBAAiB,MAAM5E,aAAa;QAACoB,UAAUZ,OAAO2H,WAAW;IAAA;IACvE,MAAMG,wBAAwB9H,OAAOqC,YAAY,GAC7C,MAAMzE,6BAA6B;QAACiF,aAAatF,gBAAgByC,OAAOqC,YAAY;IAAC,KACrFoD;IACJ,MAAMsC,uBACJD,uBAAuBxG,WAAWO,KAAKE,EAAE,GAAG+F,sBAAsB/F,EAAE,GAAG0D;IAEzE,MAAMjH,mBAAmB;QAAC8C,QAAQO,KAAKE,EAAE;QAAEqC;IAAc;IACzD,MAAMrG,2BAA2B;QAACuD,QAAQO,KAAKE,EAAE;QAAEgG;IAAoB;AACzE;AAEA,OAAO,eAAeC,OAAOhI,MAA2C;IACtE,IAAI,CAACA,OAAOqC,YAAY,EAAE;IAC1B,MAAMA,eAAe,MAAMxE,uBAAuB;QAChDgF,aAAatF,gBAAgByC,OAAOqC,YAAY;IAClD;IACA,IAAI,CAACA,cAAc;IACnB,MAAMvE,qBAAqB;QAAC8E,WAAWP,aAAaO,SAAS;QAAEtB,QAAQe,aAAaf,MAAM;IAAA;AAC5F;AAMA,OAAO,eAAe2G,eAAejI,MAAwB;IAC3D,MAAM6B,OAAO,MAAMzD,aAAa;QAAC2D,IAAI/B,OAAOsB,MAAM;IAAA;IAClD,IAAI,CAACO,MAAM;QACT,MAAM,IAAIxC,kBAAkBW,OAAOsB,MAAM;IAC3C;IAEA,OAAO;QAACO;IAAI;AACd"}
+{"version":3,"sources":["../../src/core/auth.ts"],"sourcesContent":["import {type AdminRole, emailSchema} from '@shipfox/api-auth-dto';\nimport {\n  confirmEmailChallenge,\n  consumeEmailChallengeProof,\n  createEmailChallenge,\n  resendEmailChallenge,\n} from '@shipfox/api-email-challenges';\nimport {\n  type WorkspacesInterModuleClient,\n  workspacesInterModuleContract,\n} from '@shipfox/api-workspaces-dto/inter-module';\nimport {isInterModuleKnownError} from '@shipfox/inter-module';\nimport {userAccessTokenKey} from '@shipfox/node-auth-root-key';\nimport {durationToSeconds} from '@shipfox/node-jwt';\nimport {generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {config} from '#config.js';\nimport {consumePasswordReset, createPasswordReset} from '#db/password-resets.js';\nimport {\n  createRefreshTokenForActiveUser,\n  findActiveRefreshTokenByHash,\n  findRefreshTokenByHash,\n  revokeRefreshSession,\n  revokeRefreshTokensForUser,\n  rotateRefreshToken,\n} from '#db/refresh-tokens.js';\nimport {\n  createUser as createDbUser,\n  findUserByEmail,\n  findUserById,\n  markEmailVerified,\n  provisionUser as provisionDbUser,\n  updateUserPassword,\n} from '#db/users.js';\nimport {type AuthTokenRefreshOutcome, recordTokenRefreshed} from '#metrics/index.js';\nimport {getCurrentAdminRole} from './admin-role.js';\nimport type {RefreshToken} from './entities/refresh-token.js';\nimport type {User} from './entities/user.js';\nimport {\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  EmailTakenError,\n  ImpersonationDisabledError,\n  InvalidCredentialsError,\n  InvitationEmailMismatchError,\n  SignupNotAllowedError,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  TokenInvalidError,\n  UserNotFoundError,\n} from './errors.js';\nimport {signUserToken, type TokenMembership, verifyUserToken} from './jwt.js';\nimport {hashPassword, verifyPassword} from './password.js';\nimport type {SignupPolicy} from './ports.js';\nimport {createEnvironmentSignupPolicy} from './signup-policy.js';\n\nconst RESET_TTL_HOURS = 1;\nconst PASSWORD_VERIFICATION_PURPOSE = 'password-verification';\nconst DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE =\n  'This Shipfox deployment does not accept new accounts right now.';\n\nconst defaultSignupPolicy: SignupPolicy = createEnvironmentSignupPolicy();\n\nasync function assertSignupAllowed(params: {\n  signupPolicy?: SignupPolicy | undefined;\n  email: string;\n  emailVerified: boolean;\n  source: string;\n}): Promise<void> {\n  const result = await (params.signupPolicy ?? defaultSignupPolicy).isSignupAllowed({\n    email: params.email,\n    emailVerified: params.emailVerified,\n    source: params.source,\n  });\n\n  if (!result.allowed) {\n    throw new SignupNotAllowedError(\n      result.message ?? DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,\n      result.format,\n    );\n  }\n}\n\nlet dummyHashCache: string | undefined;\nasync function getDummyHash(): Promise<string> {\n  if (!dummyHashCache) {\n    dummyHashCache = await hashPassword({password: 'dummy-for-timing-parity'});\n  }\n  return dummyHashCache;\n}\n\nfunction hoursFromNow(hours: number): Date {\n  return new Date(Date.now() + hours * 60 * 60 * 1000);\n}\n\nfunction daysFromNow(days: number): Date {\n  return new Date(Date.now() + days * 24 * 60 * 60 * 1000);\n}\n\nfunction recordRefreshOutcome(outcome: AuthTokenRefreshOutcome): void {\n  recordTokenRefreshed(outcome);\n}\n\ntype TokenMemberships = TokenMembership[];\n\nasync function loadTokenMemberships(\n  userId: string,\n  workspaces: WorkspacesInterModuleClient,\n): Promise<TokenMemberships> {\n  const memberships = await workspaces\n    .listMembershipsForTokenClaims({userId})\n    .catch((error: unknown) => {\n      throw new AuthDependencyUnavailableError('workspaces', error);\n    });\n  return memberships.memberships;\n}\n\nasync function signAccessToken(\n  user: User,\n  memberships: TokenMemberships,\n  refreshSessionId: string,\n): Promise<string> {\n  return await signUserToken({\n    userId: user.id,\n    email: user.email,\n    name: user.name,\n    memberships,\n    refreshSessionId,\n    secret: userAccessTokenKey(),\n    expiresIn: config.AUTH_JWT_EXPIRES_IN,\n  });\n}\n\nfunction isWithinRotationGrace(refreshToken: RefreshToken): boolean {\n  if (!refreshToken.rotatedAt) return false;\n  const graceMs = config.AUTH_REFRESH_ROTATION_GRACE_SECONDS * 1000;\n  return Date.now() - refreshToken.rotatedAt.getTime() <= graceMs;\n}\n\nasync function createRefreshSession(\n  user: User,\n  refreshSessionId: string,\n): Promise<{refreshToken: string; refreshSessionId: string}> {\n  const refreshToken = generateOpaqueToken('refreshToken');\n  const session = await createRefreshTokenForActiveUser({\n    sessionId: refreshSessionId,\n    userId: user.id,\n    hashedToken: hashOpaqueToken(refreshToken),\n    expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS),\n  });\n  if (!session) throw new InvalidCredentialsError();\n  return {refreshToken, refreshSessionId: session.sessionId};\n}\n\nasync function createSessionTokens(\n  user: User,\n  workspaces: WorkspacesInterModuleClient,\n): Promise<{token: string; refreshToken: string; adminRole: AdminRole | null}> {\n  const refreshSessionId = crypto.randomUUID();\n  const memberships = await loadTokenMemberships(user.id, workspaces);\n  const token = await signAccessToken(user, memberships, refreshSessionId);\n  const adminRole = await getCurrentAdminRole({userId: user.id});\n  const {refreshToken} = await createRefreshSession(user, refreshSessionId);\n  return {token, refreshToken, adminRole};\n}\n\nfunction passwordResetLink(rawToken: string): string {\n  return `${config.CLIENT_BASE_URL}/auth/reset?token=${rawToken}`;\n}\n\nfunction invitationErrorFromKnownError(\n  error: unknown,\n  method: 'preflightInvitationAcceptance' | 'acceptInvitation',\n): Error {\n  const contractMethod = workspacesInterModuleContract.methods[method];\n  if (!isInterModuleKnownError(contractMethod, error)) return error as Error;\n\n  if (error.code === 'invitation-token-invalid')\n    return new TokenInvalidError('Invitation token is invalid');\n  if (error.code === 'invitation-token-used') return new TokenAlreadyUsedError();\n  if (error.code === 'invitation-token-expired') return new TokenExpiredError();\n  return new InvitationEmailMismatchError();\n}\n\nfunction invitationErrorMessage(\n  code:\n    | 'invitation-token-invalid'\n    | 'invitation-token-used'\n    | 'invitation-token-expired'\n    | 'invitation-email-mismatch',\n): string {\n  if (code === 'invitation-token-invalid') return 'Invitation token is invalid';\n  if (code === 'invitation-token-used') return 'Invitation has already been accepted';\n  if (code === 'invitation-token-expired') return 'Invitation has expired';\n  return 'Signup email does not match the invitation';\n}\n\nexport interface SignupParams {\n  email: string;\n  password: string;\n  name?: string | undefined;\n  signupPolicy?: SignupPolicy | undefined;\n}\n\nexport interface ProvisionUserParams {\n  email: string;\n  name?: string | null | undefined;\n  signupPolicy?: SignupPolicy | undefined;\n}\n\n/**\n * Creates a verified, password-less user for an external identity provider.\n * Existing users are returned unchanged, including their password and profile.\n */\nexport async function provisionUser(params: ProvisionUserParams): Promise<User> {\n  const email = emailSchema.parse(params.email);\n  const existing = await findUserByEmail({email});\n  if (existing) return existing;\n\n  await assertSignupAllowed({\n    signupPolicy: params.signupPolicy,\n    email,\n    emailVerified: true,\n    source: 'external-identity',\n  });\n\n  return await provisionDbUser({\n    email,\n    name: params.name ?? null,\n  });\n}\n\nexport type SignupResult = User & {\n  emailChallenge: {id: string; nextResendAvailableAt: Date};\n};\n\nexport async function signup(params: SignupParams & {sourceIp?: string}): Promise<SignupResult> {\n  const email = emailSchema.parse(params.email);\n  const existing = await findUserByEmail({email});\n  if (existing) {\n    const canResumeVerification =\n      existing.status === 'active' &&\n      existing.emailVerifiedAt === null &&\n      existing.hashedPassword !== null &&\n      (await verifyPassword({password: params.password, hash: existing.hashedPassword}));\n    if (canResumeVerification) {\n      const emailChallenge = await createEmailChallenge({\n        email: existing.email,\n        purpose: PASSWORD_VERIFICATION_PURPOSE,\n        continuation: existing.id,\n        idempotencyKey: existing.id,\n        sourceIp: params.sourceIp ?? '0.0.0.0',\n      });\n      return {...existing, emailChallenge};\n    }\n    throw new EmailTakenError(email);\n  }\n\n  await assertSignupAllowed({\n    signupPolicy: params.signupPolicy,\n    email,\n    emailVerified: false,\n    source: 'password',\n  });\n\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email,\n    hashedPassword,\n    name: params.name ?? null,\n    signedUp: {viaInvitation: false},\n  });\n\n  const emailChallenge = await createEmailChallenge({\n    email: user.email,\n    purpose: PASSWORD_VERIFICATION_PURPOSE,\n    continuation: user.id,\n    idempotencyKey: user.id,\n    sourceIp: params.sourceIp ?? '0.0.0.0',\n  });\n\n  return {...user, emailChallenge};\n}\n\nexport interface SignupWithInvitationParams extends SignupParams {\n  invitationToken: string;\n  workspaces: WorkspacesInterModuleClient;\n}\n\nexport interface SignupWithInvitationResult extends LoginResult {\n  membership: {id: string; userId: string; workspaceId: string} | null;\n  acceptError?: {code: string; message: string};\n}\n\nexport async function signupWithInvitation(\n  params: SignupWithInvitationParams,\n): Promise<SignupWithInvitationResult> {\n  // Step 1: Pre-validate the invitation BEFORE any user write so an invalid\n  // token never produces an orphan user. Re-validation happens again inside\n  // acceptWorkspaceInvitation (race-safe) after the user is created.\n  try {\n    await params.workspaces.preflightInvitationAcceptance({\n      token: params.invitationToken,\n      email: params.email,\n    });\n  } catch (error) {\n    throw invitationErrorFromKnownError(error, 'preflightInvitationAcceptance');\n  }\n\n  // Step 2: Create the user as verified. The invitation email is the proof of\n  // ownership, and this avoids a second auth-table write just to mark verified.\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) {\n    throw new EmailTakenError(params.email);\n  }\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email: params.email,\n    hashedPassword,\n    name: params.name ?? null,\n    emailVerifiedAt: new Date(),\n    signedUp: {viaInvitation: true},\n  });\n\n  // Step 3: Accept the invitation through the workspaces module boundary.\n  // This is intentionally not one database transaction with auth; treat it like\n  // calling another service. If it fails after user creation, return a verified\n  // signed-in user and an explicit retryable accept error.\n  let membership: SignupWithInvitationResult['membership'] = null;\n  let acceptError: SignupWithInvitationResult['acceptError'];\n  try {\n    const result = await params.workspaces.acceptInvitation({\n      token: params.invitationToken,\n      userId: user.id,\n      email: user.email,\n      name: user.name,\n    });\n    membership = {\n      id: result.membership.id,\n      userId: result.membership.userId,\n      workspaceId: result.membership.workspaceId,\n    };\n  } catch (error) {\n    if (isInterModuleKnownError(workspacesInterModuleContract.methods.acceptInvitation, error)) {\n      acceptError = {code: error.code, message: invitationErrorMessage(error.code)};\n    } else {\n      acceptError = {\n        code: 'AcceptFailed',\n        message: 'Could not accept the invitation; please retry from the invite link.',\n      };\n    }\n  }\n\n  // Step 4: Issue session. createSessionTokens reads memberships through the\n  // workspaces module API, so a successful accept is reflected in the JWT.\n  const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);\n\n  if (acceptError) {\n    return {token, refreshToken, user, membership, acceptError, adminRole};\n  }\n  return {token, refreshToken, user, membership, adminRole};\n}\n\nexport interface CreateUserParams extends SignupParams {\n  verified: boolean;\n}\n\nexport async function createUser(params: CreateUserParams): Promise<User> {\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) {\n    throw new EmailTakenError(params.email);\n  }\n\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email: params.email,\n    hashedPassword,\n    name: params.name ?? null,\n    emailVerifiedAt: params.verified ? new Date() : null,\n  });\n\n  return user;\n}\n\nexport interface LoginParams {\n  email: string;\n  password: string;\n  workspaces: WorkspacesInterModuleClient;\n}\n\nexport interface LoginResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport async function login(params: LoginParams): Promise<LoginResult> {\n  const user = await findUserByEmail({email: params.email});\n\n  if (!user) {\n    await verifyPassword({password: params.password, hash: await getDummyHash()});\n    throw new InvalidCredentialsError();\n  }\n\n  const hasPassword = user.hashedPassword !== null;\n  const ok = await verifyPassword({\n    password: params.password,\n    hash: user.hashedPassword ?? (await getDummyHash()),\n  });\n  if (!hasPassword || !ok || user.status !== 'active') {\n    throw new InvalidCredentialsError();\n  }\n\n  if (user.emailVerifiedAt === null) {\n    throw new EmailNotVerifiedError();\n  }\n\n  const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);\n\n  return {token, refreshToken, user, adminRole};\n}\n\nexport interface CreateSessionForUserParams {\n  userId?: string | undefined;\n  email?: string | undefined;\n  workspaces: WorkspacesInterModuleClient;\n}\n\nexport interface CreateSessionForUserResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport type CreateSessionForUserError =\n  | AuthDependencyUnavailableError\n  | EmailNotVerifiedError\n  | InvalidCredentialsError\n  | UserNotFoundError;\n\nexport async function createSessionForUser(\n  params: CreateSessionForUserParams,\n): Promise<CreateSessionForUserResult> {\n  let user: User | undefined;\n  if (params.userId) user = await findUserById({id: params.userId});\n  else if (params.email) user = await findUserByEmail({email: emailSchema.parse(params.email)});\n\n  if (!user) {\n    throw new UserNotFoundError(params.userId ?? params.email ?? 'unknown');\n  }\n  if (user.emailVerifiedAt === null) {\n    throw new EmailNotVerifiedError();\n  }\n  if (user.status !== 'active') {\n    throw new InvalidCredentialsError();\n  }\n\n  const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);\n\n  return {token, refreshToken, user, adminRole};\n}\n\n/**\n * Cap for impersonated session tokens: the TTL is min(`AUTH_JWT_EXPIRES_IN`,\n * this), so an impersonated window can never outlive 15 minutes no matter how\n * the deployment configures ordinary access tokens.\n */\nexport const IMPERSONATION_MAX_TTL_SECONDS = 15 * 60;\n\nexport interface CreateImpersonatedSessionTokenParams {\n  targetUserId: string;\n  /** The administrator the token is minted for; signed into the `impersonatorId` claim. */\n  impersonatorId: string;\n  workspaces: WorkspacesInterModuleClient;\n  /**\n   * Re-sign lifetime override used by an idempotent replay: the remaining\n   * lifetime to the stored `expires_at`, so a replay never extends the window.\n   * Defaults to min(`AUTH_JWT_EXPIRES_IN`, 15 minutes).\n   */\n  expiresIn?: string | undefined;\n}\n\nexport interface CreateImpersonatedSessionTokenResult {\n  token: string;\n  expiresAt: Date;\n  user: User;\n}\n\nfunction impersonationTtlSeconds(): number {\n  const configuredSeconds = durationToSeconds(config.AUTH_JWT_EXPIRES_IN);\n  const ttlSeconds = Math.min(configuredSeconds, IMPERSONATION_MAX_TTL_SECONDS);\n  if (ttlSeconds <= 0) {\n    throw new TypeError(\n      `AUTH_JWT_EXPIRES_IN must be a valid duration of at least 1 second, got ${config.AUTH_JWT_EXPIRES_IN}`,\n    );\n  }\n  return ttlSeconds;\n}\n\n/**\n * Mints an access-token-only impersonated session for a target user: the same\n * eligibility as login (active account, verified email), the target's real\n * membership claims, a capped TTL, the `impersonatorId` claim, and **no**\n * `refreshSessionId`. It creates no refresh session and sets no cookie, so\n * nothing persisted can resurrect the session after the token window.\n */\nexport async function createImpersonatedSessionToken(\n  params: CreateImpersonatedSessionTokenParams,\n): Promise<CreateImpersonatedSessionTokenResult> {\n  // Rule 1 lives in the mint primitive as well as the command entry, so the\n  // exported package API can never bypass the kill switch: the flag is a\n  // configuration read that also holds on the in-transaction replay path.\n  if (!config.AUTH_IMPERSONATION_ENABLED) throw new ImpersonationDisabledError();\n\n  const user = await findUserById({id: params.targetUserId});\n  if (!user) {\n    throw new UserNotFoundError(params.targetUserId);\n  }\n  if (user.emailVerifiedAt === null) {\n    throw new EmailNotVerifiedError();\n  }\n  if (user.status !== 'active') {\n    throw new InvalidCredentialsError();\n  }\n\n  const memberships = await loadTokenMemberships(user.id, params.workspaces);\n  const ttlSeconds =\n    params.expiresIn === undefined\n      ? impersonationTtlSeconds()\n      : Math.min(durationToSeconds(params.expiresIn), IMPERSONATION_MAX_TTL_SECONDS);\n  if (ttlSeconds <= 0) {\n    throw new TypeError(\n      `Impersonation token TTL must be at least 1 second, got ${params.expiresIn}`,\n    );\n  }\n\n  const token = await signUserToken({\n    userId: user.id,\n    email: user.email,\n    name: user.name,\n    memberships,\n    impersonatorId: params.impersonatorId,\n    secret: userAccessTokenKey(),\n    expiresIn: `${ttlSeconds}s`,\n  });\n\n  // The advertised expiry is the token's actual signed `exp`, never a\n  // clock-derived estimate: the signer stamps `iat`/`exp` in whole seconds, so\n  // `Date.now() + ttl` could drift up to a second from the signed claims in\n  // either direction. Deriving `expiresAt` from the signed token keeps the\n  // response, the stored command result, and the bearer token exactly aligned,\n  // which is what lets a replay re-sign with a TTL that never extends the\n  // window (`exp` of the re-signed token is at most the original `exp`).\n  const claims = await verifyUserToken({token, secret: userAccessTokenKey()});\n  return {token, expiresAt: new Date(claims.exp * 1000), user};\n}\n\nexport interface RefreshAccessTokenResult {\n  token: string;\n  /** Undefined on a grace-window hit: keep the existing cookie instead of rotating it. */\n  refreshToken: string | undefined;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport async function refreshAccessToken(params: {\n  refreshToken: string;\n  workspaces: WorkspacesInterModuleClient;\n}): Promise<RefreshAccessTokenResult> {\n  const currentHashedToken = hashOpaqueToken(params.refreshToken);\n  const current = await findRefreshTokenByHash({hashedToken: currentHashedToken});\n  if (!current) {\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token is invalid or expired');\n  }\n\n  const user = await findUserById({id: current.userId});\n  if (user?.status !== 'active') {\n    await revokeRefreshSession({sessionId: current.sessionId, userId: current.userId});\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token is invalid or expired');\n  }\n  const adminRole = await getCurrentAdminRole({userId: user.id});\n\n  // Within the grace window a rotated token means a concurrent refresh (e.g. a\n  // second tab); past it, reuse of a retired token means a compromised session.\n  if (current.rotatedAt) {\n    if (isWithinRotationGrace(current)) {\n      const memberships = await loadTokenMemberships(user.id, params.workspaces);\n      const token = await signAccessToken(user, memberships, current.sessionId);\n      recordRefreshOutcome('grace');\n      return {token, refreshToken: undefined, user, adminRole};\n    }\n    await revokeRefreshTokensForUser({userId: user.id});\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token reused after rotation');\n  }\n\n  // Keep the external membership snapshot ahead of rotation so an outage\n  // cannot retire a refresh token that the caller can still retry.\n  const memberships = await loadTokenMemberships(user.id, params.workspaces);\n\n  // Losing the CAS requires a state check: another request may have rotated,\n  // revoked, or expired the token before this refresh could claim it.\n  const nextRefreshToken = generateOpaqueToken('refreshToken');\n  const rotated = await rotateRefreshToken({\n    userId: current.userId,\n    id: current.id,\n    currentHashedToken,\n    nextHashedToken: hashOpaqueToken(nextRefreshToken),\n    expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS),\n  });\n  if (!rotated) {\n    const latestUser = await findUserById({id: current.userId});\n    if (latestUser?.status !== 'active') {\n      recordRefreshOutcome('rejected');\n      throw new TokenInvalidError('Refresh token is invalid or expired');\n    }\n    const latest = await findRefreshTokenByHash({hashedToken: currentHashedToken});\n    if (!latest || !isWithinRotationGrace(latest)) {\n      recordRefreshOutcome('rejected');\n      throw new TokenInvalidError('Refresh token is invalid or expired');\n    }\n    const token = await signAccessToken(user, memberships, latest.sessionId);\n    recordRefreshOutcome('grace');\n    return {token, refreshToken: undefined, user, adminRole};\n  }\n\n  const token = await signAccessToken(user, memberships, current.sessionId);\n  recordRefreshOutcome('rotated');\n  return {token, refreshToken: nextRefreshToken, user, adminRole};\n}\n\nexport interface ConfirmEmailVerificationResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport interface ResendEmailVerificationResult {\n  nextResendAvailableAt: Date;\n}\n\nexport async function confirmEmailVerification(params: {\n  email: string;\n  challengeId: string;\n  code: string;\n  workspaces: WorkspacesInterModuleClient;\n}): Promise<ConfirmEmailVerificationResult> {\n  const user = await findUserByEmail({email: emailSchema.parse(params.email)});\n  if (!user) throw new TokenInvalidError('Verification code is invalid or expired');\n  await confirmEmailChallenge({id: params.challengeId, code: params.code, continuation: user.id});\n  await consumeEmailChallengeProof({\n    id: params.challengeId,\n    purpose: PASSWORD_VERIFICATION_PURPOSE,\n    continuation: user.id,\n  });\n\n  const verifiedUser = await markEmailVerified({userId: user.id});\n  if (verifiedUser?.status !== 'active') {\n    throw new TokenInvalidError('Verification code is invalid or expired');\n  }\n\n  const {token, refreshToken, adminRole} = await createSessionTokens(\n    verifiedUser,\n    params.workspaces,\n  );\n\n  return {token, refreshToken, user: verifiedUser, adminRole};\n}\n\nexport async function resendEmailVerification(params: {\n  email: string;\n  challengeId: string;\n  sourceIp: string;\n}): Promise<ResendEmailVerificationResult> {\n  const user = await findUserByEmail({email: emailSchema.parse(params.email)});\n  if (!user || user.emailVerifiedAt || user.status !== 'active') {\n    return {nextResendAvailableAt: new Date()};\n  }\n  const result = await resendEmailChallenge({\n    id: params.challengeId,\n    continuation: user.id,\n    sourceIp: params.sourceIp,\n  });\n\n  return {nextResendAvailableAt: result.nextResendAvailableAt};\n}\n\nexport async function requestPasswordReset(params: {email: string}): Promise<void> {\n  const user = await findUserByEmail({email: params.email});\n  if (user?.status !== 'active' || user.hashedPassword === null) {\n    return;\n  }\n\n  const rawToken = generateOpaqueToken('passwordReset');\n  await createPasswordReset({\n    userId: user.id,\n    hashedToken: hashOpaqueToken(rawToken),\n    expiresAt: hoursFromNow(RESET_TTL_HOURS),\n    sendEmail: {\n      email: user.email,\n      resetLink: passwordResetLink(rawToken),\n      expiresInHours: RESET_TTL_HOURS,\n    },\n  });\n}\n\nexport interface ConfirmPasswordResetResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport async function confirmPasswordReset(params: {\n  token: string;\n  newPassword: string;\n  workspaces: WorkspacesInterModuleClient;\n}): Promise<ConfirmPasswordResetResult> {\n  const consumed = await consumePasswordReset({hashedToken: hashOpaqueToken(params.token)});\n  if (!consumed) {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  const existingUser = await findUserById({id: consumed.userId});\n  if (existingUser?.status !== 'active' || existingUser.hashedPassword === null) {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  const hashedPassword = await hashPassword({password: params.newPassword});\n  const user = await updateUserPassword({userId: consumed.userId, hashedPassword});\n  if (user?.status !== 'active') {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  await revokeRefreshTokensForUser({userId: consumed.userId});\n\n  const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);\n\n  return {token, refreshToken, user, adminRole};\n}\n\nexport async function changePassword(params: {\n  userId: string;\n  currentPassword: string;\n  newPassword: string;\n  refreshToken?: string | undefined;\n}): Promise<void> {\n  const user = await findUserById({id: params.userId});\n  if (!user) {\n    throw new UserNotFoundError(params.userId);\n  }\n\n  const hasPassword = user.hashedPassword !== null;\n  const ok = await verifyPassword({\n    password: params.currentPassword,\n    hash: user.hashedPassword ?? (await getDummyHash()),\n  });\n  if (!hasPassword || !ok) {\n    throw new InvalidCredentialsError();\n  }\n\n  const hashedPassword = await hashPassword({password: params.newPassword});\n  const currentRefreshSession = params.refreshToken\n    ? await findActiveRefreshTokenByHash({hashedToken: hashOpaqueToken(params.refreshToken)})\n    : undefined;\n  const exceptRefreshTokenId =\n    currentRefreshSession?.userId === user.id ? currentRefreshSession.id : undefined;\n\n  await updateUserPassword({userId: user.id, hashedPassword});\n  await revokeRefreshTokensForUser({userId: user.id, exceptRefreshTokenId});\n}\n\nexport async function logout(params: {refreshToken?: string | undefined}): Promise<void> {\n  if (!params.refreshToken) return;\n  const refreshToken = await findRefreshTokenByHash({\n    hashedToken: hashOpaqueToken(params.refreshToken),\n  });\n  if (!refreshToken) return;\n  await revokeRefreshSession({sessionId: refreshToken.sessionId, userId: refreshToken.userId});\n}\n\nexport interface GetCurrentUserResult {\n  user: User;\n}\n\nexport async function getCurrentUser(params: {userId: string}): Promise<GetCurrentUserResult> {\n  const user = await findUserById({id: params.userId});\n  if (!user) {\n    throw new UserNotFoundError(params.userId);\n  }\n\n  return {user};\n}\n"],"names":["emailSchema","confirmEmailChallenge","consumeEmailChallengeProof","createEmailChallenge","resendEmailChallenge","workspacesInterModuleContract","isInterModuleKnownError","userAccessTokenKey","durationToSeconds","generateOpaqueToken","hashOpaqueToken","config","consumePasswordReset","createPasswordReset","createRefreshTokenForActiveUser","findActiveRefreshTokenByHash","findRefreshTokenByHash","revokeRefreshSession","revokeRefreshTokensForUser","rotateRefreshToken","createUser","createDbUser","findUserByEmail","findUserById","markEmailVerified","provisionUser","provisionDbUser","updateUserPassword","recordTokenRefreshed","getCurrentAdminRole","AuthDependencyUnavailableError","EmailNotVerifiedError","EmailTakenError","ImpersonationDisabledError","InvalidCredentialsError","InvitationEmailMismatchError","SignupNotAllowedError","TokenAlreadyUsedError","TokenExpiredError","TokenInvalidError","UserNotFoundError","signUserToken","verifyUserToken","hashPassword","verifyPassword","createEnvironmentSignupPolicy","RESET_TTL_HOURS","PASSWORD_VERIFICATION_PURPOSE","DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE","defaultSignupPolicy","assertSignupAllowed","params","result","signupPolicy","isSignupAllowed","email","emailVerified","source","allowed","message","format","dummyHashCache","getDummyHash","password","hoursFromNow","hours","Date","now","daysFromNow","days","recordRefreshOutcome","outcome","loadTokenMemberships","userId","workspaces","memberships","listMembershipsForTokenClaims","catch","error","signAccessToken","user","refreshSessionId","id","name","secret","expiresIn","AUTH_JWT_EXPIRES_IN","isWithinRotationGrace","refreshToken","rotatedAt","graceMs","AUTH_REFRESH_ROTATION_GRACE_SECONDS","getTime","createRefreshSession","session","sessionId","hashedToken","expiresAt","AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS","createSessionTokens","crypto","randomUUID","token","adminRole","passwordResetLink","rawToken","CLIENT_BASE_URL","invitationErrorFromKnownError","method","contractMethod","methods","code","invitationErrorMessage","parse","existing","signup","canResumeVerification","status","emailVerifiedAt","hashedPassword","hash","emailChallenge","purpose","continuation","idempotencyKey","sourceIp","signedUp","viaInvitation","signupWithInvitation","preflightInvitationAcceptance","invitationToken","membership","acceptError","acceptInvitation","workspaceId","verified","login","hasPassword","ok","createSessionForUser","IMPERSONATION_MAX_TTL_SECONDS","impersonationTtlSeconds","configuredSeconds","ttlSeconds","Math","min","TypeError","createImpersonatedSessionToken","AUTH_IMPERSONATION_ENABLED","targetUserId","undefined","impersonatorId","claims","exp","refreshAccessToken","currentHashedToken","current","nextRefreshToken","rotated","nextHashedToken","latestUser","latest","confirmEmailVerification","challengeId","verifiedUser","resendEmailVerification","nextResendAvailableAt","requestPasswordReset","sendEmail","resetLink","expiresInHours","confirmPasswordReset","consumed","existingUser","newPassword","changePassword","currentPassword","currentRefreshSession","exceptRefreshTokenId","logout","getCurrentUser"],"mappings":"AAAA,SAAwBA,WAAW,QAAO,wBAAwB;AAClE,SACEC,qBAAqB,EACrBC,0BAA0B,EAC1BC,oBAAoB,EACpBC,oBAAoB,QACf,gCAAgC;AACvC,SAEEC,6BAA6B,QACxB,2CAA2C;AAClD,SAAQC,uBAAuB,QAAO,wBAAwB;AAC9D,SAAQC,kBAAkB,QAAO,8BAA8B;AAC/D,SAAQC,iBAAiB,QAAO,oBAAoB;AACpD,SAAQC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAC1E,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,oBAAoB,EAAEC,mBAAmB,QAAO,yBAAyB;AACjF,SACEC,+BAA+B,EAC/BC,4BAA4B,EAC5BC,sBAAsB,EACtBC,oBAAoB,EACpBC,0BAA0B,EAC1BC,kBAAkB,QACb,wBAAwB;AAC/B,SACEC,cAAcC,YAAY,EAC1BC,eAAe,EACfC,YAAY,EACZC,iBAAiB,EACjBC,iBAAiBC,eAAe,EAChCC,kBAAkB,QACb,eAAe;AACtB,SAAsCC,oBAAoB,QAAO,oBAAoB;AACrF,SAAQC,mBAAmB,QAAO,kBAAkB;AAGpD,SACEC,8BAA8B,EAC9BC,qBAAqB,EACrBC,eAAe,EACfC,0BAA0B,EAC1BC,uBAAuB,EACvBC,4BAA4B,EAC5BC,qBAAqB,EACrBC,qBAAqB,EACrBC,iBAAiB,EACjBC,iBAAiB,EACjBC,iBAAiB,QACZ,cAAc;AACrB,SAAQC,aAAa,EAAwBC,eAAe,QAAO,WAAW;AAC9E,SAAQC,YAAY,EAAEC,cAAc,QAAO,gBAAgB;AAE3D,SAAQC,6BAA6B,QAAO,qBAAqB;AAEjE,MAAMC,kBAAkB;AACxB,MAAMC,gCAAgC;AACtC,MAAMC,qCACJ;AAEF,MAAMC,sBAAoCJ;AAE1C,eAAeK,oBAAoBC,MAKlC;IACC,MAAMC,SAAS,MAAM,AAACD,CAAAA,OAAOE,YAAY,IAAIJ,mBAAkB,EAAGK,eAAe,CAAC;QAChFC,OAAOJ,OAAOI,KAAK;QACnBC,eAAeL,OAAOK,aAAa;QACnCC,QAAQN,OAAOM,MAAM;IACvB;IAEA,IAAI,CAACL,OAAOM,OAAO,EAAE;QACnB,MAAM,IAAItB,sBACRgB,OAAOO,OAAO,IAAIX,oCAClBI,OAAOQ,MAAM;IAEjB;AACF;AAEA,IAAIC;AACJ,eAAeC;IACb,IAAI,CAACD,gBAAgB;QACnBA,iBAAiB,MAAMlB,aAAa;YAACoB,UAAU;QAAyB;IAC1E;IACA,OAAOF;AACT;AAEA,SAASG,aAAaC,KAAa;IACjC,OAAO,IAAIC,KAAKA,KAAKC,GAAG,KAAKF,QAAQ,KAAK,KAAK;AACjD;AAEA,SAASG,YAAYC,IAAY;IAC/B,OAAO,IAAIH,KAAKA,KAAKC,GAAG,KAAKE,OAAO,KAAK,KAAK,KAAK;AACrD;AAEA,SAASC,qBAAqBC,OAAgC;IAC5D3C,qBAAqB2C;AACvB;AAIA,eAAeC,qBACbC,MAAc,EACdC,UAAuC;IAEvC,MAAMC,cAAc,MAAMD,WACvBE,6BAA6B,CAAC;QAACH;IAAM,GACrCI,KAAK,CAAC,CAACC;QACN,MAAM,IAAIhD,+BAA+B,cAAcgD;IACzD;IACF,OAAOH,YAAYA,WAAW;AAChC;AAEA,eAAeI,gBACbC,IAAU,EACVL,WAA6B,EAC7BM,gBAAwB;IAExB,OAAO,MAAMxC,cAAc;QACzBgC,QAAQO,KAAKE,EAAE;QACf3B,OAAOyB,KAAKzB,KAAK;QACjB4B,MAAMH,KAAKG,IAAI;QACfR;QACAM;QACAG,QAAQ7E;QACR8E,WAAW1E,OAAO2E,mBAAmB;IACvC;AACF;AAEA,SAASC,sBAAsBC,YAA0B;IACvD,IAAI,CAACA,aAAaC,SAAS,EAAE,OAAO;IACpC,MAAMC,UAAU/E,OAAOgF,mCAAmC,GAAG;IAC7D,OAAOzB,KAAKC,GAAG,KAAKqB,aAAaC,SAAS,CAACG,OAAO,MAAMF;AAC1D;AAEA,eAAeG,qBACbb,IAAU,EACVC,gBAAwB;IAExB,MAAMO,eAAe/E,oBAAoB;IACzC,MAAMqF,UAAU,MAAMhF,gCAAgC;QACpDiF,WAAWd;QACXR,QAAQO,KAAKE,EAAE;QACfc,aAAatF,gBAAgB8E;QAC7BS,WAAW7B,YAAYzD,OAAOuF,kCAAkC;IAClE;IACA,IAAI,CAACJ,SAAS,MAAM,IAAI5D;IACxB,OAAO;QAACsD;QAAcP,kBAAkBa,QAAQC,SAAS;IAAA;AAC3D;AAEA,eAAeI,oBACbnB,IAAU,EACVN,UAAuC;IAEvC,MAAMO,mBAAmBmB,OAAOC,UAAU;IAC1C,MAAM1B,cAAc,MAAMH,qBAAqBQ,KAAKE,EAAE,EAAER;IACxD,MAAM4B,QAAQ,MAAMvB,gBAAgBC,MAAML,aAAaM;IACvD,MAAMsB,YAAY,MAAM1E,oBAAoB;QAAC4C,QAAQO,KAAKE,EAAE;IAAA;IAC5D,MAAM,EAACM,YAAY,EAAC,GAAG,MAAMK,qBAAqBb,MAAMC;IACxD,OAAO;QAACqB;QAAOd;QAAce;IAAS;AACxC;AAEA,SAASC,kBAAkBC,QAAgB;IACzC,OAAO,GAAG9F,OAAO+F,eAAe,CAAC,kBAAkB,EAAED,UAAU;AACjE;AAEA,SAASE,8BACP7B,KAAc,EACd8B,MAA4D;IAE5D,MAAMC,iBAAiBxG,8BAA8ByG,OAAO,CAACF,OAAO;IACpE,IAAI,CAACtG,wBAAwBuG,gBAAgB/B,QAAQ,OAAOA;IAE5D,IAAIA,MAAMiC,IAAI,KAAK,4BACjB,OAAO,IAAIxE,kBAAkB;IAC/B,IAAIuC,MAAMiC,IAAI,KAAK,yBAAyB,OAAO,IAAI1E;IACvD,IAAIyC,MAAMiC,IAAI,KAAK,4BAA4B,OAAO,IAAIzE;IAC1D,OAAO,IAAIH;AACb;AAEA,SAAS6E,uBACPD,IAI+B;IAE/B,IAAIA,SAAS,4BAA4B,OAAO;IAChD,IAAIA,SAAS,yBAAyB,OAAO;IAC7C,IAAIA,SAAS,4BAA4B,OAAO;IAChD,OAAO;AACT;AAeA;;;CAGC,GACD,OAAO,eAAetF,cAAc0B,MAA2B;IAC7D,MAAMI,QAAQvD,YAAYiH,KAAK,CAAC9D,OAAOI,KAAK;IAC5C,MAAM2D,WAAW,MAAM5F,gBAAgB;QAACiC;IAAK;IAC7C,IAAI2D,UAAU,OAAOA;IAErB,MAAMhE,oBAAoB;QACxBG,cAAcF,OAAOE,YAAY;QACjCE;QACAC,eAAe;QACfC,QAAQ;IACV;IAEA,OAAO,MAAM/B,gBAAgB;QAC3B6B;QACA4B,MAAMhC,OAAOgC,IAAI,IAAI;IACvB;AACF;AAMA,OAAO,eAAegC,OAAOhE,MAA0C;IACrE,MAAMI,QAAQvD,YAAYiH,KAAK,CAAC9D,OAAOI,KAAK;IAC5C,MAAM2D,WAAW,MAAM5F,gBAAgB;QAACiC;IAAK;IAC7C,IAAI2D,UAAU;QACZ,MAAME,wBACJF,SAASG,MAAM,KAAK,YACpBH,SAASI,eAAe,KAAK,QAC7BJ,SAASK,cAAc,KAAK,QAC3B,MAAM3E,eAAe;YAACmB,UAAUZ,OAAOY,QAAQ;YAAEyD,MAAMN,SAASK,cAAc;QAAA;QACjF,IAAIH,uBAAuB;YACzB,MAAMK,iBAAiB,MAAMtH,qBAAqB;gBAChDoD,OAAO2D,SAAS3D,KAAK;gBACrBmE,SAAS3E;gBACT4E,cAAcT,SAAShC,EAAE;gBACzB0C,gBAAgBV,SAAShC,EAAE;gBAC3B2C,UAAU1E,OAAO0E,QAAQ,IAAI;YAC/B;YACA,OAAO;gBAAC,GAAGX,QAAQ;gBAAEO;YAAc;QACrC;QACA,MAAM,IAAIzF,gBAAgBuB;IAC5B;IAEA,MAAML,oBAAoB;QACxBG,cAAcF,OAAOE,YAAY;QACjCE;QACAC,eAAe;QACfC,QAAQ;IACV;IAEA,MAAM8D,iBAAiB,MAAM5E,aAAa;QAACoB,UAAUZ,OAAOY,QAAQ;IAAA;IACpE,MAAMiB,OAAO,MAAM3D,aAAa;QAC9BkC;QACAgE;QACApC,MAAMhC,OAAOgC,IAAI,IAAI;QACrB2C,UAAU;YAACC,eAAe;QAAK;IACjC;IAEA,MAAMN,iBAAiB,MAAMtH,qBAAqB;QAChDoD,OAAOyB,KAAKzB,KAAK;QACjBmE,SAAS3E;QACT4E,cAAc3C,KAAKE,EAAE;QACrB0C,gBAAgB5C,KAAKE,EAAE;QACvB2C,UAAU1E,OAAO0E,QAAQ,IAAI;IAC/B;IAEA,OAAO;QAAC,GAAG7C,IAAI;QAAEyC;IAAc;AACjC;AAYA,OAAO,eAAeO,qBACpB7E,MAAkC;IAElC,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI;QACF,MAAMA,OAAOuB,UAAU,CAACuD,6BAA6B,CAAC;YACpD3B,OAAOnD,OAAO+E,eAAe;YAC7B3E,OAAOJ,OAAOI,KAAK;QACrB;IACF,EAAE,OAAOuB,OAAO;QACd,MAAM6B,8BAA8B7B,OAAO;IAC7C;IAEA,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAMoC,WAAW,MAAM5F,gBAAgB;QAACiC,OAAOJ,OAAOI,KAAK;IAAA;IAC3D,IAAI2D,UAAU;QACZ,MAAM,IAAIlF,gBAAgBmB,OAAOI,KAAK;IACxC;IACA,MAAMgE,iBAAiB,MAAM5E,aAAa;QAACoB,UAAUZ,OAAOY,QAAQ;IAAA;IACpE,MAAMiB,OAAO,MAAM3D,aAAa;QAC9BkC,OAAOJ,OAAOI,KAAK;QACnBgE;QACApC,MAAMhC,OAAOgC,IAAI,IAAI;QACrBmC,iBAAiB,IAAIpD;QACrB4D,UAAU;YAACC,eAAe;QAAI;IAChC;IAEA,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,yDAAyD;IACzD,IAAII,aAAuD;IAC3D,IAAIC;IACJ,IAAI;QACF,MAAMhF,SAAS,MAAMD,OAAOuB,UAAU,CAAC2D,gBAAgB,CAAC;YACtD/B,OAAOnD,OAAO+E,eAAe;YAC7BzD,QAAQO,KAAKE,EAAE;YACf3B,OAAOyB,KAAKzB,KAAK;YACjB4B,MAAMH,KAAKG,IAAI;QACjB;QACAgD,aAAa;YACXjD,IAAI9B,OAAO+E,UAAU,CAACjD,EAAE;YACxBT,QAAQrB,OAAO+E,UAAU,CAAC1D,MAAM;YAChC6D,aAAalF,OAAO+E,UAAU,CAACG,WAAW;QAC5C;IACF,EAAE,OAAOxD,OAAO;QACd,IAAIxE,wBAAwBD,8BAA8ByG,OAAO,CAACuB,gBAAgB,EAAEvD,QAAQ;YAC1FsD,cAAc;gBAACrB,MAAMjC,MAAMiC,IAAI;gBAAEpD,SAASqD,uBAAuBlC,MAAMiC,IAAI;YAAC;QAC9E,OAAO;YACLqB,cAAc;gBACZrB,MAAM;gBACNpD,SAAS;YACX;QACF;IACF;IAEA,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,EAAC2C,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAAoBnB,MAAM7B,OAAOuB,UAAU;IAE1F,IAAI0D,aAAa;QACf,OAAO;YAAC9B;YAAOd;YAAcR;YAAMmD;YAAYC;YAAa7B;QAAS;IACvE;IACA,OAAO;QAACD;QAAOd;QAAcR;QAAMmD;QAAY5B;IAAS;AAC1D;AAMA,OAAO,eAAenF,WAAW+B,MAAwB;IACvD,MAAM+D,WAAW,MAAM5F,gBAAgB;QAACiC,OAAOJ,OAAOI,KAAK;IAAA;IAC3D,IAAI2D,UAAU;QACZ,MAAM,IAAIlF,gBAAgBmB,OAAOI,KAAK;IACxC;IAEA,MAAMgE,iBAAiB,MAAM5E,aAAa;QAACoB,UAAUZ,OAAOY,QAAQ;IAAA;IACpE,MAAMiB,OAAO,MAAM3D,aAAa;QAC9BkC,OAAOJ,OAAOI,KAAK;QACnBgE;QACApC,MAAMhC,OAAOgC,IAAI,IAAI;QACrBmC,iBAAiBnE,OAAOoF,QAAQ,GAAG,IAAIrE,SAAS;IAClD;IAEA,OAAOc;AACT;AAeA,OAAO,eAAewD,MAAMrF,MAAmB;IAC7C,MAAM6B,OAAO,MAAM1D,gBAAgB;QAACiC,OAAOJ,OAAOI,KAAK;IAAA;IAEvD,IAAI,CAACyB,MAAM;QACT,MAAMpC,eAAe;YAACmB,UAAUZ,OAAOY,QAAQ;YAAEyD,MAAM,MAAM1D;QAAc;QAC3E,MAAM,IAAI5B;IACZ;IAEA,MAAMuG,cAAczD,KAAKuC,cAAc,KAAK;IAC5C,MAAMmB,KAAK,MAAM9F,eAAe;QAC9BmB,UAAUZ,OAAOY,QAAQ;QACzByD,MAAMxC,KAAKuC,cAAc,IAAK,MAAMzD;IACtC;IACA,IAAI,CAAC2E,eAAe,CAACC,MAAM1D,KAAKqC,MAAM,KAAK,UAAU;QACnD,MAAM,IAAInF;IACZ;IAEA,IAAI8C,KAAKsC,eAAe,KAAK,MAAM;QACjC,MAAM,IAAIvF;IACZ;IAEA,MAAM,EAACuE,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAAoBnB,MAAM7B,OAAOuB,UAAU;IAE1F,OAAO;QAAC4B;QAAOd;QAAcR;QAAMuB;IAAS;AAC9C;AAqBA,OAAO,eAAeoC,qBACpBxF,MAAkC;IAElC,IAAI6B;IACJ,IAAI7B,OAAOsB,MAAM,EAAEO,OAAO,MAAMzD,aAAa;QAAC2D,IAAI/B,OAAOsB,MAAM;IAAA;SAC1D,IAAItB,OAAOI,KAAK,EAAEyB,OAAO,MAAM1D,gBAAgB;QAACiC,OAAOvD,YAAYiH,KAAK,CAAC9D,OAAOI,KAAK;IAAC;IAE3F,IAAI,CAACyB,MAAM;QACT,MAAM,IAAIxC,kBAAkBW,OAAOsB,MAAM,IAAItB,OAAOI,KAAK,IAAI;IAC/D;IACA,IAAIyB,KAAKsC,eAAe,KAAK,MAAM;QACjC,MAAM,IAAIvF;IACZ;IACA,IAAIiD,KAAKqC,MAAM,KAAK,UAAU;QAC5B,MAAM,IAAInF;IACZ;IAEA,MAAM,EAACoE,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAAoBnB,MAAM7B,OAAOuB,UAAU;IAE1F,OAAO;QAAC4B;QAAOd;QAAcR;QAAMuB;IAAS;AAC9C;AAEA;;;;CAIC,GACD,OAAO,MAAMqC,gCAAgC,KAAK,GAAG;AAqBrD,SAASC;IACP,MAAMC,oBAAoBtI,kBAAkBG,OAAO2E,mBAAmB;IACtE,MAAMyD,aAAaC,KAAKC,GAAG,CAACH,mBAAmBF;IAC/C,IAAIG,cAAc,GAAG;QACnB,MAAM,IAAIG,UACR,CAAC,uEAAuE,EAAEvI,OAAO2E,mBAAmB,EAAE;IAE1G;IACA,OAAOyD;AACT;AAEA;;;;;;CAMC,GACD,OAAO,eAAeI,+BACpBhG,MAA4C;IAE5C,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,CAACxC,OAAOyI,0BAA0B,EAAE,MAAM,IAAInH;IAElD,MAAM+C,OAAO,MAAMzD,aAAa;QAAC2D,IAAI/B,OAAOkG,YAAY;IAAA;IACxD,IAAI,CAACrE,MAAM;QACT,MAAM,IAAIxC,kBAAkBW,OAAOkG,YAAY;IACjD;IACA,IAAIrE,KAAKsC,eAAe,KAAK,MAAM;QACjC,MAAM,IAAIvF;IACZ;IACA,IAAIiD,KAAKqC,MAAM,KAAK,UAAU;QAC5B,MAAM,IAAInF;IACZ;IAEA,MAAMyC,cAAc,MAAMH,qBAAqBQ,KAAKE,EAAE,EAAE/B,OAAOuB,UAAU;IACzE,MAAMqE,aACJ5F,OAAOkC,SAAS,KAAKiE,YACjBT,4BACAG,KAAKC,GAAG,CAACzI,kBAAkB2C,OAAOkC,SAAS,GAAGuD;IACpD,IAAIG,cAAc,GAAG;QACnB,MAAM,IAAIG,UACR,CAAC,uDAAuD,EAAE/F,OAAOkC,SAAS,EAAE;IAEhF;IAEA,MAAMiB,QAAQ,MAAM7D,cAAc;QAChCgC,QAAQO,KAAKE,EAAE;QACf3B,OAAOyB,KAAKzB,KAAK;QACjB4B,MAAMH,KAAKG,IAAI;QACfR;QACA4E,gBAAgBpG,OAAOoG,cAAc;QACrCnE,QAAQ7E;QACR8E,WAAW,GAAG0D,WAAW,CAAC,CAAC;IAC7B;IAEA,oEAAoE;IACpE,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,uEAAuE;IACvE,MAAMS,SAAS,MAAM9G,gBAAgB;QAAC4D;QAAOlB,QAAQ7E;IAAoB;IACzE,OAAO;QAAC+F;QAAOL,WAAW,IAAI/B,KAAKsF,OAAOC,GAAG,GAAG;QAAOzE;IAAI;AAC7D;AAUA,OAAO,eAAe0E,mBAAmBvG,MAGxC;IACC,MAAMwG,qBAAqBjJ,gBAAgByC,OAAOqC,YAAY;IAC9D,MAAMoE,UAAU,MAAM5I,uBAAuB;QAACgF,aAAa2D;IAAkB;IAC7E,IAAI,CAACC,SAAS;QACZtF,qBAAqB;QACrB,MAAM,IAAI/B,kBAAkB;IAC9B;IAEA,MAAMyC,OAAO,MAAMzD,aAAa;QAAC2D,IAAI0E,QAAQnF,MAAM;IAAA;IACnD,IAAIO,MAAMqC,WAAW,UAAU;QAC7B,MAAMpG,qBAAqB;YAAC8E,WAAW6D,QAAQ7D,SAAS;YAAEtB,QAAQmF,QAAQnF,MAAM;QAAA;QAChFH,qBAAqB;QACrB,MAAM,IAAI/B,kBAAkB;IAC9B;IACA,MAAMgE,YAAY,MAAM1E,oBAAoB;QAAC4C,QAAQO,KAAKE,EAAE;IAAA;IAE5D,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI0E,QAAQnE,SAAS,EAAE;QACrB,IAAIF,sBAAsBqE,UAAU;YAClC,MAAMjF,cAAc,MAAMH,qBAAqBQ,KAAKE,EAAE,EAAE/B,OAAOuB,UAAU;YACzE,MAAM4B,QAAQ,MAAMvB,gBAAgBC,MAAML,aAAaiF,QAAQ7D,SAAS;YACxEzB,qBAAqB;YACrB,OAAO;gBAACgC;gBAAOd,cAAc8D;gBAAWtE;gBAAMuB;YAAS;QACzD;QACA,MAAMrF,2BAA2B;YAACuD,QAAQO,KAAKE,EAAE;QAAA;QACjDZ,qBAAqB;QACrB,MAAM,IAAI/B,kBAAkB;IAC9B;IAEA,uEAAuE;IACvE,iEAAiE;IACjE,MAAMoC,cAAc,MAAMH,qBAAqBQ,KAAKE,EAAE,EAAE/B,OAAOuB,UAAU;IAEzE,2EAA2E;IAC3E,oEAAoE;IACpE,MAAMmF,mBAAmBpJ,oBAAoB;IAC7C,MAAMqJ,UAAU,MAAM3I,mBAAmB;QACvCsD,QAAQmF,QAAQnF,MAAM;QACtBS,IAAI0E,QAAQ1E,EAAE;QACdyE;QACAI,iBAAiBrJ,gBAAgBmJ;QACjC5D,WAAW7B,YAAYzD,OAAOuF,kCAAkC;IAClE;IACA,IAAI,CAAC4D,SAAS;QACZ,MAAME,aAAa,MAAMzI,aAAa;YAAC2D,IAAI0E,QAAQnF,MAAM;QAAA;QACzD,IAAIuF,YAAY3C,WAAW,UAAU;YACnC/C,qBAAqB;YACrB,MAAM,IAAI/B,kBAAkB;QAC9B;QACA,MAAM0H,SAAS,MAAMjJ,uBAAuB;YAACgF,aAAa2D;QAAkB;QAC5E,IAAI,CAACM,UAAU,CAAC1E,sBAAsB0E,SAAS;YAC7C3F,qBAAqB;YACrB,MAAM,IAAI/B,kBAAkB;QAC9B;QACA,MAAM+D,QAAQ,MAAMvB,gBAAgBC,MAAML,aAAasF,OAAOlE,SAAS;QACvEzB,qBAAqB;QACrB,OAAO;YAACgC;YAAOd,cAAc8D;YAAWtE;YAAMuB;QAAS;IACzD;IAEA,MAAMD,QAAQ,MAAMvB,gBAAgBC,MAAML,aAAaiF,QAAQ7D,SAAS;IACxEzB,qBAAqB;IACrB,OAAO;QAACgC;QAAOd,cAAcqE;QAAkB7E;QAAMuB;IAAS;AAChE;AAaA,OAAO,eAAe2D,yBAAyB/G,MAK9C;IACC,MAAM6B,OAAO,MAAM1D,gBAAgB;QAACiC,OAAOvD,YAAYiH,KAAK,CAAC9D,OAAOI,KAAK;IAAC;IAC1E,IAAI,CAACyB,MAAM,MAAM,IAAIzC,kBAAkB;IACvC,MAAMtC,sBAAsB;QAACiF,IAAI/B,OAAOgH,WAAW;QAAEpD,MAAM5D,OAAO4D,IAAI;QAAEY,cAAc3C,KAAKE,EAAE;IAAA;IAC7F,MAAMhF,2BAA2B;QAC/BgF,IAAI/B,OAAOgH,WAAW;QACtBzC,SAAS3E;QACT4E,cAAc3C,KAAKE,EAAE;IACvB;IAEA,MAAMkF,eAAe,MAAM5I,kBAAkB;QAACiD,QAAQO,KAAKE,EAAE;IAAA;IAC7D,IAAIkF,cAAc/C,WAAW,UAAU;QACrC,MAAM,IAAI9E,kBAAkB;IAC9B;IAEA,MAAM,EAAC+D,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAC7CiE,cACAjH,OAAOuB,UAAU;IAGnB,OAAO;QAAC4B;QAAOd;QAAcR,MAAMoF;QAAc7D;IAAS;AAC5D;AAEA,OAAO,eAAe8D,wBAAwBlH,MAI7C;IACC,MAAM6B,OAAO,MAAM1D,gBAAgB;QAACiC,OAAOvD,YAAYiH,KAAK,CAAC9D,OAAOI,KAAK;IAAC;IAC1E,IAAI,CAACyB,QAAQA,KAAKsC,eAAe,IAAItC,KAAKqC,MAAM,KAAK,UAAU;QAC7D,OAAO;YAACiD,uBAAuB,IAAIpG;QAAM;IAC3C;IACA,MAAMd,SAAS,MAAMhD,qBAAqB;QACxC8E,IAAI/B,OAAOgH,WAAW;QACtBxC,cAAc3C,KAAKE,EAAE;QACrB2C,UAAU1E,OAAO0E,QAAQ;IAC3B;IAEA,OAAO;QAACyC,uBAAuBlH,OAAOkH,qBAAqB;IAAA;AAC7D;AAEA,OAAO,eAAeC,qBAAqBpH,MAAuB;IAChE,MAAM6B,OAAO,MAAM1D,gBAAgB;QAACiC,OAAOJ,OAAOI,KAAK;IAAA;IACvD,IAAIyB,MAAMqC,WAAW,YAAYrC,KAAKuC,cAAc,KAAK,MAAM;QAC7D;IACF;IAEA,MAAMd,WAAWhG,oBAAoB;IACrC,MAAMI,oBAAoB;QACxB4D,QAAQO,KAAKE,EAAE;QACfc,aAAatF,gBAAgB+F;QAC7BR,WAAWjC,aAAalB;QACxB0H,WAAW;YACTjH,OAAOyB,KAAKzB,KAAK;YACjBkH,WAAWjE,kBAAkBC;YAC7BiE,gBAAgB5H;QAClB;IACF;AACF;AASA,OAAO,eAAe6H,qBAAqBxH,MAI1C;IACC,MAAMyH,WAAW,MAAMhK,qBAAqB;QAACoF,aAAatF,gBAAgByC,OAAOmD,KAAK;IAAC;IACvF,IAAI,CAACsE,UAAU;QACb,MAAM,IAAIrI,kBAAkB;IAC9B;IAEA,MAAMsI,eAAe,MAAMtJ,aAAa;QAAC2D,IAAI0F,SAASnG,MAAM;IAAA;IAC5D,IAAIoG,cAAcxD,WAAW,YAAYwD,aAAatD,cAAc,KAAK,MAAM;QAC7E,MAAM,IAAIhF,kBAAkB;IAC9B;IAEA,MAAMgF,iBAAiB,MAAM5E,aAAa;QAACoB,UAAUZ,OAAO2H,WAAW;IAAA;IACvE,MAAM9F,OAAO,MAAMrD,mBAAmB;QAAC8C,QAAQmG,SAASnG,MAAM;QAAE8C;IAAc;IAC9E,IAAIvC,MAAMqC,WAAW,UAAU;QAC7B,MAAM,IAAI9E,kBAAkB;IAC9B;IAEA,MAAMrB,2BAA2B;QAACuD,QAAQmG,SAASnG,MAAM;IAAA;IAEzD,MAAM,EAAC6B,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAAoBnB,MAAM7B,OAAOuB,UAAU;IAE1F,OAAO;QAAC4B;QAAOd;QAAcR;QAAMuB;IAAS;AAC9C;AAEA,OAAO,eAAewE,eAAe5H,MAKpC;IACC,MAAM6B,OAAO,MAAMzD,aAAa;QAAC2D,IAAI/B,OAAOsB,MAAM;IAAA;IAClD,IAAI,CAACO,MAAM;QACT,MAAM,IAAIxC,kBAAkBW,OAAOsB,MAAM;IAC3C;IAEA,MAAMgE,cAAczD,KAAKuC,cAAc,KAAK;IAC5C,MAAMmB,KAAK,MAAM9F,eAAe;QAC9BmB,UAAUZ,OAAO6H,eAAe;QAChCxD,MAAMxC,KAAKuC,cAAc,IAAK,MAAMzD;IACtC;IACA,IAAI,CAAC2E,eAAe,CAACC,IAAI;QACvB,MAAM,IAAIxG;IACZ;IAEA,MAAMqF,iBAAiB,MAAM5E,aAAa;QAACoB,UAAUZ,OAAO2H,WAAW;IAAA;IACvE,MAAMG,wBAAwB9H,OAAOqC,YAAY,GAC7C,MAAMzE,6BAA6B;QAACiF,aAAatF,gBAAgByC,OAAOqC,YAAY;IAAC,KACrF8D;IACJ,MAAM4B,uBACJD,uBAAuBxG,WAAWO,KAAKE,EAAE,GAAG+F,sBAAsB/F,EAAE,GAAGoE;IAEzE,MAAM3H,mBAAmB;QAAC8C,QAAQO,KAAKE,EAAE;QAAEqC;IAAc;IACzD,MAAMrG,2BAA2B;QAACuD,QAAQO,KAAKE,EAAE;QAAEgG;IAAoB;AACzE;AAEA,OAAO,eAAeC,OAAOhI,MAA2C;IACtE,IAAI,CAACA,OAAOqC,YAAY,EAAE;IAC1B,MAAMA,eAAe,MAAMxE,uBAAuB;QAChDgF,aAAatF,gBAAgByC,OAAOqC,YAAY;IAClD;IACA,IAAI,CAACA,cAAc;IACnB,MAAMvE,qBAAqB;QAAC8E,WAAWP,aAAaO,SAAS;QAAEtB,QAAQe,aAAaf,MAAM;IAAA;AAC5F;AAMA,OAAO,eAAe2G,eAAejI,MAAwB;IAC3D,MAAM6B,OAAO,MAAMzD,aAAa;QAAC2D,IAAI/B,OAAOsB,MAAM;IAAA;IAClD,IAAI,CAACO,MAAM;QACT,MAAM,IAAIxC,kBAAkBW,OAAOsB,MAAM;IAC3C;IAEA,OAAO;QAACO;IAAI;AACd"}

package/dist/core/cimd.d.ts

@@ -0,0 +1,39 @@
+import type { ValidatedOAuthClientMetadata } from './oauth-client.js';
+export declare const OAUTH_CIMD_MAX_BODY_BYTES: number;
+export declare const OAUTH_CIMD_FETCH_TIMEOUT_MS = 5000;
+export interface CimdAddress {
+    address: string;
+    family: 4 | 6;
+}
+export interface CimdHttpResponse {
+    statusCode: number;
+    headers: Record<string, string | string[] | undefined>;
+    body: Uint8Array;
+}
+export type CimdAddressResolver = (hostname: string) => Promise<readonly CimdAddress[]>;
+export type CimdHttpRequester = (params: {
+    url: URL;
+    address: CimdAddress;
+    timeoutMs: number;
+    maxBodyBytes: number;
+    signal?: AbortSignal;
+}) => Promise<CimdHttpResponse>;
+export interface FetchedCimdMetadata {
+    metadata: ValidatedOAuthClientMetadata;
+    cacheMaxAgeSeconds: number;
+}
+/** Returns true only for a globally routable unicast address. */
+export declare function isPublicUnicastAddress(address: string, family?: 4 | 6): boolean;
+export interface FetchCimdMetadataOptions {
+    resolveAddress?: CimdAddressResolver;
+    request?: CimdHttpRequester;
+    timeoutMs?: number;
+    maxBodyBytes?: number;
+}
+/**
+ * Fetches a Client ID Metadata Document after resolving and pinning a public
+ * address. This deliberately does not share the general egress helper: CIMD
+ * has stricter public-only, no-redirect, and no-credential requirements.
+ */
+export declare function fetchClientIdMetadata(clientId: string, options?: FetchCimdMetadataOptions): Promise<FetchedCimdMetadata>;
+//# sourceMappingURL=cimd.d.ts.map

package/dist/core/cimd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../src/core/cimd.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAC,4BAA4B,EAAC,MAAM,mBAAmB,CAAC;AAOpE,eAAO,MAAM,yBAAyB,QAAa,CAAC;AACpD,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAYjD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;AACxF,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE;IACvC,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,WAAW,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAEhC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,4BAA4B,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AA6HD,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAM/E;AAoSD,MAAM,WAAW,wBAAwB;IACvC,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,mBAAmB,CAAC,CA2C9B"}