@spinajs/rbac-http-user 2.0.507 → 2.0.509

package/lib/cjs/2fa/otpUrl.d.ts

@@ -0,0 +1,16 @@
+export interface IOtpUrlOptions {
+    issuer: string;
+    label: string;
+    algorithm: string;
+    digits: number;
+    period: number;
+}
+/**
+ * Turns a raw base32 TOTP secret into a full `otpauth://` url that
+ * authenticator apps ( eg. google authenticator ) understand. A value that is
+ * already an `otpauth://` url is passed through untouched, so callers can
+ * accept either form. Whitespace and case in the secret are normalized —
+ * secrets are often shared in `jbsw y3dp ...` form.
+ */
+export declare function buildOtpAuthUrl(secretOrUrl: string, options: IOtpUrlOptions): string;
+//# sourceMappingURL=otpUrl.d.ts.map

package/lib/cjs/2fa/otpUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otpUrl.d.ts","sourceRoot":"","sources":["../../../src/2fa/otpUrl.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CAqBpF"}

package/lib/cjs/2fa/otpUrl.js

@@ -0,0 +1,64 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildOtpAuthUrl = buildOtpAuthUrl;
+const OTPAuth = __importStar(require("otpauth"));
+const exceptions_1 = require("@spinajs/exceptions");
+/**
+ * Turns a raw base32 TOTP secret into a full `otpauth://` url that
+ * authenticator apps ( eg. google authenticator ) understand. A value that is
+ * already an `otpauth://` url is passed through untouched, so callers can
+ * accept either form. Whitespace and case in the secret are normalized —
+ * secrets are often shared in `jbsw y3dp ...` form.
+ */
+function buildOtpAuthUrl(secretOrUrl, options) {
+    const input = secretOrUrl.trim();
+    if (!input) {
+        throw new exceptions_1.InvalidArgument('2fa secret or otpauth url is empty');
+    }
+    if (input.toLowerCase().startsWith('otpauth://')) {
+        return input;
+    }
+    const secret = input.replace(/\s+/g, '').toUpperCase();
+    return new OTPAuth.TOTP({
+        issuer: options.issuer,
+        label: options.label,
+        algorithm: options.algorithm,
+        digits: options.digits,
+        period: options.period,
+        secret: OTPAuth.Secret.fromBase32(secret),
+    }).toString();
+}
+//# sourceMappingURL=otpUrl.js.map

package/lib/cjs/2fa/otpUrl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otpUrl.js","sourceRoot":"","sources":["../../../src/2fa/otpUrl.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,MAAY,OAAO,oCAAgB;AACnC,oDAAsD;AAUtD;;;;;;GAMG;AACH,yBAAgC,WAAmB,EAAE,OAAuB;IAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAEjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,4BAAe,CAAC,oCAAoC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEvD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;KAC1C,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChB,CAAC"}

package/lib/cjs/cli/Generate2FaQrCode.d.ts

@@ -0,0 +1,19 @@
+import { Log } from '@spinajs/log';
+import { CliCommand } from '@spinajs/cli';
+interface IGenerate2FaQrOptions {
+    label: string;
+    issuer?: string;
+    output?: string;
+}
+export declare class Generate2FaQrCode extends CliCommand {
+    protected Log: Log;
+    protected OtpConfig: {
+        issuer: string;
+        algorithm: string;
+        digits: number;
+        period: number;
+    };
+    execute(secretOrUrl: string, options: IGenerate2FaQrOptions): Promise<void>;
+}
+export {};
+//# sourceMappingURL=Generate2FaQrCode.d.ts.map

package/lib/cjs/cli/Generate2FaQrCode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Generate2FaQrCode.d.ts","sourceRoot":"","sources":["../../../src/cli/Generate2FaQrCode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAY,UAAU,EAAmB,MAAM,cAAc,CAAC;AAMrE,UAAU,qBAAqB;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAKa,iBAAkB,SAAQ,UAAU;IAE/C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9E,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBvF;CACF"}

package/lib/cjs/cli/Generate2FaQrCode.js

@@ -0,0 +1,57 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Generate2FaQrCode = void 0;
+const log_1 = require("@spinajs/log");
+const cli_1 = require("@spinajs/cli");
+const configuration_1 = require("@spinajs/configuration");
+const qrcode_1 = __importDefault(require("qrcode"));
+const otpUrl_js_1 = require("../2fa/otpUrl.js");
+let Generate2FaQrCode = class Generate2FaQrCode extends cli_1.CliCommand {
+    async execute(secretOrUrl, options) {
+        const url = (0, otpUrl_js_1.buildOtpAuthUrl)(secretOrUrl, {
+            issuer: options.issuer ?? this.OtpConfig.issuer,
+            label: options.label,
+            algorithm: this.OtpConfig.algorithm,
+            digits: this.OtpConfig.digits,
+            period: this.OtpConfig.period,
+        });
+        const qr = await qrcode_1.default.toString(url, { type: 'terminal', small: true });
+        // straight to stdout - logger prefixes would break QR module alignment
+        // and make the code unscannable
+        console.log(qr);
+        console.log(url);
+        if (options.output) {
+            await qrcode_1.default.toFile(options.output, url, { type: 'png' });
+            this.Log.success(`QR code written to ${options.output}`);
+        }
+    }
+};
+exports.Generate2FaQrCode = Generate2FaQrCode;
+__decorate([
+    (0, log_1.Logger)('rbac-http-user'),
+    __metadata("design:type", log_1.Log)
+], Generate2FaQrCode.prototype, "Log", void 0);
+__decorate([
+    (0, configuration_1.Config)('rbac.otpauth'),
+    __metadata("design:type", Object)
+], Generate2FaQrCode.prototype, "OtpConfig", void 0);
+exports.Generate2FaQrCode = Generate2FaQrCode = __decorate([
+    (0, cli_1.Command)('rbac:2fa-qr', 'Prints QR code for given 2fa TOTP secret or otpauth url ( scannable by eg. google authenticator )'),
+    (0, cli_1.Argument)('secretOrUrl', true, 'base32 TOTP secret or full otpauth:// url'),
+    (0, cli_1.Option)('-l, --label <label>', false, 'account label shown in authenticator app', 'user'),
+    (0, cli_1.Option)('-i, --issuer <issuer>', false, 'issuer shown in authenticator app, defaults to rbac.otpauth.issuer config'),
+    (0, cli_1.Option)('-o, --output <file>', false, 'also write QR code to png file')
+], Generate2FaQrCode);
+//# sourceMappingURL=Generate2FaQrCode.js.map

package/lib/cjs/cli/Generate2FaQrCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Generate2FaQrCode.js","sourceRoot":"","sources":["../../../src/cli/Generate2FaQrCode.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sCAA2C;AAC3C,sCAAqE;AACrE,0DAAgD;AAChD,oDAA4B;AAE5B,gDAAmD;AAa5C,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,gBAAU;IAOxC,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,OAA8B;QACtE,MAAM,GAAG,GAAG,IAAA,2BAAe,EAAC,WAAW,EAAE;YACvC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM;YAC/C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;YACnC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;YAC7B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;SAC9B,CAAC,CAAC;QAEH,MAAM,EAAE,GAAG,MAAM,gBAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzE,uEAAuE;QACvE,gCAAgC;QAChC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEjB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,gBAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF,CAAA;;AA1BW;IADT,IAAA,YAAM,EAAC,gBAAgB,CAAC;8BACV,SAAG;8CAAC;AAGT;IADT,IAAA,sBAAM,EAAC,cAAc,CAAC;;oDACoE;4BALhF,iBAAiB;IAL7B,IAAA,aAAO,EAAC,aAAa,EAAE,mGAAmG,CAAC;IAC3H,IAAA,cAAQ,EAAC,aAAa,EAAE,IAAI,EAAE,2CAA2C,CAAC;IAC1E,IAAA,YAAM,EAAC,qBAAqB,EAAE,KAAK,EAAE,0CAA0C,EAAE,MAAM,CAAC;IACxF,IAAA,YAAM,EAAC,uBAAuB,EAAE,KAAK,EAAE,2EAA2E,CAAC;IACnH,IAAA,YAAM,EAAC,qBAAqB,EAAE,KAAK,EAAE,gCAAgC,CAAC;GAC1D,iBAAiB,CA4B7B"}

package/lib/cjs/index.d.ts

@@ -12,7 +12,9 @@ export * from "./controllers/TwoFactorAuthUserController.js";
 export * from "./controllers/PasswordResetController.js";
 export * from "./controllers/SessionsController.js";
 export * from "./cli/EnableUser2Fa.js";
+export * from "./cli/Generate2FaQrCode.js";
 export * from "./2fa/Default2FaToken.js";
+export * from "./2fa/otpUrl.js";
 export * from './actions/2fa.js';
 export * from './services/SessionCookies.js';
 export * from './services/grants.js';

package/lib/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAIvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAEhD,cAAc,aAAa,CAAC;AAC5B,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AAEpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AAEzC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAElD,cAAc,yBAAyB,CAAC;AAIxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAEzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AAGvC,qBACa,wBAAyB,SAAQ,YAAY;IAC/C,SAAS,IAAI,IAAI,CAMvB;CACJ"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAIvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAEhD,cAAc,aAAa,CAAC;AAC5B,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AAEpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAElD,cAAc,yBAAyB,CAAC;AAIxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAEzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AAGvC,qBACa,wBAAyB,SAAQ,YAAY;IAC/C,SAAS,IAAI,IAAI,CAMvB;CACJ"}

package/lib/cjs/index.js

@@ -37,7 +37,9 @@ __exportStar(require("./controllers/TwoFactorAuthUserController.js"), exports);
 __exportStar(require("./controllers/PasswordResetController.js"), exports);
 __exportStar(require("./controllers/SessionsController.js"), exports);
 __exportStar(require("./cli/EnableUser2Fa.js"), exports);
+__exportStar(require("./cli/Generate2FaQrCode.js"), exports);
 __exportStar(require("./2fa/Default2FaToken.js"), exports);
+__exportStar(require("./2fa/otpUrl.js"), exports);
 __exportStar(require("./actions/2fa.js"), exports);
 __exportStar(require("./services/SessionCookies.js"), exports);
 __exportStar(require("./services/grants.js"), exports);

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAuD;AACvD,wCAAiD;AACjD,iEAAkE;AAElE,mEAAiD;AACjD,wEAAsD;AACtD,2EAAyD;AACzD,kEAAgD;AAEhD,8CAA4B;AAC5B,2EAAyD;AACzD,qEAAmD;AACnD,0EAAwD;AACxD,2EAAyD;AACzD,+EAA6D;AAC7D,2EAAyD;AACzD,sEAAoD;AAEpD,yDAAuC;AACvC,2DAAyC;AAEzC,mDAAiC;AAEjC,+DAA6C;AAC7C,uDAAqC;AACrC,qEAAmD;AACnD,oEAAkD;AAElD,0DAAwC;AAExC,6EAA6E;AAC7E,8DAA8D;AAC9D,6DAA2C;AAC3C,8DAA4C;AAC5C,4DAA0C;AAC1C,2DAAyC;AAEzC,gEAA8C;AAC9C,2DAAyC;AACzC,wDAAsC;AACtC,wDAAsC;AACtC,8DAA4C;AAC5C,0DAAwC;AACxC,qDAAmC;AACnC,yDAAuC;AAIhC,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,iBAAY;IAC/C,SAAS;QACZ,uBAAgB,CAAC,WAAW,GAAG;YAC3B,GAAG,uBAAgB,CAAC,WAAW;YAC/B,2CAAsB,CAAC,KAAK;YAC5B,2CAAsB,CAAC,GAAG;SAC7B,CAAA;IACL,CAAC;CACJ,CAAA;;mCARY,wBAAwB;IADpC,IAAA,eAAU,EAAC,iBAAY,CAAC;GACZ,wBAAwB,CAQpC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAuD;AACvD,wCAAiD;AACjD,iEAAkE;AAElE,mEAAiD;AACjD,wEAAsD;AACtD,2EAAyD;AACzD,kEAAgD;AAEhD,8CAA4B;AAC5B,2EAAyD;AACzD,qEAAmD;AACnD,0EAAwD;AACxD,2EAAyD;AACzD,+EAA6D;AAC7D,2EAAyD;AACzD,sEAAoD;AAEpD,yDAAuC;AACvC,6DAA2C;AAC3C,2DAAyC;AACzC,kDAAgC;AAEhC,mDAAiC;AAEjC,+DAA6C;AAC7C,uDAAqC;AACrC,qEAAmD;AACnD,oEAAkD;AAElD,0DAAwC;AAExC,6EAA6E;AAC7E,8DAA8D;AAC9D,6DAA2C;AAC3C,8DAA4C;AAC5C,4DAA0C;AAC1C,2DAAyC;AAEzC,gEAA8C;AAC9C,2DAAyC;AACzC,wDAAsC;AACtC,wDAAsC;AACtC,8DAA4C;AAC5C,0DAAwC;AACxC,qDAAmC;AACnC,yDAAuC;AAIhC,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,iBAAY;IAC/C,SAAS;QACZ,uBAAgB,CAAC,WAAW,GAAG;YAC3B,GAAG,uBAAgB,CAAC,WAAW;YAC/B,2CAAsB,CAAC,KAAK;YAC5B,2CAAsB,CAAC,GAAG;SAC7B,CAAA;IACL,CAAC;CACJ,CAAA;;mCARY,wBAAwB;IADpC,IAAA,eAAU,EAAC,iBAAY,CAAC;GACZ,wBAAwB,CAQpC"}

package/lib/mjs/2fa/otpUrl.d.ts

@@ -0,0 +1,16 @@
+export interface IOtpUrlOptions {
+    issuer: string;
+    label: string;
+    algorithm: string;
+    digits: number;
+    period: number;
+}
+/**
+ * Turns a raw base32 TOTP secret into a full `otpauth://` url that
+ * authenticator apps ( eg. google authenticator ) understand. A value that is
+ * already an `otpauth://` url is passed through untouched, so callers can
+ * accept either form. Whitespace and case in the secret are normalized —
+ * secrets are often shared in `jbsw y3dp ...` form.
+ */
+export declare function buildOtpAuthUrl(secretOrUrl: string, options: IOtpUrlOptions): string;
+//# sourceMappingURL=otpUrl.d.ts.map

package/lib/mjs/2fa/otpUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otpUrl.d.ts","sourceRoot":"","sources":["../../../src/2fa/otpUrl.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CAqBpF"}

package/lib/mjs/2fa/otpUrl.js

@@ -0,0 +1,28 @@
+import * as OTPAuth from 'otpauth';
+import { InvalidArgument } from '@spinajs/exceptions';
+/**
+ * Turns a raw base32 TOTP secret into a full `otpauth://` url that
+ * authenticator apps ( eg. google authenticator ) understand. A value that is
+ * already an `otpauth://` url is passed through untouched, so callers can
+ * accept either form. Whitespace and case in the secret are normalized —
+ * secrets are often shared in `jbsw y3dp ...` form.
+ */
+export function buildOtpAuthUrl(secretOrUrl, options) {
+    const input = secretOrUrl.trim();
+    if (!input) {
+        throw new InvalidArgument('2fa secret or otpauth url is empty');
+    }
+    if (input.toLowerCase().startsWith('otpauth://')) {
+        return input;
+    }
+    const secret = input.replace(/\s+/g, '').toUpperCase();
+    return new OTPAuth.TOTP({
+        issuer: options.issuer,
+        label: options.label,
+        algorithm: options.algorithm,
+        digits: options.digits,
+        period: options.period,
+        secret: OTPAuth.Secret.fromBase32(secret),
+    }).toString();
+}
+//# sourceMappingURL=otpUrl.js.map

package/lib/mjs/2fa/otpUrl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otpUrl.js","sourceRoot":"","sources":["../../../src/2fa/otpUrl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAUtD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,OAAuB;IAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAEjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEvD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;KAC1C,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChB,CAAC"}

package/lib/mjs/cli/Generate2FaQrCode.d.ts

@@ -0,0 +1,19 @@
+import { Log } from '@spinajs/log';
+import { CliCommand } from '@spinajs/cli';
+interface IGenerate2FaQrOptions {
+    label: string;
+    issuer?: string;
+    output?: string;
+}
+export declare class Generate2FaQrCode extends CliCommand {
+    protected Log: Log;
+    protected OtpConfig: {
+        issuer: string;
+        algorithm: string;
+        digits: number;
+        period: number;
+    };
+    execute(secretOrUrl: string, options: IGenerate2FaQrOptions): Promise<void>;
+}
+export {};
+//# sourceMappingURL=Generate2FaQrCode.d.ts.map

package/lib/mjs/cli/Generate2FaQrCode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Generate2FaQrCode.d.ts","sourceRoot":"","sources":["../../../src/cli/Generate2FaQrCode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAY,UAAU,EAAmB,MAAM,cAAc,CAAC;AAMrE,UAAU,qBAAqB;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAKa,iBAAkB,SAAQ,UAAU;IAE/C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9E,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBvF;CACF"}

package/lib/mjs/cli/Generate2FaQrCode.js

@@ -0,0 +1,51 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Log, Logger } from '@spinajs/log';
+import { Argument, CliCommand, Command, Option } from '@spinajs/cli';
+import { Config } from '@spinajs/configuration';
+import QRCode from 'qrcode';
+import { buildOtpAuthUrl } from '../2fa/otpUrl.js';
+let Generate2FaQrCode = class Generate2FaQrCode extends CliCommand {
+    async execute(secretOrUrl, options) {
+        const url = buildOtpAuthUrl(secretOrUrl, {
+            issuer: options.issuer ?? this.OtpConfig.issuer,
+            label: options.label,
+            algorithm: this.OtpConfig.algorithm,
+            digits: this.OtpConfig.digits,
+            period: this.OtpConfig.period,
+        });
+        const qr = await QRCode.toString(url, { type: 'terminal', small: true });
+        // straight to stdout - logger prefixes would break QR module alignment
+        // and make the code unscannable
+        console.log(qr);
+        console.log(url);
+        if (options.output) {
+            await QRCode.toFile(options.output, url, { type: 'png' });
+            this.Log.success(`QR code written to ${options.output}`);
+        }
+    }
+};
+__decorate([
+    Logger('rbac-http-user'),
+    __metadata("design:type", Log)
+], Generate2FaQrCode.prototype, "Log", void 0);
+__decorate([
+    Config('rbac.otpauth'),
+    __metadata("design:type", Object)
+], Generate2FaQrCode.prototype, "OtpConfig", void 0);
+Generate2FaQrCode = __decorate([
+    Command('rbac:2fa-qr', 'Prints QR code for given 2fa TOTP secret or otpauth url ( scannable by eg. google authenticator )'),
+    Argument('secretOrUrl', true, 'base32 TOTP secret or full otpauth:// url'),
+    Option('-l, --label <label>', false, 'account label shown in authenticator app', 'user'),
+    Option('-i, --issuer <issuer>', false, 'issuer shown in authenticator app, defaults to rbac.otpauth.issuer config'),
+    Option('-o, --output <file>', false, 'also write QR code to png file')
+], Generate2FaQrCode);
+export { Generate2FaQrCode };
+//# sourceMappingURL=Generate2FaQrCode.js.map

package/lib/mjs/cli/Generate2FaQrCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Generate2FaQrCode.js","sourceRoot":"","sources":["../../../src/cli/Generate2FaQrCode.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAa5C,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,UAAU;IAOxC,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,OAA8B;QACtE,MAAM,GAAG,GAAG,eAAe,CAAC,WAAW,EAAE;YACvC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM;YAC/C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;YACnC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;YAC7B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;SAC9B,CAAC,CAAC;QAEH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzE,uEAAuE;QACvE,gCAAgC;QAChC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEjB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF,CAAA;AA1BW;IADT,MAAM,CAAC,gBAAgB,CAAC;8BACV,GAAG;8CAAC;AAGT;IADT,MAAM,CAAC,cAAc,CAAC;;oDACoE;AALhF,iBAAiB;IAL7B,OAAO,CAAC,aAAa,EAAE,mGAAmG,CAAC;IAC3H,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,2CAA2C,CAAC;IAC1E,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,0CAA0C,EAAE,MAAM,CAAC;IACxF,MAAM,CAAC,uBAAuB,EAAE,KAAK,EAAE,2EAA2E,CAAC;IACnH,MAAM,CAAC,qBAAqB,EAAE,KAAK,EAAE,gCAAgC,CAAC;GAC1D,iBAAiB,CA4B7B"}

package/lib/mjs/index.d.ts

@@ -12,7 +12,9 @@ export * from "./controllers/TwoFactorAuthUserController.js";
 export * from "./controllers/PasswordResetController.js";
 export * from "./controllers/SessionsController.js";
 export * from "./cli/EnableUser2Fa.js";
+export * from "./cli/Generate2FaQrCode.js";
 export * from "./2fa/Default2FaToken.js";
+export * from "./2fa/otpUrl.js";
 export * from './actions/2fa.js';
 export * from './services/SessionCookies.js';
 export * from './services/grants.js';

package/lib/mjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAIvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAEhD,cAAc,aAAa,CAAC;AAC5B,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AAEpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AAEzC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAElD,cAAc,yBAAyB,CAAC;AAIxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAEzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AAGvC,qBACa,wBAAyB,SAAQ,YAAY;IAC/C,SAAS,IAAI,IAAI,CAMvB;CACJ"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAIvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAEhD,cAAc,aAAa,CAAC;AAC5B,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AAEpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAElD,cAAc,yBAAyB,CAAC;AAIxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAEzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AAGvC,qBACa,wBAAyB,SAAQ,YAAY;IAC/C,SAAS,IAAI,IAAI,CAMvB;CACJ"}

package/lib/mjs/index.js

@@ -20,7 +20,9 @@ export * from "./controllers/TwoFactorAuthUserController.js";
 export * from "./controllers/PasswordResetController.js";
 export * from "./controllers/SessionsController.js";
 export * from "./cli/EnableUser2Fa.js";
+export * from "./cli/Generate2FaQrCode.js";
 export * from "./2fa/Default2FaToken.js";
+export * from "./2fa/otpUrl.js";
 export * from './actions/2fa.js';
 export * from './services/SessionCookies.js';
 export * from './services/grants.js';

package/lib/mjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAEhD,cAAc,aAAa,CAAC;AAC5B,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AAEpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AAEzC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAElD,cAAc,yBAAyB,CAAC;AAExC,6EAA6E;AAC7E,8DAA8D;AAC9D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAEzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AAIhC,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,YAAY;IAC/C,SAAS;QACZ,gBAAgB,CAAC,WAAW,GAAG;YAC3B,GAAG,gBAAgB,CAAC,WAAW;YAC/B,sBAAsB,CAAC,KAAK;YAC5B,sBAAsB,CAAC,GAAG;SAC7B,CAAA;IACL,CAAC;CACJ,CAAA;AARY,wBAAwB;IADpC,UAAU,CAAC,YAAY,CAAC;GACZ,wBAAwB,CAQpC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,cAAc,kCAAkC,CAAC;AACjD,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,iCAAiC,CAAC;AAEhD,cAAc,aAAa,CAAC;AAC5B,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AAEpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,kBAAkB,CAAC;AAEjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAElD,cAAc,yBAAyB,CAAC;AAExC,6EAA6E;AAC7E,8DAA8D;AAC9D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AAEzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AAIhC,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,YAAY;IAC/C,SAAS;QACZ,gBAAgB,CAAC,WAAW,GAAG;YAC3B,GAAG,gBAAgB,CAAC,WAAW;YAC/B,sBAAsB,CAAC,KAAK;YAC5B,sBAAsB,CAAC,GAAG;SAC7B,CAAA;IACL,CAAC;CACJ,CAAA;AARY,wBAAwB;IADpC,UAAU,CAAC,YAAY,CAAC;GACZ,wBAAwB,CAQpC"}