@starklabs/forge 1.3.25-cors.0 → 2.0.0

package/dist/auth/MagicLinkService.js

@@ -0,0 +1,132 @@
+import { BadRequestError, ErrorCode } from "../errors/index.js";
+import { MAGIC_LINK_MODEL } from "../data/internalModels.js";
+import { randomToken, safeEqual, sha256 } from "../security/TokenService.js";
+/**
+ * Passwordless sign-in: an e-mailed, single-use link.
+ *
+ * Design choices that matter:
+ * - Requesting a link *always* looks the same to the caller, so it cannot be used to find out which e-mails have accounts.
+ * - The link opens a front-end page, which then `POST`s the token. Mail scanners follow links with GET; if a GET could
+ *   sign someone in (or burn the token), scanners would break the feature and could even use the link.
+ * - Only a hash of the token is stored; it is 256 bits of randomness, so it cannot be guessed.
+ * - The link is bound to the browser that asked for it (cookie), so an attacker cannot mail *their own* link to a victim
+ *   and silently sign them in to the attacker's account (login CSRF).
+ * - Using it deletes it first: of two simultaneous attempts exactly one wins.
+ */
+export class MagicLinkService {
+    config;
+    data;
+    users;
+    emails;
+    provisioner;
+    linkPolicy;
+    completer;
+    logger;
+    constructor(config, data, users, emails, provisioner, linkPolicy, completer, logger) {
+        this.config = config;
+        this.data = data;
+        this.users = users;
+        this.emails = emails;
+        this.provisioner = provisioner;
+        this.linkPolicy = linkPolicy;
+        this.completer = completer;
+        this.logger = logger;
+    }
+    get settings() {
+        return this.config.auth.magicLink;
+    }
+    get links() {
+        return this.data.repository(MAGIC_LINK_MODEL);
+    }
+    /**
+     * Sends a link if the address may sign in. Never reveals whether it did: the caller should answer 200 either way,
+     * and mail-provider failures are logged, not reported (a failure only for real accounts would reveal them).
+     */
+    async request(rawEmail, options) {
+        const email = rawEmail.trim().toLowerCase();
+        const existing = await this.users().findOne({ [this.config.auth.fields.email]: email });
+        if (!existing && !this.settings.allowSignup)
+            return;
+        const now = Date.now();
+        const pending = await this.links.findOne({ email });
+        if (pending) {
+            const recent = new Date(pending.lastSentAt).getTime() + this.settings.resendCooldown.toMs() > now;
+            const alive = new Date(pending.expiresAt).getTime() > now;
+            if (recent && alive)
+                return; // the link already in the inbox keeps working; do not flood the address
+        }
+        const token = randomToken(32);
+        const record = {
+            email,
+            tokenHash: sha256(token),
+            bindingHash: this.settings.sameDevice ? sha256(options.binding) : null,
+            name: options.name?.trim() || null,
+            expiresAt: this.settings.expiresIn.fromNow(now),
+            lastSentAt: new Date(now),
+        };
+        try {
+            if (pending)
+                await this.links.updateById(pending._id, record);
+            else
+                await this.links.create(record);
+        }
+        catch (error) {
+            // Two simultaneous requests for a new address: the other one stored its link; that is enough.
+            this.logger.debug("Magic link was already created by a concurrent request.", { error: String(error) });
+            return;
+        }
+        const url = new URL(this.settings.url);
+        url.searchParams.set("token", token);
+        if (this.config.isOffline)
+            this.logger.info(`[offline] magic link for ${email}: ${url.toString()}`);
+        try {
+            await this.emails.sendTemplate({
+                to: email,
+                subject: "Your sign-in link",
+                template: "magic-link",
+                placeholders: {
+                    magicLinkUrl: url.toString(),
+                    expiryMinutes: Math.max(1, Math.round(this.settings.expiresIn.toMs() / 60_000)),
+                    userName: existing ? (existing.name ?? "there") : (options.name?.trim() || "there"),
+                    userEmail: email,
+                },
+            });
+        }
+        catch (error) {
+            this.logger.error("Could not send a magic link.", { error: error instanceof Error ? error.message : String(error) });
+        }
+    }
+    /** Redeems a link. Expired, used and unknown links are indistinguishable on purpose. */
+    async verify(token, binding, req) {
+        const record = await this.links.findOne({ tokenHash: sha256(token) }, { withSecrets: ["tokenHash", "bindingHash"] });
+        if (!record)
+            throw this.invalid();
+        if (new Date(record.expiresAt).getTime() <= Date.now()) {
+            await this.links.deleteById(record._id);
+            throw this.invalid();
+        }
+        // Wrong browser: refuse, but do not burn the link - the rightful owner can still use it.
+        if (this.settings.sameDevice) {
+            const stored = record.bindingHash;
+            if (!binding || !stored || !safeEqual(stored, sha256(binding))) {
+                throw new BadRequestError({
+                    message: "Open the link in the same browser where you asked for it, or request a new one.",
+                    code: ErrorCode.MAGIC_LINK_DEVICE_MISMATCH,
+                });
+            }
+        }
+        const email = record.email;
+        const existing = await this.users().findOne({ [this.config.auth.fields.email]: email });
+        if (existing)
+            this.linkPolicy.assertMayLink(this.settings.accountLinking, "magic links");
+        // Single use: deleting is the claim. Whoever gets the document back wins.
+        if (!(await this.links.deleteById(record._id)))
+            throw this.invalid();
+        const user = existing ?? (await this.provisioner.create({ email, name: record.name }));
+        return this.completer.complete(user, req, { created: !existing });
+    }
+    invalid() {
+        return new BadRequestError({ message: "This sign-in link is invalid or has expired.", code: ErrorCode.MAGIC_LINK_INVALID });
+    }
+}
+//# sourceMappingURL=MagicLinkService.js.map

package/dist/auth/MagicLinkService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkService.js","sourceRoot":"","sources":["../../src/auth/MagicLinkService.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAG7D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAM7E;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAER,MAAM;IACN,IAAI;IACJ,KAAK;IACL,MAAM;IACN,WAAW;IACX,UAAU;IACV,SAAS;IACT,MAAM;IARzB,YACmB,MAAmB,EACnB,IAAgB,EAChB,KAAuB,EACvB,MAAoB,EACpB,WAA4B,EAC5B,UAA6B,EAC7B,SAAyB,EACzB,MAAc;sBAPd,MAAM;oBACN,IAAI;qBACJ,KAAK;sBACL,MAAM;2BACN,WAAW;0BACX,UAAU;yBACV,SAAS;sBACT,MAAM;IACtB,CAAC;IAEJ,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAoC,CAAC;IAC/D,CAAC;IAED,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,OAAuD;QACrF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW;YAAE,OAAO;QAEpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,UAA2B,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC;YACnH,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAA0B,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC;YAC3E,IAAI,MAAM,IAAI,KAAK;gBAAE,OAAO,CAAC,wEAAwE;QACvG,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG;YACb,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;YACxB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;YACtE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI;YAClC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;YAC/C,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;SAC1B,CAAC;QACF,IAAI,CAAC;YACH,IAAI,OAAO;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;;gBACzD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8FAA8F;YAC9F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,KAAK,KAAK,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAEpG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;gBAC7B,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,mBAAmB;gBAC5B,QAAQ,EAAE,YAAY;gBACtB,YAAY,EAAE;oBACZ,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE;oBAC5B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC;oBAC/E,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,IAA2B,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC;oBAC3G,SAAS,EAAE,KAAK;iBACjB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAA2B,EAAE,GAAY;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;QACrH,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAA0B,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,yFAAyF;QACzF,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAwC,CAAC;YAC/D,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,eAAe,CAAC;oBACxB,OAAO,EAAE,iFAAiF;oBAC1F,IAAI,EAAE,SAAS,CAAC,0BAA0B;iBAC3C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAe,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,IAAI,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QAEzF,0EAA0E;QAC1E,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAErE,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAA0B,EAAE,CAAC,CAAC,CAAC;QAC7G,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAW,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,IAAI,EAAE,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC9H,CAAC;CACF"}

package/dist/auth/MfaController.d.ts

@@ -0,0 +1,25 @@
+import type { Request, Response } from "express";
+import type { RouteContext } from "../core/RouteContext.js";
+import type { Services } from "../core/Services.js";
+import type { LoginCompleter } from "./LoginCompleter.js";
+import type { MfaService } from "./MfaService.js";
+/** HTTP adapter for {@link MfaService}: status, setup, activation, the sign-in challenge, disabling, recovery codes. */
+export declare class MfaController {
+    private readonly services;
+    private readonly mfa;
+    private readonly completer;
+    constructor(services: Services, mfa: () => MfaService, completer: () => LoginCompleter);
+    private userId;
+    mfaStatus: (req: Request, res: Response, _ctx: RouteContext) => Promise<void>;
+    /** Step 1 of enrolment: returns the secret and the `otpauth://` URL to show as a QR code. */
+    mfaSetup: (req: Request, res: Response, _ctx: RouteContext) => Promise<void>;
+    /** Step 2: confirm with a code from the app. The recovery codes are returned once. */
+    mfaEnable: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    /** The second step of a sign-in: `{ mfaToken, code }` or `{ mfaToken, recoveryCode }`. */
+    mfaVerify: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    mfaDisable: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    mfaRecoveryCodes: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    /** Exactly one of `code` / `recoveryCode`. */
+    private input;
+}
+//# sourceMappingURL=MfaController.d.ts.map

package/dist/auth/MfaController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MfaController.d.ts","sourceRoot":"","sources":["../../src/auth/MfaController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAqB,MAAM,iBAAiB,CAAC;AAErE,wHAAwH;AACxH,qBAAa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAH5B,YACmB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,UAAU,EACrB,SAAS,EAAE,MAAM,cAAc,EAC9C;IAEJ,OAAO,CAAC,MAAM;IAId,SAAS,QAAe,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAEhF;IAEF,6FAA6F;IAC7F,QAAQ,QAAe,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAO/E;IAEF,sFAAsF;IACtF,SAAS,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAQ/E;IAEF,0FAA0F;IAC1F,SAAS,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAU/E;IAEF,UAAU,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAGhF;IAEF,gBAAgB,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAItF;IAEF,8CAA8C;IAC9C,OAAO,CAAC,KAAK;CAQd"}

package/dist/auth/MfaController.js

@@ -0,0 +1,67 @@
+import { ErrorCode, NotFoundError, ValidationError } from "../errors/index.js";
+/** HTTP adapter for {@link MfaService}: status, setup, activation, the sign-in challenge, disabling, recovery codes. */
+export class MfaController {
+    services;
+    mfa;
+    completer;
+    constructor(services, mfa, completer) {
+        this.services = services;
+        this.mfa = mfa;
+        this.completer = completer;
+    }
+    userId(req) {
+        return req.user._id;
+    }
+    mfaStatus = async (req, res, _ctx) => {
+        this.services.responses.success(res, { message: "Two-factor status fetched successfully.", data: await this.mfa().status(this.userId(req)) });
+    };
+    /** Step 1 of enrolment: returns the secret and the `otpauth://` URL to show as a QR code. */
+    mfaSetup = async (req, res, _ctx) => {
+        const user = await this.services.data.repository(this.services.userModel).findById(this.userId(req));
+        if (!user)
+            throw new NotFoundError({ message: "Account not found.", code: ErrorCode.USER_NOT_FOUND });
+        const account = String(user[this.services.config.auth.fields.email] ?? user._id);
+        res.setHeader("Cache-Control", "no-store");
+        this.services.responses.success(res, { message: "Scan the code with your authenticator app, then confirm it.", data: await this.mfa().beginSetup(user._id, account) });
+    };
+    /** Step 2: confirm with a code from the app. The recovery codes are returned once. */
+    mfaEnable = async (req, res, ctx) => {
+        const body = ctx.parseBody(req.body);
+        res.setHeader("Cache-Control", "no-store");
+        const recoveryCodes = await this.mfa().confirmSetup(this.userId(req), String(body.code));
+        this.services.responses.success(res, {
+            message: "Two-factor authentication is on. Store the recovery codes somewhere safe: they are shown only once.",
+            data: { enabled: true, recoveryCodes },
+        });
+    };
+    /** The second step of a sign-in: `{ mfaToken, code }` or `{ mfaToken, recoveryCode }`. */
+    mfaVerify = async (req, res, ctx) => {
+        const body = ctx.parseBody(req.body);
+        res.setHeader("Cache-Control", "no-store");
+        const userId = await this.mfa().verifyChallenge(typeof body.mfaToken === "string" ? body.mfaToken : undefined, this.input(body));
+        const user = await this.services.data.repository(this.services.userModel).findById(userId);
+        if (!user)
+            throw new NotFoundError({ message: "Account not found.", code: ErrorCode.USER_NOT_FOUND });
+        const result = await this.completer().startSession(user, req);
+        this.services.sessionResponder.sendLogin(res, result, { message: "Signed in successfully.", hiddenFields: ctx.route.config?.hiddenFields });
+    };
+    mfaDisable = async (req, res, ctx) => {
+        await this.mfa().disable(this.userId(req), this.input(ctx.parseBody(req.body)));
+        this.services.responses.success(res, { message: "Two-factor authentication is off.", data: { enabled: false } });
+    };
+    mfaRecoveryCodes = async (req, res, ctx) => {
+        res.setHeader("Cache-Control", "no-store");
+        const recoveryCodes = await this.mfa().regenerateRecoveryCodes(this.userId(req), this.input(ctx.parseBody(req.body)));
+        this.services.responses.success(res, { message: "New recovery codes created. The old ones no longer work.", data: { recoveryCodes } });
+    };
+    /** Exactly one of `code` / `recoveryCode`. */
+    input(body) {
+        const code = typeof body.code === "string" && body.code !== "" ? body.code : undefined;
+        const recoveryCode = typeof body.recoveryCode === "string" && body.recoveryCode !== "" ? body.recoveryCode : undefined;
+        if ((code === undefined) === (recoveryCode === undefined)) {
+            throw new ValidationError({ message: "Provide either 'code' or 'recoveryCode'.", code: ErrorCode.VALIDATION_FAILED });
+        }
+        return { code, recoveryCode };
+    }
+}
+//# sourceMappingURL=MfaController.js.map

package/dist/auth/MfaController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MfaController.js","sourceRoot":"","sources":["../../src/auth/MfaController.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAM/E,wHAAwH;AACxH,MAAM,OAAO,aAAa;IAEL,QAAQ;IACR,GAAG;IACH,SAAS;IAH5B,YACmB,QAAkB,EAClB,GAAqB,EACrB,SAA+B;wBAF/B,QAAQ;mBACR,GAAG;yBACH,SAAS;IACzB,CAAC;IAEI,MAAM,CAAC,GAAY;QACzB,OAAO,GAAG,CAAC,IAAK,CAAC,GAAG,CAAC;IACvB,CAAC;IAED,SAAS,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QACnF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAChJ,CAAC,CAAC;IAEF,6FAA6F;IAC7F,QAAQ,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAClF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAU,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;QAEtG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,6DAA6D,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACzK,CAAC,CAAC;IAEF,sFAAsF;IACtF,SAAS,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QAClF,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;YACnC,OAAO,EAAE,qGAAqG;YAC9G,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE;SACvC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,0FAA0F;IAC1F,SAAS,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QAClF,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjI,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;QAEtG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9I,CAAC,CAAC;IAEF,UAAU,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QACnF,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACnH,CAAC,CAAC;IAEF,gBAAgB,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QACzF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtH,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,0DAA0D,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;IACzI,CAAC,CAAC;IAEF,8CAA8C;IACtC,KAAK,CAAC,IAA6B;QACzC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACvH,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;CACF"}

package/dist/auth/MfaService.d.ts

@@ -0,0 +1,60 @@
+import type { ForgeConfig } from "../config/ForgeConfig.js";
+import type { DataSource } from "../data/Repository.js";
+import type { CryptoVault } from "../security/CryptoVault.js";
+import { type TokenService } from "../security/TokenService.js";
+/** What a user types to prove the second factor: an authenticator code, or one of their recovery codes. */
+export interface SecondFactorInput {
+    code?: string | undefined;
+    recoveryCode?: string | undefined;
+}
+export interface SetupResult {
+    /** Base32 secret for manual entry. Shown once. */
+    secret: string;
+    /** `otpauth://` URI: render it as a QR code. */
+    otpauthUrl: string;
+    issuer: string;
+}
+/**
+ * Authenticator-app (TOTP) second factor with recovery codes.
+ *
+ * - The secret is encrypted with the master key (it must be readable to check codes).
+ * - A code works once: the accepted time step is stored and only newer steps are accepted.
+ * - Wrong codes are counted per account; too many lock the second factor for a while,
+ *   which stops a distributed guess of the 6 digits that per-IP limits cannot.
+ * - Every state change is a compare-and-set on `version`, so two simultaneous requests cannot both
+ *   spend the same code.
+ */
+export declare class MfaService {
+    private readonly config;
+    private readonly data;
+    private readonly vault;
+    private readonly tokens;
+    private readonly totp;
+    constructor(config: ForgeConfig, data: DataSource, vault: CryptoVault, tokens: TokenService);
+    private get settings();
+    private get factors();
+    isEnabled(userId: string): Promise<boolean>;
+    status(userId: string): Promise<{
+        enabled: boolean;
+        recoveryCodesRemaining: number;
+    }>;
+    /** Step 1: create a pending secret. Nothing is protected until {@link confirmSetup} succeeds. */
+    beginSetup(userId: string, account: string): Promise<SetupResult>;
+    /** Step 2: the user proves their app works by entering a code. Activates the factor and returns the recovery codes (once). */
+    confirmSetup(userId: string, code: string): Promise<string[]>;
+    /** Checks the second-factor step of a sign-in and returns the user it belongs to. */
+    verifyChallenge(mfaToken: string | undefined, input: SecondFactorInput): Promise<string>;
+    /** Verifies a code or recovery code for a user whose factor is enabled. Throws on failure. */
+    verifySecondFactor(userId: string, input: SecondFactorInput): Promise<void>;
+    /** Turns the second factor off (requires a valid code or recovery code). */
+    disable(userId: string, input: SecondFactorInput): Promise<void>;
+    /** Replaces all recovery codes with a fresh set (requires a valid code or recovery code). */
+    regenerateRecoveryCodes(userId: string, input: SecondFactorInput): Promise<string[]>;
+    /** Optimistic lock: applies `changes` only if nobody changed the factor since it was read. */
+    private commit;
+    private assertNotLocked;
+    private recordFailure;
+    private invalid;
+    private newRecoveryCodes;
+}
+//# sourceMappingURL=MfaService.d.ts.map

package/dist/auth/MfaService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MfaService.d.ts","sourceRoot":"","sources":["../../src/auth/MfaService.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,0BAA0B,CAAC;AAK/E,OAAO,KAAK,EAAE,UAAU,EAAmB,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAe,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGnF,2GAA2G;AAC3G,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAQD;;;;;;;;;GASG;AACH,qBAAa,UAAU;IAInB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAE5B,YACmB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,YAAY,EAGtC;IAED,OAAO,KAAK,QAAQ,GAEnB;IAED,OAAO,KAAK,OAAO,GAElB;IAEK,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhD;IAEK,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,CAAC,CAM1F;IAED,iGAAiG;IAC3F,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAYtE;IAED,8HAA8H;IACxH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAyBlE;IAED,qFAAqF;IAC/E,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAI7F;IAED,8FAA8F;IACxF,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BhF;IAED,4EAA4E;IACtE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrE;IAED,6FAA6F;IACvF,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMzF;IAID,8FAA8F;YAChF,MAAM;IAMpB,OAAO,CAAC,eAAe;YAaT,aAAa;IAwB3B,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,gBAAgB;CAOzB"}

package/dist/auth/MfaService.js

@@ -0,0 +1,192 @@
+import { randomInt } from "node:crypto";
+import { AppError, BadRequestError, ConflictError, ErrorCode, TooManyRequestsError, UnauthorizedError, ValidationError, } from "../errors/index.js";
+import { MFA_FACTOR_MODEL } from "../data/internalModels.js";
+import { safeEqual, sha256 } from "../security/TokenService.js";
+import { Totp } from "../security/Totp.js";
+const RECOVERY_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"; // no 0/O, 1/I
+const RECOVERY_LENGTH = 12;
+/** Normalises what a person typed: case, spaces and dashes do not matter. */
+const normaliseRecovery = (value) => value.toUpperCase().replace(/[^A-Z0-9]/g, "");
+/**
+ * Authenticator-app (TOTP) second factor with recovery codes.
+ *
+ * - The secret is encrypted with the master key (it must be readable to check codes).
+ * - A code works once: the accepted time step is stored and only newer steps are accepted.
+ * - Wrong codes are counted per account; too many lock the second factor for a while,
+ *   which stops a distributed guess of the 6 digits that per-IP limits cannot.
+ * - Every state change is a compare-and-set on `version`, so two simultaneous requests cannot both
+ *   spend the same code.
+ */
+export class MfaService {
+    config;
+    data;
+    vault;
+    tokens;
+    totp;
+    constructor(config, data, vault, tokens) {
+        this.config = config;
+        this.data = data;
+        this.vault = vault;
+        this.tokens = tokens;
+        this.totp = new Totp({ window: this.settings.window });
+    }
+    get settings() {
+        return this.config.auth.mfa;
+    }
+    get factors() {
+        return this.data.repository(MFA_FACTOR_MODEL);
+    }
+    async isEnabled(userId) {
+        return Boolean((await this.factors.findOne({ owner: userId }))?.enabled);
+    }
+    async status(userId) {
+        const factor = await this.factors.findOne({ owner: userId }, { withSecrets: ["recoveryCodeHashes"] });
+        return {
+            enabled: Boolean(factor?.enabled),
+            recoveryCodesRemaining: factor?.enabled ? (factor.recoveryCodeHashes ?? []).length : 0,
+        };
+    }
+    /** Step 1: create a pending secret. Nothing is protected until {@link confirmSetup} succeeds. */
+    async beginSetup(userId, account) {
+        const existing = await this.factors.findOne({ owner: userId });
+        if (existing?.enabled) {
+            throw new ConflictError({ message: "Two-factor authentication is already enabled.", code: ErrorCode.MFA_ALREADY_ENABLED });
+        }
+        const secret = Totp.generateSecret();
+        const pendingSecret = await this.vault.seal(secret);
+        if (existing)
+            await this.factors.updateById(existing._id, { pendingSecret });
+        else
+            await this.factors.create({ owner: userId, pendingSecret });
+        return { secret, issuer: this.settings.issuer, otpauthUrl: this.totp.otpauthUrl({ secret, issuer: this.settings.issuer, account }) };
+    }
+    /** Step 2: the user proves their app works by entering a code. Activates the factor and returns the recovery codes (once). */
+    async confirmSetup(userId, code) {
+        const factor = await this.factors.findOne({ owner: userId }, { withSecrets: ["pendingSecret", "secret"] });
+        if (factor?.enabled) {
+            throw new ConflictError({ message: "Two-factor authentication is already enabled.", code: ErrorCode.MFA_ALREADY_ENABLED });
+        }
+        if (!factor?.pendingSecret) {
+            throw new BadRequestError({ message: "Start the setup first.", code: ErrorCode.MFA_SETUP_REQUIRED });
+        }
+        this.assertNotLocked(factor);
+        const step = this.totp.verify(await this.vault.unseal(factor.pendingSecret), code);
+        if (step === undefined)
+            throw await this.recordFailure(factor);
+        const { codes, hashes } = this.newRecoveryCodes();
+        const won = await this.commit(factor, {
+            enabled: true,
+            secret: factor.pendingSecret,
+            pendingSecret: null,
+            lastUsedStep: step,
+            recoveryCodeHashes: hashes,
+            failedAttempts: 0,
+            lockedUntil: null,
+        });
+        if (!won)
+            throw this.invalid();
+        return codes;
+    }
+    /** Checks the second-factor step of a sign-in and returns the user it belongs to. */
+    async verifyChallenge(mfaToken, input) {
+        const claims = this.tokens.verifyMfaChallenge(mfaToken);
+        await this.verifySecondFactor(claims.sub, input);
+        return claims.sub;
+    }
+    /** Verifies a code or recovery code for a user whose factor is enabled. Throws on failure. */
+    async verifySecondFactor(userId, input) {
+        const factor = await this.factors.findOne({ owner: userId }, { withSecrets: ["secret", "recoveryCodeHashes"] });
+        if (!factor?.enabled || !factor.secret) {
+            throw new ConflictError({ message: "Two-factor authentication is not enabled.", code: ErrorCode.MFA_NOT_ENABLED });
+        }
+        this.assertNotLocked(factor);
+        if (input.code !== undefined) {
+            const step = this.totp.verify(await this.vault.unseal(factor.secret), input.code, { afterStep: factor.lastUsedStep });
+            if (step === undefined)
+                throw await this.recordFailure(factor);
+            const won = await this.commit(factor, { lastUsedStep: step, failedAttempts: 0, lockedUntil: null });
+            if (!won)
+                throw this.invalid(); // the same code was spent by a concurrent request
+            return;
+        }
+        if (input.recoveryCode !== undefined) {
+            const wanted = sha256(normaliseRecovery(input.recoveryCode));
+            const hashes = factor.recoveryCodeHashes ?? [];
+            // Compare against every stored hash (no early exit) so timing does not reveal how close a guess was.
+            const index = hashes.reduce((found, hash, i) => (safeEqual(hash, wanted) ? i : found), -1);
+            if (index === -1)
+                throw await this.recordFailure(factor);
+            const won = await this.commit(factor, { recoveryCodeHashes: hashes.filter((_, i) => i !== index), failedAttempts: 0, lockedUntil: null });
+            if (!won)
+                throw this.invalid();
+            return;
+        }
+        throw new ValidationError({ message: "Provide either 'code' or 'recoveryCode'.", code: ErrorCode.MFA_CODE_INVALID });
+    }
+    /** Turns the second factor off (requires a valid code or recovery code). */
+    async disable(userId, input) {
+        await this.verifySecondFactor(userId, input);
+        await this.factors.deleteMany({ owner: userId });
+    }
+    /** Replaces all recovery codes with a fresh set (requires a valid code or recovery code). */
+    async regenerateRecoveryCodes(userId, input) {
+        await this.verifySecondFactor(userId, input);
+        const factor = await this.factors.findOne({ owner: userId });
+        const { codes, hashes } = this.newRecoveryCodes();
+        await this.factors.updateById(factor._id, { recoveryCodeHashes: hashes });
+        return codes;
+    }
+    // ── internals ────────────────────────────────────────────────────────────
+    /** Optimistic lock: applies `changes` only if nobody changed the factor since it was read. */
+    async commit(factor, changes) {
+        const version = factor.version ?? 0;
+        const updated = await this.factors.updateMany({ _id: factor._id, version }, { ...changes, version: version + 1 });
+        return updated === 1;
+    }
+    assertNotLocked(factor) {
+        const until = factor.lockedUntil ? new Date(factor.lockedUntil).getTime() : 0;
+        if (until > Date.now()) {
+            const seconds = Math.ceil((until - Date.now()) / 1000);
+            throw new TooManyRequestsError({
+                message: "Too many wrong codes. Try again later.",
+                code: ErrorCode.MFA_LOCKED,
+                headers: { "Retry-After": String(seconds) },
+                details: { retryAfterSeconds: seconds },
+            });
+        }
+    }
+    async recordFailure(factor) {
+        const failed = (factor.failedAttempts ?? 0) + 1;
+        const locking = failed >= this.settings.maxAttempts;
+        await this.commit(factor, {
+            failedAttempts: locking ? 0 : failed,
+            lockedUntil: locking ? this.settings.lockoutDuration.fromNow() : null,
+        });
+        if (locking) {
+            // Same status and code as every later attempt during the lock.
+            const seconds = Math.ceil(this.settings.lockoutDuration.toSeconds());
+            return new TooManyRequestsError({
+                message: "Too many wrong codes. The second factor is locked for a while.",
+                code: ErrorCode.MFA_LOCKED,
+                headers: { "Retry-After": String(seconds) },
+                details: { retryAfterSeconds: seconds },
+            });
+        }
+        return new UnauthorizedError({
+            message: "The code is incorrect.",
+            code: ErrorCode.MFA_CODE_INVALID,
+            details: { attemptsLeft: this.settings.maxAttempts - failed },
+        });
+    }
+    invalid() {
+        return new UnauthorizedError({ message: "The code is incorrect or was already used.", code: ErrorCode.MFA_CODE_INVALID });
+    }
+    newRecoveryCodes() {
+        const codes = Array.from({ length: this.settings.recoveryCodes }, () => {
+            const raw = Array.from({ length: RECOVERY_LENGTH }, () => RECOVERY_ALPHABET[randomInt(RECOVERY_ALPHABET.length)]).join("");
+            return raw.match(/.{4}/g).join("-");
+        });
+        return { codes, hashes: codes.map((c) => sha256(normaliseRecovery(c))) };
+    }
+}
+//# sourceMappingURL=MfaService.js.map

package/dist/auth/MfaService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MfaService.js","sourceRoot":"","sources":["../../src/auth/MfaService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EACL,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,eAAe,GAC9G,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAG7D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAqB,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAgB3C,MAAM,iBAAiB,GAAG,kCAAkC,CAAC,CAAC,cAAc;AAC5E,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAEnG;;;;;;;;;GASG;AACH,MAAM,OAAO,UAAU;IAIF,MAAM;IACN,IAAI;IACJ,KAAK;IACL,MAAM;IANR,IAAI,CAAO;IAE5B,YACmB,MAAmB,EACnB,IAAgB,EAChB,KAAkB,EAClB,MAAoB;sBAHpB,MAAM;oBACN,IAAI;qBACJ,KAAK;sBACL,MAAM;QAEvB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAwB,CAAC;IACnD,CAAC;IAED,IAAY,OAAO;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,OAAO,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACtG,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;YACjC,sBAAsB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,kBAA2C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SACjH,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAe;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,IAAI,QAAQ,EAAE,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAC7H,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,QAAQ;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;;YACxE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAEjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACvI,CAAC;IAED,8HAA8H;IAC9H,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,IAAY;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3G,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;YAC3B,MAAM,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,aAA4B,CAAC,EAAE,IAAI,CAAC,CAAC;QAClG,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAE/D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YACpC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,MAAM,CAAC,aAAa;YAC5B,aAAa,EAAE,IAAI;YACnB,YAAY,EAAE,IAAI;YAClB,kBAAkB,EAAE,MAAM;YAC1B,cAAc,EAAE,CAAC;YACjB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,eAAe,CAAC,QAA4B,EAAE,KAAwB;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,KAAwB;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,IAAI,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAE7B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAqB,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,YAAsB,EAAE,CAAC,CAAC;YAC/I,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACpG,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,kDAAkD;YAClF,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAI,MAAM,CAAC,kBAA2C,IAAI,EAAE,CAAC;YACzE,qGAAqG;YACrG,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3F,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,MAAM,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1I,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,IAAI,EAAE,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,KAAwB;QACpD,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,uBAAuB,CAAC,MAAc,EAAE,KAAwB;QACpE,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAClD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAE,MAAc,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4EAA4E;IAE5E,8FAA8F;IACtF,KAAK,CAAC,MAAM,CAAC,MAAW,EAAE,OAAgC;QAChE,MAAM,OAAO,GAAI,MAAM,CAAC,OAA8B,IAAI,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;QAClH,OAAO,OAAO,KAAK,CAAC,CAAC;IACvB,CAAC;IAEO,eAAe,CAAC,MAAW;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAA4B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,OAAO,EAAE,wCAAwC;gBACjD,IAAI,EAAE,SAAS,CAAC,UAAU;gBAC1B,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;gBAC3C,OAAO,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAW;QACrC,MAAM,MAAM,GAAG,CAAE,MAAM,CAAC,cAAqC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YACxB,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;YACpC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;SACtE,CAAC,CAAC;QACH,IAAI,OAAO,EAAE,CAAC;YACZ,+DAA+D;YAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC;YACrE,OAAO,IAAI,oBAAoB,CAAC;gBAC9B,OAAO,EAAE,gEAAgE;gBACzE,IAAI,EAAE,SAAS,CAAC,UAAU;gBAC1B,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;gBAC3C,OAAO,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC;YAC3B,OAAO,EAAE,wBAAwB;YACjC,IAAI,EAAE,SAAS,CAAC,gBAAgB;YAChC,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,MAAM,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,IAAI,EAAE,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5H,CAAC;IAEO,gBAAgB;QACtB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE;YACrE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3H,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;CACF"}

package/dist/auth/OtpService.d.ts

@@ -0,0 +1,43 @@
+import type { ForgeConfig } from "../config/ForgeConfig.js";
+import type { DataSource, Doc } from "../data/Repository.js";
+import type { EmailService } from "../email/EmailService.js";
+import type { Logger } from "../utils/Logger.js";
+export type OtpPurpose = "signup" | "login" | "password_reset";
+export declare const OTP_PURPOSES: readonly OtpPurpose[];
+export interface IssueInput {
+    email: string;
+    purpose: OtpPurpose;
+    /** Data to hand back after verification (e.g. the sign-up payload). */
+    payload?: Record<string, unknown> | undefined;
+    /** Name used in the greeting of the e-mail. */
+    userName?: string | undefined;
+}
+/**
+ * One-time codes for sign-up, login and password reset.
+ *
+ * Differences from 1.x: codes expire on their own (TTL index) instead of
+ * blocking the user forever, wrong guesses are counted correctly, resend is
+ * rate limited, codes are stored as keyed hashes, and password reset hands
+ * out a separate single-use token rather than a reusable "verified" flag.
+ */
+export declare class OtpService {
+    private readonly config;
+    private readonly data;
+    private readonly emails;
+    private readonly logger;
+    constructor(config: ForgeConfig, data: DataSource, emails: EmailService, logger: Logger);
+    private get repo();
+    private key;
+    issue(input: IssueInput): Promise<void>;
+    /** Re-sends a code for a request that is already pending. */
+    resend(email: string, purpose: OtpPurpose, userName?: string): Promise<void>;
+    /** Checks a code. On success a signup/login request is consumed and its payload returned. */
+    verify(email: string, purpose: OtpPurpose, code: string): Promise<{
+        record: Doc;
+        resetToken?: string;
+    }>;
+    /** Validates and burns a password-reset token. */
+    consumeResetToken(email: string, resetToken: string): Promise<void>;
+    private send;
+}
+//# sourceMappingURL=OtpService.d.ts.map

package/dist/auth/OtpService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OtpService.d.ts","sourceRoot":"","sources":["../../src/auth/OtpService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG5D,OAAO,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,gBAAgB,CAAC;AAC/D,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA0C,CAAC;AAEzF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,UAAU,CAAC;IACpB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC9C,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAQD;;;;;;;GAOG;AACH,qBAAa,UAAU;IAEnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,YACmB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EAC7B;IAEJ,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,CAAC,GAAG;IAIL,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgD5C;IAED,6DAA6D;IACvD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASjF;IAED,6FAA6F;IACvF,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CA2C5G;IAED,kDAAkD;IAC5C,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBxE;YAEa,IAAI;CAiBnB"}