@synoikia/core 0.1.0

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE7D;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AACtC,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,0FAA0F;AAC1F,MAAM,OAAO,UAAW,SAAQ,YAAY;IAI/B;IAHX,YACE,IAAY,EACZ,OAAe,EACN,aAAwB,GAAG;QAEpC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAFjB,eAAU,GAAV,UAAU,CAAiB;IAGtC,CAAC;CACF;AAED,2GAA2G;AAC3G,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChG,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3G,OAAO,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACjH,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,0BAA0B,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACzG,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,SAAiB;IAChE,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAY1E,MAAM,OAAO,YAAY;IAEJ;IACA;IAFnB,YACmB,EAAM,EACN,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QADlC,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,gBAAgB;IAEhB,QAAQ,CAAC,GAAY,EAAE,GAAoB,EAAE,QAA6B,EAAE;QAC1E,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO;YAChB,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvG,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,iCAAiC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,gEAAgE,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,0BAA0B,KAAK,MAAM,CAAC;QACtE,MAAM,QAAQ,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,GAAG,GAAG;YACV,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;YAC5D,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB;YACpD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa;YACtC,aAAa,EAAE,GAAG;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC1C,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,yBAAyB;gBACnC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC3C,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE;aAC1E,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAC/D,WAAW,EAAE,GAAG,CAAC,IAAI;YACrB,aAAa,EAAE,GAAG,CAAC,YAAY;YAC/B,0BAA0B,EAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B;YACjE,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;SACzB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACjG,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;aACpC,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,YAAY,CAAC,EAAU,EAAE,QAA6B,EAAE;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACrF,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrF,MAAM,QAAQ,GAAG,EAAE;iBAChB,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;iBAC9B,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;iBACnC,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpB,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpB,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC9F,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrG,CAAC;YACD,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,sBAAsB;gBAChC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;aACnD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iGAAiG;IACjG,kBAAkB,CAAC,QAA4B,EAAE,YAAgC;QAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBAC5E,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,uBAAuB;IAEvB,UAAU;QACR,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACjE,IAAI,CAAC,WAAW,CAAC;aACjB,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;aAClE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAClD,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;aACnC,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACjC,GAAG,KAAK;YACR,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;YACvE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;SAC/C,CAAC,CAAC,CAAC;IACR,CAAC;IAED,WAAW,CAAC,EAAU,EAAE,QAA6B,EAAE;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;YAC3G,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;YAC1E,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACxF,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,qBAAqB;gBAC/B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;aACxB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,MAAc,EAAE,MAA4C,EAAE,QAA6B,EAAE;QAC5G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YAChC,MAAM,IAAI,GAAG,EAAE;iBACZ,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;iBAC9B,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;iBACzE,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,CAAC;YAC3B,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC1F,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC/F,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,sBAAsB;gBAChC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC3C,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aAChD,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4GAA4G;IAC5G,SAAS,CAAC,KAUT;QACC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;iBACnB,MAAM,CAAC;gBACN,EAAE,EAAE,OAAO;gBACX,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;gBACzB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;iBAClB,MAAM,CAAC;gBACN,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;gBACtB,OAAO;gBACP,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC;aACjD,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,uBAAuB;gBACjC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE;oBACN,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;oBAC/B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;oBACvB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CACjB,EAAmD,EACnD,OAAe,EACf,SAAmB,EACnB,QAAgB,EAChB,GAA4C;QAE5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,aAAa,GAAG,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,GAAG,cAAc,GAAG,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;QACtD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;aACnB,MAAM,CAAC;YACN;gBACE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;gBACzB,OAAO;gBACP,IAAI,EAAE,QAAQ;gBACd,QAAQ;gBACR,SAAS;gBACT,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC;aACxC;YACD;gBACE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;gBAC1B,OAAO;gBACP,IAAI,EAAE,SAAS;gBACf,QAAQ;gBACR,SAAS;gBACT,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC;aACzC;SACF,CAAC;aACD,GAAG,EAAE,CAAC;QACT,OAAO;YACL,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;YAC3C,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE,KAAK;SACb,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,EAAmD,EAAE,QAAgB;QACxF,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;aAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;aAC7E,GAAG,EAAE,CAAC;IACX,CAAC;IAED,wGAAwG;IACxG,YAAY,CAAC,KAOZ;QACC,+FAA+F;QAC/F,+FAA+F;QAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAA0B,EAAE;YACjE,MAAM,GAAG,GAAG,EAAE;iBACX,MAAM,EAAE;iBACR,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;iBAClD,GAAG,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAChG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE;gBACtD,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;YACvE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACrG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBAChG,UAAU,CAAC,EAAE,EAAE;oBACb,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,qBAAqB;oBAC/B,SAAS,EAAE,QAAQ;oBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;iBAC5C,CAAC,CAAC;gBACH,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,iCAAiC,CAAC,CAAC;YAC5E,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,SAAS;gBACpE,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;YACvE,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBAAE,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;YACjH,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC;gBACxD,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YACjG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACpD,OAAO,IAAI,UAAU,CAAC,gBAAgB,EAAE,oCAAoC,CAAC,CAAC;YAChF,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,YAAY,UAAU;YAAE,MAAM,OAAO,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mGAAmG;IACnG,OAAO,CAAC,KAKP;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAA0B,EAAE;YACjE,MAAM,GAAG,GAAG,EAAE;iBACX,MAAM,EAAE;iBACR,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;iBAClG,GAAG,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAChG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE;gBACtD,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC1G,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ;gBAAE,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,oCAAoC,CAAC,CAAC;YAC3G,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClB,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACpC,UAAU,CAAC,EAAE,EAAE;oBACb,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,qBAAqB;oBAC/B,SAAS,EAAE,QAAQ;oBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;iBACpE,CAAC,CAAC;gBACH,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;gBACpE,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;YAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YACjG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACtD,OAAO,IAAI,UAAU,CAAC,gBAAgB,EAAE,oCAAoC,CAAC,CAAC;YAChF,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC5G,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,YAAY,UAAU;YAAE,MAAM,OAAO,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8FAA8F;IAC9F,WAAW,CAAC,KAAa,EAAE,MAAiB;QAC1C,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,MAAM,GAAG,GAAG,EAAE;iBACX,MAAM,EAAE;iBACR,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;iBAC/C,GAAG,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAChG,IAAI,CAAC,GAAG,IAAI,KAAK,EAAE,QAAQ,KAAK,MAAM,CAAC,EAAE;gBAAE,OAAO;YAClD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;gBAAE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;;gBAC3D,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACnH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,KAAa,EAAE,UAAkB;QAC5C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE;aAClB,MAAM,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACrF,IAAI,CAAC,WAAW,CAAC;aACjB,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;aAC/D,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;aAClE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAClD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;aACpF,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAChD,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrF,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QACzG,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;YACxC,MAAM;YACN,IAAI;YACJ,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,cAAc,CAAC,UAAkB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;gBACzF,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC;oBAAE,SAAS;gBACnD,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,UAAU,CAAC;oBAAE,SAAS;gBAC5D,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACrF,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC5F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,SAAyC;QAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;YAChG,kGAAkG;YAClG,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1F,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC5F,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,YAAY;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE;aACd,MAAM,CAAC,UAAU,CAAC;aAClB,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;aACvE,GAAG,EAAE,CAAC,OAAO,CAAC;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE;aACd,MAAM,CAAC,WAAW,CAAC;aACnB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;aACzE,GAAG,EAAE,CAAC,OAAO,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAa,EAAE,OAAoB;IACpE,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9G,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/auth/oidc.d.ts

@@ -0,0 +1,110 @@
+import { z } from 'zod';
+import type { SecretBox } from '../crypto/index.js';
+import type { Db } from '../db/index.js';
+import { ServiceError } from '../errors.js';
+import type { UserRow, UserService } from './users.js';
+/**
+ * Optional OIDC sign-in (design §6.1): authorization code + PKCE, `state` and `nonce`. An identity
+ * must pass the allow policy, and must be linked to a local user unless auto-provisioning is on.
+ * Used by both the admin login and the MCP-port login pages (OAuth consent, approval links).
+ */
+export declare const AllowPolicySchema: z.ZodPrefault<z.ZodObject<{
+    emails: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    subjects: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    group: z.ZodDefault<z.ZodString>;
+    groupsClaim: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>>;
+export declare const OidcSettingsSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    issuer: z.ZodURL;
+    clientId: z.ZodString;
+    scopes: z.ZodDefault<z.ZodString>;
+    label: z.ZodDefault<z.ZodString>;
+    allowPolicy: z.ZodPrefault<z.ZodObject<{
+        emails: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        subjects: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        group: z.ZodDefault<z.ZodString>;
+        groupsClaim: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
+    autoProvision: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type OidcSettings = z.infer<typeof OidcSettingsSchema>;
+export type OidcPurpose = 'admin_login' | 'admin_link' | 'mcp_login';
+export interface OidcState extends Record<string, unknown> {
+    purpose: OidcPurpose;
+    verifier: string;
+    state: string;
+    nonce: string;
+    redirectUri: string;
+    returnTo?: string;
+    userId?: string;
+}
+export interface OidcIdentity {
+    issuer: string;
+    subject: string;
+    email?: string;
+    username?: string;
+    groups: string[];
+}
+export declare class OidcError extends ServiceError {
+    constructor(code: string, message: string);
+}
+export declare class OidcService {
+    private readonly db;
+    private readonly box;
+    private readonly stateKey;
+    /** Allow http:// issuers (tests, lab IdPs on a trusted LAN). */
+    private readonly allowInsecure;
+    private cached?;
+    constructor(db: Db, box: SecretBox, stateKey: Buffer, 
+    /** Allow http:// issuers (tests, lab IdPs on a trusted LAN). */
+    allowInsecure?: boolean);
+    private row;
+    getSettings(): (OidcSettings & {
+        clientSecretSet: boolean;
+    }) | null;
+    isEnabled(): boolean;
+    /** `clientSecret`: string replaces, `null` clears, omitted keeps (write-only, never returned). */
+    updateSettings(patch: Partial<OidcSettings> & {
+        clientSecret?: string | null;
+    }, actor?: {
+        userId?: string;
+    }): ({
+        enabled: boolean;
+        issuer: string;
+        clientId: string;
+        scopes: string;
+        label: string;
+        allowPolicy: {
+            emails: string[];
+            subjects: string[];
+            group: string;
+            groupsClaim: string;
+        };
+        autoProvision: boolean;
+    } & {
+        clientSecretSet: boolean;
+    }) | null;
+    private configuration;
+    /** Returns the IdP URL to redirect to and a signed state token to keep in a short-lived cookie. */
+    begin(input: {
+        purpose: OidcPurpose;
+        redirectUri: string;
+        returnTo?: string;
+        userId?: string;
+    }): Promise<{
+        url: string;
+        stateToken: string;
+    }>;
+    /** Validates the callback (state, PKCE, nonce, ID token) and returns the identity plus the flow state. */
+    complete(callbackUrl: URL, stateToken: string | undefined): Promise<{
+        identity: OidcIdentity;
+        state: OidcState;
+    }>;
+    isAllowed(identity: OidcIdentity): boolean;
+    /**
+     * Finds the local user for a sign-in: the linked user, or (auto-provision only) a new user.
+     * Returns null when the identity is not allowed or not linked.
+     */
+    resolveUser(users: UserService, identity: OidcIdentity): Promise<UserRow | null>;
+}

package/dist/auth/oidc.js

@@ -0,0 +1,221 @@
+import * as oidc from 'openid-client';
+import { eq } from 'drizzle-orm';
+import { z } from 'zod';
+import { writeAudit } from '../audit.js';
+import { aad } from '../crypto/index.js';
+import { oidcConfig } from '../db/schema.js';
+import { ServiceError, ValidationError } from '../errors.js';
+import { signPayload, verifyPayload } from './tokens.js';
+/**
+ * Optional OIDC sign-in (design §6.1): authorization code + PKCE, `state` and `nonce`. An identity
+ * must pass the allow policy, and must be linked to a local user unless auto-provisioning is on.
+ * Used by both the admin login and the MCP-port login pages (OAuth consent, approval links).
+ */
+export const AllowPolicySchema = z
+    .object({
+    emails: z.array(z.string().email()).default([]),
+    subjects: z.array(z.string().min(1)).default([]),
+    /** Required value in the groups claim (`groupsClaim`, default `groups`). */
+    group: z.string().default(''),
+    groupsClaim: z.string().default('groups'),
+})
+    .prefault({});
+export const OidcSettingsSchema = z.object({
+    enabled: z.boolean().default(false),
+    issuer: z.url(),
+    clientId: z.string().min(1),
+    scopes: z.string().default('openid email profile'),
+    label: z.string().default('SSO'),
+    allowPolicy: AllowPolicySchema,
+    autoProvision: z.boolean().default(false),
+});
+const STATE_TTL_MS = 10 * 60_000;
+const policyIsEmpty = (p) => !p.emails.length && !p.subjects.length && !p.group;
+export class OidcError extends ServiceError {
+    constructor(code, message) {
+        super(400, code, message);
+    }
+}
+export class OidcService {
+    db;
+    box;
+    stateKey;
+    allowInsecure;
+    cached;
+    constructor(db, box, stateKey, 
+    /** Allow http:// issuers (tests, lab IdPs on a trusted LAN). */
+    allowInsecure = false) {
+        this.db = db;
+        this.box = box;
+        this.stateKey = stateKey;
+        this.allowInsecure = allowInsecure;
+    }
+    row() {
+        return this.db.select().from(oidcConfig).where(eq(oidcConfig.id, 1)).get();
+    }
+    getSettings() {
+        const row = this.row();
+        if (!row)
+            return null;
+        return {
+            ...OidcSettingsSchema.parse({
+                enabled: row.enabled,
+                issuer: row.issuer,
+                clientId: row.clientId,
+                scopes: row.scopes,
+                allowPolicy: row.allowPolicy ?? {},
+                autoProvision: row.autoProvision,
+                label: row.allowPolicy?.label ?? 'SSO',
+            }),
+            clientSecretSet: !!row.clientSecretEnc,
+        };
+    }
+    isEnabled() {
+        return this.getSettings()?.enabled === true;
+    }
+    /** `clientSecret`: string replaces, `null` clears, omitted keeps (write-only, never returned). */
+    updateSettings(patch, actor = {}) {
+        const current = this.getSettings();
+        const parsed = OidcSettingsSchema.safeParse({ ...current, ...patch });
+        if (!parsed.success) {
+            throw new ValidationError('invalid_oidc', 'Invalid OIDC settings', parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`));
+        }
+        const s = parsed.data;
+        if (s.autoProvision && policyIsEmpty(s.allowPolicy)) {
+            throw new ValidationError('policy_required', 'Auto-provisioning needs an allow policy (emails, subjects or a group)');
+        }
+        let clientSecretEnc = this.row()?.clientSecretEnc ?? null;
+        if (patch.clientSecret === null)
+            clientSecretEnc = null;
+        else if (patch.clientSecret)
+            clientSecretEnc = this.box.encrypt(patch.clientSecret, aad('oidc_config', 'client_secret_enc', '1'));
+        const values = {
+            id: 1,
+            issuer: s.issuer,
+            clientId: s.clientId,
+            clientSecretEnc,
+            scopes: s.scopes,
+            allowPolicy: { ...s.allowPolicy, label: s.label },
+            autoProvision: s.autoProvision,
+            enabled: s.enabled,
+        };
+        this.db.transaction((tx) => {
+            tx.insert(oidcConfig).values(values).onConflictDoUpdate({ target: oidcConfig.id, set: values }).run();
+            writeAudit(tx, {
+                kind: 'config',
+                decision: 'oidc_settings_updated',
+                actorKind: 'user',
+                actorId: actor.userId,
+                detail: { ...s, clientSecretChanged: patch.clientSecret !== undefined },
+            });
+        });
+        this.cached = undefined;
+        return this.getSettings();
+    }
+    async configuration() {
+        const row = this.row();
+        if (!row?.enabled)
+            throw new OidcError('oidc_disabled', 'OIDC sign-in is not enabled');
+        const secret = row.clientSecretEnc
+            ? this.box.decrypt(row.clientSecretEnc, aad('oidc_config', 'client_secret_enc', '1')).toString('utf8')
+            : undefined;
+        const key = `${row.issuer}|${row.clientId}|${secret ?? ''}`;
+        if (this.cached?.key === key)
+            return this.cached.config;
+        const config = await oidc.discovery(new URL(row.issuer), row.clientId, secret, secret ? oidc.ClientSecretPost(secret) : oidc.None(), this.allowInsecure ? { execute: [oidc.allowInsecureRequests] } : undefined);
+        this.cached = { key, config };
+        return config;
+    }
+    /** Returns the IdP URL to redirect to and a signed state token to keep in a short-lived cookie. */
+    async begin(input) {
+        const config = await this.configuration();
+        const settings = this.getSettings();
+        const verifier = oidc.randomPKCECodeVerifier();
+        const state = {
+            purpose: input.purpose,
+            verifier,
+            state: oidc.randomState(),
+            nonce: oidc.randomNonce(),
+            redirectUri: input.redirectUri,
+            returnTo: input.returnTo,
+            userId: input.userId,
+        };
+        const url = oidc.buildAuthorizationUrl(config, {
+            redirect_uri: input.redirectUri,
+            scope: settings.scopes,
+            code_challenge: await oidc.calculatePKCECodeChallenge(verifier),
+            code_challenge_method: 'S256',
+            state: state.state,
+            nonce: state.nonce,
+        });
+        return { url: url.toString(), stateToken: signPayload(this.stateKey, state, STATE_TTL_MS) };
+    }
+    /** Validates the callback (state, PKCE, nonce, ID token) and returns the identity plus the flow state. */
+    async complete(callbackUrl, stateToken) {
+        const state = verifyPayload(this.stateKey, stateToken);
+        if (!state)
+            throw new OidcError('oidc_state', 'Sign-in session expired or invalid; try again');
+        const config = await this.configuration();
+        let claims;
+        try {
+            const tokens = await oidc.authorizationCodeGrant(config, callbackUrl, {
+                pkceCodeVerifier: state.verifier,
+                expectedState: state.state,
+                expectedNonce: state.nonce,
+                idTokenExpected: true,
+            });
+            claims = tokens.claims();
+        }
+        catch (err) {
+            throw new OidcError('oidc_failed', `Sign-in failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (!claims)
+            throw new OidcError('oidc_failed', 'The identity provider returned no ID token');
+        const settings = this.getSettings();
+        const rawGroups = claims[settings.allowPolicy.groupsClaim];
+        const identity = {
+            issuer: claims.iss,
+            subject: claims.sub,
+            // Only an email the IdP vouches for counts: many IdPs omit the claim or let users set any address.
+            email: typeof claims.email === 'string' && claims.email_verified === true ? claims.email : undefined,
+            username: typeof claims.preferred_username === 'string' ? claims.preferred_username : undefined,
+            groups: Array.isArray(rawGroups) ? rawGroups.map(String) : [],
+        };
+        return { identity, state };
+    }
+    isAllowed(identity) {
+        const policy = this.getSettings()?.allowPolicy;
+        if (!policy || policyIsEmpty(policy))
+            return true; // linking alone decides
+        if (policy.subjects.includes(identity.subject))
+            return true;
+        if (identity.email && policy.emails.map((e) => e.toLowerCase()).includes(identity.email.toLowerCase()))
+            return true;
+        if (policy.group && identity.groups.includes(policy.group))
+            return true;
+        return false;
+    }
+    /**
+     * Finds the local user for a sign-in: the linked user, or (auto-provision only) a new user.
+     * Returns null when the identity is not allowed or not linked.
+     */
+    async resolveUser(users, identity) {
+        if (!this.isAllowed(identity))
+            return null;
+        const linked = users.byOidc(identity.issuer, identity.subject);
+        if (linked)
+            return linked.disabled ? null : linked;
+        const settings = this.getSettings();
+        if (!settings?.autoProvision || policyIsEmpty(settings.allowPolicy))
+            return null;
+        const base = (identity.username ?? identity.email?.split('@')[0] ?? 'user').replace(/[^a-zA-Z0-9._@-]/g, '').slice(0, 48) ||
+            'user';
+        let username = base.length >= 2 ? base : `${base}-sso`;
+        for (let i = 2; users.byUsername(username); i++)
+            username = `${base}-${i}`;
+        const created = await users.create({ username });
+        users.linkOidc(created.id, identity.issuer, identity.subject);
+        return users.get(created.id);
+    }
+}
+//# sourceMappingURL=oidc.js.map

package/dist/auth/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/auth/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGzD;;;;GAIG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4EAA4E;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC1C,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,WAAW,EAAE,iBAAiB;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1C,CAAC,CAAC;AAuBH,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AACjC,MAAM,aAAa,GAAG,CAAC,CAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAE7G,MAAM,OAAO,SAAU,SAAQ,YAAY;IACzC,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAIH;IACA;IACA;IAEA;IAPX,MAAM,CAA+C;IAE7D,YACmB,EAAM,EACN,GAAc,EACd,QAAgB;IACjC,gEAAgE;IAC/C,gBAAgB,KAAK;QAJrB,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAAW;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEI,GAAG;QACT,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,CAAC;IAED,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,GAAG,kBAAkB,CAAC,KAAK,CAAC;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;gBAClC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,KAAK,EAAG,GAAG,CAAC,WAAyC,EAAE,KAAK,IAAI,KAAK;aACtE,CAAC;YACF,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,CAAC;IAED,kGAAkG;IAClG,cAAc,CAAC,KAA+D,EAAE,QAA6B,EAAE;QAC7G,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,eAAe,IAAI,IAAI,CAAC;QAC1D,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI;YAAE,eAAe,GAAG,IAAI,CAAC;aACnD,IAAI,KAAK,CAAC,YAAY;YACzB,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,eAAe;YACf,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;YACjD,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACtG,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,uBAAuB;gBACjC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;aACxE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe;YAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtG,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EACnB,GAAG,CAAC,QAAQ,EACZ,MAAM,EACN,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EACpD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,KAAK,CAAC,KAAwF;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAc;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ;YACR,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;YAC7C,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,cAAc,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC;YAC/D,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;IAC9F,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,QAAQ,CACZ,WAAgB,EAChB,UAA8B;QAE9B,MAAM,KAAK,GAAG,aAAa,CAAY,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,MAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE;gBACpE,gBAAgB,EAAE,KAAK,CAAC,QAAQ;gBAChC,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,SAAS,GAAI,MAAkC,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAiB;YAC7B,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,mGAAmG;YACnG,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACpG,QAAQ,EAAE,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;YAC/F,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9D,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,SAAS,CAAC,QAAsB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACpH,IAAI,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,KAAkB,EAAE,QAAsB;QAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACjF,MAAM,IAAI,GACR,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5G,MAAM,CAAC;QACT,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YAAE,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/auth/sessions.d.ts

@@ -0,0 +1,34 @@
+import type { Db } from '../db/index.js';
+import type { UserRow } from './users.js';
+/**
+ * Server-side sessions (design §6.1). The cookie holds a random 256-bit id; the DB stores only its
+ * HMAC under a pepper derived from the master key, so a DB leak doesn't yield usable cookies.
+ */
+export type SessionKind = 'admin' | 'oauth_ui' | 'approval_ui';
+export interface SessionLimits {
+    idleMs: number;
+    absoluteMs: number;
+}
+export interface ValidSession {
+    idHash: string;
+    kind: SessionKind;
+    user: UserRow;
+    createdAt: Date;
+}
+export declare class SessionService {
+    private readonly db;
+    private readonly pepper;
+    private readonly now;
+    constructor(db: Db, pepper: Buffer, now?: () => Date);
+    hashId(raw: string): string;
+    create(userId: string, kind: SessionKind, limits: SessionLimits, meta?: {
+        ip?: string;
+        userAgent?: string;
+    }): string;
+    /** Returns the session if it is of `kind`, unexpired (idle and absolute), and its user is enabled. */
+    validate(raw: string | undefined, kind: SessionKind, limits: SessionLimits): ValidSession | null;
+    revoke(raw: string | undefined): void;
+    /** Signs a user out everywhere (e.g. after a password change), optionally keeping the current session. */
+    revokeUser(userId: string, keepRaw?: string): void;
+    purgeExpired(): number;
+}

package/dist/auth/sessions.js

@@ -0,0 +1,83 @@
+import { createHmac } from 'node:crypto';
+import { and, eq, lt, ne } from 'drizzle-orm';
+import { sessions, users } from '../db/schema.js';
+import { randomToken } from './tokens.js';
+const TOUCH_EVERY_MS = 60_000;
+export class SessionService {
+    db;
+    pepper;
+    now;
+    constructor(db, pepper, now = () => new Date()) {
+        this.db = db;
+        this.pepper = pepper;
+        this.now = now;
+    }
+    hashId(raw) {
+        return createHmac('sha256', this.pepper).update(raw).digest('hex');
+    }
+    create(userId, kind, limits, meta = {}) {
+        const raw = randomToken(32);
+        const now = this.now();
+        this.db
+            .insert(sessions)
+            .values({
+            idHash: this.hashId(raw),
+            userId,
+            kind,
+            createdAt: now,
+            lastSeenAt: now,
+            expiresAt: new Date(now.getTime() + limits.absoluteMs),
+            ip: meta.ip ?? null,
+            userAgent: meta.userAgent?.slice(0, 256) ?? null,
+        })
+            .run();
+        return raw;
+    }
+    /** Returns the session if it is of `kind`, unexpired (idle and absolute), and its user is enabled. */
+    validate(raw, kind, limits) {
+        if (!raw || raw.length > 128)
+            return null;
+        const idHash = this.hashId(raw);
+        const row = this.db
+            .select({ session: sessions, user: users })
+            .from(sessions)
+            .innerJoin(users, eq(sessions.userId, users.id))
+            .where(and(eq(sessions.idHash, idHash), eq(sessions.kind, kind)))
+            .get();
+        if (!row)
+            return null;
+        const now = this.now().getTime();
+        const idleExpired = now - row.session.lastSeenAt.getTime() > limits.idleMs;
+        if (row.user.disabled || idleExpired || row.session.expiresAt.getTime() <= now) {
+            this.db.delete(sessions).where(eq(sessions.idHash, idHash)).run();
+            return null;
+        }
+        if (now - row.session.lastSeenAt.getTime() > TOUCH_EVERY_MS) {
+            this.db
+                .update(sessions)
+                .set({ lastSeenAt: new Date(now) })
+                .where(eq(sessions.idHash, idHash))
+                .run();
+        }
+        return { idHash, kind: row.session.kind, user: row.user, createdAt: row.session.createdAt };
+    }
+    revoke(raw) {
+        if (raw)
+            this.db
+                .delete(sessions)
+                .where(eq(sessions.idHash, this.hashId(raw)))
+                .run();
+    }
+    /** Signs a user out everywhere (e.g. after a password change), optionally keeping the current session. */
+    revokeUser(userId, keepRaw) {
+        const keep = keepRaw ? this.hashId(keepRaw) : '';
+        this.db
+            .delete(sessions)
+            .where(and(eq(sessions.userId, userId), ne(sessions.idHash, keep)))
+            .run();
+    }
+    purgeExpired() {
+        return this.db.delete(sessions).where(lt(sessions.expiresAt, this.now())).run().changes;
+    }
+}
+//# sourceMappingURL=sessions.js.map

package/dist/auth/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAsB1C,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,OAAO,cAAc;IAEN;IACA;IACA;IAHnB,YACmB,EAAM,EACN,MAAc,EACd,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAFlC,OAAE,GAAF,EAAE,CAAI;QACN,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,MAAM,CAAC,GAAW;QAChB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CACJ,MAAc,EACd,IAAiB,EACjB,MAAqB,EACrB,OAA4C,EAAE;QAE9C,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC;YACN,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACxB,MAAM;YACN,IAAI;YACJ,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;YACtD,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;SACjD,CAAC;aACD,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sGAAsG;IACtG,QAAQ,CAAC,GAAuB,EAAE,IAAiB,EAAE,MAAqB;QACxE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aAC1C,IAAI,CAAC,QAAQ,CAAC;aACd,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC/C,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3E,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,WAAW,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC;YAC/E,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;YAC5D,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;iBAClC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBAClC,GAAG,EAAE,CAAC;QACX,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,CAAC,GAAuB;QAC5B,IAAI,GAAG;YACL,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;iBAC5C,GAAG,EAAE,CAAC;IACb,CAAC;IAED,0GAA0G;IAC1G,UAAU,CAAC,MAAc,EAAE,OAAgB;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,QAAQ,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;aAClE,GAAG,EAAE,CAAC;IACX,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IAC1F,CAAC;CACF"}

package/dist/auth/throttle.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Brute-force protection (design §6.1): 5 failed logins per username per 15 minutes locks that
+ * username for 15 minutes, plus a per-IP budget for everything under /auth and connection tests.
+ * In memory on purpose: a restart resets it, which is acceptable for a single-process server.
+ *
+ * Failures are counted **per surface**: attempts on the internet-facing MCP-port sign-in can lock a
+ * username there, but never lock it out of the LAN admin portal.
+ */
+export type LoginSurface = 'admin' | 'mcp';
+export interface ThrottleOptions {
+    maxFailures: number;
+    windowMs: number;
+    ipLimit: number;
+    ipWindowMs: number;
+}
+export declare class LoginThrottle {
+    private readonly now;
+    private readonly failures;
+    private readonly ipHits;
+    private readonly opts;
+    constructor(opts?: Partial<ThrottleOptions>, now?: () => number, maxKeys?: number);
+    /** Tracked keys (tests and diagnostics). */
+    get size(): number;
+    /** Counts a request from `ip`; false when the IP is over budget. */
+    allowIp(ip: string | undefined): boolean;
+    /** Seconds until the username may try again, or 0. */
+    lockedFor(username: string, surface?: LoginSurface): number;
+    /** Records a failure; returns true if this failure triggered a lockout. */
+    fail(username: string, surface?: LoginSurface): boolean;
+    succeed(username: string, surface?: LoginSurface): void;
+}

package/dist/auth/throttle.js

@@ -0,0 +1,52 @@
+/**
+ * Brute-force protection (design §6.1): 5 failed logins per username per 15 minutes locks that
+ * username for 15 minutes, plus a per-IP budget for everything under /auth and connection tests.
+ * In memory on purpose: a restart resets it, which is acceptable for a single-process server.
+ *
+ * Failures are counted **per surface**: attempts on the internet-facing MCP-port sign-in can lock a
+ * username there, but never lock it out of the LAN admin portal.
+ */
+import { HitWindows } from '../gate/rate-limit.js';
+const failureKey = (username, surface) => `${surface}:${username.toLowerCase()}`;
+const DEFAULTS = { maxFailures: 5, windowMs: 15 * 60_000, ipLimit: 60, ipWindowMs: 5 * 60_000 };
+export class LoginThrottle {
+    now;
+    failures;
+    ipHits;
+    opts;
+    constructor(opts = {}, now = Date.now, maxKeys) {
+        this.now = now;
+        this.opts = { ...DEFAULTS, ...opts };
+        // Bounded: random usernames or spoofed IPs from the internet can't grow these without limit.
+        this.failures = new HitWindows(now, maxKeys);
+        this.ipHits = new HitWindows(now, maxKeys);
+    }
+    /** Tracked keys (tests and diagnostics). */
+    get size() {
+        return this.failures.size + this.ipHits.size;
+    }
+    /** Counts a request from `ip`; false when the IP is over budget. */
+    allowIp(ip) {
+        if (!ip)
+            return true;
+        if (this.ipHits.recent(ip, this.opts.ipWindowMs).length >= this.opts.ipLimit)
+            return false;
+        this.ipHits.add(ip, this.opts.ipWindowMs);
+        return true;
+    }
+    /** Seconds until the username may try again, or 0. */
+    lockedFor(username, surface = 'admin') {
+        const list = this.failures.recent(failureKey(username, surface), this.opts.windowMs);
+        if (list.length < this.opts.maxFailures)
+            return 0;
+        return Math.ceil((list[0] + this.opts.windowMs - this.now()) / 1000);
+    }
+    /** Records a failure; returns true if this failure triggered a lockout. */
+    fail(username, surface = 'admin') {
+        return this.failures.add(failureKey(username, surface), this.opts.windowMs).length === this.opts.maxFailures;
+    }
+    succeed(username, surface = 'admin') {
+        this.failures.delete(failureKey(username, surface));
+    }
+}
+//# sourceMappingURL=throttle.js.map

package/dist/auth/throttle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"throttle.js","sourceRoot":"","sources":["../../src/auth/throttle.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,OAAqB,EAAE,EAAE,CAAC,GAAG,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;AASvG,MAAM,QAAQ,GAAoB,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC;AAEjH,MAAM,OAAO,aAAa;IAOL;IANF,QAAQ,CAAa;IACrB,MAAM,CAAa;IACnB,IAAI,CAAkB;IAEvC,YACE,OAAiC,EAAE,EAClB,MAAoB,IAAI,CAAC,GAAG,EAC7C,OAAgB;QADC,QAAG,GAAH,GAAG,CAAyB;QAG7C,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;QACrC,6FAA6F;QAC7F,IAAI,CAAC,QAAQ,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,4CAA4C;IAC5C,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED,oEAAoE;IACpE,OAAO,CAAC,EAAsB;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sDAAsD;IACtD,SAAS,CAAC,QAAgB,EAAE,UAAwB,OAAO;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrF,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,QAAgB,EAAE,UAAwB,OAAO;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;IAC/G,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,UAAwB,OAAO;QACvD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;CACF"}

package/dist/auth/tokens.d.ts

@@ -0,0 +1,7 @@
+/** Random opaque tokens (stored hashed) and short-lived HMAC-signed payloads for multi-step flows. */
+export declare function randomToken(bytes?: number): string;
+export declare function sha256(value: string): string;
+/** Signs a small JSON payload with an expiry. Used for the TOTP step, OIDC state and consent forms. */
+export declare function signPayload(key: Buffer, payload: Record<string, unknown>, ttlMs: number, nowMs?: number): string;
+export declare function verifyPayload<T extends Record<string, unknown>>(key: Buffer, token: string | undefined, nowMs?: number): T | null;
+export declare function safeEqual(a: string, b: string): boolean;