@trokky/trokky 2.0.3

package/dist/core/services/oauth2-server-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-server-service.js","sourceRoot":"","sources":["../../../src/core/services/oauth2-server-service.ts"],"names":[],"mappings":"AAgBA;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,IAAqC;QAArC,SAAI,GAAJ,IAAI,CAAiC;IAAG,CAAC;IAEtE;;;OAGG;IACI,eAAe;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAA;IACpC,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,oBAAoB,CAC/B,IAAU,EACV,MAAqB,EACrB,QAAgB;QAMhB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,cAAc,IAAI,IAAI,CAAA;QAC3E,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,eAAe,IAAI,OAAO,CAAA;QAChF,MAAM,mBAAmB,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAE7D,6DAA6D;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAElF,wBAAwB;QACxB,MAAM,kBAAkB,GAAG;YACzB,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,eAAe;YACrB,QAAQ;YACR,MAAM;YACN,WAAW;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAA;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YACrG,SAAS,EAAE,cAAc;SAC1B,CAAC,CAAA;QAEF,IAAI,YAAgC,CAAA;QACpC,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,mBAAmB,GAAG;gBAC1B,GAAG,EAAE,IAAI,CAAC,EAAE;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,QAAQ;gBACR,MAAM;aACP,CAAA;YAED,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBACjG,SAAS,EAAE,eAAe;aAC3B,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC/C,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ;YACR,MAAM;YACN,mBAAmB;SACpB,CAAC,CAAA;QAEF,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,cAAc;SAC1B,CAAA;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB,CAC7B,YAAoB,EACpB,QAAgB,EAChB,cAAuB;QAEvB,IAAI,CAAC;YACH,uBAAuB;YACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAKjF,CAAA;YAER,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;gBAC9C,OAAO,IAAI,CAAA;YACb,CAAC;YAED,iCAAiC;YACjC,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC/E,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;oBACtD,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAA;gBACF,OAAO,IAAI,CAAA;YACb,CAAC;YAED,qDAAqD;YACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACjD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;gBACxF,OAAO,IAAI,CAAA;YACb,CAAC;YAED,iDAAiD;YACjD,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAC3B,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAkB,CAAA;gBAClF,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;YAClE,CAAC;YAED,sBAAsB;YACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;YAEtE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBAC9C,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ;gBACR,MAAM;aACP,CAAC,CAAA;YAEF,OAAO;gBACL,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACxB,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/D,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,4BAA4B;IAC5B,+CAA+C;IAE/C;;;OAGG;IACI,KAAK,CAAC,cAAc,CACzB,MAAc,EACd,QAAgB,EAChB,eAA8B;QAE9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBACpE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;YACnD,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;gBACzD,MAAM;gBACN,QAAQ;gBACR,eAAe;gBACf,eAAe,EAAE,IAAI,CAAC,WAAW;aAClC,CAAC,CAAA;YAEF,qCAAqC;YACrC,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,IAAI,EAAE,CAIvD,CAAA;YAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAClC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;gBAC7F,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;YACnD,CAAC;YAED,+BAA+B;YAC/B,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBAClE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;gBACtE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;YACnD,CAAC;YAED,sDAAsD;YACtD,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;YAC5C,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;YAEpF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBAC/C,YAAY;gBACZ,eAAe;gBACf,eAAe;aAChB,CAAC,CAAA;YAEF,OAAO;gBACL,UAAU,EAAE,YAAY;gBACxB,eAAe;aAChB,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAClF,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;QACnD,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAC1B,MAAc,EACd,QAAgB,EAChB,MAAqB,EACrB,aAAsB;QAEtB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAEhF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBACzE,OAAO,KAAK,CAAA;YACd,CAAC;YAED,wBAAwB;YACxB,MAAM,kBAAkB,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAA;YACjD,MAAM,gBAAgB,GAAG,CAAC,kBAAkB,CAAC,eAAe,IAAI,EAAE,CAIhE,CAAA;YAEF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBACxD,kBAAkB;gBAClB,gBAAgB;aACjB,CAAC,CAAA;YAEF,yCAAyC;YACzC,MAAM,eAAe,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;YAClD,MAAM,YAAY,GAAG,eAAe;gBAClC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAkB;gBACvE,CAAC,CAAC,MAAM,CAAA;YAEV,kEAAkE;YAClE,MAAM,SAAS,GAAG,aAAa;gBAC7B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;gBAC1E,CAAC,CAAC,SAAS,CAAA;YAEb,kBAAkB;YAClB,MAAM,eAAe,GAAG;gBACtB,GAAG,gBAAgB;gBACnB,CAAC,QAAQ,CAAC,EAAE;oBACV,MAAM,EAAE,YAAY;oBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,SAAS;iBACV;aACF,CAAA;YAED,MAAM,cAAc,GAAG;gBACrB,GAAG,kBAAkB;gBACrB,eAAe,EAAE,eAAe;aACjC,CAAA;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,EAAE,cAAc,EAAE,CAAC,CAAA;YAErF,2BAA2B;YAC3B,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;gBACjC,WAAW,EAAE,cAAc;aAC5B,CAAC,CAAA;YAEF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBACvD,MAAM;gBACN,QAAQ;gBACR,MAAM,EAAE,YAAY;aACrB,CAAC,CAAA;YAEF,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAClF,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,QAAgB;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAA;YACd,CAAC;YAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAA;YACjD,MAAM,gBAAgB,GAAG,CAAC,kBAAkB,CAAC,eAAe,IAAI,EAAE,CAA4B,CAAA;YAE9F,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAA,CAAC,kBAAkB;YAChC,CAAC;YAED,qCAAqC;YACrC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,GAAG,iBAAiB,EAAE,GAAG,gBAAgB,CAAA;YAEvE,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;gBACjC,WAAW,EAAE;oBACX,GAAG,kBAAkB;oBACrB,eAAe,EAAE,iBAAiB;iBACnC;aACF,CAAC,CAAA;YAEF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YACnE,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YACpF,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/core/services/passkey-service.d.ts

@@ -0,0 +1,59 @@
+import type { TrokkyLogger } from '../utils/logger.js';
+import type { AuditEvent } from '../core/engine.js';
+import type { MFARequirement } from './mfa-service.js';
+import type { AuthenticationResult, AuthenticationSuccessResult, DataStorageAdapter, MFAMethodType, TrokkyConfig, UpdateUserData, User, UserListOptions } from '../types/index.js';
+export interface PasskeyServiceDependencies {
+    config: TrokkyConfig;
+    logger: TrokkyLogger;
+    dataStorage: DataStorageAdapter;
+    getUser: (id: string) => Promise<User | null>;
+    updateUser: (id: string, userData: UpdateUserData) => Promise<User>;
+    listUsers: (options?: UserListOptions) => Promise<User[]>;
+    logAuditEvent: (event: AuditEvent) => void;
+    checkMFARequired: (userId: string) => Promise<MFARequirement>;
+    isDeviceTrusted: (userId: string, deviceId: string) => Promise<boolean>;
+    issueFullTokens: (user: User, options?: {
+        rememberMe?: boolean;
+    }) => Promise<AuthenticationSuccessResult>;
+    generateMFAPendingToken: (user: User, methods: MFAMethodType[]) => Promise<string>;
+    generateMFASetupToken: (user: User, allowedMethods: MFAMethodType[]) => Promise<string>;
+}
+/**
+ * Passkey/WebAuthn credential management and login.
+ */
+export declare class PasskeyService {
+    private readonly deps;
+    constructor(deps: PasskeyServiceDependencies);
+    /**
+     * Check if passkey authentication is configured
+     */
+    isPasskeyConfigured(): boolean;
+    /**
+     * Get passkey configuration
+     */
+    getPasskeyConfig(): import('../../types/index.js').PasskeyConfig | null;
+    /**
+     * Find a user by passkey credential ID
+     */
+    getUserByPasskeyCredentialId(credentialId: string): Promise<User | null>;
+    /**
+     * Add a passkey credential to a user
+     */
+    addPasskeyToUser(userId: string, credential: import('../../types/index.js').PasskeyCredential): Promise<User>;
+    /**
+     * Remove a passkey credential from a user
+     */
+    removePasskeyFromUser(userId: string, credentialId: string): Promise<User>;
+    /**
+     * Update a passkey credential (counter, lastUsedAt, friendlyName)
+     */
+    updateUserPasskey(userId: string, credentialId: string, updates: Partial<import('../../types/index.js').PasskeyCredential>): Promise<User>;
+    /**
+     * Authenticate with passkey (after WebAuthn verification)
+     * Similar to authenticateWithOAuth but for passkeys
+     */
+    authenticateWithPasskey(userId: string, credentialId: string, options?: {
+        deviceId?: string;
+    }): Promise<AuthenticationResult | null>;
+}
+//# sourceMappingURL=passkey-service.d.ts.map

package/dist/core/services/passkey-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-service.d.ts","sourceRoot":"","sources":["../../../src/core/services/passkey-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,KAAK,EACV,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,IAAI,EACJ,eAAe,EAChB,MAAM,mBAAmB,CAAA;AAE1B,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,YAAY,CAAA;IACpB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC7C,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IACzD,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;IAC1C,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;IAC7D,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACvE,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACzG,uBAAuB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAClF,qBAAqB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CACxF;AAED;;GAEG;AACH,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,0BAA0B;IAE7D;;OAEG;IACI,mBAAmB,IAAI,OAAO;IAarC;;OAEG;IACI,gBAAgB,IAAI,OAAO,sBAAsB,EAAE,aAAa,GAAG,IAAI;IAK9E;;OAEG;IACU,4BAA4B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAsBrF;;OAEG;IACU,gBAAgB,CAC3B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,OAAO,sBAAsB,EAAE,iBAAiB,GAC3D,OAAO,CAAC,IAAI,CAAC;IAoChB;;OAEG;IACU,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCvF;;OAEG;IACU,iBAAiB,CAC5B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,OAAO,CAAC,OAAO,sBAAsB,EAAE,iBAAiB,CAAC,GACjE,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;OAGG;IACU,uBAAuB,CAClC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;CAwGxC"}

package/dist/core/services/passkey-service.js

@@ -0,0 +1,238 @@
+import { InvalidInputError } from '../errors/index.js';
+/**
+ * Passkey/WebAuthn credential management and login.
+ */
+export class PasskeyService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * Check if passkey authentication is configured
+     */
+    isPasskeyConfigured() {
+        const config = this.deps.config.security?.passkey;
+        // Debug logging
+        this.deps.logger.debug('isPasskeyConfigured check', {
+            hasSecurityConfig: !!this.deps.config.security,
+            hasPasskeyConfig: !!config,
+            passkeyEnabled: config?.enabled,
+            passkeyRpId: config?.rpId,
+            passkeyOrigin: config?.origin,
+        });
+        return !!(config?.enabled && config?.rpId && config?.origin);
+    }
+    /**
+     * Get passkey configuration
+     */
+    getPasskeyConfig() {
+        if (!this.isPasskeyConfigured())
+            return null;
+        return this.deps.config.security.passkey;
+    }
+    /**
+     * Find a user by passkey credential ID
+     */
+    async getUserByPasskeyCredentialId(credentialId) {
+        // First try storage adapter method if available
+        if (this.deps.dataStorage.getUserByPasskeyCredentialId) {
+            return this.deps.dataStorage.getUserByPasskeyCredentialId(credentialId);
+        }
+        // Fallback: list all users and search (inefficient, but works as fallback)
+        this.deps.logger.warn('getUserByPasskeyCredentialId not implemented in storage adapter, using fallback');
+        const users = await this.deps.listUsers({ limit: 10000 });
+        for (const user of users) {
+            const credential = (user.passkeys || []).find((p) => p.id === credentialId);
+            if (credential) {
+                return user;
+            }
+        }
+        return null;
+    }
+    /**
+     * Add a passkey credential to a user
+     */
+    async addPasskeyToUser(userId, credential) {
+        const user = await this.deps.getUser(userId);
+        if (!user) {
+            throw new InvalidInputError('User not found');
+        }
+        // Check if credential ID already exists for this user
+        const existingPasskeys = user.passkeys || [];
+        const alreadyExists = existingPasskeys.some((p) => p.id === credential.id);
+        if (alreadyExists) {
+            throw new InvalidInputError('Passkey credential already registered');
+        }
+        // Add the credential
+        const updatedPasskeys = [...existingPasskeys, credential];
+        const updatedUser = await this.deps.updateUser(userId, {
+            passkeys: updatedPasskeys,
+        });
+        this.deps.logAuditEvent({
+            type: 'user_updated',
+            targetUserId: userId,
+            username: user.username,
+            action: 'Passkey credential added',
+            timestamp: new Date().toISOString(),
+            success: true,
+            details: {
+                credentialId: credential.id,
+                friendlyName: credential.friendlyName,
+                deviceType: credential.deviceType,
+            },
+        });
+        return updatedUser;
+    }
+    /**
+     * Remove a passkey credential from a user
+     */
+    async removePasskeyFromUser(userId, credentialId) {
+        const user = await this.deps.getUser(userId);
+        if (!user) {
+            throw new InvalidInputError('User not found');
+        }
+        const existingPasskeys = user.passkeys || [];
+        const credentialToRemove = existingPasskeys.find((p) => p.id === credentialId);
+        if (!credentialToRemove) {
+            throw new InvalidInputError('Passkey credential not found');
+        }
+        const updatedPasskeys = existingPasskeys.filter((p) => p.id !== credentialId);
+        const updatedUser = await this.deps.updateUser(userId, {
+            passkeys: updatedPasskeys,
+        });
+        this.deps.logAuditEvent({
+            type: 'user_updated',
+            targetUserId: userId,
+            username: user.username,
+            action: 'Passkey credential removed',
+            timestamp: new Date().toISOString(),
+            success: true,
+            details: {
+                credentialId,
+                friendlyName: credentialToRemove.friendlyName,
+            },
+        });
+        return updatedUser;
+    }
+    /**
+     * Update a passkey credential (counter, lastUsedAt, friendlyName)
+     */
+    async updateUserPasskey(userId, credentialId, updates) {
+        const user = await this.deps.getUser(userId);
+        if (!user) {
+            throw new InvalidInputError('User not found');
+        }
+        const existingPasskeys = user.passkeys || [];
+        const credentialIndex = existingPasskeys.findIndex((p) => p.id === credentialId);
+        if (credentialIndex === -1) {
+            throw new InvalidInputError('Passkey credential not found');
+        }
+        // Update the credential
+        const updatedCredential = {
+            ...existingPasskeys[credentialIndex],
+            ...updates,
+        };
+        const updatedPasskeys = [...existingPasskeys];
+        updatedPasskeys[credentialIndex] = updatedCredential;
+        const updatedUser = await this.deps.updateUser(userId, {
+            passkeys: updatedPasskeys,
+        });
+        return updatedUser;
+    }
+    /**
+     * Authenticate with passkey (after WebAuthn verification)
+     * Similar to authenticateWithOAuth but for passkeys
+     */
+    async authenticateWithPasskey(userId, credentialId, options) {
+        try {
+            const user = await this.deps.getUser(userId);
+            if (!user || !user.isActive) {
+                return null;
+            }
+            // Update last login time and lastUsedAt for the passkey
+            const now = new Date().toISOString();
+            const updatedPasskeys = (user.passkeys || []).map((p) => p.id === credentialId ? { ...p, lastUsedAt: now } : p);
+            await this.deps.updateUser(user.id, {
+                lastLoginAt: now,
+                passkeys: updatedPasskeys,
+            });
+            // Check MFA requirements (same as regular login)
+            const mfaStatus = await this.deps.checkMFARequired(user.id);
+            if (mfaStatus.required) {
+                // User has MFA set up - check if device is trusted first
+                if (mfaStatus.userHasMFA) {
+                    // Check if device is trusted (can skip MFA)
+                    if (options?.deviceId) {
+                        const isTrusted = await this.deps.isDeviceTrusted(user.id, options.deviceId);
+                        if (isTrusted) {
+                            this.deps.logger.info('Passkey login - skipping MFA for trusted device', {
+                                userId: user.id,
+                                credentialId: credentialId.substring(0, 8) + '...',
+                                deviceId: options.deviceId.substring(0, 8) + '...',
+                            });
+                            // Device is trusted, issue full tokens (skip MFA)
+                            return this.deps.issueFullTokens(user, {});
+                        }
+                    }
+                    const mfaToken = await this.deps.generateMFAPendingToken(user, mfaStatus.methods);
+                    this.deps.logAuditEvent({
+                        type: 'user_login',
+                        userId: user.id,
+                        username: user.username,
+                        action: 'Passkey login - MFA verification required',
+                        timestamp: now,
+                        success: true,
+                        details: {
+                            mfaRequired: true,
+                            methods: mfaStatus.methods,
+                            authMethod: 'passkey',
+                        },
+                    });
+                    return {
+                        type: 'mfa_required',
+                        requiresMFA: true,
+                        mfaToken,
+                        methods: mfaStatus.methods,
+                        expiresIn: 300, // 5 minutes
+                    };
+                }
+                // Org/role requires MFA but user hasn't set it up
+                if (mfaStatus.reason === 'org_required' || mfaStatus.reason === 'role_required') {
+                    const setupToken = await this.deps.generateMFASetupToken(user, mfaStatus.methods);
+                    const message = mfaStatus.reason === 'role_required'
+                        ? `Your role (${user.role}) requires MFA. Please set up multi-factor authentication.`
+                        : 'Your organization requires MFA. Please set up multi-factor authentication.';
+                    this.deps.logAuditEvent({
+                        type: 'user_login',
+                        userId: user.id,
+                        username: user.username,
+                        action: 'Passkey login - MFA setup required',
+                        timestamp: now,
+                        success: true,
+                        details: {
+                            mfaSetupRequired: true,
+                            allowedMethods: mfaStatus.methods,
+                            reason: mfaStatus.reason,
+                            authMethod: 'passkey',
+                        },
+                    });
+                    return {
+                        type: 'mfa_setup_required',
+                        requiresMFASetup: true,
+                        setupToken,
+                        allowedMethods: mfaStatus.methods,
+                        message,
+                        expiresIn: 900, // 15 minutes
+                    };
+                }
+            }
+            // No MFA required - issue full tokens
+            return this.deps.issueFullTokens(user, {});
+        }
+        catch (error) {
+            this.deps.logger.error('Passkey authentication failed', error);
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=passkey-service.js.map

package/dist/core/services/passkey-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-service.js","sourceRoot":"","sources":["../../../src/core/services/passkey-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AA8BtD;;GAEG;AACH,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,IAAgC;QAAhC,SAAI,GAAJ,IAAI,CAA4B;IAAG,CAAC;IAEjE;;OAEG;IACI,mBAAmB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAA;QACjD,gBAAgB;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;YAClD,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9C,gBAAgB,EAAE,CAAC,CAAC,MAAM;YAC1B,cAAc,EAAE,MAAM,EAAE,OAAO;YAC/B,WAAW,EAAE,MAAM,EAAE,IAAI;YACzB,aAAa,EAAE,MAAM,EAAE,MAAM;SAC9B,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9D,CAAC;IAED;;OAEG;IACI,gBAAgB;QACrB,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE;YAAE,OAAO,IAAI,CAAA;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAS,CAAC,OAAQ,CAAA;IAC5C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,4BAA4B,CAAC,YAAoB;QAC5D,gDAAgD;QAChD,IAAK,IAAI,CAAC,IAAI,CAAC,WAAmB,CAAC,4BAA4B,EAAE,CAAC;YAChE,OAAQ,IAAI,CAAC,IAAI,CAAC,WAAmB,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAA;QAClF,CAAC;QAED,2EAA2E;QAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,iFAAiF,CAClF,CAAA;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAC7B,CAAA;YACD,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,gBAAgB,CAC3B,MAAc,EACd,UAA4D;QAE5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;QAC/C,CAAC;QAED,sDAAsD;QACtD,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAA;QAC5C,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,CAAA;QAC1E,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAA;QACtE,CAAC;QAED,qBAAqB;QACrB,MAAM,eAAe,GAAG,CAAC,GAAG,gBAAgB,EAAE,UAAU,CAAC,CAAA;QACzD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YACrD,QAAQ,EAAE,eAAe;SACnB,CAAC,CAAA;QAET,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,cAAc;YACpB,YAAY,EAAE,MAAM;YACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,0BAA0B;YAClC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC;SACF,CAAC,CAAA;QAEF,OAAO,WAAW,CAAA;IACpB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,qBAAqB,CAAC,MAAc,EAAE,YAAoB;QACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;QAC/C,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAA;QAC5C,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAA;QAE9E,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAA;QAC7E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YACrD,QAAQ,EAAE,eAAe;SACnB,CAAC,CAAA;QAET,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,cAAc;YACpB,YAAY,EAAE,MAAM;YACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,4BAA4B;YACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,YAAY;gBACZ,YAAY,EAAE,kBAAkB,CAAC,YAAY;aAC9C;SACF,CAAC,CAAA;QAEF,OAAO,WAAW,CAAA;IACpB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,iBAAiB,CAC5B,MAAc,EACd,YAAoB,EACpB,OAAkE;QAElE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;QAC/C,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAA;QAC5C,MAAM,eAAe,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAA;QAEhF,IAAI,eAAe,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;QAC7D,CAAC;QAED,wBAAwB;QACxB,MAAM,iBAAiB,GAAG;YACxB,GAAG,gBAAgB,CAAC,eAAe,CAAC;YACpC,GAAG,OAAO;SACX,CAAA;QACD,MAAM,eAAe,GAAG,CAAC,GAAG,gBAAgB,CAAC,CAAA;QAC7C,eAAe,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAA;QAEpD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YACrD,QAAQ,EAAE,eAAe;SACnB,CAAC,CAAA;QAET,OAAO,WAAW,CAAA;IACpB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,uBAAuB,CAClC,MAAc,EACd,YAAoB,EACpB,OAA+B;QAE/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAA;YACb,CAAC;YAED,wDAAwD;YACxD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YACpC,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CACtD,CAAA;YAED,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBAClC,WAAW,EAAE,GAAG;gBAChB,QAAQ,EAAE,eAAe;aACnB,CAAC,CAAA;YAET,iDAAiD;YACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAE3D,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,yDAAyD;gBACzD,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;oBACzB,4CAA4C;oBAC5C,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;wBACtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;wBAC5E,IAAI,SAAS,EAAE,CAAC;4BACd,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;gCACvE,MAAM,EAAE,IAAI,CAAC,EAAE;gCACf,YAAY,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;gCAClD,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;6BACnD,CAAC,CAAA;4BACF,kDAAkD;4BAClD,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;wBAC5C,CAAC;oBACH,CAAC;oBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;oBAEjF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;wBACtB,IAAI,EAAE,YAAY;wBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,2CAA2C;wBACnD,SAAS,EAAE,GAAG;wBACd,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE;4BACP,WAAW,EAAE,IAAI;4BACjB,OAAO,EAAE,SAAS,CAAC,OAAO;4BAC1B,UAAU,EAAE,SAAS;yBACtB;qBACF,CAAC,CAAA;oBAEF,OAAO;wBACL,IAAI,EAAE,cAAc;wBACpB,WAAW,EAAE,IAAI;wBACjB,QAAQ;wBACR,OAAO,EAAE,SAAS,CAAC,OAAO;wBAC1B,SAAS,EAAE,GAAG,EAAE,YAAY;qBAC7B,CAAA;gBACH,CAAC;gBAED,kDAAkD;gBAClD,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,IAAI,SAAS,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;oBAChF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;oBAEjF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,KAAK,eAAe;wBAClD,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,4DAA4D;wBACrF,CAAC,CAAC,4EAA4E,CAAA;oBAEhF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;wBACtB,IAAI,EAAE,YAAY;wBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,oCAAoC;wBAC5C,SAAS,EAAE,GAAG;wBACd,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE;4BACP,gBAAgB,EAAE,IAAI;4BACtB,cAAc,EAAE,SAAS,CAAC,OAAO;4BACjC,MAAM,EAAE,SAAS,CAAC,MAAM;4BACxB,UAAU,EAAE,SAAS;yBACtB;qBACF,CAAC,CAAA;oBAEF,OAAO;wBACL,IAAI,EAAE,oBAAoB;wBAC1B,gBAAgB,EAAE,IAAI;wBACtB,UAAU;wBACV,cAAc,EAAE,SAAS,CAAC,OAAO;wBACjC,OAAO;wBACP,SAAS,EAAE,GAAG,EAAE,aAAa;qBAC9B,CAAA;gBACH,CAAC;YACH,CAAC;YAED,sCAAsC;YACtC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAA;YAC9D,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF"}

package/dist/core/services/token-service.d.ts

@@ -0,0 +1,31 @@
+import type { CryptoAdapter } from '../crypto/adapter.js';
+import { RateLimiter } from '../security/rate-limiter.js';
+import { IdGenerator } from '../utils/id-generator.js';
+import type { AppTokenCreationResult } from '../security/auth.js';
+import type { AuditEvent } from '../core/engine.js';
+import { DataStorageAdapter, AppToken, AppTokenListOptions, CreateAppTokenData } from '../types/index.js';
+export interface TokenServiceDependencies {
+    dataStorage: DataStorageAdapter;
+    idGenerator: IdGenerator;
+    cryptoAdapter: CryptoAdapter;
+    rateLimiter?: RateLimiter;
+    securityEnabled: boolean;
+    logAuditEvent: (event: AuditEvent) => void;
+}
+/**
+ * Application token management (creation, validation, revocation).
+ */
+export declare class TokenService {
+    private readonly deps;
+    constructor(deps: TokenServiceDependencies);
+    listAppTokens(options?: AppTokenListOptions): Promise<AppToken[]>;
+    createAppToken(tokenData: CreateAppTokenData, createdBy: string): Promise<AppTokenCreationResult>;
+    getAppToken(id: string): Promise<AppToken | null>;
+    validateAppToken(token: string): Promise<{
+        valid: boolean;
+        appToken?: AppToken;
+        error?: string;
+    }>;
+    deleteAppToken(id: string): Promise<void>;
+}
+//# sourceMappingURL=token-service.d.ts.map

package/dist/core/services/token-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-service.d.ts","sourceRoot":"","sources":["../../../src/core/services/token-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEzD,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAEtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,mBAAmB,CAAA;AAE1B,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,kBAAkB,CAAA;IAC/B,WAAW,EAAE,WAAW,CAAA;IACxB,aAAa,EAAE,aAAa,CAAA;IAC5B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,eAAe,EAAE,OAAO,CAAA;IACxB,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CAC3C;AAED;;GAEG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,wBAAwB;IAG9C,aAAa,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IASjE,cAAc,CAAC,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA6CjG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAajD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAyCjG,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgCvD"}

package/dist/core/services/token-service.js

@@ -0,0 +1,132 @@
+import { createHash, timingSafeEqual } from 'crypto';
+import { SecurityValidator } from '../security/validation.js';
+import { DocumentNotFoundError } from '../errors/index.js';
+/**
+ * Application token management (creation, validation, revocation).
+ */
+export class TokenService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    // App Token management operations
+    async listAppTokens(options) {
+        if (this.deps.rateLimiter) {
+            await this.deps.rateLimiter.checkRateLimit('listAppTokens');
+        }
+        // App token operations are handled by data storage adapter
+        return await this.deps.dataStorage.listAppTokens(options);
+    }
+    async createAppToken(tokenData, createdBy) {
+        if (this.deps.rateLimiter) {
+            await this.deps.rateLimiter.checkRateLimit('createAppToken');
+        }
+        // App token operations are handled by data storage adapter
+        try {
+            // Generate token and hash using SHA256 (fast) - bcrypt is unnecessary for API tokens
+            // API tokens are long random strings, not user-chosen passwords, so SHA256 is secure
+            const token = this.deps.cryptoAdapter.generateSecureRandom(32);
+            const tokenHash = createHash('sha256').update(token).digest('hex');
+            const now = new Date().toISOString();
+            const tokenId = this.deps.idGenerator.generate();
+            const appToken = {
+                id: tokenId,
+                name: tokenData.name,
+                description: tokenData.description,
+                tokenHash,
+                permissions: tokenData.permissions,
+                isActive: true,
+                createdAt: now,
+                updatedAt: now,
+                createdBy,
+                lastUsedAt: undefined,
+                expiresAt: tokenData.expiresAt
+            };
+            const savedToken = await this.deps.dataStorage.saveAppToken(tokenId, appToken);
+            return {
+                success: true,
+                token, // Plain text token (only returned once)
+                appToken: savedToken
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : 'Failed to create app token'
+            };
+        }
+    }
+    async getAppToken(id) {
+        if (this.deps.rateLimiter) {
+            await this.deps.rateLimiter.checkRateLimit('getAppToken');
+        }
+        if (this.deps.securityEnabled) {
+            SecurityValidator.validateDocumentId(id);
+        }
+        // App token operations are handled by data storage adapter
+        return await this.deps.dataStorage.getAppToken(id);
+    }
+    async validateAppToken(token) {
+        if (this.deps.rateLimiter) {
+            await this.deps.rateLimiter.checkRateLimit('validateAppToken');
+        }
+        try {
+            // Hash the provided token with SHA256 for comparison
+            const providedHash = createHash('sha256').update(token).digest('hex');
+            // Get all active app tokens and check if any match the hash
+            const tokens = await this.deps.dataStorage.listAppTokens({ isActive: true });
+            for (const appToken of tokens) {
+                // Use constant-time comparison to prevent timing attacks
+                if (appToken.tokenHash && appToken.tokenHash.length === providedHash.length) {
+                    const storedBuffer = Buffer.from(appToken.tokenHash, 'hex');
+                    const providedBuffer = Buffer.from(providedHash, 'hex');
+                    if (timingSafeEqual(storedBuffer, providedBuffer)) {
+                        // Update last used timestamp and usage count
+                        const updatedToken = {
+                            ...appToken,
+                            lastUsedAt: new Date().toISOString(),
+                            usageCount: (appToken.usageCount || 0) + 1
+                        };
+                        await this.deps.dataStorage.saveAppToken(appToken.id, updatedToken);
+                        return { valid: true, appToken: updatedToken };
+                    }
+                }
+            }
+            return { valid: false, error: 'Invalid app token' };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                error: error instanceof Error ? error.message : 'App token validation failed'
+            };
+        }
+    }
+    async deleteAppToken(id) {
+        if (this.deps.rateLimiter) {
+            await this.deps.rateLimiter.checkRateLimit('deleteAppToken');
+        }
+        if (this.deps.securityEnabled) {
+            SecurityValidator.validateDocumentId(id);
+        }
+        // App token operations are handled by data storage adapter
+        const existingToken = await this.getAppToken(id);
+        if (!existingToken) {
+            throw new DocumentNotFoundError('tokens', id);
+        }
+        await this.deps.dataStorage.deleteAppToken(id);
+        // Log audit event
+        this.deps.logAuditEvent({
+            type: 'app_token_deleted',
+            targetTokenId: id,
+            tokenName: existingToken.name,
+            action: `App token deleted`,
+            timestamp: new Date().toISOString(),
+            success: true,
+            details: {
+                permissions: existingToken.permissions,
+                createdBy: existingToken.createdBy
+            }
+        });
+    }
+}
+//# sourceMappingURL=token-service.js.map

package/dist/core/services/token-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-service.js","sourceRoot":"","sources":["../../../src/core/services/token-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAEpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAG7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAmB1D;;GAEG;AACH,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,IAA8B;QAA9B,SAAI,GAAJ,IAAI,CAA0B;IAAG,CAAC;IAE/D,kCAAkC;IAC3B,KAAK,CAAC,aAAa,CAAC,OAA6B;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,eAAe,CAAC,CAAA;QAC7D,CAAC;QAED,2DAA2D;QAC3D,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,SAA6B,EAAE,SAAiB;QAC1E,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAA;QAC9D,CAAC;QAED,2DAA2D;QAE3D,IAAI,CAAC;YACH,qFAAqF;YACrF,qFAAqF;YACrF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAA;YAC9D,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAElE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAA;YAEhD,MAAM,QAAQ,GAAa;gBACzB,EAAE,EAAE,OAAO;gBACX,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,SAAS;gBACT,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;gBACd,SAAS;gBACT,UAAU,EAAE,SAAS;gBACrB,SAAS,EAAE,SAAS,CAAC,SAAS;aAC/B,CAAA;YAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAE9E,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,wCAAwC;gBAC/C,QAAQ,EAAE,UAAU;aACrB,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;aAC7E,CAAA;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,EAAU;QACjC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9B,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAA;QAC1C,CAAC;QAED,2DAA2D;QAC3D,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IACpD,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,KAAa;QACzC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAErE,4DAA4D;YAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;YAE5E,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;gBAC9B,yDAAyD;gBACzD,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;oBAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;oBAC3D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;oBACvD,IAAI,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;wBAClD,6CAA6C;wBAC7C,MAAM,YAAY,GAAa;4BAC7B,GAAG,QAAQ;4BACX,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BACpC,UAAU,EAAE,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC;yBAC3C,CAAA;wBAED,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC,CAAA;wBAEnE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B;aAC9E,CAAA;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,EAAU;QACpC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAA;QAC9D,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9B,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAA;QAC1C,CAAC;QAED,2DAA2D;QAE3D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;QAC/C,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QAE9C,kBAAkB;QAClB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,mBAAmB;YACzB,aAAa,EAAE,EAAE;YACjB,SAAS,EAAE,aAAa,CAAC,IAAI;YAC7B,MAAM,EAAE,mBAAmB;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,SAAS,EAAE,aAAa,CAAC,SAAS;aACnC;SACF,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/core/services/trusted-device-service.d.ts

@@ -0,0 +1,39 @@
+import type { TrokkyLogger } from '../utils/logger.js';
+import type { SettingsConfig, TrustedDevice, UpdateUserData, User } from '../types/index.js';
+export interface TrustedDeviceServiceDependencies {
+    logger: TrokkyLogger;
+    getUser: (id: string) => Promise<User | null>;
+    updateUser: (id: string, userData: UpdateUserData) => Promise<User>;
+    getSettings: () => Promise<SettingsConfig | null>;
+}
+/**
+ * Trusted device management for MFA bypass.
+ */
+export declare class TrustedDeviceService {
+    private readonly deps;
+    constructor(deps: TrustedDeviceServiceDependencies);
+    /**
+     * Trust a device to skip MFA
+     */
+    trustDevice(userId: string, deviceId: string, deviceName: string, options?: {
+        ipAddress?: string;
+        userAgent?: string;
+    }): Promise<TrustedDevice>;
+    /**
+     * Check if a device is trusted for MFA bypass
+     */
+    isDeviceTrusted(userId: string, deviceId: string): Promise<boolean>;
+    /**
+     * Revoke trust for a specific device
+     */
+    revokeTrustedDevice(userId: string, deviceId: string): Promise<void>;
+    /**
+     * Revoke trust for all devices
+     */
+    revokeAllTrustedDevices(userId: string): Promise<void>;
+    /**
+     * Get list of trusted devices for a user
+     */
+    getTrustedDevices(userId: string): Promise<TrustedDevice[]>;
+}
+//# sourceMappingURL=trusted-device-service.d.ts.map

package/dist/core/services/trusted-device-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-device-service.d.ts","sourceRoot":"","sources":["../../../src/core/services/trusted-device-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAE5F,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC7C,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,WAAW,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAA;CAClD;AAED;;GAEG;AACH,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,gCAAgC;IAEnE;;OAEG;IACU,WAAW,CACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GACnD,OAAO,CAAC,aAAa,CAAC;IAoCzB;;OAEG;IACU,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsChF;;OAEG;IACU,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBjF;;OAEG;IACU,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBnE;;OAEG;IACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAczE"}