@yadsh/dsh-qa-surface 0.10.0 → 0.11.0

package/lib/accounts/database.js

@@ -58,7 +58,56 @@ const MIGRATIONS = [
       );
     `,
     },
+    {
+        version: 2,
+        up: `
+      -- One row per account that asked for a password reset from the sign-in
+      -- screen. The row is what makes "забыли пароль?" a path rather than a
+      -- dead end: an operator reads it and sets a new password. Keyed by
+      -- account id, so a second tap updates the row instead of queueing a
+      -- duplicate, and the count keeps the repetition visible.
+      CREATE TABLE qa_password_resets (
+        user_id TEXT PRIMARY KEY,
+        requested_at TEXT NOT NULL,
+        last_requested_at TEXT NOT NULL,
+        request_count INTEGER NOT NULL DEFAULT 1
+      );
+      -- Integration tokens: the credentials a non-browser application
+      -- presents to the QA HTTP API. The row keeps a digest of the secret and
+      -- never the secret itself, so a copied database is not a copied
+      -- credential; scopes, expiry and the revocation column are what make one
+      -- token revocable without touching the account's browser sessions.
+      CREATE TABLE qa_service_tokens (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        label TEXT NOT NULL,
+        token_hash TEXT NOT NULL,
+        scopes_json TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        expires_at TEXT NOT NULL,
+        last_used_at TEXT,
+        revoked_at TEXT,
+        use_count INTEGER NOT NULL DEFAULT 0
+      );
+      CREATE INDEX qa_service_tokens_user
+        ON qa_service_tokens (user_id, created_at);
+    `,
+    },
 ];
+function toServiceToken(row) {
+    return {
+        id: row.id,
+        userId: row.user_id,
+        label: row.label,
+        hash: row.token_hash,
+        scopes: JSON.parse(row.scopes_json),
+        createdAt: row.created_at,
+        expiresAt: row.expires_at,
+        lastUsedAt: row.last_used_at,
+        revokedAt: row.revoked_at,
+        useCount: row.use_count,
+    };
+}
 /** SQLite hands back null-prototype records; the row shapes describe them. */
 function asRows(value) {
     return value;
@@ -176,6 +225,39 @@ export class QaAccountsDatabase {
             this.writeUser(user, { replace: true });
         });
     }
+    /**
+     * Record one forgotten-password request. A repeat from the same account
+     * moves the row up the queue and counts up, so the console shows "asked
+     * again" rather than an identical-looking pile of rows.
+     */
+    recordPasswordReset(userId, at) {
+        this.storage.transaction(() => {
+            this.storage.db
+                .prepare(`INSERT INTO qa_password_resets
+             (user_id, requested_at, last_requested_at, request_count)
+           VALUES (?, ?, ?, 1)
+           ON CONFLICT(user_id) DO UPDATE SET
+             last_requested_at = excluded.last_requested_at,
+             request_count = qa_password_resets.request_count + 1`)
+                .run(userId, at, at);
+        });
+    }
+    /** Every pending request, newest first. */
+    listPasswordResets() {
+        return asRows(this.storage.db
+            .prepare(`SELECT user_id, requested_at, last_requested_at, request_count
+             FROM qa_password_resets
+            ORDER BY last_requested_at DESC, user_id`)
+            .all());
+    }
+    /** Drop an account's pending request: it was answered, or it is moot. */
+    clearPasswordReset(userId) {
+        this.storage.transaction(() => {
+            this.storage.db
+                .prepare("DELETE FROM qa_password_resets WHERE user_id = ?")
+                .run(userId);
+        });
+    }
     /** Record a successful sign-in without rewriting the account. */
     touchLogin(userId, at) {
         this.storage.transaction(() => {
@@ -220,6 +302,64 @@ export class QaAccountsDatabase {
             this.gcSnapshots();
         });
     }
+    /** Record one freshly minted integration token (digest only, never a secret). */
+    insertServiceToken(token) {
+        this.storage.transaction(() => {
+            this.storage.db
+                .prepare(`INSERT INTO qa_service_tokens
+             (id, user_id, label, token_hash, scopes_json, created_at,
+              expires_at, last_used_at, revoked_at, use_count)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(token.id, token.userId, token.label, token.hash, JSON.stringify(token.scopes), token.createdAt, token.expiresAt, token.lastUsedAt, token.revokedAt, token.useCount);
+        });
+    }
+    /**
+     * One integration token by id, revoked and expired ones included.
+     *
+     * The caller needs the revoked ones: presenting a revoked token must be a
+     * refusal, not a lookup miss, and the two are only distinguishable when the
+     * row still answers.
+     */
+    serviceToken(tokenId) {
+        const row = this.storage.db
+            .prepare("SELECT * FROM qa_service_tokens WHERE id = ?")
+            .get(tokenId);
+        return row === undefined ? undefined : toServiceToken(row);
+    }
+    /** Every integration token of one account, oldest first. */
+    serviceTokensOf(userId) {
+        return asRows(this.storage.db
+            .prepare("SELECT * FROM qa_service_tokens WHERE user_id = ? ORDER BY created_at, id")
+            .all(userId)).map(toServiceToken);
+    }
+    /** Record that one token was used, without rewriting its row. */
+    touchServiceToken(tokenId, at) {
+        this.storage.transaction(() => {
+            this.storage.db
+                .prepare(`UPDATE qa_service_tokens
+              SET last_used_at = ?, use_count = use_count + 1
+            WHERE id = ?`)
+                .run(at, tokenId);
+        });
+    }
+    /** Revoke one token; already-revoked tokens keep their first timestamp. */
+    revokeServiceToken(tokenId, at) {
+        return this.storage.transaction(() => {
+            const result = this.storage.db
+                .prepare("UPDATE qa_service_tokens SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL")
+                .run(at, tokenId);
+            return result.changes > 0;
+        });
+    }
+    /** Revoke every token of one account; returns how many were still live. */
+    revokeServiceTokensOf(userId, at) {
+        return this.storage.transaction(() => {
+            const result = this.storage.db
+                .prepare("UPDATE qa_service_tokens SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL")
+                .run(at, userId);
+            return Number(result.changes);
+        });
+    }
     /**
      * Append one skill activation and keep the newest `limit` of them. The list
      * is bounded because a long session may activate skills many times, and the

package/lib/accounts/database.js.map

@@ -1 +1 @@
-{"version":3,"file":"database.js","sourceRoot":"","sources":["../../src/accounts/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EACL,cAAc,GAEf,MAAM,8BAA8B,CAAC;AAMtC,OAAO,EACL,cAAc,GAMf,MAAM,WAAW,CAAC;AAEnB,0EAA0E;AAC1E,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC;;;GAGG;AACH,MAAM,UAAU,GAA+B;IAC7C;QACE,OAAO,EAAE,CAAC;QACV,EAAE,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA6CH;KACF;CACF,CAAC;AAiCF,8EAA8E;AAC9E,SAAS,MAAM,CAAI,KAAc;IAC/B,OAAO,KAAY,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CAAI,GAAkB;IAC5C,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,GAAe;IAC7B,MAAM,OAAO,GAAG,eAAe,CAAgB,GAAG,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,eAAe,CAAiB,GAAG,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,eAAe,CAAe,GAAG,CAAC,cAAc,CAAC,CAAC;IACnE,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,IAAI,EAAE,GAAG,CAAC,IAA0B;QACpC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,EAAE;QAClE,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,WAAW,EAAE,GAAG,CAAC,aAAa;QAC9B,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,kBAAkB;IAIR,QAAQ;IAHpB,OAAO,CAAiB;IACzB,mBAAmB,CAAS;IAEpC,YAAqB,QAAgB;wBAAhB,QAAQ;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,uEAAuE;IACvE,IAAI,MAAM;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,QAAQ,+CAA+C,CAC7E,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,eAAe,EAAE,KAAK,IAAI,CAAC,mBAAmB,CAAC;IAC7D,CAAC;IAED,+EAA+E;IAC/E,UAAU;QACR,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;IACpD,CAAC;IAED,yEAAyE;IACzE,OAAO;QACL,MAAM,KAAK,GAAG,MAAM,CAClB,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EAAE,CACxE,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,CAC1B,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;;kEAGwD,CACzD;aACA,GAAG,EAAE,CACT,CAAC;QACF,MAAM,SAAS,GAAoC,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,eAAe,CAC9B,GAAG,CAAC,aAAa,CAClB,CAAC;YACF,MAAM,gBAAgB,GAAG,MAAM,CAC7B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN,yEAAyE,CAC1E;iBACA,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CACvB,CAAC;YACF,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG;gBAC1B,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;gBACjE,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;gBACnE,GAAG,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;oBAC/B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CACpC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAA4B,CAC7D;qBACF,CAAC;aACP,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YACxB,SAAS;SACV,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,UAAU,CAAC,IAAgB;QACzB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,UAAU,CAAC,IAAgB;QACzB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,UAAU,CAAC,MAAc,EAAE,EAAU;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CAAC,uDAAuD,CAAC;iBAChE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,eAAe,CAAC,SAAiB,EAAE,KAAsB;QACvD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,mBAAmB,CAAC,IAA+B;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,eAAe,CAAC,SAAiB,EAAE,KAAsB;QACvD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,eAAe,CAAC,UAA6B;QAC3C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CACpC,+CAA+C,CAChD,CAAC;YACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACtB,IAAI,CAAC,OAAO,CAAC,EAAE;qBACZ,OAAO,CAAC,uDAAuD,CAAC;qBAChE,GAAG,CAAC,SAAS,CAAC,CAAC;YACpB,CAAC;YACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,qBAAqB,CACnB,SAAiB,EACjB,KAA8B,EAC9B,KAAa;QAEb,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;iBACzB,OAAO,CACN,yFAAyF,CAC1F;iBACA,GAAG,CAAC,SAAS,CAAqB,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN,2EAA2E,CAC5E;iBACA,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,IAAI,CAAC,OAAO,CAAC,EAAE;qBACZ,OAAO,CACN;;iCAEqB,CACtB;qBACA,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CACjB,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN,yEAAyE,CAC1E;iBACA,GAAG,CAAC,SAAS,CAAC,CAClB,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA4B,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,gBAAgB,CACd,cAAkC;QAElC,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACnD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC7C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;gBAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACtD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,UAAU,CACR,cAAc,EACd,GAAG,cAAc,aAAa,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAChF,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,mBAAmB,CACzB,cAAsB,EACtB,MAAoB,EACpB,QAAsB;QAEtB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CACX,YAAY,MAAM,CAAC,KAAK,CAAC,MAAM,uBAAuB,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAC9D,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAChE,IAAI,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,YAAY,gBAAgB,2BAA2B,gBAAgB,EAAE,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,0BAA0B,cAAc,yBAAyB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,6DAA6D,CAClJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,WAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;aACxB,OAAO,CAAC,2CAA2C,CAAC;aACpD,GAAG,EAAuB,CAAC;QAC9B,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;IACvB,CAAC;IAEO,eAAe;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAE7D,CAAC;QACF,OAAO,GAAG,CAAC,YAAY,CAAC;IAC1B,CAAC;IAEO,YAAY;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO;QACtD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,oEAAoE;YACpE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACjE,cAAc,CACpB,IAAgB;QAEhB,OAAO;YACL,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,IAAI;YACT,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,YAAY,IAAI,CAAC;YACtB,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,YAAY,CAAC,IAAI;YACtB,IAAI,CAAC,YAAY,CAAC,IAAI;YACtB,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAChE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;YAClE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;SACnE,CAAC;IACJ,CAAC;IAEO,SAAS,CACf,IAAgB,EAChB,OAAO,GAA0B,EAAE;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN;;;;;yBAKe,CAChB;iBACA,GAAG,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;aACzB,OAAO,CAAC,2DAA2D,CAAC;aACpE,GAAG,EAAsB,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;;;2DAImD,CACpD;aACA,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;IACzC,CAAC;IAEO,cAAc,CAAC,SAAiB,EAAE,KAAsB;QAC9D,MAAM,YAAY,GAChB,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACpC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;;;;;;;kDAQ0C,CAC3C;aACA,GAAG,CACF,SAAS,EACT,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACnC,YAAY,CACb,CAAC;QACJ,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CAAC,uDAAuD,CAAC;aAChE,GAAG,CAAC,SAAS,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CACpC,2EAA2E,CAC5E,CAAC;QACF,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACnC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED,uEAAuE;IAC/D,aAAa,CAAC,MAAmC;QACvD,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;sCAC8B,CAC/B;aACA,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IACvE,WAAW;QACjB,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;;;YAII,CACL;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IAEO,eAAe,CAAC,QAAgB,EAAE,GAAW;QACnD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACd,MAAuB,CAAC,OAAO,KAAK,CAAC;YACtC,OAAQ,MAAuB,CAAC,MAAM,KAAK,QAAQ;YACnD,CAAC,KAAK,CAAC,OAAO,CAAE,MAAuB,CAAC,KAAK,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gBAAgB,QAAQ,6DAA6D,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAEZ,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GAAoC,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACtE,MAAM,MAAM,GAAG,KAAmD,CAAC;YACnE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;YACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,wBAAwB,SAAS,0CAA0C,WAAW,8CAA8C,CACrI,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QACnE,CAAC;QACD,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS;SACV,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../src/accounts/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EACL,cAAc,GAEf,MAAM,8BAA8B,CAAC;AAMtC,OAAO,EACL,cAAc,GAMf,MAAM,WAAW,CAAC;AAEnB,0EAA0E;AAC1E,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC;;;GAGG;AACH,MAAM,UAAU,GAA+B;IAC7C;QACE,OAAO,EAAE,CAAC;QACV,EAAE,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA6CH;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,EAAE,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA+BH;KACF;CACF,CAAC;AAkEF,SAAS,cAAc,CAAC,GAAoB;IAC1C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,UAAU;QACpB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAsB;QACxD,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,QAAQ,EAAE,GAAG,CAAC,SAAS;KACxB,CAAC;AACJ,CAAC;AAQD,8EAA8E;AAC9E,SAAS,MAAM,CAAI,KAAc;IAC/B,OAAO,KAAY,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CAAI,GAAkB;IAC5C,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,GAAe;IAC7B,MAAM,OAAO,GAAG,eAAe,CAAgB,GAAG,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,eAAe,CAAiB,GAAG,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,eAAe,CAAe,GAAG,CAAC,cAAc,CAAC,CAAC;IACnE,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,IAAI,EAAE,GAAG,CAAC,IAA0B;QACpC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,EAAE;QAClE,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,WAAW,EAAE,GAAG,CAAC,aAAa;QAC9B,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,kBAAkB;IAIR,QAAQ;IAHpB,OAAO,CAAiB;IACzB,mBAAmB,CAAS;IAEpC,YAAqB,QAAgB;wBAAhB,QAAQ;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,uEAAuE;IACvE,IAAI,MAAM;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,QAAQ,+CAA+C,CAC7E,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,eAAe,EAAE,KAAK,IAAI,CAAC,mBAAmB,CAAC;IAC7D,CAAC;IAED,+EAA+E;IAC/E,UAAU;QACR,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;IACpD,CAAC;IAED,yEAAyE;IACzE,OAAO;QACL,MAAM,KAAK,GAAG,MAAM,CAClB,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EAAE,CACxE,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,CAC1B,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;;kEAGwD,CACzD;aACA,GAAG,EAAE,CACT,CAAC;QACF,MAAM,SAAS,GAAoC,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,eAAe,CAC9B,GAAG,CAAC,aAAa,CAClB,CAAC;YACF,MAAM,gBAAgB,GAAG,MAAM,CAC7B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN,yEAAyE,CAC1E;iBACA,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CACvB,CAAC;YACF,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG;gBAC1B,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;gBACjE,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;gBACnE,GAAG,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;oBAC/B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CACpC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAA4B,CAC7D;qBACF,CAAC;aACP,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YACxB,SAAS;SACV,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,UAAU,CAAC,IAAgB;QACzB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,UAAU,CAAC,IAAgB;QACzB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,MAAc,EAAE,EAAU;QAC5C,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN;;;;;kEAKwD,CACzD;iBACA,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IAC3C,kBAAkB;QAChB,OAAO,MAAM,CACX,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;qDAE2C,CAC5C;aACA,GAAG,EAAE,CACT,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,kBAAkB,CAAC,MAAc;QAC/B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CAAC,kDAAkD,CAAC;iBAC3D,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,UAAU,CAAC,MAAc,EAAE,EAAU;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CAAC,uDAAuD,CAAC;iBAChE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,eAAe,CAAC,SAAiB,EAAE,KAAsB;QACvD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,mBAAmB,CAAC,IAA+B;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,eAAe,CAAC,SAAiB,EAAE,KAAsB;QACvD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,eAAe,CAAC,UAA6B;QAC3C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CACpC,+CAA+C,CAChD,CAAC;YACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACtB,IAAI,CAAC,OAAO,CAAC,EAAE;qBACZ,OAAO,CAAC,uDAAuD,CAAC;qBAChE,GAAG,CAAC,SAAS,CAAC,CAAC;YACpB,CAAC;YACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,kBAAkB,CAAC,KAAyB;QAC1C,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN;;;iDAGuC,CACxC;iBACA,GAAG,CACF,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,EACV,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAC5B,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,QAAQ,CACf,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,OAAe;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;aACxB,OAAO,CAAC,8CAA8C,CAAC;aACvD,GAAG,CAAC,OAAO,CAAgC,CAAC;QAC/C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,4DAA4D;IAC5D,eAAe,CAAC,MAAc;QAC5B,OAAO,MAAM,CACX,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN,2EAA2E,CAC5E;aACA,GAAG,CAAC,MAAM,CAAC,CACf,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxB,CAAC;IAED,iEAAiE;IACjE,iBAAiB,CAAC,OAAe,EAAE,EAAU;QAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN;;yBAEe,CAChB;iBACA,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,kBAAkB,CAAC,OAAe,EAAE,EAAU;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;iBAC3B,OAAO,CACN,iFAAiF,CAClF;iBACA,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACpB,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,qBAAqB,CAAC,MAAc,EAAE,EAAU;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;iBAC3B,OAAO,CACN,sFAAsF,CACvF;iBACA,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACnB,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,qBAAqB,CACnB,SAAiB,EACjB,KAA8B,EAC9B,KAAa;QAEb,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;iBACzB,OAAO,CACN,yFAAyF,CAC1F;iBACA,GAAG,CAAC,SAAS,CAAqB,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN,2EAA2E,CAC5E;iBACA,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,IAAI,CAAC,OAAO,CAAC,EAAE;qBACZ,OAAO,CACN;;iCAEqB,CACtB;qBACA,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CACjB,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN,yEAAyE,CAC1E;iBACA,GAAG,CAAC,SAAS,CAAC,CAClB,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA4B,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,gBAAgB,CACd,cAAkC;QAElC,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACnD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC7C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;gBAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACtD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,UAAU,CACR,cAAc,EACd,GAAG,cAAc,aAAa,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAChF,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,mBAAmB,CACzB,cAAsB,EACtB,MAAoB,EACpB,QAAsB;QAEtB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CACX,YAAY,MAAM,CAAC,KAAK,CAAC,MAAM,uBAAuB,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAC9D,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAChE,IAAI,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,YAAY,gBAAgB,2BAA2B,gBAAgB,EAAE,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,0BAA0B,cAAc,yBAAyB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,6DAA6D,CAClJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,WAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;aACxB,OAAO,CAAC,2CAA2C,CAAC;aACpD,GAAG,EAAuB,CAAC;QAC9B,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;IACvB,CAAC;IAEO,eAAe;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAE7D,CAAC;QACF,OAAO,GAAG,CAAC,YAAY,CAAC;IAC1B,CAAC;IAEO,YAAY;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO;QACtD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;YAC5B,oEAAoE;YACpE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACjE,cAAc,CACpB,IAAgB;QAEhB,OAAO;YACL,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,IAAI;YACT,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,YAAY,IAAI,CAAC;YACtB,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,YAAY,CAAC,IAAI;YACtB,IAAI,CAAC,YAAY,CAAC,IAAI;YACtB,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAChE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;YAClE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;SACnE,CAAC;IACJ,CAAC;IAEO,SAAS,CACf,IAAgB,EAChB,OAAO,GAA0B,EAAE;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,OAAO,CACN;;;;;yBAKe,CAChB;iBACA,GAAG,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;aACzB,OAAO,CAAC,2DAA2D,CAAC;aACpE,GAAG,EAAsB,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;;;2DAImD,CACpD;aACA,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;IACzC,CAAC;IAEO,cAAc,CAAC,SAAiB,EAAE,KAAsB;QAC9D,MAAM,YAAY,GAChB,KAAK,CAAC,kBAAkB,KAAK,SAAS;YACpC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;;;;;;;kDAQ0C,CAC3C;aACA,GAAG,CACF,SAAS,EACT,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACnC,YAAY,CACb,CAAC;QACJ,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CAAC,uDAAuD,CAAC;aAChE,GAAG,CAAC,SAAS,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CACpC,2EAA2E,CAC5E,CAAC;QACF,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACnC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED,uEAAuE;IAC/D,aAAa,CAAC,MAAmC;QACvD,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;sCAC8B,CAC/B;aACA,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IACvE,WAAW;QACjB,IAAI,CAAC,OAAO,CAAC,EAAE;aACZ,OAAO,CACN;;;;YAII,CACL;aACA,GAAG,EAAE,CAAC;IACX,CAAC;IAEO,eAAe,CAAC,QAAgB,EAAE,GAAW;QACnD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACd,MAAuB,CAAC,OAAO,KAAK,CAAC;YACtC,OAAQ,MAAuB,CAAC,MAAM,KAAK,QAAQ;YACnD,CAAC,KAAK,CAAC,OAAO,CAAE,MAAuB,CAAC,KAAK,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gBAAgB,QAAQ,6DAA6D,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAEZ,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GAAoC,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACtE,MAAM,MAAM,GAAG,KAAmD,CAAC;YACnE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;YACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,wBAAwB,SAAS,0CAA0C,WAAW,8CAA8C,CACrI,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QACnE,CAAC;QACD,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS;SACV,CAAC;IACJ,CAAC;CACF"}

package/lib/accounts/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/accounts/errors.ts"],"names":[],"mappings":"AA8BA,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,MAAM;IADjB,YACW,MAA6B,EACtC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/accounts/errors.ts"],"names":[],"mappings":"AAkCA,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,MAAM;IADjB,YACW,MAA6B,EACtC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF"}

package/lib/accounts/service-token.js

@@ -0,0 +1,103 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual, } from "node:crypto";
+import { QA_SERVICE_TOKEN_DEFAULT_SCOPES, QA_SERVICE_TOKEN_LABEL_MAX, QA_SERVICE_TOKEN_SCOPES, QA_SERVICE_TOKEN_TTL_DAYS_MAX, QA_SERVICE_TOKEN_TTL_DAYS_MIN, } from "../shared/integration-tokens.js";
+// The scope list and the limits are declared in `shared`, because the profile
+// page enforces the same ones and must not import this module's crypto. They
+// are re-exported here so the Host's own callers keep one import site.
+export { QA_SERVICE_TOKEN_DEFAULT_SCOPES, QA_SERVICE_TOKEN_LABEL_MAX, QA_SERVICE_TOKEN_SCOPES, QA_SERVICE_TOKEN_TTL_DAYS_MAX, QA_SERVICE_TOKEN_TTL_DAYS_MIN, };
+/**
+ * Integration tokens: the credential a non-browser application presents to the
+ * QA HTTP API.
+ *
+ * They are deliberately a second, separate credential from the browser auth
+ * token (`accounts/token.ts`). The browser token is an HMAC over a payload that
+ * carries the account's `tokenVersion`; bumping that version — what a password
+ * change does — signs every browser out. An integration token must survive
+ * that: a service that keeps a Jira bridge running cannot be logged out by a
+ * human editing their profile. What it *does* share is the accounts database,
+ * so a disabled account and the operator's "revoke every token" command still
+ * reach it.
+ *
+ * The plaintext is minted once and never stored. What rests in the database is
+ * a SHA-256 digest of the secret, so a leaked database is not a leaked
+ * credential, and the token id in front of the secret makes verification one
+ * indexed lookup instead of a scan over every account's digests.
+ */
+/** Marks a credential as an integration token in a log line, a paste or a grep. */
+export const QA_SERVICE_TOKEN_PREFIX = "qsat";
+const SECRET_BYTES = 32;
+/**
+ * Normalize a scope list: known scopes only, duplicates dropped, declared
+ * order preserved. An unknown scope is not an error the caller can see
+ * through — it is simply not granted.
+ * @param values - scope tokens as configured or requested.
+ * @returns the accepted scopes.
+ */
+export function normalizeServiceTokenScopes(values) {
+    const seen = new Set();
+    const accepted = [];
+    for (const value of values) {
+        const candidate = typeof value === "string" ? value.trim() : "";
+        if (candidate === "" || seen.has(candidate))
+            continue;
+        seen.add(candidate);
+        if (QA_SERVICE_TOKEN_SCOPES.includes(candidate) &&
+            !accepted.includes(candidate)) {
+            accepted.push(candidate);
+        }
+    }
+    return Object.freeze(accepted);
+}
+/** The digest of one secret, hex encoded, in the one shape verification expects. */
+export function serviceTokenHash(secret) {
+    return createHash("sha256").update(secret).digest("hex");
+}
+/**
+ * Mint one token. The id is a UUID so the operator can name a token in a
+ * revocation request without ever holding its plaintext again.
+ * @returns the plaintext, its id and the digest storage keeps.
+ */
+export function mintServiceToken() {
+    const tokenId = randomUUID();
+    const secret = randomBytes(SECRET_BYTES).toString("base64url");
+    return {
+        token: `${QA_SERVICE_TOKEN_PREFIX}.${tokenId}.${secret}`,
+        tokenId,
+        hash: serviceTokenHash(secret),
+    };
+}
+/**
+ * Split a presented token. Anything that is not exactly
+ * `qsat.<uuid>.<secret>` is refused here rather than looked up: a malformed
+ * credential must not reach the database at all.
+ * @param token - the raw `Authorization: Bearer` value.
+ * @returns the id and secret, or null.
+ */
+export function parseServiceToken(token) {
+    if (typeof token !== "string")
+        return null;
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    const [prefix, tokenId, secret] = parts;
+    if (prefix !== QA_SERVICE_TOKEN_PREFIX)
+        return null;
+    if (tokenId === undefined || secret === undefined)
+        return null;
+    if (!/^[0-9a-f-]{36}$/u.test(tokenId) || secret.length === 0)
+        return null;
+    return { tokenId, secret };
+}
+/**
+ * Constant-time digest comparison. Both sides are hex digests of a fixed
+ * length, so the length check leaks nothing beyond "this is not a digest".
+ * @param secret - the presented secret.
+ * @param hash - the digest storage holds.
+ * @returns whether they are the same secret.
+ */
+export function serviceTokenMatches(secret, hash) {
+    const expected = serviceTokenHash(secret);
+    if (expected.length !== hash.length)
+        return false;
+    return timingSafeEqual(Buffer.from(expected), Buffer.from(hash));
+}
+//# sourceMappingURL=service-token.js.map

package/lib/accounts/service-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-token.js","sourceRoot":"","sources":["../../src/accounts/service-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,iCAAiC,CAAC;AAGzC,8EAA8E;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,GAC9B,CAAC;AAGF;;;;;;;;;;;;;;;;;GAiBG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C,MAAM,YAAY,GAAG,EAAE,CAAC;AAiBxB;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAyB;IAEzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,SAAS,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QACtD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,IACG,uBAA6C,CAAC,QAAQ,CAAC,SAAS,CAAC;YAClE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAgC,CAAC,EACpD,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,SAAgC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,OAAO;QACL,KAAK,EAAE,GAAG,uBAAuB,IAAI,OAAO,IAAI,MAAM,EAAE;QACxD,OAAO;QACP,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IACxC,IAAI,MAAM,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAAY;IAC9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC"}