admindb 1.2.0 → 2.0.0

package/dist/app.d.ts

@@ -1,20 +1,41 @@
 import express from 'express';
-import { SqliteDatabase } from './db/database';
+import type { IDatabase, PostgresOptions } from './db/types';
 import { DbManager } from './db/manager';
-import { type Logger, type LogLevel } from './logger';
+import { type Logger, type LogLevel } from './utils/logger';
+import { type AuthConfig } from './auth';
 export interface AppOptions {
-    /** Path to the SQLite file (single-db mode). Defaults to `admindb.db`. */
+    /** Path to the SQLite file (single-db mode) or connection string. Defaults to `admindb.db`. */
     dbPath?: string;
+    /** PostgreSQL or database connection string (e.g. `postgresql://user:pass@host:5432/db`). */
+    connection?: string;
+    /** Explicit PostgreSQL connection options. */
+    pgOptions?: PostgresOptions;
     /** URL prefix used by templates/static assets (e.g. `/admin`). Defaults to `''`. */
     basePath?: string;
     logger?: Logger;
     logLevel?: LogLevel;
     /** Provide an existing database instance (single-db embedding). */
-    db?: SqliteDatabase;
+    db?: IDatabase;
     /** Enable multi-database mode with a manager over a directory of `.db` files. */
     manager?: DbManager;
     /** Open the database read-only — all write routes are rejected with 403. */
     readonly?: boolean;
+    /**
+     * Serverless mode flag.
+     * When enabled (or auto-detected in Vercel/AWS Lambda/Netlify/etc.),
+     * all write operations, mutations, schema alterations, and seeder generators
+     * are disabled, enforcing strict read-only safety for ephemeral environments.
+     *
+     * Defaults to `undefined` (auto-detected via environment).
+     */
+    serverless?: boolean;
+    /**
+     * Authentication configuration.
+     * - `true` (default): authentication enabled with default or env credentials.
+     * - `false`: completely disables authentication (no protection / developer's own auth).
+     * - `{ username, password, secret, ... }`: custom credentials and options.
+     */
+    auth?: boolean | AuthConfig;
     /**
      * Manager mode: show the filesystem file-browser on the databases landing
      * page. Defaults to `true`. Set to `false` to disable browsing (e.g. when the

package/dist/app.js

@@ -8,12 +8,16 @@ const express_1 = __importDefault(require("express"));
 const node_path_1 = __importDefault(require("node:path"));
 const express_handlebars_1 = require("express-handlebars");
 const database_1 = require("./db/database");
-const logger_1 = require("./logger");
+const postgres_1 = require("./db/postgres");
+const logger_1 = require("./utils/logger");
 const pages_1 = require("./routes/pages");
-const api_1 = require("./routes/api");
+const index_1 = require("./routes/api/index");
 const databases_1 = require("./routes/databases");
-const args_1 = require("./args");
-const util_1 = require("./util");
+const args_1 = require("./cli/args");
+const common_1 = require("./utils/common");
+const icons_1 = require("./utils/icons");
+const serverless_1 = require("./serverless");
+const auth_1 = require("./auth");
 /** Installed package version, exposed to every template as `{{version}}`. */
 const APP_VERSION = (0, args_1.getPackageVersion)();
 /**
@@ -32,7 +36,7 @@ const APP_VERSION = (0, args_1.getPackageVersion)();
 function createRouter(options = {}) {
     return options.manager ? createManagerApp(options) : createSingleDbApp(options);
 }
-function setupViewEngine(app, logger) {
+function setupViewEngine(app, _logger) {
     app.engine('hbs', (0, express_handlebars_1.engine)({
         extname: '.hbs',
         defaultLayout: 'main',
@@ -46,12 +50,16 @@ function setupViewEngine(app, logger) {
                 const s = v == null ? '' : String(v);
                 return s.length > n ? `${s.slice(0, n)}…` : s;
             },
-            json: (v) => JSON.stringify(v).replace(/</g, '\\u003c'),
+            json: (v) => (JSON.stringify(v ?? null) ?? 'null').replace(/</g, '\\u003c'),
             add: (a, b) => Number(a) + Number(b),
             sub: (a, b) => Number(a) - Number(b),
             gt: (a, b) => Number(a) > Number(b),
             lt: (a, b) => Number(a) < Number(b),
             join: (arr, sep) => (Array.isArray(arr) ? arr.join(String(sep ?? ',')) : String(arr ?? '')),
+            icon: (name, options) => {
+                const customClass = (options && options.hash && options.hash.class) || undefined;
+                return (0, icons_1.renderIcon)(String(name ?? ''), customClass);
+            },
         },
     }));
     app.set('view engine', 'hbs');
@@ -69,23 +77,51 @@ function addErrorHandlers(app, logger) {
     app.use((err, req, res, _next) => {
         logger.error('Unhandled error', err);
         if (req.path.startsWith('/api/')) {
-            return res.status(500).json({ success: false, error: (0, util_1.errorMessage)(err) });
+            return res.status(500).json({ success: false, error: (0, common_1.errorMessage)(err) });
         }
-        res.status(500).render('pages/error', { title: 'Error', status: 500, error: (0, util_1.errorMessage)(err) });
+        res.status(500).render('pages/error', { title: 'Error', status: 500, error: (0, common_1.errorMessage)(err) });
     });
 }
 /** Single-database app (also used as the per-database app in multi-db mode). */
 function createSingleDbApp(options) {
+    const isServerless = options.serverless !== undefined ? options.serverless : (0, serverless_1.isServerlessEnvironment)();
+    const rawTarget = options.connection || options.dbPath || '';
+    const isPg = Boolean(options.pgOptions) ||
+        (typeof rawTarget === 'string' && (rawTarget.startsWith('postgres://') || rawTarget.startsWith('postgresql://'))) ||
+        options.db?.dialect === 'postgres';
+    // In serverless environments, SQLite local files are ephemeral/read-only,
+    // whereas PostgreSQL connects to a remote networked database and is fully editable.
+    const readonly = options.readonly !== undefined
+        ? Boolean(options.readonly)
+        : (isServerless && !isPg);
     const basePath = (options.basePath ?? '').replace(/\/+$/, '');
     const logger = options.logger ?? (0, logger_1.createLogger)(options.logLevel ?? 'info', 'admindb');
-    const db = options.db ?? new database_1.SqliteDatabase(options.dbPath ?? 'admindb.db', logger, { readonly: options.readonly });
+    let db;
+    if (options.db) {
+        db = options.db;
+    }
+    else {
+        if (isPg) {
+            const conn = options.pgOptions || rawTarget;
+            db = new postgres_1.PostgresDatabase(conn, logger, { readonly });
+        }
+        else {
+            db = new database_1.SqliteDatabase(options.dbPath ?? 'admindb.db', logger, { readonly });
+        }
+    }
     const databasesUrl = options.databasesUrl;
+    const authConfig = (0, auth_1.resolveAuthConfig)(options.auth);
     const router = (0, express_1.default)();
     router.disable('x-powered-by');
     // Static assets (relative to the mount point, so a prefix "just works").
     router.use(express_1.default.static(node_path_1.default.join(__dirname, 'public')));
     setupViewEngine(router, logger);
     router.use(express_1.default.json({ limit: '10mb' }));
+    router.use(express_1.default.urlencoded({ extended: false }));
+    // Register authentication endpoints (/login, /logout)
+    (0, auth_1.registerAuthRoutes)(router, authConfig, basePath, logger);
+    // Authentication gatekeeper middleware
+    router.use((0, auth_1.createAuthMiddleware)(authConfig, basePath, logger));
     // Page locals (skipped for API + static paths).
     router.use(async (req, res, next) => {
         try {
@@ -93,11 +129,18 @@ function createSingleDbApp(options) {
             res.locals.currentPath = req.path;
             res.locals.currentTable = null;
             res.locals.dbPath = db.path;
-            res.locals.dbId = options.dbId ?? null;
+            res.locals.dbId = options.dbId ?? (db.dialect === 'postgres' ? 'PostgreSQL' : (node_path_1.default.basename(db.path) || 'SQLite'));
+            res.locals.dialect = db.dialect;
+            res.locals.isPostgres = db.dialect === 'postgres';
+            res.locals.isSqlite = db.dialect === 'sqlite';
+            res.locals.dialectName = db.dialect === 'postgres' ? 'PostgreSQL' : 'SQLite';
             res.locals.databasesUrl = databasesUrl ?? null;
             res.locals.databasesMode = false;
             res.locals.readonly = db.isReadOnly;
+            res.locals.serverless = isServerless;
             res.locals.version = APP_VERSION;
+            res.locals.authEnabled = authConfig.enabled;
+            res.locals.isDefaultPassword = authConfig.isDefaultPassword;
             if (!req.path.startsWith('/api/')) {
                 const all = await db.listTables();
                 const names = (all.data ?? []).map((t) => t.name);
@@ -111,21 +154,28 @@ function createSingleDbApp(options) {
         }
     });
     (0, pages_1.registerPages)(router, { db, logger });
-    (0, api_1.registerApi)(router, { db, logger });
+    (0, index_1.registerApi)(router, { db, logger });
     addErrorHandlers(router, logger);
     return router;
 }
 /** Multi-database app: databases landing page + a per-database sub-app per file. */
 function createManagerApp(options) {
+    const isServerless = options.serverless !== undefined ? options.serverless : (0, serverless_1.isServerlessEnvironment)();
+    const readonly = isServerless || Boolean(options.readonly);
     const manager = options.manager;
     const basePath = (options.basePath ?? '').replace(/\/+$/, '');
     const logger = options.logger ?? (0, logger_1.createLogger)(options.logLevel ?? 'info', 'admindb');
-    const readonly = !!options.readonly;
+    const authConfig = (0, auth_1.resolveAuthConfig)(options.auth);
     const app = (0, express_1.default)();
     app.disable('x-powered-by');
     app.use(express_1.default.static(node_path_1.default.join(__dirname, 'public')));
     setupViewEngine(app, logger);
     app.use(express_1.default.json({ limit: '10mb' }));
+    app.use(express_1.default.urlencoded({ extended: false }));
+    // Register authentication endpoints (/login, /logout)
+    (0, auth_1.registerAuthRoutes)(app, authConfig, basePath, logger);
+    // Authentication gatekeeper middleware
+    app.use((0, auth_1.createAuthMiddleware)(authConfig, basePath, logger));
     // Locals for the databases landing page.
     app.use(async (req, res, next) => {
         try {
@@ -137,7 +187,10 @@ function createManagerApp(options) {
             res.locals.databasesUrl = null;
             res.locals.databasesMode = true;
             res.locals.readonly = readonly;
+            res.locals.serverless = isServerless;
             res.locals.version = APP_VERSION;
+            res.locals.authEnabled = authConfig.enabled;
+            res.locals.isDefaultPassword = authConfig.isDefaultPassword;
             if (!req.path.startsWith('/api/')) {
                 res.locals.tables = [];
                 res.locals.internalTables = [];
@@ -155,7 +208,7 @@ function createManagerApp(options) {
         logger,
         basePath,
         readonly,
-        allowBrowse: options.allowBrowse,
+        allowBrowse: isServerless ? false : options.allowBrowse,
         browseRoot: options.browseRoot,
         invalidate: (id) => subApps.delete(id),
     });
@@ -171,17 +224,28 @@ function createManagerApp(options) {
                 error: `Database "${dbId}" does not exist.`,
             });
         }
+        const rawRo = req.query.readonly;
+        if (rawRo !== undefined) {
+            const explicitRo = rawRo === '1' || rawRo === 'true';
+            if (!readonly || explicitRo) {
+                manager.setReadonly(dbId, explicitRo);
+                subApps.delete(dbId);
+            }
+        }
         let sub = subApps.get(dbId);
         if (!sub) {
             const subBase = `${basePath ? basePath : ''}/${encodeURIComponent(dbId)}`;
+            const effectiveRo = readonly || manager.isDbReadOnly(dbId);
             sub = createSingleDbApp({
-                db: manager.open(dbId),
+                db: manager.open(dbId, effectiveRo),
                 basePath: subBase,
                 logger,
                 logLevel: options.logLevel,
                 dbId,
                 databasesUrl: `${basePath ? basePath : ''}/`,
-                readonly,
+                readonly: effectiveRo,
+                serverless: isServerless,
+                auth: authConfig,
             });
             subApps.set(dbId, sub);
         }

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":";;;;;AA2DA,oCAEC;AA7DD,sDAA8B;AAC9B,0DAA6B;AAC7B,2DAA4C;AAC5C,4CAA+C;AAE/C,qCAAoE;AACpE,0CAA+C;AAC/C,sCAA2C;AAC3C,kDAA6D;AAC7D,iCAA2C;AAC3C,iCAAsC;AAEtC,6EAA6E;AAC7E,MAAM,WAAW,GAAG,IAAA,wBAAiB,GAAE,CAAC;AAiCxC;;;;;;;;;;;;GAYG;AACH,SAAgB,YAAY,CAAC,UAAsB,EAAE;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB,EAAE,MAAc;IAC3D,GAAG,CAAC,MAAM,CACR,KAAK,EACL,IAAA,2BAAM,EAAC;QACL,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,MAAM;QACrB,UAAU,EAAE,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC;QACpD,WAAW,EAAE,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC;QACtD,OAAO,EAAE;YACP,EAAE,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;YACvC,UAAU,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACnF,MAAM,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YACrD,QAAQ,EAAE,CAAC,CAAU,EAAE,CAAS,EAAE,EAAE;gBAClC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACrC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;YAChE,GAAG,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;YACtD,GAAG,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;YACtD,EAAE,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;YACrD,EAAE,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;YACrD,IAAI,EAAE,CAAC,GAAY,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;SAC7G;KACF,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAoB,EAAE,MAAc;IAC5D,eAAe;IACf,GAAG,CAAC,GAAG,CAAC,CAAC,GAAoB,EAAE,GAAqB,EAAE,EAAE;QACtD,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;IAC9H,CAAC,CAAC,CAAC;IAEH,yBAAyB;IACzB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAU,EAAE,GAAoB,EAAE,GAAqB,EAAE,KAA2B,EAAE,EAAE;QAC/F,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAA,mBAAY,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAA,mBAAY,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,SAAS,iBAAiB,CAAC,OAAmB;IAC5C,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAA,qBAAY,EAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,yBAAc,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpH,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAA,iBAAO,GAAE,CAAC;IACzB,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE/B,yEAAyE;IACzE,MAAM,CAAC,GAAG,CAAC,iBAAO,CAAC,MAAM,CAAC,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE3D,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAE5C,gDAAgD;IAChD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,KAAK,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,WAAW,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,IAAA,iBAAW,EAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,gBAAgB,CAAC,OAAmB;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAQ,CAAC;IACjC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAA,qBAAY,EAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,MAAM,CAAC,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxD,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,yCAAyC;IACzC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,WAAW,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,cAAc,GAAG,EAAE,CAAC;YACjC,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,IAAA,mCAAuB,EAAC,GAAG,EAAE;QAC3B,OAAO;QACP,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;KACvC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;QAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,IAAI,mBAAmB,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE;gBAC3C,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,aAAa,IAAI,mBAAmB;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1E,GAAG,GAAG,iBAAiB,CAAC;gBACtB,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBACtB,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI;gBACJ,YAAY,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG;gBAC5C,QAAQ;aACT,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":";;;;;AA2FA,oCAEC;AA7FD,sDAA8B;AAC9B,0DAA6B;AAC7B,2DAA4C;AAC5C,4CAA+C;AAC/C,4CAAiD;AAGjD,2CAA0E;AAC1E,0CAA+C;AAC/C,8CAAiD;AACjD,kDAA6D;AAC7D,qCAA+C;AAC/C,2CAA8C;AAC9C,yCAA2C;AAC3C,6CAAuD;AAEvD,iCAKgB;AAEhB,6EAA6E;AAC7E,MAAM,WAAW,GAAG,IAAA,wBAAiB,GAAE,CAAC;AAsDxC;;;;;;;;;;;;GAYG;AACH,SAAgB,YAAY,CAAC,UAAsB,EAAE;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB,EAAE,OAAe;IAC5D,GAAG,CAAC,MAAM,CACR,KAAK,EACL,IAAA,2BAAM,EAAC;QACL,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,MAAM;QACrB,UAAU,EAAE,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC;QACpD,WAAW,EAAE,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC;QACtD,OAAO,EAAE;YACP,EAAE,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;YACvC,UAAU,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACnF,MAAM,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YACrD,QAAQ,EAAE,CAAC,CAAU,EAAE,CAAS,EAAE,EAAE;gBAClC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACrC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;YACpF,GAAG,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;YACtD,GAAG,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;YACtD,EAAE,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;YACrD,EAAE,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;YACrD,IAAI,EAAE,CAAC,GAAY,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAC5G,IAAI,EAAE,CAAC,IAAa,EAAE,OAAa,EAAE,EAAE;gBACrC,MAAM,WAAW,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;gBACjF,OAAO,IAAA,kBAAU,EAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YACrD,CAAC;SACF;KACF,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAElD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAoB,EAAE,MAAc;IAC5D,eAAe;IACf,GAAG,CAAC,GAAG,CAAC,CAAC,GAAoB,EAAE,GAAqB,EAAE,EAAE;QACtD,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;IAC9H,CAAC,CAAC,CAAC;IAEH,yBAAyB;IACzB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAU,EAAE,GAAoB,EAAE,GAAqB,EAAE,KAA2B,EAAE,EAAE;QAC/F,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAA,qBAAY,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAA,qBAAY,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,SAAS,iBAAiB,CAAC,OAAmB;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAA,oCAAuB,GAAE,CAAC;IACvG,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IAC7D,MAAM,IAAI,GACR,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;QACjH,OAAO,CAAC,EAAE,EAAE,OAAO,KAAK,UAAU,CAAC;IAErC,0EAA0E;IAC1E,oFAAoF;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS;QAC7C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3B,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,CAAC;IAE5B,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAA,qBAAY,EAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,EAAE,SAAS,CAAC,CAAC;IAErF,IAAI,EAAa,CAAC;IAClB,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC;YAC5C,EAAE,GAAG,IAAI,2BAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,IAAI,yBAAc,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAA,wBAAiB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,IAAA,iBAAO,GAAE,CAAC;IACzB,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE/B,yEAAyE;IACzE,MAAM,CAAC,GAAG,CAAC,iBAAO,CAAC,MAAM,CAAC,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE3D,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,iBAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAEpD,sDAAsD;IACtD,IAAA,yBAAkB,EAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEzD,uCAAuC;IACvC,MAAM,CAAC,GAAG,CAAC,IAAA,2BAAoB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/D,gDAAgD;IAChD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,mBAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC;YACpH,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,OAAO,KAAK,UAAU,CAAC;YAClD,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,EAAE,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7E,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,KAAK,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,YAAY,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,WAAW,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,IAAA,mBAAW,EAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,gBAAgB,CAAC,OAAmB;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAA,oCAAuB,GAAE,CAAC;IACvG,MAAM,QAAQ,GAAG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAQ,CAAC;IACjC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAA,qBAAY,EAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,IAAA,wBAAiB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,MAAM,CAAC,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxD,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAEjD,sDAAsD;IACtD,IAAA,yBAAkB,EAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEtD,uCAAuC;IACvC,GAAG,CAAC,GAAG,CAAC,IAAA,2BAAoB,EAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAE5D,yCAAyC;IACzC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,YAAY,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,WAAW,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,cAAc,GAAG,EAAE,CAAC;YACjC,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,IAAA,mCAAuB,EAAC,GAAG,EAAE;QAC3B,OAAO;QACP,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW;QACvD,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;KACvC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;QAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,IAAI,mBAAmB,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE;gBAC3C,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,aAAa,IAAI,mBAAmB;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;YACrD,IAAI,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAC5B,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBACtC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1E,MAAM,WAAW,GAAG,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC3D,GAAG,GAAG,iBAAiB,CAAC;gBACtB,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;gBACnC,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI;gBACJ,YAAY,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG;gBAC5C,QAAQ,EAAE,WAAW;gBACrB,UAAU,EAAE,YAAY;gBACxB,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAGH,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/auth/config.d.ts

@@ -0,0 +1,19 @@
+import { type AuthConfig, type ResolvedAuthConfig } from './types';
+/**
+ * Clears the in-memory fallback secret cache (primarily for testing).
+ */
+export declare function resetPersistentSecretCache(): void;
+/**
+ * Returns a persistent secret key for signing session cookies.
+ *
+ * Priority order:
+ * 1. `ADMINDB_SECRET` or `SESSION_SECRET` environment variables.
+ * 2. `ADMINDB_SECRET_FILE` path if specified in environment.
+ * 3. User home directory `.admindb-secret` (or temp directory if home is not writable).
+ * 4. In-memory random fallback if filesystem is completely read-only.
+ */
+export declare function getOrCreatePersistentSecret(env?: NodeJS.ProcessEnv): string;
+/**
+ * Resolves the authentication options against environment variables.
+ */
+export declare function resolveAuthConfig(optionsAuth?: boolean | AuthConfig, env?: NodeJS.ProcessEnv): ResolvedAuthConfig;

package/dist/auth/config.js

@@ -0,0 +1,147 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetPersistentSecretCache = resetPersistentSecretCache;
+exports.getOrCreatePersistentSecret = getOrCreatePersistentSecret;
+exports.resolveAuthConfig = resolveAuthConfig;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const types_1 = require("./types");
+// In-memory cache of resolved secret to avoid repeated disk reads per process
+let cachedFallbackSecret = null;
+/**
+ * Clears the in-memory fallback secret cache (primarily for testing).
+ */
+function resetPersistentSecretCache() {
+    cachedFallbackSecret = null;
+}
+/**
+ * Returns a persistent secret key for signing session cookies.
+ *
+ * Priority order:
+ * 1. `ADMINDB_SECRET` or `SESSION_SECRET` environment variables.
+ * 2. `ADMINDB_SECRET_FILE` path if specified in environment.
+ * 3. User home directory `.admindb-secret` (or temp directory if home is not writable).
+ * 4. In-memory random fallback if filesystem is completely read-only.
+ */
+function getOrCreatePersistentSecret(env = process.env) {
+    const envSecret = env.ADMINDB_SECRET ?? env.SESSION_SECRET;
+    if (envSecret && String(envSecret).trim()) {
+        return String(envSecret).trim();
+    }
+    // If a custom secret file is specified, don't use default home cache
+    const customSecretFile = env.ADMINDB_SECRET_FILE ? String(env.ADMINDB_SECRET_FILE).trim() : undefined;
+    if (!customSecretFile && cachedFallbackSecret) {
+        return cachedFallbackSecret;
+    }
+    const candidatePaths = [];
+    if (customSecretFile) {
+        candidatePaths.push(node_path_1.default.resolve(customSecretFile));
+    }
+    else {
+        try {
+            const home = node_os_1.default.homedir();
+            if (home) {
+                candidatePaths.push(node_path_1.default.join(home, '.admindb-secret'));
+            }
+        }
+        catch {
+            /* ignore */
+        }
+        try {
+            const tmp = node_os_1.default.tmpdir();
+            if (tmp) {
+                candidatePaths.push(node_path_1.default.join(tmp, '.admindb-secret'));
+            }
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    // 1. Try reading existing secret from candidate paths
+    for (const filePath of candidatePaths) {
+        try {
+            if ((0, node_fs_1.existsSync)(filePath)) {
+                const content = (0, node_fs_1.readFileSync)(filePath, 'utf8').trim();
+                if (content.length >= 16) {
+                    if (!customSecretFile) {
+                        cachedFallbackSecret = content;
+                    }
+                    return content;
+                }
+            }
+        }
+        catch {
+            // Continue to next candidate or write attempt
+        }
+    }
+    // 2. Generate new secret and attempt writing to the first writable candidate path
+    const newSecret = (0, node_crypto_1.randomBytes)(32).toString('hex');
+    for (const filePath of candidatePaths) {
+        try {
+            const dir = node_path_1.default.dirname(filePath);
+            if (!(0, node_fs_1.existsSync)(dir)) {
+                (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+            }
+            (0, node_fs_1.writeFileSync)(filePath, newSecret, { encoding: 'utf8', mode: 0o600 });
+            if (!customSecretFile) {
+                cachedFallbackSecret = newSecret;
+            }
+            return newSecret;
+        }
+        catch {
+            // Continue to next candidate if write fails
+        }
+    }
+    // 3. Last-resort fallback to in-memory secret if disk is not writable
+    if (!customSecretFile) {
+        cachedFallbackSecret = newSecret;
+    }
+    return newSecret;
+}
+/**
+ * Resolves the authentication options against environment variables.
+ */
+function resolveAuthConfig(optionsAuth, env = process.env) {
+    // Check if explicitly disabled via options or environment variable
+    const envDisabled = ['0', 'false', 'no', 'off'].includes(String(env.ADMINDB_AUTH ?? '').trim().toLowerCase()) ||
+        ['1', 'true', 'yes'].includes(String(env.ADMINDB_NO_AUTH ?? env.ADMINDB_DISABLE_AUTH ?? '').trim().toLowerCase());
+    let enabled = true;
+    let username = (env.ADMINDB_USERNAME ?? env.ADMINDB_USER) ? String(env.ADMINDB_USERNAME ?? env.ADMINDB_USER).trim() : types_1.DEFAULT_USERNAME;
+    let password = (env.ADMINDB_PASSWORD ?? env.ADMINDB_PASS) ? String(env.ADMINDB_PASSWORD ?? env.ADMINDB_PASS).trim() : types_1.DEFAULT_PASSWORD_HASH;
+    let secret = (env.ADMINDB_SECRET ?? env.SESSION_SECRET)
+        ? String(env.ADMINDB_SECRET ?? env.SESSION_SECRET).trim()
+        : getOrCreatePersistentSecret(env);
+    let sessionDurationMs = types_1.DEFAULT_SESSION_DURATION_MS;
+    if (optionsAuth === false || envDisabled) {
+        enabled = false;
+    }
+    else if (typeof optionsAuth === 'object' && optionsAuth !== null) {
+        if (optionsAuth.enabled === false)
+            enabled = false;
+        if (optionsAuth.username !== undefined)
+            username = String(optionsAuth.username).trim();
+        if (optionsAuth.password !== undefined)
+            password = String(optionsAuth.password).trim();
+        if (optionsAuth.secret !== undefined && String(optionsAuth.secret).trim()) {
+            secret = String(optionsAuth.secret).trim();
+        }
+        if (optionsAuth.sessionDurationMs !== undefined)
+            sessionDurationMs = optionsAuth.sessionDurationMs;
+    }
+    const isDefaultPassword = username === types_1.DEFAULT_USERNAME &&
+        (password === types_1.DEFAULT_PASSWORD_HASH || password === 'admin');
+    return {
+        enabled,
+        username,
+        password,
+        secret,
+        sessionDurationMs,
+        isDefaultPassword,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":";;;;;AAkBA,gEAEC;AAWD,kEA2EC;AAKD,8CAyCC;AAxJD,6CAA0C;AAC1C,qCAA6E;AAC7E,sDAAyB;AACzB,0DAA6B;AAC7B,mCAMiB;AAEjB,8EAA8E;AAC9E,IAAI,oBAAoB,GAAkB,IAAI,CAAC;AAE/C;;GAEG;AACH,SAAgB,0BAA0B;IACxC,oBAAoB,GAAG,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,2BAA2B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,CAAC;IAC3D,IAAI,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,qEAAqE;IACrE,MAAM,gBAAgB,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,IAAI,CAAC,gBAAgB,IAAI,oBAAoB,EAAE,CAAC;QAC9C,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,IAAI,gBAAgB,EAAE,CAAC;QACrB,cAAc,CAAC,IAAI,CAAC,mBAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,iBAAE,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,IAAI,EAAE,CAAC;gBACT,cAAc,CAAC,IAAI,CAAC,mBAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,iBAAE,CAAC,MAAM,EAAE,CAAC;YACxB,IAAI,GAAG,EAAE,CAAC;gBACR,cAAc,CAAC,IAAI,CAAC,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAA,sBAAY,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;oBACzB,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBACtB,oBAAoB,GAAG,OAAO,CAAC;oBACjC,CAAC;oBACD,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,MAAM,SAAS,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,mBAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,IAAA,oBAAU,EAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,CAAC;YACD,IAAA,uBAAa,EAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,oBAAoB,GAAG,SAAS,CAAC;YACnC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,oBAAoB,GAAG,SAAS,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAC/B,WAAkC,EAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,mEAAmE;IACnE,MAAM,WAAW,GACf,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzF,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAEpH,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,QAAQ,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,wBAAgB,CAAC;IACvI,IAAI,QAAQ,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,6BAAqB,CAAC;IAC5I,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,CAAC;QACrD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE;QACzD,CAAC,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,iBAAiB,GAAG,mCAA2B,CAAC;IAEpD,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,EAAE,CAAC;QACzC,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACnE,IAAI,WAAW,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,GAAG,KAAK,CAAC;QACnD,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS;YAAE,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACvF,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS;YAAE,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACvF,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1E,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,WAAW,CAAC,iBAAiB,KAAK,SAAS;YAAE,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,CAAC;IACrG,CAAC;IAED,MAAM,iBAAiB,GACrB,QAAQ,KAAK,wBAAgB;QAC7B,CAAC,QAAQ,KAAK,6BAAqB,IAAI,QAAQ,KAAK,OAAO,CAAC,CAAC;IAE/D,OAAO;QACL,OAAO;QACP,QAAQ;QACR,QAAQ;QACR,MAAM;QACN,iBAAiB;QACjB,iBAAiB;KAClB,CAAC;AACJ,CAAC"}

package/dist/auth/crypto.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Generates a secure scrypt password hash with a random or provided salt.
+ * Format: `scrypt:<saltHex>:<derivedKeyHex>`
+ */
+export declare function hashPassword(password: string, salt?: string): string;
+/**
+ * Constant-time comparison between two strings to prevent timing attacks.
+ */
+export declare function constantTimeCompare(a: string, b: string): boolean;
+/**
+ * Verifies a candidate plaintext password against a stored password or scrypt hash.
+ */
+export declare function verifyPassword(candidatePassword: string, storedPasswordOrHash: string): boolean;
+/**
+ * Parses raw Cookie header string into key-value map.
+ */
+export declare function parseCookies(cookieHeader?: string): Record<string, string>;
+/**
+ * Creates a tamper-proof signed session token using HMAC-SHA256.
+ * Format: `<base64url(username)>.<expiresAtTimestamp>.<hmacSignature>`
+ */
+export declare function createSessionToken(username: string, secret: string, durationMs?: number): string;
+/**
+ * Verifies a signed session token in constant time.
+ * Returns the authenticated username if valid and non-expired, or null otherwise.
+ */
+export declare function verifySessionToken(token: string, secret: string, expectedUser?: string): string | null;

package/dist/auth/crypto.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashPassword = hashPassword;
+exports.constantTimeCompare = constantTimeCompare;
+exports.verifyPassword = verifyPassword;
+exports.parseCookies = parseCookies;
+exports.createSessionToken = createSessionToken;
+exports.verifySessionToken = verifySessionToken;
+const node_crypto_1 = require("node:crypto");
+const types_1 = require("./types");
+/**
+ * Generates a secure scrypt password hash with a random or provided salt.
+ * Format: `scrypt:<saltHex>:<derivedKeyHex>`
+ */
+function hashPassword(password, salt) {
+    const saltHex = salt || (0, node_crypto_1.randomBytes)(16).toString('hex');
+    const derivedKey = (0, node_crypto_1.scryptSync)(password, saltHex, 64).toString('hex');
+    return `scrypt:${saltHex}:${derivedKey}`;
+}
+/**
+ * Constant-time comparison between two strings to prevent timing attacks.
+ */
+function constantTimeCompare(a, b) {
+    try {
+        const bufA = Buffer.from(String(a), 'utf8');
+        const bufB = Buffer.from(String(b), 'utf8');
+        if (bufA.length !== bufB.length) {
+            // Dummy comparison to prevent timing leak on length mismatch
+            (0, node_crypto_1.timingSafeEqual)(bufA, bufA);
+            return false;
+        }
+        return (0, node_crypto_1.timingSafeEqual)(bufA, bufB);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verifies a candidate plaintext password against a stored password or scrypt hash.
+ */
+function verifyPassword(candidatePassword, storedPasswordOrHash) {
+    if (typeof candidatePassword !== 'string' || typeof storedPasswordOrHash !== 'string') {
+        return false;
+    }
+    // Handle scrypt formatted hash: `scrypt:<salt>:<hash>`
+    if (storedPasswordOrHash.startsWith('scrypt:')) {
+        const parts = storedPasswordOrHash.split(':');
+        if (parts.length === 3 && parts[1] && parts[2]) {
+            const salt = parts[1];
+            const expectedKeyHex = parts[2];
+            try {
+                const derivedKey = (0, node_crypto_1.scryptSync)(candidatePassword, salt, 64).toString('hex');
+                return constantTimeCompare(derivedKey, expectedKeyHex);
+            }
+            catch {
+                return false;
+            }
+        }
+    }
+    // Fallback for plaintext passwords (legacy or plain string configs)
+    return constantTimeCompare(candidatePassword, storedPasswordOrHash);
+}
+/**
+ * Parses raw Cookie header string into key-value map.
+ */
+function parseCookies(cookieHeader) {
+    const cookies = {};
+    if (!cookieHeader)
+        return cookies;
+    for (const pair of cookieHeader.split(';')) {
+        const idx = pair.indexOf('=');
+        if (idx === -1)
+            continue;
+        const key = pair.slice(0, idx).trim();
+        let val = pair.slice(idx + 1).trim();
+        if (val.startsWith('"') && val.endsWith('"') && val.length >= 2) {
+            val = val.slice(1, -1);
+        }
+        if (key) {
+            try {
+                cookies[key] = decodeURIComponent(val);
+            }
+            catch {
+                cookies[key] = val;
+            }
+        }
+    }
+    return cookies;
+}
+/**
+ * Creates a tamper-proof signed session token using HMAC-SHA256.
+ * Format: `<base64url(username)>.<expiresAtTimestamp>.<hmacSignature>`
+ */
+function createSessionToken(username, secret, durationMs = types_1.DEFAULT_SESSION_DURATION_MS) {
+    const expiresAt = Date.now() + durationMs;
+    const userPayload = Buffer.from(username, 'utf8').toString('base64url');
+    const data = `${userPayload}.${expiresAt}`;
+    const signature = (0, node_crypto_1.createHmac)('sha256', secret).update(data).digest('base64url');
+    return `${data}.${signature}`;
+}
+/**
+ * Verifies a signed session token in constant time.
+ * Returns the authenticated username if valid and non-expired, or null otherwise.
+ */
+function verifySessionToken(token, secret, expectedUser) {
+    if (!token || typeof token !== 'string')
+        return null;
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return null;
+    const [userPayload, expiresStr, providedSignature] = parts;
+    const data = `${userPayload}.${expiresStr}`;
+    const expectedSignature = (0, node_crypto_1.createHmac)('sha256', secret).update(data).digest('base64url');
+    if (!constantTimeCompare(providedSignature, expectedSignature)) {
+        return null;
+    }
+    const expiresAt = Number.parseInt(expiresStr, 10);
+    if (!Number.isFinite(expiresAt) || Date.now() > expiresAt) {
+        return null; // Expired
+    }
+    let username;
+    try {
+        username = Buffer.from(userPayload, 'base64url').toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    if (expectedUser && !constantTimeCompare(username, expectedUser)) {
+        return null;
+    }
+    return username;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/auth/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":";;AAOA,oCAIC;AAKD,kDAaC;AAKD,wCAsBC;AAKD,oCAoBC;AAMD,gDAMC;AAMD,gDA8BC;AAjID,6CAAmF;AACnF,mCAAsD;AAEtD;;;GAGG;AACH,SAAgB,YAAY,CAAC,QAAgB,EAAE,IAAa;IAC1D,MAAM,OAAO,GAAG,IAAI,IAAI,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,UAAU,OAAO,IAAI,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,CAAS,EAAE,CAAS;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,6DAA6D;YAC7D,IAAA,6BAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAA,6BAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,iBAAyB,EAAE,oBAA4B;IACpF,IAAI,OAAO,iBAAiB,KAAK,QAAQ,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uDAAuD;IACvD,IAAI,oBAAoB,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,IAAA,wBAAU,EAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC3E,OAAO,mBAAmB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,OAAO,mBAAmB,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,YAAqB;IAChD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,SAAS;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAChE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,QAAgB,EAAE,MAAc,EAAE,UAAU,GAAG,mCAA2B;IAC3G,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;IAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,SAAS,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChF,OAAO,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,KAAa,EAAE,MAAc,EAAE,YAAqB;IACrF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,iBAAiB,CAAC,GAAG,KAAK,CAAC;IAC3D,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,UAAU,EAAE,CAAC;IAC5C,MAAM,iBAAiB,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAExF,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,CAAC,UAAU;IACzB,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,YAAY,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,5 @@
+export * from './types';
+export * from './crypto';
+export * from './config';
+export * from './middleware';
+export * from './routes';