cursedbelt 0.0.0

package/dist/server/auth/jwt.d.ts

@@ -0,0 +1,19 @@
+import { type JWTPayload } from 'jose';
+import type { AppJwtPayload } from './types';
+/**
+ * Sign an HS256 token. `expiresIn` is a jose duration string (`'15m'`, `'24h'`) or a
+ * number of seconds-from-now. `iat`/`exp` are set automatically — pass everything
+ * else (`userId`, `sessionId`, `roles`, `getOnly`, optional `purpose`).
+ */
+export declare function signToken(payload: Omit<AppJwtPayload, 'iat' | 'exp'>, secret: string, expiresIn: string | number): Promise<string>;
+/** Verify signature + claims and return the decoded payload (throws on bad
+ * signature / expiry / malformed). */
+export declare function verifyToken<T extends JWTPayload = AppJwtPayload>(token: string, secret: string): Promise<T>;
+/**
+ * Verify a single-purpose token (vault/private-media/files/yt-oauth) AND assert its
+ * `purpose` claim matches — so an access token (or a token for a *different*
+ * feature) can never be replayed as, say, a vault-unlock token. Throws on a bad
+ * signature, expiry, or a purpose mismatch.
+ */
+export declare function verifyPurposeToken<T extends AppJwtPayload = AppJwtPayload>(token: string, secret: string, purpose: string): Promise<T>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/server/auth/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/server/auth/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAsB,MAAM,MAAM,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AA8B7C;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,KAAK,CAAC,EAC3C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,MAAM,GACzB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED;sCACsC;AACtC,wBAAsB,WAAW,CAAC,CAAC,SAAS,UAAU,GAAG,aAAa,EACpE,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,CAGZ;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,EAC9E,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,CAAC,CAMZ"}

package/dist/server/auth/jwt.js

@@ -0,0 +1,57 @@
+import { jwtVerify, SignJWT } from 'jose';
+/**
+ * JWT sign/verify on `jose` (Web Crypto HMAC — native on Bun + Node, no native
+ * deps; replaces `jsonwebtoken`). Every token system in the apps — the access
+ * token plus the short-lived vault/private-media/files/yt-oauth unlock tokens —
+ * goes through these, so there is exactly ONE jose integration to reason about.
+ *
+ * jose verifies any standard HS256 JWT regardless of which library signed it, so a
+ * token previously minted by `jsonwebtoken` validates here unchanged — that is the
+ * whole cutover guarantee (no dual-verify shim or `jsonwebtoken` dependency is
+ * carried into this from-scratch toolkit). A pre-`getOnly` token simply has no
+ * `getOnly` claim; the auth middleware reads it as `false`.
+ *
+ * NOTE: Web Crypto HMAC is async, so these are async (jsonwebtoken was sync — every
+ * caller becomes async/await).
+ */
+const keyOf = (secret) => new TextEncoder().encode(secret);
+/**
+ * Normalize jose's expiration input. jose treats a bare **number** as an absolute
+ * UNIX timestamp (seconds) — so `3600` would mean "1970" and expire instantly. We
+ * treat a number as RELATIVE seconds-from-now (the obviously-intended meaning) by
+ * handing jose a `"<n>s"` duration; a string (`'15m'`, `'24h'`) passes through as a
+ * jose duration unchanged.
+ */
+const asDuration = (expiresIn) => typeof expiresIn === 'number' ? `${expiresIn}s` : expiresIn;
+/**
+ * Sign an HS256 token. `expiresIn` is a jose duration string (`'15m'`, `'24h'`) or a
+ * number of seconds-from-now. `iat`/`exp` are set automatically — pass everything
+ * else (`userId`, `sessionId`, `roles`, `getOnly`, optional `purpose`).
+ */
+export async function signToken(payload, secret, expiresIn) {
+    return new SignJWT(payload)
+        .setProtectedHeader({ alg: 'HS256' })
+        .setIssuedAt()
+        .setExpirationTime(asDuration(expiresIn))
+        .sign(keyOf(secret));
+}
+/** Verify signature + claims and return the decoded payload (throws on bad
+ * signature / expiry / malformed). */
+export async function verifyToken(token, secret) {
+    const { payload } = await jwtVerify(token, keyOf(secret));
+    return payload;
+}
+/**
+ * Verify a single-purpose token (vault/private-media/files/yt-oauth) AND assert its
+ * `purpose` claim matches — so an access token (or a token for a *different*
+ * feature) can never be replayed as, say, a vault-unlock token. Throws on a bad
+ * signature, expiry, or a purpose mismatch.
+ */
+export async function verifyPurposeToken(token, secret, purpose) {
+    const payload = await verifyToken(token, secret);
+    if (payload.purpose !== purpose) {
+        throw new Error(`token purpose mismatch: expected '${purpose}', got '${payload.purpose}'`);
+    }
+    return payload;
+}
+//# sourceMappingURL=jwt.js.map

package/dist/server/auth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/server/auth/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAG3D;;;;;;;;;;;;;;GAcG;AAEH,MAAM,KAAK,GAAG,CAAC,MAAc,EAAc,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,CAAC,SAA0B,EAAU,EAAE,CACxD,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAA2C,EAC3C,MAAc,EACd,SAA0B;IAE1B,OAAO,IAAI,OAAO,CAAC,OAAqB,CAAC;SACtC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SACxC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;sCACsC;AACtC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,MAAc;IAEd,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,OAAY,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,MAAc,EACd,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,WAAW,CAAI,KAAK,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,WAAW,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/server/auth/loginThrottle.d.ts

@@ -0,0 +1,34 @@
+/**
+ * In-memory brute-force lockout for password login, keyed by the caller's choice of
+ * identifier (recommended: `"<email>:<ip>"` — per-account AND per-source, stricter
+ * than the per-IP {@link ../middleware/rateLimit}). After `maxAttempts` failures
+ * within `windowMs`, the key is locked for `lockoutMs`; a successful login clears
+ * the counter. In-memory matches the rest of the auth stack (the session store is
+ * in-memory too) and is correct for a single-instance deployment.
+ *
+ * This replaces the app's ad-hoc per-IP login limiter: pair `createRateLimiter`
+ * (per-IP, coarse) with `createLoginThrottle` (per-email+IP, strict).
+ */
+export interface LoginThrottle {
+    /** Is this key allowed to attempt a login right now? When locked, includes the ms
+     * until it may retry. */
+    check(key: string): {
+        allowed: boolean;
+        retryAfterMs?: number;
+    };
+    /** Record an attempt's outcome. Success resets the counter; failure advances the
+     * sliding window and may trip the lockout. */
+    record(key: string, success: boolean): void;
+    /** Clear a key's counter/lockout (e.g. after an admin unlock or a verified reset). */
+    reset(key: string): void;
+}
+export interface LoginThrottleOptions {
+    /** Failures within the window before locking. Default 5. */
+    maxAttempts?: number;
+    /** Sliding window failures must cluster within, ms. Default 15 min. */
+    windowMs?: number;
+    /** Lock duration once tripped, ms. Default 30 min. */
+    lockoutMs?: number;
+}
+export declare function createLoginThrottle(opts?: LoginThrottleOptions): LoginThrottle;
+//# sourceMappingURL=loginThrottle.d.ts.map

package/dist/server/auth/loginThrottle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginThrottle.d.ts","sourceRoot":"","sources":["../../../src/server/auth/loginThrottle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,aAAa;IAC5B;6BACyB;IACzB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE;kDAC8C;IAC9C,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5C,sFAAsF;IACtF,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAWD,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,oBAAyB,GAAG,aAAa,CAmDlF"}

package/dist/server/auth/loginThrottle.js

@@ -0,0 +1,63 @@
+/**
+ * In-memory brute-force lockout for password login, keyed by the caller's choice of
+ * identifier (recommended: `"<email>:<ip>"` — per-account AND per-source, stricter
+ * than the per-IP {@link ../middleware/rateLimit}). After `maxAttempts` failures
+ * within `windowMs`, the key is locked for `lockoutMs`; a successful login clears
+ * the counter. In-memory matches the rest of the auth stack (the session store is
+ * in-memory too) and is correct for a single-instance deployment.
+ *
+ * This replaces the app's ad-hoc per-IP login limiter: pair `createRateLimiter`
+ * (per-IP, coarse) with `createLoginThrottle` (per-email+IP, strict).
+ */
+const normalizeKey = (key) => key.trim().toLowerCase();
+export function createLoginThrottle(opts = {}) {
+    const maxAttempts = opts.maxAttempts ?? 5;
+    const windowMs = opts.windowMs ?? 15 * 60 * 1000;
+    const lockoutMs = opts.lockoutMs ?? 30 * 60 * 1000;
+    const entries = new Map();
+    let lastSweep = Date.now();
+    // Drop keys that are neither locked nor holding live attempts, so the map can't
+    // grow unbounded under attack traffic.
+    const sweep = (now) => {
+        const cutoff = now - windowMs;
+        for (const [key, e] of entries) {
+            const live = e.attempts.filter((t) => t > cutoff);
+            if (live.length === 0 && e.lockedUntil <= now)
+                entries.delete(key);
+            else
+                e.attempts = live;
+        }
+        lastSweep = now;
+    };
+    return {
+        check(key) {
+            const e = entries.get(normalizeKey(key));
+            const now = Date.now();
+            if (e && e.lockedUntil > now) {
+                return { allowed: false, retryAfterMs: e.lockedUntil - now };
+            }
+            return { allowed: true };
+        },
+        record(key, success) {
+            const k = normalizeKey(key);
+            if (success) {
+                entries.delete(k);
+                return;
+            }
+            const now = Date.now();
+            if (now - lastSweep > windowMs)
+                sweep(now);
+            const cutoff = now - windowMs;
+            const e = entries.get(k) ?? { attempts: [], lockedUntil: 0 };
+            e.attempts = e.attempts.filter((t) => t > cutoff);
+            e.attempts.push(now);
+            if (e.attempts.length >= maxAttempts)
+                e.lockedUntil = now + lockoutMs;
+            entries.set(k, e);
+        },
+        reset(key) {
+            entries.delete(normalizeKey(key));
+        },
+    };
+}
+//# sourceMappingURL=loginThrottle.js.map

package/dist/server/auth/loginThrottle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginThrottle.js","sourceRoot":"","sources":["../../../src/server/auth/loginThrottle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA6BH,MAAM,YAAY,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAEvE,MAAM,UAAU,mBAAmB,CAAC,OAA6B,EAAE;IACjE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACzC,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,gFAAgF;IAChF,uCAAuC;IACvC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,MAAM,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC;QAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAC9D,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;QACzB,CAAC;QACD,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,GAAG;YACP,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;gBAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;YAC/D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,CAAC,GAAG,EAAE,OAAO;YACjB,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,SAAS,GAAG,QAAQ;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAE3C,MAAM,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC;YAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;YAC7D,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YAClD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,WAAW;gBAAE,CAAC,CAAC,WAAW,GAAG,GAAG,GAAG,SAAS,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,GAAG;YACP,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/auth/middleware.d.ts

@@ -0,0 +1,15 @@
+import type { MiddlewareHandler } from 'hono';
+import type { AuthEnv, SessionStore } from './types';
+/**
+ * The composed auth middleware. Reads the httpOnly `access_token` cookie, verifies
+ * the JWT, checks the session is live (present, not revoked, inside its sliding
+ * window), and sets the normalized {@link AuthUser} on `c.get('user')` (plus
+ * `userId` for request-log attribution). Every failure maps to a 401 in the
+ * canonical error envelope.
+ *
+ * Deliberately minimal: it does NOT slide/re-issue the token — that (and the
+ * `/f`-vs-`/login` policy) is app business (task 32). Mount {@link
+ * ./getOnly.getOnlyEnforcement} AFTER this to add the GET-only gate.
+ */
+export declare function createAuthMiddleware(sessionStore: SessionStore, jwtSecret: string): MiddlewareHandler<AuthEnv>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/server/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/server/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI9C,OAAO,KAAK,EAAiB,OAAO,EAAY,YAAY,EAAE,MAAM,SAAS,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM,GAChB,iBAAiB,CAAC,OAAO,CAAC,CAmC5B"}

package/dist/server/auth/middleware.js

@@ -0,0 +1,48 @@
+import { ApiError, toErrorEnvelope } from '../errors';
+import { readAuthCookie } from './cookie';
+import { verifyToken } from './jwt';
+/**
+ * The composed auth middleware. Reads the httpOnly `access_token` cookie, verifies
+ * the JWT, checks the session is live (present, not revoked, inside its sliding
+ * window), and sets the normalized {@link AuthUser} on `c.get('user')` (plus
+ * `userId` for request-log attribution). Every failure maps to a 401 in the
+ * canonical error envelope.
+ *
+ * Deliberately minimal: it does NOT slide/re-issue the token — that (and the
+ * `/f`-vs-`/login` policy) is app business (task 32). Mount {@link
+ * ./getOnly.getOnlyEnforcement} AFTER this to add the GET-only gate.
+ */
+export function createAuthMiddleware(sessionStore, jwtSecret) {
+    return async (c, next) => {
+        const token = readAuthCookie(c);
+        if (!token) {
+            return c.json(toErrorEnvelope(new ApiError(401, 'Unauthorized')), 401);
+        }
+        let payload;
+        try {
+            payload = await verifyToken(token, jwtSecret);
+        }
+        catch {
+            return c.json(toErrorEnvelope(new ApiError(401, 'Invalid token')), 401);
+        }
+        const session = sessionStore.get(payload.sessionId);
+        if (!session || session.disabled) {
+            return c.json(toErrorEnvelope(new ApiError(401, 'Session revoked')), 401);
+        }
+        if (new Date(session.refreshExpiresAt) < new Date()) {
+            return c.json(toErrorEnvelope(new ApiError(401, 'Session expired')), 401);
+        }
+        const user = {
+            id: payload.userId,
+            roles: payload.roles ?? [],
+            // A token minted before the claim existed has no `getOnly` → treat as false,
+            // preserving access for pre-existing cookies.
+            getOnly: payload.getOnly ?? false,
+            sessionId: payload.sessionId,
+        };
+        c.set('user', user);
+        c.set('userId', user.id);
+        await next();
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/server/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/server/auth/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAGpC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAA0B,EAC1B,SAAiB;IAEjB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAgB,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACjC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,IAAI,GAAa;YACrB,EAAE,EAAE,OAAO,CAAC,MAAM;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;YAC1B,6EAA6E;YAC7E,8CAA8C;YAC9C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;YACjC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;QACF,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAEzB,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/auth/password.d.ts

@@ -0,0 +1,15 @@
+/** Mint an argon2id password hash. Returns the self-describing PHC string. */
+export declare function hashPassword(plain: string): Promise<string>;
+/**
+ * Verify a candidate against a stored hash, handling BOTH formats: an argon2id PHC
+ * string (new) via `Bun.password.verify`; a legacy `"<salt>:<pbkdf2-hex>"` digest by
+ * re-deriving PBKDF2-SHA512 with the stored salt and comparing in constant time.
+ */
+export declare function verifyPassword(plain: string, stored: string): Promise<boolean>;
+/**
+ * True when a stored hash is a legacy (non-argon2id) digest and should be upgraded.
+ * Call AFTER a successful {@link verifyPassword} to opportunistically re-hash with
+ * argon2id — never block auth on the upgrade.
+ */
+export declare function needsRehash(stored: string): boolean;
+//# sourceMappingURL=password.d.ts.map

package/dist/server/auth/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/server/auth/password.ts"],"names":[],"mappings":"AA4BA,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3D;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBpF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/server/auth/password.js

@@ -0,0 +1,66 @@
+import { pbkdf2 as pbkdf2Cb, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+/**
+ * Password hashing on `Bun.password` (argon2id — memory-hard, thread-pooled, zero
+ * deps, the current OWASP default). The argon2id hash is self-describing
+ * (`$argon2id$v=19$m=…$<salt>$<hash>`) so there is NO separate salt column — the new
+ * schema stores just the hash string.
+ *
+ * Legacy upgrade path: the old app used PBKDF2-SHA512 @ 1000 iterations with a
+ * separate salt; the ETL (task 43) brings those forward as a combined `"<salt>:<hex>"`
+ * string in the password column (it can't re-hash — it lacks the plaintext).
+ * {@link verifyPassword} transparently verifies BOTH shapes; on a legacy match the
+ * caller re-hashes with argon2id ({@link needsRehash}) — a silent per-login upgrade,
+ * no forced reset.
+ */
+// Legacy PBKDF2-SHA512 parameters — used ONLY to verify pre-argon2id hashes; never
+// to mint new ones. (1000 iterations is far below modern guidance — exactly why we
+// moved off it.)
+const LEGACY_ITERATIONS = 1000;
+const LEGACY_KEYLEN = 64;
+const LEGACY_DIGEST = 'sha512';
+const pbkdf2 = promisify(pbkdf2Cb);
+const isArgon2 = (hash) => hash.startsWith('$argon2');
+/** Mint an argon2id password hash. Returns the self-describing PHC string. */
+export function hashPassword(plain) {
+    return Bun.password.hash(plain, { algorithm: 'argon2id' });
+}
+/**
+ * Verify a candidate against a stored hash, handling BOTH formats: an argon2id PHC
+ * string (new) via `Bun.password.verify`; a legacy `"<salt>:<pbkdf2-hex>"` digest by
+ * re-deriving PBKDF2-SHA512 with the stored salt and comparing in constant time.
+ */
+export async function verifyPassword(plain, stored) {
+    if (isArgon2(stored)) {
+        try {
+            return await Bun.password.verify(plain, stored);
+        }
+        catch {
+            return false;
+        }
+    }
+    // Legacy: split on the FIRST colon — salt (hex) : derived (hex). A malformed value
+    // (no colon) is simply a non-match.
+    const sep = stored.indexOf(':');
+    if (sep === -1)
+        return false;
+    const salt = stored.slice(0, sep);
+    const expectedHex = stored.slice(sep + 1);
+    if (!salt || !expectedHex)
+        return false;
+    const derived = (await pbkdf2(plain, salt, LEGACY_ITERATIONS, LEGACY_KEYLEN, LEGACY_DIGEST)).toString('hex');
+    // timingSafeEqual throws on length mismatch; a length diff is already a non-match
+    // and short-circuiting leaks nothing a compare wouldn't.
+    if (derived.length !== expectedHex.length)
+        return false;
+    return timingSafeEqual(Buffer.from(derived), Buffer.from(expectedHex));
+}
+/**
+ * True when a stored hash is a legacy (non-argon2id) digest and should be upgraded.
+ * Call AFTER a successful {@link verifyPassword} to opportunistically re-hash with
+ * argon2id — never block auth on the upgrade.
+ */
+export function needsRehash(stored) {
+    return !isArgon2(stored);
+}
+//# sourceMappingURL=password.js.map

package/dist/server/auth/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../src/server/auth/password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC;;;;;;;;;;;;GAYG;AAEH,mFAAmF;AACnF,mFAAmF;AACnF,iBAAiB;AACjB,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEnC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAEvE,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,MAAc;IAChE,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,mFAAmF;IACnF,oCAAoC;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAExC,MAAM,OAAO,GAAG,CACd,MAAM,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,CAAC,CAC3E,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClB,kFAAkF;IAClF,yDAAyD;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC"}

package/dist/server/auth/sessionStore.d.ts

@@ -0,0 +1,20 @@
+import type { PlumbingDb } from '../db/kysely';
+import type { SessionStore } from './types';
+export interface SessionStoreOptions {
+    /** Sliding refresh window — how long after the last activity a session stays
+     * valid. Default 7 days. */
+    refreshWindowMs?: number;
+    /** Retention before a stale (lapsed) row is pruned from memory + DB. Default 30
+     * days. Must be ≥ refreshWindowMs to keep recently-expired rows for the audit view. */
+    retentionMs?: number;
+    /** Throttle window for sliding-`touch` DB writes. Memory is always current; the
+     * row is flushed at most this often (unless a token re-issue forces it). Default 60s. */
+    flushIntervalMs?: number;
+    /** Start a background prune timer. Default false — wire pruning through the job
+     * runner (task 29), or call {@link SessionStore.prune} yourself. */
+    autoPrune?: boolean;
+    /** Auto-prune cadence when {@link autoPrune} is on. Default 1 hour. */
+    pruneIntervalMs?: number;
+}
+export declare function createSessionStore(ky: PlumbingDb, opts?: SessionStoreOptions): SessionStore;
+//# sourceMappingURL=sessionStore.d.ts.map

package/dist/server/auth/sessionStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionStore.d.ts","sourceRoot":"","sources":["../../../src/server/auth/sessionStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,KAAK,EAA+B,YAAY,EAAE,MAAM,SAAS,CAAC;AAgBzE,MAAM,WAAW,mBAAmB;IAClC;gCAC4B;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;2FACuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;6FACyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;wEACoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAiBD,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,GAAE,mBAAwB,GAAG,YAAY,CAkN/F"}

package/dist/server/auth/sessionStore.js

@@ -0,0 +1,222 @@
+/**
+ * Kysely-backed, revocable, restart-surviving session store (task 26).
+ *
+ * The in-memory map is the hot-path source of truth for token validity — the auth
+ * middleware reads it synchronously, no per-request DB round-trip. The
+ * `auth_sessions` table exists only so the map can be rebuilt after a restart
+ * ({@link SessionStore.rehydrate}); DB writes for sliding `touch`es are throttled
+ * (memory is always current). Single-server deployment, so there is no
+ * cross-instance coherence to manage.
+ */
+const HOUR_MS = 60 * 60 * 1000;
+const DAY_MS = 24 * HOUR_MS;
+const rowToSession = (r) => ({
+    sessionId: r.session_id,
+    userId: r.user_id,
+    getOnly: r.get_only === 1,
+    createdAt: r.created_at,
+    lastSeenAt: r.last_seen_at,
+    refreshExpiresAt: r.refresh_expires_at,
+    accessExpiresAt: r.access_expires_at,
+    disabled: r.disabled === 1,
+    disabledAt: r.disabled_at,
+    disabledBy: r.disabled_by,
+    userAgent: r.user_agent,
+    ip: r.ip,
+});
+export function createSessionStore(ky, opts = {}) {
+    const refreshWindowMs = opts.refreshWindowMs ?? 7 * DAY_MS;
+    const retentionMs = opts.retentionMs ?? 30 * DAY_MS;
+    const flushIntervalMs = opts.flushIntervalMs ?? 60_000;
+    const pruneIntervalMs = opts.pruneIntervalMs ?? HOUR_MS;
+    const map = new Map();
+    const lastFlushAt = new Map();
+    let pruneTimer;
+    const isFresh = (s, now = Date.now()) => !!s && !s.disabled && Date.parse(s.refreshExpiresAt) >= now;
+    const store = {
+        async rehydrate() {
+            // Drop ancient rows first so the map starts trim, then load only currently-valid
+            // sessions (disabled/expired rows stay in the DB for the audit view).
+            await store.prune();
+            const rows = await ky.selectFrom('auth_sessions').selectAll().execute();
+            const now = Date.now();
+            map.clear();
+            lastFlushAt.clear();
+            for (const r of rows) {
+                const s = rowToSession(r);
+                if (isFresh(s, now)) {
+                    map.set(s.sessionId, s);
+                    lastFlushAt.set(s.sessionId, now);
+                }
+            }
+        },
+        async create(input) {
+            const now = Date.now();
+            const nowIso = new Date(now).toISOString();
+            const session = {
+                sessionId: input.sessionId,
+                userId: input.userId,
+                getOnly: input.getOnly ?? false,
+                createdAt: nowIso,
+                lastSeenAt: nowIso,
+                refreshExpiresAt: input.refreshExpiresAt ?? new Date(now + refreshWindowMs).toISOString(),
+                accessExpiresAt: input.accessExpiresAt ?? null,
+                disabled: false,
+                disabledAt: null,
+                disabledBy: null,
+                userAgent: input.userAgent ?? null,
+                ip: input.ip ?? null,
+            };
+            map.set(session.sessionId, session);
+            lastFlushAt.set(session.sessionId, now);
+            await ky
+                .insertInto('auth_sessions')
+                .values({
+                session_id: session.sessionId,
+                user_id: session.userId,
+                get_only: session.getOnly ? 1 : 0,
+                created_at: session.createdAt,
+                last_seen_at: session.lastSeenAt,
+                refresh_expires_at: session.refreshExpiresAt,
+                access_expires_at: session.accessExpiresAt,
+                disabled: 0,
+                disabled_at: null,
+                disabled_by: null,
+                user_agent: session.userAgent,
+                ip: session.ip,
+            })
+                .execute();
+            return session;
+        },
+        get(sessionId) {
+            return map.get(sessionId);
+        },
+        isValid(session) {
+            return isFresh(session);
+        },
+        async touch(sessionId, opts2) {
+            const s = map.get(sessionId);
+            if (!s)
+                return;
+            const now = Date.now();
+            s.lastSeenAt = new Date(now).toISOString();
+            s.refreshExpiresAt = new Date(now + refreshWindowMs).toISOString();
+            const reissued = opts2?.accessExpiresAt !== undefined;
+            if (reissued)
+                s.accessExpiresAt = opts2?.accessExpiresAt ?? null;
+            const last = lastFlushAt.get(sessionId) ?? 0;
+            if (reissued || now - last > flushIntervalMs) {
+                await ky
+                    .updateTable('auth_sessions')
+                    .set({
+                    last_seen_at: s.lastSeenAt,
+                    refresh_expires_at: s.refreshExpiresAt,
+                    access_expires_at: s.accessExpiresAt,
+                })
+                    .where('session_id', '=', sessionId)
+                    .execute();
+                lastFlushAt.set(sessionId, now);
+            }
+        },
+        async disable(sessionId, disabledBy = null) {
+            const s = map.get(sessionId);
+            const nowIso = new Date().toISOString();
+            if (s) {
+                s.disabled = true;
+                s.disabledAt = nowIso;
+                s.disabledBy = disabledBy;
+            }
+            const res = await ky
+                .updateTable('auth_sessions')
+                .set({ disabled: 1, disabled_at: nowIso, disabled_by: disabledBy })
+                .where('session_id', '=', sessionId)
+                .where('disabled', '=', 0)
+                .executeTakeFirst();
+            return s !== undefined || Number(res?.numUpdatedRows ?? 0) > 0;
+        },
+        async disableAllForUser(userId, disabledBy = null) {
+            const nowIso = new Date().toISOString();
+            const affected = [];
+            for (const s of map.values()) {
+                if (s.userId === userId && !s.disabled) {
+                    s.disabled = true;
+                    s.disabledAt = nowIso;
+                    s.disabledBy = disabledBy;
+                    affected.push(s.sessionId);
+                }
+            }
+            await ky
+                .updateTable('auth_sessions')
+                .set({ disabled: 1, disabled_at: nowIso, disabled_by: disabledBy })
+                .where('user_id', '=', userId)
+                .where('disabled', '=', 0)
+                .execute();
+            return affected;
+        },
+        async remove(sessionId) {
+            map.delete(sessionId);
+            lastFlushAt.delete(sessionId);
+            await ky.deleteFrom('auth_sessions').where('session_id', '=', sessionId).execute();
+        },
+        async deleteByUser(userId) {
+            for (const [id, s] of map) {
+                if (s.userId === userId) {
+                    map.delete(id);
+                    lastFlushAt.delete(id);
+                }
+            }
+            await ky.deleteFrom('auth_sessions').where('user_id', '=', userId).execute();
+        },
+        async listByUser(userId) {
+            const rows = await ky
+                .selectFrom('auth_sessions')
+                .selectAll()
+                .where('user_id', '=', userId)
+                .orderBy('created_at', 'desc')
+                .execute();
+            return rows.map(rowToSession);
+        },
+        listAll() {
+            return Array.from(map.values());
+        },
+        getLastSeenForUser(userId) {
+            let latest = null;
+            for (const s of map.values()) {
+                if (s.userId !== userId || s.disabled)
+                    continue;
+                if (!latest || s.lastSeenAt > latest)
+                    latest = s.lastSeenAt;
+            }
+            return latest;
+        },
+        async prune() {
+            const cutoff = Date.now() - retentionMs;
+            const cutoffIso = new Date(cutoff).toISOString();
+            let removed = 0;
+            for (const [id, s] of map) {
+                if (Date.parse(s.lastSeenAt) < cutoff) {
+                    map.delete(id);
+                    lastFlushAt.delete(id);
+                    removed++;
+                }
+            }
+            await ky.deleteFrom('auth_sessions').where('last_seen_at', '<', cutoffIso).execute();
+            return removed;
+        },
+        stop() {
+            if (pruneTimer) {
+                clearInterval(pruneTimer);
+                pruneTimer = undefined;
+            }
+        },
+    };
+    if (opts.autoPrune) {
+        pruneTimer = setInterval(() => {
+            void store.prune();
+        }, pruneIntervalMs);
+        // Never keep the process alive for a prune tick.
+        pruneTimer.unref?.();
+    }
+    return store;
+}
+//# sourceMappingURL=sessionStore.js.map

package/dist/server/auth/sessionStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionStore.js","sourceRoot":"","sources":["../../../src/server/auth/sessionStore.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AAEH,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/B,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC;AAmB5B,MAAM,YAAY,GAAG,CAAC,CAAiB,EAAW,EAAE,CAAC,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO;IACjB,OAAO,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,UAAU,EAAE,CAAC,CAAC,YAAY;IAC1B,gBAAgB,EAAE,CAAC,CAAC,kBAAkB;IACtC,eAAe,EAAE,CAAC,CAAC,iBAAiB;IACpC,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,WAAW;IACzB,UAAU,EAAE,CAAC,CAAC,WAAW;IACzB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,EAAE,EAAE,CAAC,CAAC,EAAE;CACT,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CAAC,EAAc,EAAE,OAA4B,EAAE;IAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,CAAC,GAAG,MAAM,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,GAAG,MAAM,CAAC;IACpD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC;IAExD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,IAAI,UAAsD,CAAC;IAE3D,MAAM,OAAO,GAAG,CAAC,CAAsB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAgB,EAAE,CACzE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC;IAE9D,MAAM,KAAK,GAAiB;QAC1B,KAAK,CAAC,SAAS;YACb,iFAAiF;YACjF,sEAAsE;YACtE,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBACpB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;oBACxB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAyB;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAY;gBACvB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;gBAC/B,SAAS,EAAE,MAAM;gBACjB,UAAU,EAAE,MAAM;gBAClB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,WAAW,EAAE;gBACzF,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;gBAC9C,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI;aACrB,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACpC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,EAAE;iBACL,UAAU,CAAC,eAAe,CAAC;iBAC3B,MAAM,CAAC;gBACN,UAAU,EAAE,OAAO,CAAC,SAAS;gBAC7B,OAAO,EAAE,OAAO,CAAC,MAAM;gBACvB,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjC,UAAU,EAAE,OAAO,CAAC,SAAS;gBAC7B,YAAY,EAAE,OAAO,CAAC,UAAU;gBAChC,kBAAkB,EAAE,OAAO,CAAC,gBAAgB;gBAC5C,iBAAiB,EAAE,OAAO,CAAC,eAAe;gBAC1C,QAAQ,EAAE,CAAC;gBACX,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,OAAO,CAAC,SAAS;gBAC7B,EAAE,EAAE,OAAO,CAAC,EAAE;aACf,CAAC;iBACD,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,GAAG,CAAC,SAAS;YACX,OAAO,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,CAAC,OAAO;YACb,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK;YAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,CAAC,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3C,CAAC,CAAC,gBAAgB,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,EAAE,eAAe,KAAK,SAAS,CAAC;YACtD,IAAI,QAAQ;gBAAE,CAAC,CAAC,eAAe,GAAG,KAAK,EAAE,eAAe,IAAI,IAAI,CAAC;YAEjE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,eAAe,EAAE,CAAC;gBAC7C,MAAM,EAAE;qBACL,WAAW,CAAC,eAAe,CAAC;qBAC5B,GAAG,CAAC;oBACH,YAAY,EAAE,CAAC,CAAC,UAAU;oBAC1B,kBAAkB,EAAE,CAAC,CAAC,gBAAgB;oBACtC,iBAAiB,EAAE,CAAC,CAAC,eAAe;iBACrC,CAAC;qBACD,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,SAAS,CAAC;qBACnC,OAAO,EAAE,CAAC;gBACb,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;YACxC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,CAAC,EAAE,CAAC;gBACN,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC;gBACtB,CAAC,CAAC,UAAU,GAAG,UAAU,CAAC;YAC5B,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,eAAe,CAAC;iBAC5B,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;iBAClE,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,SAAS,CAAC;iBACnC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;iBACzB,gBAAgB,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI;YAC/C,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACvC,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;oBAClB,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC;oBACtB,CAAC,CAAC,UAAU,GAAG,UAAU,CAAC;oBAC1B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,MAAM,EAAE;iBACL,WAAW,CAAC,eAAe,CAAC;iBAC5B,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;iBAClE,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC7B,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;iBACzB,OAAO,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,SAAS;YACpB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtB,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,MAAM,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QACrF,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBACxB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACf,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YACD,MAAM,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/E,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,eAAe,CAAC;iBAC3B,SAAS,EAAE;iBACX,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC7B,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC;iBAC7B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QAED,OAAO;YACL,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,CAAC;QAED,kBAAkB,CAAC,MAAM;YACvB,IAAI,MAAM,GAAkB,IAAI,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ;oBAAE,SAAS;gBAChD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,GAAG,MAAM;oBAAE,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC;YAC9D,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,KAAK;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC;oBACtC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACf,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACvB,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,MAAM,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACrF,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI;YACF,IAAI,UAAU,EAAE,CAAC;gBACf,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1B,UAAU,GAAG,SAAS,CAAC;YACzB,CAAC;QACH,CAAC;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC,EAAE,eAAe,CAAC,CAAC;QACpB,iDAAiD;QACjD,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}