sentri 1.1.2 → 2.1.0

package/dist/middleware/router.js

@@ -1,264 +0,0 @@
-import { Router } from 'express';
-import { SentriError } from '../errors/AuthError.js';
-import { register, login, refresh, logout, logoutAll, assignRoles } from '../services/auth.js';
-import { resolveConfig, parseExpiry } from '../libs/config.js';
-import { protect } from './protect.js';
-import { authorize } from './authorize.js';
-const MIN_PASSWORD_LENGTH = 8;
-// bcrypt silently truncates input beyond 72 bytes. Enforcing a cap makes the
-// truncation boundary explicit so two passwords that share the same first 72
-// bytes cannot be treated as identical.
-const MAX_PASSWORD_LENGTH = 72;
-const MAX_IDENTIFIER_LENGTH = 255;
-function badRequest(message) {
-    return new SentriError('VALIDATION_ERROR', message);
-}
-function ok(response, statusCode, message, data) {
-    response.status(statusCode).json({ error: false, statusCode, message, data });
-}
-function fail(response, error) {
-    response.status(error.statusCode).json({ error: true, statusCode: error.statusCode, message: error.message, data: null });
-}
-function parseBody(body) {
-    if (body === null || body === undefined || typeof body !== 'object' || Array.isArray(body)) {
-        throw new SentriError('VALIDATION_ERROR', 'Request body is missing or not a JSON object. Did you apply express.json()?');
-    }
-    return body;
-}
-// Read a single cookie from the raw Cookie header — no cookie-parser needed.
-function readCookie(cookieHeader, name) {
-    if (!cookieHeader)
-        return undefined;
-    const pair = cookieHeader
-        .split(';')
-        .map((segment) => segment.trim())
-        .find((segment) => segment.startsWith(`${name}=`));
-    return pair !== undefined ? pair.slice(name.length + 1) : undefined;
-}
-function getCookieName(config) {
-    return config.cookie?.name ?? 'refresh_token';
-}
-function setCookie(response, token, config) {
-    const cookieConfig = config.cookie ?? {};
-    const resolved = resolveConfig(config);
-    const maxAge = parseExpiry(resolved.refreshExpiresIn);
-    response.cookie(getCookieName(config), token, {
-        httpOnly: cookieConfig.httpOnly ?? true,
-        secure: cookieConfig.secure ?? false,
-        sameSite: cookieConfig.sameSite ?? 'strict',
-        path: cookieConfig.path ?? '/',
-        maxAge,
-    });
-}
-function clearCookie(response, config) {
-    const cookieConfig = config.cookie ?? {};
-    response.clearCookie(getCookieName(config), { path: cookieConfig.path ?? '/' });
-}
-/**
- * Validate the `X-Api-Key` header when `config.apiKey` is set.
- * Throws `SentriError` with code `UNAUTHORIZED` on mismatch.
- */
-function validateApiKey(request, config) {
-    if (!config.apiKey)
-        return;
-    const provided = request.headers['x-api-key'];
-    if (typeof provided !== 'string' || provided !== config.apiKey) {
-        throw new SentriError('UNAUTHORIZED', 'Invalid or missing API key');
-    }
-}
-/**
- * Creates a pre-built Express Router with all standard auth endpoints.
- *
- * Mount it once and all routes are ready:
- *
- * ```
- * POST /register            — register a new user (protected by X-Api-Key when config.apiKey is set)
- * POST /login               — authenticate and get tokens
- * POST /refresh             — rotate refresh token
- * POST /logout              — invalidate current session; access tokens issued before logout become invalid
- * POST /logout-all          — invalidate all sessions for the authenticated user
- * GET  /me                  — return the currently authenticated user
- * POST /users/:userId/roles — assign roles (admin only)
- * ```
- *
- * Requires `express.json()` to be applied before the router.
- *
- * When `cookie` is set in config, the refresh token is stored in an httpOnly
- * cookie automatically — no `cookie-parser` needed.
- *
- * When `apiKey` is set in config, `POST /register` requires the caller to send
- * an `X-Api-Key: <key>` header matching the configured value.
- *
- * When `router` is set in config, individual service functions can be replaced
- * while the router still handles validation and response formatting.
- *
- * @example
- * app.use(express.json());
- * app.use('/auth', auth.router());
- */
-export function createAuthRouter(config) {
-    const router = Router();
-    // Resolve service functions — use custom override from config.router when provided, else fall back to the built-in service.
-    const baseConfig = config;
-    const registerFn = config.router?.register ?? ((input) => register(input, baseConfig));
-    const loginFn = config.router?.login ?? ((input) => login(input, baseConfig));
-    const refreshFn = config.router?.refresh ?? ((token) => refresh(token, baseConfig));
-    const logoutFn = config.router?.logout ?? ((token) => token !== undefined ? logout(token, baseConfig) : Promise.resolve());
-    const logoutAllFn = config.router?.logoutAll ?? ((userId) => logoutAll(userId, baseConfig));
-    const assignRolesFn = config.router?.assignRoles ?? ((userId, roles) => assignRoles(userId, roles, baseConfig));
-    /**
-     * POST /register
-     *
-     * Register a new user. Does **not** issue tokens — call `/login` after registration.
-     *
-     * When `config.apiKey` is set the caller must supply the matching value in the
-     * `X-Api-Key` header, preventing arbitrary users from self-registering as admins.
-     */
-    router.post('/register', async (request, response, next) => {
-        try {
-            validateApiKey(request, config);
-            const body = parseBody(request.body);
-            const { identifier, password, roles } = body;
-            if (typeof identifier !== 'string' || identifier.trim().length === 0) {
-                throw badRequest('identifier is required and must be a non-empty string');
-            }
-            if (identifier.length > MAX_IDENTIFIER_LENGTH) {
-                throw badRequest(`identifier must not exceed ${MAX_IDENTIFIER_LENGTH} characters`);
-            }
-            if (typeof password !== 'string' || password.length < MIN_PASSWORD_LENGTH) {
-                throw badRequest(`password is required and must be at least ${MIN_PASSWORD_LENGTH} characters`);
-            }
-            if (password.length > MAX_PASSWORD_LENGTH) {
-                throw badRequest(`password must not exceed ${MAX_PASSWORD_LENGTH} characters`);
-            }
-            if (roles !== undefined && !Array.isArray(roles)) {
-                throw badRequest('roles must be an array of strings when provided');
-            }
-            if (Array.isArray(roles) && !roles.every((role) => typeof role === 'string')) {
-                throw badRequest('each role must be a string');
-            }
-            const rolesInput = Array.isArray(roles) ? roles : undefined;
-            const input = rolesInput !== undefined
-                ? { identifier: identifier.trim(), password, roles: rolesInput }
-                : { identifier: identifier.trim(), password };
-            const result = await registerFn(input);
-            if (!result.success) {
-                fail(response, result.error);
-                return;
-            }
-            ok(response, 201, 'User registered successfully', { user: result.user });
-        }
-        catch (error) {
-            next(error);
-        }
-    });
-    router.post('/login', async (request, response, next) => {
-        try {
-            const body = parseBody(request.body);
-            const { identifier, password } = body;
-            if (typeof identifier !== 'string' || identifier.trim().length === 0) {
-                throw badRequest('identifier is required and must be a non-empty string');
-            }
-            if (identifier.length > MAX_IDENTIFIER_LENGTH) {
-                throw badRequest(`identifier must not exceed ${MAX_IDENTIFIER_LENGTH} characters`);
-            }
-            if (typeof password !== 'string' || password.length === 0) {
-                throw badRequest('password is required');
-            }
-            if (password.length > MAX_PASSWORD_LENGTH) {
-                throw badRequest(`password must not exceed ${MAX_PASSWORD_LENGTH} characters`);
-            }
-            const result = await loginFn({ identifier: identifier.trim(), password });
-            if (!result.success) {
-                fail(response, result.error);
-                return;
-            }
-            setCookie(response, result.refreshToken, config);
-            ok(response, 200, 'Login successful', { accessToken: result.accessToken, user: result.user });
-        }
-        catch (error) {
-            next(error);
-        }
-    });
-    router.post('/refresh', async (request, response, next) => {
-        try {
-            const fromCookie = readCookie(request.headers['cookie'], getCookieName(config));
-            if (!fromCookie) {
-                throw new SentriError('UNAUTHORIZED', 'Refresh token cookie is missing');
-            }
-            const result = await refreshFn(fromCookie);
-            if (!result.success) {
-                clearCookie(response, config);
-                fail(response, result.error);
-                return;
-            }
-            setCookie(response, result.refreshToken, config);
-            ok(response, 200, 'Token refreshed', { accessToken: result.accessToken });
-        }
-        catch (error) {
-            next(error);
-        }
-    });
-    router.post('/logout', async (request, response, next) => {
-        try {
-            const fromCookie = readCookie(request.headers['cookie'], getCookieName(config));
-            await logoutFn(fromCookie);
-            clearCookie(response, config);
-            ok(response, 200, 'Logged out', null);
-        }
-        catch (error) {
-            next(error);
-        }
-    });
-    router.post('/logout-all', protect(config), async (request, response, next) => {
-        try {
-            await logoutAllFn(request.user.id);
-            clearCookie(response, config);
-            ok(response, 200, 'All sessions revoked', null);
-        }
-        catch (error) {
-            next(error);
-        }
-    });
-    router.get('/me', protect(config), (request, response) => {
-        ok(response, 200, 'OK', request.user);
-    });
-    router.post('/users/:userId/roles', protect(config), authorize('admin'), async (request, response, next) => {
-        try {
-            const body = parseBody(request.body);
-            const { roles } = body;
-            const rawUserId = request.params['userId'];
-            const userId = typeof rawUserId === 'string' ? rawUserId : undefined;
-            if (!userId) {
-                throw badRequest('userId is required');
-            }
-            if (!Array.isArray(roles) || roles.length === 0) {
-                throw badRequest('roles must be a non-empty array of strings');
-            }
-            if (!roles.every((role) => typeof role === 'string')) {
-                throw badRequest('each role must be a string');
-            }
-            const result = await assignRolesFn(userId, roles);
-            if (!result.success) {
-                fail(response, result.error);
-                return;
-            }
-            ok(response, 200, 'Roles assigned successfully', { user: result.user });
-        }
-        catch (error) {
-            next(error);
-        }
-    });
-    // Centralized error handler — converts SentriError (and unexpected errors) to the
-    // standard envelope so every endpoint produces a consistent shape on failure.
-    router.use((error, _request, response, _next) => {
-        if (error instanceof SentriError) {
-            fail(response, error);
-        }
-        else {
-            response.status(500).json({ error: true, statusCode: 500, message: 'Internal server error', data: null });
-        }
-    });
-    return router;
-}
-//# sourceMappingURL=router.js.map

package/dist/middleware/router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/middleware/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkD,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,6EAA6E;AAC7E,6EAA6E;AAC7E,wCAAwC;AACxC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,IAAI,WAAW,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,EAAE,CAAI,QAAkB,EAAE,UAAkB,EAAE,OAAe,EAAE,IAAO;IAC7E,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,IAAI,CAAC,QAAkB,EAAE,KAAkB;IAClD,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5H,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,6EAA6E,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,YAAgC,EAAE,IAAY;IAChE,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,IAAI,GAAG,YAAY;SACtB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;SAChC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,MAAkB;IACvC,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,eAAe,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,QAAkB,EAAE,KAAa,EAAE,MAAkB;IACtE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACtD,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE;QAC5C,QAAQ,EAAE,YAAY,CAAC,QAAQ,IAAI,IAAI;QACvC,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,KAAK;QACpC,QAAQ,EAAE,YAAY,CAAC,QAAQ,IAAI,QAAQ;QAC3C,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,GAAG;QAC9B,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,QAAkB,EAAE,MAAkB;IACzD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAgB,EAAE,MAAkB;IAC1D,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,gBAAgB,CAAuB,MAAyB;IAC9E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,4HAA4H;IAC5H,MAAM,UAAU,GAAG,MAAoB,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC,KAAoB,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACtG,MAAM,OAAO,GAAM,MAAM,CAAC,MAAM,EAAE,KAAK,IAAO,CAAC,CAAC,KAAiB,EAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACjG,MAAM,SAAS,GAAI,MAAM,CAAC,MAAM,EAAE,OAAO,IAAK,CAAC,CAAC,KAAa,EAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAK,MAAM,CAAC,MAAM,EAAE,MAAM,IAAM,CAAC,CAAC,KAAyB,EAAE,EAAE,CAC3E,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,MAAM,WAAW,GAAK,MAAM,CAAC,MAAM,EAAE,SAAS,IAAM,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC,MAAc,EAAE,KAAe,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IAElI;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAEhC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;YAE7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrE,MAAM,UAAU,CAAC,uDAAuD,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBAC9C,MAAM,UAAU,CAAC,8BAA8B,qBAAqB,aAAa,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAC1E,MAAM,UAAU,CAAC,6CAA6C,mBAAmB,aAAa,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,UAAU,CAAC,4BAA4B,mBAAmB,aAAa,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,MAAM,UAAU,CAAC,iDAAiD,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC7E,MAAM,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;gBAChE,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YAEvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,8BAA8B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;YAEtC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrE,MAAM,UAAU,CAAC,uDAAuD,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBAC9C,MAAM,UAAU,CAAC,8BAA8B,qBAAqB,aAAa,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,UAAU,CAAC,sBAAsB,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,UAAU,CAAC,4BAA4B,mBAAmB,aAAa,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAE1E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACjD,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YAChF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;YAC3E,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;YAE3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC9B,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACjD,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACvD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YAChF,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3B,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9B,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QAC5E,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC;YACpC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9B,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACvD,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACzG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;YACvB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAErE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,UAAU,CAAC,oBAAoB,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,UAAU,CAAC,4CAA4C,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACrD,MAAM,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,KAAiB,CAAC,CAAC;YAE9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,6BAA6B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,kFAAkF;IAClF,8EAA8E;IAC9E,MAAM,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,QAAiB,EAAE,QAAkB,EAAE,KAAmB,EAAE,EAAE;QACxF,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/services/auth.d.ts

@@ -1,85 +0,0 @@
-import type { AssignRolesResult, AuthConfig, AuthResult, LoginInput, RefreshResult, RegisterInput, RegisterResult } from '../types/auth.js';
-/**
- * Register a new user.
- *
- * Validates that every requested role is in `validRoles`, rejects duplicate
- * identifiers, hashes the password with bcrypt, creates the user record via
- * the adapter, and returns the created user.
- *
- * No tokens are issued — the caller should invoke `login` after registration
- * if immediate authentication is desired.
- *
- * @param input - Registration data: identifier, plain-text password, and optional roles.
- * @param config - Auth configuration containing the adapter and role definitions.
- * @returns `{ success: true, user }` on success, or `{ success: false, error }` with
- *   code `INVALID_ROLE` or `USER_ALREADY_EXISTS` on failure.
- */
-export declare function register(input: RegisterInput, config: AuthConfig): Promise<RegisterResult>;
-/**
- * Authenticate an existing user by identifier and plain-text password.
- *
- * Looks up the user, verifies the password with bcrypt, creates a new session,
- * and issues a JWT access token + refresh token pair. The access token embeds
- * the session ID so that `protect()` can reject it immediately after logout
- * without waiting for the token to expire.
- *
- * The failure response always uses code `INVALID_CREDENTIALS` regardless of
- * whether the identifier or the password was wrong, preventing user enumeration.
- *
- * @param input - Login data: identifier and plain-text password.
- * @param config - Auth configuration containing the adapter and JWT settings.
- * @returns `{ success: true, accessToken, refreshToken, user }` on success, or
- *   `{ success: false, error }` with code `INVALID_CREDENTIALS` on failure.
- */
-export declare function login(input: LoginInput, config: AuthConfig): Promise<AuthResult>;
-/**
- * Exchange a valid refresh token for a new access + refresh token pair.
- *
- * Implements **session rotation**: the old session is deleted and a fresh
- * session is created, so each refresh token is single-use. An attacker
- * replaying a stolen refresh token after it has already been rotated will
- * find the session gone.
- *
- * @param refreshToken - The JWT refresh token (typically from an httpOnly cookie).
- * @param config - Auth configuration containing the adapter and JWT settings.
- * @returns `{ success: true, accessToken, refreshToken, user }` on success, or
- *   `{ success: false, error }` with code `UNAUTHORIZED`, `TOKEN_EXPIRED`, or
- *   `TOKEN_INVALID` on failure.
- */
-export declare function refresh(refreshToken: string, config: AuthConfig): Promise<RefreshResult>;
-/**
- * Invalidate a single session identified by a refresh token.
- *
- * Safe to call even when the token is already expired or invalid — the JWT
- * parse failure is silently swallowed and the function resolves normally.
- * This makes logout idempotent from the client's perspective.
- *
- * @param refreshToken - The JWT refresh token bound to the session to revoke.
- * @param config - Auth configuration containing the adapter and JWT settings.
- */
-export declare function logout(refreshToken: string, config: AuthConfig): Promise<void>;
-/**
- * Delete all sessions for a user, effectively logging them out of every device.
- *
- * Delegates to `adapter.session.deleteAllForUser`. No token is required — the
- * router route that calls this function is already guarded by `protect()`.
- *
- * @param userId - The user's primary key as stored in the database.
- * @param config - Auth configuration containing the adapter.
- */
-export declare function logoutAll(userId: string, config: AuthConfig): Promise<void>;
-/**
- * Add roles to a user account, merging them with any existing roles.
- *
- * Validates that every role in `rolesToAdd` is listed in `config.validRoles`.
- * The resulting role set is deduplicated before being persisted via
- * `adapter.user.updateRoles`.
- *
- * @param userId - The primary key of the user to update.
- * @param rolesToAdd - Role names to assign. Must all be present in `validRoles`.
- * @param config - Auth configuration containing the adapter and role definitions.
- * @returns `{ success: true, user }` on success, or `{ success: false, error }` with
- *   code `INVALID_ROLE` or `USER_NOT_FOUND` on failure.
- */
-export declare function assignRoles(userId: string, rolesToAdd: string[], config: AuthConfig): Promise<AssignRolesResult>;
-//# sourceMappingURL=auth.d.ts.map

package/dist/services/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/services/auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE5I;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,cAAc,CAAC,CAoBzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,KAAK,CACzB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,OAAO,CAC3B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,aAAa,CAAC,CA+BxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,MAAM,CAC1B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAAE,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAiB5B"}

package/dist/services/auth.js

@@ -1,173 +0,0 @@
-import { SentriError } from '../errors/AuthError.js';
-import { hashPassword, verifyPassword } from '../libs/hash.js';
-import { signAccessToken, signRefreshToken, verifyRefreshToken } from '../libs/token.js';
-import { resolveConfig, parseExpiry } from '../libs/config.js';
-/**
- * Register a new user.
- *
- * Validates that every requested role is in `validRoles`, rejects duplicate
- * identifiers, hashes the password with bcrypt, creates the user record via
- * the adapter, and returns the created user.
- *
- * No tokens are issued — the caller should invoke `login` after registration
- * if immediate authentication is desired.
- *
- * @param input - Registration data: identifier, plain-text password, and optional roles.
- * @param config - Auth configuration containing the adapter and role definitions.
- * @returns `{ success: true, user }` on success, or `{ success: false, error }` with
- *   code `INVALID_ROLE` or `USER_ALREADY_EXISTS` on failure.
- */
-export async function register(input, config) {
-    const resolved = resolveConfig(config);
-    const requestedRoles = input.roles ?? [];
-    const invalidRoles = requestedRoles.filter((r) => !resolved.validRoles.includes(r));
-    if (invalidRoles.length > 0) {
-        return { success: false, error: new SentriError('INVALID_ROLE', `Invalid roles: ${invalidRoles.join(', ')}`) };
-    }
-    const identifier = input.identifier.trim();
-    const existing = await resolved.adapter.user.findByIdentifier(identifier);
-    if (existing) {
-        return { success: false, error: new SentriError('USER_ALREADY_EXISTS', 'User already exists') };
-    }
-    const passwordHash = await hashPassword(input.password, resolved.saltRounds);
-    const created = await resolved.adapter.user.create({ identifier, passwordHash, roles: requestedRoles });
-    const user = { id: created.id, identifier, roles: requestedRoles };
-    return { success: true, user };
-}
-/**
- * Authenticate an existing user by identifier and plain-text password.
- *
- * Looks up the user, verifies the password with bcrypt, creates a new session,
- * and issues a JWT access token + refresh token pair. The access token embeds
- * the session ID so that `protect()` can reject it immediately after logout
- * without waiting for the token to expire.
- *
- * The failure response always uses code `INVALID_CREDENTIALS` regardless of
- * whether the identifier or the password was wrong, preventing user enumeration.
- *
- * @param input - Login data: identifier and plain-text password.
- * @param config - Auth configuration containing the adapter and JWT settings.
- * @returns `{ success: true, accessToken, refreshToken, user }` on success, or
- *   `{ success: false, error }` with code `INVALID_CREDENTIALS` on failure.
- */
-export async function login(input, config) {
-    const resolved = resolveConfig(config);
-    const found = await resolved.adapter.user.findByIdentifier(input.identifier.trim());
-    if (!found) {
-        return { success: false, error: new SentriError('INVALID_CREDENTIALS', 'Invalid credentials') };
-    }
-    const valid = await verifyPassword(input.password, found.passwordHash);
-    if (!valid) {
-        return { success: false, error: new SentriError('INVALID_CREDENTIALS', 'Invalid credentials') };
-    }
-    const expiresAt = new Date(Date.now() + parseExpiry(resolved.refreshExpiresIn));
-    const session = await resolved.adapter.session.create({ userId: found.id, expiresAt });
-    const user = { id: found.id, identifier: found.identifier, roles: found.roles };
-    // Embed sessionId in the access token so protect() can invalidate it on logout.
-    const accessToken = signAccessToken({ ...user, sessionId: session.id }, config);
-    const refreshToken = signRefreshToken(session.id, config);
-    return { success: true, accessToken, refreshToken, user };
-}
-/**
- * Exchange a valid refresh token for a new access + refresh token pair.
- *
- * Implements **session rotation**: the old session is deleted and a fresh
- * session is created, so each refresh token is single-use. An attacker
- * replaying a stolen refresh token after it has already been rotated will
- * find the session gone.
- *
- * @param refreshToken - The JWT refresh token (typically from an httpOnly cookie).
- * @param config - Auth configuration containing the adapter and JWT settings.
- * @returns `{ success: true, accessToken, refreshToken, user }` on success, or
- *   `{ success: false, error }` with code `UNAUTHORIZED`, `TOKEN_EXPIRED`, or
- *   `TOKEN_INVALID` on failure.
- */
-export async function refresh(refreshToken, config) {
-    const resolved = resolveConfig(config);
-    let sessionId;
-    try {
-        ({ sessionId } = verifyRefreshToken(refreshToken, config));
-    }
-    catch (err) {
-        if (err instanceof SentriError)
-            return { success: false, error: err };
-        return { success: false, error: new SentriError('TOKEN_INVALID', 'Invalid refresh token') };
-    }
-    const session = await resolved.adapter.session.findById(sessionId);
-    if (!session) {
-        return { success: false, error: new SentriError('UNAUTHORIZED', 'Session not found or revoked') };
-    }
-    if (session.expiresAt < new Date()) {
-        await resolved.adapter.session.delete(sessionId);
-        return { success: false, error: new SentriError('TOKEN_EXPIRED', 'Session has expired') };
-    }
-    // rotate: delete old session, create new one
-    await resolved.adapter.session.delete(sessionId);
-    const expiresAt = new Date(Date.now() + parseExpiry(resolved.refreshExpiresIn));
-    const newSession = await resolved.adapter.session.create({ userId: session.userId, expiresAt });
-    const user = { id: session.user.id, identifier: session.user.identifier, roles: session.user.roles };
-    // Embed new sessionId in the rotated access token.
-    const newAccessToken = signAccessToken({ ...user, sessionId: newSession.id }, config);
-    const newRefreshToken = signRefreshToken(newSession.id, config);
-    return { success: true, accessToken: newAccessToken, refreshToken: newRefreshToken, user };
-}
-/**
- * Invalidate a single session identified by a refresh token.
- *
- * Safe to call even when the token is already expired or invalid — the JWT
- * parse failure is silently swallowed and the function resolves normally.
- * This makes logout idempotent from the client's perspective.
- *
- * @param refreshToken - The JWT refresh token bound to the session to revoke.
- * @param config - Auth configuration containing the adapter and JWT settings.
- */
-export async function logout(refreshToken, config) {
-    let sessionId;
-    try {
-        ({ sessionId } = verifyRefreshToken(refreshToken, config));
-    }
-    catch {
-        return; // already invalid, nothing to revoke
-    }
-    await resolveConfig(config).adapter.session.delete(sessionId);
-}
-/**
- * Delete all sessions for a user, effectively logging them out of every device.
- *
- * Delegates to `adapter.session.deleteAllForUser`. No token is required — the
- * router route that calls this function is already guarded by `protect()`.
- *
- * @param userId - The user's primary key as stored in the database.
- * @param config - Auth configuration containing the adapter.
- */
-export async function logoutAll(userId, config) {
-    await resolveConfig(config).adapter.session.deleteAllForUser(userId);
-}
-/**
- * Add roles to a user account, merging them with any existing roles.
- *
- * Validates that every role in `rolesToAdd` is listed in `config.validRoles`.
- * The resulting role set is deduplicated before being persisted via
- * `adapter.user.updateRoles`.
- *
- * @param userId - The primary key of the user to update.
- * @param rolesToAdd - Role names to assign. Must all be present in `validRoles`.
- * @param config - Auth configuration containing the adapter and role definitions.
- * @returns `{ success: true, user }` on success, or `{ success: false, error }` with
- *   code `INVALID_ROLE` or `USER_NOT_FOUND` on failure.
- */
-export async function assignRoles(userId, rolesToAdd, config) {
-    const resolved = resolveConfig(config);
-    const invalidRoles = rolesToAdd.filter((role) => !resolved.validRoles.includes(role));
-    if (invalidRoles.length > 0) {
-        return { success: false, error: new SentriError('INVALID_ROLE', `Invalid roles: ${invalidRoles.join(', ')}`) };
-    }
-    const found = await resolved.adapter.user.findById(userId);
-    if (!found) {
-        return { success: false, error: new SentriError('USER_NOT_FOUND', 'User not found') };
-    }
-    const mergedRoles = Array.from(new Set([...found.roles, ...rolesToAdd]));
-    await resolved.adapter.user.updateRoles(userId, mergedRoles);
-    return { success: true, user: { id: found.id, identifier: found.identifier, roles: mergedRoles } };
-}
-//# sourceMappingURL=auth.js.map

package/dist/services/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/services/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAG/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAoB,EACpB,MAAkB;IAElB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IACzC,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,cAAc,EAAE,kBAAkB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACjH,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC1E,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAExG,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,KAAiB,EACjB,MAAkB;IAElB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAEvF,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAChF,gFAAgF;IAChF,MAAM,WAAW,GAAG,eAAe,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,YAAoB,EACpB,MAAkB;IAElB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,CAAC,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,eAAe,EAAE,uBAAuB,CAAC,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,cAAc,EAAE,8BAA8B,CAAC,EAAE,CAAC;IACpG,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,eAAe,EAAE,qBAAqB,CAAC,EAAE,CAAC;IAC5F,CAAC;IAED,6CAA6C;IAC7C,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAEhG,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACrG,mDAAmD;IACnD,MAAM,cAAc,GAAG,eAAe,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,YAAoB,EACpB,MAAkB;IAElB,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,CAAC,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,qCAAqC;IAC/C,CAAC;IACD,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,MAAkB;IAElB,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,UAAoB,EACpB,MAAkB;IAElB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACtF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,cAAc,EAAE,kBAAkB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACjH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;AACrG,CAAC"}