station-kit 1.0.9 → 2.0.0

package/dist/server/auth/keys.js

@@ -1,11 +1,146 @@
 import crypto from "node:crypto";
-import Database from "better-sqlite3";
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeSync, } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname } from "node:path";
 /**
- * Default ApiKeyStorageAdapter backed by better-sqlite3. Used by the Station
- * server when no `keyStorage` is configured. For Postgres / MySQL / Redis,
- * implement `ApiKeyStorageAdapter` and pass it to `KeyStore` directly.
+ * Default ApiKeyStorageAdapter backed by a JSON file. Used by the Station
+ * server when no `keyStorage` is configured. Has no native dependencies —
+ * works on any Node 18+ install without compiling bindings.
+ *
+ * Crash-safety: writes go through a fsync'd tmp-file + rename, with a
+ * second fsync on the parent directory so the rename itself survives
+ * power loss. The keys file is created with `0o600` and the parent dir
+ * with `0o700` so a default umask doesn't expose key metadata.
+ *
+ * Single-process only: do not point two `createStation` instances at
+ * the same file or last-rename-wins will silently clobber writes. For
+ * multi-process or high-volume deployments, implement
+ * `ApiKeyStorageAdapter` against Postgres / MySQL / Redis.
+ */
+export class FileKeyStorage {
+    filePath;
+    records = new Map();
+    constructor(options) {
+        this.filePath = options.filePath;
+        mkdirSync(dirname(this.filePath), { recursive: true, mode: 0o700 });
+        this.load();
+    }
+    load() {
+        if (!existsSync(this.filePath))
+            return;
+        try {
+            const raw = readFileSync(this.filePath, "utf8");
+            const data = JSON.parse(raw);
+            if (Array.isArray(data)) {
+                for (const r of data)
+                    this.records.set(r.id, r);
+            }
+        }
+        catch {
+            // Corrupt or unreadable file — start fresh rather than throwing.
+        }
+    }
+    flush() {
+        const tmp = `${this.filePath}.tmp`;
+        const body = JSON.stringify(Array.from(this.records.values()), null, 2);
+        // Write tmp file with fsync so its bytes are durable before rename.
+        const fd = openSync(tmp, "w", 0o600);
+        try {
+            writeSync(fd, body);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(tmp, this.filePath);
+        // fsync the parent directory so the rename's directory entry survives
+        // a crash. Best-effort: opening a directory for fsync isn't supported
+        // on every platform (notably Windows), so swallow errors.
+        try {
+            const dirFd = openSync(dirname(this.filePath), "r");
+            try {
+                fsyncSync(dirFd);
+            }
+            finally {
+                closeSync(dirFd);
+            }
+        }
+        catch {
+            // Platform doesn't support directory fsync; rename + tmp fsync
+            // already give us most of the durability we can offer.
+        }
+    }
+    insert(record) {
+        this.records.set(record.id, { ...record });
+        this.flush();
+    }
+    findByHash(keyHash) {
+        for (const r of this.records.values()) {
+            if (r.keyHash === keyHash)
+                return { ...r };
+        }
+        return null;
+    }
+    list() {
+        return Array.from(this.records.values())
+            .sort((a, b) => b.createdAt.localeCompare(a.createdAt))
+            .map((r) => {
+            const { keyHash: _h, ...rest } = r;
+            return rest;
+        });
+    }
+    touch(id, lastUsedIso) {
+        const r = this.records.get(id);
+        if (!r)
+            return;
+        const prev = r.lastUsed ? Date.parse(r.lastUsed) : 0;
+        r.lastUsed = lastUsedIso;
+        // lastUsed is advisory. flush() rewrites and fsyncs the whole file
+        // synchronously — doing that on every authenticated request stalls the
+        // event loop, so only persist when the value moves by at least a minute.
+        // Reads stay fresh because list() serves from memory.
+        if (Date.parse(lastUsedIso) - prev >= 60_000) {
+            this.flush();
+        }
+    }
+    revoke(id) {
+        const r = this.records.get(id);
+        if (!r)
+            return false;
+        r.revoked = true;
+        this.flush();
+        return true;
+    }
+}
+let cachedBetterSqlite3 = null;
+function loadBetterSqlite3() {
+    if (cachedBetterSqlite3)
+        return cachedBetterSqlite3;
+    try {
+        const requireFn = createRequire(import.meta.url);
+        cachedBetterSqlite3 = requireFn("better-sqlite3");
+        return cachedBetterSqlite3;
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new Error(`SqliteKeyStorage requires the optional 'better-sqlite3' package, ` +
+            `which isn't installed. Install it with:\n` +
+            `  npm install better-sqlite3\n` +
+            `Or use FileKeyStorage (default) / MemoryKeyStorage instead.\n` +
+            `Underlying error: ${reason}`);
+    }
+}
+/**
+ * Optional ApiKeyStorageAdapter backed by better-sqlite3. Requires the
+ * `better-sqlite3` package to be installed separately — Station Kit no
+ * longer ships it as a hard dependency.
+ *
+ * Prefer `FileKeyStorage` (the default) unless you specifically need
+ * sqlite features (concurrent reads from multiple processes, large
+ * key catalogs, etc.).
  */
 export class SqliteKeyStorage {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     db;
     table;
     constructor(options) {
@@ -14,6 +149,7 @@ export class SqliteKeyStorage {
             throw new Error(`Invalid table name "${tableName}"`);
         }
         this.table = tableName;
+        const Database = loadBetterSqlite3();
         this.db = new Database(options.dbPath);
         this.db.pragma("journal_mode = WAL");
         this.db.exec(`
@@ -71,7 +207,15 @@ export class SqliteKeyStorage {
             revoked: Boolean(row.revoked),
         }));
     }
+    /** Last persisted lastUsed per key id, to skip per-request UPDATEs. */
+    lastTouched = new Map();
     touch(id, lastUsedIso) {
+        // lastUsed is advisory — throttle writes to once a minute per key.
+        const prev = this.lastTouched.get(id) ?? 0;
+        const next = Date.parse(lastUsedIso);
+        if (next - prev < 60_000)
+            return;
+        this.lastTouched.set(id, next);
         this.db.prepare(`UPDATE ${this.table} SET last_used = ? WHERE id = ?`).run(lastUsedIso, id);
     }
     revoke(id) {
@@ -129,27 +273,44 @@ export class MemoryKeyStorage {
         return true;
     }
 }
-// ─── KeyStore — owns crypto, delegates persistence ──────────────────
 export class KeyStore {
     storage;
+    pepper;
     /**
      * Pass an `ApiKeyStorageAdapter` for any backend. The string overload is
-     * retained for backwards compatibility — it constructs a SqliteKeyStorage
-     * at the given path.
+     * retained for backwards compatibility — it constructs a FileKeyStorage
+     * at the given path. (Previously this returned a SqliteKeyStorage; SQLite
+     * is now opt-in to avoid native build dependencies.)
      */
-    constructor(storageOrDbPath) {
-        if (typeof storageOrDbPath === "string") {
-            this.storage = new SqliteKeyStorage({ dbPath: storageOrDbPath });
+    constructor(storageOrPath, options) {
+        if (typeof storageOrPath === "string") {
+            const filePath = storageOrPath.endsWith(".db")
+                ? storageOrPath.replace(/\.db$/, ".json")
+                : storageOrPath;
+            this.storage = new FileKeyStorage({ filePath });
         }
         else {
-            this.storage = storageOrDbPath;
+            this.storage = storageOrPath;
+        }
+        if (options?.pepper)
+            this.pepper = Buffer.from(options.pepper, "utf8");
+    }
+    /** Peppered hash for new keys — HMAC-SHA256 when a pepper is set, else SHA-256. */
+    hashKey(rawKey) {
+        if (this.pepper) {
+            return crypto.createHmac("sha256", this.pepper).update(rawKey).digest("hex");
         }
+        return crypto.createHash("sha256").update(rawKey).digest("hex");
+    }
+    /** Unpeppered SHA-256 — used to verify keys stored before a pepper was configured. */
+    legacyHashKey(rawKey) {
+        return crypto.createHash("sha256").update(rawKey).digest("hex");
     }
     /** Generate a new API key. Returns the full key (only shown once) and the stored record. */
     async create(name, scopes = ["trigger", "read"]) {
         const id = crypto.randomUUID();
         const rawKey = `sk_live_${crypto.randomBytes(16).toString("hex")}`;
-        const keyHash = crypto.createHash("sha256").update(rawKey).digest("hex");
+        const keyHash = this.hashKey(rawKey);
         const keyPrefix = rawKey.slice(0, 12);
         const createdAt = new Date().toISOString();
         const record = {
@@ -161,8 +322,12 @@ export class KeyStore {
     }
     /** Verify an API key. Returns the key record if valid, null otherwise. */
     async verify(rawKey) {
-        const keyHash = crypto.createHash("sha256").update(rawKey).digest("hex");
-        const record = await this.storage.findByHash(keyHash);
+        let record = await this.storage.findByHash(this.hashKey(rawKey));
+        // Fall back to the unpeppered hash for keys created before the pepper was
+        // configured, so enabling a pepper doesn't invalidate existing keys.
+        if (!record && this.pepper) {
+            record = await this.storage.findByHash(this.legacyHashKey(rawKey));
+        }
         if (!record)
             return null;
         if (record.revoked)

package/dist/server/auth/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/server/auth/keys.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAsCtC;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IACnB,EAAE,CAAoB;IACtB,KAAK,CAAS;IAEtB,YAAY,OAAgC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;QAClD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;mCACkB,IAAI,CAAC,KAAK;;;;;;;;;;;KAWxC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;oBACA,IAAI,CAAC,KAAK;;;;KAIzB,CAAC,CAAC,GAAG,CAAC;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC;uBACQ,IAAI,CAAC,KAAK,qBAAqB,CAAC;aAChD,GAAG,CAAC,OAAO,CAAwC,CAAC;QACvD,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC;uBACQ,IAAI,CAAC,KAAK,2BAA2B,CAAC;aACtD,GAAG,EAA+B,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,EAAY;YACpB,IAAI,EAAE,GAAG,CAAC,IAAc;YACxB,SAAS,EAAE,GAAG,CAAC,UAAoB;YACnC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAgB,CAAC;YACxC,SAAS,EAAE,GAAG,CAAC,UAAoB;YACnC,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;YAClD,SAAS,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;YACpD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,EAAU,EAAE,WAAmB;QACnC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,iCAAiC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,+BAA+B,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,IAAI,EAAE,GAAG,CAAC,IAAc;QACxB,OAAO,EAAE,GAAG,CAAC,QAAkB;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAoB;QACnC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAgB,CAAC;QACxC,SAAS,EAAE,GAAG,CAAC,UAAoB;QACnC,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QAClD,SAAS,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;QACpD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,uEAAuE;AAEvE,MAAM,OAAO,gBAAgB;IACnB,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;aACrC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,EAAU,EAAE,WAAmB;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YAAE,CAAC,CAAC,QAAQ,GAAG,WAAW,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,uEAAuE;AAEvE,MAAM,OAAO,QAAQ;IACX,OAAO,CAAuB;IAEtC;;;;OAIG;IACH,YAAY,eAA8C;QACxD,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,OAAO,GAAG,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC;QACjC,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,SAAmB,CAAC,SAAS,EAAE,MAAM,CAAC;QAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,MAAM,MAAM,GAAW;YACrB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS;YAC/C,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK;SAChD,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAE7E,wEAAwE;QACxE,uEAAuE;QACvE,2CAA2C;QAC3C,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;aACnE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,0BAA0B;IAC1B,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACrD,CAAC;CACF"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/server/auth/keys.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EAEV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoCpC;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,cAAc;IACjB,QAAQ,CAAS;IACjB,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,YAAY,OAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;YACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,IAAI,IAAI;oBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,oEAAoE;QACpE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACpB,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,sEAAsE;QACtE,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,uDAAuD;QACzD,CAAC;IACH,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;aACrC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,EAAU,EAAE,WAAmB;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,QAAQ,GAAG,WAAW,CAAC;QACzB,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,sDAAsD;QACtD,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAcD,IAAI,mBAAmB,GAA+B,IAAI,CAAC;AAE3D,SAAS,iBAAiB;IACxB,IAAI,mBAAmB;QAAE,OAAO,mBAAmB,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,mBAAmB,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAClD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,2CAA2C;YAC3C,gCAAgC;YAChC,+DAA+D;YAC/D,qBAAqB,MAAM,EAAE,CAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAgB;IAC3B,8DAA8D;IACtD,EAAE,CAAM;IACR,KAAK,CAAS;IAEtB,YAAY,OAAgC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;QAClD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;mCACkB,IAAI,CAAC,KAAK;;;;;;;;;;;KAWxC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;oBACA,IAAI,CAAC,KAAK;;;;KAIzB,CAAC,CAAC,GAAG,CAAC;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC;uBACQ,IAAI,CAAC,KAAK,qBAAqB,CAAC;aAChD,GAAG,CAAC,OAAO,CAAwC,CAAC;QACvD,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC;uBACQ,IAAI,CAAC,KAAK,2BAA2B,CAAC;aACtD,GAAG,EAA+B,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,EAAY;YACpB,IAAI,EAAE,GAAG,CAAC,IAAc;YACxB,SAAS,EAAE,GAAG,CAAC,UAAoB;YACnC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAgB,CAAC;YACxC,SAAS,EAAE,GAAG,CAAC,UAAoB;YACnC,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;YAClD,SAAS,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;YACpD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,uEAAuE;IAC/D,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEhD,KAAK,CAAC,EAAU,EAAE,WAAmB;QACnC,mEAAmE;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,IAAI,GAAG,IAAI,GAAG,MAAM;YAAE,OAAO;QACjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,iCAAiC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,+BAA+B,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,IAAI,EAAE,GAAG,CAAC,IAAc;QACxB,OAAO,EAAE,GAAG,CAAC,QAAkB;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAoB;QACnC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAgB,CAAC;QACxC,SAAS,EAAE,GAAG,CAAC,UAAoB;QACnC,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QAClD,SAAS,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;QACpD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,uEAAuE;AAEvE,MAAM,OAAO,gBAAgB;IACnB,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;aACrC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,EAAU,EAAE,WAAmB;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YAAE,CAAC,CAAC,QAAQ,GAAG,WAAW,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAeD,MAAM,OAAO,QAAQ;IACX,OAAO,CAAuB;IAC9B,MAAM,CAAU;IAExB;;;;;OAKG;IACH,YAAY,aAA4C,EAAE,OAAyB;QACjF,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC5C,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;gBACzC,CAAC,CAAC,aAAa,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,EAAE,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,mFAAmF;IAC3E,OAAO,CAAC,MAAc;QAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,sFAAsF;IAC9E,aAAa,CAAC,MAAc;QAClC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,SAAmB,CAAC,SAAS,EAAE,MAAM,CAAC;QAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,MAAM,MAAM,GAAW;YACrB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS;YAC/C,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK;SAChD,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAE7E,wEAAwE;QACxE,uEAAuE;QACvE,2CAA2C;QAC3C,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;aACnE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,0BAA0B;IAC1B,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACrD,CAAC;CACF"}

package/dist/server/auth/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/server/auth/session.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AASD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAKhE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAchF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAOpG"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/server/auth/session.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAqCD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAKhE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAchF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAMpG"}

package/dist/server/auth/session.js

@@ -1,15 +1,39 @@
 import crypto from "node:crypto";
 const SESSION_TTL_MS = 86_400_000; // 24 hours
-/** HMAC-sign a token. The secret is derived from the password. */
-function sign(payload, secret) {
-    const hmac = crypto.createHmac("sha256", secret);
+/**
+ * Derive the HMAC signing key from the password via HKDF instead of using
+ * the cleartext password as the key directly — issued cookies should not be
+ * HMACs keyed with the literal admin credential. Cached because HKDF per
+ * request would be wasted CPU.
+ */
+const secretCache = new Map();
+function sessionSecret(config) {
+    let secret = secretCache.get(config.password);
+    if (!secret) {
+        secret = Buffer.from(crypto.hkdfSync("sha256", config.password, "station-kit", "session-token-v1", 32));
+        secretCache.set(config.password, secret);
+    }
+    return secret;
+}
+function sign(payload, config) {
+    const hmac = crypto.createHmac("sha256", sessionSecret(config));
     hmac.update(payload);
     return hmac.digest("hex");
 }
+/**
+ * Timing-safe string comparison that doesn't leak length: both inputs are
+ * hashed to a fixed size before `timingSafeEqual` (which requires equal
+ * lengths and would otherwise short-circuit on a length check).
+ */
+function safeEqual(a, b) {
+    const ha = crypto.createHash("sha256").update(a).digest();
+    const hb = crypto.createHash("sha256").update(b).digest();
+    return crypto.timingSafeEqual(ha, hb);
+}
 export function createSessionToken(config) {
     const exp = Date.now() + (config.sessionTtlMs ?? SESSION_TTL_MS);
     const payload = `${config.username}:${exp}`;
-    const signature = sign(payload, config.password);
+    const signature = sign(payload, config);
     return Buffer.from(`${payload}:${signature}`).toString("base64url");
 }
 export function verifySessionToken(token, config) {
@@ -24,19 +48,18 @@ export function verifySessionToken(token, config) {
             return false;
         if (username !== config.username)
             return false;
-        const expected = sign(`${username}:${expStr}`, config.password);
-        return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
+        const expected = sign(`${username}:${expStr}`, config);
+        return safeEqual(sig, expected);
     }
     catch {
         return false;
     }
 }
 export function verifyCredentials(username, password, config) {
-    // Use timing-safe comparison to prevent timing attacks
-    const userMatch = username.length === config.username.length &&
-        crypto.timingSafeEqual(Buffer.from(username), Buffer.from(config.username));
-    const passMatch = password.length === config.password.length &&
-        crypto.timingSafeEqual(Buffer.from(password), Buffer.from(config.password));
+    // Evaluate both comparisons unconditionally so a valid username isn't
+    // distinguishable from an invalid one by response time.
+    const userMatch = safeEqual(username, config.username);
+    const passMatch = safeEqual(password, config.password);
     return userMatch && passMatch;
 }
 //# sourceMappingURL=session.js.map

package/dist/server/auth/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/server/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,WAAW;AAQ9C,kEAAkE;AAClE,SAAS,IAAI,CAAC,OAAe,EAAE,MAAc;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,cAAc,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAqB;IACrE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;QACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,QAAgB,EAAE,MAAqB;IACzF,uDAAuD;IACvD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC1D,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC1D,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,OAAO,SAAS,IAAI,SAAS,CAAC;AAChC,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/server/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,WAAW;AAQ9C;;;;;GAKG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC9C,SAAS,aAAa,CAAC,MAAqB;IAC1C,IAAI,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,MAAM,CAAC,IAAI,CAClB,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAClF,CAAC;QACF,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,IAAI,CAAC,OAAe,EAAE,MAAqB;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1D,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1D,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,cAAc,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAqB;IACrE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;QACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QACvD,OAAO,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,QAAgB,EAAE,MAAqB;IACzF,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,SAAS,IAAI,SAAS,CAAC;AAChC,CAAC"}

package/dist/server/index.d.ts

@@ -1,7 +1,10 @@
 import type { StationConfig } from "../config/schema.js";
 import { KeyStore } from "./auth/keys.js";
-export { KeyStore, SqliteKeyStorage, MemoryKeyStorage, } from "./auth/keys.js";
-export type { ApiKey, ApiKeyPublic, ApiKeyStorageAdapter, SqliteKeyStorageOptions, } from "./auth/keys.js";
+export { KeyStore, FileKeyStorage, SqliteKeyStorage, MemoryKeyStorage, } from "./auth/keys.js";
+export type { ApiKey, ApiKeyPublic, ApiKeyStorageAdapter, FileKeyStorageOptions, SqliteKeyStorageOptions, } from "./auth/keys.js";
+export { LogStore, FileLogStorage, MemoryLogStorage, } from "./log-store.js";
+export type { LogStorageAdapter, FileLogStorageOptions, } from "./log-store.js";
+export type { LogEntry } from "./log-buffer.js";
 export interface StationInstance {
     start(): Promise<void>;
     stop(): Promise<void>;

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAWzD,OAAO,EAAE,QAAQ,EAAoB,MAAM,gBAAgB,CAAC;AAiB5D,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,eAAe;IAC9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA0VnH"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD,OAAO,EAAE,QAAQ,EAAkB,MAAM,gBAAgB,CAAC;AAkB1D,OAAO,EACL,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,QAAQ,EACR,cAAc,EACd,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,WAAW,eAAe;IAC9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAsbnH"}