@acorex-platform/module-auth-server 0.0.15 → 2.0.0-next.42

package/contracts/src/commands.keys.d.ts

@@ -12,9 +12,19 @@ export declare const AXMAuthCommandKeys: {
     };
     readonly Security: {
         readonly ChangePassword: "auth:change-password";
+        readonly ManageTwoFactor: "auth:manage-two-factor";
         readonly SetPinCode: "auth:set-pin-code";
         readonly RemovePinCode: "auth:remove-pin-code";
         readonly ViewLoginHistory: "auth:view-login-history";
         readonly EditSignature: "auth:edit-signature";
     };
+    readonly Onboarding: {
+        readonly Welcome: "auth:welcome-onboarding";
+    };
+    readonly Account: {
+        /** Opens `/auth/account/waiting-room` (e.g. from membership-invite inbox action). */
+        readonly OpenWaitingRoom: "auth:open-waiting-room";
+    };
 };
+/** Scheduled purge of DeviceSessions idle past the InactiveSessionTermination setting. */
+export declare const AXM_AUTH_INACTIVE_SESSION_TERMINATION_PURGE_COMMAND_KEY: "auth.inactive-session.terminate";

package/contracts/src/commands.keys.js

@@ -1,7 +1,7 @@
 "use strict";
 //#region ---- Command keys ----
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AXMAuthCommandKeys = void 0;
+exports.AXM_AUTH_INACTIVE_SESSION_TERMINATION_PURGE_COMMAND_KEY = exports.AXMAuthCommandKeys = void 0;
 exports.AXMAuthCommandKeys = {
     Profile: {
         Show: 'auth:profile',
@@ -16,11 +16,21 @@ exports.AXMAuthCommandKeys = {
     },
     Security: {
         ChangePassword: 'auth:change-password',
+        ManageTwoFactor: 'auth:manage-two-factor',
         SetPinCode: 'auth:set-pin-code',
         RemovePinCode: 'auth:remove-pin-code',
         ViewLoginHistory: 'auth:view-login-history',
         EditSignature: 'auth:edit-signature',
     },
+    Onboarding: {
+        Welcome: 'auth:welcome-onboarding',
+    },
+    Account: {
+        /** Opens `/auth/account/waiting-room` (e.g. from membership-invite inbox action). */
+        OpenWaitingRoom: 'auth:open-waiting-room',
+    },
 };
+/** Scheduled purge of DeviceSessions idle past the InactiveSessionTermination setting. */
+exports.AXM_AUTH_INACTIVE_SESSION_TERMINATION_PURGE_COMMAND_KEY = 'auth.inactive-session.terminate';
 //#endregion
 //# sourceMappingURL=commands.keys.js.map

package/contracts/src/commands.keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"commands.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/server/contracts/src/commands.keys.ts"],"names":[],"mappings":";AAAA,gCAAgC;;;AAEnB,QAAA,kBAAkB,GAAG;IAChC,OAAO,EAAE;QACP,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,mBAAmB;QAChC,eAAe,EAAE,wBAAwB;QACzC,UAAU,EAAE,0BAA0B;KACvC;IACD,OAAO,EAAE;QACP,OAAO,EAAE,cAAc;QACvB,YAAY,EAAE,oBAAoB;QAClC,UAAU,EAAE,kBAAkB;KAC/B;IACD,QAAQ,EAAE;QACR,cAAc,EAAE,sBAAsB;QACtC,UAAU,EAAE,mBAAmB;QAC/B,aAAa,EAAE,sBAAsB;QACrC,gBAAgB,EAAE,yBAAyB;QAC3C,aAAa,EAAE,qBAAqB;KACrC;CACO,CAAC;AAEX,YAAY"}
+{"version":3,"file":"commands.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/contracts/src/commands.keys.ts"],"names":[],"mappings":";AAAA,gCAAgC;;;AAEnB,QAAA,kBAAkB,GAAG;IAChC,OAAO,EAAE;QACP,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,mBAAmB;QAChC,eAAe,EAAE,wBAAwB;QACzC,UAAU,EAAE,0BAA0B;KACvC;IACD,OAAO,EAAE;QACP,OAAO,EAAE,cAAc;QACvB,YAAY,EAAE,oBAAoB;QAClC,UAAU,EAAE,kBAAkB;KAC/B;IACD,QAAQ,EAAE;QACR,cAAc,EAAE,sBAAsB;QACtC,eAAe,EAAE,wBAAwB;QACzC,UAAU,EAAE,mBAAmB;QAC/B,aAAa,EAAE,sBAAsB;QACrC,gBAAgB,EAAE,yBAAyB;QAC3C,aAAa,EAAE,qBAAqB;KACrC;IACD,UAAU,EAAE;QACV,OAAO,EAAE,yBAAyB;KACnC;IACD,OAAO,EAAE;QACP,qFAAqF;QACrF,eAAe,EAAE,wBAAwB;KAC1C;CACO,CAAC;AAEX,0FAA0F;AAC7E,QAAA,uDAAuD,GAClE,iCAA0C,CAAC;AAE7C,YAAY"}

package/contracts/src/index.d.ts

@@ -1,6 +1,6 @@
 export * from './commands.keys';
-export * from './datasource.keys';
 export * from './menu.keys';
 export * from './permission.keys';
+export * from './queries.keys';
 export * from './root-config';
 export * from './settings.keys';

package/contracts/src/index.js

@@ -3,9 +3,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./commands.keys"), exports);
-tslib_1.__exportStar(require("./datasource.keys"), exports);
 tslib_1.__exportStar(require("./menu.keys"), exports);
 tslib_1.__exportStar(require("./permission.keys"), exports);
+tslib_1.__exportStar(require("./queries.keys"), exports);
 tslib_1.__exportStar(require("./root-config"), exports);
 tslib_1.__exportStar(require("./settings.keys"), exports);
 //#endregion

package/contracts/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/server/contracts/src/index.ts"],"names":[],"mappings":";AAAA,oCAAoC;;;AAEpC,0DAAgC;AAChC,4DAAkC;AAClC,sDAA4B;AAC5B,4DAAkC;AAClC,wDAA8B;AAC9B,0DAAgC;AAEhC,YAAY"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/contracts/src/index.ts"],"names":[],"mappings":";AAAA,oCAAoC;;;AAEpC,0DAAgC;AAChC,sDAA4B;AAC5B,4DAAkC;AAClC,yDAA+B;AAC/B,wDAA8B;AAC9B,0DAAgC;AAEhC,YAAY"}

package/contracts/src/menu.keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"menu.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/server/contracts/src/menu.keys.ts"],"names":[],"mappings":";;;AAAa,QAAA,eAAe,GAAG,EAAW,CAAC"}
+{"version":3,"file":"menu.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/contracts/src/menu.keys.ts"],"names":[],"mappings":";;;AAAa,QAAA,eAAe,GAAG,EAAW,CAAC"}

package/contracts/src/permission.keys.d.ts

@@ -1,5 +1,15 @@
+/**
+ * Auth stub — maps legacy Management to Administration Access.
+ * Prefer {@link AXPAdministrationPermissionKeys} from security-management contracts when wiring real checks.
+ */
+export declare const AXPAdministrationPermissionKeys: {
+    readonly Access: "Administration:Permission:Access";
+};
+/**
+ * @deprecated Prefer Administration Access / conceptual keys.
+ */
 export declare const AXMPermissionsKeys: {
-    Auth: {
-        Management: string;
+    readonly Auth: {
+        readonly Management: "Administration:Permission:Access";
     };
 };

package/contracts/src/permission.keys.js

@@ -1,10 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AXMPermissionsKeys = void 0;
+exports.AXMPermissionsKeys = exports.AXPAdministrationPermissionKeys = void 0;
+/**
+ * Auth stub — maps legacy Management to Administration Access.
+ * Prefer {@link AXPAdministrationPermissionKeys} from security-management contracts when wiring real checks.
+ */
+exports.AXPAdministrationPermissionKeys = {
+    Access: 'Administration:Permission:Access',
+};
+/**
+ * @deprecated Prefer Administration Access / conceptual keys.
+ */
 exports.AXMPermissionsKeys = {
     Auth: {
-        Management: 'Auth:Permission:Management',
-        // TODO: Add permission keys when permissions are defined
+        Management: exports.AXPAdministrationPermissionKeys.Access,
     },
 };
 //# sourceMappingURL=permission.keys.js.map

package/contracts/src/permission.keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/server/contracts/src/permission.keys.ts"],"names":[],"mappings":";;;AAAa,QAAA,kBAAkB,GAAG;IAChC,IAAI,EAAE;QACJ,UAAU,EAAE,4BAA4B;QACxC,yDAAyD;KAC1D;CACF,CAAC"}
+{"version":3,"file":"permission.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/contracts/src/permission.keys.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACU,QAAA,+BAA+B,GAAG;IAC7C,MAAM,EAAE,kCAAkC;CAClC,CAAC;AAEX;;GAEG;AACU,QAAA,kBAAkB,GAAG;IAChC,IAAI,EAAE;QACJ,UAAU,EAAE,uCAA+B,CAAC,MAAM;KACnD;CACO,CAAC"}

package/contracts/src/queries.keys.d.ts

@@ -0,0 +1,6 @@
+export declare const AXMAuthQueryKeys: {
+    readonly Captcha: {
+        /** Connected captcha IntegrationConnections for platform Default Captcha Provider select. */
+        readonly ListConnectedProviders: "Auth:Query:Captcha.ListConnectedProviders";
+    };
+};

package/contracts/src/queries.keys.js

@@ -0,0 +1,12 @@
+"use strict";
+//#region ---- Query keys ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AXMAuthQueryKeys = void 0;
+exports.AXMAuthQueryKeys = {
+    Captcha: {
+        /** Connected captcha IntegrationConnections for platform Default Captcha Provider select. */
+        ListConnectedProviders: 'Auth:Query:Captcha.ListConnectedProviders',
+    },
+};
+//#endregion
+//# sourceMappingURL=queries.keys.js.map

package/contracts/src/queries.keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queries.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/contracts/src/queries.keys.ts"],"names":[],"mappings":";AAAA,8BAA8B;;;AAEjB,QAAA,gBAAgB,GAAG;IAC9B,OAAO,EAAE;QACP,6FAA6F;QAC7F,sBAAsB,EAAE,2CAA2C;KACpE;CACO,CAAC;AAEX,YAAY"}

package/contracts/src/root-config.d.ts

@@ -9,4 +9,13 @@ export declare const RootConfig: {
         readonly title: "@auth:module.title";
         readonly icon: "fa-light fa-shield-keyhole";
     };
+    /**
+     * Platform schedule: revoke DeviceSessions idle longer than
+     * {@link AXPAuthSettings.InactiveSessionTermination} (user override → tenant default).
+     * Cron every minute so the 1-minute option is testable.
+     */
+    readonly inactiveSessionTermination: {
+        readonly providerKey: "auth";
+        readonly defaultCron: "* * * * *";
+    };
 };

package/contracts/src/root-config.js

@@ -13,5 +13,14 @@ exports.RootConfig = {
         title: '@auth:module.title',
         icon: 'fa-light fa-shield-keyhole',
     },
+    /**
+     * Platform schedule: revoke DeviceSessions idle longer than
+     * {@link AXPAuthSettings.InactiveSessionTermination} (user override → tenant default).
+     * Cron every minute so the 1-minute option is testable.
+     */
+    inactiveSessionTermination: {
+        providerKey: 'auth',
+        defaultCron: '* * * * *',
+    },
 };
 //# sourceMappingURL=root-config.js.map

package/contracts/src/root-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"root-config.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/server/contracts/src/root-config.ts"],"names":[],"mappings":";;;AAAA,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,MAAM;CACf,CAAC;AAEW,QAAA,UAAU,GAAG;IACxB,MAAM;IACN,MAAM,EAAE;QACN,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,4BAA4B;KACnC;CACO,CAAC"}
+{"version":3,"file":"root-config.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/contracts/src/root-config.ts"],"names":[],"mappings":";;;AAAA,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,MAAM;CACf,CAAC;AAEW,QAAA,UAAU,GAAG;IACxB,MAAM;IACN,MAAM,EAAE;QACN,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,4BAA4B;KACnC;IACD;;;;OAIG;IACH,0BAA0B,EAAE;QAC1B,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,WAAW;KACzB;CACO,CAAC"}

package/contracts/src/settings.keys.d.ts

@@ -1,12 +1,32 @@
+import type { AXPMultiLanguageString } from '@acorex-platform/framework-shared/core';
 export declare enum AXPAuthSettings {
-    TwoFactorAuth = "Auth:Setting:Authentication.TwoFactorAuth",
+    /** User-scoped: login requires verified authenticator enrollment when true. */
+    UserTwoFactorEnabled = "Auth:Setting:User.TwoFactor.Enabled",
     PasswordComplexity = "Auth:Setting:Authentication.PasswordComplexity",
     PasswordExpiryDays = "Auth:Setting:Authentication.PasswordExpiryDays",
     MaxLoginAttempts = "Auth:Setting:Authentication.MaxLoginAttempts",
     LockoutDuration = "Auth:Setting:Authentication.LockoutDuration",
+    CaptchaAttemptThreshold = "Auth:Setting:Authentication.CaptchaAttemptThreshold",
+    /**
+     * Platform: Integration provider id used for login captcha
+     * (e.g. `google-recaptcha`). Empty = captcha disabled until selected.
+     */
+    DefaultCaptchaProvider = "Auth:Setting:Authentication.DefaultCaptchaProvider",
+    /** Platform sign-in page branding (multi-language string). */
+    SignInPageSlogan = "Auth:Setting:SignInPage.Slogan",
+    SignInPageDescription = "Auth:Setting:SignInPage.Description",
+    /** Platform sign-up policy. */
+    SignUpEnabled = "Auth:Setting:SignUp.Enabled",
+    SignUpUrl = "Auth:Setting:SignUp.Url",
+    /** Platform sign-in credential UX + default strategy. */
+    SignInCredentialType = "Auth:Setting:SignIn.CredentialType",
+    SignInDefaultStrategy = "Auth:Setting:SignIn.DefaultStrategy",
     LockWhenIdleEnabled = "Auth:Setting:SessionManagement.LockWhenIdleEnabled",
     LockWhenIdleMinutes = "Auth:Setting:SessionManagement.LockWhenIdleMinutes",
-    InactiveSessionTermination = "Auth:Setting:SessionManagement.InactiveSessionTermination"
+    InactiveSessionTermination = "Auth:Setting:SessionManagement.InactiveSessionTermination",
+    MaxActiveDeviceSessions = "Auth:Setting:SessionManagement.MaxActiveDeviceSessions",
+    /** User-scoped welcome onboarding progress blob. */
+    OnboardingWelcome = "Auth:Setting:Onboarding.Welcome"
 }
 export declare const AXPAuthInactiveSessionTerminationOptions: {
     readonly OneWeek: "oneWeek";
@@ -15,3 +35,36 @@ export declare const AXPAuthInactiveSessionTerminationOptions: {
     readonly SixMonths: "sixMonths";
 };
 export type AXPAuthInactiveSessionTerminationValue = (typeof AXPAuthInactiveSessionTerminationOptions)[keyof typeof AXPAuthInactiveSessionTerminationOptions];
+/** Shared select options for settings UI + Active Sessions modal (i18n title keys). */
+export declare const AXP_AUTH_INACTIVE_SESSION_TERMINATION_OPTION_DEFINITIONS: ReadonlyArray<{
+    id: AXPAuthInactiveSessionTerminationValue;
+    titleKey: string;
+}>;
+/** Inactivity window for each stored termination option. */
+export declare const AXP_AUTH_INACTIVE_SESSION_TERMINATION_DURATION_MS: Record<AXPAuthInactiveSessionTerminationValue, number>;
+export declare const AXP_AUTH_INACTIVE_SESSION_TERMINATION_SETTING_DEFAULTS: {
+    readonly "Auth:Setting:SessionManagement.InactiveSessionTermination": "oneMonth";
+};
+export declare function isAuthInactiveSessionTerminationValue(value: unknown): value is AXPAuthInactiveSessionTerminationValue;
+export declare function resolveAuthInactiveSessionTerminationDurationMs(value: unknown): number;
+/** Stored values for {@link AXPAuthSettings.SignInCredentialType}. */
+export declare const AXPAuthCredentialTypeOptions: {
+    readonly UsernamePassword: "UsernamePassword";
+    readonly UsernameEmailPassword: "UsernameEmailPassword";
+    readonly EmailPassword: "EmailPassword";
+    readonly MobilePassword: "MobilePassword";
+    readonly EmailCode: "EmailCode";
+    readonly MobileCode: "MobileCode";
+};
+export type AXPAuthCredentialTypeValue = (typeof AXPAuthCredentialTypeOptions)[keyof typeof AXPAuthCredentialTypeOptions];
+export declare const AXP_AUTH_LOCKOUT_SETTING_DEFAULTS: {
+    readonly "Auth:Setting:Authentication.MaxLoginAttempts": 5;
+    readonly "Auth:Setting:Authentication.LockoutDuration": 3;
+    readonly "Auth:Setting:Authentication.CaptchaAttemptThreshold": 1;
+    readonly "Auth:Setting:Authentication.DefaultCaptchaProvider": "";
+};
+export declare const AXP_AUTH_MAX_ACTIVE_DEVICE_SESSIONS_SETTING_DEFAULTS: {
+    readonly "Auth:Setting:SessionManagement.MaxActiveDeviceSessions": 0;
+};
+export declare const AXP_AUTH_SIGN_IN_PAGE_SLOGAN_DEFAULT: AXPMultiLanguageString;
+export declare const AXP_AUTH_SIGN_IN_PAGE_DESCRIPTION_DEFAULT: AXPMultiLanguageString;

package/contracts/src/settings.keys.js

@@ -1,16 +1,38 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AXPAuthInactiveSessionTerminationOptions = exports.AXPAuthSettings = void 0;
+exports.AXP_AUTH_SIGN_IN_PAGE_DESCRIPTION_DEFAULT = exports.AXP_AUTH_SIGN_IN_PAGE_SLOGAN_DEFAULT = exports.AXP_AUTH_MAX_ACTIVE_DEVICE_SESSIONS_SETTING_DEFAULTS = exports.AXP_AUTH_LOCKOUT_SETTING_DEFAULTS = exports.AXPAuthCredentialTypeOptions = exports.AXP_AUTH_INACTIVE_SESSION_TERMINATION_SETTING_DEFAULTS = exports.AXP_AUTH_INACTIVE_SESSION_TERMINATION_DURATION_MS = exports.AXP_AUTH_INACTIVE_SESSION_TERMINATION_OPTION_DEFINITIONS = exports.AXPAuthInactiveSessionTerminationOptions = exports.AXPAuthSettings = void 0;
+exports.isAuthInactiveSessionTerminationValue = isAuthInactiveSessionTerminationValue;
+exports.resolveAuthInactiveSessionTerminationDurationMs = resolveAuthInactiveSessionTerminationDurationMs;
+//#region ----- Auth setting keys -----
 var AXPAuthSettings;
 (function (AXPAuthSettings) {
-    AXPAuthSettings["TwoFactorAuth"] = "Auth:Setting:Authentication.TwoFactorAuth";
+    /** User-scoped: login requires verified authenticator enrollment when true. */
+    AXPAuthSettings["UserTwoFactorEnabled"] = "Auth:Setting:User.TwoFactor.Enabled";
     AXPAuthSettings["PasswordComplexity"] = "Auth:Setting:Authentication.PasswordComplexity";
     AXPAuthSettings["PasswordExpiryDays"] = "Auth:Setting:Authentication.PasswordExpiryDays";
     AXPAuthSettings["MaxLoginAttempts"] = "Auth:Setting:Authentication.MaxLoginAttempts";
     AXPAuthSettings["LockoutDuration"] = "Auth:Setting:Authentication.LockoutDuration";
+    AXPAuthSettings["CaptchaAttemptThreshold"] = "Auth:Setting:Authentication.CaptchaAttemptThreshold";
+    /**
+     * Platform: Integration provider id used for login captcha
+     * (e.g. `google-recaptcha`). Empty = captcha disabled until selected.
+     */
+    AXPAuthSettings["DefaultCaptchaProvider"] = "Auth:Setting:Authentication.DefaultCaptchaProvider";
+    /** Platform sign-in page branding (multi-language string). */
+    AXPAuthSettings["SignInPageSlogan"] = "Auth:Setting:SignInPage.Slogan";
+    AXPAuthSettings["SignInPageDescription"] = "Auth:Setting:SignInPage.Description";
+    /** Platform sign-up policy. */
+    AXPAuthSettings["SignUpEnabled"] = "Auth:Setting:SignUp.Enabled";
+    AXPAuthSettings["SignUpUrl"] = "Auth:Setting:SignUp.Url";
+    /** Platform sign-in credential UX + default strategy. */
+    AXPAuthSettings["SignInCredentialType"] = "Auth:Setting:SignIn.CredentialType";
+    AXPAuthSettings["SignInDefaultStrategy"] = "Auth:Setting:SignIn.DefaultStrategy";
     AXPAuthSettings["LockWhenIdleEnabled"] = "Auth:Setting:SessionManagement.LockWhenIdleEnabled";
     AXPAuthSettings["LockWhenIdleMinutes"] = "Auth:Setting:SessionManagement.LockWhenIdleMinutes";
     AXPAuthSettings["InactiveSessionTermination"] = "Auth:Setting:SessionManagement.InactiveSessionTermination";
+    AXPAuthSettings["MaxActiveDeviceSessions"] = "Auth:Setting:SessionManagement.MaxActiveDeviceSessions";
+    /** User-scoped welcome onboarding progress blob. */
+    AXPAuthSettings["OnboardingWelcome"] = "Auth:Setting:Onboarding.Welcome";
 })(AXPAuthSettings || (exports.AXPAuthSettings = AXPAuthSettings = {}));
 exports.AXPAuthInactiveSessionTerminationOptions = {
     OneWeek: 'oneWeek',
@@ -18,4 +40,72 @@ exports.AXPAuthInactiveSessionTerminationOptions = {
     ThreeMonths: 'threeMonths',
     SixMonths: 'sixMonths',
 };
+/** Shared select options for settings UI + Active Sessions modal (i18n title keys). */
+exports.AXP_AUTH_INACTIVE_SESSION_TERMINATION_OPTION_DEFINITIONS = [
+    {
+        id: exports.AXPAuthInactiveSessionTerminationOptions.OneWeek,
+        titleKey: '@auth:settings.session.terminate-old-sessions.options.one-week',
+    },
+    {
+        id: exports.AXPAuthInactiveSessionTerminationOptions.OneMonth,
+        titleKey: '@auth:settings.session.terminate-old-sessions.options.one-month',
+    },
+    {
+        id: exports.AXPAuthInactiveSessionTerminationOptions.ThreeMonths,
+        titleKey: '@auth:settings.session.terminate-old-sessions.options.three-months',
+    },
+    {
+        id: exports.AXPAuthInactiveSessionTerminationOptions.SixMonths,
+        titleKey: '@auth:settings.session.terminate-old-sessions.options.six-months',
+    },
+];
+const MS_MINUTE = 60000;
+const MS_DAY = 24 * 60 * MS_MINUTE;
+/** Inactivity window for each stored termination option. */
+exports.AXP_AUTH_INACTIVE_SESSION_TERMINATION_DURATION_MS = {
+    [exports.AXPAuthInactiveSessionTerminationOptions.OneWeek]: 7 * MS_DAY,
+    [exports.AXPAuthInactiveSessionTerminationOptions.OneMonth]: 30 * MS_DAY,
+    [exports.AXPAuthInactiveSessionTerminationOptions.ThreeMonths]: 90 * MS_DAY,
+    [exports.AXPAuthInactiveSessionTerminationOptions.SixMonths]: 180 * MS_DAY,
+};
+exports.AXP_AUTH_INACTIVE_SESSION_TERMINATION_SETTING_DEFAULTS = {
+    [AXPAuthSettings.InactiveSessionTermination]: exports.AXPAuthInactiveSessionTerminationOptions.OneMonth,
+};
+function isAuthInactiveSessionTerminationValue(value) {
+    return (typeof value === 'string' &&
+        Object.values(exports.AXPAuthInactiveSessionTerminationOptions).includes(value));
+}
+function resolveAuthInactiveSessionTerminationDurationMs(value) {
+    if (isAuthInactiveSessionTerminationValue(value)) {
+        return exports.AXP_AUTH_INACTIVE_SESSION_TERMINATION_DURATION_MS[value];
+    }
+    return exports.AXP_AUTH_INACTIVE_SESSION_TERMINATION_DURATION_MS[exports.AXP_AUTH_INACTIVE_SESSION_TERMINATION_SETTING_DEFAULTS[AXPAuthSettings.InactiveSessionTermination]];
+}
+/** Stored values for {@link AXPAuthSettings.SignInCredentialType}. */
+exports.AXPAuthCredentialTypeOptions = {
+    UsernamePassword: 'UsernamePassword',
+    UsernameEmailPassword: 'UsernameEmailPassword',
+    EmailPassword: 'EmailPassword',
+    MobilePassword: 'MobilePassword',
+    EmailCode: 'EmailCode',
+    MobileCode: 'MobileCode',
+};
+exports.AXP_AUTH_LOCKOUT_SETTING_DEFAULTS = {
+    [AXPAuthSettings.MaxLoginAttempts]: 5,
+    [AXPAuthSettings.LockoutDuration]: 3,
+    [AXPAuthSettings.CaptchaAttemptThreshold]: 1,
+    [AXPAuthSettings.DefaultCaptchaProvider]: '',
+};
+exports.AXP_AUTH_MAX_ACTIVE_DEVICE_SESSIONS_SETTING_DEFAULTS = {
+    [AXPAuthSettings.MaxActiveDeviceSessions]: 0,
+};
+exports.AXP_AUTH_SIGN_IN_PAGE_SLOGAN_DEFAULT = {
+    'en-US': 'Welcome',
+    'fa-IR': 'خوش آمدید',
+};
+exports.AXP_AUTH_SIGN_IN_PAGE_DESCRIPTION_DEFAULT = {
+    'en-US': 'Sign in to continue to your applications.',
+    'fa-IR': 'برای ادامه به برنامه‌های خود وارد شوید.',
+};
+//#endregion
 //# sourceMappingURL=settings.keys.js.map

package/contracts/src/settings.keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/server/contracts/src/settings.keys.ts"],"names":[],"mappings":";;;AAAA,IAAY,eASX;AATD,WAAY,eAAe;IACzB,8EAA2D,CAAA;IAC3D,wFAAqE,CAAA;IACrE,wFAAqE,CAAA;IACrE,oFAAiE,CAAA;IACjE,kFAA+D,CAAA;IAC/D,6FAA0E,CAAA;IAC1E,6FAA0E,CAAA;IAC1E,2GAAwF,CAAA;AAC1F,CAAC,EATW,eAAe,+BAAf,eAAe,QAS1B;AAEY,QAAA,wCAAwC,GAAG;IACtD,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;CACd,CAAC"}
+{"version":3,"file":"settings.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/contracts/src/settings.keys.ts"],"names":[],"mappings":";;;AA0FA,sFAOC;AAED,0GASC;AA1GD,uCAAuC;AAEvC,IAAY,eAiCX;AAjCD,WAAY,eAAe;IACzB,+EAA+E;IAC/E,+EAA4D,CAAA;IAC5D,wFAAqE,CAAA;IACrE,wFAAqE,CAAA;IACrE,oFAAiE,CAAA;IACjE,kFAA+D,CAAA;IAC/D,kGAA+E,CAAA;IAC/E;;;OAGG;IACH,gGAA6E,CAAA;IAE7E,8DAA8D;IAC9D,sEAAmD,CAAA;IACnD,gFAA6D,CAAA;IAE7D,+BAA+B;IAC/B,gEAA6C,CAAA;IAC7C,wDAAqC,CAAA;IAErC,yDAAyD;IACzD,8EAA2D,CAAA;IAC3D,gFAA6D,CAAA;IAE7D,6FAA0E,CAAA;IAC1E,6FAA0E,CAAA;IAC1E,2GAAwF,CAAA;IACxF,qGAAkF,CAAA;IAElF,oDAAoD;IACpD,wEAAqD,CAAA;AACvD,CAAC,EAjCW,eAAe,+BAAf,eAAe,QAiC1B;AAEY,QAAA,wCAAwC,GAAG;IACtD,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;CACd,CAAC;AAKX,uFAAuF;AAC1E,QAAA,wDAAwD,GAGhE;IACH;QACE,EAAE,EAAE,gDAAwC,CAAC,OAAO;QACpD,QAAQ,EAAE,gEAAgE;KAC3E;IACD;QACE,EAAE,EAAE,gDAAwC,CAAC,QAAQ;QACrD,QAAQ,EAAE,iEAAiE;KAC5E;IACD;QACE,EAAE,EAAE,gDAAwC,CAAC,WAAW;QACxD,QAAQ,EAAE,oEAAoE;KAC/E;IACD;QACE,EAAE,EAAE,gDAAwC,CAAC,SAAS;QACtD,QAAQ,EAAE,kEAAkE;KAC7E;CACF,CAAC;AAEF,MAAM,SAAS,GAAG,KAAM,CAAC;AACzB,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC;AAEnC,4DAA4D;AAC/C,QAAA,iDAAiD,GAG1D;IACF,CAAC,gDAAwC,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,MAAM;IAC9D,CAAC,gDAAwC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,MAAM;IAChE,CAAC,gDAAwC,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,MAAM;IACnE,CAAC,gDAAwC,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,MAAM;CACnE,CAAC;AAEW,QAAA,sDAAsD,GAAG;IACpE,CAAC,eAAe,CAAC,0BAA0B,CAAC,EAAE,gDAAwC,CAAC,QAAQ;CACvF,CAAC;AAEX,SAAgB,qCAAqC,CACnD,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,MAAM,CAAC,MAAM,CAAC,gDAAwC,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtF,CAAC;AACJ,CAAC;AAED,SAAgB,+CAA+C,CAC7D,KAAc;IAEd,IAAI,qCAAqC,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,yDAAiD,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,yDAAiD,CACtD,8DAAsD,CAAC,eAAe,CAAC,0BAA0B,CAAC,CACnG,CAAC;AACJ,CAAC;AAED,sEAAsE;AACzD,QAAA,4BAA4B,GAAG;IAC1C,gBAAgB,EAAE,kBAAkB;IACpC,qBAAqB,EAAE,uBAAuB;IAC9C,aAAa,EAAE,eAAe;IAC9B,cAAc,EAAE,gBAAgB;IAChC,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;CAChB,CAAC;AAKE,QAAA,iCAAiC,GAAG;IAC/C,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACrC,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;IACpC,CAAC,eAAe,CAAC,uBAAuB,CAAC,EAAE,CAAC;IAC5C,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE,EAAE;CACpC,CAAC;AAEE,QAAA,oDAAoD,GAAG;IAClE,CAAC,eAAe,CAAC,uBAAuB,CAAC,EAAE,CAAC;CACpC,CAAC;AAEE,QAAA,oCAAoC,GAA2B;IAC1E,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,WAAW;CACrB,CAAC;AAEW,QAAA,yCAAyC,GAA2B;IAC/E,OAAO,EAAE,2CAA2C;IACpD,OAAO,EAAE,yCAAyC;CACnD,CAAC;AAEF,YAAY"}

package/package.json

@@ -1,29 +1,35 @@
 {
   "name": "@acorex-platform/module-auth-server",
-  "version": "0.0.15",
+  "version": "2.0.0-next.42",
   "type": "commonjs",
-  "main": "./src/index.js",
-  "types": "./src/index.d.ts",
+  "main": "./server/src/index.js",
+  "types": "./server/src/index.d.ts",
   "peerDependencies": {
+    "@acorex-platform/framework-server": "2.0.0-next.42",
+    "@acorex-platform/framework-shared": "2.0.0-next.42",
+    "@acorex-platform/module-auth-client": "2.0.0-next.42",
+    "@acorex-platform/module-integration-management-client": "2.0.0-next.42",
+    "@acorex-platform/module-settings-management-client": "2.0.0-next.42",
+    "@acorex-platform/module-settings-management-server": "2.0.0-next.42",
     "@nestjs/common": "^11.0.0",
-    "@acorex-platform/module-common-server": "0.0.15",
-    "@nestjs/passport": "^11.0.0",
-    "passport": "^0.7.0",
-    "passport-local": "^1.0.0",
-    "passport-jwt": "^4.0.1",
-    "@nestjs/jwt": "^11.0.0",
     "@nestjs/config": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/jwt": "^11.0.0",
+    "@nestjs/passport": "^11.0.0",
     "bcrypt": "^5.1.1",
-    "uuid": "^10.0.0",
     "cookie-parser": "^1.4.6",
     "express": "^4.19.2",
-    "@acorex-platform/module-security-management-server": "0.0.15"
+    "passport": "^0.7.0",
+    "passport-jwt": "^4.0.1",
+    "passport-local": "^1.0.0",
+    "rxjs": "^7.8.0",
+    "uuid": "^10.0.0"
   },
   "exports": {
     "./package.json": "./package.json",
     ".": {
-      "types": "./src/index.d.ts",
-      "default": "./src/index.js"
+      "types": "./server/src/index.d.ts",
+      "default": "./server/src/index.js"
     },
     "./contracts": {
       "types": "./contracts/src/index.d.ts",

package/server/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/server/src/index.ts"],"names":[],"mappings":";;;AAAA,mEAAyC"}

package/server/src/lib/auth-lockout-settings.service.d.ts

@@ -0,0 +1,9 @@
+import { type OnModuleInit } from '@nestjs/common';
+import { type AuthLockoutPolicy } from '@acorex-platform/framework-server/security';
+import { SettingsManagementStoreService } from '@acorex-platform/module-settings-management-server';
+export declare class AuthLockoutSettingsService implements OnModuleInit {
+    private readonly settingsStore;
+    constructor(settingsStore: SettingsManagementStoreService);
+    onModuleInit(): void;
+    resolve(): Promise<AuthLockoutPolicy>;
+}

package/server/src/lib/auth-lockout-settings.service.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthLockoutSettingsService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const security_1 = require("@acorex-platform/framework-server/security");
+const module_settings_management_server_1 = require("@acorex-platform/module-settings-management-server");
+const module_auth_contracts_1 = require("@acorex-platform/module-auth-client/contracts");
+//#region ----- Auth lockout settings -----
+let AuthLockoutSettingsService = class AuthLockoutSettingsService {
+    constructor(settingsStore) {
+        this.settingsStore = settingsStore;
+    }
+    onModuleInit() {
+        (0, security_1.configureAuthLockoutPolicyResolver)(() => this.resolve());
+    }
+    resolve() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const document = yield this.settingsStore.findByPartition({ scope: 'P', documentId: 'P' });
+            const platform = (_a = document === null || document === void 0 ? void 0 : document.values) !== null && _a !== void 0 ? _a : {};
+            const defaults = module_auth_contracts_1.AXP_AUTH_LOCKOUT_SETTING_DEFAULTS;
+            return {
+                maxLoginAttempts: coercePositiveInt(platform[module_auth_contracts_1.AXPAuthSettings.MaxLoginAttempts], defaults[module_auth_contracts_1.AXPAuthSettings.MaxLoginAttempts]),
+                lockoutDurationMinutes: coercePositiveInt(platform[module_auth_contracts_1.AXPAuthSettings.LockoutDuration], defaults[module_auth_contracts_1.AXPAuthSettings.LockoutDuration]),
+                captchaAttemptThreshold: coercePositiveInt(platform[module_auth_contracts_1.AXPAuthSettings.CaptchaAttemptThreshold], defaults[module_auth_contracts_1.AXPAuthSettings.CaptchaAttemptThreshold]),
+                defaultCaptchaProvider: coerceProviderId(platform[module_auth_contracts_1.AXPAuthSettings.DefaultCaptchaProvider], defaults[module_auth_contracts_1.AXPAuthSettings.DefaultCaptchaProvider]),
+            };
+        });
+    }
+};
+exports.AuthLockoutSettingsService = AuthLockoutSettingsService;
+exports.AuthLockoutSettingsService = AuthLockoutSettingsService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [module_settings_management_server_1.SettingsManagementStoreService])
+], AuthLockoutSettingsService);
+function coercePositiveInt(value, fallback) {
+    const parsed = typeof value === 'number' ? value : Number(value);
+    if (!Number.isFinite(parsed) || parsed < 1) {
+        return fallback;
+    }
+    return Math.floor(parsed);
+}
+function coerceProviderId(value, fallback) {
+    if (typeof value === 'string') {
+        return value.trim();
+    }
+    return fallback;
+}
+//#endregion
+//# sourceMappingURL=auth-lockout-settings.service.js.map

package/server/src/lib/auth-lockout-settings.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-lockout-settings.service.js","sourceRoot":"","sources":["../../../../../../libs/modules/auth/server/src/lib/auth-lockout-settings.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA+D;AAC/D,yEAGoD;AACpD,0GAAoG;AACpG,kFAGgD;AAEhD,2CAA2C;AAGpC,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;IAAG,CAAC;IAE9E,YAAY;QACV,IAAA,6CAAkC,EAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEK,OAAO;;;YACX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3F,MAAM,QAAQ,GAAG,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,yDAAiC,CAAC;YAEnD,OAAO;gBACL,gBAAgB,EAAE,iBAAiB,CACjC,QAAQ,CAAC,uCAAe,CAAC,gBAAgB,CAAC,EAC1C,QAAQ,CAAC,uCAAe,CAAC,gBAAgB,CAAC,CAC3C;gBACD,sBAAsB,EAAE,iBAAiB,CACvC,QAAQ,CAAC,uCAAe,CAAC,eAAe,CAAC,EACzC,QAAQ,CAAC,uCAAe,CAAC,eAAe,CAAC,CAC1C;gBACD,uBAAuB,EAAE,iBAAiB,CACxC,QAAQ,CAAC,uCAAe,CAAC,uBAAuB,CAAC,EACjD,QAAQ,CAAC,uCAAe,CAAC,uBAAuB,CAAC,CAClD;gBACD,sBAAsB,EAAE,gBAAgB,CACtC,QAAQ,CAAC,uCAAe,CAAC,sBAAsB,CAAC,EAChD,QAAQ,CAAC,uCAAe,CAAC,sBAAsB,CAAC,CACjD;aACF,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AA/BY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;6CAEiC,kEAA8B;GAD/D,0BAA0B,CA+BtC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,QAAgB;IACzD,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,QAAgB;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,YAAY"}

package/server/src/lib/auth-max-device-sessions-settings.service.d.ts

@@ -0,0 +1,8 @@
+import { type OnModuleInit } from '@nestjs/common';
+import { SettingsManagementStoreService } from '@acorex-platform/module-settings-management-server';
+export declare class AuthMaxDeviceSessionsSettingsService implements OnModuleInit {
+    private readonly settingsStore;
+    constructor(settingsStore: SettingsManagementStoreService);
+    onModuleInit(): void;
+    resolve(tenantId: string): Promise<number>;
+}

package/server/src/lib/auth-max-device-sessions-settings.service.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthMaxDeviceSessionsSettingsService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const security_1 = require("@acorex-platform/framework-server/security");
+const module_settings_management_server_1 = require("@acorex-platform/module-settings-management-server");
+const module_auth_contracts_1 = require("@acorex-platform/module-auth-client/contracts");
+//#region ----- Auth max active device sessions settings -----
+let AuthMaxDeviceSessionsSettingsService = class AuthMaxDeviceSessionsSettingsService {
+    constructor(settingsStore) {
+        this.settingsStore = settingsStore;
+    }
+    onModuleInit() {
+        (0, security_1.configureAuthMaxDeviceSessionsPolicyResolver)((tenantId) => this.resolve(tenantId));
+    }
+    resolve(tenantId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const tid = tenantId === null || tenantId === void 0 ? void 0 : tenantId.trim();
+            if (!tid) {
+                return module_auth_contracts_1.AXP_AUTH_MAX_ACTIVE_DEVICE_SESSIONS_SETTING_DEFAULTS[module_auth_contracts_1.AXPAuthSettings.MaxActiveDeviceSessions];
+            }
+            const document = yield this.settingsStore.findByPartition({
+                scope: 'T',
+                documentId: `T:${tid}`,
+                tenantId: tid,
+            });
+            const values = (_a = document === null || document === void 0 ? void 0 : document.values) !== null && _a !== void 0 ? _a : {};
+            const defaults = module_auth_contracts_1.AXP_AUTH_MAX_ACTIVE_DEVICE_SESSIONS_SETTING_DEFAULTS;
+            return coerceNonNegativeInt(values[module_auth_contracts_1.AXPAuthSettings.MaxActiveDeviceSessions], defaults[module_auth_contracts_1.AXPAuthSettings.MaxActiveDeviceSessions]);
+        });
+    }
+};
+exports.AuthMaxDeviceSessionsSettingsService = AuthMaxDeviceSessionsSettingsService;
+exports.AuthMaxDeviceSessionsSettingsService = AuthMaxDeviceSessionsSettingsService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [module_settings_management_server_1.SettingsManagementStoreService])
+], AuthMaxDeviceSessionsSettingsService);
+function coerceNonNegativeInt(value, fallback) {
+    const parsed = typeof value === 'number' ? value : Number(value);
+    if (!Number.isFinite(parsed) || parsed < 0) {
+        return fallback;
+    }
+    return Math.floor(parsed);
+}
+//#endregion
+//# sourceMappingURL=auth-max-device-sessions-settings.service.js.map

package/server/src/lib/auth-max-device-sessions-settings.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-max-device-sessions-settings.service.js","sourceRoot":"","sources":["../../../../../../libs/modules/auth/server/src/lib/auth-max-device-sessions-settings.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA+D;AAC/D,yEAA0G;AAC1G,0GAAoG;AACpG,kFAGgD;AAEhD,8DAA8D;AAGvD,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAC/C,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;IAAG,CAAC;IAE9E,YAAY;QACV,IAAA,uDAA4C,EAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrF,CAAC;IAEK,OAAO,CAAC,QAAgB;;;YAC5B,MAAM,GAAG,GAAG,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,4EAAoD,CAAC,uCAAe,CAAC,uBAAuB,CAAC,CAAC;YACvG,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;gBACxD,KAAK,EAAE,GAAG;gBACV,UAAU,EAAE,KAAK,GAAG,EAAE;gBACtB,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,4EAAoD,CAAC;YAEtE,OAAO,oBAAoB,CACzB,MAAM,CAAC,uCAAe,CAAC,uBAAuB,CAAC,EAC/C,QAAQ,CAAC,uCAAe,CAAC,uBAAuB,CAAC,CAClD,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AA1BY,oFAAoC;+CAApC,oCAAoC;IADhD,IAAA,mBAAU,GAAE;6CAEiC,kEAA8B;GAD/D,oCAAoC,CA0BhD;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,QAAgB;IAC5D,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,YAAY"}