@ambushsoftworks/nestjs-auth-graphql 0.12.0 → 0.15.0

package/CHANGELOG.md

@@ -27,6 +27,216 @@ for buried obligations. **The marker was introduced in 0.9.0 and has not been
 retro-applied**, so it is reliable from 0.9.0 onward only. Convention adopted
 from `@ambushsoftworks/nestjs-payments-graphql`.
 
+## [0.15.0] - 2026-10-01
+
+A biometric credential now signs in only to the realm it was enrolled in.
+
+### ⚠ Security
+
+- **A credential enrolled in one realm could sign in to another.** The credential
+  record carried no realm, and `authenticateWithBiometric` issued the session with
+  the realm of the *request*. A credential enrolled in realm `staff`, used on a
+  request in realm `customers`, therefore received a token with `realm:
+  "customers"` for the staff user — and `JwtStrategy`'s realm check accepted it,
+  because the claim and the request agreed. Realms are documented as partitioning
+  identity; this crossed them. Only consumers that pass `realm` to
+  `authenticateWithBiometric` were exposed. A consumer that omitted it got a token
+  carrying the user's own realm instead, which is why the e2e suite did not see
+  it. Credentials only exist since 0.14.0 (released the day before).
+
+### Changed — breaking
+
+- **`BiometricCredentialRecord` has a `realm` field, and adapters must persist
+  it.** `getCredential` must return it. A credential whose stored realm differs
+  from the request's is refused with the usual `401 Biometric authentication
+  failed` (logged reason `credential_realm_mismatch`). A credential stored
+  **without** a realm, while realms are enabled, is refused too: it fails closed.
+- **With realms enabled, `enrolCredential` and `authenticateWithBiometric` require
+  a realm** and throw `400 Realm required` without one, the same answer as
+  `realmForRequest`. Pass the request's realm, e.g.
+  `this.getRealmFromContext(context)` in a resolver extending `BaseAuthResolver`:
+
+  ```typescript
+  enrolCredential({ userId, publicKey, deviceName, realm })
+  authenticateWithBiometric(input, { realm, res, ipAddress })
+  ```
+
+### Migration
+
+1. Add a nullable `realm` column to your biometric credential table, write it in
+   `storeCredential` and return it from `getCredential`.
+2. Backfill existing rows from their user's realm, e.g.
+   `UPDATE "BiometricCredential" c SET realm = u.realm FROM "User" u WHERE u.id = c."userId";`
+   Rows left without a realm stop authenticating while realms are enabled; their
+   users re-enrol.
+3. Pass `realm` to `enrolCredential` and `authenticateWithBiometric`.
+
+Without realms (`realmExtractorInstance` not set) nothing changes: no column
+needed, no argument needed.
+
+## [0.14.0] - 2026-09-29
+
+Biometric authentication works. It has been exported since v0.1.3 and never did.
+
+### ⚠ Security
+
+- **The previous `authenticateWithBiometric` verified nothing.** It took
+  `(userId, deviceId)`, checked only that an enrolled credential's id equalled the
+  supplied `deviceId`, and then issued an access and refresh token. No signature,
+  no challenge, no nonce; the public key `enableBiometric` stored was never read
+  by anything. Neither input is a secret, so anyone who knew a user id and an
+  enrolled device id could obtain a session. It also minted its own tokens, so it
+  bypassed the account-status check every other login goes through — a suspended
+  user could sign in.
+
+  **If you wired biometric authentication on 0.13.0 or earlier, treat any session
+  it issued as unauthenticated**, and revoke refresh tokens for affected users.
+  We know of no consumer that did: `IBiometricRepository` had no implementations,
+  and LiftIQ, the only app with biometrics, built its own rather than use this.
+
+### Added
+
+- **A working challenge-response flow.**
+  ```
+  enrolCredential({ userId, publicKey, deviceName })  -> credentialId
+  requestChallenge(credentialId)                      -> { challengeId, challenge, expiresAt }
+  authenticateWithBiometric({ challengeId, credentialId, signature }) -> session
+  ```
+  32-byte single-use challenges, 60-second default expiry, ES256 signature
+  verification, and a session issued through `AuthService.issueAuthSession` — the
+  same sink as every other login, so `assertUserActive`, cookie auth, realm claims
+  and `SESSION_ISSUED` all apply without being reimplemented.
+- **`IBiometricVerifier`**, with `Es256DeviceKeyVerifier` as the default. The
+  verifier is selected by each credential's stored `algorithm`, so a credential
+  enrolled as ES256 is only ever verified as ES256 — the same pinning `JwtStrategy`
+  gained in 0.12.0. WebAuthn can be added later against this interface without
+  reshaping the port.
+- **`biometric` module options**: `verifiers`, `challengeExpirySeconds`,
+  `challengeRateLimit`. Boot refuses an empty verifier list, two verifiers claiming
+  one algorithm, a non-positive expiry, and a rate limit without
+  `rateLimiterInstance`.
+- **A per-IP rate limit** on challenge issuance alongside the per-credential one.
+  The per-credential limit cannot see a caller varying the credential id.
+
+### Changed — breaking
+
+- **`IBiometricRepository` is reshaped**, composed from a new
+  `IBiometricChallengeStore`. It had no implementations, so this breaks nobody in
+  practice. Credentials now carry `algorithm`, `isActive`, `lastUsedAt` and
+  optional `metadata`; challenges are keyed on `credentialId`.
+
+  Its one hard contract: **`consumeChallenge` must be atomic.** A read, a check and
+  then a write lets two concurrent requests with one challenge both succeed. Use a
+  single conditional update and check the affected count — the README has the
+  Prisma form.
+
+  Two schema notes: `credentialId` on a challenge is **not** a foreign key (a
+  challenge is stored for ids that do not exist, so the signed-out request cannot
+  reveal which credentials are enrolled), and there is **no uniqueness** on any
+  device string.
+- **`authenticateWithBiometric`'s signature changed** to
+  `({ challengeId, credentialId, signature }, opts)`.
+- **`enableBiometric`, `disableBiometric` and `updateLastBiometricLogin` are gone
+  from `IUserRepositoryBiometric`.** Having credentials in two ports is why
+  enrolment and authentication used different stores and never met.
+- **`NoOpBiometricRepository` is removed.** A no-op that accepts enrolments and
+  returns no credentials turns a missing implementation into a login that silently
+  never works. Without `biometricRepositoryInstance` the services are not
+  registered.
+- **`credentialId` is generated by the package**, not by the client or the adapter.
+  It travels on an unauthenticated request, so it must be unguessable.
+
+### Security properties worth knowing
+
+- **What it proves.** Possession of the enrolled private key — **not** that a
+  biometric check happened. Nothing in an ECDSA signature attests to that, and the
+  server cannot tell a hardware-backed key from a software one. Most mobile
+  biometric APIs accept a device PIN by default. Weigh that before making it a
+  sole factor.
+- **Every biometric failure returns one 401.** Unknown credential, deactivated
+  credential, replayed or mismatched challenge, bad signature, missing verifier.
+  The route is reachable signed-out, so anything distinguishable reveals which
+  credentials exist. An inactive *account* is deliberately not flattened into it.
+- **A failed attempt still burns the challenge**, so one challenge cannot be used
+  to try many signatures.
+
+### Documentation
+
+- README: **Biometric Authentication**, leading with what a successful
+  authentication does and does not prove, the `IBiometricRepository` contract with
+  the atomic-consume example, and a `biometric` options table.
+- CLAUDE.md: replaced a flow description that named three methods which never
+  existed and described verification the code never performed.
+
+### Testing
+
+- 24 unit tests on the flow with real P-256 keys, real signatures and a real
+  `AuthService` — so the suspended-user case exercises `assertUserActive` rather
+  than a double. The spec they replace mocked both sides of every seam and
+  asserted the method returned tokens, which was true and hid that it returned
+  them without verifying anything.
+- 9 end-to-end tests on both NestJS majors, including that the issued token works
+  on a guarded route, which is what proves the session came from the shared sink.
+- 13 on the challenge service, including twenty concurrent claims on one challenge
+  yielding exactly one winner.
+- Mutation checks: dropping the challenge/credential binding, forcing the verifier
+  true, ignoring `isActive`, minting tokens locally instead of via
+  `issueAuthSession`, and making the test store non-atomic. Each compiles; each
+  fails the suite.
+## [0.13.0] - 2026-09-29
+
+**Never published separately — these changes ship inside `0.14.0`.** Both landed
+on master before either was released, and `npm version` writes one version per
+release, so `0.13.0` does not exist on npm. The entry stays because the changes
+are real and worth reading on their own; if you are upgrading, everything here is
+in `0.14.0`.
+
+A documentation release, with one removal. Nothing in the runtime behaviour of
+any supported path changes.
+
+### Removed
+
+- **`MagicLinkStrategy`, `VerificationCodeStrategy`, `IPasswordResetStrategy`,
+  `IMagicLinkRepository` and `NoOpMagicLinkRepository`** are no longer exported,
+  and their files are gone. Nothing in the package consumed
+  `IPasswordResetStrategy` — `AuthService` calls `VerificationService` directly —
+  and `MagicLinkStrategy` could not be constructed through Nest DI at all,
+  because it injects a `'MAGIC_LINK_REPOSITORY'` token that `AuthModule` never
+  registered. The `NoOpMagicLinkRepository` docblock even showed a
+  `magicLinkRepositoryInstance` option that does not exist in
+  `AuthModuleOptions`.
+
+  This is a public API removal, hence the minor bump, but it cannot break a
+  working consumer: there was no supported way to reach any of it. If you
+  constructed `MagicLinkStrategy` yourself by registering that token, the file is
+  small and self-contained — copy it into your application. Password reset
+  through the package remains the 6-digit code flow, unchanged.
+
+### Documentation
+
+- **README: new `Password Reset` section.** The feature had one passing mention,
+  despite the properties a consumer cannot infer and must not discover in
+  production: 3 attempts before the code is destroyed, the 15-minute expiry, the
+  60-second per-user cooldown, the per-IP limit of 5/hour checked *before* the
+  user lookup for enumeration safety, and that a successful reset **revokes every
+  refresh token for that user**. It also states plainly that the response is
+  identical whether the address was sent a code, skipped or does not exist, and
+  that the distinguishing signal is `PASSWORD_RESET_REQUESTED` with
+  `result: 'SKIPPED_SOCIAL_ONLY'` on your `IAuthLogger`.
+- **README: new `Phone & SMS Verification` section.** Five `perform*` methods
+  that previously appeared only as rows in a table. Records that SMS is
+  code-only — `features.verificationMode: 'token'` does not apply to it — and
+  that omitting `smsServiceInstance` substitutes a no-op, so codes are stored
+  but never delivered.
+- **README: `sendgrid` and `twilio` option tables.** The only two of 42
+  `AuthModuleOptions` fields documented nowhere. Both are read solely by the
+  bundled services; a custom `IEmailService` or `ISmsService` ignores them.
+- **`verification.baseUrl`** now names its exported type,
+  `VerificationBaseUrlResolver`.
+- **`package.json` gains `homepage` and `bugs`.** npmjs.com renders both in the
+  sidebar, so until now the package page offered no route to the repository or
+  to filing an issue.
+
 ## [0.12.0] - 2026-09-20
 
 Ambush Desk asked for two things: verifying JWTs that other systems sign, and API

package/README.md

@@ -16,8 +16,11 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
   - [External JWTs](#external-jwts)
   - [Email System](#email-system)
   - [Verification Modes](#verification-modes)
+  - [Phone \& SMS Verification](#phone--sms-verification)
   - [OAuth](#oauth)
+  - [Biometric Authentication](#biometric-authentication)
   - [Brute Force Protection](#brute-force-protection)
+  - [Password Reset](#password-reset)
   - [Password Policy](#password-policy)
   - [Lifecycle Hooks](#lifecycle-hooks)
   - [Account Status](#account-status)
@@ -34,12 +37,16 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
   - [CSRF Options](#csrf-options-csrf)
   - [Composable Email](#composable-email-email)
   - [Verification Options](#verification-options-verification)
+  - [Biometric Options (`biometric`)](#biometric-options-biometric)
+  - [SendGrid Options (`sendgrid`)](#sendgrid-options-sendgrid)
+  - [Twilio Options (`twilio`)](#twilio-options-twilio)
   - [Optional Instance Options](#optional-instance-options)
 - [Decorators](#decorators)
 - [Guards](#guards)
   - [GraphQL Subscriptions](#graphql-subscriptions)
 - [Utilities](#utilities)
 - [Security Features](#security-features)
+- [Upgrading from 0.9.x](#upgrading-from-09x)
 - [Migrating to v0.12.0](#migrating-to-v0120)
 - [Migrating to v0.11.0](#migrating-to-v0110)
 - [Migrating to v0.10.0](#migrating-to-v0100)
@@ -805,6 +812,45 @@ link. `expiresInMinutes` reflects the mode's real expiry, so render it rather
 than hardcoding a duration. Both trailing parameters are optional, so existing
 implementations continue to compile.
 
+### Phone & SMS Verification
+
+An authenticated user adds a phone number, receives a 6-digit code by SMS, and
+confirms it. All five methods take the current user, so they sit behind your
+authentication guard — this is account management, not a sign-in path.
+
+| Method | Purpose |
+|---|---|
+| `performSendPhoneVerification(input, user)` | Store the number and send a code |
+| `performVerifyPhone(input, user)` | Confirm the code, mark the number verified |
+| `performResendPhoneVerification(phoneNumber, user)` | Send again, subject to the 60-second cooldown |
+| `performRemovePhoneNumber(user)` | Clear the number and its verified state |
+| `performPhoneVerificationStatus(user)` | Whether a number is present and verified |
+
+Provide `smsServiceInstance` and `verificationRepositoryInstance`. `ISmsService`
+has a single method, so the seam is small:
+
+```typescript
+export class TwilioSmsService implements ISmsService {
+  async sendVerificationSms(phoneNumber: string, code: string): Promise<void> {
+    await this.client.messages.create({ to: phoneNumber, body: `Your code is ${code}` });
+  }
+}
+```
+
+Two things worth knowing:
+
+- **SMS is code-only.** `features.verificationMode: 'token'` governs email
+  verification and password reset. A phone always receives a 6-digit code,
+  because a link is not usable from a text message in the same way — so
+  `verification.baseUrl` is irrelevant here.
+- **Omitting `smsServiceInstance` does not fail loudly.** The package substitutes
+  a no-op that logs, so codes are generated and stored but never delivered.
+  Verification then only succeeds for someone reading your application logs.
+
+The number's realm is scoped like any other identity field: with realms enabled,
+`findByPhoneNumber` receives the realm, so the same number can exist once per
+realm.
+
 ### OAuth
 
 Google and Facebook OAuth with encrypted token storage (AES-256-GCM).
@@ -858,6 +904,114 @@ It sits beside `useFactory` because Nest fixes a module's controllers before asy
 
 With realms enabled, a request without a realm gets `400 Realm required` first. Before 0.10.0 the lockout, inactive-account, rate-limit and unconfigured-provider cases answered 500.
 
+### Biometric Authentication
+
+A device holds an ECDSA P-256 keypair, gated behind the OS biometric prompt. The
+server stores the public key and verifies a signature over a challenge it issued.
+
+```typescript
+biometricRepositoryInstance: myBiometricRepo,   // enables the capability
+biometric: {
+  challengeExpirySeconds: 60,                   // default
+  challengeRateLimit: { maxAttempts: 5, windowMs: 60_000 },  // needs rateLimiterInstance
+},
+```
+
+#### ⚠ What a successful authentication actually proves
+
+**It proves the client still holds the private key. It does not prove a biometric
+check happened.** Nothing in an ECDSA signature attests to that, and the server
+cannot distinguish a key held in a hardware enclave from one generated in
+software. Whether a fingerprint was scanned — or a PIN accepted instead, which
+most mobile biometric APIs allow by default — is the client's word.
+
+Treat this as *possession of a device-bound key that the client promises to
+gate*. It is a good second factor and a good convenience login. Before making it
+the sole factor for something sensitive, be clear that you are trusting the app,
+not the biometric. WebAuthn's `userVerification` flag is what actually attests to
+user verification, and is not this.
+
+#### The flow
+
+```typescript
+// 1. Enrol, authenticated. The package generates the credential id — keep it
+//    on the device alongside the private key.
+const { credentialId } = await biometricAuth.enrolCredential({
+  userId: user.id,
+  publicKey,                  // PEM, SPKI
+  deviceName: 'iPhone 15',
+  metadata: { yourDeviceString: '...' },   // optional, opaque to the package
+  realm,                      // required with realms enabled; the credential is bound to it
+});
+
+// 2. Request a challenge. No user id — the caller is usually signed out.
+const challenge = await biometricAuth.requestChallenge(credentialId, {
+  ipAddress: req.ip,
+});
+if (!challenge) { /* rate limited */ }
+
+// 3. The client signs `challenge.challenge` (base64) with the private key.
+
+// 4. Verify and receive a session.
+const session = await biometricAuth.authenticateWithBiometric(
+  { challengeId: challenge.challengeId, credentialId, signature },
+  { res, realm, ipAddress: req.ip },
+);
+```
+
+Also `listCredentials(userId)` for a device list and `removeCredential(userId,
+credentialId)` to deactivate one.
+
+#### What the package guarantees
+
+| | |
+|---|---|
+| Challenge | 32 random bytes, single use, 60s default |
+| Replay | A challenge is consumed **atomically** before anything is checked, so a retry loses the race — and a failed attempt still burns it |
+| Cross-credential | A challenge issued for one credential cannot be answered with another's key |
+| Realm | A credential signs in only to the realm it was enrolled in (since 0.15.0). With realms enabled, `enrolCredential` and `authenticateWithBiometric` require `realm` |
+| Algorithm | Pinned **per credential**. A credential enrolled as ES256 is only verified as ES256; no verifier for its algorithm means refusal, not a fallback |
+| Account status | The session comes from the same sink as every other login, so a suspended or soft-deleted user is refused **after** a valid signature |
+| Enumeration | Every biometric failure returns the same 401, and a challenge is issued even for a credential that does not exist |
+| Rate limiting | Per credential, and per IP so varying the credential id cannot evade it |
+
+#### Implementing `IBiometricRepository`
+
+One method has a contract you cannot satisfy with a read followed by a write:
+
+```typescript
+async consumeChallenge(challengeId: string) {
+  // Atomic: mark used and return it, only if it was unused and unexpired.
+  const { count } = await prisma.biometricChallenge.updateMany({
+    where: { id: challengeId, used: false, expiresAt: { gt: new Date() } },
+    data: { used: true, usedAt: new Date() },
+  });
+  if (count !== 1) return null;    // someone else claimed it, or it expired
+  return this.load(challengeId);
+}
+```
+
+Read-then-write lets two concurrent requests with one challenge both succeed,
+which is the replay single use exists to prevent.
+
+Two more things your schema needs to know:
+
+- **Persist `realm` on the credential** and return it from `getCredential`. A
+  credential without its realm, while realms are enabled, never authenticates.
+- **`credentialId` on a challenge is not a foreign key.** A challenge is stored
+  for credential ids that do not exist, so that the signed-out request cannot be
+  used to discover which credentials are enrolled.
+- **No uniqueness on `deviceName` or any device string.** It is a display label,
+  never matched on. Key rotation is enrol-new then deactivate-old.
+
+`getCredential` must return deactivated credentials rather than hiding them — the
+package decides, so that a deactivated credential and an unknown one produce the
+same answer.
+
+**There is no no-op fallback.** Omit `biometricRepositoryInstance` and the
+biometric services are not registered at all, rather than silently accepting
+enrolments that can never authenticate.
+
 ### Brute Force Protection
 
 Provide a `bruteForceRepositoryInstance` and the module tracks failed login attempts and temporarily locks accounts. Without one, `NoOpBruteForceRepository` is used and no account is ever locked; there is no flag to set. The lockout policy (attempt thresholds, lockout duration) is determined by your `IBruteForceRepository` implementation.
@@ -962,6 +1116,78 @@ async changePassword(
 
 `issueAuthSession(userId, res?, realm?)` mints a new access + refresh pair, persists the refresh token, and (when `features.cookieAuth` is enabled and `res` is supplied) sets the auth cookies on the response. The caller is responsible for verifying the user's identity — `issueAuthSession` takes a `userId` and trusts it. Pair it only with flows that have already authenticated the user (`changePassword`, MFA enrollment completion, admin-impersonation reissue, etc.). Emits `SecurityEvent.SESSION_ISSUED`.
 
+### Password Reset
+
+A reset is two calls: `performRequestPasswordReset` sends a 6-digit code, and
+`performResetPassword` redeems it. `performChangePassword` is the separate,
+authenticated path for a signed-in user who knows their current password.
+
+```typescript
+@Mutation(() => PasswordResetResponse)
+requestPasswordReset(@Args('input') input: RequestPasswordResetInput, @Context() ctx: any) {
+  return this.performRequestPasswordReset(input, ctx);
+}
+
+@Mutation(() => PasswordResetResponse)
+resetPassword(@Args('input') input: ResetPasswordInput, @Context() ctx: any) {
+  return this.performResetPassword(input, ctx);
+}
+```
+
+It needs `verificationRepositoryInstance` to store the code and
+`emailServiceInstance` to deliver it. Without the first, codes are logged rather
+than stored and no reset can complete.
+
+#### What the package enforces for you
+
+None of this is configurable, and most of it is invisible until it bites:
+
+| | |
+|---|---|
+| Code | 6 digits, HMAC-SHA256 hashed at rest, never logged |
+| Expiry | 15 minutes |
+| Attempts | **3**, then the code is destroyed and a new one must be requested |
+| Per-user cooldown | 60 seconds, tracked on `passwordResetSentAt` |
+| Per-IP limit | 5 per hour, checked **before** the user lookup |
+| On success | **every refresh token for that user is revoked** — all devices are signed out |
+| Comparison | constant-time |
+
+The IP limit runs before the lookup deliberately: checking it afterwards would
+make a request for a non-existent address measurably faster than one for a real
+address, which is the enumeration leak the generic message exists to prevent.
+
+#### The response never tells you what happened
+
+`requestPasswordReset` returns the same success payload whether the address does
+not exist, belongs to a social-login account, or was actually sent a code. That
+is deliberate — the mutation is reachable unauthenticated, so any distinguishable
+result is an oracle for whether an address is registered.
+
+If you need to know, read your `IAuthLogger`. A skip is reported as
+`PASSWORD_RESET_REQUESTED` with `result: 'SKIPPED_SOCIAL_ONLY'` and the user ID.
+An operator tool that creates accounts and invites by reset should assert on that
+event, not on the mutation's return value.
+
+#### Accounts with no password
+
+An account is refused only if it has an actual social identity — `googleId`,
+`facebookId` or `appleId`. A password-less account with none of those, which is
+how an operator-provisioned account starts, receives a code and can redeem it.
+This is the documented "invite by password reset" flow.
+
+**This changed in 0.12.0.** Before then the test was `passwordHash == null`, so
+operator-created accounts were skipped silently and could never sign in. See
+[Migrating to v0.12.0](#migrating-to-v0120) for the consequence worth deciding
+on. The predicate is exported as `hasSocialIdentity(user)` if you want the same
+test in your own code.
+
+#### Token mode
+
+With `features.verificationMode: 'token'` the email carries a link rather than a
+code, and `performResetPassword` takes the token lifted from that link in place
+of the 6-digit code. Everything above still applies. See
+[Verification Modes](#verification-modes).
+
 ### Password Policy
 
 ```typescript
@@ -1199,7 +1425,40 @@ When `email` is provided, it takes precedence over `emailServiceInstance`.
 |--------|------|---------|-------------|
 | `tokenLength` | `number` | `64` | Token length in bytes (token mode) |
 | `tokenExpiresInMinutes` | `number` | `60` | Token expiration (token mode) |
-| `baseUrl` | `string \| (realm?: string) => string` | — | Absolute http(s) base URL for verification/reset links, or a resolver called with the request's realm. **Required when `verificationMode` is `'token'`** (validated at boot); optional in code mode |
+| `baseUrl` | `string \| VerificationBaseUrlResolver` | — | Absolute http(s) base URL for verification/reset links, or a resolver called with the request's realm. **Required when `verificationMode` is `'token'`** (validated at boot); optional in code mode |
+
+### SendGrid Options (`sendgrid`)
+
+Read only by the bundled `SendGridEmailService`. A custom `IEmailService` ignores
+this block entirely.
+
+| Option | Type | Required | Description |
+|--------|------|----------|-------------|
+| `apiKey` | `string` | yes | SendGrid API key |
+| `fromEmail` | `string` | yes | Verified sender address |
+| `fromName` | `string` | — | Display name on the From header |
+
+### Twilio Options (`twilio`)
+
+Read only by the bundled `TwilioSmsService`. A custom `ISmsService` ignores this
+block entirely.
+
+| Option | Type | Required | Description |
+|--------|------|----------|-------------|
+| `accountSid` | `string` | yes | Twilio account SID |
+| `authToken` | `string` | yes | Twilio auth token |
+| `phoneNumber` | `string` | yes | Sending number, E.164 |
+
+### Biometric Options (`biometric`)
+
+Read only when `biometricRepositoryInstance` is provided. Passing this block
+without it is reported at boot, not refused.
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `verifiers` | `IBiometricVerifier[]` | `[new Es256DeviceKeyVerifier()]` | One per credential algorithm. Two claiming the same algorithm is refused at boot — resolution would depend on array order |
+| `challengeExpirySeconds` | `number` | `60` | Short on purpose: it bounds replay |
+| `challengeRateLimit` | `{ maxAttempts, windowMs }` | `5 / 60s` | Per credential. **Requires `rateLimiterInstance`** — the same guardrail as `bruteForce.ipRateLimit`, because per-replica counters would make the limit silently looser. A per-IP limit at ten times this bound also applies when you pass `ipAddress` |
 
 ### Optional Instance Options
 
@@ -1343,6 +1602,31 @@ export class CustomGuard implements CanActivate {
 - **API keys with scopes and expiry**, refused hard when they carry your prefix and match no key, so no other strategy accepts them
 - **No raw personal data in package logs** — log lines use the user ID or a salted hash (`emailHash=`, `ipHash=`, under `AUTH_IP_HASH_SALT` or `jwtSecret`), phone numbers keep only their last two digits, and the default `ConsoleAuthLogger` redacts security-event metadata. A custom `authLoggerInstance` receives the raw fields; pass them through `redactSecurityEventMetadata` to store them redacted.
 
+## Upgrading from 0.9.x
+
+Four releases separate 0.9 from 0.14 and each has its own note below. If you are
+jumping the whole way, this is the order things will bite, and the short answer
+for each.
+
+| Release | What you have to do |
+|---|---|
+| **0.10.0** | Usually nothing. If you relied on `['api-key','jwt']` rejecting JWTs, it no longer does — an unknown key now fails softly so the next strategy runs |
+| **0.11.0** | `getRequestFromContext` can return `undefined`; TypeScript flags every call that assumed otherwise. If you use subscriptions with cookie auth, set `csrf.webSocket` |
+| **0.12.0** | The `jwt` strategy pins HS256 — check anything minting staff tokens elsewhere. Security events are logged once instead of twice, so counts built on them halve. Password reset now reaches password-less accounts with no social identity |
+| **0.13.0** | Nothing — and it was never published separately; its changes ship inside 0.14.0 |
+| **0.14.0** | Biometric authentication is rebuilt and breaking. If you never wired `biometricRepositoryInstance`, nothing changes. If you did, read the security note in the changelog first |
+
+Two things that are easy to miss because nothing errors:
+
+- **Security-event counts.** 0.12.0 stopped double-logging `SIGNUP_SUCCESS`,
+  `LOGIN_SUCCESS` and `LOGOUT_SUCCESS`. Dashboards built before it were reading
+  double and will step down on upgrade rather than when you fix the data.
+- **`verification.baseUrl`.** If you run realms and serve more than one frontend,
+  it accepts a resolver from 0.13.0. Before that, every realm got the same host.
+
+Take them in order rather than jumping straight to 0.14.0 — each note assumes the
+one before it.
+
 ## Migrating to v0.12.0
 
 **Password reset now reaches accounts that have no password and no social login.** The guard on `requestPasswordReset` and `resetPassword` tested `passwordHash == null` and treated it as "this user signed in with Google". That is also how an operator-provisioned account starts, so an account created by an admin CLI was skipped silently — the request returned the same success message as a real send, and the reset would have been refused even if a code had arrived. Both guards now test for an actual social identity (`googleId`, `facebookId` or `appleId`), so a social-only account behaves exactly as before, and a password-less account with no social identity receives a reset code and can redeem it.

package/dist/auth.module.d.ts

@@ -14,6 +14,7 @@ import { ITenantRepository } from './interfaces/tenant-repository.interface';
 import { ITenantExtractor } from './interfaces/tenant-extractor.interface';
 import { IRealmExtractor } from './interfaces/realm-extractor.interface';
 import { IResourcePermissionRepository } from './interfaces/resource-permission-repository.interface';
+import { IBiometricVerifier } from './interfaces/biometric-verifier.interface';
 import { IJwtPayloadFactory } from './interfaces/jwt-payload-factory.interface';
 import { IApiKeyRepository } from './interfaces/api-key-repository.interface';
 import { PasswordPolicyConfig } from './interfaces/password-policy-config.interface';
@@ -121,6 +122,14 @@ export interface AuthModuleOptions {
         branding?: EmailBrandingConfig;
         templateRenderer?: IEmailTemplateRenderer;
     };
+    biometric?: {
+        verifiers?: IBiometricVerifier[];
+        challengeExpirySeconds?: number;
+        challengeRateLimit?: {
+            maxAttempts: number;
+            windowMs: number;
+        };
+    };
     verification?: {
         tokenLength?: number;
         tokenExpiresInMinutes?: number;

package/dist/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA0B3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAYjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AA+B9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAKxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAQnD,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAS7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAa3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAKzC,KAAK,CAAC,EAAE;QA4BN,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC;KAChE,CAAC;IAQF,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAK7C,MAAM,CAAC,EAAE;QAMP,UAAU,CAAC,EAAE,MAAM,CAAC;QAOpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAmBF,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAyBxC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAO5C,YAAY,CAAC,EAAE,MAAM,CAAC;IAmBtB,QAAQ,CAAC,EAAE;QAOT,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAc5B,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;KAC/B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAWnC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAenC,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAuB/C,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAe/B,OAAO,CAAC,EAAE,MAAM,GAAG,2BAA2B,CAAC;KAChD,CAAC;CACH;AASD,MAAM,MAAM,2BAA2B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;AAKrE,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IAef,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAgCD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAyCvE;AA2ED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB7E;AASD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CA0BxE;AAWD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAsB1E;AAsKD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAuCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CAwZpE"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA4B3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAWjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAgC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAKxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAQnD,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAS7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAa3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAKzC,KAAK,CAAC,EAAE;QA4BN,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC;KAChE,CAAC;IAQF,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAK7C,MAAM,CAAC,EAAE;QAMP,UAAU,CAAC,EAAE,MAAM,CAAC;QAOpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAmBF,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAyBxC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAO5C,YAAY,CAAC,EAAE,MAAM,CAAC;IAmBtB,QAAQ,CAAC,EAAE;QAOT,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAc5B,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;KAC/B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAWnC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAenC,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAuB/C,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAUF,SAAS,CAAC,EAAE;QAUV,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;QAGjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAShC,kBAAkB,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;KAChE,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAe/B,OAAO,CAAC,EAAE,MAAM,GAAG,2BAA2B,CAAC;KAChD,CAAC;CACH;AASD,MAAM,MAAM,2BAA2B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;AAKrE,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IAef,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAgCD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CA0CvE;AA2ED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB7E;AASD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CA0BxE;AAWD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAsB1E;AAyPD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAuCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CA0apE"}