@ambushsoftworks/nestjs-auth-graphql 0.17.1 → 0.19.0

package/CHANGELOG.md

@@ -27,6 +27,105 @@ for buried obligations. **The marker was introduced in 0.9.0 and has not been
 retro-applied**, so it is reliable from 0.9.0 onward only. Convention adopted
 from `@ambushsoftworks/nestjs-payments-graphql`.
 
+## [0.19.0] - 2026-10-08
+
+**Guest sessions**: a session for someone who is not a user, which works only on
+routes that opt in, for the things you granted, until the dates you set.
+Additive; nothing changes for an app that does not use it. Requested by Ariadne,
+for outside translators working on one job.
+
+### ⚠ External configuration required
+
+Only to use guest sessions:
+- **Two tables for `IGuestSessionRepository`**, with no foreign key to users.
+  Schema and Prisma adapter in `examples/guest-sessions/`. Run
+  `assertGuestSessionRepositoryContract` against it on your real database.
+- **Your frontend handles `GUEST_SESSION_INVALID`** by sending the person to
+  prove their address again. It must not be treated like `UNAUTHENTICATED`:
+  there is no refresh for a guest.
+- Without `features.cookieAuth`, the client keeps the token `issue` returns and
+  sends it as `Authorization: Guest <token>`. **The token changes whenever a
+  grant is added**; store the new one.
+
+### Added
+
+- **`GuestSessionService`**: `issue({ principal, grant })` starts a session or
+  adds a grant to the one the browser holds; `revokeGrant({ kind, id })`,
+  `revoke(sessionId)` and `end(request, res)` stop them. See the README, "Guest
+  Sessions".
+- **`@AllowGuestSession(kind)`**, on a method, lets a guest with a standing
+  grant of that kind reach the handler. Guards made by `createAuthGuard` read
+  it, trying the user first; so does the new **`GuestSessionGuard`**, which
+  admits guests only. **`@CurrentGuest()`** gives the handler the guest and
+  their grants of that kind.
+- **`IGuestSessionRepository`**, `InMemoryGuestSessionRepository`, and
+  `guestSessionRepositoryInstance`, which enables the feature.
+- **`assertGuestSessionRepositoryContract`** in
+  `@ambushsoftworks/nestjs-auth-graphql/testing`.
+- **`guestSession`** options: `maxGrantsPerSession` (default 10; `1` gives one
+  grant per session) and `maxLifetimeDays` (default 30).
+- Security events `GUEST_SESSION_ISSUED`, `GUEST_SESSION_REJECTED`,
+  `GUEST_SESSION_REVOKED`, `GUEST_SESSION_ENDED` and `GUEST_GRANT_REVOKED`.
+- Error codes `GUEST_SESSION_INVALID` (401) and `GUEST_SESSION_UNAVAILABLE`
+  (503).
+
+### Changed
+
+- A guard made by `createAuthGuard` now reads `@AllowGuestSession` on the
+  handler. On a handler without it, which is every handler in an existing app,
+  nothing changes: no guest credential is read. `JwtAuthGuard` is unchanged and
+  ignores the decorator.
+
+## [0.18.0] - 2026-10-07
+
+**Email challenges**: one-time codes that prove someone holds an email address,
+whether or not it belongs to a user. Additive; nothing changes for an app that
+does not use it. Requested by Ariadne, for outside translators who open one job
+and are not users.
+
+### ⚠ External configuration required
+
+Only to use email challenges:
+- **A table for `IEmailChallengeRepository`**, with no foreign key to users.
+  Schema and Prisma adapter in `examples/email-challenge/`. Run
+  `assertEmailChallengeRepositoryContract` against it on your real database.
+- **An email service that can send the code.** `ConfigurableEmailService` does,
+  with the default renderer. A custom `IEmailTemplateRenderer` adds
+  `renderEmailChallengeCodeEmail`; a hand-written `IEmailService` adds
+  `sendEmailChallengeCode`.
+- **A shared `rateLimiterInstance`** if you run more than one instance: the send
+  limits are counted there.
+- **A button in your frontend** that asks for the code. Do not send it when the
+  page loads: mail scanners open links.
+
+### Added
+
+- **`EmailChallengeService`**: `issue({ email, purpose, emailData? })` emails a
+  6-digit code and returns an opaque `challengeId`; `verify({ challengeId, code,
+  email, purpose })` answers `{ ok: true, email, purpose }` or `{ ok: false,
+  reason: 'WRONG' | 'EXPIRED' | 'LOCKED' }`; `revoke({ purpose, email? })` stops
+  outstanding codes. No `perform*` resolver methods: your resolver calls it with
+  an address and purpose from your own data. See the README, "Email Challenges",
+  including six rules for that resolver.
+- **`IEmailChallengeRepository`**, `InMemoryEmailChallengeRepository`, and
+  `emailChallengeRepositoryInstance`, which enables the feature. Rows hold keyed
+  hashes only: no address, purpose or code.
+- **`assertEmailChallengeRepositoryContract`** in
+  `@ambushsoftworks/nestjs-auth-graphql/testing`.
+- **`emailChallenge`** options: `ttlMinutes` (default 15, up to 60) and
+  `issueLimits` (`cooldownSeconds` 60, `perHour` 5, `perIpPerHour` 30).
+- `IEmailService.sendEmailChallengeCode` and
+  `IEmailTemplateRenderer.renderEmailChallengeCodeEmail`, both optional.
+- Security events `EMAIL_CHALLENGE_ISSUED`, `EMAIL_CHALLENGE_VERIFIED`,
+  `EMAIL_CHALLENGE_FAILED` and `EMAIL_CHALLENGE_LOCKED`.
+- Error codes `EMAIL_CHALLENGE_UNAVAILABLE` and `EMAIL_CHALLENGE_SEND_FAILED`
+  (both 503).
+
+### Changed
+
+- The boot warning for a missing `rateLimiterInstance` now names everything
+  counted there, not only password-reset throttling.
+
 ## [0.17.1] - 2026-10-07
 
 A security fix for passwordless sign-up, which shipped in 0.17.0. **If you offer

package/README.md

@@ -21,6 +21,8 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
   - [Biometric Authentication](#biometric-authentication)
   - [Passkeys](#passkeys)
   - [Step-Up Re-authentication](#step-up-re-authentication)
+  - [Email Challenges](#email-challenges)
+  - [Guest Sessions](#guest-sessions)
   - [Brute Force Protection](#brute-force-protection)
   - [Password Reset](#password-reset)
   - [Password Policy](#password-policy)
@@ -42,6 +44,8 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
   - [Biometric Options (`biometric`)](#biometric-options-biometric)
   - [Passkey Options (`passkey`)](#passkey-options-passkey)
   - [Step-Up Options (`stepUp`)](#step-up-options-stepup)
+  - [Email Challenge Options (`emailChallenge`)](#email-challenge-options-emailchallenge)
+  - [Guest Session Options (`guestSession`)](#guest-session-options-guestsession)
   - [SendGrid Options (`sendgrid`)](#sendgrid-options-sendgrid)
   - [Twilio Options (`twilio`)](#twilio-options-twilio)
   - [Optional Instance Options](#optional-instance-options)
@@ -1465,6 +1469,337 @@ over a short expiry. Shorten `stepUp.ttlSeconds` if you want a tighter window.
 **Email codes use a new verification type, `step-up`.** If your verification
 repository stores the type in a database enum, add the value.
 
+### Email Challenges
+
+Prove that someone holds an email address, with a 6-digit code, **whether or not
+the address belongs to a user**: an outside translator opening a job, a referee
+uploading a letter, a client's employer confirming details. Since 0.18.0.
+
+There are no resolver methods for this. Your own resolver calls
+`EmailChallengeService`:
+
+```typescript
+@Resolver()
+export class TranslationJobResolver {
+  constructor(
+    private readonly emailChallenges: EmailChallengeService,
+    private readonly jobs: JobsService,
+  ) {}
+
+  // The link in the job email carries a job reference and no credential.
+  // "Send me a code" is a button on the page it opens.
+  @Mutation(() => JobCodeSent)
+  async sendJobCode(@Args('jobRef') jobRef: string, @CurrentRealm() realm: string, @Context() ctx) {
+    const job = await this.jobs.findByReference(jobRef);       // throws if unknown
+    return this.emailChallenges.issue(
+      { email: job.translatorEmail, purpose: `translation-job:${job.id}`, emailData: { firm: job.firmName } },
+      { realm, ipAddress: extractIpAddress(ctx.req) },
+    );                                                         // { challengeId, expiresAt, expiresInMinutes }
+  }
+
+  @Mutation(() => JobOpened)
+  async openJob(@Args('input') input: OpenJobInput, @CurrentRealm() realm: string, @Context() ctx) {
+    const job = await this.jobs.findByReference(input.jobRef);
+    const result = await this.emailChallenges.verify(
+      // The address and purpose this job says the code must be for.
+      { challengeId: input.challengeId, code: input.code, email: job.translatorEmail, purpose: `translation-job:${job.id}` },
+      { realm, ipAddress: extractIpAddress(ctx.req) },
+    );
+    if (!result.ok) return { ok: false, reason: result.reason };   // 'WRONG' | 'EXPIRED' | 'LOCKED'
+    // result.email holds mail for this job. What they get now is yours to decide.
+  }
+}
+```
+
+**Enable it** with a repository and an email service that can send the code:
+
+```typescript
+AuthModule.forRootAsync({
+  useFactory: (emailChallenges: PrismaEmailChallengeRepository) => ({
+    // ...
+    emailChallengeRepositoryInstance: emailChallenges,   // enables the feature; there is no flag
+    rateLimiterInstance: sharedRateLimiter,              // send limits; shared if you run several instances
+  }),
+})
+```
+
+`ConfigurableEmailService` sends the code through `renderEmailChallengeCodeEmail`
+on its renderer; the default renderer has a generic one. A hand-written
+`IEmailService` adds `sendEmailChallengeCode(email, code, expiresInMinutes, { purpose, data })`.
+Without the repository or the method, `issue` answers `EMAIL_CHALLENGE_UNAVAILABLE`.
+
+**What a verified challenge proves:** that whoever entered the code could read
+mail sent to that address in the last 15 minutes. Not who they are, and nothing
+about any account.
+
+| Behaviour | Detail |
+|---|---|
+| Code | 6 digits, 15 minutes (`emailChallenge.ttlMinutes`, or `ttlMinutes` per call; 1 to 60) |
+| Attempts | Three per code, right or wrong, then `LOCKED`. A new code can be sent |
+| Single use | A code is accepted once. Two requests with the right code: one wins |
+| Newest wins | Sending a new code stops the earlier one for that address and purpose |
+| Binding | `verify` refuses a challenge issued for another address, purpose or realm, as `EXPIRED`. Purposes never affect each other, nor a user's own email verification |
+| Send limits | Per address and purpose: one a minute, five an hour. Per IP: thirty an hour. `RATE_LIMIT_EXCEEDED` with `retryAfterSeconds`; see [`emailChallenge`](#email-challenge-options-emailchallenge) |
+| A failed send | `EMAIL_CHALLENGE_SEND_FAILED` and nothing else: provider errors quote the recipient. The detail goes to `IAuthLogger.error`. Costs the address a minute's wait, not its hourly five |
+| Revoking | `revoke({ purpose, email? })` stops outstanding codes, for when the job is cancelled |
+
+| Result or code | Meaning | Tell the person |
+|---|---|---|
+| `{ ok: true, email, purpose }` | The code was right | |
+| `reason: 'WRONG'` | Not the code; attempts remain | Try again |
+| `reason: 'EXPIRED'` | Ran out, already used, replaced, or not a challenge for this address and purpose | Send a new code |
+| `reason: 'LOCKED'` | Three attempts spent | Send a new code |
+| `RATE_LIMIT_EXCEEDED` (429) | Too many codes requested | Wait `retryAfterSeconds` |
+| `EMAIL_CHALLENGE_SEND_FAILED` (503) | The email could not be sent | Try again shortly |
+| `EMAIL_CHALLENGE_UNAVAILABLE` (503) | Not configured | |
+
+A refused code is a result, not an exception: what to show is your decision.
+The exact cause (`code_wrong`, `purpose_mismatch`, `challenge_expired`, ...) is
+in the `EMAIL_CHALLENGE_FAILED` security event only.
+
+#### Rules for your resolver
+
+`issue` sends mail to whatever address it is given, and the person asking may
+not be the address's owner. Six rules keep that safe:
+
+1. **Take the address and the purpose from your own data, never from the
+   request.** `verify` then enforces that the code was issued for exactly that.
+2. **Send the code on a button press, not when the page loads.** Mail scanners
+   and link previews open links, and each would send a code and spend the
+   cooldown.
+3. **Make the reference in the link unguessable.** Whoever holds the link can
+   spend the address's five codes an hour, which locks the real person out for
+   that hour. They still cannot read the code.
+4. **Pass `ipAddress`.** Without it the per-IP limit is not applied (the service
+   warns once).
+5. **Keep personal data out of `purpose`.** It is written to security events as
+   given. Use ids. Put a counter in it (`translation-job:42:2`) if a re-sent job
+   should start with a clean slate.
+6. **Show the address masked** (`t•••@agency.example`), not in full: the person
+   looking at the page may be holding a forwarded link.
+
+#### Implementing `IEmailChallengeRepository`
+
+One table, no relation to your users. Reference schema and Prisma adapter:
+[`examples/email-challenge/`](examples/email-challenge/).
+
+```prisma
+model EmailChallenge {
+  id          String    @id               // generated by the package
+  emailHash   String
+  purposeHash String
+  codeHash    String
+  attempts    Int       @default(0)
+  consumedAt  DateTime?
+  expiresAt   DateTime
+  createdAt   DateTime
+
+  @@index([purposeHash, emailHash])
+  @@index([expiresAt])
+}
+```
+
+Nothing in a row is readable. The address, the purpose and the code are stored
+as keyed hashes the package computes (the realm is inside the first two), so
+the table holds no addresses of people who are not your users, and the adapter
+has no realm to filter on.
+
+**Two methods must each be one conditional write**, never a read followed by a
+write: `registerAttempt` (`UPDATE … SET attempts = attempts + 1 WHERE attempts <
+max AND consumedAt IS NULL`) and `consumeChallenge` (`UPDATE … WHERE consumedAt
+IS NULL`). A read-then-write version lets guesses sent together all count as
+one, or one code be accepted twice. Check your adapter against your real
+database:
+
+```typescript
+import { assertEmailChallengeRepositoryContract } from '@ambushsoftworks/nestjs-auth-graphql/testing';
+
+it('meets the email challenge repository contract', async () => {
+  await assertEmailChallengeRepositoryContract(() => new PrismaEmailChallengeRepository(prisma), {
+    cleanup: async ({ challengeIds }) => {
+      await prisma.emailChallenge.deleteMany({ where: { id: { in: challengeIds } } });
+    },
+  });
+});
+```
+
+It calls `deleteExpiredChallenges`, which removes every expired challenge in
+that database. `InMemoryEmailChallengeRepository` is for tests and a single
+instance.
+
+### Guest Sessions
+
+A session for someone who is **not a user**: it works only on the routes you
+mark, for the things you granted, until the dates you set. For the outside
+translator who has proved their address with an [email challenge](#email-challenges)
+and now needs to work on one job. Since 0.19.0.
+
+```typescript
+// 1. After your own check that they hold the address (a verified email challenge):
+const issued = await this.guestSessions.issue(
+  {
+    principal: { id: translator.id, email: job.translatorEmail },      // your id for the person
+    grant: { kind: 'translation-job', id: job.id, expiresAt: job.dueAt },
+  },
+  { request: ctx.req, res: ctx.res, realm, ipAddress: extractIpAddress(ctx.req) },
+);
+
+// 2. On the routes a guest may reach, and no others:
+@Mutation(() => UploadResult)
+@UseGuards(CsrfGuard, JwtGuard)             // a guard from createAuthGuard
+@AllowGuestSession('translation-job')       // on the method
+upload(@Args('input') input: UploadInput,
+       @CurrentUser() user: User | undefined,
+       @CurrentGuest() guest: GuestPrincipal | undefined) {
+  if (guest && !guest.grants.some((g) => g.id === input.jobId)) throw new ForbiddenException();
+  // ...
+}
+
+// 3. When the job is delivered or taken back:
+await this.guestSessions.revokeGrant({ kind: 'translation-job', id: job.id }, { realm });
+```
+
+**Enable it** with `guestSessionRepositoryInstance`. There is no flag, and no
+fallback store.
+
+#### What a guest can and cannot reach
+
+| | |
+|---|---|
+| A handler with `@AllowGuestSession(kind)` | Admitted, if the session holds a standing grant of that kind |
+| Every other handler | **Refused. The guest credential is not even read** |
+| `@CurrentUser()`, `request.user` | Empty for a guest. The guest is on `request.guest` / `@CurrentGuest()` |
+| `PermissionGuard`, `TenantGuard`, `ScopeGuard` | Refuse a guest: there is no user for them to look up |
+| Token refresh | None. When a grant ends, the person proves their address again |
+| GraphQL subscriptions | Not accepted |
+
+`@AllowGuestSession` is read **from the method only**. On a class it does
+nothing, so decorating a resolver cannot open every method on it.
+
+| Guard on the route | With `@AllowGuestSession(kind)` |
+|---|---|
+| One made by `createAuthGuard([...])` | Users and guests. The user strategies run first, so a signed-in user is handled exactly as on any other route; only if none authenticates is the guest session looked at |
+| `GuestSessionGuard` | Guests only |
+| `JwtAuthGuard` | Users only: it ignores the decorator |
+
+#### What the package checks, and what is yours
+
+The package guarantees that the guest holds a standing grant of the **kind** the
+route names. **Which one is your check**, in every opted-in handler: compare
+what the request asks for with `guest.grants`. A route marked for
+`translation-job` is reachable by every guest with any translation job.
+
+Two more things are yours:
+
+- **What the response contains.** Field resolvers do not run guards by default.
+  A guest-allowed query returning `Job { client { ... } }` exposes whatever
+  those fields resolve. Return guest-shaped types from guest routes.
+- **Do not make a guest route `@Public()`.** `CsrfGuard` skips public routes,
+  and a guest cookie needs its CSRF check like any other cookie session. That
+  is why the route keeps its normal guard and adds the decorator.
+
+#### Several grants in one session
+
+A translator with two open jobs uses one browser. When `issue` is given the
+request, and that browser already holds a guest session **for the same
+`principal.id`, address and realm**, the new grant joins it. Otherwise a new
+session starts.
+
+| Behaviour | Detail |
+|---|---|
+| The token changes when a grant is added | The old one stops working, so an older copy of it never gains the new job. With cookie auth the cookie is replaced for you |
+| `guestSession.maxGrantsPerSession` (default 10) | When full, the grant that ends soonest is revoked to make room |
+| `maxGrantsPerSession: 1` | One grant per session: each new one replaces the last |
+| The same `kind` and `id` again | Replaces the earlier grant, taking the new end date |
+| Each grant has its own `expiresAt` | Never moved. At most `guestSession.maxLifetimeDays` (default 30) ahead |
+
+#### Credential and codes
+
+The credential is an opaque random token, stored only as a keyed hash. It is not
+a JWT, so nothing that verifies access tokens can accept it.
+
+- **With `features.cookieAuth`** and `res` passed to `issue`, it is set as the
+  HttpOnly cookie `guest_session` (`__Host-guest_session` with
+  `cookie.useHostPrefix`), with your cookie options, lasting until the session's
+  last grant ends. It is a different cookie from the access token, so a staff
+  member who opens a translator's link stays signed in.
+- **Otherwise** the client sends `Authorization: Guest <token>`.
+
+| Answer | When | Tell the person |
+|---|---|---|
+| The route's usual `UNAUTHENTICATED` | No credential at all | Sign in, or open your link |
+| `GUEST_SESSION_INVALID` (401) | A guest credential that cannot be used here: revoked, ended, another realm, another kind, or unknown | Prove your address again |
+| `GUEST_SESSION_UNAVAILABLE` (503) | `issue` without a repository | |
+
+`GUEST_SESSION_INVALID` is deliberately not `UNAUTHENTICATED`: clients treat
+that as "refresh and retry", which can never work for a guest. The same code is
+in the body on REST routes. The exact cause (`revoked`, `expired`,
+`realm_mismatch`, `kind_not_allowed`) is in the `GUEST_SESSION_REJECTED`
+security event.
+
+`end(request, res)` is the guest's own "I'm done": it revokes the session and
+clears the cookie. Put `CsrfGuard` on that route too.
+
+#### Implementing `IGuestSessionRepository`
+
+Two tables, no relation to your users. Reference schema and Prisma adapter:
+[`examples/guest-sessions/`](examples/guest-sessions/).
+
+```prisma
+model GuestSession {
+  id          String       @id
+  tokenHash   String       @unique           // read on every guest request
+  principalId String
+  email       String
+  realm       String?
+  revokedAt   DateTime?
+  createdAt   DateTime
+  grants      GuestGrant[]
+}
+
+model GuestGrant {
+  id        String       @id
+  sessionId String
+  kind      String
+  grantId   String
+  realm     String?
+  expiresAt DateTime
+  revokedAt DateTime?
+  createdAt DateTime
+  session   GuestSession @relation(fields: [sessionId], references: [id], onDelete: Cascade)
+
+  @@index([sessionId])
+  @@index([kind, grantId])
+  @@index([expiresAt])
+}
+```
+
+Two rules are the ones adapters get wrong, and the contract checks both:
+
+- **`rotateToken` is one conditional write** (`UPDATE … SET tokenHash = new WHERE
+  tokenHash = old AND revokedAt IS NULL`), never a read followed by a write.
+- **`realm: null` means "no realm", never "any realm".** Pass it through as
+  given; `where: { realm: undefined }` drops the condition.
+
+```typescript
+import { assertGuestSessionRepositoryContract } from '@ambushsoftworks/nestjs-auth-graphql/testing';
+
+it('meets the guest session repository contract', async () => {
+  await assertGuestSessionRepositoryContract(() => new PrismaGuestSessionRepository(prisma), {
+    realms: false,                        // if you do not use realms
+    cleanup: async ({ sessionIds, grantIds }) => {
+      await prisma.guestGrant.deleteMany({ where: { id: { in: grantIds } } });
+      await prisma.guestSession.deleteMany({ where: { id: { in: sessionIds } } });
+    },
+  });
+});
+```
+
+It calls `deleteExpired`, which removes every expired grant and every session
+without grants in that database. `InMemoryGuestSessionRepository` is for tests
+and a single instance. The store is read once per request that presents a guest
+credential on an opted-in route, and never written per request.
+
 ### Brute Force Protection
 
 Provide a `bruteForceRepositoryInstance` and the module tracks failed login attempts and temporarily locks accounts. Without one, `NoOpBruteForceRepository` is used and no account is ever locked; there is no flag to set. The lockout policy (attempt thresholds, lockout duration) is determined by your `IBruteForceRepository` implementation.
@@ -1971,6 +2306,26 @@ reported at boot as ignored. With it, `rp` is required.
 | `ttlSeconds` | `number` | `300` | Step-up token lifetime, 1 to 3600 |
 | `issueOnLogin` | `boolean` | `false` | Return a step-up token from fresh sign-ins (see [Step-Up](#step-up-re-authentication)) |
 
+### Email Challenge Options (`emailChallenge`)
+
+Read only with `emailChallengeRepositoryInstance`. See [Email Challenges](#email-challenges).
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `ttlMinutes` | `number` | `15` | How long a code lasts, 1 to 60. `issue` can override it per call |
+| `issueLimits.cooldownSeconds` | `number` | `60` | Seconds between two codes for one address and purpose. `0` turns it off |
+| `issueLimits.perHour` | `number` | `5` | Codes an hour for one address and purpose. At least 1 |
+| `issueLimits.perIpPerHour` | `number` | `30` | Codes an hour from one IP, across addresses. `0` turns it off |
+
+### Guest Session Options (`guestSession`)
+
+Read only with `guestSessionRepositoryInstance`. See [Guest Sessions](#guest-sessions).
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `maxGrantsPerSession` | `number` | `10` | Standing grants one session may hold, 1 to 100. `1` gives one grant per session |
+| `maxLifetimeDays` | `number` | `30` | The furthest ahead a grant's `expiresAt` may be, 1 to 365 |
+
 ### Optional Instance Options
 
 | Option | Interface | Fallback |
@@ -1982,6 +2337,8 @@ reported at boot as ignored. With it, `rp` is required.
 | `bruteForceRepositoryInstance` | `IBruteForceRepository` | `NoOpBruteForceRepository` |
 | `biometricRepositoryInstance` | `IBiometricRepository` | none: biometrics disabled |
 | `passkeyRepositoryInstance` | `IPasskeyRepository` | none: passkeys disabled |
+| `emailChallengeRepositoryInstance` | `IEmailChallengeRepository` | none: email challenges unavailable |
+| `guestSessionRepositoryInstance` | `IGuestSessionRepository` | none: guest sessions disabled |
 | `authLoggerInstance` | `IAuthLogger` | `ConsoleAuthLogger` |
 | `tenantRepositoryInstance` | `ITenantRepository` | `null` |
 | `tenantExtractorInstance` | `ITenantExtractor` | `null` |
@@ -2004,6 +2361,8 @@ reported at boot as ignored. With it, `rp` is required.
 | `@RequirePermissions('p1', 'p2')` | Method/Class | Require specific permissions |
 | `@RequireScopes('s1', 's2')` | Method/Class | Require API key scopes, enforced by `ScopeGuard`. People are unaffected. See [API Key Authentication](#api-key-authentication) |
 | `@CurrentUser()` | Parameter | Inject authenticated user |
+| `@AllowGuestSession('kind')` | **Method only** | Let a guest session with a standing grant of that kind reach the handler. See [Guest Sessions](#guest-sessions) |
+| `@CurrentGuest()` | Parameter | Inject the admitted guest, or `undefined` for a user |
 | `@CurrentTenant()` | Parameter | Inject resolved tenant context |
 | `@CurrentRealm()` | Parameter | Inject resolved realm from request context |
 | `@ResourceScope('resourceType', 'argName')` | Method | Resource-level permission scoping |
@@ -2012,7 +2371,8 @@ reported at boot as ignored. With it, `rp` is required.
 
 | Guard | Description |
 |-------|-------------|
-| `createAuthGuard(strategies, options)` | Factory for multi-strategy auth guards |
+| `createAuthGuard(strategies, options)` | Factory for multi-strategy auth guards. Also admits guests on handlers marked `@AllowGuestSession()`, after trying the user strategies |
+| `GuestSessionGuard` | Guests only, on handlers marked `@AllowGuestSession()` |
 | `CsrfGuard` | CSRF header validation for cookie auth |
 | `TenantGuard` | Multi-tenant context resolution |
 | `PermissionGuard` | Permission checking against tenant context |
@@ -2110,6 +2470,8 @@ export class CustomGuard implements CanActivate {
 - **`__Host-` cookie prefix** support for enhanced cookie security
 - **Separate HMAC secrets** for refresh tokens, verification codes, and OAuth state
 - **Realm-based identity isolation** with JWT realm claim validation, realm-scoped rate limiting and lockout, and auth flows that refuse a request without a realm
+- **Guest sessions for non-users** -- an opaque token stored as a keyed hash, never a JWT, kept off `request.user`, refused by every route that has not opted in by name, with a hard end per grant, revocation effective on the next request, and the token replaced whenever a grant is added (see [Guest Sessions](#guest-sessions))
+- **Email challenges for non-users** -- one-time codes whose address, purpose and code are stored only as keyed hashes, bound to the address, purpose and realm they were issued for, with attempts and single use enforced by atomic writes in your store (see [Email Challenges](#email-challenges))
 - **Pinned JWT algorithms** -- the package's own `jwt` strategy verifies `HS256` only, and `createExternalJwtStrategy` requires an explicit `algorithms` list from one family (see [External JWTs](#external-jwts))
 - **API keys with scopes and expiry**, refused hard when they carry your prefix and match no key, so no other strategy accepts them
 - **No raw personal data in package logs** — log lines use the user ID or a salted hash (`emailHash=`, `ipHash=`, under `AUTH_IP_HASH_SALT` or `jwtSecret`), phone numbers keep only their last two digits, and the default `ConsoleAuthLogger` redacts security-event metadata. A custom `authLoggerInstance` receives the raw fields; pass them through `redactSecurityEventMetadata` to store them redacted.

package/dist/auth.module.d.ts

@@ -10,6 +10,8 @@ import { IVerificationRepository } from './interfaces/verification-repository.in
 import { IBruteForceRepository } from './interfaces/brute-force-repository.interface';
 import { IBiometricRepository } from './interfaces/biometric-repository.interface';
 import { IPasskeyRepository } from './interfaces/passkey-repository.interface';
+import { IEmailChallengeRepository } from './interfaces/email-challenge-repository.interface';
+import { IGuestSessionRepository } from './interfaces/guest-session-repository.interface';
 import { PasskeyRelyingPartyConfig } from './utils/passkey-rp';
 import { IAuthLogger } from './interfaces/auth-logger.interface';
 import { ITenantRepository } from './interfaces/tenant-repository.interface';
@@ -35,6 +37,8 @@ export interface AuthModuleOptions {
     bruteForceRepositoryInstance?: IBruteForceRepository;
     biometricRepositoryInstance?: IBiometricRepository;
     passkeyRepositoryInstance?: IPasskeyRepository;
+    emailChallengeRepositoryInstance?: IEmailChallengeRepository;
+    guestSessionRepositoryInstance?: IGuestSessionRepository;
     authLoggerInstance?: IAuthLogger;
     refreshTokenSecret?: string;
     verificationCodeSecret?: string;
@@ -148,6 +152,18 @@ export interface AuthModuleOptions {
             removed?: boolean;
         };
     };
+    emailChallenge?: {
+        ttlMinutes?: number;
+        issueLimits?: {
+            cooldownSeconds?: number;
+            perHour?: number;
+            perIpPerHour?: number;
+        };
+    };
+    guestSession?: {
+        maxGrantsPerSession?: number;
+        maxLifetimeDays?: number;
+    };
     stepUp?: {
         ttlSeconds?: number;
         issueOnLogin?: boolean;

package/dist/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAiC3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAuB,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAWjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAkC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAKxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAOnD,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAQ/C,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAS7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAa3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAKzC,KAAK,CAAC,EAAE;QA4BN,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC;KAChE,CAAC;IAQF,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAK7C,MAAM,CAAC,EAAE;QAMP,UAAU,CAAC,EAAE,MAAM,CAAC;QAOpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAmBF,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAyBxC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAO5C,YAAY,CAAC,EAAE,MAAM,CAAC;IAmBtB,QAAQ,CAAC,EAAE;QAOT,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAc5B,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;KAC/B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAWnC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAenC,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAuB/C,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAUF,SAAS,CAAC,EAAE;QAUV,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;QAGjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAShC,kBAAkB,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;KAChE,CAAC;IAMF,OAAO,CAAC,EAAE;QAMR,EAAE,EAAE,yBAAyB,CAAC;QAa9B,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;QAG5D,0BAA0B,CAAC,EAAE,MAAM,CAAC;QAGpC,4BAA4B,CAAC,EAAE,MAAM,CAAC;QAOtC,SAAS,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QAGtD,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,MAAM,CAAC;QAa9C,kBAAkB,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC7D,CAAC;IAOF,MAAM,CAAC,EAAE;QAEP,UAAU,CAAC,EAAE,MAAM,CAAC;QAYpB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAe/B,OAAO,CAAC,EAAE,MAAM,GAAG,2BAA2B,CAAC;KAChD,CAAC;CACH;AASD,MAAM,MAAM,2BAA2B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;AAKrE,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IAef,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAgCD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CA4CvE;AA2ED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB7E;AASD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAiCxE;AAWD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAsB1E;AAoXD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAuCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CAkcpE"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAmC3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAuB,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAWjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAoC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAKxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAOnD,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAQ/C,gCAAgC,CAAC,EAAE,yBAAyB,CAAC;IAQ7D,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAQzD,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAS7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAa3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAKzC,KAAK,CAAC,EAAE;QA4BN,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC;KAChE,CAAC;IAQF,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAK7C,MAAM,CAAC,EAAE;QAMP,UAAU,CAAC,EAAE,MAAM,CAAC;QAOpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAmBF,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAyBxC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAO5C,YAAY,CAAC,EAAE,MAAM,CAAC;IAmBtB,QAAQ,CAAC,EAAE;QAOT,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAc5B,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;KAC/B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAWnC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAenC,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAuB/C,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAUF,SAAS,CAAC,EAAE;QAUV,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;QAGjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAShC,kBAAkB,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;KAChE,CAAC;IAMF,OAAO,CAAC,EAAE;QAMR,EAAE,EAAE,yBAAyB,CAAC;QAa9B,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;QAG5D,0BAA0B,CAAC,EAAE,MAAM,CAAC;QAGpC,4BAA4B,CAAC,EAAE,MAAM,CAAC;QAOtC,SAAS,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QAGtD,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,MAAM,CAAC;QAa9C,kBAAkB,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC7D,CAAC;IAOF,cAAc,CAAC,EAAE;QAEf,UAAU,CAAC,EAAE,MAAM,CAAC;QAOpB,WAAW,CAAC,EAAE;YAEZ,eAAe,CAAC,EAAE,MAAM,CAAC;YAEzB,OAAO,CAAC,EAAE,MAAM,CAAC;YAEjB,YAAY,CAAC,EAAE,MAAM,CAAC;SACvB,CAAC;KACH,CAAC;IAOF,YAAY,CAAC,EAAE;QAMb,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAM7B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IAOF,MAAM,CAAC,EAAE;QAEP,UAAU,CAAC,EAAE,MAAM,CAAC;QAYpB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAe/B,OAAO,CAAC,EAAE,MAAM,GAAG,2BAA2B,CAAC;KAChD,CAAC;CACH;AASD,MAAM,MAAM,2BAA2B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;AAKrE,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IAef,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAgCD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CA8CvE;AA2ED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB7E;AASD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAiDxE;AAWD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB1E;AAibD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAuCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CAwdpE"}