@ambushsoftworks/nestjs-auth-graphql 0.17.1 → 0.19.0

package/dist/testing/guest-session-repository.contract.js

@@ -0,0 +1,368 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuestSessionRepositoryContractError = void 0;
+exports.assertGuestSessionRepositoryContract = assertGuestSessionRepositoryContract;
+const crypto_1 = require("crypto");
+class GuestSessionRepositoryContractError extends Error {
+    constructor(check, detail, options) {
+        super(`IGuestSessionRepository contract — ${check}: ${detail}`);
+        this.name = 'GuestSessionRepositoryContractError';
+        if (options?.cause !== undefined) {
+            this.cause = options.cause;
+        }
+    }
+}
+exports.GuestSessionRepositoryContractError = GuestSessionRepositoryContractError;
+const CONCURRENCY = 8;
+async function assertGuestSessionRepositoryContract(factory, options = {}) {
+    if (options.realms !== undefined && typeof options.realms !== 'boolean') {
+        throw new TypeError(`assertGuestSessionRepositoryContract: realms must be a boolean; received ${String(options.realms)}`);
+    }
+    if (options.cleanup !== undefined && typeof options.cleanup !== 'function') {
+        throw new TypeError('assertGuestSessionRepositoryContract: cleanup must be a function');
+    }
+    const run = new ContractRun(options.realms ?? true);
+    let failure;
+    try {
+        for (const [name, check] of CHECKS) {
+            try {
+                const repository = run.track(await factory());
+                await check(repository, run, name);
+            }
+            catch (error) {
+                if (error instanceof GuestSessionRepositoryContractError)
+                    throw error;
+                throw new GuestSessionRepositoryContractError(name, `threw ${error instanceof Error ? `${error.name}: ${error.message}` : String(error)}`);
+            }
+        }
+    }
+    catch (error) {
+        failure = error;
+    }
+    if (options.cleanup) {
+        try {
+            await options.cleanup(run.created());
+        }
+        catch (cleanupError) {
+            if (failure instanceof GuestSessionRepositoryContractError) {
+                throw new GuestSessionRepositoryContractError('cleanup', `${failure.message} — and cleanup then threw: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`, { cause: cleanupError });
+            }
+            if (failure === undefined)
+                throw cleanupError;
+        }
+    }
+    if (failure !== undefined)
+        throw failure;
+}
+class ContractRun {
+    constructor(realms) {
+        this.realms = realms;
+        this.sessionIds = new Set();
+        this.grantIds = new Set();
+    }
+    created() {
+        return { sessionIds: [...this.sessionIds], grantIds: [...this.grantIds] };
+    }
+    track(repo) {
+        return new Proxy(repo, {
+            get: (target, property, receiver) => {
+                const value = Reflect.get(target, property, receiver);
+                if (property === 'createSession') {
+                    return async (session, grant) => {
+                        this.sessionIds.add(session.id);
+                        this.grantIds.add(grant.id);
+                        return value.call(target, session, grant);
+                    };
+                }
+                if (property === 'addGrant') {
+                    return async (grant) => {
+                        this.grantIds.add(grant.id);
+                        return value.call(target, grant);
+                    };
+                }
+                return typeof value === 'function' ? value.bind(target) : value;
+            },
+        });
+    }
+    realm(realm) {
+        return this.realms ? realm : null;
+    }
+    session(overrides = {}) {
+        return {
+            id: (0, crypto_1.randomUUID)(),
+            tokenHash: hash(),
+            principalId: `contract-principal-${(0, crypto_1.randomUUID)()}`,
+            email: `contract-${(0, crypto_1.randomUUID)()}@example.com`,
+            realm: this.realm('contract-realm'),
+            revokedAt: null,
+            createdAt: wholeSecond(),
+            ...overrides,
+        };
+    }
+    grant(session, overrides = {}) {
+        return {
+            id: (0, crypto_1.randomUUID)(),
+            sessionId: session.id,
+            kind: 'contract-kind',
+            grantId: `contract-grant-${(0, crypto_1.randomUUID)()}`,
+            realm: session.realm,
+            expiresAt: new Date(wholeSecond().getTime() + 600_000),
+            revokedAt: null,
+            createdAt: wholeSecond(),
+            ...overrides,
+        };
+    }
+    async stored(repo, sessionOverrides = {}, grantOverrides = {}) {
+        const session = this.session(sessionOverrides);
+        const grant = this.grant(session, grantOverrides);
+        await repo.createSession(session, grant);
+        return { session, grant };
+    }
+}
+const hash = () => (0, crypto_1.randomBytes)(32).toString('hex');
+const wholeSecond = () => new Date(Math.floor(Date.now() / 1000) * 1000);
+function fail(check, detail) {
+    throw new GuestSessionRepositoryContractError(check, detail);
+}
+const sameTime = (a, b) => a === b || (a instanceof Date && b instanceof Date && Math.abs(a.getTime() - b.getTime()) < 1000);
+const CHECKS = [
+    [
+        'a session and its grants round-trip every field',
+        async (repo, run, check) => {
+            const { session, grant } = await run.stored(repo);
+            const second = run.grant(session, { kind: 'contract-other-kind' });
+            await repo.addGrant(second);
+            const got = await repo.findSessionByTokenHash(session.tokenHash);
+            if (!got)
+                fail(check, 'findSessionByTokenHash returned null for a session just created');
+            for (const key of ['id', 'tokenHash', 'principalId', 'email', 'realm', 'revokedAt']) {
+                if (got[key] !== session[key]) {
+                    fail(check, `session ${key} came back as ${JSON.stringify(got[key])}, stored ${JSON.stringify(session[key])}`);
+                }
+            }
+            if (!(got.createdAt instanceof Date) || !sameTime(got.createdAt, session.createdAt)) {
+                fail(check, 'session createdAt changed, or is not a Date');
+            }
+            if (!Array.isArray(got.grants) || got.grants.length !== 2) {
+                fail(check, `the session came back with ${JSON.stringify(got.grants?.length)} grants; it has 2`);
+            }
+            for (const stored of [grant, second]) {
+                const back = got.grants.find((g) => g.id === stored.id);
+                if (!back)
+                    fail(check, `grant ${stored.kind} is missing from the session`);
+                for (const key of ['sessionId', 'kind', 'grantId', 'realm', 'revokedAt']) {
+                    if (back[key] !== stored[key]) {
+                        fail(check, `grant ${key} came back as ${JSON.stringify(back[key])}, stored ${JSON.stringify(stored[key])}`);
+                    }
+                }
+                if (!(back.expiresAt instanceof Date) || !sameTime(back.expiresAt, stored.expiresAt)) {
+                    fail(check, 'grant expiresAt changed, or is not a Date');
+                }
+                if (!(back.createdAt instanceof Date) || !sameTime(back.createdAt, stored.createdAt)) {
+                    fail(check, 'grant createdAt changed, or is not a Date');
+                }
+            }
+        },
+    ],
+    [
+        'a session without a realm stores null',
+        async (repo, run, check) => {
+            const { session } = await run.stored(repo, { realm: null });
+            const got = await repo.findSessionByTokenHash(session.tokenHash);
+            if (!got)
+                fail(check, 'findSessionByTokenHash returned null');
+            if (got.realm !== null || got.grants[0]?.realm !== null) {
+                fail(check, `realm came back as ${JSON.stringify(got.realm)} on the session and ` +
+                    `${JSON.stringify(got.grants[0]?.realm)} on its grant; both must be null, not undefined or ''`);
+            }
+        },
+    ],
+    [
+        'an unknown token or id answers null or false',
+        async (repo, _run, check) => {
+            const unknown = `unknown-${(0, crypto_1.randomUUID)()}`;
+            if ((await repo.findSessionByTokenHash(hash())) !== null)
+                fail(check, 'findSessionByTokenHash did not return null');
+            if ((await repo.rotateToken(unknown, hash(), hash())) !== false)
+                fail(check, 'rotateToken did not return false');
+            if ((await repo.revokeSession(unknown)) !== false)
+                fail(check, 'revokeSession did not return false');
+            if ((await repo.revokeGrant(unknown)) !== false)
+                fail(check, 'revokeGrant did not return false');
+        },
+    ],
+    [
+        'revoked sessions, and revoked and expired grants, are still returned',
+        async (repo, run, check) => {
+            const { session, grant } = await run.stored(repo);
+            const expired = run.grant(session, { expiresAt: new Date(Date.now() - 60_000) });
+            await repo.addGrant(expired);
+            await repo.revokeGrant(grant.id);
+            await repo.revokeSession(session.id);
+            const got = await repo.findSessionByTokenHash(session.tokenHash);
+            if (!got)
+                fail(check, 'findSessionByTokenHash hid a revoked session. Return it: the package decides.');
+            if (!(got.revokedAt instanceof Date))
+                fail(check, 'revokedAt is not a Date after revokeSession');
+            const revoked = got.grants.find((g) => g.id === grant.id);
+            if (!revoked)
+                fail(check, 'a revoked grant is missing from its session');
+            if (!(revoked.revokedAt instanceof Date))
+                fail(check, "a revoked grant's revokedAt is not a Date");
+            if (!got.grants.some((g) => g.id === expired.id))
+                fail(check, 'an expired grant is missing from its session');
+        },
+    ],
+    [
+        'rotateToken replaces the hash only from the current one',
+        async (repo, run, check) => {
+            const { session } = await run.stored(repo);
+            const next = hash();
+            if ((await repo.rotateToken(session.id, hash(), next)) !== false) {
+                fail(check, 'it rotated from a hash that is not the current one');
+            }
+            if ((await repo.rotateToken(session.id, session.tokenHash, next)) !== true) {
+                fail(check, 'it refused to rotate from the current hash');
+            }
+            if ((await repo.findSessionByTokenHash(session.tokenHash)) !== null) {
+                fail(check, 'the old token hash still finds the session after a rotation');
+            }
+            if ((await repo.findSessionByTokenHash(next))?.id !== session.id) {
+                fail(check, 'the new token hash does not find the session');
+            }
+            if ((await repo.rotateToken(session.id, session.tokenHash, hash())) !== false) {
+                fail(check, 'it rotated again from the hash it had just replaced');
+            }
+        },
+    ],
+    [
+        'rotateToken refuses a revoked session',
+        async (repo, run, check) => {
+            const { session } = await run.stored(repo);
+            await repo.revokeSession(session.id);
+            if ((await repo.rotateToken(session.id, session.tokenHash, hash())) !== false) {
+                fail(check, 'it rotated the token of a revoked session');
+            }
+        },
+    ],
+    [
+        'rotateToken applies exactly once, under concurrency',
+        async (repo, run, check) => {
+            const { session } = await run.stored(repo);
+            const candidates = Array.from({ length: CONCURRENCY }, hash);
+            const results = await Promise.all(candidates.map((next) => repo.rotateToken(session.id, session.tokenHash, next)));
+            const applied = results.filter((r) => r === true).length;
+            if (applied !== 1) {
+                fail(check, `${applied} of ${CONCURRENCY} concurrent rotations from the same hash applied; exactly one must. ` +
+                    'It must be one conditional update (UPDATE … SET tokenHash = new WHERE tokenHash = old), ' +
+                    'not a read then a write.');
+            }
+            const winner = candidates[results.indexOf(true)];
+            if ((await repo.findSessionByTokenHash(winner))?.id !== session.id) {
+                fail(check, 'the rotation that reported success is not the hash the session ended up with');
+            }
+        },
+    ],
+    [
+        'revoking a session or a grant happens once',
+        async (repo, run, check) => {
+            const { session, grant } = await run.stored(repo);
+            if ((await repo.revokeGrant(grant.id)) !== true)
+                fail(check, 'revokeGrant refused a standing grant');
+            const grantRevokedAt = (await repo.findSessionByTokenHash(session.tokenHash))?.grants[0]?.revokedAt;
+            if ((await repo.revokeGrant(grant.id)) !== false)
+                fail(check, 'revokeGrant revoked a grant twice');
+            if ((await repo.revokeSession(session.id)) !== true)
+                fail(check, 'revokeSession refused a standing session');
+            const sessionRevokedAt = (await repo.findSessionByTokenHash(session.tokenHash))?.revokedAt;
+            if ((await repo.revokeSession(session.id)) !== false)
+                fail(check, 'revokeSession revoked a session twice');
+            const got = await repo.findSessionByTokenHash(session.tokenHash);
+            if (!sameTime(got?.revokedAt, sessionRevokedAt) || !(got?.revokedAt instanceof Date)) {
+                fail(check, "the session's revokedAt changed on the second revoke");
+            }
+            if (!sameTime(got.grants[0]?.revokedAt, grantRevokedAt) || !(got.grants[0]?.revokedAt instanceof Date)) {
+                fail(check, "the grant's revokedAt changed on the second revoke");
+            }
+        },
+    ],
+    [
+        'revokeGrants is by kind, id and realm, across sessions',
+        async (repo, run, check) => {
+            const realm = run.realm('contract-realm');
+            const grantId = `contract-job-${(0, crypto_1.randomUUID)()}`;
+            const one = await run.stored(repo, {}, { grantId });
+            const two = await run.stored(repo, {}, { grantId });
+            const otherId = await run.stored(repo);
+            const otherKind = await run.stored(repo, {}, { grantId, kind: 'contract-other-kind' });
+            const standing = async (stored) => (await repo.findSessionByTokenHash(stored.session.tokenHash))?.grants.find((g) => g.id === stored.grant.id)?.revokedAt === null;
+            const count = await repo.revokeGrants({ kind: 'contract-kind', grantId, realm });
+            if (await standing(one))
+                fail(check, 'a matching grant is still standing');
+            if (await standing(two))
+                fail(check, "a matching grant in another session is still standing");
+            if (!(await standing(otherId)))
+                fail(check, 'it revoked a grant with another id');
+            if (!(await standing(otherKind)))
+                fail(check, 'it revoked a grant of another kind with the same id');
+            if (count !== 2)
+                fail(check, `it reported ${JSON.stringify(count)} revoked; 2 matched`);
+            const again = await repo.revokeGrants({ kind: 'contract-kind', grantId, realm });
+            if (again !== 0)
+                fail(check, `a second call reported ${JSON.stringify(again)} revoked; none was standing`);
+        },
+    ],
+    [
+        'revokeGrants keeps realms apart, and null means no realm',
+        async (repo, run, check) => {
+            if (!run.realms)
+                return;
+            const grantId = `contract-job-${(0, crypto_1.randomUUID)()}`;
+            const inA = await run.stored(repo, { realm: 'contract-realm-a' }, { grantId });
+            const inB = await run.stored(repo, { realm: 'contract-realm-b' }, { grantId });
+            const inNone = await run.stored(repo, { realm: null }, { grantId });
+            const standing = async (stored) => (await repo.findSessionByTokenHash(stored.session.tokenHash))?.grants[0]?.revokedAt === null;
+            const none = await repo.revokeGrants({ kind: 'contract-kind', grantId, realm: null });
+            if (!(await standing(inA)) || !(await standing(inB))) {
+                fail(check, 'realm: null revoked a grant that has a realm. null means "no realm", not "any realm": ' +
+                    'do not let it become `where: { realm: undefined }`.');
+            }
+            if (await standing(inNone))
+                fail(check, 'realm: null left the grant without a realm standing');
+            if (none !== 1)
+                fail(check, `realm: null reported ${JSON.stringify(none)} revoked; 1 matched`);
+            const a = await repo.revokeGrants({ kind: 'contract-kind', grantId, realm: 'contract-realm-a' });
+            if (await standing(inA))
+                fail(check, "a realm's own grant is still standing");
+            if (!(await standing(inB)))
+                fail(check, "revoking in one realm revoked another realm's grant");
+            if (a !== 1)
+                fail(check, `one realm reported ${JSON.stringify(a)} revoked; 1 matched`);
+        },
+    ],
+    [
+        'deleteExpired removes expired grants and emptied sessions, and keeps the rest',
+        async (repo, run, check) => {
+            const past = new Date(Date.now() - 60_000);
+            const dead = await run.stored(repo, {}, { expiresAt: past });
+            const mixed = await run.stored(repo);
+            const mixedExpired = run.grant(mixed.session, { expiresAt: past });
+            await repo.addGrant(mixedExpired);
+            const deleted = await repo.deleteExpired();
+            if (typeof deleted !== 'number' || deleted < 2) {
+                fail(check, `deleteExpired returned ${JSON.stringify(deleted)}; at least two grants had expired`);
+            }
+            if ((await repo.findSessionByTokenHash(dead.session.tokenHash)) !== null) {
+                fail(check, 'a session whose only grant had expired survived');
+            }
+            const kept = await repo.findSessionByTokenHash(mixed.session.tokenHash);
+            if (!kept)
+                fail(check, 'a session with a live grant was deleted');
+            if (kept.grants.some((g) => g.id === mixedExpired.id))
+                fail(check, 'an expired grant survived');
+            if (!kept.grants.some((g) => g.id === mixed.grant.id))
+                fail(check, 'a live grant was deleted');
+        },
+    ],
+];
+//# sourceMappingURL=guest-session-repository.contract.js.map

package/dist/testing/guest-session-repository.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest-session-repository.contract.js","sourceRoot":"","sources":["../../src/testing/guest-session-repository.contract.ts"],"names":[],"mappings":";;;AA+FA,oFAkDC;AAjJD,mCAAiD;AAQjD,MAAa,mCAAoC,SAAQ,KAAK;IAC5D,YAAY,KAAa,EAAE,MAAc,EAAE,OAA6B;QACtE,KAAK,CAAC,sCAAsC,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;QAClD,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,IAA4B,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QACtD,CAAC;IACH,CAAC;CACF;AARD,kFAQC;AAkCD,MAAM,WAAW,GAAG,CAAC,CAAC;AA6Cf,KAAK,UAAU,oCAAoC,CACxD,OAAgB,EAChB,UAAiD,EAAE;IAEnD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CACjB,4EAA4E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CACrG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3E,MAAM,IAAI,SAAS,CAAC,kEAAkE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IAEpD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;gBAC9C,MAAM,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,KAAK,YAAY,mCAAmC;oBAAE,MAAM,KAAK,CAAC;gBACtE,MAAM,IAAI,mCAAmC,CAC3C,IAAI,EACJ,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,YAAqB,EAAE,CAAC;YAC/B,IAAI,OAAO,YAAY,mCAAmC,EAAE,CAAC;gBAC3D,MAAM,IAAI,mCAAmC,CAC3C,SAAS,EACT,GAAG,OAAO,CAAC,OAAO,8BAChB,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAC5E,EAAE,EACF,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,YAAY,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC;AAC3C,CAAC;AAGD,MAAM,WAAW;IAIf,YAAqB,MAAe;QAAf,WAAM,GAAN,MAAM,CAAS;QAHnB,eAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,aAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEP,CAAC;IAExC,OAAO;QACL,OAAO,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5E,CAAC;IAGD,KAAK,CAAC,IAA6B;QACjC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE;YACrB,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;gBAClC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACtD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;oBACjC,OAAO,KAAK,EAAE,OAA2B,EAAE,KAAuB,EAAE,EAAE;wBACpE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;wBAC5B,OAAQ,KAAkD,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC1F,CAAC,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;oBAC5B,OAAO,KAAK,EAAE,KAAuB,EAAE,EAAE;wBACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;wBAC5B,OAAQ,KAA6C,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;oBAC5E,CAAC,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAClE,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,KAAa;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,YAAyC,EAAE;QACjD,OAAO;YACL,EAAE,EAAE,IAAA,mBAAU,GAAE;YAChB,SAAS,EAAE,IAAI,EAAE;YACjB,WAAW,EAAE,sBAAsB,IAAA,mBAAU,GAAE,EAAE;YACjD,KAAK,EAAE,YAAY,IAAA,mBAAU,GAAE,cAAc;YAC7C,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACnC,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,WAAW,EAAE;YACxB,GAAG,SAAS;SACb,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAA2B,EAAE,YAAuC,EAAE;QAC1E,OAAO;YACL,EAAE,EAAE,IAAA,mBAAU,GAAE;YAChB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,kBAAkB,IAAA,mBAAU,GAAE,EAAE;YACzC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC;YACtD,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,WAAW,EAAE;YACxB,GAAG,SAAS;SACb,CAAC;IACJ,CAAC;IAGD,KAAK,CAAC,MAAM,CACV,IAA6B,EAC7B,mBAAgD,EAAE,EAClD,iBAA4C,EAAE;QAE9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF;AAGD,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AAEzE,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc;IACzC,MAAM,IAAI,mCAAmC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAA0B,EAAE,CAA0B,EAAE,EAAE,CAC1E,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;AAIpG,MAAM,MAAM,GAA2B;IACrC;QACE,iDAAiD;QACjD,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAE5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,iEAAiE,CAAC,CAAC;YACzF,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAU,EAAE,CAAC;gBAC7F,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpF,IAAI,CAAC,KAAK,EAAE,6CAA6C,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1D,IAAI,CAAC,KAAK,EAAE,8BAA8B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACnG,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxD,IAAI,CAAC,IAAI;oBAAE,IAAI,CAAC,KAAK,EAAE,SAAS,MAAM,CAAC,IAAI,8BAA8B,CAAC,CAAC;gBAC3E,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAU,EAAE,CAAC;oBAClF,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC9B,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC/G,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;oBACrF,IAAI,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;gBAC3D,CAAC;gBACD,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;oBACrF,IAAI,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;KACF;IACD;QACE,uCAAuC;QACvC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;YAC9D,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;gBACxD,IAAI,CACF,KAAK,EACL,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB;oBACnE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,uDAAuD,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;KACF;IACD;QACE,8CAA8C;QAC9C,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,WAAW,IAAA,mBAAU,GAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,EAAE,4CAA4C,CAAC,CAAC;YACpH,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;YACjH,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;QACnG,CAAC;KACF;IACD;QACE,sEAAsE;QACtE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;YACjF,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAErC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,+EAA+E,CAAC,CAAC;YACvG,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,6CAA6C,CAAC,CAAC;YACjG,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,KAAK,EAAE,6CAA6C,CAAC,CAAC;YACzE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,YAAY,IAAI,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;YACnG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,8CAA8C,CAAC,CAAC;QAChH,CAAC;KACF;IACD;QACE,yDAAyD;QACzD,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBACjE,IAAI,CAAC,KAAK,EAAE,oDAAoD,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3E,IAAI,CAAC,KAAK,EAAE,4CAA4C,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpE,IAAI,CAAC,KAAK,EAAE,6DAA6D,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;gBACjE,IAAI,CAAC,KAAK,EAAE,8CAA8C,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC9E,IAAI,CAAC,KAAK,EAAE,qDAAqD,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;KACF;IACD;QACE,uCAAuC;QACvC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC9E,IAAI,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;KACF;IACD;QACE,qDAAqD;QACrD,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAChF,CAAC;YACF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YACzD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,IAAI,CACF,KAAK,EACL,GAAG,OAAO,OAAO,WAAW,sEAAsE;oBAChG,0FAA0F;oBAC1F,0BAA0B,CAC7B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;gBACnE,IAAI,CAAC,KAAK,EAAE,8EAA8E,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;KACF;IACD;QACE,4CAA4C;QAC5C,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;YACrG,MAAM,cAAc,GAAG,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;YACpG,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;YACnG,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,EAAE,0CAA0C,CAAC,CAAC;YAC7G,MAAM,gBAAgB,GAAG,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC;YAC3F,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;YAE3G,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,YAAY,IAAI,CAAC,EAAE,CAAC;gBACrF,IAAI,CAAC,KAAK,EAAE,sDAAsD,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,YAAY,IAAI,CAAC,EAAE,CAAC;gBACvG,IAAI,CAAC,KAAK,EAAE,oDAAoD,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;KACF;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,gBAAgB,IAAA,mBAAU,GAAE,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACvF,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAgE,EAAE,EAAE,CAC1F,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CACxE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAChC,EAAE,SAAS,KAAK,IAAI,CAAC;YAExB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;YAC3E,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,uDAAuD,CAAC,CAAC;YAC9F,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;YAClF,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,qDAAqD,CAAC,CAAC;YACrG,IAAI,KAAK,KAAK,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAExF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,IAAI,KAAK,KAAK,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7G,CAAC;KACF;IACD;QACE,0DAA0D;QAC1D,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACzB,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,OAAO;YACxB,MAAM,OAAO,GAAG,gBAAgB,IAAA,mBAAU,GAAE,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAgE,EAAE,EAAE,CAC1F,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,KAAK,IAAI,CAAC;YAE/F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACrD,IAAI,CACF,KAAK,EACL,wFAAwF;oBACtF,qDAAqD,CACxD,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,qDAAqD,CAAC,CAAC;YAC/F,IAAI,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAE/F,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACjG,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;YAC9E,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,qDAAqD,CAAC,CAAC;YAC/F,IAAI,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QACzF,CAAC;KACF;IACD;QACE,+EAA+E;QAC/E,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAElC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,KAAK,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzE,IAAI,CAAC,KAAK,EAAE,iDAAiD,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACxE,IAAI,CAAC,IAAI;gBAAE,IAAI,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;YAChG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QACjG,CAAC;KACF;CACF,CAAC"}

package/dist/testing/index.d.ts

@@ -1,3 +1,5 @@
 export { assertPasskeyRepositoryContract, PasskeyRepositoryContractError, type PasskeyRepositoryContractOptions, type PasskeyContractCreatedIds, } from './passkey-repository.contract';
+export { assertEmailChallengeRepositoryContract, EmailChallengeRepositoryContractError, type EmailChallengeRepositoryContractOptions, } from './email-challenge-repository.contract';
+export { assertGuestSessionRepositoryContract, GuestSessionRepositoryContractError, type GuestSessionRepositoryContractOptions, type GuestSessionContractCreatedIds, } from './guest-session-repository.contract';
 export { SoftwareAuthenticator, type CreateOptions as SoftwareAuthenticatorCreateOptions, type GetOptions as SoftwareAuthenticatorGetOptions, type SoftwareAlgorithm, } from '../test-utils/software-authenticator';
 //# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,KAAK,gCAAgC,EACrC,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,KAAK,aAAa,IAAI,kCAAkC,EACxD,KAAK,UAAU,IAAI,+BAA+B,EAClD,KAAK,iBAAiB,GACvB,MAAM,sCAAsC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,KAAK,gCAAgC,EACrC,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,sCAAsC,EACtC,qCAAqC,EACrC,KAAK,uCAAuC,GAC7C,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,oCAAoC,EACpC,mCAAmC,EACnC,KAAK,qCAAqC,EAC1C,KAAK,8BAA8B,GACpC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,qBAAqB,EACrB,KAAK,aAAa,IAAI,kCAAkC,EACxD,KAAK,UAAU,IAAI,+BAA+B,EAClD,KAAK,iBAAiB,GACvB,MAAM,sCAAsC,CAAC"}

package/dist/testing/index.js

@@ -1,9 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SoftwareAuthenticator = exports.PasskeyRepositoryContractError = exports.assertPasskeyRepositoryContract = void 0;
+exports.SoftwareAuthenticator = exports.GuestSessionRepositoryContractError = exports.assertGuestSessionRepositoryContract = exports.EmailChallengeRepositoryContractError = exports.assertEmailChallengeRepositoryContract = exports.PasskeyRepositoryContractError = exports.assertPasskeyRepositoryContract = void 0;
 var passkey_repository_contract_1 = require("./passkey-repository.contract");
 Object.defineProperty(exports, "assertPasskeyRepositoryContract", { enumerable: true, get: function () { return passkey_repository_contract_1.assertPasskeyRepositoryContract; } });
 Object.defineProperty(exports, "PasskeyRepositoryContractError", { enumerable: true, get: function () { return passkey_repository_contract_1.PasskeyRepositoryContractError; } });
+var email_challenge_repository_contract_1 = require("./email-challenge-repository.contract");
+Object.defineProperty(exports, "assertEmailChallengeRepositoryContract", { enumerable: true, get: function () { return email_challenge_repository_contract_1.assertEmailChallengeRepositoryContract; } });
+Object.defineProperty(exports, "EmailChallengeRepositoryContractError", { enumerable: true, get: function () { return email_challenge_repository_contract_1.EmailChallengeRepositoryContractError; } });
+var guest_session_repository_contract_1 = require("./guest-session-repository.contract");
+Object.defineProperty(exports, "assertGuestSessionRepositoryContract", { enumerable: true, get: function () { return guest_session_repository_contract_1.assertGuestSessionRepositoryContract; } });
+Object.defineProperty(exports, "GuestSessionRepositoryContractError", { enumerable: true, get: function () { return guest_session_repository_contract_1.GuestSessionRepositoryContractError; } });
 var software_authenticator_1 = require("../test-utils/software-authenticator");
 Object.defineProperty(exports, "SoftwareAuthenticator", { enumerable: true, get: function () { return software_authenticator_1.SoftwareAuthenticator; } });
 //# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":";;;AAMA,6EAKuC;AAJrC,8IAAA,+BAA+B,OAAA;AAC/B,6IAAA,8BAA8B,OAAA;AAIhC,+EAK8C;AAJ5C,+HAAA,qBAAqB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":";;;AAMA,6EAKuC;AAJrC,8IAAA,+BAA+B,OAAA;AAC/B,6IAAA,8BAA8B,OAAA;AAIhC,6FAI+C;AAH7C,6JAAA,sCAAsC,OAAA;AACtC,4JAAA,qCAAqC,OAAA;AAGvC,yFAK6C;AAJ3C,yJAAA,oCAAoC,OAAA;AACpC,wJAAA,mCAAmC,OAAA;AAIrC,+EAK8C;AAJ5C,+HAAA,qBAAqB,OAAA"}

package/dist/utils/rate-limit-helpers.d.ts

@@ -0,0 +1,4 @@
+export declare function retryAfterSeconds(resetAt: Date): number;
+export declare function realmKeyPrefix(realm: string | undefined): string;
+export declare function normaliseEmail(email: unknown): string;
+//# sourceMappingURL=rate-limit-helpers.d.ts.map

package/dist/utils/rate-limit-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-helpers.d.ts","sourceRoot":"","sources":["../../src/utils/rate-limit-helpers.ts"],"names":[],"mappings":"AAGA,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,IAAI,GAAG,MAAM,CAEvD;AAGD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEhE;AAGD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMrD"}

package/dist/utils/rate-limit-helpers.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.retryAfterSeconds = retryAfterSeconds;
+exports.realmKeyPrefix = realmKeyPrefix;
+exports.normaliseEmail = normaliseEmail;
+const common_1 = require("@nestjs/common");
+function retryAfterSeconds(resetAt) {
+    return Math.max(1, Math.ceil((resetAt.getTime() - Date.now()) / 1000));
+}
+function realmKeyPrefix(realm) {
+    return realm ? `${realm}:` : '';
+}
+function normaliseEmail(email) {
+    const normalised = typeof email === 'string' ? email.trim().toLowerCase() : '';
+    if (!/^[^\s@]+@[^\s@]+$/.test(normalised)) {
+        throw new common_1.BadRequestException('A valid email address is required');
+    }
+    return normalised;
+}
+//# sourceMappingURL=rate-limit-helpers.js.map

package/dist/utils/rate-limit-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-helpers.js","sourceRoot":"","sources":["../../src/utils/rate-limit-helpers.ts"],"names":[],"mappings":";;AAGA,8CAEC;AAGD,wCAEC;AAGD,wCAMC;AAnBD,2CAAqD;AAGrD,SAAgB,iBAAiB,CAAC,OAAa;IAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACzE,CAAC;AAGD,SAAgB,cAAc,CAAC,KAAyB;IACtD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAGD,SAAgB,cAAc,CAAC,KAAc;IAC3C,MAAM,UAAU,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,4BAAmB,CAAC,mCAAmC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/examples/email-challenge/prisma-email-challenge.repository.ts

@@ -0,0 +1,85 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
+import {
+  EmailChallengeRecord,
+  IEmailChallengeRepository,
+} from '@ambushsoftworks/nestjs-auth-graphql';
+
+/**
+ * IEmailChallengeRepository on Prisma, for the model in ./schema.prisma.
+ *
+ * Verified against PostgreSQL 16 with `assertEmailChallengeRepositoryContract`
+ * from `@ambushsoftworks/nestjs-auth-graphql/testing`. Run that contract
+ * against your copy, too, on your real database:
+ *
+ *   await assertEmailChallengeRepositoryContract(() => new PrismaEmailChallengeRepository(prisma), {
+ *     cleanup: async ({ challengeIds }) => {
+ *       await prisma.emailChallenge.deleteMany({ where: { id: { in: challengeIds } } });
+ *     },
+ *   });
+ *
+ * Inject your own PrismaService in place of PrismaClient if you have one.
+ */
+@Injectable()
+export class PrismaEmailChallengeRepository implements IEmailChallengeRepository {
+  constructor(private readonly prisma: PrismaClient) {}
+
+  async createChallenge(record: EmailChallengeRecord): Promise<void> {
+    await this.prisma.emailChallenge.create({
+      data: {
+        id: record.id,
+        emailHash: record.emailHash,
+        purposeHash: record.purposeHash,
+        codeHash: record.codeHash,
+        attempts: record.attempts,
+        consumedAt: record.consumedAt,
+        expiresAt: record.expiresAt,
+        createdAt: record.createdAt,
+      },
+    });
+  }
+
+  /** Whatever its state: the package decides what expired, consumed and exhausted mean. */
+  async findChallenge(id: string): Promise<EmailChallengeRecord | null> {
+    return this.prisma.emailChallenge.findUnique({ where: { id } });
+  }
+
+  /** One conditional update: never a read followed by a write. */
+  async registerAttempt(id: string, maxAttempts: number): Promise<boolean> {
+    const { count } = await this.prisma.emailChallenge.updateMany({
+      where: { id, consumedAt: null, attempts: { lt: maxAttempts } },
+      data: { attempts: { increment: 1 } },
+    });
+    return count === 1;
+  }
+
+  /** One conditional update: never a read followed by a write. */
+  async consumeChallenge(id: string): Promise<boolean> {
+    const { count } = await this.prisma.emailChallenge.updateMany({
+      where: { id, consumedAt: null },
+      data: { consumedAt: new Date() },
+    });
+    return count === 1;
+  }
+
+  async invalidateChallenges(filter: { purposeHash: string; emailHash?: string }): Promise<number> {
+    const { count } = await this.prisma.emailChallenge.updateMany({
+      where: {
+        purposeHash: filter.purposeHash,
+        // Only when given. `emailHash: undefined` would mean the same to Prisma,
+        // but spelling it out keeps the intent from depending on that.
+        ...(filter.emailHash !== undefined ? { emailHash: filter.emailHash } : {}),
+        consumedAt: null,
+      },
+      data: { consumedAt: new Date() },
+    });
+    return count;
+  }
+
+  async deleteExpiredChallenges(): Promise<number> {
+    const { count } = await this.prisma.emailChallenge.deleteMany({
+      where: { expiresAt: { lt: new Date() } },
+    });
+    return count;
+  }
+}

package/examples/email-challenge/schema.prisma

@@ -0,0 +1,24 @@
+// Reference schema for IEmailChallengeRepository, as in the README ("Email
+// Challenges"). Verified against PostgreSQL 16 with
+// `assertEmailChallengeRepositoryContract`.
+//
+// Merge this model into your schema. It has no relation to your User model, on
+// purpose: these codes go to people who are not users.
+//
+// Nothing in a row is readable. The address, the purpose and the code are
+// keyed hashes computed by the package (64 hex characters each), and the id is
+// 43 random base64url characters.
+
+model EmailChallenge {
+  id          String    @id               // generated by the package, not by the database
+  emailHash   String
+  purposeHash String
+  codeHash    String
+  attempts    Int       @default(0)
+  consumedAt  DateTime?                   // null while the code can still be used
+  expiresAt   DateTime
+  createdAt   DateTime
+
+  @@index([purposeHash, emailHash])
+  @@index([expiresAt])
+}