@ambushsoftworks/nestjs-auth-graphql 0.18.0 → 0.20.0

package/CHANGELOG.md

@@ -27,6 +27,107 @@ for buried obligations. **The marker was introduced in 0.9.0 and has not been
 retro-applied**, so it is reliable from 0.9.0 onward only. Convention adopted
 from `@ambushsoftworks/nestjs-payments-graphql`.
 
+## [0.20.0] - 2026-10-10
+
+For apps whose accounts are created by an operator, not by sign-up. Five
+requests from Posada San Carlos. Nothing here requires a change to an app that
+compiles today, with one exception under "Changed — breaking".
+
+### Added
+
+- **`features.signup: false`** refuses every path that would create an account
+  with `SIGNUP_DISABLED` (403), before it reaches `create`: password sign-up,
+  passwordless sign-up, and a first sign-in with Google or Facebook. Signing in
+  to an existing account is unaffected. Default `true`.
+- **`PasswordHashService`**: `hash(password)` hashes exactly as sign-up does, at
+  the module's `bcryptRounds`, for accounts created by a script. Available from
+  `NestFactory.createApplicationContext`. Sign-up, change-password and
+  reset-password now go through the same function.
+- **`AuthUserRepository`**, the type `userRepositoryInstance` now accepts: five
+  required methods (`findByEmail`, `findById`, `update`, `updatePassword`,
+  `markEmailVerified`) and the rest optional. The README Quick Start's core-only
+  repository now compiles without a cast.
+- **A boot check on the user repository**: `InvalidAuthConfigException` naming
+  the method, when `oauth.google` or `oauth.facebook` is set without
+  `findByOAuthProvider`, or `smsServiceInstance` without `findByPhoneNumber`.
+- `AuthService.issueLoginSession`, used by the package's own passkey and
+  device-key sign-in. `SignupDisabledException`.
+
+### Changed
+
+- **`onLogin` now fires for passkey and device-key sign-in**, as it always has
+  for password, Google and Facebook. If your hook sends a "new sign-in" email,
+  people who sign in with a passkey will start to receive it. An error thrown
+  by the hook on these two paths is logged and does not fail the sign-in.
+- **No boot warning about Google or Facebook when you have not configured
+  them.** The two "OAuth not configured" warnings are now logged only when an
+  `oauth.google` or `oauth.facebook` block is present but incomplete.
+
+### Changed — breaking (types only)
+
+- **27 methods of `IUserRepository` are now optional and `@deprecated`**: the
+  package never called them. Among them `updateLastLoginAt` (record a login in
+  `onLogin` instead), `incrementFailedLoginAttempts`, `updateEmail`, every
+  per-provider `find…`, `link…` and `unlink…` method, and all of
+  `IUserRepositoryBiometric`. A repository that implements them keeps
+  compiling. **Code of yours that calls one of them through the package's
+  interface type** will now be told it may be undefined; call it on your own
+  class type instead. They will be removed from the interface at the next
+  breaking release.
+
+### Deprecated
+
+- `IUserRepositoryBiometric`, and the 27 methods above.
+
+## [0.19.0] - 2026-10-08
+
+**Guest sessions**: a session for someone who is not a user, which works only on
+routes that opt in, for the things you granted, until the dates you set.
+Additive; nothing changes for an app that does not use it. Requested by Ariadne,
+for outside translators working on one job.
+
+### ⚠ External configuration required
+
+Only to use guest sessions:
+- **Two tables for `IGuestSessionRepository`**, with no foreign key to users.
+  Schema and Prisma adapter in `examples/guest-sessions/`. Run
+  `assertGuestSessionRepositoryContract` against it on your real database.
+- **Your frontend handles `GUEST_SESSION_INVALID`** by sending the person to
+  prove their address again. It must not be treated like `UNAUTHENTICATED`:
+  there is no refresh for a guest.
+- Without `features.cookieAuth`, the client keeps the token `issue` returns and
+  sends it as `Authorization: Guest <token>`. **The token changes whenever a
+  grant is added**; store the new one.
+
+### Added
+
+- **`GuestSessionService`**: `issue({ principal, grant })` starts a session or
+  adds a grant to the one the browser holds; `revokeGrant({ kind, id })`,
+  `revoke(sessionId)` and `end(request, res)` stop them. See the README, "Guest
+  Sessions".
+- **`@AllowGuestSession(kind)`**, on a method, lets a guest with a standing
+  grant of that kind reach the handler. Guards made by `createAuthGuard` read
+  it, trying the user first; so does the new **`GuestSessionGuard`**, which
+  admits guests only. **`@CurrentGuest()`** gives the handler the guest and
+  their grants of that kind.
+- **`IGuestSessionRepository`**, `InMemoryGuestSessionRepository`, and
+  `guestSessionRepositoryInstance`, which enables the feature.
+- **`assertGuestSessionRepositoryContract`** in
+  `@ambushsoftworks/nestjs-auth-graphql/testing`.
+- **`guestSession`** options: `maxGrantsPerSession` (default 10; `1` gives one
+  grant per session) and `maxLifetimeDays` (default 30).
+- Security events `GUEST_SESSION_ISSUED`, `GUEST_SESSION_REJECTED`,
+  `GUEST_SESSION_REVOKED`, `GUEST_SESSION_ENDED` and `GUEST_GRANT_REVOKED`.
+- Error codes `GUEST_SESSION_INVALID` (401) and `GUEST_SESSION_UNAVAILABLE`
+  (503).
+
+### Changed
+
+- A guard made by `createAuthGuard` now reads `@AllowGuestSession` on the
+  handler. On a handler without it, which is every handler in an existing app,
+  nothing changes: no guest credential is read. `JwtAuthGuard` is unchanged and
+  ignores the decorator.
+
 ## [0.18.0] - 2026-10-07
 
 **Email challenges**: one-time codes that prove someone holds an email address,

package/README.md

@@ -22,6 +22,8 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
   - [Passkeys](#passkeys)
   - [Step-Up Re-authentication](#step-up-re-authentication)
   - [Email Challenges](#email-challenges)
+  - [Guest Sessions](#guest-sessions)
+  - [Accounts Created by an Operator](#accounts-created-by-an-operator)
   - [Brute Force Protection](#brute-force-protection)
   - [Password Reset](#password-reset)
   - [Password Policy](#password-policy)
@@ -44,6 +46,7 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
   - [Passkey Options (`passkey`)](#passkey-options-passkey)
   - [Step-Up Options (`stepUp`)](#step-up-options-stepup)
   - [Email Challenge Options (`emailChallenge`)](#email-challenge-options-emailchallenge)
+  - [Guest Session Options (`guestSession`)](#guest-session-options-guestsession)
   - [SendGrid Options (`sendgrid`)](#sendgrid-options-sendgrid)
   - [Twilio Options (`twilio`)](#twilio-options-twilio)
   - [Optional Instance Options](#optional-instance-options)
@@ -102,13 +105,33 @@ import { IUserRepositoryCore, CreateUserData } from '@ambushsoftworks/nestjs-aut
 
 @Injectable()
 export class UsersRepository implements IUserRepositoryCore<User> {
-  async findByEmail(email: string): Promise<User | null> { /* ... */ }
+  async findByEmail(email: string, realm?: string): Promise<User | null> { /* ... */ }
   async findById(id: string): Promise<User | null> { /* ... */ }
   async create(data: CreateUserData): Promise<User> { /* ... */ }
-  // ... implement remaining IUserRepositoryCore methods
+  async update(id: string, data: Partial<User>): Promise<User> { /* ... */ }
+  async updatePassword(id: string, passwordHash: string): Promise<User> { /* ... */ }
+  async markEmailVerified(id: string): Promise<User> { /* ... */ }
+  async delete(id: string): Promise<void> { /* ... */ }
 }
 ```
 
+Those seven are all of `IUserRepositoryCore`. What the package calls, and when:
+
+| Method | Called by |
+|---|---|
+| `findByEmail`, `findById` | Every sign-in and every authenticated request. Boot fails without them |
+| `update`, `updatePassword`, `markEmailVerified` | Account changes, password change and reset, email verification |
+| `create` | Sign-up. Never, with `features.signup: false` |
+| `delete` | Passwordless sign-up only, to undo a half-made account |
+| `findByOAuthProvider` | Google and Facebook sign-in. **Boot fails without it once `oauth.google` or `oauth.facebook` is set** |
+| `findByPhoneNumber` | Phone verification. **Boot fails without it once `smsServiceInstance` is set** |
+
+`userRepositoryInstance` accepts any repository with the first five
+(`AuthUserRepository`), so an app that only signs existing users in implements
+five methods and no stubs. The other methods on `IUserRepository` are optional
+and deprecated: the package never called them. See
+[Accounts Created by an Operator](#accounts-created-by-an-operator).
+
 ```typescript
 // refresh-token.repository.ts
 import { Injectable } from '@nestjs/common';
@@ -1625,6 +1648,234 @@ It calls `deleteExpiredChallenges`, which removes every expired challenge in
 that database. `InMemoryEmailChallengeRepository` is for tests and a single
 instance.
 
+### Guest Sessions
+
+A session for someone who is **not a user**: it works only on the routes you
+mark, for the things you granted, until the dates you set. For the outside
+translator who has proved their address with an [email challenge](#email-challenges)
+and now needs to work on one job. Since 0.19.0.
+
+```typescript
+// 1. After your own check that they hold the address (a verified email challenge):
+const issued = await this.guestSessions.issue(
+  {
+    principal: { id: translator.id, email: job.translatorEmail },      // your id for the person
+    grant: { kind: 'translation-job', id: job.id, expiresAt: job.dueAt },
+  },
+  { request: ctx.req, res: ctx.res, realm, ipAddress: extractIpAddress(ctx.req) },
+);
+
+// 2. On the routes a guest may reach, and no others:
+@Mutation(() => UploadResult)
+@UseGuards(CsrfGuard, JwtGuard)             // a guard from createAuthGuard
+@AllowGuestSession('translation-job')       // on the method
+upload(@Args('input') input: UploadInput,
+       @CurrentUser() user: User | undefined,
+       @CurrentGuest() guest: GuestPrincipal | undefined) {
+  if (guest && !guest.grants.some((g) => g.id === input.jobId)) throw new ForbiddenException();
+  // ...
+}
+
+// 3. When the job is delivered or taken back:
+await this.guestSessions.revokeGrant({ kind: 'translation-job', id: job.id }, { realm });
+```
+
+**Enable it** with `guestSessionRepositoryInstance`. There is no flag, and no
+fallback store.
+
+#### What a guest can and cannot reach
+
+| | |
+|---|---|
+| A handler with `@AllowGuestSession(kind)` | Admitted, if the session holds a standing grant of that kind |
+| Every other handler | **Refused. The guest credential is not even read** |
+| `@CurrentUser()`, `request.user` | Empty for a guest. The guest is on `request.guest` / `@CurrentGuest()` |
+| `PermissionGuard`, `TenantGuard`, `ScopeGuard` | Refuse a guest: there is no user for them to look up |
+| Token refresh | None. When a grant ends, the person proves their address again |
+| GraphQL subscriptions | Not accepted |
+
+`@AllowGuestSession` is read **from the method only**. On a class it does
+nothing, so decorating a resolver cannot open every method on it.
+
+| Guard on the route | With `@AllowGuestSession(kind)` |
+|---|---|
+| One made by `createAuthGuard([...])` | Users and guests. The user strategies run first, so a signed-in user is handled exactly as on any other route; only if none authenticates is the guest session looked at |
+| `GuestSessionGuard` | Guests only |
+| `JwtAuthGuard` | Users only: it ignores the decorator |
+
+#### What the package checks, and what is yours
+
+The package guarantees that the guest holds a standing grant of the **kind** the
+route names. **Which one is your check**, in every opted-in handler: compare
+what the request asks for with `guest.grants`. A route marked for
+`translation-job` is reachable by every guest with any translation job.
+
+Two more things are yours:
+
+- **What the response contains.** Field resolvers do not run guards by default.
+  A guest-allowed query returning `Job { client { ... } }` exposes whatever
+  those fields resolve. Return guest-shaped types from guest routes.
+- **Do not make a guest route `@Public()`.** `CsrfGuard` skips public routes,
+  and a guest cookie needs its CSRF check like any other cookie session. That
+  is why the route keeps its normal guard and adds the decorator.
+
+#### Several grants in one session
+
+A translator with two open jobs uses one browser. When `issue` is given the
+request, and that browser already holds a guest session **for the same
+`principal.id`, address and realm**, the new grant joins it. Otherwise a new
+session starts.
+
+| Behaviour | Detail |
+|---|---|
+| The token changes when a grant is added | The old one stops working, so an older copy of it never gains the new job. With cookie auth the cookie is replaced for you |
+| `guestSession.maxGrantsPerSession` (default 10) | When full, the grant that ends soonest is revoked to make room |
+| `maxGrantsPerSession: 1` | One grant per session: each new one replaces the last |
+| The same `kind` and `id` again | Replaces the earlier grant, taking the new end date |
+| Each grant has its own `expiresAt` | Never moved. At most `guestSession.maxLifetimeDays` (default 30) ahead |
+
+#### Credential and codes
+
+The credential is an opaque random token, stored only as a keyed hash. It is not
+a JWT, so nothing that verifies access tokens can accept it.
+
+- **With `features.cookieAuth`** and `res` passed to `issue`, it is set as the
+  HttpOnly cookie `guest_session` (`__Host-guest_session` with
+  `cookie.useHostPrefix`), with your cookie options, lasting until the session's
+  last grant ends. It is a different cookie from the access token, so a staff
+  member who opens a translator's link stays signed in.
+- **Otherwise** the client sends `Authorization: Guest <token>`.
+
+| Answer | When | Tell the person |
+|---|---|---|
+| The route's usual `UNAUTHENTICATED` | No credential at all | Sign in, or open your link |
+| `GUEST_SESSION_INVALID` (401) | A guest credential that cannot be used here: revoked, ended, another realm, another kind, or unknown | Prove your address again |
+| `GUEST_SESSION_UNAVAILABLE` (503) | `issue` without a repository | |
+
+`GUEST_SESSION_INVALID` is deliberately not `UNAUTHENTICATED`: clients treat
+that as "refresh and retry", which can never work for a guest. The same code is
+in the body on REST routes. The exact cause (`revoked`, `expired`,
+`realm_mismatch`, `kind_not_allowed`) is in the `GUEST_SESSION_REJECTED`
+security event.
+
+`end(request, res)` is the guest's own "I'm done": it revokes the session and
+clears the cookie. Put `CsrfGuard` on that route too.
+
+#### Implementing `IGuestSessionRepository`
+
+Two tables, no relation to your users. Reference schema and Prisma adapter:
+[`examples/guest-sessions/`](examples/guest-sessions/).
+
+```prisma
+model GuestSession {
+  id          String       @id
+  tokenHash   String       @unique           // read on every guest request
+  principalId String
+  email       String
+  realm       String?
+  revokedAt   DateTime?
+  createdAt   DateTime
+  grants      GuestGrant[]
+}
+
+model GuestGrant {
+  id        String       @id
+  sessionId String
+  kind      String
+  grantId   String
+  realm     String?
+  expiresAt DateTime
+  revokedAt DateTime?
+  createdAt DateTime
+  session   GuestSession @relation(fields: [sessionId], references: [id], onDelete: Cascade)
+
+  @@index([sessionId])
+  @@index([kind, grantId])
+  @@index([expiresAt])
+}
+```
+
+Two rules are the ones adapters get wrong, and the contract checks both:
+
+- **`rotateToken` is one conditional write** (`UPDATE … SET tokenHash = new WHERE
+  tokenHash = old AND revokedAt IS NULL`), never a read followed by a write.
+- **`realm: null` means "no realm", never "any realm".** Pass it through as
+  given; `where: { realm: undefined }` drops the condition.
+
+```typescript
+import { assertGuestSessionRepositoryContract } from '@ambushsoftworks/nestjs-auth-graphql/testing';
+
+it('meets the guest session repository contract', async () => {
+  await assertGuestSessionRepositoryContract(() => new PrismaGuestSessionRepository(prisma), {
+    realms: false,                        // if you do not use realms
+    cleanup: async ({ sessionIds, grantIds }) => {
+      await prisma.guestGrant.deleteMany({ where: { id: { in: grantIds } } });
+      await prisma.guestSession.deleteMany({ where: { id: { in: sessionIds } } });
+    },
+  });
+});
+```
+
+It calls `deleteExpired`, which removes every expired grant and every session
+without grants in that database. `InMemoryGuestSessionRepository` is for tests
+and a single instance. The store is read once per request that presents a guest
+credential on an opted-in route, and never written per request.
+
+### Accounts Created by an Operator
+
+For an app with no public registration: staff accounts made by a script or an
+admin screen. Three things make that a property of the configuration instead of
+a convention in your code. Since 0.20.0.
+
+**1. Switch sign-up off.**
+
+```typescript
+features: { signup: false }
+```
+
+Every path in the package that would create a user then refuses with
+`SIGNUP_DISABLED` (403), before it reaches `create`: password sign-up,
+passwordless sign-up (no code is emailed), and a first sign-in with Google or
+Facebook. Signing in to an existing account, by any method, is unaffected. The
+answer is the same for every address.
+
+**2. Hash passwords with the package.**
+
+```typescript
+// scripts/create-staff.ts
+const app = await NestFactory.createApplicationContext(AppModule);
+const passwordHash = await app.get(PasswordHashService).hash(password);
+await staffUsers.insert({ email, passwordHash, emailVerified: true });
+await app.close();
+```
+
+`PasswordHashService` hashes exactly as sign-up, change-password and
+reset-password do, at the module's `bcryptRounds`, because all four go through
+one function. Do not call `bcrypt` yourself: if the package's hashing ever
+changes, a hash made on the side keeps the old shape and nothing fails until a
+login does. It hashes whatever it is given; check strength first with
+`PasswordValidationService` if the operator types the password.
+
+**3. Implement only what you use.**
+
+```typescript
+@Injectable()
+export class StaffUserRepository implements AuthUserRepository<StaffUser> {
+  findByEmail(email: string) { /* ... */ }
+  findById(id: string) { /* ... */ }
+  update(id: string, data: Partial<StaffUser>) { /* ... */ }
+  updatePassword(id: string, passwordHash: string) { /* ... */ }
+  markEmailVerified(id: string) { /* ... */ }
+}
+```
+
+No `create`, and no OAuth, biometric or phone methods. If you later configure a
+feature that needs one, the module refuses to boot and names the method.
+
+To record when someone last signed in, use the `onLogin` hook. It fires for
+every sign-in the package verifies: password, Google, Facebook, passkey and
+device key.
+
 ### Brute Force Protection
 
 Provide a `bruteForceRepositoryInstance` and the module tracks failed login attempts and temporarily locks accounts. Without one, `NoOpBruteForceRepository` is used and no account is ever locked; there is no flag to set. The lockout policy (attempt thresholds, lockout duration) is determined by your `IBruteForceRepository` implementation.
@@ -1861,7 +2112,7 @@ React to auth events without modifying core logic:
 ```typescript
 lifecycleHooksInstance: {
   async onSignup(user) { /* create default settings, send analytics */ },
-  async onLogin(user) { /* update metrics */ },
+  async onLogin(user) { /* record lastLoginAt, update metrics */ },
   async onLogout(user) { /* cleanup */ },
   async onEmailVerified(user) { /* unlock features */ },
   async onPhoneVerified(user) { /* enable 2FA */ },
@@ -1880,6 +2131,8 @@ lifecycleHooksInstance: {
 
 All hooks are optional. Async hooks are awaited but failures are logged and do not block the auth operation; the passkey hooks are not awaited. The package sends the passkey notification emails itself (see [Notification emails](#notification-emails)); don't send them again from these hooks. `onAuthFailure` and `onAccountLocked` are synchronous (fire-and-forget) — both are security signals and the underlying state (lock recorded, attempt logged) is already persisted by the time the hook fires, so hook failures must not roll it back.
 
+`onLogin` fires for every sign-in the package verifies: password, Google, Facebook, and since 0.20.0 passkey and device-key sign-in too. It is the place to record `lastLoginAt`; `IUserRepository.updateLastLoginAt` was never called and is deprecated. It does not fire for a token refresh, for sign-up (`onSignup` does), or for a session you issue yourself through `AuthService.issueAuthSession`.
+
 `onAccountLocked` fires from `BruteForceProtectionService.recordFailedAttempt` on the transition from "not locked" → "locked". Subsequent failed attempts while the account remains locked do **not** re-fire (use `onAuthFailure` for per-attempt signal). Wire it to send the account-locked email yourself — the package no longer ships a `sendAccountLockedEmail` method on `IEmailService`; notification surface area beyond verification, password-reset, and password-changed is consumer-owned via this hook.
 
 ### Account Status
@@ -2006,6 +2259,7 @@ These sit beside `useFactory`, not in the object it returns.
 | `cookieAuth` | `false` | Token delivery via HttpOnly cookies |
 | `preventEnumerationOnSignup` | `false` | Return synthetic success for duplicate emails |
 | `verificationMode` | `'code'` | `'code'` for 6-digit codes, `'token'` for URL tokens |
+| `signup` | `true` | `false` refuses every path that would create an account, with `SIGNUP_DISABLED`. See [Accounts Created by an Operator](#accounts-created-by-an-operator) |
 
 Capabilities are not switched on by flags. They follow from what you configure:
 
@@ -2013,7 +2267,7 @@ Capabilities are not switched on by flags. They follow from what you configure:
 |------------|------------|
 | Email verification | `email` or `emailServiceInstance` to deliver, `verificationRepositoryInstance` to store codes |
 | SMS verification | `smsServiceInstance`, plus `verificationRepositoryInstance` |
-| Google / Facebook sign-in | `oauth.google` / `oauth.facebook`, plus `encryptionKey` |
+| Google / Facebook sign-in | `oauth.google` / `oauth.facebook`, plus `encryptionKey`. With no block for a provider, nothing is logged about it; a block that is present but incomplete is a boot warning |
 | Biometric authentication | `biometricRepositoryInstance` |
 | Account lockout | `bruteForceRepositoryInstance` |
 | Multi-tenancy | `tenantRepositoryInstance` and `tenantExtractorInstance`, with `TenantGuard` in your guard chain |
@@ -2142,6 +2396,15 @@ Read only with `emailChallengeRepositoryInstance`. See [Email Challenges](#email
 | `issueLimits.perHour` | `number` | `5` | Codes an hour for one address and purpose. At least 1 |
 | `issueLimits.perIpPerHour` | `number` | `30` | Codes an hour from one IP, across addresses. `0` turns it off |
 
+### Guest Session Options (`guestSession`)
+
+Read only with `guestSessionRepositoryInstance`. See [Guest Sessions](#guest-sessions).
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `maxGrantsPerSession` | `number` | `10` | Standing grants one session may hold, 1 to 100. `1` gives one grant per session |
+| `maxLifetimeDays` | `number` | `30` | The furthest ahead a grant's `expiresAt` may be, 1 to 365 |
+
 ### Optional Instance Options
 
 | Option | Interface | Fallback |
@@ -2154,6 +2417,7 @@ Read only with `emailChallengeRepositoryInstance`. See [Email Challenges](#email
 | `biometricRepositoryInstance` | `IBiometricRepository` | none: biometrics disabled |
 | `passkeyRepositoryInstance` | `IPasskeyRepository` | none: passkeys disabled |
 | `emailChallengeRepositoryInstance` | `IEmailChallengeRepository` | none: email challenges unavailable |
+| `guestSessionRepositoryInstance` | `IGuestSessionRepository` | none: guest sessions disabled |
 | `authLoggerInstance` | `IAuthLogger` | `ConsoleAuthLogger` |
 | `tenantRepositoryInstance` | `ITenantRepository` | `null` |
 | `tenantExtractorInstance` | `ITenantExtractor` | `null` |
@@ -2176,6 +2440,8 @@ Read only with `emailChallengeRepositoryInstance`. See [Email Challenges](#email
 | `@RequirePermissions('p1', 'p2')` | Method/Class | Require specific permissions |
 | `@RequireScopes('s1', 's2')` | Method/Class | Require API key scopes, enforced by `ScopeGuard`. People are unaffected. See [API Key Authentication](#api-key-authentication) |
 | `@CurrentUser()` | Parameter | Inject authenticated user |
+| `@AllowGuestSession('kind')` | **Method only** | Let a guest session with a standing grant of that kind reach the handler. See [Guest Sessions](#guest-sessions) |
+| `@CurrentGuest()` | Parameter | Inject the admitted guest, or `undefined` for a user |
 | `@CurrentTenant()` | Parameter | Inject resolved tenant context |
 | `@CurrentRealm()` | Parameter | Inject resolved realm from request context |
 | `@ResourceScope('resourceType', 'argName')` | Method | Resource-level permission scoping |
@@ -2184,7 +2450,8 @@ Read only with `emailChallengeRepositoryInstance`. See [Email Challenges](#email
 
 | Guard | Description |
 |-------|-------------|
-| `createAuthGuard(strategies, options)` | Factory for multi-strategy auth guards |
+| `createAuthGuard(strategies, options)` | Factory for multi-strategy auth guards. Also admits guests on handlers marked `@AllowGuestSession()`, after trying the user strategies |
+| `GuestSessionGuard` | Guests only, on handlers marked `@AllowGuestSession()` |
 | `CsrfGuard` | CSRF header validation for cookie auth |
 | `TenantGuard` | Multi-tenant context resolution |
 | `PermissionGuard` | Permission checking against tenant context |
@@ -2282,6 +2549,7 @@ export class CustomGuard implements CanActivate {
 - **`__Host-` cookie prefix** support for enhanced cookie security
 - **Separate HMAC secrets** for refresh tokens, verification codes, and OAuth state
 - **Realm-based identity isolation** with JWT realm claim validation, realm-scoped rate limiting and lockout, and auth flows that refuse a request without a realm
+- **Guest sessions for non-users** -- an opaque token stored as a keyed hash, never a JWT, kept off `request.user`, refused by every route that has not opted in by name, with a hard end per grant, revocation effective on the next request, and the token replaced whenever a grant is added (see [Guest Sessions](#guest-sessions))
 - **Email challenges for non-users** -- one-time codes whose address, purpose and code are stored only as keyed hashes, bound to the address, purpose and realm they were issued for, with attempts and single use enforced by atomic writes in your store (see [Email Challenges](#email-challenges))
 - **Pinned JWT algorithms** -- the package's own `jwt` strategy verifies `HS256` only, and `createExternalJwtStrategy` requires an explicit `algorithms` list from one family (see [External JWTs](#external-jwts))
 - **API keys with scopes and expiry**, refused hard when they carry your prefix and match no key, so no other strategy accepts them

package/dist/auth.module.d.ts

@@ -1,6 +1,6 @@
 import { DynamicModule, MiddlewareConsumer, NestModule } from '@nestjs/common';
 import { ModuleMetadata } from '@nestjs/common/interfaces';
-import { IUserRepository } from './interfaces/user-repository.interface';
+import { AuthUserRepository } from './interfaces/user-repository.interface';
 import { IAuthUser } from './interfaces/auth-user.interface';
 import { IEmailService } from './interfaces/email-service.interface';
 import { ISmsService } from './interfaces/sms-service.interface';
@@ -11,6 +11,7 @@ import { IBruteForceRepository } from './interfaces/brute-force-repository.inter
 import { IBiometricRepository } from './interfaces/biometric-repository.interface';
 import { IPasskeyRepository } from './interfaces/passkey-repository.interface';
 import { IEmailChallengeRepository } from './interfaces/email-challenge-repository.interface';
+import { IGuestSessionRepository } from './interfaces/guest-session-repository.interface';
 import { PasskeyRelyingPartyConfig } from './utils/passkey-rp';
 import { IAuthLogger } from './interfaces/auth-logger.interface';
 import { ITenantRepository } from './interfaces/tenant-repository.interface';
@@ -27,7 +28,7 @@ import { IEmailSender } from './interfaces/email-sender.interface';
 import { IEmailTemplateRenderer } from './interfaces/email-template-renderer.interface';
 import { EmailBrandingConfig } from './interfaces/email-branding-config.interface';
 export interface AuthModuleOptions {
-    userRepositoryInstance: IUserRepository;
+    userRepositoryInstance: AuthUserRepository;
     refreshTokenRepositoryInstance: IRefreshTokenRepository;
     emailServiceInstance?: IEmailService;
     smsServiceInstance?: ISmsService;
@@ -37,6 +38,7 @@ export interface AuthModuleOptions {
     biometricRepositoryInstance?: IBiometricRepository;
     passkeyRepositoryInstance?: IPasskeyRepository;
     emailChallengeRepositoryInstance?: IEmailChallengeRepository;
+    guestSessionRepositoryInstance?: IGuestSessionRepository;
     authLoggerInstance?: IAuthLogger;
     refreshTokenSecret?: string;
     verificationCodeSecret?: string;
@@ -73,6 +75,7 @@ export interface AuthModuleOptions {
         preventEnumerationOnSignup?: boolean;
         cookieAuth?: boolean;
         verificationMode?: 'code' | 'token';
+        signup?: boolean;
     };
     cookie?: {
         httpOnly?: boolean;
@@ -158,6 +161,10 @@ export interface AuthModuleOptions {
             perIpPerHour?: number;
         };
     };
+    guestSession?: {
+        maxGrantsPerSession?: number;
+        maxLifetimeDays?: number;
+    };
     stepUp?: {
         ttlSeconds?: number;
         issueOnLogin?: boolean;
@@ -178,6 +185,7 @@ export declare function validateAuthModuleOptions(opts: AuthModuleOptions): void
 export declare function describeIgnoredFeatureFlags(opts: AuthModuleOptions): string[];
 export declare function describeIgnoredOptions(opts: AuthModuleOptions): string[];
 export declare function describeInMemoryDefaults(opts: AuthModuleOptions): string[];
+export declare function validateUserRepositoryMethods(opts: AuthModuleOptions): void;
 export { AUTH_MODULE_OPTIONS, USER_REPOSITORY, REFRESH_TOKEN_REPOSITORY, EMAIL_SERVICE, SMS_SERVICE, AUTH_LIFECYCLE_HOOKS, VERIFICATION_REPOSITORY, BRUTE_FORCE_REPOSITORY, BIOMETRIC_REPOSITORY, AUTH_LOGGER, RATE_LIMITER, TENANT_REPOSITORY, TENANT_EXTRACTOR, RESOURCE_PERMISSION_REPOSITORY, JWT_PAYLOAD_FACTORY, API_KEY_REPOSITORY, } from './constants';
 export declare class AuthModule implements NestModule {
     configure(consumer: MiddlewareConsumer): void;

package/dist/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAkC3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAuB,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAWjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAmC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAKxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAOnD,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAQ/C,gCAAgC,CAAC,EAAE,yBAAyB,CAAC;IAQ7D,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAS7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAa3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAKzC,KAAK,CAAC,EAAE;QA4BN,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC;KAChE,CAAC;IAQF,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAK7C,MAAM,CAAC,EAAE;QAMP,UAAU,CAAC,EAAE,MAAM,CAAC;QAOpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAmBF,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAyBxC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAO5C,YAAY,CAAC,EAAE,MAAM,CAAC;IAmBtB,QAAQ,CAAC,EAAE;QAOT,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAc5B,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;KAC/B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAWnC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAenC,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAuB/C,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAUF,SAAS,CAAC,EAAE;QAUV,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;QAGjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAShC,kBAAkB,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;KAChE,CAAC;IAMF,OAAO,CAAC,EAAE;QAMR,EAAE,EAAE,yBAAyB,CAAC;QAa9B,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;QAG5D,0BAA0B,CAAC,EAAE,MAAM,CAAC;QAGpC,4BAA4B,CAAC,EAAE,MAAM,CAAC;QAOtC,SAAS,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QAGtD,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,MAAM,CAAC;QAa9C,kBAAkB,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC7D,CAAC;IAOF,cAAc,CAAC,EAAE;QAEf,UAAU,CAAC,EAAE,MAAM,CAAC;QAOpB,WAAW,CAAC,EAAE;YAEZ,eAAe,CAAC,EAAE,MAAM,CAAC;YAEzB,OAAO,CAAC,EAAE,MAAM,CAAC;YAEjB,YAAY,CAAC,EAAE,MAAM,CAAC;SACvB,CAAC;KACH,CAAC;IAOF,MAAM,CAAC,EAAE;QAEP,UAAU,CAAC,EAAE,MAAM,CAAC;QAYpB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAe/B,OAAO,CAAC,EAAE,MAAM,GAAG,2BAA2B,CAAC;KAChD,CAAC;CACH;AASD,MAAM,MAAM,2BAA2B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;AAKrE,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IAef,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAgCD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CA6CvE;AA2ED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB7E;AASD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAyCxE;AAWD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB1E;AAsZD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAuCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CA6cpE"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAoC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAC9F,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAuB,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAWjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAoC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAKxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAOhC,sBAAsB,EAAE,kBAAkB,CAAC;IAO3C,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAOnD,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAQ/C,gCAAgC,CAAC,EAAE,yBAAyB,CAAC;IAQ7D,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAQzD,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAS7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAa3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAKzC,KAAK,CAAC,EAAE;QA4BN,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC;KAChE,CAAC;IAQF,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAK7C,MAAM,CAAC,EAAE;QAMP,UAAU,CAAC,EAAE,MAAM,CAAC;QAOpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAmBF,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAyBxC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAO5C,YAAY,CAAC,EAAE,MAAM,CAAC;IAmBtB,QAAQ,CAAC,EAAE;QAOT,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAcpC,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAc5B,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;KAC/B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAWnC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAenC,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAuB/C,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAUF,SAAS,CAAC,EAAE;QAUV,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;QAGjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAShC,kBAAkB,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;KAChE,CAAC;IAMF,OAAO,CAAC,EAAE;QAMR,EAAE,EAAE,yBAAyB,CAAC;QAa9B,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;QAG5D,0BAA0B,CAAC,EAAE,MAAM,CAAC;QAGpC,4BAA4B,CAAC,EAAE,MAAM,CAAC;QAOtC,SAAS,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QAGtD,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,MAAM,CAAC;QAa9C,kBAAkB,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC7D,CAAC;IAOF,cAAc,CAAC,EAAE;QAEf,UAAU,CAAC,EAAE,MAAM,CAAC;QAOpB,WAAW,CAAC,EAAE;YAEZ,eAAe,CAAC,EAAE,MAAM,CAAC;YAEzB,OAAO,CAAC,EAAE,MAAM,CAAC;YAEjB,YAAY,CAAC,EAAE,MAAM,CAAC;SACvB,CAAC;KACH,CAAC;IAOF,YAAY,CAAC,EAAE;QAMb,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAM7B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IAOF,MAAM,CAAC,EAAE;QAEP,UAAU,CAAC,EAAE,MAAM,CAAC;QAYpB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAe/B,OAAO,CAAC,EAAE,MAAM,GAAG,2BAA2B,CAAC;KAChD,CAAC;CACH;AASD,MAAM,MAAM,2BAA2B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;AAKrE,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IAef,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAgCD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CA8CvE;AA2ED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB7E;AASD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAiDxE;AAWD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB1E;AAsYD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAgC3E;AA4DD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAuCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CAsepE"}