@astram/guard 0.1.1 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (183) hide show
  1. package/dist/auth/account.controller.d.ts +245 -0
  2. package/dist/auth/account.controller.d.ts.map +1 -0
  3. package/dist/auth/account.controller.js +673 -0
  4. package/dist/auth/account.controller.js.map +1 -0
  5. package/dist/auth/auth.controller.d.ts +316 -0
  6. package/dist/auth/auth.controller.d.ts.map +1 -0
  7. package/dist/auth/auth.controller.js +1091 -0
  8. package/dist/auth/auth.controller.js.map +1 -0
  9. package/dist/auth/auth.module.d.ts +202 -0
  10. package/dist/auth/auth.module.d.ts.map +1 -0
  11. package/dist/auth/auth.module.js +610 -0
  12. package/dist/auth/auth.module.js.map +1 -0
  13. package/dist/auth/connections.d.ts +61 -0
  14. package/dist/auth/connections.d.ts.map +1 -0
  15. package/dist/auth/connections.js +116 -0
  16. package/dist/auth/connections.js.map +1 -0
  17. package/dist/auth/dto.d.ts +154 -0
  18. package/dist/auth/dto.d.ts.map +1 -0
  19. package/dist/auth/dto.js +29 -0
  20. package/dist/auth/dto.js.map +1 -0
  21. package/dist/auth/pending-mfa-store.d.ts +72 -0
  22. package/dist/auth/pending-mfa-store.d.ts.map +1 -0
  23. package/dist/auth/pending-mfa-store.js +106 -0
  24. package/dist/auth/pending-mfa-store.js.map +1 -0
  25. package/dist/auth/persistence.module.d.ts +42 -0
  26. package/dist/auth/persistence.module.d.ts.map +1 -0
  27. package/dist/auth/persistence.module.js +94 -0
  28. package/dist/auth/persistence.module.js.map +1 -0
  29. package/dist/auth/ports/audit-sink.d.ts +47 -0
  30. package/dist/auth/ports/audit-sink.d.ts.map +1 -0
  31. package/dist/auth/ports/audit-sink.js +20 -0
  32. package/dist/auth/ports/audit-sink.js.map +1 -0
  33. package/dist/auth/ports/credential-writer.d.ts +23 -0
  34. package/dist/auth/ports/credential-writer.d.ts.map +1 -0
  35. package/dist/auth/ports/credential-writer.js +2 -0
  36. package/dist/auth/ports/credential-writer.js.map +1 -0
  37. package/dist/auth/ports/email-sender.d.ts +14 -0
  38. package/dist/auth/ports/email-sender.d.ts.map +1 -0
  39. package/dist/auth/ports/email-sender.js +2 -0
  40. package/dist/auth/ports/email-sender.js.map +1 -0
  41. package/dist/auth/ports/mfa-device-store.d.ts +45 -0
  42. package/dist/auth/ports/mfa-device-store.d.ts.map +1 -0
  43. package/dist/auth/ports/mfa-device-store.js +13 -0
  44. package/dist/auth/ports/mfa-device-store.js.map +1 -0
  45. package/dist/auth/ports/profile-writer.d.ts +12 -0
  46. package/dist/auth/ports/profile-writer.d.ts.map +1 -0
  47. package/dist/auth/ports/profile-writer.js +2 -0
  48. package/dist/auth/ports/profile-writer.js.map +1 -0
  49. package/dist/auth/ports/recovery-code-store.d.ts +10 -0
  50. package/dist/auth/ports/recovery-code-store.d.ts.map +1 -0
  51. package/dist/auth/ports/recovery-code-store.js +2 -0
  52. package/dist/auth/ports/recovery-code-store.js.map +1 -0
  53. package/dist/auth/ports/reset-token-store.d.ts +12 -0
  54. package/dist/auth/ports/reset-token-store.d.ts.map +1 -0
  55. package/dist/auth/ports/reset-token-store.js +2 -0
  56. package/dist/auth/ports/reset-token-store.js.map +1 -0
  57. package/dist/auth/ports/session-facts-projector.d.ts +44 -0
  58. package/dist/auth/ports/session-facts-projector.d.ts.map +1 -0
  59. package/dist/auth/ports/session-facts-projector.js +30 -0
  60. package/dist/auth/ports/session-facts-projector.js.map +1 -0
  61. package/dist/auth/ports/session-sweeper.d.ts +12 -0
  62. package/dist/auth/ports/session-sweeper.d.ts.map +1 -0
  63. package/dist/auth/ports/session-sweeper.js +2 -0
  64. package/dist/auth/ports/session-sweeper.js.map +1 -0
  65. package/dist/auth/profile-resolver.d.ts +73 -0
  66. package/dist/auth/profile-resolver.d.ts.map +1 -0
  67. package/dist/auth/profile-resolver.js +28 -0
  68. package/dist/auth/profile-resolver.js.map +1 -0
  69. package/dist/auth/rate-limit/attempt-limiter.d.ts +91 -0
  70. package/dist/auth/rate-limit/attempt-limiter.d.ts.map +1 -0
  71. package/dist/auth/rate-limit/attempt-limiter.js +133 -0
  72. package/dist/auth/rate-limit/attempt-limiter.js.map +1 -0
  73. package/dist/auth/tokens.d.ts +236 -0
  74. package/dist/auth/tokens.d.ts.map +1 -0
  75. package/dist/auth/tokens.js +254 -0
  76. package/dist/auth/tokens.js.map +1 -0
  77. package/dist/auth/totp-enrollment.d.ts +42 -0
  78. package/dist/auth/totp-enrollment.d.ts.map +1 -0
  79. package/dist/auth/totp-enrollment.js +96 -0
  80. package/dist/auth/totp-enrollment.js.map +1 -0
  81. package/dist/authentication/argon2id-password-hasher.js.map +1 -0
  82. package/dist/authentication/mariadb-credential-resolver.d.ts +110 -0
  83. package/dist/authentication/mariadb-credential-resolver.d.ts.map +1 -0
  84. package/dist/authentication/mariadb-credential-resolver.js +170 -0
  85. package/dist/authentication/mariadb-credential-resolver.js.map +1 -0
  86. package/dist/authz/cross-tenant-grant-writer.d.ts +259 -0
  87. package/dist/authz/cross-tenant-grant-writer.d.ts.map +1 -0
  88. package/dist/authz/cross-tenant-grant-writer.js +397 -0
  89. package/dist/authz/cross-tenant-grant-writer.js.map +1 -0
  90. package/dist/authz/manifest-operation-authority-adapter.d.ts +65 -0
  91. package/dist/authz/manifest-operation-authority-adapter.d.ts.map +1 -0
  92. package/dist/authz/manifest-operation-authority-adapter.js +108 -0
  93. package/dist/authz/manifest-operation-authority-adapter.js.map +1 -0
  94. package/dist/authz/mariadb-cross-tenant-grant-adapter.d.ts +90 -0
  95. package/dist/authz/mariadb-cross-tenant-grant-adapter.d.ts.map +1 -0
  96. package/dist/authz/mariadb-cross-tenant-grant-adapter.js +211 -0
  97. package/dist/authz/mariadb-cross-tenant-grant-adapter.js.map +1 -0
  98. package/dist/authz/mariadb-record-rule-adapter.d.ts +60 -0
  99. package/dist/authz/mariadb-record-rule-adapter.d.ts.map +1 -0
  100. package/dist/authz/mariadb-record-rule-adapter.js +154 -0
  101. package/dist/authz/mariadb-record-rule-adapter.js.map +1 -0
  102. package/dist/authz/mariadb-record-share-adapter.d.ts +75 -0
  103. package/dist/authz/mariadb-record-share-adapter.d.ts.map +1 -0
  104. package/dist/authz/mariadb-record-share-adapter.js +106 -0
  105. package/dist/authz/mariadb-record-share-adapter.js.map +1 -0
  106. package/dist/authz/record-share-cascade.d.ts +52 -0
  107. package/dist/authz/record-share-cascade.d.ts.map +1 -0
  108. package/dist/authz/record-share-cascade.js +49 -0
  109. package/dist/authz/record-share-cascade.js.map +1 -0
  110. package/dist/authz/record-share-writer.d.ts +175 -0
  111. package/dist/authz/record-share-writer.d.ts.map +1 -0
  112. package/dist/authz/record-share-writer.js +225 -0
  113. package/dist/authz/record-share-writer.js.map +1 -0
  114. package/dist/authz/wire-record-authorization.d.ts +66 -0
  115. package/dist/authz/wire-record-authorization.d.ts.map +1 -0
  116. package/dist/authz/wire-record-authorization.js +34 -0
  117. package/dist/authz/wire-record-authorization.js.map +1 -0
  118. package/dist/boot/boot-sequence.js.map +1 -0
  119. package/dist/boot/boot.module.js.map +1 -0
  120. package/dist/completeness/catalog-reconciler.d.ts +21 -0
  121. package/dist/completeness/catalog-reconciler.d.ts.map +1 -0
  122. package/dist/completeness/catalog-reconciler.js +74 -0
  123. package/dist/completeness/catalog-reconciler.js.map +1 -0
  124. package/dist/completeness/operation-inventory-scanner.d.ts +17 -0
  125. package/dist/completeness/operation-inventory-scanner.d.ts.map +1 -0
  126. package/dist/completeness/operation-inventory-scanner.js +79 -0
  127. package/dist/completeness/operation-inventory-scanner.js.map +1 -0
  128. package/dist/completeness/ports/catalog-store.d.ts +33 -0
  129. package/dist/completeness/ports/catalog-store.d.ts.map +1 -0
  130. package/dist/completeness/ports/catalog-store.js +2 -0
  131. package/dist/completeness/ports/catalog-store.js.map +1 -0
  132. package/dist/config/app-config.d.ts +134 -1
  133. package/dist/config/app-config.d.ts.map +1 -1
  134. package/dist/config/app-config.js +144 -2
  135. package/dist/config/app-config.js.map +1 -0
  136. package/dist/config/config.module.js.map +1 -0
  137. package/dist/enforcement/classification.decorator.d.ts +33 -14
  138. package/dist/enforcement/classification.decorator.d.ts.map +1 -1
  139. package/dist/enforcement/classification.decorator.js +34 -14
  140. package/dist/enforcement/classification.decorator.js.map +1 -0
  141. package/dist/enforcement/core-seam.js.map +1 -0
  142. package/dist/enforcement/enforcement.module.js.map +1 -0
  143. package/dist/enforcement/global-enforcement.guard.d.ts +29 -19
  144. package/dist/enforcement/global-enforcement.guard.d.ts.map +1 -1
  145. package/dist/enforcement/global-enforcement.guard.js +108 -25
  146. package/dist/enforcement/global-enforcement.guard.js.map +1 -0
  147. package/dist/enforcement/reenroll-allowlist.d.ts +49 -0
  148. package/dist/enforcement/reenroll-allowlist.d.ts.map +1 -0
  149. package/dist/enforcement/reenroll-allowlist.js +77 -0
  150. package/dist/enforcement/reenroll-allowlist.js.map +1 -0
  151. package/dist/index.d.ts +43 -3
  152. package/dist/index.d.ts.map +1 -1
  153. package/dist/index.js +198 -1
  154. package/dist/index.js.map +1 -0
  155. package/dist/module/shield-tokens.d.ts +15 -0
  156. package/dist/module/shield-tokens.d.ts.map +1 -0
  157. package/dist/module/shield-tokens.js +17 -0
  158. package/dist/module/shield-tokens.js.map +1 -0
  159. package/dist/module/shield.module.d.ts +203 -8
  160. package/dist/module/shield.module.d.ts.map +1 -1
  161. package/dist/module/shield.module.js +232 -14
  162. package/dist/module/shield.module.js.map +1 -0
  163. package/dist/request-auth/request-principal.d.ts +42 -0
  164. package/dist/request-auth/request-principal.d.ts.map +1 -0
  165. package/dist/request-auth/request-principal.js +87 -0
  166. package/dist/request-auth/request-principal.js.map +1 -0
  167. package/dist/request-auth/session-facts-als.d.ts +65 -0
  168. package/dist/request-auth/session-facts-als.d.ts.map +1 -0
  169. package/dist/request-auth/session-facts-als.js +57 -0
  170. package/dist/request-auth/session-facts-als.js.map +1 -0
  171. package/dist/request-auth/session-token-binder.d.ts +130 -0
  172. package/dist/request-auth/session-token-binder.d.ts.map +1 -0
  173. package/dist/request-auth/session-token-binder.js +277 -0
  174. package/dist/request-auth/session-token-binder.js.map +1 -0
  175. package/dist/request-auth/tokens.d.ts +14 -0
  176. package/dist/request-auth/tokens.d.ts.map +1 -0
  177. package/dist/request-auth/tokens.js +16 -0
  178. package/dist/request-auth/tokens.js.map +1 -0
  179. package/dist/session/crypto-adapters.js.map +1 -0
  180. package/dist/session/index.js.map +1 -0
  181. package/dist/session/mariadb-session-record-store.js.map +1 -0
  182. package/dist/session/redis-hot-session-store.js.map +1 -0
  183. package/package.json +2 -2
@@ -0,0 +1 @@
1
+ {"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;;;;;;;;;;;;;;;AAEH,2CAWwB;AACxB,6CAAsD;AAYtD,2CAA0C;AAC1C,4FAAoE;AACpE,2CAkBqB;AAGrB,iEAAyD;AACzD,yDAAwE;AAExE,+EAA+E;AAC/E,2CAAsD;AAmBtD;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,qBAA8B,EAAE,CAAC,CAAC;AAEtF,+EAA+E;AAC/E,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,4BAAqC,EAAE,CAAC,CAAC;AAEvF,iEAAiE;AACjE,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B;;;GAGG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,qFAAqF;AACrF,SAAS,mBAAmB;IAC1B,MAAM,IAAI,sBAAa,CAAC,oBAAoB,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,8EAA8E;AAC9E,SAAS,oBAAoB;IAC3B,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,mBAAU,CAAC,mBAAmB,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe;IACtB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,mBAAU,CAAC,iBAAiB,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,GAAyB;IACjD,OAAO;QACL,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,MAAM,EAAE;YACN,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW;YACnC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY;SACtC;KACF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,4FAA4F;AAC5F,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IAGN;IAEA;IACA;IAOA;IAOA;IAOA;IAIA;IAIA;IAIA;IAIA;IAIA;IAKA;IAOA;IASA;IAIA;IAQA;IAKA;IAKA;IAOA;IASA;IAzGnB,YAEmB,aAA4B,EAE5B,gBAAkC,EAClC,UAA2B,EAO3B,WAAgC,EAOhC,eAAiC,EAOjC,kBAA8C,EAI9C,eAAwC,EAIxC,WAAgC,EAIhC,gBAA0C,EAI1C,cAAsC,EAItC,cAA+B,EAK/B,gBAAyB,EAOzB,aAAwC,EASxC,YAAoC,EAIpC,eAAuC,EAQvC,aAAqC,EAKrC,iBAAyC,EAKzC,YAAoC,EAOpC,SAA4B,EAS5B,qBAAoD;QAvGpD,kBAAa,GAAb,aAAa,CAAe;QAE5B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,eAAU,GAAV,UAAU,CAAiB;QAO3B,gBAAW,GAAX,WAAW,CAAqB;QAOhC,oBAAe,GAAf,eAAe,CAAkB;QAOjC,uBAAkB,GAAlB,kBAAkB,CAA4B;QAI9C,oBAAe,GAAf,eAAe,CAAyB;QAIxC,gBAAW,GAAX,WAAW,CAAqB;QAIhC,qBAAgB,GAAhB,gBAAgB,CAA0B;QAI1C,mBAAc,GAAd,cAAc,CAAwB;QAItC,mBAAc,GAAd,cAAc,CAAiB;QAK/B,qBAAgB,GAAhB,gBAAgB,CAAS;QAOzB,kBAAa,GAAb,aAAa,CAA2B;QASxC,iBAAY,GAAZ,YAAY,CAAwB;QAIpC,oBAAe,GAAf,eAAe,CAAwB;QAQvC,kBAAa,GAAb,aAAa,CAAwB;QAKrC,sBAAiB,GAAjB,iBAAiB,CAAwB;QAKzC,iBAAY,GAAZ,YAAY,CAAwB;QAOpC,cAAS,GAAT,SAAS,CAAmB;QAS5B,0BAAqB,GAArB,qBAAqB,CAA+B;IACpE,CAAC;IAEJ;;;;;OAKG;IACK,KAAK,CAAC,WAAW,CACvB,GAAyB,EACzB,SAAoB,EACpB,YAAY,GAAG,KAAK;QAEpB,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC5E,mFAAmF;QACnF,uFAAuF;QACvF,+EAA+E;QAC/E,oFAAoF;QACpF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CACzB,GAAG,CAAC,MAAM,CAAC,WAAW,EACtB;gBACE,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;gBAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,MAAM,EAAE,SAAS,CAAC,MAAM,KAAK,IAAI;gBACjC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;gBAChC,0EAA0E;gBAC1E,6DAA6D;gBAC7D,YAAY;gBACZ,gEAAgE;gBAChE,8EAA8E;gBAC9E,wEAAwE;gBACxE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,EACD,KAAK,CACN,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;YAC/E,qEAAqE;QACvE,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,YAAY,CAAC,SAAoB;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3E,+EAA+E;QAC/E,gFAAgF;QAChF,mCAAmC;QACnC,OAAO,KAAK,IAAI,SAAS,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,eAAe,CAC3B,WAAmB,EACnB,QAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACpE,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,mBAAmB,CAAC,MAA+B;QACzD,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC;IAED;;;;OAIG;IAIG,AAAN,KAAK,CAAC,KAAK,CAAS,IAAkB;QACpC,MAAM,YAAY,GAAG,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzE,6EAA6E;QAC7E,+EAA+E;QAC/E,gFAAgF;QAChF,iFAAiF;QACjF,qEAAqE;QACrE,MAAM,QAAQ,GAAG,SAAS,YAAY,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5E,iFAAiF;YACjF,gFAAgF;YAChF,0EAA0E;YAC1E,mFAAmF;YACnF,gDAAgD;YAChD,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,GAAyB,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CACxE,YAAY,EACZ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAC/B,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YACvC,8EAA8E;YAC9E,MAAM,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACvC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;YACtC,+EAA+E;YAC/E,8EAA8E;YAC9E,gFAAgF;YAChF,6EAA6E;YAC7E,yCAAyC;YACzC,MAAM,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACrE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC/C,CAAC;QAED,0EAA0E;QAC1E,+EAA+E;QAC/E,2BAA2B;QAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YAC9C,8EAA8E;YAC9E,oEAAoE;YACpE,oBAAoB,EAAE,CAAC;QACzB,CAAC;QACD,oFAAoF;QACpF,mFAAmF;QACnF,oFAAoF;QACpF,gFAAgF;QAChF,qFAAqF;QACrF,+EAA+E;QAC/E,kFAAkF;QAClF,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,KAAK,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;gBAC5C,IAAI,CAAC,mBAAmB,CAAC;oBACvB,MAAM,EAAE,mBAAmB;oBAC3B,YAAY;oBACZ,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;oBACpC,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,mBAAmB,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IAIG,AAAN,KAAK,CAAC,EAAE,CAA2B,aAAsB;QACvD,8EAA8E;QAC9E,kFAAkF;QAClF,iFAAiF;QACjF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,yEAAyE;YACzE,MAAM,IAAI,sBAAa,CACrB,EAAE,KAAK,EAAE,cAAc,EAAE,EACzB,mBAAU,CAAC,YAAY,CACxB,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAA,8CAAuB,EAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;QAC9E,CAAC;QAED,8EAA8E;QAC9E,iFAAiF;QACjF,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACxE,MAAM,IAAI,sBAAa,CACrB,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAChC,mBAAU,CAAC,eAAe,CAC3B,CAAC;QACJ,CAAC;QAED,IAAI,OAAkC,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;YAC9E,+DAA+D;YAC/D,MAAM,IAAI,sBAAa,CACrB,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAChC,mBAAU,CAAC,qBAAqB,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,+EAA+E;YAC/E,0DAA0D;YAC1D,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,AAAN,KAAK,CAAC,cAAc,CACV,IAA+B,EAIjC,EAAU;QAEhB,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAEhC,oFAAoF;QACpF,mFAAmF;QACnF,+EAA+E;QAC/E,kFAAkF;QAClF,iFAAiF;QACjF,oFAAoF;QACpF,qFAAqF;QACrF,mFAAmF;QACnF,+EAA+E;QAC/E,sFAAsF;QACtF,iFAAiF;QACjF,MAAM,KAAK,GAAG,aAAa,EAAE,IAAI,YAAY,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,UAAU,IAAI,EAAE,CAAC;QAEjC,kFAAkF;QAClF,mFAAmF;QACnF,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACxF,qFAAqF;QACrF,qFAAqF;QACrF,MAAM,WAAW,GACf,IAAI,CAAC,iBAAiB,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAEjG,qFAAqF;QACrF,kFAAkF;QAClF,sFAAsF;QACtF,mFAAmF;QACnF,2EAA2E;QAC3E,oFAAoF;QACpF,iFAAiF;QACjF,6EAA6E;QAC7E,oFAAoF;QACpF,gFAAgF;QAChF,sFAAsF;QACtF,oFAAoF;QACpF,qFAAqF;QACrF,mFAAmF;QACnF,oFAAoF;QACpF,8EAA8E;QAC9E,KAAK,IAAI,CAAC,aAAa;YACrB,EAAE,aAAa,CAAC,KAAK,CAAC;aACrB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;gBAC3E,IAAI,CAAC,mBAAmB,CAAC;oBACvB,MAAM,EAAE,gCAAgC;oBACxC,YAAY,EAAE,IAAI,IAAI,IAAI;oBAC1B,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;oBACpC,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnB,mFAAmF;QACnF,oFAAoF;QACpF,mFAAmF;QACnF,mFAAmF;QACnF,gFAAgF;QAChF,6EAA6E;QAC7E,iFAAiF;QACjF,6BAA6B;QAC7B,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,KAAK,IAAI,CAAC,iBAAiB;gBACzB,EAAE,aAAa,CAAC,OAAO,CAAC;iBACvB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBACd,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC;oBACnF,IAAI,CAAC,mBAAmB,CAAC;wBACvB,MAAM,EAAE,qCAAqC;wBAC7C,YAAY,EAAE,IAAI;wBAClB,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;wBACpC,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QAED,4EAA4E;QAC5E,+EAA+E;QAC/E,iFAAiF;QACjF,IAAI,SAAS,IAAI,WAAW,IAAI,IAAI,IAAI,QAAQ,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YACpE,uEAAuE;YACvE,wEAAwE;YACxE,+DAA+D;YAC/D,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACnE,+EAA+E;YACjF,CAAC,CAAC,CAAC;QACL,CAAC;QACD,sFAAsF;IACxF,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,gBAAgB,CAC5B,IAAY,EACZ,QAA4B,EAC5B,KAAsB,EACtB,MAAmB;QAEnB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,CAAC,gDAAgD;QAE/E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA8C,CAAC;QACvE,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAE5E,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;QAE5E,kFAAkF;QAClF,oFAAoF;QACpF,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI;YAAE,OAAO;QAChF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YACjD,EAAE,EAAE,WAAW;YACf,QAAQ;YACR,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,KAAK;YAAE,OAAO;QAE5B,oEAAoE;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,sCAAsC,CAAC;QAC7E,MAAM,IAAI,GAAG,GAAG,IAAI,UAAU,QAAQ,EAAE,CAAC;QACzC,MAAM,MAAM,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,OAAO,CAAC,KAAK;YACjB,OAAO,EAAE,qBAAqB;YAC9B,IAAI,EAAE,wBAAwB,IAAI,EAAE;YACpC,IAAI,EAAE,oCAAoC,IAAI,KAAK,IAAI,UAAU;SAClE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IAIG,AAAN,KAAK,CAAC,aAAa,CACT,IAA8C,EAEhD,EAAU;QAEhB,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAElF,mFAAmF;QACnF,oFAAoF;QACpF,oFAAoF;QACpF,qFAAqF;QACrF,mFAAmF;QACnF,iFAAiF;QACjF,kFAAkF;QAClF,qFAAqF;QACrF,MAAM,QAAQ,GAAG,YAAY,EAAE,IAAI,YAAY,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5E,+EAA+E;YAC/E,iFAAiF;YACjF,kFAAkF;YAClF,kFAAkF;YAClF,eAAe,EAAE,CAAC;QACpB,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,mBAAU,CAAC,oBAAoB,CAAC,CAAC;QACvF,CAAC;QACD,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7G,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,mBAAU,CAAC,eAAe,CAAC,CAAC;QAClF,CAAC;QAED,+EAA+E;QAC/E,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,iFAAiF;YACjF,mFAAmF;YACnF,mFAAmF;YACnF,qFAAqF;YACrF,mFAAmF;YACnF,qFAAqF;YACrF,4EAA4E;YAC5E,mFAAmF;YACnF,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC9D,IAAI,KAAK,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;oBAC5C,IAAI,CAAC,mBAAmB,CAAC;wBACvB,MAAM,EAAE,4BAA4B;wBACpC,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;wBACpC,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAE/C,oFAAoF;QACpF,yDAAyD;QACzD,MAAM,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEzC,kFAAkF;QAClF,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACtE,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC/D,CAAC;QACD,mFAAmF;QACnF,MAAM,KAAK,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IAIG,AAAN,KAAK,CAAC,GAAG,CAAS,IAAgB;QAChC,MAAM,cAAc,GAAG,OAAO,IAAI,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;QAE5B,8EAA8E;QAC9E,+EAA+E;QAC/E,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,OAAO,KAAK,IAAI;YAAE,mBAAmB,EAAE,CAAC;QAE5C,gFAAgF;QAChF,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,8EAA8E;QAC9E,yCAAyC;QACzC,IAAI,MAAM,KAAK,MAAM;YAAE,mBAAmB,EAAE,CAAC;QAE7C,MAAM,MAAM,GAAyB,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CACxE,OAAO,CAAC,YAAY,EACpB,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAC7D,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACvC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAED,+EAA+E;QAC/E,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YAC9C,oBAAoB,EAAE,CAAC;QACzB,CAAC;QACD,mBAAmB,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,uBAAuB,CACnC,OAAmD,EACnD,IAAY;QAEZ,yEAAyE;QACzE,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;YAClE,mBAAmB,EAAE,CAAC;QACxB,CAAC;QACD,4EAA4E;QAC5E,+EAA+E;QAC/E,yDAAyD;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/F,IAAI,QAAQ,IAAI,IAAI;YAAE,mBAAmB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAiC,CAAC;QAC1D,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,WAAW;YAAE,mBAAmB,EAAE,CAAC;QAExC,+EAA+E;QAC/E,gFAAgF;QAChF,gFAAgF;QAChF,mFAAmF;QACnF,4EAA4E;QAC5E,MAAM,WAAW,GAAG,YAAY,WAAW,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACrF,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAED,6EAA6E;QAC7E,2DAA2D;QAC3D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAClF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,6EAA6E;YAC7E,+EAA+E;YAC/E,sEAAsE;YACtE,oFAAoF;YACpF,mEAAmE;YACnE,gFAAgF;YAChF,kFAAkF;YAClF,mEAAmE;YACnE,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;gBACpE,IAAI,KAAK,KAAK,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;oBAC/C,IAAI,CAAC,mBAAmB,CAAC;wBACvB,MAAM,EAAE,0BAA0B;wBAClC,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;wBACtE,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;wBACpC,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAED,+EAA+E;QAC/E,MAAM,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAE/C,gFAAgF;QAChF,mEAAmE;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,IAAI;YAAE,mBAAmB,EAAE,CAAC;QAE9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACpD,iFAAiF;QACjF,mFAAmF;QACnF,gEAAgE;QAChE,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAE7C,gFAAgF;QAChF,qFAAqF;QACrF,iFAAiF;QACjF,mFAAmF;QACnF,mFAAmF;QACnF,0EAA0E;QAC1E,IAAI,CAAC,mBAAmB,CAAC;YACvB,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,SAAS,CAAC,EAAE;YACrB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IACK,kBAAkB,CAAC,WAAmB,EAAE,QAAgB;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3F,OAAO,CAAC,8EAA8E;QACxF,CAAC;QACD,KAAK,CAAC,KAAK,IAAmB,EAAE;YAC9B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;gBACrC,EAAE,EAAE,WAAW;gBACf,QAAQ;gBACR,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,KAAK;gBAAE,OAAO,CAAC,sDAAsD;YACnF,MAAM,MAAM,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,OAAO,CAAC,KAAK;gBACjB,OAAO,EAAE,qCAAqC;gBAC9C,IAAI,EACF,4DAA4D;oBAC5D,4EAA4E;oBAC5E,kFAAkF;gBACpF,IAAI,EACF,kEAAkE;oBAClE,oFAAoF;oBACpF,yEAAyE;oBACzE,2BAA2B;aAC9B,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACd,iEAAiE;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,mBAAmB,CAAC,MAO3B;QACC,mFAAmF;QACnF,mFAAmF;QACnF,kFAAkF;QAClF,2DAA2D;QAC3D,MAAM,UAAU,GAA4B;YAC1C,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC;QACF,KAAK,IAAI,CAAC,SAAS;YACjB,EAAE,MAAM,CAAC;YACP,IAAI,EAAE,gBAAgB;YACtB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;YAC7B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU;SACX,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,8DAA8D;QAChE,CAAC,CAAC,CAAC;QAEL,mFAAmF;QACnF,oFAAoF;QACpF,gFAAgF;QAChF,oFAAoF;QACpF,kCAAkC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,gBAAgB,CAAC,WAAmB,EAAE,QAAgB;QAC5D,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IAIG,AAAN,KAAK,CAAC,OAAO,CAAS,IAAoB;QACxC,MAAM,YAAY,GAAG,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7D,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBAC5E,mFAAmF;gBACnF,iFAAiF;gBACjF,iFAAiF;gBACjF,8EAA8E;gBAC9E,+EAA+E;gBAC/E,4EAA4E;gBAC5E,iEAAiE;gBACjE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAC3C,GAAG,CAAC,OAAO,CAAC,WAAW,EACvB,GAAG,CAAC,OAAO,CAAC,QAAQ,CACrB,CAAC;gBACF,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CACnC,GAAG,CAAC,MAAM,CAAC,WAAW,EACtB,GAAG,CAAC,OAAO,CAAC,SAAS,EACrB,KAAK,EACL,UAAU,CACX,CAAC;YACJ,CAAC;YACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,8EAA8E;YAC9E,uDAAuD;YACvD,mBAAmB,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;OAIG;IAIG,AAAN,KAAK,CAAC,MAAM,CAAS,IAAmB;QACtC,MAAM,SAAS,GAAG,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,iEAAiE;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAAC,SAAoB;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;CACF,CAAA;AA/9BY,wCAAc;AA+NnB;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACX,WAAA,IAAA,aAAI,GAAE,CAAA;;;;2CAuElB;AAwBK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACd,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;;;;wCA0CjC;AAyBK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAE7B,WAAA,IAAA,aAAI,GAAE,CAAA;IAIN,WAAA,IAAA,WAAE,GAAE,CAAA;;;;oDA8FN;AAkEK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,gBAAgB,CAAC;IACtB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAE7B,WAAA,IAAA,aAAI,GAAE,CAAA;IAEN,WAAA,IAAA,WAAE,GAAE,CAAA;;;;mDAsEN;AAqBK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,KAAK,CAAC;IACX,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACb,WAAA,IAAA,aAAI,GAAE,CAAA;;;;yCAuChB;AA6OK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACT,WAAA,IAAA,aAAI,GAAE,CAAA;;;;6CAiCpB;AAUK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAClB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;4CAanB;yBAh9BU,cAAc;IAD1B,IAAA,mBAAU,EAAC,MAAM,CAAC;IAGd,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAE5B,WAAA,IAAA,eAAM,EAAC,oCAAwB,CAAC,CAAA;IAOhC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,uCAA2B,CAAC,CAAA;IAMnC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;IAM/B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAGlC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,oCAAwB,CAAC,CAAA;IAGhC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;IAG3B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,oCAAwB,CAAC,CAAA;IAGhC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,kCAAsB,CAAC,CAAA;IAG9B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,kCAAsB,CAAC,CAAA;IAI9B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAMlC,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAQlC,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAG5B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;IAO/B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,iCAAqB,CAAC,CAAA;IAI7B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAIlC,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAM5B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,6BAAiB,CAAC,CAAA;IAQzB,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,0CAA8B,CAAC,CAAA;qDAnGV,sCAAe;GANnC,cAAc,CA+9B1B;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,MAA4B;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAClD,mBAAmB,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
@@ -0,0 +1,202 @@
1
+ /**
2
+ * `AuthModule` — the Phase 0b **composition seam** that assembles the core auth
3
+ * engines from guard's adapters + the live connections, and exposes them under
4
+ * {@link SHIELD_AUTHENTICATOR} / {@link SHIELD_SESSION_AUTHORITY} for Team C's
5
+ * `/auth/*` controllers (spec §4).
6
+ *
7
+ * ─────────────────────────────────────────────────────────────────────────────
8
+ * Team B (connection + composition) OWNS this file. It wires the frozen tokens to
9
+ * the real engines:
10
+ *
11
+ * SHIELD_PASSWORD_HASHER → new Argon2idPasswordHasher() (the flagged fix —
12
+ * the authenticator factory injects it, so THIS module must provide it).
13
+ * SHIELD_CREDENTIAL_RESOLVER → new MariaDbCredentialResolver(pool) (Team A's
14
+ * class; its `resolve()` body is Team A's — until then it throws not-implemented,
15
+ * which the engine treats as fail-closed `authentication_unavailable`).
16
+ * SHIELD_SESSION_RECORD_STORE → new MariaDbSessionRecordStore(pool).
17
+ * SHIELD_HOT_SESSION_STORE → new RedisHotSessionStore(redis).
18
+ * SHIELD_TOKEN_GENERATOR → new CryptoTokenGenerator().
19
+ * SHIELD_CLOCK → new SystemClock().
20
+ * SHIELD_REFRESH_HASHER → new Sha256RefreshTokenHasher(
21
+ * assertRefreshHmacKey(config.refreshHmacKey)) ⛔ FAIL-CLOSED gate:
22
+ * `assertRefreshHmacKey` THROWS on a blank key, so auth can NEVER compose with
23
+ * an unkeyed refresh-token hasher. This is the boot-time fail-closed point for
24
+ * the required secret (loadAppConfig deliberately does NOT throw, so a
25
+ * non-auth scaffold still boots with no `.env` — see app-config.ts).
26
+ *
27
+ * SHIELD_SESSION_AUTHORITY → createSessionAuthority({ recordStore, hotStore,
28
+ * tokenGenerator, refreshHasher, clock, lifetimes: config.lifetimes }).
29
+ * `createSessionAuthority` validates lifetime bounds eagerly (throws LOUD on a
30
+ * nonsensical config — construction-time, correct).
31
+ *
32
+ * SHIELD_AUTHENTICATOR → createAuthenticator({ hasher, resolver,
33
+ * identityBroker: createIdentityBroker(), // default Internal, empty
34
+ * factorVerifiers: [ createTotpFactorVerifier({ hmacSha1 }) ] }). The TOTP
35
+ * verifier is wired so MFA works; `hmacSha1` is the {@link hmacSha1} node:crypto
36
+ * one-liner (guard owns node:crypto, core does not). `createIdentityBroker()`
37
+ * with no args registers the default Internal adapter with an EMPTY root
38
+ * allowlist (default-deny).
39
+ * ─────────────────────────────────────────────────────────────────────────────
40
+ *
41
+ * ⛔ OPT-IN (how the integration owner gates this — for the no-`.env` boot):
42
+ * AuthModule opens live connections (via PersistenceModule) and fires the
43
+ * fail-closed `assertRefreshHmacKey` gate the moment it composes. So it MUST be
44
+ * imported ONLY when a deployment wants auth. `ShieldModule.forRoot(options)`
45
+ * should conditionally add `AuthModule.forRoot()` to its `imports` gated behind an
46
+ * option (e.g. `ShieldModule.forRoot({ auth: true })`) or an env flag:
47
+ *
48
+ * imports: [
49
+ * EnforcementModule, BootModule,
50
+ * ...(options?.auth ? [AuthModule.forRoot()] : []), // ← opt-in
51
+ * ],
52
+ * exports: [APP_CONFIG, SHIELD_DECISION_AUTHORITY,
53
+ * ...(options?.auth ? [SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY] : [])],
54
+ *
55
+ * An enforcement-only app that does NOT opt in never imports AuthModule → never
56
+ * opens a pool/redis → never calls `assertRefreshHmacKey` → keeps the no-`.env`
57
+ * boot. An auth-enabled app fails LOUD at boot if `SHIELD_REFRESH_HMAC_KEY` is
58
+ * blank — auth can never compose unkeyed. `APP_CONFIG` is already `@Global` from
59
+ * `ShieldModule`, so AuthModule's config-injecting factories resolve. See DONE.md.
60
+ *
61
+ * ADR-0003: the core factories (`createAuthenticator`/`createSessionAuthority`/
62
+ * `createIdentityBroker`/`createTotpFactorVerifier`) are pure; the adapters + the
63
+ * node:crypto HMAC live in guard. Core stays zero-dep + unchanged.
64
+ */
65
+ import { type DynamicModule } from '@nestjs/common';
66
+ import type { CredentialResolver, HmacSha1, FactorVerifier } from '@astram/core';
67
+ import type { SessionFactsProjector } from './ports/session-facts-projector.js';
68
+ import type { ProfileResolver } from './profile-resolver.js';
69
+ import type { CredentialWriter } from './ports/credential-writer.js';
70
+ import type { ResetTokenStore } from './ports/reset-token-store.js';
71
+ import type { EmailSender } from './ports/email-sender.js';
72
+ import type { RecoveryCodeStore } from './ports/recovery-code-store.js';
73
+ import type { ProfileWriter } from './ports/profile-writer.js';
74
+ import type { SessionSweeper } from './ports/session-sweeper.js';
75
+ import type { MfaDeviceStore } from './ports/mfa-device-store.js';
76
+ import type { AuditSink } from './ports/audit-sink.js';
77
+ /**
78
+ * The injected HMAC-SHA1 primitive the core TOTP verifier needs (Core is zero-dep
79
+ * + node-type-free, so it cannot import `node:crypto`). Guard owns node:crypto and
80
+ * supplies this one-liner: raw key bytes + message bytes → the 20-byte HMAC-SHA1
81
+ * digest. Never logs the key or message.
82
+ */
83
+ export declare const hmacSha1: HmacSha1;
84
+ /**
85
+ * Resolve the login `totp` {@link FactorVerifier}: the consumer's `override` when
86
+ * supplied, else the framework's `defaultVerifier`. A pure, infra-free `??` — the
87
+ * ONE decision point of the Phase-2 verifier seam (override wins; absent → the
88
+ * default RFC-6238 single-secret verify, behavior unchanged).
89
+ *
90
+ * The default is passed IN (rather than built here) because the core factory
91
+ * `createTotpFactorVerifier` is loaded LAZILY via {@link loadCore} (the CJS↔ESM
92
+ * invariant, see the file header) — only reachable inside an async provider factory.
93
+ * So the authenticator's async `useFactory` awaits {@link loadCore}, builds the
94
+ * default, and hands it here alongside the injected override.
95
+ */
96
+ export declare function resolveTotpVerifier(override: FactorVerifier | null | undefined, defaultVerifier: FactorVerifier): FactorVerifier;
97
+ /**
98
+ * Build the framework's DEFAULT single-secret TOTP {@link FactorVerifier}
99
+ * (`createTotpFactorVerifier({ hmacSha1 })`), loading the core factory lazily (the
100
+ * CJS↔ESM invariant, see the file header). Exported so a CONSUMER can obtain the
101
+ * framework's base per-secret verifier to WRAP (e.g. an OR-matching multi-device
102
+ * verifier delegates to it per device secret) WITHOUT importing `@astram/core`
103
+ * directly — which would become a runtime `require` on the ESM-only core in the
104
+ * consumer's built CJS dist. Async because of {@link loadCore}.
105
+ */
106
+ export declare function makeDefaultTotpVerifier(): Promise<FactorVerifier>;
107
+ /**
108
+ * Options for {@link AuthModule.forRoot} — registration-time collaborators the
109
+ * consumer plugs through {@link ShieldModule.forRoot}.
110
+ */
111
+ export interface AuthModuleOptions {
112
+ /**
113
+ * OPTIONAL custom credential resolver (the store login checks against). Omit →
114
+ * the framework's default {@link MariaDbCredentialResolver} (reads
115
+ * `shield_identity.identity_credential`). Supply a consumer implementation of the
116
+ * core `CredentialResolver` port to authenticate against your OWN user/identity
117
+ * schema. Only meaningful here (AuthModule is only imported under `auth: true`).
118
+ */
119
+ readonly credentialResolver?: CredentialResolver;
120
+ /**
121
+ * OPTIONAL current-user profile resolver backing `GET /auth/me` (the
122
+ * {@link ProfileResolver} port). Omit → `/auth/me` returns an honest 501 (the
123
+ * framework is org-schema-agnostic; it cannot name the user/company/roles without
124
+ * the consumer's org tables). Supply an implementation to return the signed-in
125
+ * user's display profile (names, never UUIDs). Only meaningful under `auth: true`.
126
+ */
127
+ readonly profileResolver?: ProfileResolver;
128
+ /**
129
+ * OPTIONAL account/credential-surface seams (forgot/reset, change-password, MFA
130
+ * enrollment, profile edit). Each is threaded through exactly like
131
+ * {@link profileResolver}: supplied → bound app-wide under its token; omitted →
132
+ * bound `null`, so the route that needs it returns an honest 501. Only meaningful
133
+ * under `auth: true`. See `./ports/*.ts` for each contract.
134
+ */
135
+ readonly credentialWriter?: CredentialWriter;
136
+ readonly resetTokenStore?: ResetTokenStore;
137
+ readonly emailSender?: EmailSender;
138
+ readonly recoveryCodeStore?: RecoveryCodeStore;
139
+ readonly profileWriter?: ProfileWriter;
140
+ readonly sessionSweeper?: SessionSweeper;
141
+ /**
142
+ * OPTIONAL auth-surface audit sink (the {@link AuditSink} port) — persists the
143
+ * FIRST auth audit event (the recovery-code login, spec §6.2). Threaded exactly like
144
+ * the other seams: supplied → bound app-wide under its token; omitted → bound `null`,
145
+ * so the recovery branch's best-effort audit call is a no-op (login still works,
146
+ * un-audited). Only meaningful under `auth: true`.
147
+ */
148
+ readonly auditSink?: AuditSink;
149
+ /**
150
+ * OPTIONAL multi-device MFA store (the {@link MfaDeviceStore} port) — persists the
151
+ * caller's N TOTP authenticator devices. Threaded exactly like the other seams:
152
+ * supplied → bound app-wide under its token; omitted → bound `null`, so the device
153
+ * routes return an honest 501. Only meaningful under `auth: true`.
154
+ */
155
+ readonly mfaDeviceStore?: MfaDeviceStore;
156
+ /**
157
+ * OPTIONAL login `totp` {@link FactorVerifier} override (the Phase-2 multi-device
158
+ * seam). Supplied → REPLACES the framework's default single-secret
159
+ * `createTotpFactorVerifier({ hmacSha1 })` in the composed authenticator's
160
+ * `factorVerifiers`; omitted → the default (behavior unchanged). A consumer plugs
161
+ * an OR-matching verifier here so login matches ANY enrolled device (the resolver
162
+ * bundles the N device secrets into one required-factor). Only meaningful under
163
+ * `auth: true`.
164
+ */
165
+ readonly totpVerifier?: FactorVerifier;
166
+ /**
167
+ * OPTIONAL root allowlist — the server-side, trusted set of canonical
168
+ * principal ids that ARE roots (passed to
169
+ * `createIdentityBroker({ internalRootIds })`). ROOT SAFETY: this is the
170
+ * ONLY way a login mints a root — the Internal adapter keys the trusted signal
171
+ * off THIS list, never off a claim (an attacker-controllable `isPlatformSuperuser`
172
+ * claim is ignored). Omit → `[]` → default-deny (nobody is a root, historical
173
+ * behavior unchanged). Only meaningful under `auth: true`.
174
+ */
175
+ readonly rootIds?: readonly string[];
176
+ /**
177
+ * OPTIONAL eager session-facts projector (ADR-0011, the {@link SessionFactsProjector}
178
+ * port). Threaded exactly like the other seams: supplied → bound app-wide under
179
+ * {@link SHIELD_SESSION_FACTS_PROJECTOR}; omitted → bound `null`, so the auth controller
180
+ * omits `cachedFacts` and gate 5 DB-reloads every request (today's behavior). When
181
+ * supplied, login/refresh cache the principal's coarse grants on the session binding so
182
+ * gate 5 serves them from the request's `cachedFacts`. Only meaningful under `auth: true`.
183
+ */
184
+ readonly sessionFactsProjector?: SessionFactsProjector;
185
+ }
186
+ /**
187
+ * The auth composition module. Imports {@link PersistenceModule} (the live
188
+ * connections) and provides the adapters + composed engines. Exports the two
189
+ * engines (Team C consumes them) and the resolver token. Opt-in: imported ONLY by
190
+ * an auth-enabled `ShieldModule.forRoot({ auth: true })` — see the file header +
191
+ * DONE.md for the exact gating the integration owner applies.
192
+ */
193
+ export declare class AuthModule {
194
+ /**
195
+ * Compose the auth surface. `options.credentialResolver`, when supplied, REPLACES
196
+ * the default MariaDb store with the consumer's own (a value provider under
197
+ * {@link SHIELD_CREDENTIAL_RESOLVER}); omitted → the historical default binding,
198
+ * EXACTLY unchanged (zero behavior change for existing consumers).
199
+ */
200
+ static forRoot(options?: AuthModuleOptions): DynamicModule;
201
+ }
202
+ //# sourceMappingURL=auth.module.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAa3E,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EACf,MAAM,cAAc,CAAC;AAkDtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAyUD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAgED;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CA6F/D"}