@astram/guard 0.1.1 → 0.3.0

package/dist/auth/auth.module.js

@@ -0,0 +1,610 @@
+"use strict";
+/**
+ * `AuthModule` — the Phase 0b **composition seam** that assembles the core auth
+ * engines from guard's adapters + the live connections, and exposes them under
+ * {@link SHIELD_AUTHENTICATOR} / {@link SHIELD_SESSION_AUTHORITY} for Team C's
+ * `/auth/*` controllers (spec §4).
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * Team B (connection + composition) OWNS this file. It wires the frozen tokens to
+ * the real engines:
+ *
+ *  SHIELD_PASSWORD_HASHER      →  new Argon2idPasswordHasher()  (the flagged fix —
+ *      the authenticator factory injects it, so THIS module must provide it).
+ *  SHIELD_CREDENTIAL_RESOLVER  →  new MariaDbCredentialResolver(pool)  (Team A's
+ *      class; its `resolve()` body is Team A's — until then it throws not-implemented,
+ *      which the engine treats as fail-closed `authentication_unavailable`).
+ *  SHIELD_SESSION_RECORD_STORE →  new MariaDbSessionRecordStore(pool).
+ *  SHIELD_HOT_SESSION_STORE    →  new RedisHotSessionStore(redis).
+ *  SHIELD_TOKEN_GENERATOR      →  new CryptoTokenGenerator().
+ *  SHIELD_CLOCK                →  new SystemClock().
+ *  SHIELD_REFRESH_HASHER       →  new Sha256RefreshTokenHasher(
+ *        assertRefreshHmacKey(config.refreshHmacKey))          ⛔ FAIL-CLOSED gate:
+ *      `assertRefreshHmacKey` THROWS on a blank key, so auth can NEVER compose with
+ *      an unkeyed refresh-token hasher. This is the boot-time fail-closed point for
+ *      the required secret (loadAppConfig deliberately does NOT throw, so a
+ *      non-auth scaffold still boots with no `.env` — see app-config.ts).
+ *
+ *  SHIELD_SESSION_AUTHORITY  →  createSessionAuthority({ recordStore, hotStore,
+ *        tokenGenerator, refreshHasher, clock, lifetimes: config.lifetimes }).
+ *      `createSessionAuthority` validates lifetime bounds eagerly (throws LOUD on a
+ *      nonsensical config — construction-time, correct).
+ *
+ *  SHIELD_AUTHENTICATOR  →  createAuthenticator({ hasher, resolver,
+ *        identityBroker: createIdentityBroker(),               // default Internal, empty
+ *        factorVerifiers: [ createTotpFactorVerifier({ hmacSha1 }) ] }).  The TOTP
+ *      verifier is wired so MFA works; `hmacSha1` is the {@link hmacSha1} node:crypto
+ *      one-liner (guard owns node:crypto, core does not). `createIdentityBroker()`
+ *      with no args registers the default Internal adapter with an EMPTY root
+ *      allowlist (default-deny).
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * ⛔ OPT-IN (how the integration owner gates this — for the no-`.env` boot):
+ * AuthModule opens live connections (via PersistenceModule) and fires the
+ * fail-closed `assertRefreshHmacKey` gate the moment it composes. So it MUST be
+ * imported ONLY when a deployment wants auth. `ShieldModule.forRoot(options)`
+ * should conditionally add `AuthModule.forRoot()` to its `imports` gated behind an
+ * option (e.g. `ShieldModule.forRoot({ auth: true })`) or an env flag:
+ *
+ *     imports: [
+ *       EnforcementModule, BootModule,
+ *       ...(options?.auth ? [AuthModule.forRoot()] : []),   // ← opt-in
+ *     ],
+ *     exports: [APP_CONFIG, SHIELD_DECISION_AUTHORITY,
+ *               ...(options?.auth ? [SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY] : [])],
+ *
+ * An enforcement-only app that does NOT opt in never imports AuthModule → never
+ * opens a pool/redis → never calls `assertRefreshHmacKey` → keeps the no-`.env`
+ * boot. An auth-enabled app fails LOUD at boot if `SHIELD_REFRESH_HMAC_KEY` is
+ * blank — auth can never compose unkeyed. `APP_CONFIG` is already `@Global` from
+ * `ShieldModule`, so AuthModule's config-injecting factories resolve. See DONE.md.
+ *
+ * ADR-0003: the core factories (`createAuthenticator`/`createSessionAuthority`/
+ * `createIdentityBroker`/`createTotpFactorVerifier`) are pure; the adapters + the
+ * node:crypto HMAC live in guard. Core stays zero-dep + unchanged.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var AuthModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthModule = exports.hmacSha1 = void 0;
+exports.resolveTotpVerifier = resolveTotpVerifier;
+exports.makeDefaultTotpVerifier = makeDefaultTotpVerifier;
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const app_config_js_1 = require("../config/app-config.js");
+const config_module_js_1 = require("../config/config.module.js");
+const argon2id_password_hasher_js_1 = require("../authentication/argon2id-password-hasher.js");
+const mariadb_credential_resolver_js_1 = require("../authentication/mariadb-credential-resolver.js");
+const index_js_1 = require("../session/index.js");
+const persistence_module_js_1 = require("./persistence.module.js");
+const auth_controller_js_1 = require("./auth.controller.js");
+const account_controller_js_1 = require("./account.controller.js");
+const pending_mfa_store_js_1 = require("./pending-mfa-store.js");
+const tokens_js_1 = require("./tokens.js");
+const attempt_limiter_js_1 = require("./rate-limit/attempt-limiter.js");
+const tokens_js_2 = require("../request-auth/tokens.js");
+const session_token_binder_js_1 = require("../request-auth/session-token-binder.js");
+/**
+ * The injected HMAC-SHA1 primitive the core TOTP verifier needs (Core is zero-dep
+ * + node-type-free, so it cannot import `node:crypto`). Guard owns node:crypto and
+ * supplies this one-liner: raw key bytes + message bytes → the 20-byte HMAC-SHA1
+ * digest. Never logs the key or message.
+ */
+const hmacSha1 = (key, message) => new Uint8Array((0, node_crypto_1.createHmac)('sha1', Buffer.from(key)).update(Buffer.from(message)).digest());
+exports.hmacSha1 = hmacSha1;
+/**
+ * Resolve the login `totp` {@link FactorVerifier}: the consumer's `override` when
+ * supplied, else the framework's `defaultVerifier`. A pure, infra-free `??` — the
+ * ONE decision point of the Phase-2 verifier seam (override wins; absent → the
+ * default RFC-6238 single-secret verify, behavior unchanged).
+ *
+ * The default is passed IN (rather than built here) because the core factory
+ * `createTotpFactorVerifier` is loaded LAZILY via {@link loadCore} (the CJS↔ESM
+ * invariant, see the file header) — only reachable inside an async provider factory.
+ * So the authenticator's async `useFactory` awaits {@link loadCore}, builds the
+ * default, and hands it here alongside the injected override.
+ */
+function resolveTotpVerifier(override, defaultVerifier) {
+    return override ?? defaultVerifier;
+}
+/**
+ * Build the framework's DEFAULT single-secret TOTP {@link FactorVerifier}
+ * (`createTotpFactorVerifier({ hmacSha1 })`), loading the core factory lazily (the
+ * CJS↔ESM invariant, see the file header). Exported so a CONSUMER can obtain the
+ * framework's base per-secret verifier to WRAP (e.g. an OR-matching multi-device
+ * verifier delegates to it per device secret) WITHOUT importing `@astram/core`
+ * directly — which would become a runtime `require` on the ESM-only core in the
+ * consumer's built CJS dist. Async because of {@link loadCore}.
+ */
+async function makeDefaultTotpVerifier() {
+    const { createTotpFactorVerifier } = await loadCore();
+    return createTotpFactorVerifier({ hmacSha1: exports.hmacSha1 });
+}
+/**
+ * A `Function`-wrapped dynamic `import()` that survives the CommonJS **build**.
+ * Under `module: commonjs`, `tsc` rewrites a literal `import()` into
+ * `Promise.resolve().then(() => require(...))` — which fails on the ESM-only core.
+ * Routing the import through the `Function` constructor hides it from that
+ * transform, so the emitted dist keeps a genuine native `import()` and Node's
+ * CJS→ESM interop loads core at runtime. (This path is used by the BUILT dist —
+ * e.g. example-backend. It does NOT work under vitest, whose sandbox can't resolve
+ * a specifier from an eval'd context — hence the two-strategy loadCore() below.)
+ */
+const evalImport = new Function('specifier', 'return import(specifier);');
+let cachedCore;
+/**
+ * Lazily load `@astram/core`'s four auth factory functions — invoked ONLY inside
+ * the two async provider factories (i.e. only when `forRoot()` actually composes
+ * auth), NEVER at module top-level. This keeps a runtime `require('@astram/core')`
+ * out of the guard barrel's load path (see the top-of-file note), so importing
+ * `@astram/guard`'s built dist for the enforcement-only path does not touch core.
+ *
+ * TWO strategies, so it works in BOTH runtimes:
+ *  1. A plain dynamic `import('@astram/core')` — the vitest/SWC source path keeps
+ *     this native, and vitest's resolver maps the workspace package. (In the
+ *     tsc-built CJS dist this literal is downleveled to a `require`, which throws on
+ *     the ESM core — caught below.)
+ *  2. On failure, the {@link evalImport} `Function`-wrapped native `import()` — the
+ *     BUILT dist path (Node CJS→ESM interop), which vitest can't use.
+ * Cached after the first success.
+ */
+async function loadCore() {
+    if (cachedCore !== undefined)
+        return cachedCore;
+    try {
+        // Strategy 1 — native in vitest/SWC; a `require` (that may throw) in the CJS dist.
+        cachedCore = (await Promise.resolve().then(() => __importStar(require('@astram/core'))));
+    }
+    catch {
+        // Strategy 2 — the built-dist path: a genuine `import()` via the Function shim.
+        cachedCore = (await evalImport('@astram/core'));
+    }
+    return cachedCore;
+}
+// --- Adapter-backed providers (Team A resolver + session adapters) ----------
+/** Argon2id password hasher (⛔ the flagged fix — provide it HERE so the authenticator factory's `inject` resolves). */
+const passwordHasherProvider = {
+    provide: argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER,
+    useFactory: () => new argon2id_password_hasher_js_1.Argon2idPasswordHasher(),
+};
+/**
+ * Credential resolver (the store login checks against).
+ *
+ * DEFAULT (no consumer override): a `useFactory` that constructs the framework's
+ * {@link MariaDbCredentialResolver} injected with the live {@link SHIELD_DB_POOL}
+ * — the historical binding, unchanged.
+ *
+ * OVERRIDE (Phase 1a seam): when the consumer supplies a `credentialResolver`
+ * through {@link ShieldModuleOptions.credentialResolver} → {@link AuthModule.forRoot},
+ * the token instead binds a plain **value provider** to that instance, so login
+ * authenticates against the consumer's OWN store (e.g. a richer users/roles model)
+ * WITHOUT editing the framework. The seam swaps the STORE only — the supplied
+ * resolver still flows through the SAME composed authenticator (anti-enumeration
+ * decoy verify, MFA, no-secret-leak); its `null`/throw contract is unchanged.
+ */
+function makeCredentialResolverProvider(override) {
+    return override
+        ? { provide: tokens_js_1.SHIELD_CREDENTIAL_RESOLVER, useValue: override }
+        : {
+            provide: tokens_js_1.SHIELD_CREDENTIAL_RESOLVER,
+            useFactory: (pool) => new mariadb_credential_resolver_js_1.MariaDbCredentialResolver(pool),
+            inject: [tokens_js_1.SHIELD_DB_POOL],
+        };
+}
+/** Durable session record store (MariaDB adapter, injected with the live pool). */
+const sessionRecordStoreProvider = {
+    provide: index_js_1.SHIELD_SESSION_RECORD_STORE,
+    useFactory: (pool) => new index_js_1.MariaDbSessionRecordStore(pool),
+    inject: [tokens_js_1.SHIELD_DB_POOL],
+};
+/** Hot session store (Redis adapter, injected with the live client). */
+const hotSessionStoreProvider = {
+    provide: index_js_1.SHIELD_HOT_SESSION_STORE,
+    useFactory: (redis) => new index_js_1.RedisHotSessionStore(redis),
+    inject: [tokens_js_1.SHIELD_REDIS],
+};
+/**
+ * The request-auth token binder (the flagged-gap fill): binds an opaque access token
+ * to its principal claims in Redis, so the enforcement guard can turn a later
+ * request's bearer token back into a `Principal`. Provided only under `auth: true`
+ * (it needs the live Redis client); exported so the enforcement guard injects it.
+ */
+const sessionTokenBinderProvider = {
+    provide: tokens_js_2.SHIELD_SESSION_TOKEN_BINDER,
+    useFactory: (redis) => new session_token_binder_js_1.SessionTokenBinder(redis),
+    inject: [tokens_js_1.SHIELD_REDIS],
+};
+/**
+ * The password-login rate limiter (spec §5 / H1) — a Redis-injected
+ * {@link AttemptLimiter}, 10 failures / 15-min window, keyed `login:<hint>`. Same
+ * live-Redis provider pattern as {@link sessionTokenBinderProvider} (a `useFactory`
+ * injecting {@link SHIELD_REDIS}); provided only under `auth: true`. Fail-open on a
+ * Redis outage is the limiter's own behavior (never locks out on a blip).
+ */
+const loginLimiterProvider = {
+    provide: tokens_js_1.SHIELD_LOGIN_LIMITER,
+    useFactory: (redis) => new attempt_limiter_js_1.AttemptLimiter(redis, { maxAttempts: 10, windowMs: 15 * 60 * 1000 }),
+    inject: [tokens_js_1.SHIELD_REDIS],
+};
+/**
+ * The recovery-code rate limiter (spec §5) — a Redis-injected {@link AttemptLimiter},
+ * 5 failures / 15-min window, keyed `recovery:<principalId>` (a lower ceiling than
+ * login: recovery codes don't rotate, so they're higher-value). Same live-Redis
+ * provider pattern as {@link sessionTokenBinderProvider}; provided only under
+ * `auth: true`.
+ */
+const recoveryLimiterProvider = {
+    provide: tokens_js_1.SHIELD_RECOVERY_LIMITER,
+    useFactory: (redis) => new attempt_limiter_js_1.AttemptLimiter(redis, { maxAttempts: 5, windowMs: 15 * 60 * 1000 }),
+    inject: [tokens_js_1.SHIELD_REDIS],
+};
+/**
+ * The forgot-password rate limiter (feature #141) — a Redis-injected
+ * {@link AttemptLimiter}, keyed BY CLIENT IP (`forgot:ip:<ip>`, 5 per 15-min window)
+ * AND, separately, per-hint (`forgot:<hint>`, provided as {@link forgotHintLimiterProvider}).
+ * NOTE the "attempt" semantics here differ from login: forgot-password is ALWAYS 204
+ * (returning 429 would itself be an enumeration signal), so this limiter counts every
+ * forgot REQUEST (a request-rate cap), and once the budget is exceeded the handler
+ * SILENTLY skips the email-send work while still returning 204. Same live-Redis
+ * provider pattern as {@link loginLimiterProvider}; provided only under `auth: true`.
+ * Fail-open on a Redis outage is the limiter's own behavior (never silently drops a
+ * legitimate reset email on a blip). Threshold chosen to stop IP-spray without locking
+ * out a genuine user who requests a couple of resets.
+ */
+const forgotLimiterProvider = {
+    provide: tokens_js_1.SHIELD_FORGOT_LIMITER,
+    useFactory: (redis) => new attempt_limiter_js_1.AttemptLimiter(redis, { maxAttempts: 5, windowMs: 15 * 60 * 1000 }),
+    inject: [tokens_js_1.SHIELD_REDIS],
+};
+/**
+ * The forgot-password PER-HINT rate limiter (feature #141) — a Redis-injected
+ * {@link AttemptLimiter}, keyed by the presented hint (`forgot:<hint>`, 3 per 60-min
+ * window). This caps how often ANY caller (across IPs) can trigger a reset email for
+ * ONE account, so a single victim's inbox can't be email-bombed even from a rotating
+ * IP pool. A GENEROUS per-hint ceiling (a real user rarely needs >3 reset emails/hour)
+ * with a longer window than the IP cap. Same request-rate-cap semantics as
+ * {@link forgotLimiterProvider}: on exceed, SILENTLY skip the send, still 204.
+ */
+const forgotHintLimiterProvider = {
+    provide: tokens_js_1.SHIELD_FORGOT_HINT_LIMITER,
+    useFactory: (redis) => new attempt_limiter_js_1.AttemptLimiter(redis, { maxAttempts: 3, windowMs: 60 * 60 * 1000 }),
+    inject: [tokens_js_1.SHIELD_REDIS],
+};
+/**
+ * The reset-password rate limiter (feature #141) — a Redis-injected
+ * {@link AttemptLimiter}, keyed by CLIENT IP (`reset:ip:<ip>`, 10 per 15-min window).
+ * Reset is token-gated (a 256-bit single-use token), so this is DoS/abuse throttling,
+ * NOT anti-brute-force — and unlike forgot it MAY return a generic 429 on lockout (a
+ * token-gated endpoint is not enumeration-sensitive). `recordFailure` on a bad/invalid
+ * token (the abuse signal), `reset` on a successful reset. Same live-Redis provider
+ * pattern as {@link loginLimiterProvider}; provided only under `auth: true`. Fail-open
+ * on a Redis outage (a legitimate reset is never blocked by a blip).
+ */
+const resetLimiterProvider = {
+    provide: tokens_js_1.SHIELD_RESET_LIMITER,
+    useFactory: (redis) => new attempt_limiter_js_1.AttemptLimiter(redis, { maxAttempts: 10, windowMs: 15 * 60 * 1000 }),
+    inject: [tokens_js_1.SHIELD_REDIS],
+};
+/** Opaque token generator (node:crypto adapter). */
+const tokenGeneratorProvider = {
+    provide: index_js_1.SHIELD_TOKEN_GENERATOR,
+    useFactory: () => new index_js_1.CryptoTokenGenerator(),
+};
+/**
+ * Keyed refresh hasher (HMAC adapter). ⛔ FAIL-CLOSED HMAC-key gate:
+ * `assertRefreshHmacKey` THROWS on a blank key, so auth can never compose with an
+ * unkeyed refresh-token hasher.
+ */
+const refreshHasherProvider = {
+    provide: index_js_1.SHIELD_REFRESH_HASHER,
+    useFactory: (config) => new index_js_1.Sha256RefreshTokenHasher((0, app_config_js_1.assertRefreshHmacKey)(config.refreshHmacKey)),
+    inject: [config_module_js_1.APP_CONFIG],
+};
+/** System clock. */
+const clockProvider = {
+    provide: index_js_1.SHIELD_CLOCK,
+    useFactory: () => new index_js_1.SystemClock(),
+};
+// --- Composed core engines --------------------------------------------------
+/** The composed SessionAuthority (core) — establish / rotate / revoke. */
+const sessionAuthorityProvider = {
+    provide: tokens_js_1.SHIELD_SESSION_AUTHORITY,
+    // async: loads the core factory lazily (CJS→ESM, see loadCore()); Nest awaits it.
+    useFactory: async (recordStore, hotStore, tokenGenerator, refreshHasher, clock, config) => {
+        const { createSessionAuthority } = await loadCore();
+        return createSessionAuthority({
+            recordStore,
+            hotStore,
+            tokenGenerator,
+            refreshHasher,
+            clock,
+            lifetimes: config.lifetimes,
+        });
+    },
+    inject: [
+        index_js_1.SHIELD_SESSION_RECORD_STORE,
+        index_js_1.SHIELD_HOT_SESSION_STORE,
+        index_js_1.SHIELD_TOKEN_GENERATOR,
+        index_js_1.SHIELD_REFRESH_HASHER,
+        index_js_1.SHIELD_CLOCK,
+        config_module_js_1.APP_CONFIG,
+    ],
+};
+/**
+ * The composed Authenticator (core) — password + TOTP factor, anti-enumeration.
+ *
+ * The `totp` verifier is the Phase-2 SEAM: {@link resolveTotpVerifier} picks the
+ * consumer's `totpOverride` (bound under {@link SHIELD_TOTP_VERIFIER_OVERRIDE}) when
+ * supplied, else the framework's default `createTotpFactorVerifier({ hmacSha1 })`.
+ * The override reaches this async factory via `inject` (not a captured closure) so
+ * the default binding stays exactly as before when no override is plugged.
+ */
+const authenticatorProvider = {
+    provide: tokens_js_1.SHIELD_AUTHENTICATOR,
+    // async: loads the core factories lazily (CJS→ESM, see loadCore()); Nest awaits it.
+    useFactory: async (hasher, resolver, totpOverride, rootIds) => {
+        const { createAuthenticator, createIdentityBroker, createTotpFactorVerifier } = await loadCore();
+        const totp = resolveTotpVerifier(totpOverride, createTotpFactorVerifier({ hmacSha1: exports.hmacSha1 }));
+        return createAuthenticator({
+            hasher,
+            resolver,
+            // ROOT SAFETY: the ONLY way a login mints a root is the
+            // server-side allowlist wired here (the Internal adapter keys the trusted
+            // signal off it, never off a claim). Absent → `[]` → default-deny (the
+            // historical `createIdentityBroker()` behavior, exactly unchanged).
+            identityBroker: createIdentityBroker({ internalRootIds: rootIds ?? [] }),
+            factorVerifiers: [totp],
+        });
+    },
+    inject: [
+        argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER,
+        tokens_js_1.SHIELD_CREDENTIAL_RESOLVER,
+        tokens_js_1.SHIELD_TOTP_VERIFIER_OVERRIDE,
+        tokens_js_1.SHIELD_ROOT_IDS,
+    ],
+};
+/**
+ * Bind the OPTIONAL login `totp` verifier override (the Phase-2 multi-device seam).
+ * Same value-provider pattern as the other seams: the supplied verifier when present,
+ * else `null` so the authenticator factory's inject resolves to "no override" → the
+ * default RFC-6238 verifier. Always provided so the DI token exists.
+ */
+function makeTotpVerifierOverrideProvider(override) {
+    return { provide: tokens_js_1.SHIELD_TOTP_VERIFIER_OVERRIDE, useValue: override ?? null };
+}
+/**
+ * Bind the OPTIONAL root allowlist (the {@link SHIELD_ROOT_IDS}
+ * seam). Same value-provider pattern as the other seams: the supplied ids when present,
+ * else `null` so the authenticator factory's inject resolves to "no allowlist" → the
+ * broker's default-deny empty set (nobody is a root — historical behavior). Always
+ * provided so the DI token exists. See {@link SHIELD_ROOT_IDS} for the security
+ * rationale (the flag is set SOLELY from this trusted list, never from a claim).
+ */
+function makeRootIdsProvider(rootIds) {
+    return { provide: tokens_js_1.SHIELD_ROOT_IDS, useValue: rootIds ?? null };
+}
+/**
+ * The core TOTP {@link FactorVerifier} — the SAME verifier the login MFA branch uses
+ * (`createTotpFactorVerifier({ hmacSha1 })`), provided app-wide so
+ * `POST /account/mfa/{enroll/confirm,disable}` can verify a presented code against the
+ * pending/stored secret. Built via {@link loadCore} (the CJS→ESM lazy load, see the
+ * file header) so guard's built CJS dist never eagerly `require`s the ESM-only core.
+ * Injected pre-built into {@link AccountController}, which cannot import the core
+ * factory at its own top level.
+ */
+const totpVerifierProvider = {
+    provide: tokens_js_1.SHIELD_TOTP_VERIFIER,
+    useFactory: async () => {
+        const { createTotpFactorVerifier } = await loadCore();
+        return createTotpFactorVerifier({ hmacSha1: exports.hmacSha1 });
+    },
+};
+/**
+ * Bind the OPTIONAL current-user profile resolver. When the consumer supplies one it
+ * is a value provider under {@link SHIELD_PROFILE_RESOLVER}; when absent we bind
+ * `null` so the `@Optional()` injection in the controller resolves cleanly to
+ * "no seam" (→ `/auth/me` returns 501). Always provided so the DI token exists.
+ */
+function makeProfileResolverProvider(override) {
+    return { provide: tokens_js_1.SHIELD_PROFILE_RESOLVER, useValue: override ?? null };
+}
+/**
+ * Bind each OPTIONAL account/credential-surface seam. Same pattern as
+ * {@link makeProfileResolverProvider}: a value provider under the seam's token —
+ * the supplied impl when present, else `null` so the route's `@Optional()` injection
+ * resolves cleanly to "no seam" (→ 501). Always provided so the DI token exists.
+ */
+function makeCredentialWriterProvider(override) {
+    return { provide: tokens_js_1.SHIELD_CREDENTIAL_WRITER, useValue: override ?? null };
+}
+function makeResetTokenStoreProvider(override) {
+    return { provide: tokens_js_1.SHIELD_RESET_TOKEN_STORE, useValue: override ?? null };
+}
+function makeEmailSenderProvider(override) {
+    return { provide: tokens_js_1.SHIELD_EMAIL_SENDER, useValue: override ?? null };
+}
+function makeRecoveryCodeStoreProvider(override) {
+    return { provide: tokens_js_1.SHIELD_RECOVERY_CODE_STORE, useValue: override ?? null };
+}
+function makeProfileWriterProvider(override) {
+    return { provide: tokens_js_1.SHIELD_PROFILE_WRITER, useValue: override ?? null };
+}
+function makeSessionSweeperProvider(override) {
+    return { provide: tokens_js_1.SHIELD_SESSION_SWEEPER, useValue: override ?? null };
+}
+function makeMfaDeviceStoreProvider(override) {
+    return { provide: tokens_js_1.SHIELD_MFA_DEVICE_STORE, useValue: override ?? null };
+}
+function makeAuditSinkProvider(override) {
+    return { provide: tokens_js_1.SHIELD_AUDIT_SINK, useValue: override ?? null };
+}
+/**
+ * Bind the OPTIONAL eager session-facts projector (ADR-0011). Same value-provider
+ * pattern as the other seams: the supplied impl when present, else `null` so the auth
+ * controller's `@Optional()` injection resolves cleanly to "no projector" (→ it omits
+ * `cachedFacts` → gate 5 DB-reloads). Always provided so the DI token exists.
+ */
+function makeSessionFactsProjectorProvider(override) {
+    return { provide: tokens_js_1.SHIELD_SESSION_FACTS_PROJECTOR, useValue: override ?? null };
+}
+/**
+ * The reset-link base URL the forgot-password handler builds the emailed link from
+ * (`${base}?token=<rawToken>`). A plain string VALUE (not a seam) resolved from the
+ * environment (`RESET_LINK_BASE_URL`) with a dev default, so the framework owns the
+ * URL composition and {@link SHIELD_EMAIL_SENDER} stays URL-agnostic. Always
+ * provided so the `@Optional()` injection resolves.
+ */
+const resetLinkBaseUrlProvider = {
+    provide: tokens_js_1.SHIELD_RESET_LINK_BASE_URL,
+    useValue: process.env.RESET_LINK_BASE_URL ?? 'http://localhost:5173/reset-password',
+};
+/**
+ * The auth composition module. Imports {@link PersistenceModule} (the live
+ * connections) and provides the adapters + composed engines. Exports the two
+ * engines (Team C consumes them) and the resolver token. Opt-in: imported ONLY by
+ * an auth-enabled `ShieldModule.forRoot({ auth: true })` — see the file header +
+ * DONE.md for the exact gating the integration owner applies.
+ */
+let AuthModule = AuthModule_1 = class AuthModule {
+    /**
+     * Compose the auth surface. `options.credentialResolver`, when supplied, REPLACES
+     * the default MariaDb store with the consumer's own (a value provider under
+     * {@link SHIELD_CREDENTIAL_RESOLVER}); omitted → the historical default binding,
+     * EXACTLY unchanged (zero behavior change for existing consumers).
+     */
+    static forRoot(options = {}) {
+        return {
+            module: AuthModule_1,
+            imports: [persistence_module_js_1.PersistenceModule.forRoot()],
+            // (providers list below adds the profile-resolver seam)
+            // Team C's four `@Public()` /auth/* endpoints. Registered here (integration
+            // wiring) so the routes exist the moment auth is opted in — the controller
+            // injects the two composed engines (below) + PendingMfaStore.
+            controllers: [auth_controller_js_1.AuthController, account_controller_js_1.AccountController],
+            providers: [
+                passwordHasherProvider,
+                makeCredentialResolverProvider(options.credentialResolver),
+                // The current-user profile seam backing `GET /auth/me` (null when absent).
+                makeProfileResolverProvider(options.profileResolver),
+                // The account/credential-surface seams (null when absent → route 501).
+                makeCredentialWriterProvider(options.credentialWriter),
+                makeResetTokenStoreProvider(options.resetTokenStore),
+                makeEmailSenderProvider(options.emailSender),
+                makeRecoveryCodeStoreProvider(options.recoveryCodeStore),
+                makeProfileWriterProvider(options.profileWriter),
+                makeSessionSweeperProvider(options.sessionSweeper),
+                // The auth-surface audit sink (null when absent → recovery-login audit no-ops).
+                makeAuditSinkProvider(options.auditSink),
+                // The multi-device MFA store (null when absent → device routes 501).
+                makeMfaDeviceStoreProvider(options.mfaDeviceStore),
+                // The login totp-verifier override (null when absent → default RFC-6238
+                // single-secret verify). Consumed by the authenticator factory.
+                makeTotpVerifierOverrideProvider(options.totpVerifier),
+                // The root allowlist (null when absent → broker default-deny).
+                // Consumed by the authenticator factory (createIdentityBroker). ROOT
+                // SAFETY: the ONLY source of the isRoot flag.
+                makeRootIdsProvider(options.rootIds),
+                // The eager session-facts projector (ADR-0011; null when absent → the auth
+                // controller omits cachedFacts → gate 5 DB-reloads). Consumed by AuthController.
+                makeSessionFactsProjectorProvider(options.sessionFactsProjector),
+                // The reset-link base URL value the forgot-password handler composes into the
+                // emailed link (framework-owned URL composition; EmailSender stays dumb).
+                resetLinkBaseUrlProvider,
+                sessionRecordStoreProvider,
+                hotSessionStoreProvider,
+                tokenGeneratorProvider,
+                refreshHasherProvider,
+                clockProvider,
+                sessionAuthorityProvider,
+                authenticatorProvider,
+                // The core TOTP verifier (login MFA + account MFA enroll/disable share it).
+                totpVerifierProvider,
+                // Team C's server-side, single-use, TTL'd challenge store backing the
+                // login→mfa handoff (a plain class provider the controller injects).
+                pending_mfa_store_js_1.PendingMfaStore,
+                // The request-auth token binder (access-token → principal claims).
+                sessionTokenBinderProvider,
+                // The anti-brute-force rate limiters (spec §5): login (H1) + recovery, each
+                // a Redis-injected AttemptLimiter with its own threshold. Injected into
+                // AuthController (@Optional()).
+                loginLimiterProvider,
+                recoveryLimiterProvider,
+                // The forgot/reset-password limiters (feature #141): forgot keyed by client IP
+                // + per-hint (request-rate caps → silently skip the send when exceeded, stays
+                // 204); reset keyed by client IP (may 429 on lockout — token-gated, not enum-
+                // sensitive). Injected into AuthController (@Optional()).
+                forgotLimiterProvider,
+                forgotHintLimiterProvider,
+                resetLimiterProvider,
+            ],
+            exports: [
+                tokens_js_1.SHIELD_AUTHENTICATOR,
+                tokens_js_1.SHIELD_SESSION_AUTHORITY,
+                tokens_js_1.SHIELD_CREDENTIAL_RESOLVER,
+                argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER,
+                // Exported so the (app-wide) enforcement guard can inject it.
+                tokens_js_2.SHIELD_SESSION_TOKEN_BINDER,
+                // The account/credential-surface seams — exported so the consumer's impls
+                // and the account/auth controllers see them app-wide through @Global Shield.
+                tokens_js_1.SHIELD_CREDENTIAL_WRITER,
+                tokens_js_1.SHIELD_RESET_TOKEN_STORE,
+                tokens_js_1.SHIELD_EMAIL_SENDER,
+                tokens_js_1.SHIELD_RECOVERY_CODE_STORE,
+                tokens_js_1.SHIELD_PROFILE_WRITER,
+                tokens_js_1.SHIELD_SESSION_SWEEPER,
+                // The auth-surface audit sink (consumed by the /auth/mfa recovery branch).
+                tokens_js_1.SHIELD_AUDIT_SINK,
+                // The multi-device MFA store (consumed by /account/mfa/devices/*).
+                tokens_js_1.SHIELD_MFA_DEVICE_STORE,
+                // The reset-link base URL value (consumed by /auth/forgot-password).
+                tokens_js_1.SHIELD_RESET_LINK_BASE_URL,
+                // The core TOTP verifier (consumed by /account/mfa/{enroll/confirm,disable}).
+                tokens_js_1.SHIELD_TOTP_VERIFIER,
+                // The eager session-facts projector (consumed by AuthController).
+                tokens_js_1.SHIELD_SESSION_FACTS_PROJECTOR,
+            ],
+        };
+    }
+};
+exports.AuthModule = AuthModule;
+exports.AuthModule = AuthModule = AuthModule_1 = __decorate([
+    (0, common_1.Module)({})
+], AuthModule);

package/dist/auth/auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgHH,kDAKC;AAWD,0DAGC;AAjID,2CAA2E;AAC3E,6CAAyC;AA4BzC,2DAA+E;AAC/E,iEAAwD;AACxD,+FAA+G;AAC/G,qGAA6F;AAC7F,kDAW6B;AAC7B,mEAA4D;AAC5D,6DAAsD;AACtD,mEAA4D;AAC5D,iEAAyD;AACzD,2CAyBqB;AAErB,wEAAiE;AAUjE,yDAAwE;AACxE,qFAA6E;AAE7E;;;;;GAKG;AACI,MAAM,QAAQ,GAAa,CAAC,GAAe,EAAE,OAAmB,EAAc,EAAE,CACrF,IAAI,UAAU,CAAC,IAAA,wBAAU,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AADhF,QAAA,QAAQ,YACwE;AAE7F;;;;;;;;;;;GAWG;AACH,SAAgB,mBAAmB,CACjC,QAA2C,EAC3C,eAA+B;IAE/B,OAAO,QAAQ,IAAI,eAAe,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,uBAAuB;IAC3C,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;IACtD,OAAO,wBAAwB,CAAC,EAAE,QAAQ,EAAR,gBAAQ,EAAE,CAAC,CAAC;AAChD,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAEnD,CAAC;AAEtB,IAAI,UAAmC,CAAC;AAExC;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,QAAQ;IACrB,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAChD,IAAI,CAAC;QACH,mFAAmF;QACnF,UAAU,GAAG,CAAC,wDAAa,cAAc,GAAC,CAA2B,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,CAAgB,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+EAA+E;AAE/E,uHAAuH;AACvH,MAAM,sBAAsB,GAAa;IACvC,OAAO,EAAE,oDAAsB;IAC/B,UAAU,EAAE,GAAmB,EAAE,CAAC,IAAI,oDAAsB,EAAE;CAC/D,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,SAAS,8BAA8B,CAAC,QAA6B;IACnE,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,sCAA0B,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC7D,CAAC,CAAC;YACE,OAAO,EAAE,sCAA0B;YACnC,UAAU,EAAE,CAAC,IAAU,EAAsB,EAAE,CAAC,IAAI,0DAAyB,CAAC,IAAI,CAAC;YACnF,MAAM,EAAE,CAAC,0BAAc,CAAC;SACzB,CAAC;AACR,CAAC;AAED,mFAAmF;AACnF,MAAM,0BAA0B,GAAa;IAC3C,OAAO,EAAE,sCAA2B;IACpC,UAAU,EAAE,CAAC,IAAU,EAAsB,EAAE,CAAC,IAAI,oCAAyB,CAAC,IAAI,CAAC;IACnF,MAAM,EAAE,CAAC,0BAAc,CAAC;CACzB,CAAC;AAEF,wEAAwE;AACxE,MAAM,uBAAuB,GAAa;IACxC,OAAO,EAAE,mCAAwB;IACjC,UAAU,EAAE,CAAC,KAAY,EAAmB,EAAE,CAAC,IAAI,+BAAoB,CAAC,KAAK,CAAC;IAC9E,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,0BAA0B,GAAa;IAC3C,OAAO,EAAE,uCAA2B;IACpC,UAAU,EAAE,CAAC,KAAY,EAAsB,EAAE,CAAC,IAAI,4CAAkB,CAAC,KAAK,CAAC;IAC/E,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAa;IACrC,OAAO,EAAE,gCAAoB;IAC7B,UAAU,EAAE,CAAC,KAAY,EAAkB,EAAE,CAC3C,IAAI,mCAAc,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1E,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAa;IACxC,OAAO,EAAE,mCAAuB;IAChC,UAAU,EAAE,CAAC,KAAY,EAAkB,EAAE,CAC3C,IAAI,mCAAc,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACzE,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB,GAAa;IACtC,OAAO,EAAE,iCAAqB;IAC9B,UAAU,EAAE,CAAC,KAAY,EAAkB,EAAE,CAC3C,IAAI,mCAAc,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACzE,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,yBAAyB,GAAa;IAC1C,OAAO,EAAE,sCAA0B;IACnC,UAAU,EAAE,CAAC,KAAY,EAAkB,EAAE,CAC3C,IAAI,mCAAc,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACzE,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAa;IACrC,OAAO,EAAE,gCAAoB;IAC7B,UAAU,EAAE,CAAC,KAAY,EAAkB,EAAE,CAC3C,IAAI,mCAAc,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1E,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF,oDAAoD;AACpD,MAAM,sBAAsB,GAAa;IACvC,OAAO,EAAE,iCAAsB;IAC/B,UAAU,EAAE,GAAmB,EAAE,CAAC,IAAI,+BAAoB,EAAE;CAC7D,CAAC;AAEF;;;;GAIG;AACH,MAAM,qBAAqB,GAAa;IACtC,OAAO,EAAE,gCAAqB;IAC9B,UAAU,EAAE,CAAC,MAAiB,EAAsB,EAAE,CACpD,IAAI,mCAAwB,CAAC,IAAA,oCAAoB,EAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3E,MAAM,EAAE,CAAC,6BAAU,CAAC;CACrB,CAAC;AAEF,oBAAoB;AACpB,MAAM,aAAa,GAAa;IAC9B,OAAO,EAAE,uBAAY;IACrB,UAAU,EAAE,GAAU,EAAE,CAAC,IAAI,sBAAW,EAAE;CAC3C,CAAC;AAEF,+EAA+E;AAE/E,0EAA0E;AAC1E,MAAM,wBAAwB,GAAa;IACzC,OAAO,EAAE,oCAAwB;IACjC,kFAAkF;IAClF,UAAU,EAAE,KAAK,EACf,WAA+B,EAC/B,QAAyB,EACzB,cAA8B,EAC9B,aAAiC,EACjC,KAAY,EACZ,MAAiB,EACU,EAAE;QAC7B,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACpD,OAAO,sBAAsB,CAAC;YAC5B,WAAW;YACX,QAAQ;YACR,cAAc;YACd,aAAa;YACb,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,EAAE;QACN,sCAA2B;QAC3B,mCAAwB;QACxB,iCAAsB;QACtB,gCAAqB;QACrB,uBAAY;QACZ,6BAAU;KACX;CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAa;IACtC,OAAO,EAAE,gCAAoB;IAC7B,oFAAoF;IACpF,UAAU,EAAE,KAAK,EACf,MAAsB,EACtB,QAA4B,EAC5B,YAAmC,EACnC,OAAiC,EACT,EAAE;QAC1B,MAAM,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,GAC3E,MAAM,QAAQ,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,mBAAmB,CAAC,YAAY,EAAE,wBAAwB,CAAC,EAAE,QAAQ,EAAR,gBAAQ,EAAE,CAAC,CAAC,CAAC;QACvF,OAAO,mBAAmB,CAAC;YACzB,MAAM;YACN,QAAQ;YACR,wDAAwD;YACxD,0EAA0E;YAC1E,uEAAuE;YACvE,oEAAoE;YACpE,cAAc,EAAE,oBAAoB,CAAC,EAAE,eAAe,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;YACxE,eAAe,EAAE,CAAC,IAAI,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,EAAE;QACN,oDAAsB;QACtB,sCAA0B;QAC1B,yCAA6B;QAC7B,2BAAe;KAChB;CACF,CAAC;AAEF;;;;;GAKG;AACH,SAAS,gCAAgC,CAAC,QAAyB;IACjE,OAAO,EAAE,OAAO,EAAE,yCAA6B,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,OAA2B;IACtD,OAAO,EAAE,OAAO,EAAE,2BAAe,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAa;IACrC,OAAO,EAAE,gCAAoB;IAC7B,UAAU,EAAE,KAAK,IAA6B,EAAE;QAC9C,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACtD,OAAO,wBAAwB,CAAC,EAAE,QAAQ,EAAR,gBAAQ,EAAE,CAAC,CAAC;IAChD,CAAC;CACF,CAAC;AAkFF;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,QAA0B;IAC7D,OAAO,EAAE,OAAO,EAAE,mCAAuB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAS,4BAA4B,CAAC,QAA2B;IAC/D,OAAO,EAAE,OAAO,EAAE,oCAAwB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC3E,CAAC;AACD,SAAS,2BAA2B,CAAC,QAA0B;IAC7D,OAAO,EAAE,OAAO,EAAE,oCAAwB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC3E,CAAC;AACD,SAAS,uBAAuB,CAAC,QAAsB;IACrD,OAAO,EAAE,OAAO,EAAE,+BAAmB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AACtE,CAAC;AACD,SAAS,6BAA6B,CAAC,QAA4B;IACjE,OAAO,EAAE,OAAO,EAAE,sCAA0B,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC7E,CAAC;AACD,SAAS,yBAAyB,CAAC,QAAwB;IACzD,OAAO,EAAE,OAAO,EAAE,iCAAqB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AACxE,CAAC;AACD,SAAS,0BAA0B,CAAC,QAAyB;IAC3D,OAAO,EAAE,OAAO,EAAE,kCAAsB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AACzE,CAAC;AACD,SAAS,0BAA0B,CAAC,QAAyB;IAC3D,OAAO,EAAE,OAAO,EAAE,mCAAuB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC1E,CAAC;AACD,SAAS,qBAAqB,CAAC,QAAoB;IACjD,OAAO,EAAE,OAAO,EAAE,6BAAiB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AACpE,CAAC;AACD;;;;;GAKG;AACH,SAAS,iCAAiC,CAAC,QAAgC;IACzE,OAAO,EAAE,OAAO,EAAE,0CAA8B,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAa;IACzC,OAAO,EAAE,sCAA0B;IACnC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,sCAAsC;CACpF,CAAC;AAEF;;;;;;GAMG;AAEI,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,UAA6B,EAAE;QAC5C,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,OAAO,EAAE,CAAC,yCAAiB,CAAC,OAAO,EAAE,CAAC;YACtC,wDAAwD;YACxD,4EAA4E;YAC5E,2EAA2E;YAC3E,8DAA8D;YAC9D,WAAW,EAAE,CAAC,mCAAc,EAAE,yCAAiB,CAAC;YAChD,SAAS,EAAE;gBACT,sBAAsB;gBACtB,8BAA8B,CAAC,OAAO,CAAC,kBAAkB,CAAC;gBAC1D,2EAA2E;gBAC3E,2BAA2B,CAAC,OAAO,CAAC,eAAe,CAAC;gBACpD,uEAAuE;gBACvE,4BAA4B,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBACtD,2BAA2B,CAAC,OAAO,CAAC,eAAe,CAAC;gBACpD,uBAAuB,CAAC,OAAO,CAAC,WAAW,CAAC;gBAC5C,6BAA6B,CAAC,OAAO,CAAC,iBAAiB,CAAC;gBACxD,yBAAyB,CAAC,OAAO,CAAC,aAAa,CAAC;gBAChD,0BAA0B,CAAC,OAAO,CAAC,cAAc,CAAC;gBAClD,gFAAgF;gBAChF,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxC,qEAAqE;gBACrE,0BAA0B,CAAC,OAAO,CAAC,cAAc,CAAC;gBAClD,wEAAwE;gBACxE,gEAAgE;gBAChE,gCAAgC,CAAC,OAAO,CAAC,YAAY,CAAC;gBACtD,+DAA+D;gBAC/D,qEAAqE;gBACrE,8CAA8C;gBAC9C,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;gBACpC,2EAA2E;gBAC3E,iFAAiF;gBACjF,iCAAiC,CAAC,OAAO,CAAC,qBAAqB,CAAC;gBAChE,8EAA8E;gBAC9E,0EAA0E;gBAC1E,wBAAwB;gBACxB,0BAA0B;gBAC1B,uBAAuB;gBACvB,sBAAsB;gBACtB,qBAAqB;gBACrB,aAAa;gBACb,wBAAwB;gBACxB,qBAAqB;gBACrB,4EAA4E;gBAC5E,oBAAoB;gBACpB,sEAAsE;gBACtE,qEAAqE;gBACrE,sCAAe;gBACf,mEAAmE;gBACnE,0BAA0B;gBAC1B,4EAA4E;gBAC5E,wEAAwE;gBACxE,gCAAgC;gBAChC,oBAAoB;gBACpB,uBAAuB;gBACvB,+EAA+E;gBAC/E,8EAA8E;gBAC9E,8EAA8E;gBAC9E,0DAA0D;gBAC1D,qBAAqB;gBACrB,yBAAyB;gBACzB,oBAAoB;aACrB;YACD,OAAO,EAAE;gBACP,gCAAoB;gBACpB,oCAAwB;gBACxB,sCAA0B;gBAC1B,oDAAsB;gBACtB,8DAA8D;gBAC9D,uCAA2B;gBAC3B,0EAA0E;gBAC1E,6EAA6E;gBAC7E,oCAAwB;gBACxB,oCAAwB;gBACxB,+BAAmB;gBACnB,sCAA0B;gBAC1B,iCAAqB;gBACrB,kCAAsB;gBACtB,2EAA2E;gBAC3E,6BAAiB;gBACjB,mEAAmE;gBACnE,mCAAuB;gBACvB,qEAAqE;gBACrE,sCAA0B;gBAC1B,8EAA8E;gBAC9E,gCAAoB;gBACpB,kEAAkE;gBAClE,0CAA8B;aAC/B;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AApGY,gCAAU;qBAAV,UAAU;IADtB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAoGtB"}