@astram/guard 0.18.0 → 0.20.0

package/dist/auth/admin-signin-controls.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisAccountUnlocker = exports.TotpAdminStepUp = exports.AdminControlUnavailableError = void 0;
+exports.accountUnlockKeys = accountUnlockKeys;
+const captcha_config_js_1 = require("../config/captcha-config.js");
+/** A store the admin control needs could not answer; nothing is claimed (caller → 503). */
+class AdminControlUnavailableError extends Error {
+    constructor() {
+        super('admin sign-in control unavailable');
+        this.name = 'AdminControlUnavailableError';
+    }
+}
+exports.AdminControlUnavailableError = AdminControlUnavailableError;
+class TotpAdminStepUp {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async verify(principalId, code) {
+        const { devices, verifier, limiter } = this.deps;
+        if (!devices || !verifier || !limiter || !principalId)
+            return 'unavailable';
+        let secrets;
+        try {
+            secrets = await devices.listConfirmedSecrets(principalId);
+        }
+        catch {
+            return 'unavailable';
+        }
+        if (!Array.isArray(secrets) || secrets.length === 0)
+            return 'no_factor';
+        const presented = typeof code === 'string' ? code.trim() : '';
+        if (presented === '')
+            return 'missing';
+        const key = `mfa:pid:${principalId}`;
+        let allowed;
+        try {
+            ({ allowed } = await limiter.consume(key));
+        }
+        catch {
+            return 'unavailable';
+        }
+        if (!allowed)
+            return 'locked';
+        let satisfied;
+        try {
+            satisfied = (await verifier.verify({ factor: 'totp', payload: { code: presented } }, secrets.join('\n')))?.satisfied;
+        }
+        catch {
+            // No verdict (replay guard / Redis down): give the attempt back, fail closed.
+            await limiter.refund(key);
+            return 'unavailable';
+        }
+        if (satisfied !== true)
+            return 'rejected';
+        await limiter.reset(key);
+        return 'verified';
+    }
+}
+exports.TotpAdminStepUp = TotpAdminStepUp;
+/** The keys one unlock clears (limiter keys without the `shield:attempts:` namespace). */
+function accountUnlockKeys(principalId) {
+    return {
+        login: `login:pid:${principalId}`,
+        mfa: `mfa:pid:${principalId}`,
+        recovery: `recovery:${principalId}`,
+        captcha: captcha_config_js_1.CAPTCHA_ENDPOINTS.map((ep) => `${ep}:pid:${principalId}`),
+    };
+}
+class RedisAccountUnlocker {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async unlock(principalId) {
+        if (typeof principalId !== 'string' || principalId === '') {
+            throw new AdminControlUnavailableError();
+        }
+        const keys = accountUnlockKeys(principalId);
+        try {
+            await this.deps.login.clear(keys.login);
+            await this.deps.mfa.clear(keys.mfa);
+            await this.deps.recovery.clear(keys.recovery);
+            await this.deps.captcha.clearStrict(keys.captcha);
+        }
+        catch {
+            throw new AdminControlUnavailableError();
+        }
+    }
+}
+exports.RedisAccountUnlocker = RedisAccountUnlocker;

package/dist/auth/auth-audit.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Auth audit events and counters (R12.2–R12.4, AC-18).
+ *
+ * Events (through the auth {@link AuditSink}, fire-and-forget, errors swallowed):
+ *  - `auth.login.succeeded` / `auth.login.failed` (`authentication`), attribute `method`:
+ *    `password`, or the MFA step's `totp` / `recovery_code`.
+ *  - `auth.logout` (`session_lifecycle`), attribute `proven`.
+ *  - `auth.mfa.enrolled` / `auth.mfa.removed` (`authentication`).
+ *
+ * Actor and tenant always come from the RESOLVED principal or session, never from the request.
+ * No event carries the typed hint, a password, a code or a token.
+ *
+ * Bounding (R12.3): a failure row is written only for a resolved account, and only by the attempt
+ * that OPENS the account's limiter window ({@link opensFailureWindow}: the increment-first count is
+ * 1). The limiter's counter is atomic (Lua `INCR`), so of N parallel failures exactly one sees 1,
+ * and the window is fixed (not extended by later attempts), so an account yields at most one
+ * failure row per lockout window, plus the existing lockout row on the edge. No extra Redis key and
+ * no extra round trip; with no limiter there is no window and no failure row. Unknown names write
+ * no row at all; they only count.
+ *
+ * Counters (R12.4): one structured log line per occurrence with fixed keys and no personal data,
+ * the style of `recordUnprovenLogout` (`logout-proof.ts`):
+ *  - `{ counter: 'auth.login.failed', method, account: 'known' | 'unknown' }`
+ *  - `{ counter: 'auth.lockout', method, account: 'known' | 'unknown' | 'ip' }`
+ */
+import { Logger } from '@nestjs/common';
+import type { AuditSink, AuthAuditEvent } from './ports/audit-sink.js';
+/** The sign-in factor an event or counter refers to. */
+export type AuthMethod = 'password' | 'totp' | 'recovery_code';
+/** Whether the failing name resolved to an account (`ip` = the per-IP lockout, no account). */
+export type AccountLabel = 'known' | 'unknown' | 'ip';
+export declare const AUTH_LOGIN_SUCCEEDED = "auth.login.succeeded";
+export declare const AUTH_LOGIN_FAILED = "auth.login.failed";
+export declare const AUTH_LOGOUT = "auth.logout";
+export declare const AUTH_MFA_ENROLLED = "auth.mfa.enrolled";
+export declare const AUTH_MFA_REMOVED = "auth.mfa.removed";
+/** Counter keys (R12.4). */
+export declare const LOGIN_FAILED_COUNTER = "auth.login.failed";
+export declare const LOCKOUT_COUNTER = "auth.lockout";
+/** Record one event, fire-and-forget. A missing sink is a no-op; a sink error never propagates. */
+export declare function emitAuthAudit(sink: AuditSink | null | undefined, event: AuthAuditEvent): void;
+/** An `authentication` event about `actorId` in `tenantId`. */
+export declare function authEvent(action: string, actorId: string, tenantId: string, attributes: Record<string, unknown>, nowMs?: number): AuthAuditEvent;
+/** The `auth.logout` event (`session_lifecycle`) for a revoked session. */
+export declare function logoutEvent(actorId: string, tenantId: string, proven: boolean, nowMs?: number): AuthAuditEvent;
+/**
+ * True when this failed attempt opened the account's limiter window (its increment-first count
+ * is 1), so it may write the window's one `auth.login.failed` row. `null` (no limiter) → false.
+ */
+export declare function opensFailureWindow(verdict: {
+    count: number;
+} | null | undefined): boolean;
+/** Count one failed sign-in (R12.4). */
+export declare function countLoginFailure(method: AuthMethod, account: 'known' | 'unknown', logger?: Pick<Logger, 'log'>): void;
+/** Count one lockout (the edge where a limiter trips; R12.4). */
+export declare function countLockout(method: AuthMethod, account: AccountLabel, logger?: Pick<Logger, 'log'>): void;
+/** The tenant id in resolved credential claims, or `null`. */
+export declare function tenantOfClaims(claims: unknown): string | null;
+//# sourceMappingURL=auth-audit.d.ts.map

package/dist/auth/auth-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-audit.d.ts","sourceRoot":"","sources":["../../src/auth/auth-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvE,wDAAwD;AACxD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,eAAe,CAAC;AAE/D,+FAA+F;AAC/F,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;AAEtD,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,4BAA4B;AAC5B,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AACxD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAI9C,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAS7F;AAED,+DAA+D;AAC/D,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,KAAK,GAAE,MAAmB,GACzB,cAAc,CAEhB;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,EACf,KAAK,GAAE,MAAmB,GACzB,cAAc,CAShB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEzF;AAED,wCAAwC;AACxC,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,MAAM,GAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAiB,GAC1C,IAAI,CAEN;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,YAAY,EACrB,MAAM,GAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAiB,GAC1C,IAAI,CAEN;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAG7D"}

package/dist/auth/auth-audit.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * Auth audit events and counters (R12.2–R12.4, AC-18).
+ *
+ * Events (through the auth {@link AuditSink}, fire-and-forget, errors swallowed):
+ *  - `auth.login.succeeded` / `auth.login.failed` (`authentication`), attribute `method`:
+ *    `password`, or the MFA step's `totp` / `recovery_code`.
+ *  - `auth.logout` (`session_lifecycle`), attribute `proven`.
+ *  - `auth.mfa.enrolled` / `auth.mfa.removed` (`authentication`).
+ *
+ * Actor and tenant always come from the RESOLVED principal or session, never from the request.
+ * No event carries the typed hint, a password, a code or a token.
+ *
+ * Bounding (R12.3): a failure row is written only for a resolved account, and only by the attempt
+ * that OPENS the account's limiter window ({@link opensFailureWindow}: the increment-first count is
+ * 1). The limiter's counter is atomic (Lua `INCR`), so of N parallel failures exactly one sees 1,
+ * and the window is fixed (not extended by later attempts), so an account yields at most one
+ * failure row per lockout window, plus the existing lockout row on the edge. No extra Redis key and
+ * no extra round trip; with no limiter there is no window and no failure row. Unknown names write
+ * no row at all; they only count.
+ *
+ * Counters (R12.4): one structured log line per occurrence with fixed keys and no personal data,
+ * the style of `recordUnprovenLogout` (`logout-proof.ts`):
+ *  - `{ counter: 'auth.login.failed', method, account: 'known' | 'unknown' }`
+ *  - `{ counter: 'auth.lockout', method, account: 'known' | 'unknown' | 'ip' }`
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOCKOUT_COUNTER = exports.LOGIN_FAILED_COUNTER = exports.AUTH_MFA_REMOVED = exports.AUTH_MFA_ENROLLED = exports.AUTH_LOGOUT = exports.AUTH_LOGIN_FAILED = exports.AUTH_LOGIN_SUCCEEDED = void 0;
+exports.emitAuthAudit = emitAuthAudit;
+exports.authEvent = authEvent;
+exports.logoutEvent = logoutEvent;
+exports.opensFailureWindow = opensFailureWindow;
+exports.countLoginFailure = countLoginFailure;
+exports.countLockout = countLockout;
+exports.tenantOfClaims = tenantOfClaims;
+const common_1 = require("@nestjs/common");
+exports.AUTH_LOGIN_SUCCEEDED = 'auth.login.succeeded';
+exports.AUTH_LOGIN_FAILED = 'auth.login.failed';
+exports.AUTH_LOGOUT = 'auth.logout';
+exports.AUTH_MFA_ENROLLED = 'auth.mfa.enrolled';
+exports.AUTH_MFA_REMOVED = 'auth.mfa.removed';
+/** Counter keys (R12.4). */
+exports.LOGIN_FAILED_COUNTER = 'auth.login.failed';
+exports.LOCKOUT_COUNTER = 'auth.lockout';
+const counterLogger = new common_1.Logger('ShieldAuth');
+/** Record one event, fire-and-forget. A missing sink is a no-op; a sink error never propagates. */
+function emitAuthAudit(sink, event) {
+    if (sink === undefined || sink === null)
+        return;
+    try {
+        void sink.record(event).catch(() => {
+            /* best-effort: an audit failure never changes the response */
+        });
+    }
+    catch {
+        /* a synchronous throw from a consumer sink is swallowed too */
+    }
+}
+/** An `authentication` event about `actorId` in `tenantId`. */
+function authEvent(action, actorId, tenantId, attributes, nowMs = Date.now()) {
+    return { type: 'authentication', occurredAtMs: nowMs, actorId, tenantId, action, attributes };
+}
+/** The `auth.logout` event (`session_lifecycle`) for a revoked session. */
+function logoutEvent(actorId, tenantId, proven, nowMs = Date.now()) {
+    return {
+        type: 'session_lifecycle',
+        occurredAtMs: nowMs,
+        actorId,
+        tenantId,
+        action: exports.AUTH_LOGOUT,
+        attributes: { proven },
+    };
+}
+/**
+ * True when this failed attempt opened the account's limiter window (its increment-first count
+ * is 1), so it may write the window's one `auth.login.failed` row. `null` (no limiter) → false.
+ */
+function opensFailureWindow(verdict) {
+    return verdict !== null && verdict !== undefined && verdict.count === 1;
+}
+/** Count one failed sign-in (R12.4). */
+function countLoginFailure(method, account, logger = counterLogger) {
+    logger.log({ counter: exports.LOGIN_FAILED_COUNTER, method, account });
+}
+/** Count one lockout (the edge where a limiter trips; R12.4). */
+function countLockout(method, account, logger = counterLogger) {
+    logger.log({ counter: exports.LOCKOUT_COUNTER, method, account });
+}
+/** The tenant id in resolved credential claims, or `null`. */
+function tenantOfClaims(claims) {
+    const t = claims?.tenantId;
+    return typeof t === 'string' && t !== '' ? t : null;
+}

package/dist/auth/auth.controller.d.ts

@@ -65,6 +65,10 @@ import type { AttemptLimiter } from './rate-limit/attempt-limiter.js';
 import { TrustProxyBootCheck } from './rate-limit/trust-proxy-check.js';
 import { PendingMfaStore } from './pending-mfa-store.js';
 import { type SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import type { CaptchaGate } from './captcha-gate.js';
+import type { SignInMethod } from '../authentication/sign-in-with.js';
+import type { MfaRequirementService } from '../session/mfa-requirement-service.js';
+import { type LogoutProofVerifier } from './logout-proof.js';
 import type { CurrentUserProfile, ProfileResolver } from './profile-resolver.js';
 import type { CredentialResolver } from '@astram/core';
 import type { ResetTokenStore } from './ports/reset-token-store.js';
@@ -75,7 +79,7 @@ import type { SessionSweeper } from './ports/session-sweeper.js';
 import type { RecoveryCodeStore } from './ports/recovery-code-store.js';
 import type { AuditSink } from './ports/audit-sink.js';
 import type { MariaDbPermissionFactsAdapter } from '../identity/permission-facts.adapter.js';
-import type { LoginRequest, LoginResponse, LogoutRequest, MfaRequest, RefreshRequest, SessionSuccess } from './dto.js';
+import type { LoginOptionsView, LoginRequest, LoginResponse, LogoutRequest, MfaRequest, RefreshRequest, SessionSuccess } from './dto.js';
 /**
  * The framework-owned auth endpoints. Registered into `AuthModule`'s `controllers`
  * by the integration owner / Team B (this controller is EXPORTED for that purpose;
@@ -117,7 +121,19 @@ export declare class AuthController {
     private readonly sessionRestrictions?;
     private readonly emailChangeTokens?;
     private readonly messageDispatcher?;
-    constructor(authenticator: Authenticator, sessionAuthority: SessionAuthority, pendingMfa: PendingMfaStore, tokenBinder?: SessionTokenBinder | undefined, profileResolver?: ProfileResolver | undefined, credentialResolver?: (CredentialResolver | null) | undefined, resetTokenStore?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, credentialWriter?: (CredentialWriter | null) | undefined, sessionSweeper?: (SessionSweeper | null) | undefined, passwordHasher?: PasswordHasher | undefined, resetLinkBaseUrl?: string | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined, loginIpLimiter?: (AttemptLimiter | null) | undefined, trustProxyCheck?: (TrustProxyBootCheck | null) | undefined, recoveryLimiter?: (AttemptLimiter | null) | undefined, forgotLimiter?: (AttemptLimiter | null) | undefined, forgotHintLimiter?: (AttemptLimiter | null) | undefined, resetLimiter?: (AttemptLimiter | null) | undefined, auditSink?: (AuditSink | null) | undefined, sessionFactsProjector?: (SessionFactsProjector | null) | undefined, scopeSubtreeResolver?: (ScopeSubtreeResolver | null) | undefined, membershipChecker?: (MembershipChecker | null) | undefined, permissionFacts?: (MariaDbPermissionFactsAdapter | null) | undefined, mfaLimiter?: (AttemptLimiter | null) | undefined, mfaStepUp?: (MfaStepUp | null) | undefined, clock?: (Clock | null) | undefined, lifetimes?: (SessionLifetimeConfig | null) | undefined, rootIds?: (readonly string[] | null) | undefined, sessionRecords?: (Pick<SessionRecordStore, "findSessionById"> | null) | undefined, sessionRestrictions?: (SessionRestrictionStore | null) | undefined, emailChangeTokens?: (EmailChangeTokenStore | null) | undefined, messageDispatcher?: (MessageDispatcher | null) | undefined);
+    private readonly logoutProof?;
+    private readonly logoutRequiresProof?;
+    private readonly mfaRequirement?;
+    private readonly captchaGate?;
+    private readonly signInWith?;
+    constructor(authenticator: Authenticator, sessionAuthority: SessionAuthority, pendingMfa: PendingMfaStore, tokenBinder?: SessionTokenBinder | undefined, profileResolver?: ProfileResolver | undefined, credentialResolver?: (CredentialResolver | null) | undefined, resetTokenStore?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, credentialWriter?: (CredentialWriter | null) | undefined, sessionSweeper?: (SessionSweeper | null) | undefined, passwordHasher?: PasswordHasher | undefined, resetLinkBaseUrl?: string | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined, loginIpLimiter?: (AttemptLimiter | null) | undefined, trustProxyCheck?: (TrustProxyBootCheck | null) | undefined, recoveryLimiter?: (AttemptLimiter | null) | undefined, forgotLimiter?: (AttemptLimiter | null) | undefined, forgotHintLimiter?: (AttemptLimiter | null) | undefined, resetLimiter?: (AttemptLimiter | null) | undefined, auditSink?: (AuditSink | null) | undefined, sessionFactsProjector?: (SessionFactsProjector | null) | undefined, scopeSubtreeResolver?: (ScopeSubtreeResolver | null) | undefined, membershipChecker?: (MembershipChecker | null) | undefined, permissionFacts?: (MariaDbPermissionFactsAdapter | null) | undefined, mfaLimiter?: (AttemptLimiter | null) | undefined, mfaStepUp?: (MfaStepUp | null) | undefined, clock?: (Clock | null) | undefined, lifetimes?: (SessionLifetimeConfig | null) | undefined, rootIds?: (readonly string[] | null) | undefined, sessionRecords?: (Pick<SessionRecordStore, "findSessionById"> | null) | undefined, sessionRestrictions?: (SessionRestrictionStore | null) | undefined, emailChangeTokens?: (EmailChangeTokenStore | null) | undefined, messageDispatcher?: (MessageDispatcher | null) | undefined, logoutProof?: (LogoutProofVerifier | null) | undefined, logoutRequiresProof?: boolean | null | undefined, mfaRequirement?: (MfaRequirementService | null) | undefined, captchaGate?: (CaptchaGate | null) | undefined, signInWith?: (readonly SignInMethod[] | null) | undefined);
+    /** True when bootstrap confirmed an explicit `trust proxy` (per-IP limits and CAPTCHA IP keys). */
+    private perIpEnabled;
+    /**
+     * R7.3: count one failure toward the CAPTCHA counters and say whether the next attempt needs a
+     * challenge. No gate (or endpoint not covered) ⇒ `false`.
+     */
+    private captchaAfterFailure;
     /**
      * The access-token binding TTL for an establishment (security hardening #8):
      * `clamp(session.expiresAtMs − now, 1, accessTtlMs)` — on login AND refresh. Never derived
@@ -132,6 +148,13 @@ export declare class AuthController {
      * gets valid tokens); the guard fails closed if the binding is absent.
      */
     private bindSession;
+    /**
+     * The mandatory-2FA state to bind at sign-in (R2.3, R2.4), or `undefined` when the policy feature
+     * is not wired. `'required'` is also marked on the durable session BEFORE any token leaves, so a
+     * binding rebuilt after a Redis loss stays restricted. Any failure revokes the session and
+     * answers the generic 503 (fail closed).
+     */
+    private evaluateMfaAtLogin;
     /**
      * Project coarse grants for a principal id + tenant (ADR-0011), distinguishing THREE
      * outcomes for the REFRESH path (which must know whether to carry the existing cache
@@ -239,6 +262,13 @@ export declare class AuthController {
      * outage. NEVER logs the request body.
      */
     login(body: LoginRequest, ip: string): Promise<LoginResponse>;
+    /**
+     * `GET /auth/login-options` (auth capabilities R7.3, R13.2, AC-23) — what the sign-in page needs
+     * before a session exists: the accepted sign-in forms and the public CAPTCHA settings
+     * (`{ provider, siteKey, mode }`, or `null` when CAPTCHA is off). Never the secret. `@Public()`:
+     * pre-session, reveals nothing about any account.
+     */
+    loginOptions(): LoginOptionsView;
     /**
      * `GET /auth/me` — the signed-in user's **display profile** (name, email, active
      * company name, role names) for the UI header/card. Fills the flagged gap: login
@@ -318,6 +348,7 @@ export declare class AuthController {
      */
     forgotPassword(body: {
         identityHint?: string;
+        captchaToken?: string;
     }, ip: string): Promise<void>;
     /**
      * The detached per-account half of {@link forgotPassword} (review F1):
@@ -358,6 +389,7 @@ export declare class AuthController {
     resetPassword(body: {
         token?: string;
         newPassword?: string;
+        captchaToken?: string;
     }, ip: string): Promise<void>;
     /**
      * `POST /auth/mfa` — complete a pending MFA login. Consumes the single-use
@@ -420,6 +452,15 @@ export declare class AuthController {
      * the neutral notice the account owner needs to act on it.
      */
     private notifyRecoveryUsed;
+    /** R12.2: `auth.login.succeeded` for an established session (fire-and-forget). */
+    private auditSignIn;
+    /** R12.2/R12.3: `auth.login.failed` for a RESOLVED account (the caller bounds it per window). */
+    private auditFailure;
+    /**
+     * The durable session `logout` is about to end, when it is ACTIVE and a sink is bound; else
+     * `null` (no row). A store error → `null` (the logout itself is unaffected).
+     */
+    private activeSessionForAudit;
     /**
      * Record an auth-SECURITY event (best-effort, fire-and-forget) and OPTIONALLY notify
      * the account owner. The REUSABLE audit+notify primitive (feature #140) — it
@@ -505,11 +546,17 @@ export declare class AuthController {
      */
     private rebuildBinding;
     /**
-     * `POST /auth/logout` — revoke the session. Idempotent + leak-free: revoking an
-     * unknown or already-revoked session still returns 204 (the engine's `revoke`
-     * swallows and returns void either way), so existence is never revealed.
+     * `POST /auth/logout` — revoke the session the caller proves it owns (R15.1, D-9).
+     * Proof is a bearer access token bound to `sessionId` or a refresh token of it
+     * ({@link LogoutProofVerifier}):
+     *  - proven → revoke + unbind;
+     *  - proof for another session, or an unknown/invalid token → revoke nothing;
+     *  - no proof (an old frontend), or a proof lookup outage → revoke only while
+     *    `logoutRequiresProof` is false (counted `auth.logout.unproven`, one deprecation warning);
+     *    strict mode revokes nothing (fail closed).
+     * Always 204 — never a 500, never an existence or ownership signal. Tokens are never logged.
      */
-    logout(body: LogoutRequest): Promise<void>;
+    logout(body: LogoutRequest, authorization?: string): Promise<void>;
     /**
      * Establish a session for an authenticated principal, mapping the engine's
      * generic `SessionRejectedError` (a malformed principal or a store outage at

package/dist/auth/auth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAeH,OAAO,KAAK,EACV,aAAa,EAIb,cAAc,EAGd,gBAAgB,EAEjB,MAAM,cAAc,CAAC;AAkCtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAEjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAQjE,OAAO,EAA2C,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,iCAAiC,CAAC;AAOtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,cAAc,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,KAAK,EAEV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EAEf,MAAM,UAAU,CAAC;AA8GlB;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAO7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAOjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAIlC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAKhC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOlC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAY/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAM9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAQjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAS3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAWvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAStC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAYnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAMjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAK3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAGvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAM3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAMzB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAIrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBApMlB,aAAa,EAAE,aAAa,EAE5B,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,eAAe,EAO3B,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAOhC,eAAe,CAAC,EAAE,eAAe,YAAA,EAOjC,kBAAkB,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAI9C,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAIxC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,gBAAgB,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAI1C,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAItC,cAAc,CAAC,EAAE,cAAc,YAAA,EAK/B,gBAAgB,CAAC,EAAE,MAAM,YAAA,EAOzB,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAYxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMpC,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMtC,eAAe,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5C,eAAe,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAQvC,aAAa,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKrC,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAS5B,qBAAqB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAWpD,oBAAoB,CAAC,GAAE,oBAAoB,GAAG,IAAI,aAAA,EASlD,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAY5C,eAAe,CAAC,GAAE,6BAA6B,GAAG,IAAI,aAAA,EAMtD,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAK5B,KAAK,CAAC,GAAE,KAAK,GAAG,IAAI,aAAA,EAGpB,SAAS,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAMxC,OAAO,CAAC,GAAE,SAAS,MAAM,EAAE,GAAG,IAAI,aAAA,EAMlC,cAAc,CAAC,GAAE,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,GAAG,IAAI,aAAA,EAMnE,mBAAmB,CAAC,GAAE,uBAAuB,GAAG,IAAI,aAAA,EAIpD,iBAAiB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAKhD,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAG/D;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;OAKG;YACW,WAAW;IAiEzB;;;;;;;;;;OAUG;YACW,eAAe;IAgB7B;;;;;;;;;;;;OAYG;YACW,mBAAmB;IAIjC;;;;;;;;OAQG;IACH;;;;;;;;OAQG;YACW,iBAAiB;YAcjB,sBAAsB;IAcpC;;;;;;;;;;OAUG;YACW,gBAAgB;IAY9B;;;;;;;;OAQG;YACW,uBAAuB;IAarC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;;;;;;;OAUG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK;YAIC,aAAa;IAM3B;;;;OAIG;IAIG,KAAK,CACD,IAAI,EAAE,YAAY,EAIpB,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC;IA0JzB;;;;;;;;;;;;;;;;;;OAkBG;IAIG,EAAE,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmCvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IAIG,WAAW,CACP,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EACb,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAyFjF;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,cAAc,CACV,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAKjC,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAgEhB;;;;;;;;;;OAUG;YACW,oBAAoB;IAqClC;;;;;;;;;OASG;YACW,gBAAgB;IA0C9B;;;;;;;;;;;;OAYG;IAIG,aAAa,CACT,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAEhD,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IA0FhB;;;;;;;;;;;;;;;;OAgBG;IAIG,GAAG,CAAS,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0B5D;;;;;;;;;;;;;;OAcG;YACW,eAAe;IA8C7B;;;;;;;;;;;;;;;OAeG;YACW,uBAAuB;IAuGrC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IA0C1B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;;;OAUG;IAIG,OAAO,CAAS,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IA0EpE,iGAAiG;IACjG,OAAO,CAAC,YAAY;IAUpB;;;;OAIG;YACW,cAAc;IAe5B;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,cAAc;IAgE5B;;;;OAIG;IAIG,MAAM,CAAS,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAexD;;;;;OAKG;YACW,iBAAiB;CAOhC"}
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAeH,OAAO,KAAK,EACV,aAAa,EAIb,cAAc,EAGd,gBAAgB,EAEjB,MAAM,cAAc,CAAC;AAkCtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAEjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAQjE,OAAO,EAA2C,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,iCAAiC,CAAC;AAOtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,yCAAyC,CAAC;AAQjD,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAmB,MAAM,uCAAuC,CAAC;AAMpG,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,cAAc,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAavD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,KAAK,EAEV,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EAEf,MAAM,UAAU,CAAC;AAwIlB;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAO7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAOjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAIlC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAKhC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOlC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAY/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAM9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAQjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAS3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAWvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAStC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAYnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAMjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAK3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAGvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAM3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAMzB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAIrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAMrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAKhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBA5NX,aAAa,EAAE,aAAa,EAE5B,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,eAAe,EAO3B,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAOhC,eAAe,CAAC,EAAE,eAAe,YAAA,EAOjC,kBAAkB,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAI9C,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAIxC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,gBAAgB,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAI1C,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAItC,cAAc,CAAC,EAAE,cAAc,YAAA,EAK/B,gBAAgB,CAAC,EAAE,MAAM,YAAA,EAOzB,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAYxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMpC,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMtC,eAAe,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5C,eAAe,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAQvC,aAAa,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKrC,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAS5B,qBAAqB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAWpD,oBAAoB,CAAC,GAAE,oBAAoB,GAAG,IAAI,aAAA,EASlD,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAY5C,eAAe,CAAC,GAAE,6BAA6B,GAAG,IAAI,aAAA,EAMtD,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAK5B,KAAK,CAAC,GAAE,KAAK,GAAG,IAAI,aAAA,EAGpB,SAAS,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAMxC,OAAO,CAAC,GAAE,SAAS,MAAM,EAAE,GAAG,IAAI,aAAA,EAMlC,cAAc,CAAC,GAAE,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,GAAG,IAAI,aAAA,EAMnE,mBAAmB,CAAC,GAAE,uBAAuB,GAAG,IAAI,aAAA,EAIpD,iBAAiB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAKhD,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAK5C,WAAW,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAIxC,mBAAmB,CAAC,EAAE,OAAO,GAAG,IAAI,YAAA,EAMpC,cAAc,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAK7C,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,UAAU,CAAC,GAAE,SAAS,YAAY,EAAE,GAAG,IAAI,aAAA;IAG9D,mGAAmG;IACnG,OAAO,CAAC,YAAY;IAIpB;;;OAGG;YACW,mBAAmB;IASjC;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;OAKG;YACW,WAAW;IA2EzB;;;;;OAKG;YACW,kBAAkB;IA0BhC;;;;;;;;;;OAUG;YACW,eAAe;IAgB7B;;;;;;;;;;;;OAYG;YACW,mBAAmB;IAIjC;;;;;;;;OAQG;IACH;;;;;;;;OAQG;YACW,iBAAiB;YAcjB,sBAAsB;IAcpC;;;;;;;;;;OAUG;YACW,gBAAgB;IAY9B;;;;;;;;OAQG;YACW,uBAAuB;IAgBrC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;;;;;;;OAUG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK;YAIC,aAAa;IAM3B;;;;OAIG;IAIG,KAAK,CACD,IAAI,EAAE,YAAY,EAIpB,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC;IA2MzB;;;;;OAKG;IAGH,YAAY,IAAI,gBAAgB;IAQhC;;;;;;;;;;;;;;;;;;OAkBG;IAIG,EAAE,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgDvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IAIG,WAAW,CACP,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EACb,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAoGjF;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,cAAc,CACV,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAKxD,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAiEhB;;;;;;;;;;OAUG;YACW,oBAAoB;IA2DlC;;;;;;;;;OASG;YACW,gBAAgB;IA0C9B;;;;;;;;;;;;OAYG;IAIG,aAAa,CACT,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAEvE,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAyGhB;;;;;;;;;;;;;;;;OAgBG;IAIG,GAAG,CAAS,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0B5D;;;;;;;;;;;;;;OAcG;YACW,eAAe;IAsD7B;;;;;;;;;;;;;;;OAeG;YACW,uBAAuB;IA6GrC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IA0C1B,kFAAkF;IAClF,OAAO,CAAC,WAAW;IAOnB,iGAAiG;IACjG,OAAO,CAAC,YAAY;IAIpB;;;OAGG;YACW,qBAAqB;IAiBnC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;;;OAUG;IAIG,OAAO,CAAS,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IA0EpE,iGAAiG;IACjG,OAAO,CAAC,YAAY;IAUpB;;;;OAIG;YACW,cAAc;IAe5B;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,cAAc;IA0E5B;;;;;;;;;;OAUG;IAIG,MAAM,CACF,IAAI,EAAE,aAAa,EACD,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC,IAAI,CAAC;IA0ChB;;;;;OAKG;YACW,iBAAiB;CAOhC"}