@astram/identity 0.14.0 → 0.15.0

package/dist/features/identity-feature.module.d.ts

@@ -1,6 +1,7 @@
 import { type DynamicModule } from '@nestjs/common';
 import { type FrameworkSchemas } from '@astram/core';
 import { type EngineDbConfig, type ObjectTypeInput } from '@astram/engine';
+import { type InviteOptions } from './user/invite.config.js';
 /**
  * The boot check behind {@link IDENTITY_DECISION_AUTHORITY_CHECK}: with this module wired, the
  * request path must decide with the authority guard built from this module's inputs. A missing
@@ -67,11 +68,16 @@ export declare class IdentityFeatureModule {
      *   throws). The one set is handed to the engine (registrations + its audit sink), the seven
      *   audit sinks, the audit reader and every identity store; a boot check refuses names that
      *   differ from guard's `FRAMEWORK_SCHEMAS`. Never read per request.
+     * @param invite administrator invite (G-010 R11, `POST /identity/users/:uuid/invite`).
+     *   `returnLinkToAdmin: true` also returns the link once in the response (default false: the
+     *   link is only emailed). `INVITE_LINK_TTL_HOURS` and `INVITE_RATE_PER_ADMIN` are read here,
+     *   once; a bad value refuses boot.
      */
-    static forRoot({ rootIds, extraObjects, schemas: givenSchemas, }?: {
+    static forRoot({ rootIds, extraObjects, schemas: givenSchemas, invite, }?: {
         rootIds?: readonly string[];
         extraObjects?: readonly ObjectTypeInput[];
         schemas?: FrameworkSchemas;
+        invite?: InviteOptions;
     }): DynamicModule;
 }
 //# sourceMappingURL=identity-feature.module.d.ts.map

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAYL,KAAK,cAAc,EAGnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA+GxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAwBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAqBhB;AAED;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,GACtB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;KACvB,GAAG,aAAa;CAqkBvB"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAYL,KAAK,cAAc,EAGnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAiDxB,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AA0E/E;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAwBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAqBhB;AAED;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,GACP,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,MAAM,CAAC,EAAE,aAAa,CAAC;KACnB,GAAG,aAAa;CA+lBvB"}

package/dist/features/identity-feature.module.js

@@ -31,6 +31,9 @@ const credential_provisioner_token_js_1 = require("./user/credential-provisioner
 const framework_schemas_token_js_1 = require("./framework-schemas.token.js");
 const org_bootstrap_tokens_js_1 = require("./org-bootstrap/org-bootstrap.tokens.js");
 const user_controller_js_1 = require("./user/user.controller.js");
+const invite_service_js_1 = require("./user/invite.service.js");
+const invite_config_js_1 = require("./user/invite.config.js");
+const invite_tokens_js_1 = require("./user/invite.tokens.js");
 const membership_controller_js_1 = require("./membership/membership.controller.js");
 const membership_service_js_1 = require("./membership/membership.service.js");
 const posting_service_js_1 = require("./membership/posting.service.js");
@@ -204,10 +207,16 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
      *   throws). The one set is handed to the engine (registrations + its audit sink), the seven
      *   audit sinks, the audit reader and every identity store; a boot check refuses names that
      *   differ from guard's `FRAMEWORK_SCHEMAS`. Never read per request.
+     * @param invite administrator invite (G-010 R11, `POST /identity/users/:uuid/invite`).
+     *   `returnLinkToAdmin: true` also returns the link once in the response (default false: the
+     *   link is only emailed). `INVITE_LINK_TTL_HOURS` and `INVITE_RATE_PER_ADMIN` are read here,
+     *   once; a bad value refuses boot.
      */
-    static forRoot({ rootIds, extraObjects = [], schemas: givenSchemas, } = {}) {
+    static forRoot({ rootIds, extraObjects = [], schemas: givenSchemas, invite, } = {}) {
         // G-009 N4: a reserved operation principal is never a root, whatever variable `rootIds` came from.
         (0, guard_1.assertNoReservedRootId)(rootIds);
+        // G-010 T9: invite settings, read ONCE (boot); a bad value refuses boot naming the variable.
+        const inviteConfig = (0, invite_config_js_1.loadInviteConfig)(invite, process.env);
         // The framework database names, resolved ONCE (boot) for every SQL path built below.
         // Caller-supplied names are checked before any SQL is built (fail closed, Shield #1).
         const schemas = givenSchemas !== undefined
@@ -704,6 +713,29 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 catalog_bootstrap_provider_js_1.CatalogBootstrapProvider,
                 // Stored files (file-storage Phase 5): the request-principal RecordsService + the guard's
                 // object store (`null`/absent ⇒ every method answers 501) + the file_access audit bridge.
+                // G-010 T9 (P-5): the invite, its settings, its audit writer and its two Redis limiters
+                // (built by guard's SHIELD_ATTEMPT_LIMITER_FACTORY over guard's one Redis client; `null`
+                // without auth, and InviteService then refuses invites with 503: fail closed).
+                invite_service_js_1.InviteService,
+                { provide: invite_tokens_js_1.IDENTITY_INVITE_CONFIG, useValue: inviteConfig },
+                // `user.invited` / `user.invite_throttled`: the same audit-schema writer over the shared
+                // authz pool as `file_access` (one sink, no new one; best-effort in InviteService).
+                { provide: invite_tokens_js_1.IDENTITY_INVITE_AUDIT, useValue: filesAudit },
+                {
+                    provide: invite_tokens_js_1.IDENTITY_INVITE_LIMITERS,
+                    // Guard's limiter factory over its own Redis (G-010 P-5); absent (auth off) ⇒ null, and
+                    // the invite fails closed (503) rather than running unthrottled.
+                    useFactory: (makeLimiter) => makeLimiter
+                        ? {
+                            user: makeLimiter({ maxAttempts: invite_service_js_1.INVITES_PER_USER, windowMs: invite_service_js_1.INVITE_WINDOW_MS }),
+                            admin: makeLimiter({
+                                maxAttempts: inviteConfig.perAdminPerHour,
+                                windowMs: invite_service_js_1.INVITE_WINDOW_MS,
+                            }),
+                        }
+                        : null,
+                    inject: [{ token: internal_1.SHIELD_ATTEMPT_LIMITER_FACTORY, optional: true }],
+                },
                 {
                     provide: files_service_js_1.FilesService,
                     useFactory: (records, store) => new files_service_js_1.FilesService(records, store ?? null, filesAudit),

package/dist/features/org-bootstrap/run-org-bootstrap.d.ts

@@ -19,6 +19,14 @@ export interface RunOrgBootstrapOptions {
     linkTtlHours?: number;
     /** Print links although stdout is not a terminal. */
     linksToStdout?: boolean;
+    /**
+     * G-010 R12: email each link through the message dispatcher (purpose `invite`) instead of printing
+     * it. Needs a bound dispatcher with mail on (`ShieldModule.forRoot({ emailSender })`), else the run
+     * is refused before any write. A link that cannot be sent is killed and not printed. ROOT links
+     * are never emailed (a root link is a platform takeover): they print under the G-009 rule (a
+     * terminal, or `linksToStdout`), else they are not issued and are reported as not delivered.
+     */
+    emailLinks?: boolean;
     isTTY?: boolean;
     /** Seconds to wait for the run lock (default 30). */
     lockTimeoutSeconds?: number;
@@ -35,6 +43,17 @@ export interface OrgBootstrapReport {
     written: OrgBootstrapWritten;
     /** Set-password links issued. */
     links: number;
+    /**
+     * With `emailLinks`: links emailed, and links not delivered (a failed send, killed; or a root
+     * link with no terminal to print it on, never issued). Nothing undelivered is printed.
+     */
+    linksEmailed: number;
+    linksNotEmailed: number;
+    /**
+     * With `emailLinks`: root links printed to the terminal instead. A root link is a platform
+     * takeover, so it is never emailed; it follows the G-009 print rule.
+     */
+    linksPrintedRoots: number;
     /** Uuid of every root in the file that exists after the run. */
     rootIds: string[];
 }

package/dist/features/org-bootstrap/run-org-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-org-bootstrap.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/run-org-bootstrap.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,uBAAuB,EAAQ,MAAM,gBAAgB,CAAC;AA4BpE,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAEL,KAAK,OAAO,EAIb,MAAM,yBAAyB,CAAC;AAiBjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,MAAM,WAAW,sBAAsB;IACrC,yDAAyD;IACzD,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wGAAwG;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,OAAO,EAAE,mBAAmB,CAAC;IAC7B,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAwFD,wBAAsB,eAAe,CACnC,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CA8mB7B"}
+{"version":3,"file":"run-org-bootstrap.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/run-org-bootstrap.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,uBAAuB,EAAQ,MAAM,gBAAgB,CAAC;AA+BpE,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAEL,KAAK,OAAO,EAIb,MAAM,yBAAyB,CAAC;AAiBjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,MAAM,WAAW,sBAAsB;IACrC,yDAAyD;IACzD,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wGAAwG;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,OAAO,EAAE,mBAAmB,CAAC;IAC7B,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAwFD,wBAAsB,eAAe,CACnC,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAqtB7B"}

package/dist/features/org-bootstrap/run-org-bootstrap.js

@@ -31,6 +31,7 @@ const role_owner_transition_js_1 = require("../role/role-owner-transition.js");
 const role_service_js_1 = require("../role/role.service.js");
 const credential_provisioner_token_js_1 = require("../user/credential-provisioner.token.js");
 const user_service_js_1 = require("../user/user.service.js");
+const invite_message_js_1 = require("../user/invite-message.js");
 const org_bootstrap_file_js_1 = require("./org-bootstrap-file.js");
 const org_bootstrap_error_js_1 = require("./org-bootstrap-error.js");
 const org_bootstrap_plan_js_1 = require("./org-bootstrap-plan.js");
@@ -105,6 +106,7 @@ async function runOrgBootstrap(app, opts) {
     let provisioner;
     let grantAdmin;
     let tokenStore;
+    let dispatcher;
     try {
         pool = app.get(org_bootstrap_tokens_js_1.IDENTITY_AUTHZ_POOL, { strict: false });
         schemas = app.get(framework_schemas_token_js_1.IDENTITY_FRAMEWORK_SCHEMAS, { strict: false });
@@ -118,6 +120,18 @@ async function runOrgBootstrap(app, opts) {
     catch {
         throw new org_bootstrap_error_js_1.OrgBootstrapError('not_wired', 'IdentityFeatureModule is not available in this application: wire IdentityFeatureModule.forRoot(...) and ShieldModule (auth enabled) into the AppModule this script creates.');
     }
+    // G-010 R12: --email-links needs a dispatcher that can deliver; refused before any read or write.
+    if (opts.emailLinks === true) {
+        try {
+            dispatcher = app.get(guard_1.SHIELD_MESSAGE_DISPATCHER, { strict: false });
+        }
+        catch {
+            dispatcher = undefined;
+        }
+        if (dispatcher?.emailEnabled !== true) {
+            throw new org_bootstrap_error_js_1.OrgBootstrapError('not_wired', "--email-links needs emailSender configured: pass ShieldModule.forRoot({ emailSender: 'env' }) (or your own sender) with auth enabled, or run without --email-links to print the links.");
+        }
+    }
     const catalog = await grantAdmin.listCatalog();
     const file = (0, org_bootstrap_file_js_1.parseOrgBootstrapFile)(loadFile(opts.file), {
         grantableKeys: new Set([...catalog.catalog.map((r) => r.key), ...catalog.wildcards]),
@@ -141,7 +155,16 @@ async function runOrgBootstrap(app, opts) {
             if (id !== undefined)
                 rootIds.push(id);
         }
-        return { applied: false, plan, written: {}, links: 0, rootIds };
+        return {
+            applied: false,
+            plan,
+            written: {},
+            links: 0,
+            linksEmailed: 0,
+            linksNotEmailed: 0,
+            linksPrintedRoots: 0,
+            rootIds,
+        };
     }
     // ---- checks that need no state ----
     const operator = (opts.operator ?? '').trim() || (env.ASTRAM_BOOTSTRAP_OPERATOR ?? '').trim();
@@ -232,7 +255,9 @@ async function runOrgBootstrap(app, opts) {
         let linkBase = '';
         if (mayIssueLinks) {
             linkBase = (0, set_password_links_js_1.resolveSetPasswordBase)(env);
-            if (opts.isTTY === undefined ? process.stdout.isTTY !== true : !opts.isTTY) {
+            // Emailed links are never printed, so they need no terminal.
+            if (dispatcher === undefined &&
+                (opts.isTTY === undefined ? process.stdout.isTTY !== true : !opts.isTTY)) {
                 if (opts.linksToStdout !== true) {
                     throw new org_bootstrap_error_js_1.OrgBootstrapError('links_need_terminal', 'Set-password links are printed only to a terminal; pass --links-to-stdout to print them anyway.');
                 }
@@ -537,35 +562,87 @@ async function runOrgBootstrap(app, opts) {
         });
         // 7. set-password links, after every other write
         let links = 0;
+        let linksEmailed = 0;
+        let linksNotEmailed = 0;
+        let linksPrintedRoots = 0;
         if (mayIssueLinks) {
             await step(STEP.users, async () => {
                 const targets = [];
-                const consider = async (username, companyPath) => {
+                const rootTargets = [];
+                // The stored (canonical) address the link is mailed to, never the file's spelling of it.
+                const emailOf = (username) => {
+                    if (dispatcher === undefined)
+                        return {};
+                    const fileEmail = fileEmailOf(username);
+                    return fileEmail === undefined ? {} : { email: hintFor(username, fileEmail) };
+                };
+                const consider = async (username, companyPath, into = targets) => {
                     const fresh = lockedNow.get((0, org_names_js_1.nameKey)(username));
                     if (fresh !== undefined) {
-                        targets.push({ username, ...fresh, invalidateFirst: false });
+                        into.push({ username, ...fresh, invalidateFirst: false, ...emailOf(username) });
                     }
                     else if (opts.reissueLinks === true && lockedInState(username)) {
-                        targets.push({
+                        into.push({
                             username,
                             principalId: await ids.user(username),
                             tenantId: await ids.company(companyPath),
                             invalidateFirst: true,
+                            ...emailOf(username),
                         });
                     }
                 };
-                for (const r of file.roots)
-                    await consider(r.username, r.homeCompany);
+                // A root link is a platform takeover: with --email-links it is never emailed. It follows
+                // the G-009 print rule (a terminal, or --links-to-stdout); otherwise it is not issued.
+                for (const r of file.roots) {
+                    await consider(r.username, r.homeCompany, dispatcher === undefined ? targets : rootTargets);
+                }
                 for (const u of flat.users)
                     await consider(u.username, u.company);
-                links = await (0, set_password_links_js_1.issueSetPasswordLinks)({
+                const mail = dispatcher;
+                const audit = (target, expiresAtMs) => auditOn((sql, params) => pool.query(sql, params), target.tenantId, 'credential.setup_link_issued', STEP.users, { userUuid: target.principalId, expiresAtMs });
+                if (rootTargets.length > 0) {
+                    const printable = opts.linksToStdout === true ||
+                        (opts.isTTY === undefined ? process.stdout.isTTY === true : opts.isTTY);
+                    if (printable) {
+                        const printed = await (0, set_password_links_js_1.issueSetPasswordLinks)({
+                            store: tokenStore,
+                            targets: rootTargets,
+                            base: linkBase,
+                            ttlHours,
+                            out,
+                            audit,
+                        });
+                        links += printed.issued;
+                        linksPrintedRoots = printed.issued;
+                    }
+                    else {
+                        for (const target of rootTargets) {
+                            linksNotEmailed += 1;
+                            out(`${target.username}  root set-password link not printed: root links are never emailed ` +
+                                'and print only to a terminal. Re-run on a terminal with --reissue-links ' +
+                                '(or with --reissue-links --links-to-stdout, without --email-links).');
+                        }
+                    }
+                }
+                const result = await (0, set_password_links_js_1.issueSetPasswordLinks)({
                     store: tokenStore,
                     targets,
                     base: linkBase,
                     ttlHours,
                     out,
-                    audit: (target, expiresAtMs) => auditOn((sql, params) => pool.query(sql, params), target.tenantId, 'credential.setup_link_issued', STEP.users, { userUuid: target.principalId, expiresAtMs }),
+                    ...(mail !== undefined
+                        ? {
+                            deliver: async (target, link) => {
+                                const outcome = await mail.sendEmail('invite', (0, invite_message_js_1.inviteMessage)(target.email, link, ttlHours), { actorId: org_bootstrap_manifest_js_1.ORG_BOOTSTRAP_PRINCIPAL_ID, tenantId: target.tenantId });
+                                return outcome.status === 'sent';
+                            },
+                        }
+                        : {}),
+                    audit,
                 });
+                links += result.issued;
+                linksEmailed = result.emailed;
+                linksNotEmailed += result.notEmailed;
             });
         }
         // 8. root wiring (R9): print each root's uuid and the line to set
@@ -579,7 +656,16 @@ async function runOrgBootstrap(app, opts) {
         }
         if (rootIds.length > 0)
             out(`SHIELD_ROOT_IDS=${rootIds.join(',')}`);
-        return { applied: true, plan, written, links, rootIds };
+        return {
+            applied: true,
+            plan,
+            written,
+            links,
+            linksEmailed,
+            linksNotEmailed,
+            linksPrintedRoots,
+            rootIds,
+        };
         // ----- raw writes allowed by the spec (R5, R13), both under the run lock and audited -----
         async function inTransaction(work) {
             const conn = await pool.getConnection();

package/dist/features/org-bootstrap/set-password-links.d.ts

@@ -15,7 +15,11 @@ export interface LinkTarget {
     tenantId: string;
     /** Existing user whose earlier unused tokens must die first. */
     invalidateFirst: boolean;
+    /** The stored (canonical) address; required when the links are emailed. */
+    email?: string;
 }
+/** Emails one link (G-010 `--email-links`); `true` when the provider accepted it. Never throws. */
+export type LinkDelivery = (target: LinkTarget, link: string) => Promise<boolean>;
 export interface IssueLinksInput {
     store: ResetTokenStore;
     targets: readonly LinkTarget[];
@@ -24,7 +28,15 @@ export interface IssueLinksInput {
     out: (line: string) => void;
     /** Writes the `credential.setup_link_issued` audit row (user and expiry only). */
     audit: (target: LinkTarget, expiresAtMs: number) => Promise<void>;
+    /** Email the links instead of printing them (G-010 R12). */
+    deliver?: LinkDelivery;
 }
-/** Issue one token per target and print its link once. Returns how many were issued. */
-export declare function issueSetPasswordLinks(input: IssueLinksInput): Promise<number>;
+export interface IssuedLinks {
+    issued: number;
+    /** With `deliver`: links the provider accepted, and links that could not be sent (killed). */
+    emailed: number;
+    notEmailed: number;
+}
+/** Issue one token per target; print its link once, or email it with `deliver`. */
+export declare function issueSetPasswordLinks(input: IssueLinksInput): Promise<IssuedLinks>;
 //# sourceMappingURL=set-password-links.d.ts.map

package/dist/features/org-bootstrap/set-password-links.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-password-links.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/set-password-links.ts"],"names":[],"mappings":"AAMA,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAG9E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAGzC,6BAA6B;AAC7B,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ1D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAarE;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,kFAAkF;IAClF,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,wFAAwF;AACxF,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBnF"}
+{"version":3,"file":"set-password-links.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/set-password-links.ts"],"names":[],"mappings":"AAQA,OAAO,EAAsC,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAGzF,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAGzC,6BAA6B;AAC7B,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ1D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAarE;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,eAAe,EAAE,OAAO,CAAC;IACzB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mGAAmG;AACnG,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAElF,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,kFAAkF;IAClF,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,4DAA4D;IAC5D,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAoCxF"}

package/dist/features/org-bootstrap/set-password-links.js

@@ -7,7 +7,9 @@ exports.issueSetPasswordLinks = issueSetPasswordLinks;
 /**
  * One-time set-password links (G-009 R8): the same token mechanism as forgot-password (32 random bytes,
  * stored only as sha256 in the reset token store, per-row expiry), printed once to the operator's
- * terminal. A token or link never reaches the audit row, the report or an error.
+ * terminal, or (G-010 R12, `--email-links`) emailed through the message dispatcher instead and never
+ * printed. Links carry `&purpose=invite` (G-010 R11: wording on the reset page only; redemption
+ * ignores it). A token or link never reaches the audit row, the report or an error.
  */
 const node_crypto_1 = require("node:crypto");
 const guard_1 = require("@astram/guard");
@@ -38,9 +40,11 @@ function resolveSetPasswordBase(env) {
         throw new org_bootstrap_error_js_1.OrgBootstrapError('link_base_url', 'RESET_LINK_BASE_URL must be set to a public http(s) URL (not localhost) outside development/test.');
     }
 }
-/** Issue one token per target and print its link once. Returns how many were issued. */
+/** Issue one token per target; print its link once, or email it with `deliver`. */
 async function issueSetPasswordLinks(input) {
     let issued = 0;
+    let emailed = 0;
+    let notEmailed = 0;
     for (const target of input.targets) {
         if (target.invalidateFirst)
             await input.store.invalidateAllForPrincipal(target.principalId);
@@ -48,8 +52,25 @@ async function issueSetPasswordLinks(input) {
         const expiresAtMs = Date.now() + input.ttlHours * HOUR_MS;
         await input.store.issue(target.principalId, (0, node_crypto_1.createHash)('sha256').update(raw).digest('hex'), expiresAtMs);
         await input.audit(target, expiresAtMs);
-        input.out(`${target.username}  ${input.base}?token=${raw}  (expires ${new Date(expiresAtMs).toISOString()})`);
         issued += 1;
+        const link = `${input.base}?token=${raw}&purpose=invite`;
+        const expires = new Date(expiresAtMs).toISOString();
+        if (input.deliver === undefined) {
+            input.out(`${target.username}  ${link}  (expires ${expires})`);
+            continue;
+        }
+        const masked = (0, guard_1.maskEmail)(target.email ?? '');
+        if (target.email !== undefined && target.email !== '' && (await input.deliver(target, link))) {
+            emailed += 1;
+            input.out(`${target.username}  set-password link emailed to ${masked}  (expires ${expires})`);
+        }
+        else {
+            // Nobody holds this link: kill it; the operator re-runs with --reissue-links.
+            await input.store.invalidateAllForPrincipal(target.principalId);
+            notEmailed += 1;
+            input.out(`${target.username}  set-password link could not be emailed to ${masked}; nothing printed. ` +
+                'Re-run with --reissue-links to send a fresh one.');
+        }
     }
-    return issued;
+    return { issued, emailed, notEmailed };
 }

package/dist/features/user/invite-message.d.ts

@@ -0,0 +1,8 @@
+/**
+ * G-010 T9 (R9, R11): the invite email. The link is HTML-escaped in the HTML part (guard's
+ * escaper is internal to guard, so a local one with the same rule plus `'`); the text part carries
+ * the plain link. Only the link and its lifetime appear: no other user data.
+ */
+import type { EmailMessage } from '@astram/core';
+export declare function inviteMessage(to: string, link: string, ttlHours: number): EmailMessage;
+//# sourceMappingURL=invite-message.d.ts.map

package/dist/features/user/invite-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-message.d.ts","sourceRoot":"","sources":["../../../src/features/user/invite-message.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAWjD,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,CAWtF"}

package/dist/features/user/invite-message.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inviteMessage = inviteMessage;
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+function inviteMessage(to, link, ttlHours) {
+    const lifetime = `${ttlHours} ${ttlHours === 1 ? 'hour' : 'hours'}`;
+    const intro = 'You have been invited. Set your password to sign in:';
+    const expiry = `This link works once and expires in ${lifetime}.`;
+    const safe = escapeHtml(link);
+    return {
+        to,
+        subject: 'Set your password',
+        text: `${intro} ${link}\n\n${expiry}`,
+        html: `<p>${escapeHtml(intro)} <a href="${safe}">${safe}</a></p><p>${escapeHtml(expiry)}</p>`,
+    };
+}

package/dist/features/user/invite.config.d.ts

@@ -0,0 +1,15 @@
+export interface InviteOptions {
+    /** Return the link in the invite response (once, never readable again). Default false. */
+    returnLinkToAdmin?: boolean;
+}
+export interface InviteConfig {
+    readonly returnLinkToAdmin: boolean;
+    readonly ttlHours: number;
+    readonly perAdminPerHour: number;
+    /** The reset page base, or `null` when it cannot be used (the invite answers 501). */
+    readonly linkBase: string | null;
+}
+export declare const DEFAULT_INVITE_LINK_TTL_HOURS = 72;
+export declare const DEFAULT_INVITE_RATE_PER_ADMIN = 30;
+export declare function loadInviteConfig(options?: InviteOptions, env?: NodeJS.ProcessEnv): InviteConfig;
+//# sourceMappingURL=invite.config.d.ts.map

package/dist/features/user/invite.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.config.d.ts","sourceRoot":"","sources":["../../../src/features/user/invite.config.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,aAAa;IAC5B,0FAA0F;IAC1F,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAChD,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAWhD,wBAAgB,gBAAgB,CAC9B,OAAO,GAAE,aAAkB,EAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,YAAY,CAoCd"}

package/dist/features/user/invite.config.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_INVITE_RATE_PER_ADMIN = exports.DEFAULT_INVITE_LINK_TTL_HOURS = void 0;
+exports.loadInviteConfig = loadInviteConfig;
+/**
+ * G-010 T9 (R11, P-4, P-5): invite configuration, read ONCE by `IdentityFeatureModule.forRoot`.
+ *
+ *  - `INVITE_LINK_TTL_HOURS`: link lifetime, whole hours 1 to 168 (default 72; the G-009 rule).
+ *  - `INVITE_RATE_PER_ADMIN`: invites one administrator may send per 60 minutes, 1 to 1000
+ *    (default 30).
+ *  - The link base follows forgot-password's `RESET_LINK_BASE_URL` rule (G-009
+ *    `resolveSetPasswordBase`). When it cannot be resolved the invite answers 501, unless the app
+ *    opted into `returnLinkToAdmin`, which then refuses boot (it promised a usable link).
+ *
+ * A bad value refuses boot with an error naming the variable, never echoing the value.
+ */
+const set_password_links_js_1 = require("../org-bootstrap/set-password-links.js");
+exports.DEFAULT_INVITE_LINK_TTL_HOURS = 72;
+exports.DEFAULT_INVITE_RATE_PER_ADMIN = 30;
+const MAX_INVITE_RATE_PER_ADMIN = 1000;
+function wholeNumber(raw, name, fallback) {
+    if (raw === undefined)
+        return fallback;
+    if (!/^\d+$/.test(raw)) {
+        throw new Error(`${name} must be a plain positive whole number.`);
+    }
+    return Number(raw);
+}
+function loadInviteConfig(options = {}, env = process.env) {
+    const ttlRaw = wholeNumber(env.INVITE_LINK_TTL_HOURS, 'INVITE_LINK_TTL_HOURS', exports.DEFAULT_INVITE_LINK_TTL_HOURS);
+    let ttlHours;
+    try {
+        ttlHours = (0, set_password_links_js_1.validateLinkTtlHours)(ttlRaw);
+    }
+    catch {
+        throw new Error('INVITE_LINK_TTL_HOURS must be 1 to 168 whole hours.');
+    }
+    const perAdminPerHour = wholeNumber(env.INVITE_RATE_PER_ADMIN, 'INVITE_RATE_PER_ADMIN', exports.DEFAULT_INVITE_RATE_PER_ADMIN);
+    if (perAdminPerHour < 1 || perAdminPerHour > MAX_INVITE_RATE_PER_ADMIN) {
+        throw new Error(`INVITE_RATE_PER_ADMIN must be 1 to ${MAX_INVITE_RATE_PER_ADMIN}.`);
+    }
+    const returnLinkToAdmin = options.returnLinkToAdmin === true;
+    let linkBase;
+    try {
+        linkBase = (0, set_password_links_js_1.resolveSetPasswordBase)(env);
+    }
+    catch (err) {
+        if (returnLinkToAdmin) {
+            throw new Error('IdentityFeatureModule.forRoot({ invite: { returnLinkToAdmin: true } }): ' +
+                (err instanceof Error ? err.message : 'RESET_LINK_BASE_URL is not usable.'));
+        }
+        linkBase = null;
+    }
+    return { returnLinkToAdmin, ttlHours, perAdminPerHour, linkBase };
+}

package/dist/features/user/invite.service.d.ts

@@ -0,0 +1,62 @@
+import { RecordsService } from '@astram/engine';
+import type { AuditEvent, Principal } from '@astram/core';
+import { type CredentialProvisioner, type MessageDispatcher, type ResetTokenStore } from '@astram/guard';
+import { GrantCeiling } from '../authz/grant-ceiling.js';
+import type { InviteConfig } from './invite.config.js';
+/**
+ * The slice of guard's `AttemptLimiter` the invite uses: `consume` is one atomic Lua step
+ * (`ATTEMPT_CONSUME_SCRIPT`: INCR, window TTL armed on the first hit and re-armed when the key has
+ * none) that answers whether this reservation is within the budget. It REJECTS when Redis cannot
+ * answer (`AttemptLimiterUnavailableError`); the invite then proceeds (fail open, P-5).
+ */
+export interface InviteLimiter {
+    consume(key: string): Promise<{
+        readonly allowed: boolean;
+        readonly count: number;
+    }>;
+}
+export interface InviteLimiters {
+    readonly user: InviteLimiter;
+    readonly admin: InviteLimiter;
+}
+export interface InviteAuditWriter {
+    record(event: AuditEvent): Promise<void>;
+}
+/** The route's response. `link` only when the app opted into `returnLinkToAdmin`. */
+export interface InviteResult {
+    emailed: boolean;
+    link?: string;
+}
+/** Invites per invited user per window (matches forgot-password's per-account limit). */
+export declare const INVITES_PER_USER = 3;
+export declare const INVITE_WINDOW_MS = 3600000;
+export declare class InviteService {
+    private readonly records;
+    private readonly ceiling;
+    private readonly config;
+    private readonly limiters?;
+    private readonly audit?;
+    private readonly resetTokens?;
+    private readonly provisioner?;
+    private readonly dispatcher?;
+    private readonly logger;
+    constructor(records: RecordsService, ceiling: GrantCeiling, config: InviteConfig, limiters?: (InviteLimiters | null) | undefined, audit?: (InviteAuditWriter | null) | undefined, resetTokens?: (ResetTokenStore | null) | undefined, provisioner?: (CredentialProvisioner | null) | undefined, dispatcher?: (MessageDispatcher | null) | undefined);
+    invite(actor: Principal, uuid: string): Promise<InviteResult>;
+    /** Only a locked credential with an email can be invited; otherwise 409 with the reason. */
+    private assertInvitable;
+    /** Reserve one slot; `false` = over the budget. A limiter that cannot answer fails open (P-5). */
+    private reserve;
+    /**
+     * Burn this invite's own token (the store's single-use consume of exactly that hash). A token a
+     * newer invite already invalidated is simply not found. A store error is logged, not thrown: the
+     * caller still answers 503 and nobody holds the link.
+     */
+    private burn;
+    private throttled;
+    /**
+     * Writes one audit row; never throws. Returns whether the row was written (`false` when no
+     * writer is wired or the sink failed), so the link-return path can fail closed on it.
+     */
+    private record;
+}
+//# sourceMappingURL=invite.service.d.ts.map

package/dist/features/user/invite.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/invite.service.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAOzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQvD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,gBAAgB,UAAY,CAAC;AAW1C,qBACa,aAAa;IAItB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACQ,OAAO,CAAC,QAAQ,CAAC,MAAM;IAGvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACiB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAGlE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAG7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAG7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAlB9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;gBAGtC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EACW,MAAM,EAAE,YAAY,EAGpD,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EACW,KAAK,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAG3E,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAGpC,WAAW,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAG1C,UAAU,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAGlD,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAqGnE,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAKvB,kGAAkG;YACpF,OAAO;IASrB;;;;OAIG;YACW,IAAI;YAQJ,SAAS;IAKvB;;;OAGG;YACW,MAAM;CAuBrB"}