@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/entities/user-attribute/schema.mjs

@@ -0,0 +1,47 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/user-attribute/schema.ts
+const schemaMapping = {
+	user: EntityType.USER,
+	realm: EntityType.REALM
+};
+const userAttributeSchema = defineSchema({
+	name: EntityType.USER_ATTRIBUTE,
+	fields: { default: [
+		"id",
+		"name",
+		"value",
+		"userId",
+		"realmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	filters: { allowed: [
+		"id",
+		"name",
+		"userId",
+		"realmId"
+	] },
+	relations: {
+		allowed: ["user", "realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"id",
+		"name",
+		"userId",
+		"realmId",
+		"createdAt",
+		"updatedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { userAttributeSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/user-attribute/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","realm","REALM","userAttributeSchema","name","USER_ATTRIBUTE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-attribute/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, realm: EntityType.REALM };\n\nexport const userAttributeSchema = defineSchema<UserAttribute>({\n    name: EntityType.USER_ATTRIBUTE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'userId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'userId', 'realmId'] },\n    relations: { allowed: ['user', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: {\n        allowed: [\n            'id',\n            'name',\n            'userId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,sBAAsBR,aAA4B;CAC3DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAM;EAAQ;EAAU;GAAW;CACxDC,WAAW;EAAED,SAAS,CAAC,QAAQ,OAAA;EAAUE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC1Fc,MAAM,EACFH,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;GAER;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/user-attribute/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAElF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,wBAAwB,CAAC;IACrC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,qBAAsB,YAAW,qBAAqB;IAC5F,SAAS,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAEjC,GAAG,EAAE,2BAA2B;IAMtC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,aAAa,CAAC,CAAC;IAkCnD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAqBnB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAwDnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAuDnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;YAyBX,oBAAoB;CAuBrC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-attribute/service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAIlF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE,wBAAwB,CAAC;IACrC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,qBAAsB,YAAW,qBAAqB;IAC5F,SAAS,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAEjC,GAAG,EAAE,2BAA2B;IAMtC,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,aAAa,CAAC,CAAC;IA6DnD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAqBnB,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAwDnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAuDnB,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;YAyBX,oBAAoB;CAuBrC"}

package/dist/core/entities/user-attribute/service.mjs

@@ -1,10 +1,14 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { userAttributeSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import { PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, PermissionError, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityNotFoundError } from "@authup/errors";
+import { EntityNotFoundError, ValidationError } from "@authup/errors";
+import { eq, inArray, or } from "@rapiq/core";
 import { buildErrorMessageForAttribute } from "validup";
 //#region src/core/entities/user-attribute/service.ts
 var UserAttributeService = class extends AbstractEntityService {
@@ -17,7 +21,19 @@ var UserAttributeService = class extends AbstractEntityService {
 	}
 	async getMany(query, actor) {
 		await actor.permissionEvaluator.preEvaluateOneOf({ name: [PermissionName.USER_UPDATE, PermissionName.USER_SELF_MANAGE] });
-		const { data: entities, meta } = await this.repository.findMany(query);
+		const parsed = await decodeQuery(query, {
+			schema: userAttributeSchema,
+			actor
+		});
+		const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.USER_UPDATE });
+		if (compiled.verdict !== "post") {
+			const self = actor.identity && actor.identity.type === "user" ? eq("userId", actor.identity.data.id) : null;
+			let scoped = parsed;
+			if (compiled.verdict === "deny") scoped = appendQueryConditions(parsed, self ?? inArray("id", []));
+			else if (compiled.verdict === "conditional") scoped = appendQueryConditions(parsed, self ? or(self, compiled.condition) : compiled.condition);
+			return this.repository.findMany(scoped);
+		}
+		const { data: entities, meta } = await this.repository.findMany(parsed);
 		const data = [];
 		let { total } = meta;
 		for (const entity of entities) if (await this.canReadUserAttribute(actor, entity)) data.push(entity);
@@ -38,7 +54,7 @@ var UserAttributeService = class extends AbstractEntityService {
 		return entity;
 	}
 	async create(data, actor) {
-		const targetUserId = data.user_id || data.user && data.user.id;
+		const targetUserId = data.userId || data.user && data.user.id;
 		const isSelfTarget = !!actor.identity && actor.identity.type === "user" && (!targetUserId || targetUserId === actor.identity.data.id);
 		let isSelfFallback = false;
 		try {
@@ -49,12 +65,12 @@ var UserAttributeService = class extends AbstractEntityService {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });
 		}
 		await this.repository.validateJoinColumns(data);
-		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);
-		if (data.user) data.realm_id = data.user.realm_id;
+		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new ValidationError(`The user-attribute name '${data.name}' collides with a User entity column.`);
+		if (data.user) data.realmId = data.user.realmId;
 		else if (actor.identity && actor.identity.type === "user") {
-			data.user_id = actor.identity.data.id;
-			data.realm_id = actor.identity.data.realm_id;
-		} else throw new BadRequestError(buildErrorMessageForAttribute("user_id"));
+			data.userId = actor.identity.data.id;
+			data.realmId = actor.identity.data.realmId;
+		} else throw new ValidationError(buildErrorMessageForAttribute("userId"));
 		const entity = this.repository.create(data);
 		if (isSelfFallback) await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_SELF_MANAGE,
@@ -72,10 +88,10 @@ var UserAttributeService = class extends AbstractEntityService {
 	}
 	async update(id, data, actor) {
 		await this.repository.validateJoinColumns(data);
-		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);
+		if (typeof data.name === "string" && this.reservedNames.has(data.name)) throw new ValidationError(`The user-attribute name '${data.name}' collides with a User entity column.`);
 		let entity = await this.repository.findOneBy({ id });
 		if (!entity) throw new EntityNotFoundError();
-		const isSelfTarget = !!actor.identity && actor.identity.type === "user" && actor.identity.data.id === entity.user_id;
+		const isSelfTarget = !!actor.identity && actor.identity.type === "user" && actor.identity.data.id === entity.userId;
 		let isSelfFallback = false;
 		try {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });
@@ -84,9 +100,9 @@ var UserAttributeService = class extends AbstractEntityService {
 			isSelfFallback = true;
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });
 		}
-		delete data.user_id;
+		delete data.userId;
 		delete data.user;
-		delete data.realm_id;
+		delete data.realmId;
 		entity = this.repository.merge(entity, data);
 		if (isSelfFallback) await actor.permissionEvaluator.evaluate({
 			name: PermissionName.USER_SELF_MANAGE,
@@ -113,7 +129,7 @@ var UserAttributeService = class extends AbstractEntityService {
 		return entity;
 	}
 	async canReadUserAttribute(actor, entity) {
-		if (actor.identity && actor.identity.type === "user" && actor.identity.data.id === entity.user_id) return true;
+		if (actor.identity && actor.identity.type === "user" && actor.identity.data.id === entity.userId) return true;
 		try {
 			await actor.permissionEvaluator.evaluate({
 				name: PermissionName.USER_UPDATE,

package/dist/core/entities/user-attribute/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","BadRequestError","EntityNotFoundError","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","UserAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","data","entities","meta","findMany","total","entity","canRead","canReadUserAttribute","push","getOne","id","findOneBy","create","targetUserId","user_id","user","isSelfTarget","identity","type","isSelfFallback","preEvaluate","e","validateJoinColumns","has","realm_id","evaluate","ATTRIBUTES","value","resourceRealmMatch","save","update","merge","delete","entityId","remove","isMe"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { BadRequestError, EntityNotFoundError } from '@authup/errors';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\n\nexport type UserAttributeServiceContext = {\n    repository: IUserAttributeRepository;\n    reservedNames?: ReadonlySet<string>;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n    protected repository: IUserAttributeRepository;\n\n    protected reservedNames: ReadonlySet<string>;\n\n    constructor(ctx: UserAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.reservedNames = ctx.reservedNames ?? new Set();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(query);\n\n        const data: UserAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            const canRead = await this.canReadUserAttribute(actor, entity);\n            if (canRead) {\n                data.push(entity);\n            } else {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new PermissionError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        const targetUserId: string | undefined = data.user_id ||\n            (data.user && data.user.id);\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (!targetUserId || targetUserId === actor.identity.data.id);\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        if (data.user) {\n            data.realm_id = data.user.realm_id;\n        } else if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            data.user_id = actor.identity.data.id;\n            data.realm_id = actor.identity.data.realm_id;\n        } else {\n            throw new BadRequestError(buildErrorMessageForAttribute('user_id'));\n        }\n\n        const entity = this.repository.create(data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new BadRequestError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.user_id;\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        // An attribute belongs to a fixed user; its owner (and the user-derived realm_id) is\n        // IMMUTABLE on update — strip both from the body. This blocks a self-manage or admin\n        // caller from reassigning the attribute to another user (isSelfTarget was decided from\n        // the ORIGINAL owner), and blocks a caller-supplied realm_id that would gate USER_UPDATE\n        // against a realm of their choosing. To move an attribute, delete + recreate.\n        delete data.user_id;\n        delete data.user;\n        delete data.realm_id;\n\n        entity = this.repository.merge(entity, data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new PermissionError();\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    private async canReadUserAttribute(\n        actor: ActorContext,\n        entity: UserAttribute,\n    ): Promise<boolean> {\n        const isMe = actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.user_id;\n\n        if (isMe) {\n            return true;\n        }\n\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n\n            return true;\n        } catch {\n            return false;\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAqBA,IAAaQ,uBAAb,cAA0CD,sBAAAA;CAC5BE;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAM,EACFC,MAAMC,UACNC,SACA,MAAM,KAAKd,WAAWe,SAASV,KAAAA;EAEnC,MAAMO,OAAwB,CAAA;EAC9B,IAAI,EAAEI,UAAUF;EAEhB,KAAK,MAAMG,UAAUJ,UAEjB,IAAIK,MADkB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnDL,KAAKQ,KAAKH,MAAAA;OAEVD;EAIR,OAAO;GACHJ;GACAE,MAAM;IACF,GAAGA;IACHE;GACJ;EACJ;CACJ;CAEA,MAAMK,OACFC,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAId,IAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,OAAOyB;CACX;CAEA,MAAMO,OACFZ,MACAN,OACsB;EACtB,MAAMmB,eAAmCb,KAAKc,WACzCd,KAAKe,QAAQf,KAAKe,KAAKL;EAE5B,MAAMM,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,WACvB,CAACL,gBAAgBA,iBAAiBnB,MAAMuB,SAASjB,KAAKU;EAE3D,IAAIS,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAEA,MAAM,KAAKX,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAIf,gBAAgB,4BAA4BkB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIG,KAAKe,MACLf,KAAKwB,WAAWxB,KAAKe,KAAKS;OACvB,IACH9B,MAAMuB,YACNvB,MAAMuB,SAASC,SAAS,QAC1B;GACElB,KAAKc,UAAUpB,MAAMuB,SAASjB,KAAKU;GACnCV,KAAKwB,WAAW9B,MAAMuB,SAASjB,KAAKwB;EACxC,OACI,MAAM,IAAI1C,gBAAgBG,8BAA8B,SAAA,CAAA;EAG5D,MAAMoB,SAAS,KAAKjB,WAAWwB,OAAOZ,IAAAA;EAEtC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrBC,MAAMnB,iBAAiB,GAAGF,kBAAkB+C,aAAa,GAAG1B,KAAKH,OAAOG,KAAK2B,MAAM,EAAE,CAAA;EACzF,CAAA;OAEA,MAAMjC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGF,kBAAkB+C,aAAarB;IAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMyB,OACFpB,IACAV,MACAN,OACsB;EACtB,MAAM,KAAKN,WAAWkC,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKH,SAAS,YAAY,KAAKR,cAAckC,IAAIvB,KAAKH,IAAI,GACjE,MAAM,IAAIf,gBAAgB,4BAA4BkB,KAAKH,KAAK,sCAAsC;EAG1G,IAAIQ,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EAClD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAGd,MAAMiC,eAAe,CAAC,CAACtB,MAAMuB,YACzBvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS;EAEtC,IAAIK,iBAAiB;EACrB,IAAI;GACA,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAec,YAAY,CAAA;EACnF,SAASuB,GAAG;GACR,IAAI,CAACL,cACD,MAAMK;GAEVF,iBAAiB;GACjB,MAAMzB,MAAMC,oBAAoByB,YAAY,EAAEvB,MAAMb,eAAee,iBAAiB,CAAA;EACxF;EAOA,OAAOC,KAAKc;EACZ,OAAOd,KAAKe;EACZ,OAAOf,KAAKwB;EAEZnB,SAAS,KAAKjB,WAAW2C,MAAM1B,QAAQL,IAAAA;EAEvC,IAAImB,gBACA,MAAMzB,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAee;GACrBC,MAAMnB,iBAAiB,GAAGF,kBAAkB+C,aAAa,GAAGrB,OAAOR,OAAOQ,OAAOsB,MAAM,EAAE,CAAA;EAC7F,CAAA;OAEA,MAAMjC,MAAMC,oBAAoB8B,SAAS;GACrC5B,MAAMb,eAAec;GACrBE,MAAMnB,iBAAiB;KAAGF,kBAAkB+C,aAAarB;IAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAKjB,WAAWyC,KAAKxB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAM2B,OACFtB,IACAhB,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFb,eAAec,aACfd,eAAee,gBAAAA,EAEvB,CAAA;EAEA,MAAMM,SAAS,MAAM,KAAKjB,WAAWuB,UAAU,EAAED,GAAG,CAAA;EACpD,IAAI,CAACL,QACD,MAAM,IAAItB,oBAAAA;EAId,IAAI,CAACuB,MADiB,KAAKC,qBAAqBb,OAAOW,MAAAA,GAEnD,MAAM,IAAIzB,gBAAAA;EAGd,MAAM,EAAE8B,IAAIuB,aAAa5B;EACzB,MAAM,KAAKjB,WAAW8C,OAAO7B,MAAAA;EAC7BA,OAAOK,KAAKuB;EAEZ,OAAO5B;CACX;CAEA,MAAcE,qBACVb,OACAW,QACgB;EAKhB,IAJaX,MAAMuB,YACfvB,MAAMuB,SAASC,SAAS,UACxBxB,MAAMuB,SAASjB,KAAKU,OAAOL,OAAOS,SAGlC,OAAO;EAGX,IAAI;GACA,MAAMpB,MAAMC,oBAAoB8B,SAAS;IACrC5B,MAAMb,eAAec;IACrBE,MAAMnB,iBAAiB;MAAGF,kBAAkB+C,aAAarB;KAAQ,GAAG,KAAKuB,mBAAmBvB,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAEA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","PermissionError","definePolicyData","EntityNotFoundError","ValidationError","eq","inArray","or","PermissionName","buildErrorMessageForAttribute","AbstractEntityService","appendQueryConditions","decodeQuery","userAttributeSchema","UserAttributeService","repository","reservedNames","ctx","Set","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","USER_UPDATE","USER_SELF_MANAGE","parsed","schema","compiled","compile","verdict","self","identity","type","data","id","scoped","condition","findMany","entities","meta","total","entity","canRead","canReadUserAttribute","push","getOne","findOneBy","create","targetUserId","userId","user","isSelfTarget","isSelfFallback","preEvaluate","e","validateJoinColumns","has","realmId","evaluate","ATTRIBUTES","value","resourceRealmMatch","save","update","merge","delete","entityId","remove","isMe"],"sources":["../../../../src/core/entities/user-attribute/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, PermissionError, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { eq, inArray, or } from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { UserAttribute } from '@authup/core-kit';\nimport { buildErrorMessageForAttribute } from 'validup';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IUserAttributeRepository, IUserAttributeService } from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { userAttributeSchema } from './schema.ts';\n\nexport type UserAttributeServiceContext = {\n    repository: IUserAttributeRepository;\n    reservedNames?: ReadonlySet<string>;\n};\n\nexport class UserAttributeService extends AbstractEntityService implements IUserAttributeService {\n    protected repository: IUserAttributeRepository;\n\n    protected reservedNames: ReadonlySet<string>;\n\n    constructor(ctx: UserAttributeServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.reservedNames = ctx.reservedNames ?? new Set();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<UserAttribute>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const parsed = await decodeQuery(query, { schema: userAttributeSchema, actor });\n\n        // Compile the foreign-row gate into a row condition (#3286 phase 3),\n        // mirroring canReadUserAttribute: own rows (the actor's userId) are\n        // always readable, foreign rows require USER_UPDATE. USER_SELF_MANAGE\n        // is deliberately not compiled — its ATTRIBUTE_NAMES denylist policy is\n        // non-lowerable, and the self leg is the ownership term anyway. A\n        // non-expressible USER_UPDATE policy falls back to the per-row loop.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.USER_UPDATE });\n        if (compiled.verdict !== 'post') {\n            const self = actor.identity && actor.identity.type === 'user' ?\n                eq('userId', actor.identity.data.id) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, self ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    self ? or(self, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped);\n        }\n\n        const {\n            data: entities,\n            meta,\n        } = await this.repository.findMany(parsed);\n\n        const data: UserAttribute[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            const canRead = await this.canReadUserAttribute(actor, entity);\n            if (canRead) {\n                data.push(entity);\n            } else {\n                total--;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total,\n            },\n        };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new PermissionError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        const targetUserId: string | undefined = data.userId ||\n            (data.user && data.user.id);\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            (!targetUserId || targetUserId === actor.identity.data.id);\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new ValidationError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        if (data.user) {\n            data.realmId = data.user.realmId;\n        } else if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            data.userId = actor.identity.data.id;\n            data.realmId = actor.identity.data.realmId;\n        } else {\n            throw new ValidationError(buildErrorMessageForAttribute('userId'));\n        }\n\n        const entity = this.repository.create(data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [data.name]: data.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async update(\n        id: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await this.repository.validateJoinColumns(data);\n\n        if (typeof data.name === 'string' && this.reservedNames.has(data.name)) {\n            throw new ValidationError(`The user-attribute name '${data.name}' collides with a User entity column.`);\n        }\n\n        let entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const isSelfTarget = !!actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.userId;\n\n        let isSelfFallback = false;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_UPDATE });\n        } catch (e) {\n            if (!isSelfTarget) {\n                throw e;\n            }\n            isSelfFallback = true;\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.USER_SELF_MANAGE });\n        }\n\n        // An attribute belongs to a fixed user; its owner (and the user-derived realmId) is\n        // IMMUTABLE on update — strip both from the body. This blocks a self-manage or admin\n        // caller from reassigning the attribute to another user (isSelfTarget was decided from\n        // the ORIGINAL owner), and blocks a caller-supplied realmId that would gate USER_UPDATE\n        // against a realm of their choosing. To move an attribute, delete + recreate.\n        delete data.userId;\n        delete data.user;\n        delete data.realmId;\n\n        entity = this.repository.merge(entity, data);\n\n        if (isSelfFallback) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_SELF_MANAGE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { [entity.name]: entity.value } }),\n            });\n        } else {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        await this.repository.save(entity);\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<UserAttribute> {\n        await actor.permissionEvaluator.preEvaluateOneOf({\n            name: [\n                PermissionName.USER_UPDATE,\n                PermissionName.USER_SELF_MANAGE,\n            ],\n        });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const canRead = await this.canReadUserAttribute(actor, entity);\n        if (!canRead) {\n            throw new PermissionError();\n        }\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n\n    private async canReadUserAttribute(\n        actor: ActorContext,\n        entity: UserAttribute,\n    ): Promise<boolean> {\n        const isMe = actor.identity &&\n            actor.identity.type === 'user' &&\n            actor.identity.data.id === entity.userId;\n\n        if (isMe) {\n            return true;\n        }\n\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.USER_UPDATE,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n\n            return true;\n        } catch {\n            return false;\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAwBA,IAAac,uBAAb,cAA0CJ,sBAAAA;CAC5BK;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,MAAK;EACL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,gBAAgBC,IAAID,iCAAiB,IAAIE,IAAAA;CAClD;CAEA,MAAMC,QACFC,OACAC,OACsD;EACtD,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFhB,eAAeiB,aACfjB,eAAekB,gBAAAA,EAEvB,CAAA;EAEA,MAAMC,SAAS,MAAMf,YAAYQ,OAAO;GAAEQ,QAAQf;GAAqBQ;EAAM,CAAA;EAQ7E,MAAMQ,WAAW,MAAMR,MAAMC,oBAAoBQ,QAAQ,EAAEN,MAAMhB,eAAeiB,YAAY,CAAA;EAC5F,IAAII,SAASE,YAAY,QAAQ;GAC7B,MAAMC,OAAOX,MAAMY,YAAYZ,MAAMY,SAASC,SAAS,SACnD7B,GAAG,UAAUgB,MAAMY,SAASE,KAAKC,EAAE,IACnC;GAEJ,IAAIC,SAASV;GACb,IAAIE,SAASE,YAAY,QACrBM,SAAS1B,sBAAsBgB,QAAQK,QAAQ1B,QAAQ,MAAM,CAAA,CAAE,CAAA;QAC5D,IAAIuB,SAASE,YAAY,eAC5BM,SAAS1B,sBACLgB,QACAK,OAAOzB,GAAGyB,MAAMH,SAASS,SAAS,IAAIT,SAASS,SAAS;GAIhE,OAAO,KAAKvB,WAAWwB,SAASF,MAAAA;EACpC;EAEA,MAAM,EACFF,MAAMK,UACNC,SACA,MAAM,KAAK1B,WAAWwB,SAASZ,MAAAA;EAEnC,MAAMQ,OAAwB,CAAA;EAC9B,IAAI,EAAEO,UAAUD;EAEhB,KAAK,MAAME,UAAUH,UAEjB,IAAII,MADkB,KAAKC,qBAAqBxB,OAAOsB,MAAAA,GAEnDR,KAAKW,KAAKH,MAAAA;OAEVD;EAIR,OAAO;GACHP;GACAM,MAAM;IACF,GAAGA;IACHC;GACJ;EACJ;CACJ;CAEA,MAAMK,OACFX,IACAf,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFhB,eAAeiB,aACfjB,eAAekB,gBAAAA,EAEvB,CAAA;EAEA,MAAMiB,SAAS,MAAM,KAAK5B,WAAWiC,UAAU,EAAEZ,GAAG,CAAA;EACpD,IAAI,CAACO,QACD,MAAM,IAAIxC,oBAAAA;EAId,IAAI,CAACyC,MADiB,KAAKC,qBAAqBxB,OAAOsB,MAAAA,GAEnD,MAAM,IAAI1C,gBAAAA;EAGd,OAAO0C;CACX;CAEA,MAAMM,OACFd,MACAd,OACsB;EACtB,MAAM6B,eAAmCf,KAAKgB,UACzChB,KAAKiB,QAAQjB,KAAKiB,KAAKhB;EAE5B,MAAMiB,eAAe,CAAC,CAAChC,MAAMY,YACzBZ,MAAMY,SAASC,SAAS,WACvB,CAACgB,gBAAgBA,iBAAiB7B,MAAMY,SAASE,KAAKC;EAE3D,IAAIkB,iBAAiB;EACrB,IAAI;GACA,MAAMjC,MAAMC,oBAAoBiC,YAAY,EAAE/B,MAAMhB,eAAeiB,YAAY,CAAA;EACnF,SAAS+B,GAAG;GACR,IAAI,CAACH,cACD,MAAMG;GAEVF,iBAAiB;GACjB,MAAMjC,MAAMC,oBAAoBiC,YAAY,EAAE/B,MAAMhB,eAAekB,iBAAiB,CAAA;EACxF;EAEA,MAAM,KAAKX,WAAW0C,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKX,SAAS,YAAY,KAAKR,cAAc0C,IAAIvB,KAAKX,IAAI,GACjE,MAAM,IAAIpB,gBAAgB,4BAA4B+B,KAAKX,KAAK,sCAAsC;EAG1G,IAAIW,KAAKiB,MACLjB,KAAKwB,UAAUxB,KAAKiB,KAAKO;OACtB,IACHtC,MAAMY,YACNZ,MAAMY,SAASC,SAAS,QAC1B;GACEC,KAAKgB,SAAS9B,MAAMY,SAASE,KAAKC;GAClCD,KAAKwB,UAAUtC,MAAMY,SAASE,KAAKwB;EACvC,OACI,MAAM,IAAIvD,gBAAgBK,8BAA8B,QAAA,CAAA;EAG5D,MAAMkC,SAAS,KAAK5B,WAAWkC,OAAOd,IAAAA;EAEtC,IAAImB,gBACA,MAAMjC,MAAMC,oBAAoBsC,SAAS;GACrCpC,MAAMhB,eAAekB;GACrBS,MAAMjC,iBAAiB,GAAGF,kBAAkB6D,aAAa,GAAG1B,KAAKX,OAAOW,KAAK2B,MAAM,EAAE,CAAA;EACzF,CAAA;OAEA,MAAMzC,MAAMC,oBAAoBsC,SAAS;GACrCpC,MAAMhB,eAAeiB;GACrBU,MAAMjC,iBAAiB;KAAGF,kBAAkB6D,aAAalB;IAAQ,GAAG,KAAKoB,mBAAmBpB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAK5B,WAAWiD,KAAKrB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMsB,OACF7B,IACAD,MACAd,OACsB;EACtB,MAAM,KAAKN,WAAW0C,oBAAoBtB,IAAAA;EAE1C,IAAI,OAAOA,KAAKX,SAAS,YAAY,KAAKR,cAAc0C,IAAIvB,KAAKX,IAAI,GACjE,MAAM,IAAIpB,gBAAgB,4BAA4B+B,KAAKX,KAAK,sCAAsC;EAG1G,IAAImB,SAAS,MAAM,KAAK5B,WAAWiC,UAAU,EAAEZ,GAAG,CAAA;EAClD,IAAI,CAACO,QACD,MAAM,IAAIxC,oBAAAA;EAGd,MAAMkD,eAAe,CAAC,CAAChC,MAAMY,YACzBZ,MAAMY,SAASC,SAAS,UACxBb,MAAMY,SAASE,KAAKC,OAAOO,OAAOQ;EAEtC,IAAIG,iBAAiB;EACrB,IAAI;GACA,MAAMjC,MAAMC,oBAAoBiC,YAAY,EAAE/B,MAAMhB,eAAeiB,YAAY,CAAA;EACnF,SAAS+B,GAAG;GACR,IAAI,CAACH,cACD,MAAMG;GAEVF,iBAAiB;GACjB,MAAMjC,MAAMC,oBAAoBiC,YAAY,EAAE/B,MAAMhB,eAAekB,iBAAiB,CAAA;EACxF;EAOA,OAAOS,KAAKgB;EACZ,OAAOhB,KAAKiB;EACZ,OAAOjB,KAAKwB;EAEZhB,SAAS,KAAK5B,WAAWmD,MAAMvB,QAAQR,IAAAA;EAEvC,IAAImB,gBACA,MAAMjC,MAAMC,oBAAoBsC,SAAS;GACrCpC,MAAMhB,eAAekB;GACrBS,MAAMjC,iBAAiB,GAAGF,kBAAkB6D,aAAa,GAAGlB,OAAOnB,OAAOmB,OAAOmB,MAAM,EAAE,CAAA;EAC7F,CAAA;OAEA,MAAMzC,MAAMC,oBAAoBsC,SAAS;GACrCpC,MAAMhB,eAAeiB;GACrBU,MAAMjC,iBAAiB;KAAGF,kBAAkB6D,aAAalB;IAAQ,GAAG,KAAKoB,mBAAmBpB,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,MAAM,KAAK5B,WAAWiD,KAAKrB,MAAAA;EAE3B,OAAOA;CACX;CAEA,MAAMwB,OACF/B,IACAf,OACsB;EACtB,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAC7CC,MAAM,CACFhB,eAAeiB,aACfjB,eAAekB,gBAAAA,EAEvB,CAAA;EAEA,MAAMiB,SAAS,MAAM,KAAK5B,WAAWiC,UAAU,EAAEZ,GAAG,CAAA;EACpD,IAAI,CAACO,QACD,MAAM,IAAIxC,oBAAAA;EAId,IAAI,CAACyC,MADiB,KAAKC,qBAAqBxB,OAAOsB,MAAAA,GAEnD,MAAM,IAAI1C,gBAAAA;EAGd,MAAM,EAAEmC,IAAIgC,aAAazB;EACzB,MAAM,KAAK5B,WAAWsD,OAAO1B,MAAAA;EAC7BA,OAAOP,KAAKgC;EAEZ,OAAOzB;CACX;CAEA,MAAcE,qBACVxB,OACAsB,QACgB;EAKhB,IAJatB,MAAMY,YACfZ,MAAMY,SAASC,SAAS,UACxBb,MAAMY,SAASE,KAAKC,OAAOO,OAAOQ,QAGlC,OAAO;EAGX,IAAI;GACA,MAAM9B,MAAMC,oBAAoBsC,SAAS;IACrCpC,MAAMhB,eAAeiB;IACrBU,MAAMjC,iBAAiB;MAAGF,kBAAkB6D,aAAalB;KAAQ,GAAG,KAAKoB,mBAAmBpB,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAEA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}

package/dist/core/entities/user-authenticator/constants.d.ts

@@ -0,0 +1,26 @@
+export declare const USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX = "mfaAttempt";
+export declare const USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX = "mfaThrottle";
+export declare const USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX = "mfaVerifyLock";
+export declare const USER_AUTHENTICATOR_VERIFY_LOCK_TTL = 10000;
+export declare const USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL: number;
+/**
+ * Per-account exponential backoff for failed challenge codes:
+ * lock = min(MAX, FACTOR * 2^(n-1)) seconds after the n-th failure,
+ * reset on success. The counter itself expires after the window.
+ */
+export declare const USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR = 1;
+export declare const USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX = 300;
+export declare const USER_AUTHENTICATOR_ATTEMPT_WINDOW = 3600;
+export declare const USER_AUTHENTICATOR_TOTP_ALGORITHM = "SHA1";
+export declare const USER_AUTHENTICATOR_TOTP_DIGITS = 6;
+export declare const USER_AUTHENTICATOR_TOTP_PERIOD = 30;
+export declare const USER_AUTHENTICATOR_RECOVERY_CODE_COUNT = 10;
+export declare const USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX = "mfaEmailCode";
+export declare const USER_AUTHENTICATOR_EMAIL_CODE_LENGTH = 6;
+export declare const USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES = 10;
+export declare const USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX = "mfaEmailSend";
+export declare const USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN = 60;
+export declare const USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX = "mfaWebauthnReg";
+export declare const USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX = "mfaWebauthnAuth";
+export declare const USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW = 300;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/entities/user-authenticator/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/constants.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,uCAAuC,eAAe,CAAC;AACpE,eAAO,MAAM,wCAAwC,gBAAgB,CAAC;AAKtE,eAAO,MAAM,2CAA2C,kBAAkB,CAAC;AAC3E,eAAO,MAAM,kCAAkC,QAAS,CAAC;AACzD,eAAO,MAAM,6CAA6C,QAEzD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,IAAI,CAAC;AACxD,eAAO,MAAM,mCAAmC,MAAM,CAAC;AACvD,eAAO,MAAM,iCAAiC,OAAQ,CAAC;AAEvD,eAAO,MAAM,iCAAiC,SAAS,CAAC;AACxD,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAChD,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAEjD,eAAO,MAAM,sCAAsC,KAAK,CAAC;AAEzD,eAAO,MAAM,0CAA0C,iBAAiB,CAAC;AACzE,eAAO,MAAM,oCAAoC,IAAI,CAAC;AACtD,eAAO,MAAM,gDAAgD,KAAK,CAAC;AAKnE,eAAO,MAAM,0CAA0C,iBAAiB,CAAC;AACzE,eAAO,MAAM,sCAAsC,KAAK,CAAC;AAEzD,eAAO,MAAM,4CAA4C,mBAAmB,CAAC;AAC7E,eAAO,MAAM,6CAA6C,oBAAoB,CAAC;AAC/E,eAAO,MAAM,4CAA4C,MAAM,CAAC"}

package/dist/core/entities/user-authenticator/constants.mjs

@@ -0,0 +1,32 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/entities/user-authenticator/constants.ts
+const USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX = "mfaAttempt";
+const USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX = "mfaThrottle";
+const USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX = "mfaVerifyLock";
+const USER_AUTHENTICATOR_VERIFY_LOCK_TTL = 1e4;
+const USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL = Math.floor(USER_AUTHENTICATOR_VERIFY_LOCK_TTL / 3);
+/**
+* Per-account exponential backoff for failed challenge codes:
+* lock = min(MAX, FACTOR * 2^(n-1)) seconds after the n-th failure,
+* reset on success. The counter itself expires after the window.
+*/ const USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR = 1;
+const USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX = 300;
+const USER_AUTHENTICATOR_ATTEMPT_WINDOW = 3600;
+const USER_AUTHENTICATOR_TOTP_ALGORITHM = "SHA1";
+const USER_AUTHENTICATOR_TOTP_DIGITS = 6;
+const USER_AUTHENTICATOR_TOTP_PERIOD = 30;
+const USER_AUTHENTICATOR_RECOVERY_CODE_COUNT = 10;
+const USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX = "mfaEmailCode";
+const USER_AUTHENTICATOR_EMAIL_CODE_LENGTH = 6;
+const USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES = 10;
+const USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX = "mfaEmailSend";
+const USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN = 60;
+const USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX = "mfaWebauthnReg";
+const USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX = "mfaWebauthnAuth";
+const USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW = 300;
+//#endregion
+export { USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/entities/user-authenticator/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX","USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX","USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX","USER_AUTHENTICATOR_VERIFY_LOCK_TTL","USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL","Math","floor","USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR","USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX","USER_AUTHENTICATOR_ATTEMPT_WINDOW","USER_AUTHENTICATOR_TOTP_ALGORITHM","USER_AUTHENTICATOR_TOTP_DIGITS","USER_AUTHENTICATOR_TOTP_PERIOD","USER_AUTHENTICATOR_RECOVERY_CODE_COUNT","USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX","USER_AUTHENTICATOR_EMAIL_CODE_LENGTH","USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES","USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX","USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN","USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX","USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX","USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW"],"sources":["../../../../src/core/entities/user-authenticator/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n// Failed-attempt counter — a raw number bumped via the cache's atomic\n// increment, so concurrent failures (verify or confirm) never under-count\n// the exponential backoff. The lockout deadline lives under its own prefix.\nexport const USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX = 'mfaAttempt';\nexport const USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX = 'mfaThrottle';\n\n// Per-user renewable lock serializing concurrent verify critical sections so a\n// factor (recovery code / TOTP step) is consumed exactly once. The TTL bounds a\n// crashed request; the active owner renews its lease while verification runs.\nexport const USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX = 'mfaVerifyLock';\nexport const USER_AUTHENTICATOR_VERIFY_LOCK_TTL = 10_000;\nexport const USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL = Math.floor(\n    USER_AUTHENTICATOR_VERIFY_LOCK_TTL / 3,\n);\n\n/**\n * Per-account exponential backoff for failed challenge codes:\n * lock = min(MAX, FACTOR * 2^(n-1)) seconds after the n-th failure,\n * reset on success. The counter itself expires after the window.\n */\nexport const USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR = 1;\nexport const USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX = 300;\nexport const USER_AUTHENTICATOR_ATTEMPT_WINDOW = 3_600;\n\nexport const USER_AUTHENTICATOR_TOTP_ALGORITHM = 'SHA1';\nexport const USER_AUTHENTICATOR_TOTP_DIGITS = 6;\nexport const USER_AUTHENTICATOR_TOTP_PERIOD = 30;\n\nexport const USER_AUTHENTICATOR_RECOVERY_CODE_COUNT = 10;\n\nexport const USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX = 'mfaEmailCode';\nexport const USER_AUTHENTICATOR_EMAIL_CODE_LENGTH = 6;\nexport const USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES = 10;\n\n// Per-user cooldown between challenge-code emails (seconds). Bounds mail-capacity\n// abuse — an authenticated caller cannot spray unlimited OTP mails. Separate from\n// the verification backoff (which only tracks failed verifies, not sends).\nexport const USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX = 'mfaEmailSend';\nexport const USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN = 60;\n\nexport const USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX = 'mfaWebauthnReg';\nexport const USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX = 'mfaWebauthnAuth';\nexport const USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW = 300;\n"],"mappings":";;;;AAUA,MAAaA,0CAA0C;AACvD,MAAaC,2CAA2C;AAKxD,MAAaC,8CAA8C;AAC3D,MAAaC,qCAAqC;AAClD,MAAaC,gDAAgDC,KAAKC,MAC9DH,qCAAqC,CAAA;;;;;GAQzC,MAAaI,yCAAyC;AACtD,MAAaC,sCAAsC;AACnD,MAAaC,oCAAoC;AAEjD,MAAaC,oCAAoC;AACjD,MAAaC,iCAAiC;AAC9C,MAAaC,iCAAiC;AAE9C,MAAaC,yCAAyC;AAEtD,MAAaC,6CAA6C;AAC1D,MAAaC,uCAAuC;AACpD,MAAaC,mDAAmD;AAKhE,MAAaC,6CAA6C;AAC1D,MAAaC,yCAAyC;AAEtD,MAAaC,+CAA+C;AAC5D,MAAaC,gDAAgD;AAC7D,MAAaC,+CAA+C"}

package/dist/core/entities/user-authenticator/helpers.d.ts

@@ -0,0 +1,10 @@
+import { UserAuthenticatorKind } from '@authup/core-kit';
+export declare function generateRecoveryCode(): string;
+/**
+ * Classify a bare one-time code by shape: an all-digit token is a TOTP
+ * code, anything else (xxxxx-xxxxx) a recovery code. Used by the token
+ * endpoint's `otp` parameter, which carries no explicit kind.
+ */
+export declare function guessUserAuthenticatorKindByResponse(response: string): `${UserAuthenticatorKind}`;
+export declare function generateNumericCode(length: number): string;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/core/entities/user-authenticator/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAOzD,wBAAgB,oBAAoB,IAAI,MAAM,CAa7C;AAED;;;;GAIG;AACH,wBAAgB,oCAAoC,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAS1D"}

package/dist/core/entities/user-authenticator/helpers.mjs

@@ -0,0 +1,35 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { UserAuthenticatorKind } from "@authup/core-kit";
+import { getRandomValues } from "uncrypto";
+//#region src/core/entities/user-authenticator/helpers.ts
+const RECOVERY_CODE_ALPHABET = "23456789abcdefghjkmnpqrstuvwxyz";
+const RECOVERY_CODE_GROUP_LENGTH = 5;
+function generateRecoveryCode() {
+	const size = RECOVERY_CODE_GROUP_LENGTH * 2;
+	const bytes = getRandomValues(new Uint8Array(size));
+	let output = "";
+	for (let i = 0; i < size; i++) {
+		if (i === RECOVERY_CODE_GROUP_LENGTH) output += "-";
+		output += RECOVERY_CODE_ALPHABET[bytes[i] % 31];
+	}
+	return output;
+}
+/**
+* Classify a bare one-time code by shape: an all-digit token is a TOTP
+* code, anything else (xxxxx-xxxxx) a recovery code. Used by the token
+* endpoint's `otp` parameter, which carries no explicit kind.
+*/ function guessUserAuthenticatorKindByResponse(response) {
+	return /^[0-9]{4,10}$/.test(response.trim()) ? UserAuthenticatorKind.TOTP : UserAuthenticatorKind.RECOVERY;
+}
+function generateNumericCode(length) {
+	const bytes = getRandomValues(new Uint8Array(length));
+	let output = "";
+	for (let i = 0; i < length; i++) output += String(bytes[i] % 10);
+	return output;
+}
+//#endregion
+export { generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse };
+
+//# sourceMappingURL=helpers.mjs.map

package/dist/core/entities/user-authenticator/helpers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.mjs","names":["UserAuthenticatorKind","getRandomValues","RECOVERY_CODE_ALPHABET","RECOVERY_CODE_GROUP_LENGTH","generateRecoveryCode","size","bytes","Uint8Array","output","i","length","guessUserAuthenticatorKindByResponse","response","test","trim","TOTP","RECOVERY","generateNumericCode","String"],"sources":["../../../../src/core/entities/user-authenticator/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { UserAuthenticatorKind } from '@authup/core-kit';\nimport { getRandomValues } from 'uncrypto';\n\n// no ambiguous characters (0/o, 1/l/i) — codes get typed by hand\nconst RECOVERY_CODE_ALPHABET = '23456789abcdefghjkmnpqrstuvwxyz';\nconst RECOVERY_CODE_GROUP_LENGTH = 5;\n\nexport function generateRecoveryCode(): string {\n    const size = RECOVERY_CODE_GROUP_LENGTH * 2;\n    const bytes = getRandomValues(new Uint8Array(size));\n\n    let output = '';\n    for (let i = 0; i < size; i++) {\n        if (i === RECOVERY_CODE_GROUP_LENGTH) {\n            output += '-';\n        }\n        output += RECOVERY_CODE_ALPHABET[bytes[i] % RECOVERY_CODE_ALPHABET.length];\n    }\n\n    return output;\n}\n\n/**\n * Classify a bare one-time code by shape: an all-digit token is a TOTP\n * code, anything else (xxxxx-xxxxx) a recovery code. Used by the token\n * endpoint's `otp` parameter, which carries no explicit kind.\n */\nexport function guessUserAuthenticatorKindByResponse(response: string): `${UserAuthenticatorKind}` {\n    return /^[0-9]{4,10}$/.test(response.trim()) ?\n        UserAuthenticatorKind.TOTP :\n        UserAuthenticatorKind.RECOVERY;\n}\n\nexport function generateNumericCode(length: number): string {\n    const bytes = getRandomValues(new Uint8Array(length));\n\n    let output = '';\n    for (let i = 0; i < length; i++) {\n        output += String(bytes[i] % 10);\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;AAWA,MAAME,yBAAyB;AAC/B,MAAMC,6BAA6B;AAEnC,SAAgBC,uBAAAA;CACZ,MAAMC,OAAOF,6BAA6B;CAC1C,MAAMG,QAAQL,gBAAgB,IAAIM,WAAWF,IAAAA,CAAAA;CAE7C,IAAIG,SAAS;CACb,KAAK,IAAIC,IAAI,GAAGA,IAAIJ,MAAMI,KAAK;EAC3B,IAAIA,MAAMN,4BACNK,UAAU;EAEdA,UAAUN,uBAAuBI,MAAMG,KAAKP;CAChD;CAEA,OAAOM;AACX;;;;;GAOA,SAAgBG,qCAAqCC,UAAgB;CACjE,OAAO,gBAAgBC,KAAKD,SAASE,KAAI,CAAA,IACrCd,sBAAsBe,OACtBf,sBAAsBgB;AAC9B;AAEA,SAAgBC,oBAAoBP,QAAc;CAC9C,MAAMJ,QAAQL,gBAAgB,IAAIM,WAAWG,MAAAA,CAAAA;CAE7C,IAAIF,SAAS;CACb,KAAK,IAAIC,IAAI,GAAGA,IAAIC,QAAQD,KACxBD,UAAUU,OAAOZ,MAAMG,KAAK,EAAA;CAGhC,OAAOD;AACX"}

package/dist/core/entities/user-authenticator/index.d.ts

@@ -0,0 +1,7 @@
+export * from './constants.ts';
+export * from './helpers.ts';
+export * from './service.ts';
+export * from './types.ts';
+export * from './webauthn.ts';
+export * from './schema.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/user-authenticator/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC"}

package/dist/core/entities/user-authenticator/index.mjs

@@ -0,0 +1,10 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { userAuthenticatorSchema } from "./schema.mjs";
+import { USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX } from "./constants.mjs";
+import { generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse } from "./helpers.mjs";
+import { buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, verifyWebauthnAuthentication, verifyWebauthnRegistration } from "./webauthn.mjs";
+import { UserAuthenticatorService } from "./service.mjs";
+import { USER_AUTHENTICATOR_FILTER_KEYS } from "./types.mjs";
+export { USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAuthenticatorService, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse, userAuthenticatorSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration };

package/dist/core/entities/user-authenticator/schema.d.ts

@@ -0,0 +1,3 @@
+import type { UserAuthenticator } from '@authup/core-kit';
+export declare const userAuthenticatorSchema: import("@rapiq/core").Schema<UserAuthenticator, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/user-authenticator/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAM1D,eAAO,MAAM,uBAAuB,sDAoBlC,CAAC"}

package/dist/core/entities/user-authenticator/schema.mjs

@@ -0,0 +1,47 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/user-authenticator/schema.ts
+const schemaMapping = {
+	user: EntityType.USER,
+	realm: EntityType.REALM
+};
+const userAuthenticatorSchema = defineSchema({
+	name: EntityType.USER_AUTHENTICATOR,
+	fields: { allowed: [
+		"id",
+		"kind",
+		"name",
+		"confirmed",
+		"lastUsedAt",
+		"createdAt",
+		"updatedAt",
+		"userId",
+		"realmId"
+	] },
+	filters: { allowed: [
+		"id",
+		"kind",
+		"confirmed",
+		"userId",
+		"realmId"
+	] },
+	relations: {
+		allowed: ["user", "realm"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sort: { allowed: [
+		"createdAt",
+		"updatedAt",
+		"lastUsedAt"
+	] },
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { userAuthenticatorSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/user-authenticator/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","user","USER","realm","REALM","userAuthenticatorSchema","name","USER_AUTHENTICATOR","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user-authenticator/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { UserAuthenticator } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { user: EntityType.USER, realm: EntityType.REALM };\n\nexport const userAuthenticatorSchema = defineSchema<UserAuthenticator>({\n    name: EntityType.USER_AUTHENTICATOR,\n    fields: {\n        allowed: [\n            'id',\n            'kind',\n            'name',\n            'confirmed',\n            'lastUsedAt',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'realmId',\n        ],\n    },\n    filters: { allowed: ['id', 'kind', 'confirmed', 'userId', 'realmId'] },\n    relations: { allowed: ['user', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['createdAt', 'updatedAt', 'lastUsedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,0BAA0BR,aAAgC;CACnES,MAAMR,WAAWS;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;EAAa;EAAU;GAAW;CACrEE,WAAW;EAAEF,SAAS,CAAC,QAAQ,OAAA;EAAUG,UAAUb,wBAAwBC,aAAAA;CAAe;CAC1Fa,MAAM,EAAEJ,SAAS;EAAC;EAAa;EAAa;GAAc;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}

package/dist/core/entities/user-authenticator/service.d.ts

@@ -0,0 +1,89 @@
+import { EventName, UserAuthenticatorKind, UserAuthenticatorValidator } from '@authup/core-kit';
+import type { User, UserAuthenticator } from '@authup/core-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';
+import type { IRealmCipher } from '../../key/index.ts';
+import type { IEventService } from '../event/index.ts';
+import type { IMailClient, IMailTemplateRenderer } from '../../mail/index.ts';
+import type { IUserRepository } from '../user/index.ts';
+import type { IUserAuthenticatorRepository, IUserAuthenticatorService, UserAuthenticatorChallengeStatus, UserAuthenticatorEnrollResult, UserAuthenticatorSendContext, UserAuthenticatorServiceContext, UserAuthenticatorServiceOptions, UserAuthenticatorVerifyContext, UserAuthenticatorVerifyInput, UserAuthenticatorWebauthnParameters } from './types.ts';
+import type { WebauthnContext } from './webauthn.ts';
+type VerifyLock = {
+    status: 'acquired';
+    value: string;
+} | {
+    status: 'busy' | 'unavailable';
+};
+type VerifyLockLease = {
+    renew: () => Promise<boolean>;
+    stop: () => Promise<void>;
+};
+export declare class UserAuthenticatorService extends AbstractEntityService implements IUserAuthenticatorService {
+    protected repository: IUserAuthenticatorRepository;
+    protected userRepository: IUserRepository;
+    protected cache: ICache;
+    protected cipher: IRealmCipher;
+    protected eventService?: IEventService;
+    protected mailClient?: IMailClient;
+    protected mailTemplateRenderer?: IMailTemplateRenderer;
+    protected options: UserAuthenticatorServiceOptions;
+    protected validator: UserAuthenticatorValidator;
+    constructor(ctx: UserAuthenticatorServiceContext);
+    protected isOwnedBy(entity: UserAuthenticator, actor: ActorContext): boolean;
+    /**
+     * The secret/codes columns never leave the service — reads return the
+     * row with both nulled (defense in depth on top of select:false).
+     */
+    protected sanitize(entity: UserAuthenticator): UserAuthenticator;
+    getMany(query: Record<string, any>, actor: ActorContext, options?: {
+        userId?: string;
+    }): Promise<EntityRepositoryFindManyResult<UserAuthenticator>>;
+    getOne(id: string, actor: ActorContext, options?: {
+        userId?: string;
+    }): Promise<UserAuthenticator>;
+    protected resolveOne(id: string, userId?: string): Promise<UserAuthenticator>;
+    enroll(data: Record<string, any>, actor: ActorContext): Promise<UserAuthenticatorEnrollResult>;
+    protected enrollWebauthn(user: User, name: string | null): Promise<UserAuthenticatorEnrollResult>;
+    protected enrollEmail(user: User, name: string | null): Promise<UserAuthenticatorEnrollResult>;
+    protected resolveTargetUser(userId: string | undefined, actor: ActorContext, validated: Record<string, any>): Promise<User>;
+    protected enrollTotp(user: User, name: string | null): Promise<UserAuthenticatorEnrollResult>;
+    protected enrollRecovery(user: User, name: string | null): Promise<UserAuthenticatorEnrollResult>;
+    confirm(id: string, code: string, actor: ActorContext, options?: {
+        userId?: string;
+    }): Promise<UserAuthenticator>;
+    protected confirmWebauthn(entity: UserAuthenticator, response: string): Promise<UserAuthenticator>;
+    delete(id: string, actor: ActorContext, options?: {
+        userId?: string;
+    }): Promise<UserAuthenticator>;
+    verify(userId: string, input: UserAuthenticatorVerifyInput, ctx?: UserAuthenticatorVerifyContext): Promise<boolean>;
+    protected verifyTotp(device: UserAuthenticator, token: string): Promise<boolean>;
+    protected verifyRecovery(device: UserAuthenticator, code: string): Promise<boolean>;
+    protected parseWebauthnParameters(device: UserAuthenticator): UserAuthenticatorWebauthnParameters | null;
+    protected verifyWebauthnDevice(userId: string, device: UserAuthenticator, response: string): Promise<number | null>;
+    protected verifyEmail(userId: string, response: string): Promise<boolean>;
+    sendChallenge(userId: string, kind: `${UserAuthenticatorKind}`, ctx?: UserAuthenticatorSendContext): Promise<void>;
+    hasConfirmed(userId: string): Promise<boolean>;
+    challenge(userId: string, options?: {
+        issueMaterial?: boolean;
+    }): Promise<UserAuthenticatorChallengeStatus>;
+    protected assertEnabled(): void;
+    protected assertMail(): void;
+    protected assertWebauthn(): WebauthnContext;
+    protected buildAttemptCacheKey(userId: string): string;
+    protected buildThrottleCacheKey(userId: string): string;
+    protected buildEmailCodeCacheKey(userId: string): string;
+    protected buildEmailSendCacheKey(userId: string): string;
+    protected buildWebauthnCacheKey(prefix: string, userId: string): string;
+    protected buildVerifyLockCacheKey(userId: string): string;
+    protected acquireVerifyLock(key: string): Promise<VerifyLock>;
+    protected maintainVerifyLock(key: string, value: string): VerifyLockLease;
+    protected releaseVerifyLock(key: string, value: string): Promise<void>;
+    protected assertNotThrottled(userId: string): Promise<void>;
+    protected assertNotThrottledOrRetry(userId: string): Promise<void>;
+    protected bumpAttempts(userId: string): Promise<void>;
+    protected resetAttempts(userId: string): Promise<void>;
+    protected recordEvent(name: `${EventName}`, entity: UserAuthenticator): Promise<void>;
+    protected recordChallengeEvent(name: `${EventName}`, userId: string, kind: string, ctx: UserAuthenticatorVerifyContext, entity?: UserAuthenticator): Promise<void>;
+}
+export {};
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/user-authenticator/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user-authenticator/service.ts"],"names":[],"mappings":"AAWA,OAAO,EACH,SAAS,EAKT,qBAAqB,EACrB,0BAA0B,EAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAUhE,OAAO,EACH,qBAAqB,EAIxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACR,YAAY,EACZ,8BAA8B,EAC9B,MAAM,EACT,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AA8BxD,OAAO,KAAK,EACR,4BAA4B,EAC5B,yBAAyB,EACzB,gCAAgC,EAChC,6BAA6B,EAE7B,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,EAE/B,8BAA8B,EAC9B,4BAA4B,EAC5B,mCAAmC,EACtC,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAcrD,KAAK,UAAU,GAAG;IACd,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACjB,GAAG;IACA,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC;CAClC,CAAC;AAEF,KAAK,eAAe,GAAG;IACnB,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B,CAAC;AAEF,qBAAa,wBAAyB,SAAQ,qBAAsB,YAAW,yBAAyB;IACpG,SAAS,CAAC,UAAU,EAAE,4BAA4B,CAAC;IAEnD,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC;IAExB,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC;IAE/B,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC;IAEnC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,SAAS,EAAE,0BAA0B,CAAC;gBAEpC,GAAG,EAAE,+BAA+B;IAchD,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAM5E;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB;IAU1D,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;IAiFvD,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,iBAAiB,CAAC;cAiBb,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAa7E,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,6BAA6B,CAAC;cA4CpF,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC;cA+CvF,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC;cA6CpF,iBAAiB,CAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC;cA8BA,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC;cAuCnF,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC;IA0CjG,OAAO,CACT,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,iBAAiB,CAAC;cAoDb,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA2ClG,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,iBAAiB,CAAC;IAyBvB,MAAM,CACR,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,EACnC,GAAG,GAAE,8BAAmC,GACzC,OAAO,CAAC,OAAO,CAAC;cAqHH,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;cAwDtE,cAAc,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBzF,SAAS,CAAC,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,mCAAmC,GAAG,IAAI;cAWxF,oBAAoB,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,iBAAiB,EACzB,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;cAmCT,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAezE,aAAa,CACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,GAAG,qBAAqB,EAAE,EAChC,GAAG,GAAE,4BAAiC,GACvC,OAAO,CAAC,IAAI,CAAC;IAwEV,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9C,SAAS,CACX,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAO,GAC1C,OAAO,CAAC,gCAAgC,CAAC;IAsD5C,SAAS,CAAC,aAAa,IAAI,IAAI;IAS/B,SAAS,CAAC,UAAU,IAAI,IAAI;IAS5B,SAAS,CAAC,cAAc,IAAI,eAAe;IAa3C,SAAS,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOtD,SAAS,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOvD,SAAS,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOxD,SAAS,CAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOxD,SAAS,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAIvE,SAAS,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;cAOzC,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAYnE,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe;cAsCzD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAQ5D,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAYjD,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAYxD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cA2B3C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;cAS5C,WAAW,CACvB,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;cAaA,oBAAoB,CAChC,IAAI,EAAE,GAAG,SAAS,EAAE,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,8BAA8B,EACnC,MAAM,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,IAAI,CAAC;CAenB"}