@azlib/identity 0.2.0

package/dist/nestjs.d.mts

@@ -0,0 +1,102 @@
+import { V as AuthorizationRequirement } from "./errors-BGMwaW5s.mjs";
+import { t as IdentityService } from "./identity-service-B9zrvE9z.mjs";
+import { t as CookieRefreshOptions } from "./identity-router-DBL20UWT.mjs";
+import { Request, Response } from "express";
+import { CanActivate, DynamicModule, ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+
+//#region core/nestjs/identity-controller.d.ts
+/** Options accepted by {@link createIdentityController}. */
+interface IdentityControllerOptions {
+  /**
+   * Cookie-based refresh-token transport. When set, the refresh token is stored in an
+   * `HttpOnly` cookie instead of the response body. Omit for body mode.
+   */
+  cookie?: CookieRefreshOptions;
+}
+//#endregion
+//#region core/nestjs/identity.module.d.ts
+/** Token used to inject the configured {@link IdentityService} in Nest providers. */
+declare const IDENTITY_SERVICE: unique symbol;
+/** Metadata key holding the authorization requirement for a route. */
+declare const IDENTITY_REQUIREMENT: unique symbol;
+/**
+ * Options for enabling the pre-built REST routes in {@link IdentityModule}.
+ */
+interface IdentityRoutesOptions extends IdentityControllerOptions {
+  /**
+   * URL prefix for the built-in controller. Default: `"auth"`.
+   *
+   * The controller is mounted at this prefix relative to the application's global
+   * prefix (if any).
+   */
+  prefix?: string;
+}
+interface IdentityModuleOptions {
+  /** A fully wired identity service (see `createIdentityService`). */
+  service: IdentityService;
+  /**
+   * When set, the module automatically registers a built-in REST controller with all
+   * standard auth endpoints (`POST /register`, `POST /login`, `POST /refresh`,
+   * `POST /logout`, `GET /me`).
+   *
+   * Pass `true` to use the defaults (`prefix: "auth"`, body-mode refresh tokens), or
+   * supply an `IdentityRoutesOptions` object to customise the prefix and cookie behaviour.
+   *
+   * @example
+   * ```ts
+   * // Minimal — everything works out of the box
+   * IdentityModule.forRoot({ service, routes: true })
+   *
+   * // With a custom prefix and HttpOnly refresh-token cookie
+   * IdentityModule.forRoot({
+   *   service,
+   *   routes: { prefix: "v1/auth", cookie: { name: "rt", secure: true } },
+   * })
+   * ```
+   */
+  routes?: true | IdentityRoutesOptions;
+}
+interface IdentityModuleAsyncOptions {
+  imports?: DynamicModule["imports"];
+  /** Factory returning the configured identity service. */
+  useFactory: (...args: never[]) => IdentityService | Promise<IdentityService>;
+  inject?: unknown[];
+  /**
+   * Same as {@link IdentityModuleOptions.routes} — enable built-in REST routes
+   * alongside the async service factory.
+   */
+  routes?: true | IdentityRoutesOptions;
+}
+/**
+ * Authentication guard: verifies the Bearer access token and attaches the hydrated
+ * principal to `request.identity`. Apply with `@UseGuards(IdentityAuthGuard)`.
+ */
+declare class IdentityAuthGuard implements CanActivate {
+  private readonly service;
+  constructor(service: IdentityService);
+  canActivate(context: ExecutionContext): Promise<boolean>;
+}
+/**
+ * Authorization guard: enforces the requirement declared by `@RequireAuthorization()`
+ * (or `@RequirePermission()`). Must run after {@link IdentityAuthGuard}. Deny-by-default.
+ */
+declare class IdentityAuthorizationGuard implements CanActivate {
+  private readonly service;
+  private readonly reflector;
+  constructor(service: IdentityService, reflector: Reflector);
+  canActivate(context: ExecutionContext): Promise<boolean>;
+}
+/** Declares the authorization requirement for a route or controller. */
+declare const RequireAuthorization: (requirement: AuthorizationRequirement) => import("@nestjs/common").CustomDecorator<typeof IDENTITY_REQUIREMENT>;
+/** Convenience: declare a single required permission for a route or controller. */
+declare const RequirePermission: (permission: string) => import("@nestjs/common").CustomDecorator<typeof IDENTITY_REQUIREMENT>;
+/** Param decorator that resolves the authenticated principal from the request. */
+declare const CurrentUser: (...dataOrPipes: unknown[]) => ParameterDecorator;
+declare class IdentityModule {
+  static forRoot(options: IdentityModuleOptions): DynamicModule;
+  static forRootAsync(options: IdentityModuleAsyncOptions): DynamicModule;
+}
+//#endregion
+export { CurrentUser, IDENTITY_REQUIREMENT, IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard, type IdentityControllerOptions, IdentityModule, IdentityModuleAsyncOptions, IdentityModuleOptions, IdentityRoutesOptions, RequireAuthorization, RequirePermission };
+//# sourceMappingURL=nestjs.d.mts.map

package/dist/nestjs.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nestjs.d.mts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;;UAkGiB,yBAAA;;;AAAjB;;EAKE,MAAA,GAAS,oBAAoB;AAAA;;;AAAA;AAAA,cC1ElB,gBAAA;;cAGA,oBAAA;AAHb;;;AAAA,UAQiB,qBAAA,SAA8B,yBAAyB;EARJ;AAGpE;;;;AAA4E;EAY1E,MAAM;AAAA;AAAA,UAGS,qBAAA;EAV8B;EAY7C,OAAA,EAAS,eAAA;EAFM;;;;;;;;;AAuBsB;AAGvC;;;;;;;;;;EAHE,MAAA,UAAgB,qBAAqB;AAAA;AAAA,UAGtB,0BAAA;EACf,OAAA,GAAU,aAAA;EAEwB;EAAlC,UAAA,MAAgB,IAAA,cAAkB,eAAA,GAAkB,OAAA,CAAQ,eAAA;EAC5D,MAAA;EAAA;;;;EAKA,MAAA,UAAgB,qBAAA;AAAA;;;;;cAqBL,iBAAA,YAA6B,WAAA;EAAA,iBACe,OAAA;cAAA,OAAA,EAAS,eAAA;EAE1D,WAAA,CAAY,OAAA,EAAS,gBAAA,GAAmB,OAAA;AAAA;;;;;cAoBnC,0BAAA,YAAsC,WAAA;EAAA,iBAEJ,OAAA;EAAA,iBAC1B,SAAA;cAD0B,OAAA,EAAS,eAAA,EACnC,SAAA,EAAW,SAAA;EAGxB,WAAA,CAAY,OAAA,EAAS,gBAAA,GAAmB,OAAA;AAAA;AAPhD;AAAA,cAgCa,oBAAA,GAAoB,WAAA,EAAiB,wBAAA,8BAAwB,eAAA,QAAA,oBAAA;;cAI7D,iBAAA,GAAiB,UAAA,sCAAsB,eAAA,QAAA,oBAAA;;cAIvC,WAAA,MAAW,WAAA,gBAAA,kBAKvB;AAAA,cAiBY,cAAA;EAAA,OACJ,OAAA,CAAQ,OAAA,EAAS,qBAAA,GAAwB,aAAA;EAAA,OAczC,YAAA,CAAa,OAAA,EAAS,0BAAA,GAA6B,aAAA;AAAA"}

package/dist/nestjs.mjs

@@ -0,0 +1,500 @@
+import { a as IdentityError, c as UnauthenticatedError } from "./errors-CEmnZxIn.mjs";
+import { Body, Controller, ForbiddenException, Get, HttpCode, HttpException, Inject, Injectable, Param, Post, Req, Res, SetMetadata, UnauthorizedException, UseGuards, createParamDecorator } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+//#region \0@oxc-project+runtime@0.132.0/helpers/decorateMetadata.js
+function __decorateMetadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.132.0/helpers/decorateParam.js
+function __decorateParam(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.132.0/helpers/decorate.js
+function __decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+//#endregion
+//#region core/nestjs/identity-controller.ts
+/**
+* Pre-built NestJS controller for `@azlib/identity`.
+*
+* Register it automatically via `IdentityModule.forRoot({ routes: true })`.
+* `@nestjs/common` is an optional peer dependency — only required when this file is used.
+*/
+function resolveCookieName(opts) {
+	return opts.name ?? "azlib_rt";
+}
+function rethrowAsHttp(err) {
+	if (err instanceof IdentityError) throw new HttpException({
+		code: err.code,
+		message: err.message
+	}, err.statusCode);
+	throw err;
+}
+function setCookieAndStripRefreshToken(res, tokens, opts) {
+	const maxAge = tokens.refreshTokenExpiresAt.getTime() - Date.now();
+	res.cookie(resolveCookieName(opts), tokens.refreshToken, {
+		httpOnly: opts.httpOnly ?? true,
+		secure: opts.secure ?? process.env.NODE_ENV === "production",
+		sameSite: opts.sameSite ?? "lax",
+		path: opts.path ?? "/",
+		domain: opts.domain,
+		maxAge
+	});
+	const { refreshToken: _rt, refreshTokenExpiresAt: _exp, ...bodyTokens } = tokens;
+	return bodyTokens;
+}
+function buildAuthResponse(result, cookieOpts, res) {
+	if (cookieOpts) {
+		const tokens = setCookieAndStripRefreshToken(res, result.tokens, cookieOpts);
+		return {
+			user: result.user,
+			tokens
+		};
+	}
+	return result;
+}
+function buildLoginResponse(result, cookieOpts, res) {
+	if ("mfaToken" in result) return result;
+	return buildAuthResponse(result, cookieOpts, res);
+}
+function readRefreshTokenFromRequest(req, cookieOpts) {
+	if (cookieOpts) return req.cookies?.[resolveCookieName(cookieOpts)];
+	const token = req.body?.["refreshToken"];
+	return typeof token === "string" ? token : void 0;
+}
+/**
+* Returns a dynamically created NestJS controller class with all standard identity
+* routes pre-wired. The class is registered directly in `IdentityModule.forRoot()`
+* when `routes` is configured — consumers do not need to define this controller.
+*
+* Pre-wired routes (relative to the module prefix, default `"auth"`):
+*
+* | Method | Path | Description |
+* |--------|------|-------------|
+* | POST | `/register` | Create a new account |
+* | POST | `/login` | Email + password login; may return MFA challenge |
+* | POST | `/refresh` | Rotate the refresh token |
+* | POST | `/logout` | Revoke the current session |
+* | GET  | `/me` | Return the authenticated principal (requires auth) |
+* | POST | `/request-email-verification` | Re-send verification link (requires auth) |
+* | POST | `/verify-email` | Consume an email verification token |
+* | POST | `/request-password-reset` | Send a password reset link |
+* | POST | `/reset-password` | Set a new password using a reset token |
+* | POST | `/mfa/verify` | Complete an MFA challenge after login |
+* | POST | `/2fa/setup` | Begin TOTP 2FA setup (requires auth) |
+* | POST | `/2fa/enable` | Confirm and enable 2FA (requires auth) |
+* | POST | `/2fa/disable` | Disable 2FA (requires auth) |
+* | POST | `/admin/lock/:userId` | Lock an account |
+* | POST | `/admin/unlock/:userId` | Unlock an account |
+* | POST | `/admin/disable/:userId` | Disable an account |
+*/
+function createIdentityController(prefix, controllerOptions = {}) {
+	const cookieOpts = controllerOptions.cookie;
+	let IdentityController = class IdentityController {
+		service;
+		constructor(service) {
+			this.service = service;
+		}
+		async register(body, res) {
+			try {
+				return buildAuthResponse(await this.service.register(body), cookieOpts, res);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async login(body, res) {
+			try {
+				return buildLoginResponse(await this.service.login(body), cookieOpts, res);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async refresh(req, res) {
+			try {
+				const token = readRefreshTokenFromRequest(req, cookieOpts);
+				if (!token) throw new UnauthenticatedError("Refresh token is missing.");
+				return buildAuthResponse(await this.service.refresh(token), cookieOpts, res);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async logout(req, res) {
+			try {
+				const token = readRefreshTokenFromRequest(req, cookieOpts);
+				if (token) await this.service.logout(token);
+				if (cookieOpts) res.clearCookie(resolveCookieName(cookieOpts), { path: cookieOpts.path ?? "/" });
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		getMe(req) {
+			return req.identity;
+		}
+		async requestEmailVerification(req) {
+			try {
+				await this.service.requestEmailVerification(req.identity.userId);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async verifyEmail(body) {
+			try {
+				if (!body.token) throw new UnauthenticatedError("token is required.");
+				await this.service.verifyEmail(body.token);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async requestPasswordReset(body) {
+			try {
+				if (!body.email) throw new UnauthenticatedError("email is required.");
+				await this.service.requestPasswordReset(body.email);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async resetPassword(body) {
+			try {
+				if (!body.token || !body.newPassword) throw new UnauthenticatedError("token and newPassword are required.");
+				await this.service.resetPassword(body.token, body.newPassword);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async verifyMfaChallenge(body, res) {
+			try {
+				if (!body.mfaToken || !body.code) throw new UnauthenticatedError("mfaToken and code are required.");
+				return buildAuthResponse(await this.service.verifyMfaChallenge(body.mfaToken, body.code), cookieOpts, res);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async setup2FA(req) {
+			try {
+				return await this.service.setup2FA(req.identity.userId);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async enable2FA(req, body) {
+			try {
+				if (!body.code) throw new UnauthenticatedError("code is required.");
+				await this.service.enable2FA(req.identity.userId, body.code);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async disable2FA(req, body) {
+			try {
+				if (!body.code) throw new UnauthenticatedError("code is required.");
+				await this.service.disable2FA(req.identity.userId, body.code);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async lockAccount(userId) {
+			try {
+				await this.service.lockAccount(userId);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async unlockAccount(userId) {
+			try {
+				await this.service.unlockAccount(userId);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async disableAccount(userId) {
+			try {
+				await this.service.disableAccount(userId);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+	};
+	__decorate([
+		Post("register"),
+		__decorateParam(0, Body()),
+		__decorateParam(1, Res({ passthrough: true })),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "register", null);
+	__decorate([
+		Post("login"),
+		__decorateParam(0, Body()),
+		__decorateParam(1, Res({ passthrough: true })),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "login", null);
+	__decorate([
+		Post("refresh"),
+		__decorateParam(0, Req()),
+		__decorateParam(1, Res({ passthrough: true })),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "refresh", null);
+	__decorate([
+		Post("logout"),
+		HttpCode(204),
+		__decorateParam(0, Req()),
+		__decorateParam(1, Res({ passthrough: true })),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "logout", null);
+	__decorate([
+		Get("me"),
+		UseGuards(IdentityAuthGuard),
+		__decorateParam(0, Req()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", void 0)
+	], IdentityController.prototype, "getMe", null);
+	__decorate([
+		Post("request-email-verification"),
+		HttpCode(204),
+		UseGuards(IdentityAuthGuard),
+		__decorateParam(0, Req()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "requestEmailVerification", null);
+	__decorate([
+		Post("verify-email"),
+		HttpCode(204),
+		__decorateParam(0, Body()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "verifyEmail", null);
+	__decorate([
+		Post("request-password-reset"),
+		HttpCode(204),
+		__decorateParam(0, Body()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "requestPasswordReset", null);
+	__decorate([
+		Post("reset-password"),
+		HttpCode(204),
+		__decorateParam(0, Body()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "resetPassword", null);
+	__decorate([
+		Post("mfa/verify"),
+		__decorateParam(0, Body()),
+		__decorateParam(1, Res({ passthrough: true })),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "verifyMfaChallenge", null);
+	__decorate([
+		Post("2fa/setup"),
+		UseGuards(IdentityAuthGuard),
+		__decorateParam(0, Req()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "setup2FA", null);
+	__decorate([
+		Post("2fa/enable"),
+		HttpCode(204),
+		UseGuards(IdentityAuthGuard),
+		__decorateParam(0, Req()),
+		__decorateParam(1, Body()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "enable2FA", null);
+	__decorate([
+		Post("2fa/disable"),
+		HttpCode(204),
+		UseGuards(IdentityAuthGuard),
+		__decorateParam(0, Req()),
+		__decorateParam(1, Body()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "disable2FA", null);
+	__decorate([
+		Post("admin/lock/:userId"),
+		HttpCode(204),
+		__decorateParam(0, Param("userId")),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [String]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "lockAccount", null);
+	__decorate([
+		Post("admin/unlock/:userId"),
+		HttpCode(204),
+		__decorateParam(0, Param("userId")),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [String]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "unlockAccount", null);
+	__decorate([
+		Post("admin/disable/:userId"),
+		HttpCode(204),
+		__decorateParam(0, Param("userId")),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [String]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "disableAccount", null);
+	IdentityController = __decorate([
+		Controller(prefix),
+		__decorateParam(0, Inject(IDENTITY_SERVICE)),
+		__decorateMetadata("design:paramtypes", [Object])
+	], IdentityController);
+	return IdentityController;
+}
+//#endregion
+//#region core/nestjs/identity.module.ts
+/**
+* NestJS integration for `@azlib/identity`.
+*
+* Provides a configurable module, an authentication guard, an authorization guard driven
+* by metadata decorators, and a `@CurrentUser()` param decorator. `@nestjs/common` and
+* `reflect-metadata` are optional peer dependencies — only required when this entry is used.
+*/
+var _ref;
+/** Token used to inject the configured {@link IdentityService} in Nest providers. */
+const IDENTITY_SERVICE = Symbol.for("azlib.identity.service");
+/** Metadata key holding the authorization requirement for a route. */
+const IDENTITY_REQUIREMENT = Symbol.for("azlib.identity.requirement");
+const extractBearerToken = (req) => {
+	const header = req.headers.authorization;
+	const value = Array.isArray(header) ? header[0] : header;
+	if (!value || !value.startsWith("Bearer ")) return null;
+	const token = value.slice(7).trim();
+	return token.length > 0 ? token : null;
+};
+let IdentityAuthGuard = class IdentityAuthGuard {
+	service;
+	constructor(service) {
+		this.service = service;
+	}
+	async canActivate(context) {
+		const req = context.switchToHttp().getRequest();
+		const token = extractBearerToken(req);
+		if (!token) throw new UnauthorizedException("Missing bearer token.");
+		try {
+			req.identity = await this.service.authenticate(token);
+		} catch {
+			throw new UnauthorizedException("Invalid or expired token.");
+		}
+		return true;
+	}
+};
+IdentityAuthGuard = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(IDENTITY_SERVICE)),
+	__decorateMetadata("design:paramtypes", [Object])
+], IdentityAuthGuard);
+let IdentityAuthorizationGuard = class IdentityAuthorizationGuard {
+	service;
+	reflector;
+	constructor(service, reflector) {
+		this.service = service;
+		this.reflector = reflector;
+	}
+	async canActivate(context) {
+		const requirement = this.reflector.getAllAndOverride(IDENTITY_REQUIREMENT, [context.getHandler(), context.getClass()]);
+		if (!requirement) return true;
+		const principal = context.switchToHttp().getRequest().identity;
+		if (!principal) throw new UnauthorizedException("Not authenticated.");
+		if (!(await this.service.authorize(requirement, {
+			principal,
+			action: requirement.permission ?? "custom"
+		})).allowed) throw new ForbiddenException();
+		return true;
+	}
+};
+IdentityAuthorizationGuard = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(IDENTITY_SERVICE)),
+	__decorateMetadata("design:paramtypes", [Object, typeof (_ref = typeof Reflector !== "undefined" && Reflector) === "function" ? _ref : Object])
+], IdentityAuthorizationGuard);
+/** Declares the authorization requirement for a route or controller. */
+const RequireAuthorization = (requirement) => SetMetadata(IDENTITY_REQUIREMENT, requirement);
+/** Convenience: declare a single required permission for a route or controller. */
+const RequirePermission = (permission) => SetMetadata(IDENTITY_REQUIREMENT, { permission });
+/** Param decorator that resolves the authenticated principal from the request. */
+const CurrentUser = createParamDecorator((_data, context) => {
+	return context.switchToHttp().getRequest().identity;
+});
+/**
+* NestJS module exposing the identity service plus guards. Register once at the root:
+*
+* ```ts
+* IdentityModule.forRoot({ service: createIdentityService(config, store) })
+* ```
+*/
+function buildControllers(routes) {
+	if (!routes) return [];
+	const routesOpts = routes === true ? {} : routes;
+	return [createIdentityController(routesOpts.prefix ?? "auth", { cookie: routesOpts.cookie })];
+}
+var IdentityModule = class IdentityModule {
+	static forRoot(options) {
+		return {
+			module: IdentityModule,
+			global: true,
+			controllers: buildControllers(options.routes),
+			providers: [
+				{
+					provide: IDENTITY_SERVICE,
+					useValue: options.service
+				},
+				IdentityAuthGuard,
+				IdentityAuthorizationGuard
+			],
+			exports: [
+				IDENTITY_SERVICE,
+				IdentityAuthGuard,
+				IdentityAuthorizationGuard
+			]
+		};
+	}
+	static forRootAsync(options) {
+		return {
+			module: IdentityModule,
+			global: true,
+			imports: options.imports ?? [],
+			controllers: buildControllers(options.routes),
+			providers: [
+				{
+					provide: IDENTITY_SERVICE,
+					useFactory: options.useFactory,
+					inject: options.inject
+				},
+				IdentityAuthGuard,
+				IdentityAuthorizationGuard
+			],
+			exports: [
+				IDENTITY_SERVICE,
+				IdentityAuthGuard,
+				IdentityAuthorizationGuard
+			]
+		};
+	}
+};
+//#endregion
+export { CurrentUser, IDENTITY_REQUIREMENT, IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard, IdentityModule, RequireAuthorization, RequirePermission };
+
+//# sourceMappingURL=nestjs.mjs.map

package/dist/nestjs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"nestjs.mjs","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"sourcesContent":["/**\n * Pre-built NestJS controller for `@azlib/identity`.\n *\n * Register it automatically via `IdentityModule.forRoot({ routes: true })`.\n * `@nestjs/common` is an optional peer dependency — only required when this file is used.\n */\nimport {\n  Body,\n  Controller,\n  Get,\n  HttpCode,\n  HttpException,\n  type HttpStatus,\n  Inject,\n  Param,\n  Post,\n  Req,\n  Res,\n  UseGuards,\n} from \"@nestjs/common\";\nimport type { Request, Response } from \"express\";\n\nimport { IdentityError, UnauthenticatedError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthResult, AuthTokens, LoginResult } from \"../types\";\nimport type { CookieRefreshOptions } from \"../express/identity-router\";\nimport { IdentityAuthGuard, IDENTITY_SERVICE } from \"./identity.module\";\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction resolveCookieName(opts: CookieRefreshOptions): string {\n  return opts.name ?? \"azlib_rt\";\n}\n\nfunction rethrowAsHttp(err: unknown): never {\n  if (err instanceof IdentityError) {\n    throw new HttpException({ code: err.code, message: err.message }, err.statusCode as HttpStatus);\n  }\n  throw err;\n}\n\nfunction setCookieAndStripRefreshToken(\n  res: Response,\n  tokens: AuthTokens,\n  opts: CookieRefreshOptions,\n): Omit<AuthTokens, \"refreshToken\" | \"refreshTokenExpiresAt\"> {\n  const maxAge = tokens.refreshTokenExpiresAt.getTime() - Date.now();\n  res.cookie(resolveCookieName(opts), tokens.refreshToken, {\n    httpOnly: opts.httpOnly ?? true,\n    secure: opts.secure ?? process.env.NODE_ENV === \"production\",\n    sameSite: opts.sameSite ?? \"lax\",\n    path: opts.path ?? \"/\",\n    domain: opts.domain,\n    maxAge,\n  });\n  const { refreshToken: _rt, refreshTokenExpiresAt: _exp, ...bodyTokens } = tokens;\n  return bodyTokens;\n}\n\nfunction buildAuthResponse(result: AuthResult, cookieOpts: CookieRefreshOptions | undefined, res: Response) {\n  if (cookieOpts) {\n    const tokens = setCookieAndStripRefreshToken(res, result.tokens, cookieOpts);\n    return { user: result.user, tokens };\n  }\n  return result;\n}\n\nfunction buildLoginResponse(\n  result: LoginResult,\n  cookieOpts: CookieRefreshOptions | undefined,\n  res: Response,\n) {\n  if (\"mfaToken\" in result) {\n    return result; // { kind: \"mfa_required\", mfaToken: \"...\" }\n  }\n  return buildAuthResponse(result, cookieOpts, res);\n}\n\nfunction readRefreshTokenFromRequest(\n  req: Request,\n  cookieOpts: CookieRefreshOptions | undefined,\n): string | undefined {\n  if (cookieOpts) {\n    const cookies = req.cookies as Record<string, string> | undefined;\n    return cookies?.[resolveCookieName(cookieOpts)];\n  }\n  const body = req.body as Record<string, unknown> | undefined;\n  const token = body?.[\"refreshToken\"];\n  return typeof token === \"string\" ? token : undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Controller options\n// ---------------------------------------------------------------------------\n\n/** Options accepted by {@link createIdentityController}. */\nexport interface IdentityControllerOptions {\n  /**\n   * Cookie-based refresh-token transport. When set, the refresh token is stored in an\n   * `HttpOnly` cookie instead of the response body. Omit for body mode.\n   */\n  cookie?: CookieRefreshOptions;\n}\n\n// ---------------------------------------------------------------------------\n// Controller factory\n// ---------------------------------------------------------------------------\n\n/**\n * Returns a dynamically created NestJS controller class with all standard identity\n * routes pre-wired. The class is registered directly in `IdentityModule.forRoot()`\n * when `routes` is configured — consumers do not need to define this controller.\n *\n * Pre-wired routes (relative to the module prefix, default `\"auth\"`):\n *\n * | Method | Path | Description |\n * |--------|------|-------------|\n * | POST | `/register` | Create a new account |\n * | POST | `/login` | Email + password login; may return MFA challenge |\n * | POST | `/refresh` | Rotate the refresh token |\n * | POST | `/logout` | Revoke the current session |\n * | GET  | `/me` | Return the authenticated principal (requires auth) |\n * | POST | `/request-email-verification` | Re-send verification link (requires auth) |\n * | POST | `/verify-email` | Consume an email verification token |\n * | POST | `/request-password-reset` | Send a password reset link |\n * | POST | `/reset-password` | Set a new password using a reset token |\n * | POST | `/mfa/verify` | Complete an MFA challenge after login |\n * | POST | `/2fa/setup` | Begin TOTP 2FA setup (requires auth) |\n * | POST | `/2fa/enable` | Confirm and enable 2FA (requires auth) |\n * | POST | `/2fa/disable` | Disable 2FA (requires auth) |\n * | POST | `/admin/lock/:userId` | Lock an account |\n * | POST | `/admin/unlock/:userId` | Unlock an account |\n * | POST | `/admin/disable/:userId` | Disable an account |\n */\nexport function createIdentityController(\n  prefix: string,\n  controllerOptions: IdentityControllerOptions = {},\n) {\n  const cookieOpts = controllerOptions.cookie;\n\n  @Controller(prefix)\n  class IdentityController {\n    constructor(@Inject(IDENTITY_SERVICE) readonly service: IdentityService) {}\n\n    @Post(\"register\")\n    async register(\n      @Body() body: { email: string; password: string; displayName?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.register(body);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"login\")\n    async login(\n      @Body() body: { email: string; password: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.login(body);\n        return buildLoginResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"refresh\")\n    async refresh(@Req() req: Request, @Res({ passthrough: true }) res: Response) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (!token) {\n          throw new UnauthenticatedError(\"Refresh token is missing.\");\n        }\n        const result = await this.service.refresh(token);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"logout\")\n    @HttpCode(204)\n    async logout(@Req() req: Request, @Res({ passthrough: true }) res: Response) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (token) {\n          await this.service.logout(token);\n        }\n        if (cookieOpts) {\n          res.clearCookie(resolveCookieName(cookieOpts), { path: cookieOpts.path ?? \"/\" });\n        }\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Get(\"me\")\n    @UseGuards(IdentityAuthGuard)\n    getMe(@Req() req: Request & { identity?: unknown }) {\n      return req.identity;\n    }\n\n    // -------------------------------------------------------------------------\n    // Email verification\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-email-verification\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async requestEmailVerification(@Req() req: Request & { identity?: { userId: string } }) {\n      try {\n        await this.service.requestEmailVerification(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"verify-email\")\n    @HttpCode(204)\n    async verifyEmail(@Body() body: { token?: string }) {\n      try {\n        if (!body.token) throw new UnauthenticatedError(\"token is required.\");\n        await this.service.verifyEmail(body.token);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Password reset\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-password-reset\")\n    @HttpCode(204)\n    async requestPasswordReset(@Body() body: { email?: string }) {\n      try {\n        if (!body.email) throw new UnauthenticatedError(\"email is required.\");\n        await this.service.requestPasswordReset(body.email);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"reset-password\")\n    @HttpCode(204)\n    async resetPassword(@Body() body: { token?: string; newPassword?: string }) {\n      try {\n        if (!body.token || !body.newPassword)\n          throw new UnauthenticatedError(\"token and newPassword are required.\");\n        await this.service.resetPassword(body.token, body.newPassword);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Two-factor authentication\n    // -------------------------------------------------------------------------\n\n    @Post(\"mfa/verify\")\n    async verifyMfaChallenge(\n      @Body() body: { mfaToken?: string; code?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        if (!body.mfaToken || !body.code)\n          throw new UnauthenticatedError(\"mfaToken and code are required.\");\n        const result = await this.service.verifyMfaChallenge(body.mfaToken, body.code);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/setup\")\n    @UseGuards(IdentityAuthGuard)\n    async setup2FA(@Req() req: Request & { identity?: { userId: string } }) {\n      try {\n        return await this.service.setup2FA(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/enable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async enable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.enable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/disable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async disable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.disable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Account management (admin)\n    // -------------------------------------------------------------------------\n\n    @Post(\"admin/lock/:userId\")\n    @HttpCode(204)\n    async lockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.lockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/unlock/:userId\")\n    @HttpCode(204)\n    async unlockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.unlockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/disable/:userId\")\n    @HttpCode(204)\n    async disableAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.disableAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n  }\n\n  return IdentityController;\n}\n","/**\n * NestJS integration for `@azlib/identity`.\n *\n * Provides a configurable module, an authentication guard, an authorization guard driven\n * by metadata decorators, and a `@CurrentUser()` param decorator. `@nestjs/common` and\n * `reflect-metadata` are optional peer dependencies — only required when this entry is used.\n */\nimport {\n  type CanActivate,\n  type DynamicModule,\n  type ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n  createParamDecorator,\n} from \"@nestjs/common\";\nimport { Reflector } from \"@nestjs/core\";\n\nimport type { AuthorizationRequirement } from \"../authorization\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthenticatedIdentity } from \"../types\";\nimport {\n  createIdentityController,\n  type IdentityControllerOptions,\n} from \"./identity-controller\";\n\n/** Token used to inject the configured {@link IdentityService} in Nest providers. */\nexport const IDENTITY_SERVICE = Symbol.for(\"azlib.identity.service\");\n\n/** Metadata key holding the authorization requirement for a route. */\nexport const IDENTITY_REQUIREMENT = Symbol.for(\"azlib.identity.requirement\");\n\n/**\n * Options for enabling the pre-built REST routes in {@link IdentityModule}.\n */\nexport interface IdentityRoutesOptions extends IdentityControllerOptions {\n  /**\n   * URL prefix for the built-in controller. Default: `\"auth\"`.\n   *\n   * The controller is mounted at this prefix relative to the application's global\n   * prefix (if any).\n   */\n  prefix?: string;\n}\n\nexport interface IdentityModuleOptions {\n  /** A fully wired identity service (see `createIdentityService`). */\n  service: IdentityService;\n  /**\n   * When set, the module automatically registers a built-in REST controller with all\n   * standard auth endpoints (`POST /register`, `POST /login`, `POST /refresh`,\n   * `POST /logout`, `GET /me`).\n   *\n   * Pass `true` to use the defaults (`prefix: \"auth\"`, body-mode refresh tokens), or\n   * supply an `IdentityRoutesOptions` object to customise the prefix and cookie behaviour.\n   *\n   * @example\n   * ```ts\n   * // Minimal — everything works out of the box\n   * IdentityModule.forRoot({ service, routes: true })\n   *\n   * // With a custom prefix and HttpOnly refresh-token cookie\n   * IdentityModule.forRoot({\n   *   service,\n   *   routes: { prefix: \"v1/auth\", cookie: { name: \"rt\", secure: true } },\n   * })\n   * ```\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\nexport interface IdentityModuleAsyncOptions {\n  imports?: DynamicModule[\"imports\"];\n  /** Factory returning the configured identity service. */\n  useFactory: (...args: never[]) => IdentityService | Promise<IdentityService>;\n  inject?: unknown[];\n  /**\n   * Same as {@link IdentityModuleOptions.routes} — enable built-in REST routes\n   * alongside the async service factory.\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\ninterface RequestWithIdentity {\n  headers: Record<string, string | string[] | undefined>;\n  identity?: AuthenticatedIdentity;\n}\n\nconst extractBearerToken = (req: RequestWithIdentity): string | null => {\n  const header = req.headers.authorization;\n  const value = Array.isArray(header) ? header[0] : header;\n  if (!value || !value.startsWith(\"Bearer \")) return null;\n  const token = value.slice(\"Bearer \".length).trim();\n  return token.length > 0 ? token : null;\n};\n\n/**\n * Authentication guard: verifies the Bearer access token and attaches the hydrated\n * principal to `request.identity`. Apply with `@UseGuards(IdentityAuthGuard)`.\n */\n@Injectable()\nexport class IdentityAuthGuard implements CanActivate {\n  constructor(@Inject(IDENTITY_SERVICE) private readonly service: IdentityService) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const token = extractBearerToken(req);\n    if (!token) {\n      throw new UnauthorizedException(\"Missing bearer token.\");\n    }\n    try {\n      req.identity = await this.service.authenticate(token);\n    } catch {\n      throw new UnauthorizedException(\"Invalid or expired token.\");\n    }\n    return true;\n  }\n}\n\n/**\n * Authorization guard: enforces the requirement declared by `@RequireAuthorization()`\n * (or `@RequirePermission()`). Must run after {@link IdentityAuthGuard}. Deny-by-default.\n */\n@Injectable()\nexport class IdentityAuthorizationGuard implements CanActivate {\n  constructor(\n    @Inject(IDENTITY_SERVICE) private readonly service: IdentityService,\n    private readonly reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const requirement = this.reflector.getAllAndOverride<AuthorizationRequirement | undefined>(\n      IDENTITY_REQUIREMENT,\n      [context.getHandler(), context.getClass()],\n    );\n    // No requirement declared: nothing extra to enforce beyond authentication.\n    if (!requirement) return true;\n\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const principal = req.identity;\n    if (!principal) {\n      throw new UnauthorizedException(\"Not authenticated.\");\n    }\n    const decision = await this.service.authorize(requirement, {\n      principal,\n      action: requirement.permission ?? \"custom\",\n    });\n    if (!decision.allowed) {\n      throw new ForbiddenException();\n    }\n    return true;\n  }\n}\n\n/** Declares the authorization requirement for a route or controller. */\nexport const RequireAuthorization = (requirement: AuthorizationRequirement) =>\n  SetMetadata(IDENTITY_REQUIREMENT, requirement);\n\n/** Convenience: declare a single required permission for a route or controller. */\nexport const RequirePermission = (permission: string) =>\n  SetMetadata(IDENTITY_REQUIREMENT, { permission } satisfies AuthorizationRequirement);\n\n/** Param decorator that resolves the authenticated principal from the request. */\nexport const CurrentUser = createParamDecorator(\n  (_data: unknown, context: ExecutionContext): AuthenticatedIdentity | undefined => {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    return req.identity;\n  },\n);\n\n/**\n * NestJS module exposing the identity service plus guards. Register once at the root:\n *\n * ```ts\n * IdentityModule.forRoot({ service: createIdentityService(config, store) })\n * ```\n */\nfunction buildControllers(routes: true | IdentityRoutesOptions | undefined) {\n  if (!routes) return [];\n  const routesOpts = routes === true ? {} : routes;\n  const prefix = routesOpts.prefix ?? \"auth\";\n  const controllerOpts: IdentityControllerOptions = { cookie: routesOpts.cookie };\n  return [createIdentityController(prefix, controllerOpts)];\n}\n\nexport class IdentityModule {\n  static forRoot(options: IdentityModuleOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      controllers: buildControllers(options.routes),\n      providers: [\n        { provide: IDENTITY_SERVICE, useValue: options.service },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard],\n    };\n  }\n\n  static forRootAsync(options: IdentityModuleAsyncOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      imports: options.imports ?? [],\n      controllers: buildControllers(options.routes),\n      providers: [\n        {\n          provide: IDENTITY_SERVICE,\n          useFactory: options.useFactory,\n          inject: options.inject as never[],\n        },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard],\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAS,kBAAkB,MAAoC;CAC7D,OAAO,KAAK,QAAQ;AACtB;AAEA,SAAS,cAAc,KAAqB;CAC1C,IAAI,eAAe,eACjB,MAAM,IAAI,cAAc;EAAE,MAAM,IAAI;EAAM,SAAS,IAAI;CAAQ,GAAG,IAAI,UAAwB;CAEhG,MAAM;AACR;AAEA,SAAS,8BACP,KACA,QACA,MAC4D;CAC5D,MAAM,SAAS,OAAO,sBAAsB,QAAQ,IAAI,KAAK,IAAI;CACjE,IAAI,OAAO,kBAAkB,IAAI,GAAG,OAAO,cAAc;EACvD,UAAU,KAAK,YAAY;EAC3B,QAAQ,KAAK,UAAU,QAAQ,IAAI,aAAa;EAChD,UAAU,KAAK,YAAY;EAC3B,MAAM,KAAK,QAAQ;EACnB,QAAQ,KAAK;EACb;CACF,CAAC;CACD,MAAM,EAAE,cAAc,KAAK,uBAAuB,MAAM,GAAG,eAAe;CAC1E,OAAO;AACT;AAEA,SAAS,kBAAkB,QAAoB,YAA8C,KAAe;CAC1G,IAAI,YAAY;EACd,MAAM,SAAS,8BAA8B,KAAK,OAAO,QAAQ,UAAU;EAC3E,OAAO;GAAE,MAAM,OAAO;GAAM;EAAO;CACrC;CACA,OAAO;AACT;AAEA,SAAS,mBACP,QACA,YACA,KACA;CACA,IAAI,cAAc,QAChB,OAAO;CAET,OAAO,kBAAkB,QAAQ,YAAY,GAAG;AAClD;AAEA,SAAS,4BACP,KACA,YACoB;CACpB,IAAI,YAEF,OADgB,IAAI,UACH,kBAAkB,UAAU;CAG/C,MAAM,QADO,IAAI,OACI;CACrB,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;AAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,SAAgB,yBACd,QACA,oBAA+C,CAAC,GAChD;CACA,MAAM,aAAa,kBAAkB;CAErC,IAAA,qBAAA,MACM,mBAAmB;EACwB;EAA/C,YAAY,SAA6D;GAA1B,KAAA,UAAA;EAA2B;EAE1E,MACM,SACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,kBAAkB,MADJ,KAAK,QAAQ,SAAS,IAAI,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,MACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,mBAAmB,MADL,KAAK,QAAQ,MAAM,IAAI,GACV,YAAY,GAAG;GACnD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,QAAQ,KAAqB,KAA2C;GAC5E,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,CAAC,OACH,MAAM,IAAI,qBAAqB,2BAA2B;IAG5D,OAAO,kBAAkB,MADJ,KAAK,QAAQ,QAAQ,KAAK,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,OAAO,KAAqB,KAA2C;GAC3E,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,OACF,MAAM,KAAK,QAAQ,OAAO,KAAK;IAEjC,IAAI,YACF,IAAI,YAAY,kBAAkB,UAAU,GAAG,EAAE,MAAM,WAAW,QAAQ,IAAI,CAAC;GAEnF,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,KAA8C;GAClD,OAAO,IAAI;EACb;EAMA,MAGM,yBAAyB,KAAyD;GACtF,IAAI;IACF,MAAM,KAAK,QAAQ,yBAAyB,IAAI,SAAU,MAAM;GAClE,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,YAAY,MAAkC;GAClD,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,YAAY,KAAK,KAAK;GAC3C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,qBAAqB,MAAkC;GAC3D,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,qBAAqB,KAAK,KAAK;GACpD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cAAc,MAAwD;GAC1E,IAAI;IACF,IAAI,CAAC,KAAK,SAAS,CAAC,KAAK,aACvB,MAAM,IAAI,qBAAqB,qCAAqC;IACtE,MAAM,KAAK,QAAQ,cAAc,KAAK,OAAO,KAAK,WAAW;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MACM,mBACJ,MACA,KACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,YAAY,CAAC,KAAK,MAC1B,MAAM,IAAI,qBAAqB,iCAAiC;IAElE,OAAO,kBAAkB,MADJ,KAAK,QAAQ,mBAAmB,KAAK,UAAU,KAAK,IAAI,GAC5C,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,SAAS,KAAyD;GACtE,IAAI;IACF,OAAO,MAAM,KAAK,QAAQ,SAAS,IAAI,SAAU,MAAM;GACzD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,UACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,UAAU,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC9D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,WACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,WAAW,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,YAAY,QAAiC;GACjD,IAAI;IACF,MAAM,KAAK,QAAQ,YAAY,MAAM;GACvC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cAAc,QAAiC;GACnD,IAAI;IACF,MAAM,KAAK,QAAQ,cAAc,MAAM;GACzC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,eAAe,QAAiC;GACpD,IAAI;IACF,MAAM,KAAK,QAAQ,eAAe,MAAM;GAC1C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;CACF;;EA/MG,KAAK,UAAU;qBAEb,KAAK,CAAA;qBACL,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,OAAO;qBAEV,KAAK,CAAA;qBACL,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,SAAS;qBACA,IAAI,CAAA;qBAAiB,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAa5D,KAAK,QAAQ;EACb,SAAS,GAAG;qBACC,IAAI,CAAA;qBAAiB,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAc3D,IAAI,IAAI;EACR,UAAU,iBAAiB;qBACrB,IAAI,CAAA;;;;;;EAQV,KAAK,4BAA4B;EACjC,SAAS,GAAG;EACZ,UAAU,iBAAiB;qBACI,IAAI,CAAA;;;;;;EAQnC,KAAK,cAAc;EACnB,SAAS,GAAG;qBACM,KAAK,CAAA;;;;;;EAavB,KAAK,wBAAwB;EAC7B,SAAS,GAAG;qBACe,KAAK,CAAA;;;;;;EAShC,KAAK,gBAAgB;EACrB,SAAS,GAAG;qBACQ,KAAK,CAAA;;;;;;EAczB,KAAK,YAAY;qBAEf,KAAK,CAAA;qBACL,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAY3B,KAAK,WAAW;EAChB,UAAU,iBAAiB;qBACZ,IAAI,CAAA;;;;;;EAQnB,KAAK,YAAY;EACjB,SAAS,GAAG;EACZ,UAAU,iBAAiB;qBAEzB,IAAI,CAAA;qBACJ,KAAK,CAAA;;;;;;EAUP,KAAK,aAAa;EAClB,SAAS,GAAG;EACZ,UAAU,iBAAiB;qBAEzB,IAAI,CAAA;qBACJ,KAAK,CAAA;;;;;;EAcP,KAAK,oBAAoB;EACzB,SAAS,GAAG;qBACM,MAAM,QAAQ,CAAA;;;;;;EAQhC,KAAK,sBAAsB;EAC3B,SAAS,GAAG;qBACQ,MAAM,QAAQ,CAAA;;;;;;EAQlC,KAAK,uBAAuB;EAC5B,SAAS,GAAG;qBACS,MAAM,QAAQ,CAAA;;;;;;EA5MrC,WAAW,MAAM;qBAEH,OAAO,gBAAgB,CAAA;;;CAmNtC,OAAO;AACT;;;;;;;;;;;;ACvUA,MAAa,mBAAmB,OAAO,IAAI,wBAAwB;;AAGnE,MAAa,uBAAuB,OAAO,IAAI,4BAA4B;AA0D3E,MAAM,sBAAsB,QAA4C;CACtE,MAAM,SAAS,IAAI,QAAQ;CAC3B,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;CAClD,IAAI,CAAC,SAAS,CAAC,MAAM,WAAW,SAAS,GAAG,OAAO;CACnD,MAAM,QAAQ,MAAM,MAAM,CAAgB,EAAE,KAAK;CACjD,OAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAOO,IAAA,oBAAA,MAAM,kBAAyC;CACG;CAAvD,YAAY,SAAqE;EAA1B,KAAA,UAAA;CAA2B;CAElF,MAAM,YAAY,SAA6C;EAC7D,MAAM,MAAM,QAAQ,aAAa,EAAE,WAAgC;EACnE,MAAM,QAAQ,mBAAmB,GAAG;EACpC,IAAI,CAAC,OACH,MAAM,IAAI,sBAAsB,uBAAuB;EAEzD,IAAI;GACF,IAAI,WAAW,MAAM,KAAK,QAAQ,aAAa,KAAK;EACtD,QAAQ;GACN,MAAM,IAAI,sBAAsB,2BAA2B;EAC7D;EACA,OAAO;CACT;AACF;;CAjBC,WAAW;oBAEG,OAAO,gBAAgB,CAAA;;;AAsB/B,IAAA,6BAAA,MAAM,2BAAkD;CAEhB;CAC1B;CAFnB,YACE,SACA,WACA;EAF2C,KAAA,UAAA;EAC1B,KAAA,YAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,MAAM,cAAc,KAAK,UAAU,kBACjC,sBACA,CAAC,QAAQ,WAAW,GAAG,QAAQ,SAAS,CAAC,CAC3C;EAEA,IAAI,CAAC,aAAa,OAAO;EAGzB,MAAM,YADM,QAAQ,aAAa,EAAE,WACf,EAAE;EACtB,IAAI,CAAC,WACH,MAAM,IAAI,sBAAsB,oBAAoB;EAMtD,IAAI,EAAC,MAJkB,KAAK,QAAQ,UAAU,aAAa;GACzD;GACA,QAAQ,YAAY,cAAc;EACpC,CAAC,GACa,SACZ,MAAM,IAAI,mBAAmB;EAE/B,OAAO;CACT;AACF;;CA7BC,WAAW;oBAGP,OAAO,gBAAgB,CAAA;;;;AA6B5B,MAAa,wBAAwB,gBACnC,YAAY,sBAAsB,WAAW;;AAG/C,MAAa,qBAAqB,eAChC,YAAY,sBAAsB,EAAE,WAAW,CAAoC;;AAGrF,MAAa,cAAc,sBACxB,OAAgB,YAAiE;CAEhF,OADY,QAAQ,aAAa,EAAE,WAC1B,EAAE;AACb,CACF;;;;;;;;AASA,SAAS,iBAAiB,QAAkD;CAC1E,IAAI,CAAC,QAAQ,OAAO,CAAC;CACrB,MAAM,aAAa,WAAW,OAAO,CAAC,IAAI;CAG1C,OAAO,CAAC,yBAFO,WAAW,UAAU,QAEK,EADW,QAAQ,WAAW,OACjB,CAAC,CAAC;AAC1D;AAEA,IAAa,iBAAb,MAAa,eAAe;CAC1B,OAAO,QAAQ,SAA+C;EAC5D,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KAAE,SAAS;KAAkB,UAAU,QAAQ;IAAQ;IACvD;IACA;GACF;GACA,SAAS;IAAC;IAAkB;IAAmB;GAA0B;EAC3E;CACF;CAEA,OAAO,aAAa,SAAoD;EACtE,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,SAAS,QAAQ,WAAW,CAAC;GAC7B,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KACE,SAAS;KACT,YAAY,QAAQ;KACpB,QAAQ,QAAQ;IAClB;IACA;IACA;GACF;GACA,SAAS;IAAC;IAAkB;IAAmB;GAA0B;EAC3E;CACF;AACF"}