@baruk/core 0.3.1 → 0.5.0

package/dist/billing/repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/billing/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAkDtD,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5B,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QACnC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QACrE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/D,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG;;;CAGhB,CAAC;AAgBF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,KAAqB;IACpE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAU;;;;;QAKzB,MAAM,EAAE,kDAAkD,KAAK,CAAC,QAAQ;QACxE,KAAK,CAAC,WAAW,IAAI,YAAY,KAAK,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW,IAAI,SAAS;QACrF,KAAK,CAAC,MAAM,IAAI,IAAI,KAAK,KAAK,CAAC,aAAa,IAAI,KAAK,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC;QAC7E,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,KAAK,CAAC,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI;;gBAEpG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;GAChC,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,QAAiB;IAC/D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAU;aACpB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;;aAEnB,QAAQ,IAAI,IAAI,iCAAiC,QAAQ,IAAI,IAAI;;GAE3E,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,EAAU,EAAE,MAAiB;IACtE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;wCACiB,MAAM;iBAC7B,EAAE;GAChB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAsCD,SAAS,SAAS,CAAC,CAAY;IAC7B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,cAAc,EAAE,CAAC,CAAC,gBAAgB;QAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QAClD,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;QAC1B,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG;;;CAGnB,CAAC;AAgBF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,KAAwB;IACjE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAa;;;;;QAK5B,MAAM,EAAE,kDAAkD,KAAK,CAAC,QAAQ;QACxE,KAAK,CAAC,cAAc,IAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,KAAK,KAAK,CAAC,UAAU,IAAI,IAAI;QACxF,KAAK,CAAC,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,SAAS;QACpE,KAAK,CAAC,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,IAAI;QACnD,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAU,CAAC,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI;;gBAE5D,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;GACnC,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AAC7B,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAM,EACN,SAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAmC;aAC7C,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;;;aAGtB,MAAM,CAAC,QAAQ,IAAI,IAAI,iCAAiC,MAAM,CAAC,QAAQ,IAAI,IAAI;aAC/E,MAAM,CAAC,MAAM,IAAI,IAAI,8BAA8B,MAAM,CAAC,MAAM,IAAI,IAAI;;YAEzE,KAAK,WAAW,MAAM;GAC/B,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,EAAU;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAa;aACvB,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,2BAA2B,EAAE;GAC7D,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAM,EAAE,EAAU,EAAE,MAAe;IACtE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;4DACqC,MAAM,IAAI,IAAI;;iBAEzD,EAAE;GAChB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAM,EACN,QAAgB,EAChB,UAAkB,EAClB,MAAe;IAEf,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;4DACqC,MAAM,IAAI,IAAI;;uBAEnD,QAAQ,sBAAsB,UAAU;;GAE5D,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,EAAU,EAAE,MAAoB;IAC5E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;iCACU,MAAM;iBACtB,EAAE;GAChB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAM;IAMzC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkF;;;;;;;GAOtG,CAAC;IACF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACnB,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1B,YAAY,EAAE,CAAC,CAAC,aAAa;KAC9B,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAM;IAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAa;aACvB,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;;;GAGhC,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/billing/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAgEvE,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;QACjC,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5B,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QACnC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QACrE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/D,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;QACrC,iBAAiB,EAAE,CAAC,CAAC,mBAAmB,IAAI,IAAI;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,QAAmC,EAAE,MAAiC;IAC5F,IAAI,QAAQ,IAAI,MAAM,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,qDAAqD,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,eAAe,GAAG;;;;CAIvB,CAAC;AAgCF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,KAAqB;IAErB,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;;;;;QAMjC,MAAM,EAAE,kDAAkD,KAAK,CAAC,QAAQ;QACxE,KAAK,CAAC,WAAW,IAAI,YAAY,KAAK,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW,IAAI,SAAS;QACrF,KAAK,CAAC,MAAM,IAAI,IAAI,KAAK,KAAK,CAAC,aAAa,IAAI,KAAK,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC;QAC7E,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChF,KAAK,CAAC,MAAM,IAAI,IAAI,KAAK,KAAK,CAAC,iBAAiB,IAAI,IAAI,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI;;;GAGzF,CAAC;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,4EAA4E;IAC5E,kCAAkC;IAClC,OAAO,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,QAAiB;IAC/D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAU;aACpB,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;;;;cAIzB,QAAQ,IAAI,IAAI,mCAAmC,QAAQ,IAAI,IAAI;;GAE9E,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,EAAU,EAAE,MAAiB;IACtE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;wCACiB,MAAM;iBAC7B,EAAE;GAChB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,EAAU;IACtD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAU;aACpB,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;;;oBAGnB,EAAE;GACnB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,0BAA0B,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AA0BD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,EAAU,EACV,KAAqB;IAErB,MAAM,GAAG,GAAG,CAAiC,CAAI,EAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;IACtF,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,OAAO,GAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,OAAO;QAAE,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAE7C,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9C,cAAc,CACZ,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAC7D,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CACxD,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;2BAEd,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAY,CAAC,CAAC,CAAC,EAAE,CAAA,aAAa;2BACzD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAO,CAAC,CAAC,CAAC,EAAE,CAAA,QAAQ;2BAC1C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAY,CAAC,CAAC,CAAC,EAAE,CAAA,aAAa;2BACzD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA,SAAS;2BACpD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAc,CAAC,CAAC,CAAC,EAAE,CAAA,gBAAgB;2BAChE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC,CAAC,EAAE,CAAA,UAAU;2BAChD,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAY,CAAC,CAAC,CAAC,EAAE,CAAA,cAAc;2BAC1D,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAgB,CAAC,CAAC,CAAC,EAAE,CAAA,kBAAkB;2BACtE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA,WAAW;2BAC1D,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA,SAAS;;iBAE9D,EAAE;;GAEhB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,0BAA0B,CAAC,CAAC;IAClE,OAAO,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC;AAsFD,SAAS,SAAS,CAAC,CAAY;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,2BAA2B,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAC/E,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;QACjC,iBAAiB,EAAE,CAAC,CAAC,mBAAmB,IAAI,IAAI;QAChD,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI;QACrC,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAChC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC3C,cAAc,EAAE,CAAC,CAAC,gBAAgB;QAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QAClD,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;QAC1B,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG;;;CAGnB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG;;;;;;;CAO1B,CAAC;AAEF,MAAM,YAAY,GAAG;;;;CAIpB,CAAC;AAgBF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,KAAwB;IACjE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAa;;;;;QAK5B,MAAM,EAAE,kDAAkD,KAAK,CAAC,QAAQ;QACxE,KAAK,CAAC,cAAc,IAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,KAAK,KAAK,CAAC,UAAU,IAAI,IAAI;QACxF,KAAK,CAAC,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,SAAS;QACpE,KAAK,CAAC,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,IAAI;QACnD,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAU,CAAC,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI;;gBAE5D,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;GACnC,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AAC7B,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAM,EACN,SAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,6EAA6E;IAC7E,oEAAoE;IACpE,mEAAmE;IACnE,gBAAgB;IAChB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAmC;aAC7C,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC;MACpC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;;aAEhB,MAAM,CAAC,QAAQ,IAAI,IAAI,mCAAmC,MAAM,CAAC,QAAQ,IAAI,IAAI;aACjF,MAAM,CAAC,MAAM,IAAI,IAAI,gCAAgC,MAAM,CAAC,MAAM,IAAI,IAAI;aAC1E,MAAM,CAAC,UAAU,IAAI,IAAI,oCAAoC,MAAM,CAAC,UAAU,IAAI,IAAI;aACtF,MAAM,CAAC,OAAO,IAAI,IAAI,mCAAmC,MAAM,CAAC,OAAO,IAAI,IAAI;aAC/E,MAAM,CAAC,KAAK,IAAI,IAAI,mCAAmC,MAAM,CAAC,KAAK,IAAI,IAAI;aAC3E,MAAM,CAAC,MAAM,IAAI,IAAI;iBACjB,MAAM,CAAC,MAAM,IAAI,IAAI;;aAEzB,MAAM,IAAI,IAAI;2CACgB,MAAM,IAAI,IAAI;6CACZ,MAAM,IAAI,IAAI;;YAE/C,KAAK,WAAW,MAAM;GAC/B,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAM,EACN,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAa;aACvB,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;+BACtC,YAAY;;GAExC,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,EAAU;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAa;aACvB,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;oBACjD,EAAE;GACnB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAM,EAAE,EAAU,EAAE,MAAe;IACtE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;4DACqC,MAAM,IAAI,IAAI;;iBAEzD,EAAE;GAChB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAM,EACN,QAAgB,EAChB,UAAkB,EAClB,MAAe;IAEf,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;4DACqC,MAAM,IAAI,IAAI;;uBAEnD,QAAQ,sBAAsB,UAAU;;GAE5D,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,EAAU,EAAE,MAAoB;IAC5E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;iCACU,MAAM;iBACtB,EAAE;GAChB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAM;IAMzC,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;;;;;GAOA,CAAC;IACF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACnB,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1B,YAAY,EAAE,CAAC,CAAC,aAAa;KAC9B,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAM;IAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAa;aACvB,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;;;GAGhC,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAM,EACN,KAAiE;IAEjE,MAAM,EAAE,CAAA;oEAC0D,KAAK,CAAC,cAAc;GACrF,CAAC;IACF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;gBAE3B,MAAM,EAAE;gBACR,KAAK,CAAC,cAAc,KAAK,UAAU;;;KAG9C,CAAC;QACF,IAAI,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,cAAsB;IACrE,MAAM,IAAI,GAAG,MAAM,EAAE,CAA4B;;gCAEnB,cAAc;;GAE3C,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AACzC,CAAC"}

package/dist/cjs/audit/repository.js

@@ -1,17 +1,48 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.listAudit = listAudit;
-/** Lista a trilha de auditoria do tenant corrente (RLS já isola). Somente leitura. */
+/**
+ * Lista a trilha de auditoria do tenant corrente (RLS já isola). Somente leitura.
+ *
+ * ## Por que o ator vem por `membership`, e não direto de a tabela "user"
+ *
+ * a tabela "user" é entidade GLOBAL: não tem RLS. Um `JOIN "user" ON u.id = a.actor_id`
+ * leria qualquer pessoa do ecossistema, e bastaria um `actor_id` de outra
+ * organização para esta tela imprimir o nome de alguém que a SC não conhece.
+ *
+ * O join passa por `membership` do tenant corrente. Ator que não é membro daqui
+ * volta como `null` — e a tela o chama de "Sistema", que é honesto: para esta
+ * organização, aquele ato não tem rosto.
+ *
+ * ## O que este enriquecimento NÃO é
+ *
+ * Não é reescrita da trilha. `audit_log` continua append-only e nenhuma linha
+ * histórica muda: `actor_type` segue gravado como sempre esteve. Isto é
+ * projeção de LEITURA — o mesmo registro, dito de forma que quem audita
+ * entenda.
+ */
 async function listAudit(tx, filter = {}) {
     const limit = Math.min(filter.limit ?? 30, 100);
     const offset = filter.offset ?? 0;
     const rows = await tx `
-    SELECT id, actor_type, actor_id, action, resource_type, resource_id, result,
-           occurred_at, count(*) OVER() AS total
-    FROM audit_log
-    WHERE (${filter.action ?? null}::text IS NULL OR action = ${filter.action ?? null})
-      AND (${filter.resourceType ?? null}::text IS NULL OR resource_type = ${filter.resourceType ?? null})
-    ORDER BY occurred_at DESC
+    SELECT a.id, a.actor_type, a.actor_id, a.action, a.resource_type, a.resource_id,
+           a.result, a.occurred_at,
+           u.full_name AS actor_name,
+           u.email     AS actor_email,
+           u.user_type AS actor_user_type,
+           count(*) OVER() AS total
+    FROM audit_log a
+    -- A membership é o portão: sem ela o nome de alguém de outra organização
+    -- entraria nesta tela. A tabela "user" é global e não tem RLS para barrar
+    -- isso sozinha.
+    LEFT JOIN membership m
+           ON m.user_id = a.actor_id
+          AND m.tenant_id = current_setting('app.current_tenant', true)::uuid
+    LEFT JOIN "user" u
+           ON u.id = m.user_id
+    WHERE (${filter.action ?? null}::text IS NULL OR a.action = ${filter.action ?? null})
+      AND (${filter.resourceType ?? null}::text IS NULL OR a.resource_type = ${filter.resourceType ?? null})
+    ORDER BY a.occurred_at DESC
     LIMIT ${limit} OFFSET ${offset}
   `;
     const total = rows[0] ? Number(rows[0].total) : 0;
@@ -21,6 +52,9 @@ async function listAudit(tx, filter = {}) {
             id: r.id,
             actorType: r.actor_type,
             actorId: r.actor_id,
+            actorName: r.actor_name,
+            actorEmail: r.actor_email,
+            actorUserType: r.actor_user_type,
             action: r.action,
             resourceType: r.resource_type,
             resourceId: r.resource_id,

package/dist/cjs/audit/repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/audit/repository.ts"],"names":[],"mappings":";;AAcA,8BA+BC;AAhCD,sFAAsF;AAC/E,KAAK,UAAU,SAAS,CAC7B,EAAM,EACN,SAAsF,EAAE;IAExF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;;aAIU,MAAM,CAAC,MAAM,IAAI,IAAI,8BAA8B,MAAM,CAAC,MAAM,IAAI,IAAI;aACxE,MAAM,CAAC,YAAY,IAAI,IAAI,qCAAqC,MAAM,CAAC,YAAY,IAAI,IAAI;;YAE5F,KAAK,WAAW,MAAM;GAC/B,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO;QACL,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,OAAO,EAAE,CAAC,CAAC,QAAQ;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,YAAY,EAAE,CAAC,CAAC,aAAa;YAC7B,UAAU,EAAE,CAAC,CAAC,WAAW;YACzB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE;SACxC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/audit/repository.ts"],"names":[],"mappings":";;AA8CA,8BAwDC;AA5ED;;;;;;;;;;;;;;;;;;;GAmBG;AACI,KAAK,UAAU,SAAS,CAC7B,EAAM,EACN,SAAsF,EAAE;IAExF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,EAAE,CAYpB;;;;;;;;;;;;;;;;aAgBU,MAAM,CAAC,MAAM,IAAI,IAAI,gCAAgC,MAAM,CAAC,MAAM,IAAI,IAAI;aAC1E,MAAM,CAAC,YAAY,IAAI,IAAI,uCAAuC,MAAM,CAAC,YAAY,IAAI,IAAI;;YAE9F,KAAK,WAAW,MAAM;GAC/B,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO;QACL,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,OAAO,EAAE,CAAC,CAAC,QAAQ;YACnB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,UAAU,EAAE,CAAC,CAAC,WAAW;YACzB,aAAa,EAAE,CAAC,CAAC,eAAe;YAChC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,YAAY,EAAE,CAAC,CAAC,aAAa;YAC7B,UAAU,EAAE,CAAC,CAAC,WAAW;YACzB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE;SACxC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/cjs/auth/password-reset.js

@@ -1,11 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requestPasswordReset = requestPasswordReset;
+exports.createActivationToken = createActivationToken;
+exports.isResetTokenValid = isResetTokenValid;
 exports.resetPassword = resetPassword;
 const shared_1 = require("@baruk/shared");
+const context_js_1 = require("../db/context.js");
+const audit_js_1 = require("../audit/audit.js");
 const password_js_1 = require("./password.js");
 const session_token_js_1 = require("./session-token.js");
-const RESET_TTL_MS = 60 * 60 * 1000; // 1h
+/**
+ * 24h para o link de recuperação.
+ *
+ * Era 1h. O trade-off é real — janela maior é janela maior se a caixa de e-mail
+ * for comprometida —, mas 1h não sobrevive ao uso: quem pede recuperação nem
+ * sempre está com o e-mail aberto, e a API hiberna, então a primeira tentativa
+ * do dia ainda gasta segundos no cold start. Link vencido faz o usuário pedir
+ * outro, e o custo de segurança disso é maior que o da janela: cada reenvio é
+ * mais um link vivo circulando por e-mail.
+ *
+ * O que limita o dano continua valendo: uso único, invalidação no consumo e
+ * revogação das sessões anteriores.
+ */
+const RESET_TTL_MS = 24 * 60 * 60 * 1000;
+const ACTIVATION_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 dias — convite, e-mail pode demorar a ser aberto.
 const REAL_CLOCK = { now: () => Date.now() };
 /**
  * Solicita reset. Retorna o token EM CLARO (para compor o link do e-mail) e o
@@ -22,37 +40,149 @@ async function requestPasswordReset(db, email, clock = REAL_CLOCK) {
     const { token, tokenHash } = (0, session_token_js_1.generateSessionToken)();
     const now = clock.now();
     await db `
-    INSERT INTO password_reset (id, user_id, token_hash, expires_at)
-    VALUES (${(0, shared_1.uuidv7)()}, ${user.id}, ${tokenHash}, ${new Date(now + RESET_TTL_MS)})
+    INSERT INTO password_reset (id, user_id, token_hash, purpose, expires_at)
+    VALUES (${(0, shared_1.uuidv7)()}, ${user.id}, ${tokenHash}, 'reset', ${new Date(now + RESET_TTL_MS)})
   `;
+    await auditBestEffort(db, user.id, {
+        action: 'password_reset_requested',
+        resourceType: 'user',
+        resourceId: user.id,
+    });
     return { token, userId: user.id };
 }
+/**
+ * Emite o token de primeiro acesso para um usuário recém-convidado (chamado
+ * por `inviteUser`, já dentro do contexto do tenant que convidou). Mesmo
+ * mecanismo de `requestPasswordReset`, com `purpose='activation'` e TTL maior
+ * — e o `tenant_id` guardado no token, porque `resetPassword` roda sem sessão
+ * autenticada e precisa reabrir o contexto de RLS certo para ativar a
+ * membership.
+ */
+async function createActivationToken(db, input, clock = REAL_CLOCK) {
+    const { token, tokenHash } = (0, session_token_js_1.generateSessionToken)();
+    const now = clock.now();
+    // Reemitir invalida o convite anterior: um usuário tem no máximo um convite
+    // vivo por vez. Sem isto, cada reenvio deixava mais um token válido por 7
+    // dias — e um link que vazou (encaminhado, colado num chat, capturado numa
+    // screenshot) continuaria abrindo a conta mesmo depois de reemitido.
+    await db `
+    UPDATE password_reset SET used_at = now()
+     WHERE user_id = ${input.userId} AND purpose = 'activation' AND used_at IS NULL
+  `;
+    await db `
+    INSERT INTO password_reset (id, user_id, token_hash, purpose, tenant_id, expires_at)
+    VALUES (${(0, shared_1.uuidv7)()}, ${input.userId}, ${tokenHash}, 'activation', ${input.tenantId}, ${new Date(now + ACTIVATION_TTL_MS)})
+  `;
+    return { token };
+}
 /**
  * Redefine a senha usando um token válido (não usado, não expirado). Marca o
  * token como usado, limpa `must_change_password` e revoga sessões anteriores.
+ * Quando o token é de ativação (`purpose='activation'`), também ativa o
+ * usuário e a membership que o convite deixou em `invited`.
  */
+/**
+ * O token ainda vale? **Não consome.**
+ *
+ * Existe para a tela de ativação decidir o que mostrar antes de o usuário
+ * digitar. Sem isto, quem clicava num convite antigo preenchia senha, confirmava
+ * e só então descobria que o link não servia — e a tela seguia oferecendo o
+ * formulário como se a próxima tentativa pudesse dar certo.
+ *
+ * Devolve só um booleano. Não distingue inexistente de expirado de já usado:
+ * os três levam à mesma ação do usuário, e detalhar transformaria isto num
+ * oráculo para quem tenta adivinhar token.
+ */
+async function isResetTokenValid(db, token, clock = REAL_CLOCK) {
+    const rows = await db `
+    SELECT id FROM password_reset
+     WHERE token_hash = ${(0, session_token_js_1.hashToken)(token)}
+       AND used_at IS NULL
+       AND expires_at > ${new Date(clock.now())}
+     LIMIT 1
+  `;
+    return rows.length > 0;
+}
 async function resetPassword(db, token, newPassword, clock = REAL_CLOCK) {
     if (newPassword.length < 8)
         return false;
     const th = (0, session_token_js_1.hashToken)(token);
     const rows = await db `
-    SELECT id, user_id FROM password_reset
+    SELECT id, user_id, purpose, tenant_id FROM password_reset
     WHERE token_hash = ${th} AND used_at IS NULL AND expires_at > ${new Date(clock.now())}
   `;
     const reset = rows[0];
-    if (!reset)
+    if (!reset) {
+        // Token existe mas expirou/já foi usado (distinto de token nunca emitido,
+        // que não é auditável — não há usuário a quem atribuir a tentativa).
+        const stale = await db `
+      SELECT user_id FROM password_reset WHERE token_hash = ${th}
+    `;
+        if (stale[0]) {
+            await auditBestEffort(db, stale[0].user_id, {
+                action: 'password_reset_failed',
+                resourceType: 'user',
+                resourceId: stale[0].user_id,
+            });
+        }
         return false;
+    }
     await db.begin(async (tx) => {
-        await tx `
-      INSERT INTO user_credential (user_id, password_hash, must_change_password)
-      VALUES (${reset.user_id}, ${(0, password_js_1.hashPassword)(newPassword)}, false)
-      ON CONFLICT (user_id) DO UPDATE
-        SET password_hash = EXCLUDED.password_hash, must_change_password = false, updated_at = now()
-    `;
+        // Upsert via função SECURITY DEFINER (0024) — o papel de app só tem INSERT
+        // em user_credential (anti account-takeover, 0011); trocar uma senha já
+        // existente exige essa porta estreita e nomeada, nunca um UPDATE genérico.
+        await tx `SELECT set_user_password(${reset.user_id}, ${(0, password_js_1.hashPassword)(newPassword)}, false)`;
         await tx `UPDATE password_reset SET used_at = now() WHERE id = ${reset.id}`;
         // Revoga sessões anteriores (uso único de fato).
         await tx `UPDATE user_session SET revoked_at = now() WHERE user_id = ${reset.user_id} AND revoked_at IS NULL`;
+        if (reset.purpose === 'activation' && reset.tenant_id) {
+            await tx `UPDATE "user" SET status = 'active' WHERE id = ${reset.user_id} AND status = 'invited'`;
+            await tx `select set_config('app.current_tenant', ${reset.tenant_id}, true)`;
+            await tx `select set_config('app.current_user', ${reset.user_id}, true)`;
+            await tx `
+        UPDATE membership SET status = 'active', updated_at = now()
+        WHERE user_id = ${reset.user_id} AND tenant_id = ${reset.tenant_id} AND status = 'invited'
+      `;
+            await (0, audit_js_1.appendAudit)(tx, {
+                actorId: reset.user_id,
+                action: 'activation_completed',
+                resourceType: 'user',
+                resourceId: reset.user_id,
+            });
+        }
+        else {
+            await auditWithinResolvedTenant(tx, reset.user_id, {
+                action: 'password_reset_completed',
+                resourceType: 'user',
+                resourceId: reset.user_id,
+            });
+        }
     });
     return true;
 }
+/**
+ * Auditoria best-effort para ações globais (login ainda não escolheu tenant,
+ * ou nem há sessão). Só grava se o usuário tiver exatamente uma membership
+ * ativa resolvível — mesmo critério de auto-seleção usado em `login()`. Sem
+ * isso, a ação simplesmente não é auditada (não há tenant_id para a RLS de
+ * `audit_log` aceitar a linha) — comportamento documentado, não um bug.
+ */
+async function auditBestEffort(db, userId, entry) {
+    const memberships = await db `
+    SELECT tenant_id FROM membership WHERE user_id = ${userId} AND status = 'active' AND deleted_at IS NULL
+  `;
+    if (memberships.length !== 1)
+        return;
+    await (0, context_js_1.withContext)(db, { tenantId: memberships[0].tenant_id, userId }, (tx) => (0, audit_js_1.appendAudit)(tx, { ...entry, actorId: userId }));
+}
+async function auditWithinResolvedTenant(tx, userId, entry) {
+    const memberships = await tx `
+    SELECT tenant_id FROM membership WHERE user_id = ${userId} AND status = 'active' AND deleted_at IS NULL
+  `;
+    if (memberships.length !== 1)
+        return;
+    await tx `select set_config('app.current_tenant', ${memberships[0].tenant_id}, true)`;
+    await tx `select set_config('app.current_user', ${userId}, true)`;
+    await (0, audit_js_1.appendAudit)(tx, { ...entry, actorId: userId });
+}
 //# sourceMappingURL=password-reset.js.map

package/dist/cjs/auth/password-reset.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.js","sourceRoot":"","sources":["../../../src/auth/password-reset.ts"],"names":[],"mappings":";;AAiBA,oDAkBC;AAMD,sCA2BC;AApED,0CAAuC;AAEvC,+CAA6C;AAC7C,yDAAqE;AAErE,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;AAK1C,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAEpD;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAkC;kDACR,KAAK;GACpD,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,uCAAoB,GAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE,CAAA;;cAEI,IAAA,eAAM,GAAE,KAAK,IAAI,CAAC,EAAE,KAAK,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC;GAC9E,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,aAAa,CACjC,EAAM,EACN,KAAa,EACb,WAAmB,EACnB,QAAe,UAAU;IAEzB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,EAAE,GAAG,IAAA,4BAAS,EAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAmC;;yBAEjC,EAAE,yCAAyC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;GACtF,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1B,MAAM,EAAE,CAAA;;gBAEI,KAAK,CAAC,OAAO,KAAK,IAAA,0BAAY,EAAC,WAAW,CAAC;;;KAGtD,CAAC;QACF,MAAM,EAAE,CAAA,wDAAwD,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3E,iDAAiD;QACjD,MAAM,EAAE,CAAA,8DAA8D,KAAK,CAAC,OAAO,yBAAyB,CAAC;IAC/G,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"password-reset.js","sourceRoot":"","sources":["../../../src/auth/password-reset.ts"],"names":[],"mappings":";;AAiCA,oDAuBC;AAUD,sDAsBC;AAoBD,8CAaC;AAED,sCA+DC;AA1LD,0CAAuC;AAEvC,iDAA+C;AAC/C,gDAAgD;AAChD,+CAA6C;AAC7C,yDAAqE;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,sDAAsD;AAKzG,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAEpD;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAkC;kDACR,KAAK;GACpD,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,uCAAoB,GAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE,CAAA;;cAEI,IAAA,eAAM,GAAE,KAAK,IAAI,CAAC,EAAE,KAAK,SAAS,cAAc,IAAI,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC;GACvF,CAAC;IACF,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;QACjC,MAAM,EAAE,0BAA0B;QAClC,YAAY,EAAE,MAAM;QACpB,UAAU,EAAE,IAAI,CAAC,EAAE;KACpB,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,qBAAqB,CACzC,EAAa,EACb,KAA2C,EAC3C,QAAe,UAAU;IAEzB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,uCAAoB,GAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAExB,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,EAAE,CAAA;;uBAEa,KAAK,CAAC,MAAM;GAChC,CAAC;IAEF,MAAM,EAAE,CAAA;;cAEI,IAAA,eAAM,GAAE,KAAK,KAAK,CAAC,MAAM,KAAK,SAAS,mBAAmB,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,GAAG,iBAAiB,CAAC;GACzH,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,iBAAiB,CACrC,EAAa,EACb,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;0BAEf,IAAA,4BAAS,EAAC,KAAK,CAAC;;0BAEhB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;;GAE5C,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,EAAM,EACN,KAAa,EACb,WAAmB,EACnB,QAAe,UAAU;IAEzB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,EAAE,GAAG,IAAA,4BAAS,EAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;yBAEsB,EAAE,yCAAyC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;GACtF,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAuB;8DACa,EAAE;KAC3D,CAAC;QACF,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACb,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;gBAC1C,MAAM,EAAE,uBAAuB;gBAC/B,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1B,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,EAAE,CAAA,4BAA4B,KAAK,CAAC,OAAO,KAAK,IAAA,0BAAY,EAAC,WAAW,CAAC,UAAU,CAAC;QAC1F,MAAM,EAAE,CAAA,wDAAwD,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3E,iDAAiD;QACjD,MAAM,EAAE,CAAA,8DAA8D,KAAK,CAAC,OAAO,yBAAyB,CAAC;QAE7G,IAAI,KAAK,CAAC,OAAO,KAAK,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACtD,MAAM,EAAE,CAAA,kDAAkD,KAAK,CAAC,OAAO,yBAAyB,CAAC;YACjG,MAAM,EAAE,CAAA,2CAA2C,KAAK,CAAC,SAAS,SAAS,CAAC;YAC5E,MAAM,EAAE,CAAA,yCAAyC,KAAK,CAAC,OAAO,SAAS,CAAC;YACxE,MAAM,EAAE,CAAA;;0BAEY,KAAK,CAAC,OAAO,oBAAoB,KAAK,CAAC,SAAS;OACnE,CAAC;YACF,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,sBAAsB;gBAC9B,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,yBAAyB,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE;gBACjD,MAAM,EAAE,0BAA0B;gBAClC,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,EAAM,EACN,MAAc,EACd,KAAyD;IAEzD,MAAM,WAAW,GAAG,MAAM,EAAE,CAAyB;uDACA,MAAM;GAC1D,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAC5E,IAAA,sBAAW,EAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,EAAM,EACN,MAAc,EACd,KAAyD;IAEzD,MAAM,WAAW,GAAG,MAAM,EAAE,CAAyB;uDACA,MAAM;GAC1D,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,EAAE,CAAA,2CAA2C,WAAW,CAAC,CAAC,CAAE,CAAC,SAAS,SAAS,CAAC;IACtF,MAAM,EAAE,CAAA,yCAAyC,MAAM,SAAS,CAAC;IACjE,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/cjs/auth/service.js

@@ -8,6 +8,7 @@ exports.authenticate = authenticate;
 exports.sessionMemberships = sessionMemberships;
 exports.sessionProducts = sessionProducts;
 exports.logout = logout;
+exports.changePassword = changePassword;
 const shared_1 = require("@baruk/shared");
 const context_js_1 = require("../db/context.js");
 const audit_js_1 = require("../audit/audit.js");
@@ -18,7 +19,23 @@ const password_js_1 = require("./password.js");
 const session_token_js_1 = require("./session-token.js");
 const SESSION_TTL_MS = 12 * 60 * 60 * 1000; // 12h
 const REAL_CLOCK = { now: () => Date.now() };
-/** Cria (ou atualiza) um usuário staff com senha local. Usado pelo seed. */
+/**
+ * Cria (ou atualiza) um usuário staff com senha local. Usado pelos seeds.
+ *
+ * **A senha de um usuário que já existe é preservada por padrão.** Um seed de
+ * inicialização é, por natureza, algo que pode rodar de novo — em um deploy, em
+ * uma reconstrução de ambiente, na mão de alguém investigando. Se ele redefinir
+ * a senha em silêncio, quem administra o ambiente perde o acesso sem receber
+ * erro nenhum, e a causa é invisível: o seed "funcionou".
+ *
+ * Foi exatamente essa a armadilha encontrada em 2026-08-12, quando o
+ * `SEED_ADMIN_PASSWORD` do serviço divergiu do valor guardado no cofre. Rodar
+ * `db:seed` com o ambiente errado teria trocado a senha do administrador sem
+ * um aviso sequer.
+ *
+ * Para redefinir deliberadamente, passe `overwritePassword: true` — o nome
+ * torna a intenção explícita em quem chama, que é onde ela deve estar.
+ */
 async function upsertUserWithPassword(db, input) {
     const rows = await db `
     INSERT INTO "user" (id, email, full_name, user_type, auth_provider)
@@ -28,16 +45,28 @@ async function upsertUserWithPassword(db, input) {
     RETURNING id
   `;
     const userId = rows[0].id;
-    await db `
-    INSERT INTO user_credential (user_id, password_hash)
-    VALUES (${userId}, ${(0, password_js_1.hashPassword)(input.password)})
-    ON CONFLICT (user_id) DO UPDATE SET password_hash = EXCLUDED.password_hash, updated_at = now()
-  `;
+    // `RETURNING` só devolve linha quando o INSERT ou o UPDATE de fato aconteceu:
+    // com `DO NOTHING` e credencial preexistente, o resultado é vazio. É assim que
+    // sabemos, sem uma consulta extra, se a senha foi gravada ou preservada.
+    const written = input.overwritePassword
+        ? await db `
+        INSERT INTO user_credential (user_id, password_hash)
+        VALUES (${userId}, ${(0, password_js_1.hashPassword)(input.password)})
+        ON CONFLICT (user_id) DO UPDATE SET password_hash = EXCLUDED.password_hash, updated_at = now()
+        RETURNING user_id
+      `
+        : await db `
+        INSERT INTO user_credential (user_id, password_hash)
+        VALUES (${userId}, ${(0, password_js_1.hashPassword)(input.password)})
+        ON CONFLICT (user_id) DO NOTHING
+        RETURNING user_id
+      `;
     return {
         id: userId,
         email: input.email,
         fullName: input.fullName,
         userType: input.userType ?? 'staff',
+        passwordWasSet: written.length > 0,
     };
 }
 /** Login com e-mail/senha. Emite sessão; auto-seleciona tenant se houver só um. */
@@ -51,11 +80,12 @@ async function login(db, input, clock = REAL_CLOCK) {
         throw new shared_1.UnauthorizedError('Credenciais inválidas');
     }
     const creds = await db `
-    SELECT password_hash FROM user_credential WHERE user_id = ${user.id}
+    SELECT password_hash, must_change_password FROM user_credential WHERE user_id = ${user.id}
   `;
     if (!creds[0] || !(0, password_js_1.verifyPassword)(input.password, creds[0].password_hash)) {
         throw new shared_1.UnauthorizedError('Credenciais inválidas');
     }
+    const mustChangePassword = creds[0].must_change_password;
     const { token, tokenHash } = (0, session_token_js_1.generateSessionToken)();
     const now = clock.now();
     const sessionId = (0, shared_1.uuidv7)();
@@ -83,6 +113,7 @@ async function login(db, input, clock = REAL_CLOCK) {
         user: { id: user.id, email: user.email, fullName: user.full_name, userType: user.user_type },
         memberships,
         activeTenantId,
+        mustChangePassword,
     };
 }
 /** Lista os tenants a que o usuário pertence (usa RLS self-clause de membership). */
@@ -129,12 +160,34 @@ async function selectTenant(db, input) {
             userType: session.user_type,
             tenantId: input.tenantId,
             permissions,
+            mustChangePassword: session.must_change_password,
         };
     });
 }
 /**
  * Resolve uma sessão ativa em contexto autenticado (o que o middleware da API
  * chama por request). Exige tenant ativo já selecionado.
+ *
+ * ## Por que a membership é reconferida a cada requisição
+ *
+ * `selectTenant` conferia a membership; `authenticate` não. Quem já estava
+ * dentro continuava dentro: revogar o acesso de alguém fechava a porta e não
+ * tirava ninguém da sala.
+ *
+ * Medido em 2026-09-06, contra o stack local, com o token de uma sessão já
+ * amarrada ao tenant:
+ *
+ *     POST /v1/auth/select-tenant  -> 403  (a revogação valia)
+ *     GET  /v1/clients             -> 200  (e não valia)
+ *
+ * Em produção havia três sessões nessa condição, de uma conta revogada às 13:00
+ * do mesmo dia, com validade até as 21:56. Para o escritório o efeito é direto:
+ * revogar o acesso de quem sai da equipe só surtiria efeito quando a sessão
+ * dele expirasse — até doze horas depois.
+ *
+ * A conferência custa um JOIN na consulta que já existe: nenhuma ida a mais ao
+ * banco. E é fail-closed — sem membership ativa, 403, independentemente do que
+ * o `user_role` ainda diga.
  */
 async function authenticate(db, token, clock = REAL_CLOCK) {
     const session = await resolveSessionRow(db, token, clock);
@@ -142,6 +195,17 @@ async function authenticate(db, token, clock = REAL_CLOCK) {
         throw new shared_1.UnauthorizedError('Nenhum tenant selecionado para esta sessão');
     }
     const tenantId = session.active_tenant_id;
+    // `listMemberships` e não uma consulta própria: duas fontes de verdade para
+    // "pertence a este tenant" acabariam divergindo, e a primeira versão desta
+    // correção já provou como. Ela consultava `membership` direto, sem contexto —
+    // e `membership` tem RLS com cláusula por usuário. Sem GUC a consulta não
+    // devolve zero linhas por não haver acesso: devolve zero porque a RLS
+    // escondeu tudo. O efeito foi 403 para todo mundo, inclusive para quem tinha
+    // acesso legítimo. Zero sob RLS não é ausência.
+    const memberships = await listMemberships(db, session.user_id);
+    if (!memberships.some((m) => m.tenantId === tenantId)) {
+        throw new shared_1.ForbiddenError('Usuário não pertence a este tenant');
+    }
     return (0, context_js_1.withContext)(db, { tenantId, userId: session.user_id }, async (tx) => {
         const permissions = await (0, authorize_js_1.loadUserPermissions)(tx, session.user_id);
         const ctx = {
@@ -149,6 +213,7 @@ async function authenticate(db, token, clock = REAL_CLOCK) {
             userType: session.user_type,
             tenantId,
             permissions,
+            mustChangePassword: session.must_change_password,
         };
         if (session.user_type === 'client_portal') {
             ctx.clientId = await (0, repository_js_1.getPortalClientId)(tx, session.user_id);
@@ -158,9 +223,11 @@ async function authenticate(db, token, clock = REAL_CLOCK) {
 }
 async function resolveSessionRow(db, token, clock = REAL_CLOCK) {
     const rows = await db `
-    SELECT s.id, s.user_id, u.user_type, s.active_tenant_id
+    SELECT s.id, s.user_id, u.user_type, s.active_tenant_id,
+      coalesce(c.must_change_password, false) AS must_change_password
     FROM user_session s
     JOIN "user" u ON u.id = s.user_id
+    LEFT JOIN user_credential c ON c.user_id = u.id
     WHERE s.token_hash = ${(0, session_token_js_1.hashToken)(token)}
       AND s.revoked_at IS NULL
       AND s.expires_at > ${new Date(clock.now())}
@@ -183,9 +250,53 @@ async function sessionProducts(db, token) {
 }
 /** Revoga a sessão (logout). */
 async function logout(db, token) {
-    await db `UPDATE user_session SET revoked_at = now() WHERE token_hash = ${(0, session_token_js_1.hashToken)(token)}`;
+    await db `SELECT revoke_user_session(${(0, session_token_js_1.hashToken)(token)})`;
 }
+/**
+ * Troca de senha em sessão autenticada (exige a senha atual — distinto do
+ * fluxo de token de `resetPassword`). Cobre tanto a troca voluntária quanto a
+ * troca obrigatória de `must_change_password`; a sessão corrente permanece
+ * válida (não é o cenário de "conta pode estar comprometida" do reset).
+ */
+async function changePassword(db, auth, input) {
+    if (input.newPassword.length < 8) {
+        throw new shared_1.ValidationError('A nova senha deve ter ao menos 8 caracteres');
+    }
+    const creds = await db `
+    SELECT password_hash, must_change_password FROM user_credential WHERE user_id = ${auth.userId}
+  `;
+    if (!creds[0] || !(0, password_js_1.verifyPassword)(input.currentPassword, creds[0].password_hash)) {
+        throw new shared_1.UnauthorizedError('Senha atual incorreta');
+    }
+    const wasForced = creds[0].must_change_password;
+    await (0, context_js_1.withContext)(db, { tenantId: auth.tenantId, userId: auth.userId }, async (tx) => {
+        // Upsert via função SECURITY DEFINER (0024) — ver mesmo comentário em
+        // `resetPassword`: o papel de app não tem UPDATE em user_credential.
+        await tx `SELECT set_user_password(${auth.userId}, ${(0, password_js_1.hashPassword)(input.newPassword)}, false)`;
+        await (0, audit_js_1.appendAudit)(tx, {
+            actorId: auth.userId,
+            action: wasForced ? 'mandatory_password_change_completed' : 'password_changed',
+            resourceType: 'user',
+            resourceId: auth.userId,
+            ip: input.ip,
+            userAgent: input.userAgent,
+        });
+    });
+}
+/**
+ * Registra na trilha do tenant, com o ator PREENCHIDO.
+ *
+ * O `actorId` era usado só para abrir o contexto de RLS e não entrava na linha:
+ * 310 eventos de `login` em produção ficaram com `actor_id` nulo, e a tela de
+ * Auditoria — que agora diz quem praticou o ato — os atribuía a "Sistema".
+ * Entrar no sistema é o ato mais frequente da trilha e o mais óbvio de ter
+ * dono; era o único que não tinha.
+ *
+ * A correção vale daqui para a frente. As linhas históricas continuam como
+ * foram gravadas: reescrever trilha append-only para melhorar um relatório é
+ * exatamente o que uma trilha existe para impedir.
+ */
 async function auditWithinTenant(db, tenantId, actorId, entry) {
-    await (0, context_js_1.withContext)(db, { tenantId, userId: actorId }, (tx) => (0, audit_js_1.appendAudit)(tx, entry));
+    await (0, context_js_1.withContext)(db, { tenantId, userId: actorId }, (tx) => (0, audit_js_1.appendAudit)(tx, { actorId, ...entry }));
 }
 //# sourceMappingURL=service.js.map

package/dist/cjs/auth/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/auth/service.ts"],"names":[],"mappings":";;AAmDA,wDAuBC;AAGD,sBAsDC;AAGD,0CAkBC;AAGD,oCA8BC;AAMD,oCAuBC;AA4BD,gDAGC;AAGD,0CASC;AAGD,wBAEC;AAtQD,0CAAyF;AAGzF,iDAA+C;AAC/C,gDAAgD;AAChD,uDAA2D;AAC3D,2DAA4D;AAC5D,6DAAoF;AACpF,+CAA6D;AAC7D,yDAAqE;AAErE,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AAqClD,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAEpD,4EAA4E;AACrE,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,KAAiF;IAEjF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;cAE3B,IAAA,eAAM,GAAE,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO;;;;GAIpF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IAC3B,MAAM,EAAE,CAAA;;cAEI,MAAM,KAAK,IAAA,0BAAY,EAAC,KAAK,CAAC,QAAQ,CAAC;;GAElD,CAAC;IACF,OAAO;QACL,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO;KACpC,CAAC;AACJ,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,KAAK,CACzB,EAAM,EACN,KAAyD,EACzD,QAAe,UAAU;IAEzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAErB;;gCAE6B,KAAK,CAAC,KAAK;GACxC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAA6B;gEACW,IAAI,CAAC,EAAE;GACpE,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAc,EAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,uCAAoB,GAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,IAAA,eAAM,GAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC;IAEjD,MAAM,EAAE,CAAA;;cAEI,SAAS,KAAK,IAAI,CAAC,EAAE,KAAK,SAAS,WAAW,SAAS;GAClE,CAAC;IACF,MAAM,EAAE,CAAA,qCAAqC,IAAI,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,EAAE,EAAE,CAAC;IAEnF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvD,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,cAAc,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC;QAC1C,MAAM,EAAE,CAAA,8CAA8C,cAAc,eAAe,SAAS,EAAE,CAAC;QAC/F,MAAM,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;YACnD,MAAM,EAAE,OAAO;YACf,YAAY,EAAE,cAAc;YAC5B,UAAU,EAAE,SAAS;YACrB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE;QAC5F,WAAW;QACX,cAAc;KACf,CAAC;AACJ,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,MAAc;IAC1D,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;;0BAIqB,MAAM;;KAE3B,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,UAAU,EAAE,CAAC,CAAC,YAAY;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AACnE,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,KAAyD;IAEzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAc,CAAC,oCAAoC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,CAAA;iDACuC,KAAK,CAAC,QAAQ,eAAe,OAAO,CAAC,EAAE;GACrF,CAAC;IACF,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzF,MAAM,WAAW,GAAG,MAAM,IAAA,kCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,KAAK,CAAC,QAAQ;YAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW;SACZ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,0BAAiB,CAAC,4CAA4C,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAC1C,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzE,MAAM,WAAW,GAAG,MAAM,IAAA,kCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,GAAG,GAAgB;YACvB,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ;YACR,WAAW;SACZ,CAAC;QACF,IAAI,OAAO,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YAC1C,GAAG,CAAC,QAAQ,GAAG,MAAM,IAAA,iCAAiB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AASD,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAc;;;;2BAIV,IAAA,4BAAS,EAAC,KAAK,CAAC;;2BAEhB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;;GAE7C,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,oFAAoF;AAC7E,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,KAAa;IAC5D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,wFAAwF;AACjF,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CACzE,IAAA,mCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CACzC,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,gCAAgC;AACzB,KAAK,UAAU,MAAM,CAAC,EAAM,EAAE,KAAa;IAChD,MAAM,EAAE,CAAA,iEAAiE,IAAA,4BAAS,EAAC,KAAK,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,QAAgB,EAChB,OAAe,EACf,KAAwC;IAExC,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,sBAAW,EAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AACvF,CAAC"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/auth/service.ts"],"names":[],"mappings":";;AA6EA,wDA4CC;AAGD,sBAwDC;AAGD,0CAkBC;AAGD,oCA+BC;AA2BD,oCAqCC;AA+BD,gDAGC;AAGD,0CASC;AAGD,wBAEC;AAQD,wCA6BC;AAnYD,0CAMuB;AAGvB,iDAA+C;AAC/C,gDAAgD;AAChD,uDAA2D;AAC3D,2DAA4D;AAC5D,6DAAoF;AACpF,+CAA6D;AAC7D,yDAAqE;AAErE,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AAyClD,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,KAOC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;cAE3B,IAAA,eAAM,GAAE,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO;;;;GAIpF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IAE3B,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB;QACrC,CAAC,CAAC,MAAM,EAAE,CAAuB;;kBAEnB,MAAM,KAAK,IAAA,0BAAY,EAAC,KAAK,CAAC,QAAQ,CAAC;;;OAGlD;QACH,CAAC,CAAC,MAAM,EAAE,CAAuB;;kBAEnB,MAAM,KAAK,IAAA,0BAAY,EAAC,KAAK,CAAC,QAAQ,CAAC;;;OAGlD,CAAC;IAEN,OAAO;QACL,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO;QACnC,cAAc,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,KAAK,CACzB,EAAM,EACN,KAAyD,EACzD,QAAe,UAAU;IAEzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAErB;;gCAE6B,KAAK,CAAC,KAAK;GACxC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAA4D;sFACE,IAAI,CAAC,EAAE;GAC1F,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAc,EAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAEzD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,uCAAoB,GAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,IAAA,eAAM,GAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC;IAEjD,MAAM,EAAE,CAAA;;cAEI,SAAS,KAAK,IAAI,CAAC,EAAE,KAAK,SAAS,WAAW,SAAS;GAClE,CAAC;IACF,MAAM,EAAE,CAAA,qCAAqC,IAAI,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,EAAE,EAAE,CAAC;IAEnF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvD,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,cAAc,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC;QAC1C,MAAM,EAAE,CAAA,8CAA8C,cAAc,eAAe,SAAS,EAAE,CAAC;QAC/F,MAAM,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;YACnD,MAAM,EAAE,OAAO;YACf,YAAY,EAAE,cAAc;YAC5B,UAAU,EAAE,SAAS;YACrB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE;QAC5F,WAAW;QACX,cAAc;QACd,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,MAAc;IAC1D,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;;0BAIqB,MAAM;;KAE3B,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,UAAU,EAAE,CAAC,CAAC,YAAY;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AACnE,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,KAAyD;IAEzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAc,CAAC,oCAAoC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,CAAA;iDACuC,KAAK,CAAC,QAAQ,eAAe,OAAO,CAAC,EAAE;GACrF,CAAC;IACF,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzF,MAAM,WAAW,GAAG,MAAM,IAAA,kCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,KAAK,CAAC,QAAQ;YAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW;YACX,kBAAkB,EAAE,OAAO,CAAC,oBAAoB;SACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACI,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,0BAAiB,CAAC,4CAA4C,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAE1C,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,sEAAsE;IACtE,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAc,CAAC,oCAAoC,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzE,MAAM,WAAW,GAAG,MAAM,IAAA,kCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,GAAG,GAAgB;YACvB,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ;YACR,WAAW;YACX,kBAAkB,EAAE,OAAO,CAAC,oBAAoB;SACjD,CAAC;QACF,IAAI,OAAO,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YAC1C,GAAG,CAAC,QAAQ,GAAG,MAAM,IAAA,iCAAiB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAc;;;;;;2BAMV,IAAA,4BAAS,EAAC,KAAK,CAAC;;2BAEhB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;;GAE7C,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,oFAAoF;AAC7E,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,KAAa;IAC5D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,wFAAwF;AACjF,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CACzE,IAAA,mCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CACzC,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,gCAAgC;AACzB,KAAK,UAAU,MAAM,CAAC,EAAM,EAAE,KAAa;IAChD,MAAM,EAAE,CAAA,8BAA8B,IAAA,4BAAS,EAAC,KAAK,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,cAAc,CAClC,EAAM,EACN,IAA0C,EAC1C,KAAsE;IAEtE,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,wBAAe,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAA4D;sFACE,IAAI,CAAC,MAAM;GAC9F,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAc,EAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAEhD,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACnF,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,EAAE,CAAA,4BAA4B,IAAI,CAAC,MAAM,KAAK,IAAA,0BAAY,EAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC;QAC9F,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;YACpB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,kBAAkB;YAC9E,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,QAAgB,EAChB,OAAe,EACf,KAAwC;IAExC,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAC1D,IAAA,sBAAW,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CACvC,CAAC;AACJ,CAAC"}