@baseplate-dev/plugin-auth 4.0.1 → 4.0.3

package/dist/local-auth/core/generators/auth-email-password/generated/typed-templates.js

@@ -1,5 +1,7 @@
 import { createTsTemplateFile } from '@baseplate-dev/core-generators';
-import { errorHandlerServiceImportsProvider, passwordHasherServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionServiceImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { configServiceImportsProvider, errorHandlerServiceImportsProvider, passwordHasherServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionServiceImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { emailModuleImportsProvider } from '@baseplate-dev/plugin-email';
+import { rateLimitImportsProvider } from '@baseplate-dev/plugin-rate-limit';
 import path from 'node:path';
 import { authModuleImportsProvider } from '#src/local-auth/core/generators/auth-module/generated/ts-import-providers.js';
 const constantsPassword = createTsTemplateFile({
@@ -7,12 +9,27 @@ const constantsPassword = createTsTemplateFile({
     group: 'module',
     importMapProviders: {},
     name: 'constants-password',
-    projectExports: { PASSWORD_MIN_LENGTH: {} },
+    projectExports: {
+        PASSWORD_MAX_LENGTH: {},
+        PASSWORD_MIN_LENGTH: {},
+        PASSWORD_RESET_TOKEN_EXPIRY_SEC: {},
+    },
     source: {
         path: path.join(import.meta.dirname, '../templates/module/constants/password.constants.ts'),
     },
     variables: {},
 });
+const schemaPasswordResetMutations = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    group: 'module',
+    importMapProviders: { pothosImports: pothosImportsProvider },
+    name: 'schema-password-reset-mutations',
+    referencedGeneratorTemplates: { servicesPasswordReset: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/schema/password-reset.mutations.ts'),
+    },
+    variables: {},
+});
 const schemaUserPasswordMutations = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     group: 'module',
@@ -27,6 +44,32 @@ const schemaUserPasswordMutations = createTsTemplateFile({
     },
     variables: { TPL_ADMIN_ROLES: {}, TPL_USER_OBJECT_TYPE: {} },
 });
+const servicesPasswordReset = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    group: 'module',
+    importMapProviders: {
+        authModuleImports: authModuleImportsProvider,
+        configServiceImports: configServiceImportsProvider,
+        emailModuleImports: emailModuleImportsProvider,
+        errorHandlerServiceImports: errorHandlerServiceImportsProvider,
+        passwordHasherServiceImports: passwordHasherServiceImportsProvider,
+        prismaImports: prismaImportsProvider,
+        rateLimitImports: rateLimitImportsProvider,
+        requestServiceContextImports: requestServiceContextImportsProvider,
+    },
+    name: 'services-password-reset',
+    projectExports: {
+        cleanupExpiredPasswordResetTokens: { isTypeOnly: false },
+        completePasswordReset: { isTypeOnly: false },
+        requestPasswordReset: { isTypeOnly: false },
+        validatePasswordResetToken: { isTypeOnly: false },
+    },
+    referencedGeneratorTemplates: { constantsPassword: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/services/password-reset.service.ts'),
+    },
+    variables: { TPL_PASSWORD_CHANGED_EMAIL: {}, TPL_PASSWORD_RESET_EMAIL: {} },
+});
 const servicesUserPassword = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     group: 'module',
@@ -35,6 +78,7 @@ const servicesUserPassword = createTsTemplateFile({
         passwordHasherServiceImports: passwordHasherServiceImportsProvider,
         prismaGeneratedImports: prismaGeneratedImportsProvider,
         prismaImports: prismaImportsProvider,
+        rateLimitImports: rateLimitImportsProvider,
         requestServiceContextImports: requestServiceContextImportsProvider,
         userSessionServiceImports: userSessionServiceImportsProvider,
         userSessionTypesImports: userSessionTypesImportsProvider,
@@ -45,7 +89,10 @@ const servicesUserPassword = createTsTemplateFile({
         createUserWithEmailAndPassword: {},
         registerUserWithEmailAndPassword: {},
     },
-    referencedGeneratorTemplates: { constantsPassword: {} },
+    referencedGeneratorTemplates: {
+        constantsPassword: {},
+        servicesEmailVerification: {},
+    },
     source: {
         path: path.join(import.meta.dirname, '../templates/module/services/user-password.service.ts'),
     },
@@ -53,8 +100,42 @@ const servicesUserPassword = createTsTemplateFile({
 });
 export const moduleGroup = {
     constantsPassword,
+    schemaPasswordResetMutations,
     schemaUserPasswordMutations,
+    servicesPasswordReset,
     servicesUserPassword,
 };
-export const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES = { moduleGroup };
+const schemaEmailVerificationMutations = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: { pothosImports: pothosImportsProvider },
+    name: 'schema-email-verification-mutations',
+    referencedGeneratorTemplates: { servicesEmailVerification: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/schema/email-verification.mutations.ts'),
+    },
+    variables: {},
+});
+const servicesEmailVerification = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {
+        authModuleImports: authModuleImportsProvider,
+        configServiceImports: configServiceImportsProvider,
+        emailModuleImports: emailModuleImportsProvider,
+        errorHandlerServiceImports: errorHandlerServiceImportsProvider,
+        prismaImports: prismaImportsProvider,
+        rateLimitImports: rateLimitImportsProvider,
+        requestServiceContextImports: requestServiceContextImportsProvider,
+    },
+    name: 'services-email-verification',
+    referencedGeneratorTemplates: { constantsPassword: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/services/email-verification.service.ts'),
+    },
+    variables: { TPL_ACCOUNT_VERIFICATION_EMAIL: {} },
+});
+export const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES = {
+    moduleGroup,
+    schemaEmailVerificationMutations,
+    servicesEmailVerification,
+};
 //# sourceMappingURL=typed-templates.js.map

package/dist/local-auth/core/generators/auth-email-password/generated/typed-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"typed-templates.js","sourceRoot":"","sources":["../../../../../../src/local-auth/core/generators/auth-email-password/generated/typed-templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EACL,kCAAkC,EAClC,oCAAoC,EACpC,qBAAqB,EACrB,8BAA8B,EAC9B,qBAAqB,EACrB,oCAAoC,EACpC,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,8EAA8E,CAAC;AAEzH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;IAC7C,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAClC,KAAK,EAAE,QAAQ;IACf,kBAAkB,EAAE,EAAE;IACtB,IAAI,EAAE,oBAAoB;IAC1B,cAAc,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE;IAC3C,MAAM,EAAE;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,qDAAqD,CACtD;KACF;IACD,SAAS,EAAE,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;IACvD,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAClC,KAAK,EAAE,QAAQ;IACf,kBAAkB,EAAE;QAClB,iBAAiB,EAAE,yBAAyB;QAC5C,aAAa,EAAE,qBAAqB;KACrC;IACD,IAAI,EAAE,gCAAgC;IACtC,4BAA4B,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;IAC1D,MAAM,EAAE;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,uDAAuD,CACxD;KACF;IACD,SAAS,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;CAC7D,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;IAChD,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAClC,KAAK,EAAE,QAAQ;IACf,kBAAkB,EAAE;QAClB,0BAA0B,EAAE,kCAAkC;QAC9D,4BAA4B,EAAE,oCAAoC;QAClE,sBAAsB,EAAE,8BAA8B;QACtD,aAAa,EAAE,qBAAqB;QACpC,4BAA4B,EAAE,oCAAoC;QAClE,yBAAyB,EAAE,iCAAiC;QAC5D,uBAAuB,EAAE,+BAA+B;KACzD;IACD,IAAI,EAAE,wBAAwB;IAC9B,cAAc,EAAE;QACd,oCAAoC,EAAE,EAAE;QACxC,8BAA8B,EAAE,EAAE;QAClC,gCAAgC,EAAE,EAAE;KACrC;IACD,4BAA4B,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE;IACvD,MAAM,EAAE;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,uDAAuD,CACxD;KACF;IACD,SAAS,EAAE,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iBAAiB;IACjB,2BAA2B;IAC3B,oBAAoB;CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,6CAA6C,GAAG,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"typed-templates.js","sourceRoot":"","sources":["../../../../../../src/local-auth/core/generators/auth-email-password/generated/typed-templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,oCAAoC,EACpC,qBAAqB,EACrB,8BAA8B,EAC9B,qBAAqB,EACrB,oCAAoC,EACpC,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,8EAA8E,CAAC;AAEzH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;IAC7C,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAClC,KAAK,EAAE,QAAQ;IACf,kBAAkB,EAAE,EAAE;IACtB,IAAI,EAAE,oBAAoB;IAC1B,cAAc,EAAE;QACd,mBAAmB,EAAE,EAAE;QACvB,mBAAmB,EAAE,EAAE;QACvB,+BAA+B,EAAE,EAAE;KACpC;IACD,MAAM,EAAE;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,qDAAqD,CACtD;KACF;IACD,SAAS,EAAE,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,oBAAoB,CAAC;IACxD,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAClC,KAAK,EAAE,QAAQ;IACf,kBAAkB,EAAE,EAAE,aAAa,EAAE,qBAAqB,EAAE;IAC5D,IAAI,EAAE,iCAAiC;IACvC,4BAA4B,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE;IAC3D,MAAM,EAAE;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,wDAAwD,CACzD;KACF;IACD,SAAS,EAAE,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;IACvD,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAClC,KAAK,EAAE,QAAQ;IACf,kBAAkB,EAAE;QAClB,iBAAiB,EAAE,yBAAyB;QAC5C,aAAa,EAAE,qBAAqB;KACrC;IACD,IAAI,EAAE,gCAAgC;IACtC,4BAA4B,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;IAC1D,MAAM,EAAE;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,uDAAuD,CACxD;KACF;IACD,SAAS,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;CAC7D,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;IACjD,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAClC,KAAK,EAAE,QAAQ;IACf,kBAAkB,EAAE;QAClB,iBAAiB,EAAE,yBAAyB;QAC5C,oBAAoB,EAAE,4BAA4B;QAClD,kBAAkB,EAAE,0BAA0B;QAC9C,0BAA0B,EAAE,kCAAkC;QAC9D,4BAA4B,EAAE,oCAAoC;QAClE,aAAa,EAAE,qBAAqB;QACpC,gBAAgB,EAAE,wBAAwB;QAC1C,4BAA4B,EAAE,oCAAoC;KACnE;IACD,IAAI,EAAE,yBAAyB;IAC/B,cAAc,EAAE;QACd,iCAAiC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;QACxD,qBAAqB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;QAC5C,oBAAoB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;QAC3C,0BAA0B,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;KAClD;IACD,4BAA4B,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE;IACvD,MAAM,EAAE;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,wDAAwD,CACzD;KACF;IACD,SAAS,EAAE,EAAE,0BAA0B,EAAE,EAAE,EAAE,wBAAwB,EAAE,EAAE,EAAE;CAC5E,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;IAChD,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAClC,KAAK,EAAE,QAAQ;IACf,kBAAkB,EAAE;QAClB,0BAA0B,EAAE,kCAAkC;QAC9D,4BAA4B,EAAE,oCAAoC;QAClE,sBAAsB,EAAE,8BAA8B;QACtD,aAAa,EAAE,qBAAqB;QACpC,gBAAgB,EAAE,wBAAwB;QAC1C,4BAA4B,EAAE,oCAAoC;QAClE,yBAAyB,EAAE,iCAAiC;QAC5D,uBAAuB,EAAE,+BAA+B;KACzD;IACD,IAAI,EAAE,wBAAwB;IAC9B,cAAc,EAAE;QACd,oCAAoC,EAAE,EAAE;QACxC,8BAA8B,EAAE,EAAE;QAClC,gCAAgC,EAAE,EAAE;KACrC;IACD,4BAA4B,EAAE;QAC5B,iBAAiB,EAAE,EAAE;QACrB,yBAAyB,EAAE,EAAE;KAC9B;IACD,MAAM,EAAE;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,uDAAuD,CACxD;KACF;IACD,SAAS,EAAE,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iBAAiB;IACjB,4BAA4B;IAC5B,2BAA2B;IAC3B,qBAAqB;IACrB,oBAAoB;CACrB,CAAC;AAEF,MAAM,gCAAgC,GAAG,oBAAoB,CAAC;IAC5D,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAClC,kBAAkB,EAAE,EAAE,aAAa,EAAE,qBAAqB,EAAE;IAC5D,IAAI,EAAE,qCAAqC;IAC3C,4BAA4B,EAAE,EAAE,yBAAyB,EAAE,EAAE,EAAE;IAC/D,MAAM,EAAE;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,4DAA4D,CAC7D;KACF;IACD,SAAS,EAAE,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;IACrD,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAClC,kBAAkB,EAAE;QAClB,iBAAiB,EAAE,yBAAyB;QAC5C,oBAAoB,EAAE,4BAA4B;QAClD,kBAAkB,EAAE,0BAA0B;QAC9C,0BAA0B,EAAE,kCAAkC;QAC9D,aAAa,EAAE,qBAAqB;QACpC,gBAAgB,EAAE,wBAAwB;QAC1C,4BAA4B,EAAE,oCAAoC;KACnE;IACD,IAAI,EAAE,6BAA6B;IACnC,4BAA4B,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE;IACvD,MAAM,EAAE;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,4DAA4D,CAC7D;KACF;IACD,SAAS,EAAE,EAAE,8BAA8B,EAAE,EAAE,EAAE;CAClD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6CAA6C,GAAG;IAC3D,WAAW;IACX,gCAAgC;IAChC,yBAAyB;CAC1B,CAAC"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.d.ts

@@ -1,2 +1,17 @@
+/**
+ * Minimum password length
+ */
 export declare const PASSWORD_MIN_LENGTH = 8;
+/**
+ * Maximum password length (prevents DoS attacks via excessive bcrypt/argon2 computation)
+ */
+export declare const PASSWORD_MAX_LENGTH = 255;
+/**
+ * Password reset token expiration time in seconds (1 hour per OWASP recommendations)
+ */
+export declare const PASSWORD_RESET_TOKEN_EXPIRY_SEC: number;
+/**
+ * Email verification token expiration time in seconds (24 hours)
+ */
+export declare const EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC: number;
 //# sourceMappingURL=password.constants.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.constants.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mBAAmB,IAAI,CAAC"}
+{"version":3,"file":"password.constants.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;GAEG;AACH,eAAO,MAAM,+BAA+B,QAAU,CAAC;AAEvD;;GAEG;AACH,eAAO,MAAM,mCAAmC,QAAe,CAAC"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.js

@@ -1,3 +1,18 @@
 // @ts-nocheck
+/**
+ * Minimum password length
+ */
 export const PASSWORD_MIN_LENGTH = 8;
+/**
+ * Maximum password length (prevents DoS attacks via excessive bcrypt/argon2 computation)
+ */
+export const PASSWORD_MAX_LENGTH = 255;
+/**
+ * Password reset token expiration time in seconds (1 hour per OWASP recommendations)
+ */
+export const PASSWORD_RESET_TOKEN_EXPIRY_SEC = 60 * 60;
+/**
+ * Email verification token expiration time in seconds (24 hours)
+ */
+export const EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC = 60 * 60 * 24;
 //# sourceMappingURL=password.constants.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"password.constants.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC"}
+{"version":3,"file":"password.constants.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,CAAC;AAEvD;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.ts

@@ -1,3 +1,21 @@
 // @ts-nocheck
 
+/**
+ * Minimum password length
+ */
 export const PASSWORD_MIN_LENGTH = 8;
+
+/**
+ * Maximum password length (prevents DoS attacks via excessive bcrypt/argon2 computation)
+ */
+export const PASSWORD_MAX_LENGTH = 255;
+
+/**
+ * Password reset token expiration time in seconds (1 hour per OWASP recommendations)
+ */
+export const PASSWORD_RESET_TOKEN_EXPIRY_SEC = 60 * 60;
+
+/**
+ * Email verification token expiration time in seconds (24 hours)
+ */
+export const EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC = 60 * 60 * 24;

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=email-verification.mutations.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.mutations.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.ts"],"names":[],"mappings":""}

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.js

@@ -0,0 +1,24 @@
+// @ts-nocheck
+import { requestEmailVerification, verifyEmail, } from '$servicesEmailVerification';
+import { builder } from '%pothosImports';
+builder.mutationField('requestEmailVerification', (t) => t.fieldWithInputPayload({
+    authorize: ['user'],
+    payload: {
+        success: t.payload.field({ type: 'Boolean' }),
+    },
+    resolve: async (_root, _args, context) => requestEmailVerification({
+        userId: context.auth.userIdOrThrow(),
+        context,
+    }),
+}));
+builder.mutationField('verifyEmail', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+        token: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) => verifyEmail({ token: input.token, context }),
+}));
+//# sourceMappingURL=email-verification.mutations.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.mutations.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd,OAAO,EACL,wBAAwB,EACxB,WAAW,GACZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,OAAO,CAAC,aAAa,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CACvC,wBAAwB,CAAC;QACvB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE;QACpC,OAAO;KACR,CAAC;CACL,CAAC,CACH,CAAC;AAEF,OAAO,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CACzC,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C;IACD,KAAK,EAAE;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACzD;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAC3C,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;CAC/C,CAAC,CACH,CAAC"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.ts

@@ -0,0 +1,35 @@
+// @ts-nocheck
+
+import {
+  requestEmailVerification,
+  verifyEmail,
+} from '$servicesEmailVerification';
+import { builder } from '%pothosImports';
+
+builder.mutationField('requestEmailVerification', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['user'],
+    payload: {
+      success: t.payload.field({ type: 'Boolean' }),
+    },
+    resolve: async (_root, _args, context) =>
+      requestEmailVerification({
+        userId: context.auth.userIdOrThrow(),
+        context,
+      }),
+  }),
+);
+
+builder.mutationField('verifyEmail', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+      token: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) =>
+      verifyEmail({ token: input.token, context }),
+  }),
+);

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=password-reset.mutations.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.mutations.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.ts"],"names":[],"mappings":""}

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.js

@@ -0,0 +1,38 @@
+// @ts-nocheck
+import { completePasswordReset, requestPasswordReset, validatePasswordResetToken, } from '$servicesPasswordReset';
+import { builder } from '%pothosImports';
+builder.mutationField('requestPasswordReset', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+        email: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) => requestPasswordReset({ email: input.email, context }),
+}));
+builder.mutationField('validatePasswordResetToken', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        valid: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+        token: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) => validatePasswordResetToken({ token: input.token }),
+}));
+builder.mutationField('resetPasswordWithToken', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+        token: t.input.field({ required: true, type: 'String' }),
+        newPassword: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) => completePasswordReset({
+        token: input.token,
+        newPassword: input.newPassword,
+    }),
+}));
+//# sourceMappingURL=password-reset.mutations.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.mutations.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,OAAO,CAAC,aAAa,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,CAClD,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C;IACD,KAAK,EAAE;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACzD;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAC3C,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;CACxD,CAAC,CACH,CAAC;AAEF,OAAO,CAAC,aAAa,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,EAAE,CACxD,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE;QACP,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC5C;IACD,KAAK,EAAE;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACzD;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClC,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;CACrD,CAAC,CACH,CAAC;AAEF,OAAO,CAAC,aAAa,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CACpD,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C;IACD,KAAK,EAAE;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC/D;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClC,qBAAqB,CAAC;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;CACL,CAAC,CACH,CAAC"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.ts

@@ -0,0 +1,54 @@
+// @ts-nocheck
+
+import {
+  completePasswordReset,
+  requestPasswordReset,
+  validatePasswordResetToken,
+} from '$servicesPasswordReset';
+import { builder } from '%pothosImports';
+
+builder.mutationField('requestPasswordReset', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+      email: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) =>
+      requestPasswordReset({ email: input.email, context }),
+  }),
+);
+
+builder.mutationField('validatePasswordResetToken', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      valid: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+      token: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) =>
+      validatePasswordResetToken({ token: input.token }),
+  }),
+);
+
+builder.mutationField('resetPasswordWithToken', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+      token: t.input.field({ required: true, type: 'String' }),
+      newPassword: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) =>
+      completePasswordReset({
+        token: input.token,
+        newPassword: input.newPassword,
+      }),
+  }),
+);

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.d.ts

@@ -0,0 +1,24 @@
+import type { RequestServiceContext } from '%requestServiceContextImports';
+/**
+ * Request an email verification for the authenticated user.
+ * Sends a verification email with a link to verify.
+ */
+export declare function requestEmailVerification({ userId, context, }: {
+    userId: string;
+    context: RequestServiceContext;
+}): Promise<{
+    success: true;
+}>;
+/**
+ * Verify a user's email using the token from the verification email.
+ * This is a public (anonymous) mutation — the token proves identity.
+ *
+ * @throws BadRequestError if token is invalid or expired
+ */
+export declare function verifyEmail({ token, context, }: {
+    token: string;
+    context: RequestServiceContext;
+}): Promise<{
+    success: true;
+}>;
+//# sourceMappingURL=email-verification.service.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.service.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AA2C3E;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,MAAM,EACN,OAAO,GACR,EAAE;IACD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,qBAAqB,CAAC;CAChC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,CA0C7B;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,EAChC,KAAK,EACL,OAAO,GACR,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,qBAAqB,CAAC;CAChC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,CA4B7B"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.js

@@ -0,0 +1,87 @@
+// @ts-nocheck
+import { EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC } from '$constantsPassword';
+import { createAuthVerification, validateAuthVerification, } from '%authModuleImports';
+import { config } from '%configServiceImports';
+import { sendEmail } from '%emailModuleImports';
+import { BadRequestError } from '%errorHandlerServiceImports';
+import { prisma } from '%prismaImports';
+import { memoizeRateLimiter } from '%rateLimitImports';
+const EMAIL_VERIFY_TYPE = 'email-verify';
+/**
+ * Rate limiters for email verification operations.
+ */
+// Per-user rate limit: 3 requests per 20 minutes
+const getRequestEmailVerificationUserLimiter = memoizeRateLimiter('request-email-verification-user', {
+    points: 3,
+    duration: 60 * 20, // 20 minutes
+});
+// Per-IP rate limit: 10 requests/hour
+const getRequestEmailVerificationIpLimiter = memoizeRateLimiter('request-email-verification-ip', {
+    points: 10,
+    duration: 60 * 60, // 1 hour
+});
+// Per-IP rate limit for verify endpoint: 10 requests/hour
+const getVerifyEmailIpLimiter = memoizeRateLimiter('verify-email-ip', {
+    points: 10,
+    duration: 60 * 60, // 1 hour
+});
+/**
+ * Request an email verification for the authenticated user.
+ * Sends a verification email with a link to verify.
+ */
+export async function requestEmailVerification({ userId, context, }) {
+    await Promise.all([
+        getRequestEmailVerificationIpLimiter().consumeOrThrow(context.reqInfo.ip, 'Too many verification attempts. Please try again later.', 'too-many-requests'),
+        getRequestEmailVerificationUserLimiter().consumeOrThrow(userId, 'Too many verification attempts. Please try again later.', 'too-many-requests'),
+    ]);
+    const user = await prisma.user.findUnique({
+        where: { id: userId },
+        select: { id: true, email: true, emailVerified: true },
+    });
+    if (!user?.email) {
+        throw new BadRequestError('No email address on account', 'no-email');
+    }
+    if (user.emailVerified) {
+        return { success: true };
+    }
+    const { token } = await createAuthVerification({
+        type: EMAIL_VERIFY_TYPE,
+        userId: user.id,
+        expiresInSec: EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC,
+    });
+    // Construct verification URL using configured domain
+    const verifyLink = `${config.AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
+    await sendEmail(TPL_ACCOUNT_VERIFICATION_EMAIL, {
+        to: user.email,
+        data: { verifyLink },
+    });
+    return { success: true };
+}
+/**
+ * Verify a user's email using the token from the verification email.
+ * This is a public (anonymous) mutation — the token proves identity.
+ *
+ * @throws BadRequestError if token is invalid or expired
+ */
+export async function verifyEmail({ token, context, }) {
+    await getVerifyEmailIpLimiter().consumeOrThrow(context.reqInfo.ip, 'Too many verification attempts. Please try again later.', 'too-many-requests');
+    const record = await validateAuthVerification({
+        type: EMAIL_VERIFY_TYPE,
+        token,
+    });
+    if (!record?.userId) {
+        throw new BadRequestError('Invalid or expired token', 'invalid-token');
+    }
+    // Delete this token + remaining email-verify tokens + update user in one transaction
+    await prisma.$transaction([
+        prisma.authVerification.deleteMany({
+            where: { type: EMAIL_VERIFY_TYPE, userId: record.userId },
+        }),
+        prisma.user.update({
+            where: { id: record.userId },
+            data: { emailVerified: true },
+        }),
+    ]);
+    return { success: true };
+}
+//# sourceMappingURL=email-verification.service.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.service.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.ts"],"names":[],"mappings":"AAAA,cAAc;AAId,OAAO,EAAE,mCAAmC,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;GAEG;AAEH,iDAAiD;AACjD,MAAM,sCAAsC,GAAG,kBAAkB,CAC/D,iCAAiC,EACjC;IACE,MAAM,EAAE,CAAC;IACT,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,aAAa;CACjC,CACF,CAAC;AAEF,sCAAsC;AACtC,MAAM,oCAAoC,GAAG,kBAAkB,CAC7D,+BAA+B,EAC/B;IACE,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS;CAC7B,CACF,CAAC;AAEF,0DAA0D;AAC1D,MAAM,uBAAuB,GAAG,kBAAkB,CAAC,iBAAiB,EAAE;IACpE,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS;CAC7B,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,MAAM,EACN,OAAO,GAIR;IACC,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,oCAAoC,EAAE,CAAC,cAAc,CACnD,OAAO,CAAC,OAAO,CAAC,EAAE,EAClB,yDAAyD,EACzD,mBAAmB,CACpB;QACD,sCAAsC,EAAE,CAAC,cAAc,CACrD,MAAM,EACN,yDAAyD,EACzD,mBAAmB,CACpB;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;QACrB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;KACvD,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,sBAAsB,CAAC;QAC7C,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,YAAY,EAAE,mCAAmC;KAClD,CAAC,CAAC;IAEH,qDAAqD;IACrD,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,iBAAiB,4BAA4B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAEtG,MAAM,SAAS,CAAC,8BAA8B,EAAE;QAC9C,EAAE,EAAE,IAAI,CAAC,KAAK;QACd,IAAI,EAAE,EAAE,UAAU,EAAE;KACrB,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAChC,KAAK,EACL,OAAO,GAIR;IACC,MAAM,uBAAuB,EAAE,CAAC,cAAc,CAC5C,OAAO,CAAC,OAAO,CAAC,EAAE,EAClB,yDAAyD,EACzD,mBAAmB,CACpB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,IAAI,EAAE,iBAAiB;QACvB,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CAAC,0BAA0B,EAAE,eAAe,CAAC,CAAC;IACzE,CAAC;IAED,qFAAqF;IACrF,MAAM,MAAM,CAAC,YAAY,CAAC;QACxB,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;YACjC,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;SAC1D,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACjB,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;YAC5B,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;SAC9B,CAAC;KACH,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}