@bevel-software/platform-core-backend 0.27.0 → 0.28.0

package/dist/modules/auth/account-hooks.d.ts

@@ -0,0 +1,46 @@
+import type { AuthUser } from '@bevel-software/platform-shared';
+/**
+ * An admin invited somebody: a NEW account was made for the address. Never
+ * raised for an account that was already there (an invite that only set a
+ * starting password, a password reset, a rename), and never for a first
+ * single sign-on, which provisions by itself: the person is already in.
+ */
+export interface AccountInvitedEvent {
+    /** The new account, as the admin's answer carries it. */
+    account: Pick<AuthUser, 'id' | 'email' | 'name'>;
+    /** The admin who invited them. */
+    invitedBy: Pick<AuthUser, 'id' | 'email' | 'name'>;
+    /**
+     * Whether the account was created with a starting password the admin
+     * typed. The password itself never travels: a listener that writes to the
+     * person says it comes from the admin separately.
+     */
+    passwordSet: boolean;
+}
+/**
+ * A listener answers how it reached the person — a non-empty channel name,
+ * `'email'` say — or null when it did not (nothing configured, the send
+ * failed). It is awaited: the admin's answer says who was notified,
+ * truthfully, so a listener bounds its own wait. A throw is logged and
+ * counts as null; it never fails the invite. An empty name is no channel and
+ * counts as null too.
+ */
+export type AccountInvitedHook = (event: AccountInvitedEvent) => Promise<string | null>;
+/**
+ * Core's seam for "an account was invited": a deployment (the cloud with its
+ * mail, an enterprise overlay) registers how to tell the person, and core
+ * says in its answer whether somebody did. Core registers nothing, so a
+ * core-only deployment notifies nobody and the admin is handed the link and
+ * the message to send, as before.
+ */
+export interface IAccountHooks {
+    onAccountInvited(hook: AccountInvitedHook): void;
+    /** Run every listener in registration order; the channels that reached the person, in that order. */
+    runAccountInvited(event: AccountInvitedEvent): Promise<string[]>;
+}
+export declare class AccountHooks implements IAccountHooks {
+    private readonly invited;
+    onAccountInvited(hook: AccountInvitedHook): void;
+    runAccountInvited(event: AccountInvitedEvent): Promise<string[]>;
+}
+//# sourceMappingURL=account-hooks.d.ts.map

package/dist/modules/auth/account-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-hooks.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAKhE;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;IACjD,kCAAkC;IAClC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;IACnD;;;;OAIG;IACH,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACjD,qGAAqG;IACrG,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAClE;AAED,qBAAa,YAAa,YAAW,aAAa;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IAEpD,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI;IAI1C,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAcvE"}

package/dist/modules/auth/account-hooks.js

@@ -0,0 +1,25 @@
+import { logger } from '../../shared/logging.js';
+const log = logger('accounts');
+export class AccountHooks {
+    invited = [];
+    onAccountInvited(hook) {
+        this.invited.push(hook);
+    }
+    async runAccountInvited(event) {
+        const notified = [];
+        for (const hook of this.invited) {
+            try {
+                const channel = await hook(event);
+                if (channel !== null && channel !== '')
+                    notified.push(channel);
+            }
+            catch (err) {
+                // The account exists whether or not the person was told: the admin's
+                // answer says they were not, and the admin sends the link themselves.
+                log.error('an account-invited listener failed; the person was not notified by it:', { err });
+            }
+        }
+        return notified;
+    }
+}
+//# sourceMappingURL=account-hooks.js.map

package/dist/modules/auth/account-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-hooks.js","sourceRoot":"","sources":["../../../src/modules/auth/account-hooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AA4C/B,MAAM,OAAO,YAAY;IACN,OAAO,GAAyB,EAAE,CAAC;IAEpD,gBAAgB,CAAC,IAAwB;QACvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAA0B;QAChD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,EAAE;oBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,sEAAsE;gBACtE,GAAG,CAAC,KAAK,CAAC,wEAAwE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/modules/auth/account-switch-guard.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Auth's contract for a write that must not land on a switched-off account:
+ * `whileSwitchedOn` runs `write` only while `email` is not switched off, and
+ * keeps it so until `write` has finished. A switch-off either committed
+ * before the check (`write` is refused with a 409 `deactivated` and never
+ * runs) or waits until `write` is done. An address with no account yet counts
+ * as switched on.
+ *
+ * Implemented by `AuthService`; other modules take this contract, not the
+ * service, so how auth coordinates switch-offs stays its own.
+ */
+export interface IAccountSwitchGuard {
+    whileSwitchedOn(email: string, write: () => Promise<void>): Promise<void>;
+}
+//# sourceMappingURL=account-switch-guard.d.ts.map

package/dist/modules/auth/account-switch-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-switch-guard.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account-switch-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E"}

package/dist/modules/auth/account-switch-guard.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=account-switch-guard.js.map

package/dist/modules/auth/account-switch-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-switch-guard.js","sourceRoot":"","sources":["../../../src/modules/auth/account-switch-guard.ts"],"names":[],"mappings":""}

package/dist/modules/auth/account-switch-lock.d.ts

@@ -0,0 +1,34 @@
+import type { Database } from '../database/connection.js';
+/** The handle `db.transaction` hands its callback. */
+type Tx = Parameters<Parameters<Database['transaction']>[0]>[0];
+/**
+ * How long a switch-off or a promotion waits for the address's lock. The
+ * holder may be a promotion committing `roles.yaml` (a git commit and push,
+ * seconds), so the wait is generous; it is bounded all the same, for the
+ * reason `database/advisory-lock.ts` gives: a waiter blocked for good sits
+ * on a pooled connection, and a wedged holder would take the pool with it.
+ */
+export declare const ACCOUNT_SWITCH_LOCK_WAIT_MS = 15000;
+/** What a caller is told when the wait ran out: a 409, to try again shortly. */
+export declare const ACCOUNT_BUSY_MESSAGE = "Another change to this account is still being saved; try again in a moment.";
+/**
+ * Hold, for the rest of `tx`, the one lock that orders an address's switch-off
+ * against a write that must not land on a switched-off account (the invite's
+ * Admin promotion).
+ *
+ * A row lock cannot do it: an address with no account yet has no row, and an
+ * account can be created switched off (single sign-on waiting for an admin)
+ * or created and switched off while the promotion is being written. So the
+ * lock is a transaction-scoped advisory lock on the canonical address, taken
+ * by every write that switches an account off and by the promotion, before
+ * either reads the row. Whichever comes second waits for the first to commit,
+ * then reads what it committed (READ COMMITTED takes a fresh snapshot per
+ * statement). A different address that hashes to the same key only waits.
+ *
+ * The wait is bounded by a transaction-local `lock_timeout`
+ * ({@link ACCOUNT_SWITCH_LOCK_WAIT_MS}), which the transaction's end reverts
+ * with everything else; running out of it is answered as a 409 `account-busy`.
+ */
+export declare function takeAccountSwitchLock(tx: Pick<Tx, 'execute'>, email: string, waitMs?: number): Promise<void>;
+export {};
+//# sourceMappingURL=account-switch-lock.d.ts.map

package/dist/modules/auth/account-switch-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-switch-lock.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account-switch-lock.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAK1D,sDAAsD;AACtD,KAAK,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAKlD,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,gFAAgF,CAAC;AAElH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,EACvB,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAoC,GAC3C,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/modules/auth/account-switch-lock.js

@@ -0,0 +1,48 @@
+import { sql } from 'drizzle-orm';
+import { canonicalEmail } from '../../shared/email-identity.js';
+import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { pgErrorCode } from '../database/pg-error.js';
+/**
+ * How long a switch-off or a promotion waits for the address's lock. The
+ * holder may be a promotion committing `roles.yaml` (a git commit and push,
+ * seconds), so the wait is generous; it is bounded all the same, for the
+ * reason `database/advisory-lock.ts` gives: a waiter blocked for good sits
+ * on a pooled connection, and a wedged holder would take the pool with it.
+ */
+export const ACCOUNT_SWITCH_LOCK_WAIT_MS = 15_000;
+/** Postgres raises this when `lock_timeout` expires while waiting for a lock. */
+const LOCK_NOT_AVAILABLE = '55P03';
+/** What a caller is told when the wait ran out: a 409, to try again shortly. */
+export const ACCOUNT_BUSY_MESSAGE = 'Another change to this account is still being saved; try again in a moment.';
+/**
+ * Hold, for the rest of `tx`, the one lock that orders an address's switch-off
+ * against a write that must not land on a switched-off account (the invite's
+ * Admin promotion).
+ *
+ * A row lock cannot do it: an address with no account yet has no row, and an
+ * account can be created switched off (single sign-on waiting for an admin)
+ * or created and switched off while the promotion is being written. So the
+ * lock is a transaction-scoped advisory lock on the canonical address, taken
+ * by every write that switches an account off and by the promotion, before
+ * either reads the row. Whichever comes second waits for the first to commit,
+ * then reads what it committed (READ COMMITTED takes a fresh snapshot per
+ * statement). A different address that hashes to the same key only waits.
+ *
+ * The wait is bounded by a transaction-local `lock_timeout`
+ * ({@link ACCOUNT_SWITCH_LOCK_WAIT_MS}), which the transaction's end reverts
+ * with everything else; running out of it is answered as a 409 `account-busy`.
+ */
+export async function takeAccountSwitchLock(tx, email, waitMs = ACCOUNT_SWITCH_LOCK_WAIT_MS) {
+    await tx.execute(sql `select set_config('lock_timeout', ${String(waitMs)}, true)`);
+    try {
+        await tx.execute(sql `select pg_advisory_xact_lock(hashtext(${`account-switch:${canonicalEmail(email)}`}))`);
+    }
+    catch (err) {
+        // Drizzle wraps the driver's error, so the SQLSTATE is on its cause.
+        if (pgErrorCode(err) === LOCK_NOT_AVAILABLE) {
+            throw new WorkflowDomainError(ACCOUNT_BUSY_MESSAGE, 409, { kind: 'account-busy' });
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=account-switch-lock.js.map

package/dist/modules/auth/account-switch-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-switch-lock.js","sourceRoot":"","sources":["../../../src/modules/auth/account-switch-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAKtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,6EAA6E,CAAC;AAElH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAuB,EACvB,KAAa,EACb,SAAiB,2BAA2B;IAE5C,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,qCAAqC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,yCAAyC,kBAAkB,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,kBAAkB,EAAE,CAAC;YAC5C,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/modules/auth/account.routes.d.ts

@@ -1,5 +1,6 @@
 import express from 'express';
 import type { AuthService } from './auth.service.js';
+import type { IAccountHooks } from './account-hooks.js';
 import { type IAccountErasureService } from './account-erasure.service.js';
 import type { IAdminAccessService } from '../admin/admin.interface.js';
 import type { UserAccessRemovalService } from '../access/user-access-removal.service.js';
@@ -15,5 +16,7 @@ import './auth.middleware.js';
  * {@link IAdminAccessService} — the Admin role in `roles.yaml`, plus the env
  * bootstrap admin (always-admin, see AdminAccessService).
  */
-export declare function createAccountRoutes(authService: Pick<AuthService, 'listAccounts' | 'createAccount' | 'getUserById' | 'deactivate' | 'reactivate'>, adminAccess: IAdminAccessService, accountErasure: Pick<IAccountErasureService, 'eraseUser'>, accessRemoval?: Pick<UserAccessRemovalService, 'report' | 'assertRemovable' | 'remove' | 'filesNaming'>): express.Router;
+export declare function createAccountRoutes(authService: Pick<AuthService, 'listAccounts' | 'createAccount' | 'createAccountWithoutPassword' | 'createAccountWithStartingPassword' | 'getUserById' | 'deactivate' | 'reactivate' | 'isOwnerEmail' | 'assertDeletable'>, adminAccess: IAdminAccessService, accountErasure: Pick<IAccountErasureService, 'eraseUser'>, 
+/** Who tells an invited person (see {@link IAccountHooks}); core registers nobody. */
+accountHooks: Pick<IAccountHooks, 'runAccountInvited'>, accessRemoval?: Pick<UserAccessRemovalService, 'report' | 'assertRemovable' | 'remove' | 'filesNaming'>): express.Router;
 //# sourceMappingURL=account.routes.d.ts.map

package/dist/modules/auth/account.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAGzF,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,eAAe,GAAG,aAAa,GAAG,YAAY,GAAG,YAAY,CAAC,EAC9G,WAAW,EAAE,mBAAmB,EAChC,cAAc,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,EACzD,aAAa,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GACtG,OAAO,CAAC,MAAM,CA2NhB"}
+{"version":3,"file":"account.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAIzF,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,IAAI,CACf,WAAW,EACT,cAAc,GACd,eAAe,GACf,8BAA8B,GAC9B,mCAAmC,GACnC,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,cAAc,GACd,iBAAiB,CACpB,EACD,WAAW,EAAE,mBAAmB,EAChC,cAAc,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC;AACzD,sFAAsF;AACtF,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,EACtD,aAAa,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GACtG,OAAO,CAAC,MAAM,CAkThB"}

package/dist/modules/auth/account.routes.js

@@ -7,6 +7,7 @@ import { AccountAdmissionRefusedError, AccountChangeRefusedError } from './accou
 import { erasedAccountId } from './account-erasure.service.js';
 import { sendError } from '../access/admin-route-helpers.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { canonicalEmail } from '../../shared/email-identity.js';
 import './auth.middleware.js'; // Express Request augmentation
 /**
  * Admin account management — the ONE account surface (the core User Accounts
@@ -19,7 +20,9 @@ import './auth.middleware.js'; // Express Request augmentation
  * {@link IAdminAccessService} — the Admin role in `roles.yaml`, plus the env
  * bootstrap admin (always-admin, see AdminAccessService).
  */
-export function createAccountRoutes(authService, adminAccess, accountErasure, accessRemoval) {
+export function createAccountRoutes(authService, adminAccess, accountErasure, 
+/** Who tells an invited person (see {@link IAccountHooks}); core registers nobody. */
+accountHooks, accessRemoval) {
     const router = express.Router();
     const requireAdmin = async (req, res, next) => {
         if (!(await adminAccess.isAdmin(req.userEmail))) {
@@ -29,7 +32,8 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
         next();
     };
     // GET /api/admin/accounts — id, email, name, whether a password hash is
-    // stored, and whether the account is the env bootstrap admin.
+    // stored, whether the account is the env bootstrap admin, and whether it is
+    // an owner (and, if so, whether it may be deleted).
     router.get('/admin/accounts', requireAdmin, async (_req, res) => {
         res.json({ accounts: await authService.listAccounts() });
     });
@@ -37,8 +41,12 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
     // (or reset the password of an existing one; upsert-by-email is deliberate,
     // see AuthService.createAccount). Without a password the account is for
     // single sign-on: the person finds it waiting when they first sign in.
+    // With `keepExistingPassword: true` (an invite's starting password) the
+    // password goes only to a new account or a switched-on one with none; the
+    // reply's `passwordSet` says whether it did, and `deactivated` whether a
+    // refusal was because the account is switched off.
     router.post('/admin/accounts', requireAdmin, async (req, res) => {
-        const { email, name, password } = req.body;
+        const { email, name, password, keepExistingPassword } = req.body;
         if (!email) {
             res.status(400).json({ error: 'email is required' });
             return;
@@ -48,7 +56,66 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
             res.status(400).json({ error: 'password must be a string' });
             return;
         }
+        // Fail closed: anything but a boolean is a mistake, never "overwrite".
+        if (keepExistingPassword !== undefined && typeof keepExistingPassword !== 'boolean') {
+            res.status(400).json({ error: 'keepExistingPassword must be a boolean' });
+            return;
+        }
+        if (keepExistingPassword === true && typeof password !== 'string') {
+            res.status(400).json({ error: 'keepExistingPassword needs a password' });
+            return;
+        }
+        // Another admin setting an owner's password could then sign in as the
+        // owner. The owner sets their own on the Account page; an owner account
+        // without a password (restoring one, say; an empty one counts as none,
+        // as in createAccount) is still created here. An invite's starting
+        // password is a password too: the owner is invited by nobody.
+        if (password &&
+            authService.isOwnerEmail(email) &&
+            canonicalEmail(email) !== canonicalEmail(req.userEmail ?? '')) {
+            res.status(400).json({ error: "The owner's password can't be set by another admin; the owner sets it on their Account page." });
+            return;
+        }
         try {
+            // A NEW account is an invitation, and the deployment's listeners say
+            // how the person was told (`notified`): the answer the admin reads is
+            // true to what happened, so the dialog can say "emailed" or hand over
+            // the link. An account that was already there is not invited again.
+            const invited = async (account, created, passwordSet) => {
+                if (!created)
+                    return [];
+                // The inviting admin, by name when their account can be read. The
+                // account is already made: a failed read falls back to the identity
+                // the request carries rather than answering an error a retry could
+                // not make good (the account is not new the second time).
+                const requester = { id: req.userId ?? '', email: req.userEmail ?? '', name: '' };
+                const by = req.userId
+                    ? await authService.getUserById(req.userId).catch((err) => {
+                        log.warn('the inviting admin could not be read; the invite names them by address:', { err });
+                        return null;
+                    })
+                    : null;
+                return accountHooks.runAccountInvited({
+                    account: { id: account.id, email: account.email, name: account.name },
+                    invitedBy: by ?? requester,
+                    passwordSet,
+                });
+            };
+            if (keepExistingPassword === true && typeof password === 'string') {
+                const { user, created, passwordSet, deactivated } = await authService.createAccountWithStartingPassword(email, password);
+                const notified = await invited(user, created, passwordSet);
+                res.status(201).json({ ...user, passwordSet, deactivated, notified });
+                return;
+            }
+            if (!password) {
+                const { user, created } = await authService.createAccountWithoutPassword(email, name);
+                const notified = await invited(user, created, false);
+                res.status(201).json({ ...user, notified });
+                return;
+            }
+            // Set or reset password: an account that is here already, or one an
+            // admin makes with a password from the API. Not an invitation the
+            // listeners are told of: the dialog that invites never sends this form.
             const user = await authService.createAccount(email, name, password);
             res.status(201).json(user);
         }
@@ -89,6 +156,14 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
                 res.status(400).json({ error: error.message });
                 return;
             }
+            // The address's switch lock is held by a change still being saved (an
+            // invite's promotion committing roles.yaml, say): the 409 the lock
+            // promises, with its words, so the admin tries again rather than
+            // reading an outage.
+            if (error instanceof WorkflowDomainError) {
+                res.status(error.status).json({ error: error.message, ...(error.payload ?? {}) });
+                return;
+            }
             log.error('switching an account off failed:', { err: error });
             res.status(500).json({ error: 'Could not switch this account off' });
         }
@@ -162,14 +237,29 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
         // for the removal below — never logged, never returned.
         let email = null;
         let actor = null;
-        if (removeFromAccess) {
-            try {
-                const user = await authService.getUserById(userId);
-                if (!user) {
-                    res.status(404).json({ error: 'No such user' });
-                    return;
-                }
+        try {
+            const user = await authService.getUserById(userId);
+            if (!user) {
+                res.status(404).json({ error: 'No such user' });
+                return;
+            }
+            // An owner who could not sign back in afterwards is refused for every
+            // caller, whether or not the access option is ticked.
+            authService.assertDeletable(user.email);
+            if (removeFromAccess)
                 email = user.email;
+        }
+        catch (err) {
+            if (err instanceof AccountChangeRefusedError) {
+                res.status(400).json({ error: err.message });
+                return;
+            }
+            log.error('looking up the account to erase failed:', { err });
+            res.status(500).json({ error: 'Failed to erase user' });
+            return;
+        }
+        if (removeFromAccess && email !== null) {
+            try {
                 // The existing guards: the deployment owner and the last Admin are
                 // refused up front, before anything is erased.
                 await accessRemoval.assertRemovable(email);

package/dist/modules/auth/account.routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAG/B,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,eAAe,EAA+B,MAAM,8BAA8B,CAAC;AAG5F,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,sBAAsB,CAAC,CAAC,+BAA+B;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA8G,EAC9G,WAAgC,EAChC,cAAyD,EACzD,aAAuG;IAEvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAIrC,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,sFAAsF;QACtF,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,8BAA8B;YAC9B,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,wBAAwB;IACxB,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC;QAE1F,0EAA0E;QAC1E,wDAAwD;QACxD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,KAAK,GAAoB,IAAI,CAAC;QAClC,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAChD,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACnB,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,aAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC5C,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;oBACzE,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;oBAC3B,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;oBACjC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;iBACjC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC;gBACvD,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3C,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAc,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5I,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,GAAG,CAAC,KAAK,CAAC,2BAA2B,SAAS,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,wEAAwE;YACxE,IAAI,YAAY,GAAoB,IAAI,CAAC;YACzC,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,aAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,wDAAwD,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,OAAO,GACX,GAAG,YAAY,mBAAmB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBACpD,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,sEAAsE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"account.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAI/B,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,eAAe,EAA+B,MAAM,8BAA8B,CAAC;AAG5F,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,sBAAsB,CAAC,CAAC,+BAA+B;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAWC,EACD,WAAgC,EAChC,cAAyD;AACzD,sFAAsF;AACtF,YAAsD,EACtD,aAAuG;IAEvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,wEAAwE;IACxE,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,GAAG,CAAC,IAK3D,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,sFAAsF;QACtF,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,IAAI,oBAAoB,KAAK,SAAS,IAAI,OAAO,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACpF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,IAAI,oBAAoB,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,mEAAmE;QACnE,8DAA8D;QAC9D,IACE,QAAQ;YACR,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC;YAC/B,cAAc,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAC7D,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8FAA8F,EAAE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,OAAO,GAAG,KAAK,EAAE,OAAiB,EAAE,OAAgB,EAAE,WAAoB,EAAqB,EAAE;gBACrG,IAAI,CAAC,OAAO;oBAAE,OAAO,EAAE,CAAC;gBACxB,kEAAkE;gBAClE,oEAAoE;gBACpE,mEAAmE;gBACnE,0DAA0D;gBAC1D,MAAM,SAAS,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBACjF,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM;oBACnB,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;wBAC/D,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;wBAC7F,OAAO,IAAI,CAAC;oBACd,CAAC,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAC;gBACT,OAAO,YAAY,CAAC,iBAAiB,CAAC;oBACpC,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBACrE,SAAS,EAAE,EAAE,IAAI,SAAS;oBAC1B,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC,CAAC;YACF,IAAI,oBAAoB,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,WAAW,CAAC,iCAAiC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACzH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;gBAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACtF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;gBACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,oEAAoE;YACpE,kEAAkE;YAClE,wEAAwE;YACxE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,8BAA8B;YAC9B,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,sEAAsE;YACtE,mEAAmE;YACnE,iEAAiE;YACjE,qBAAqB;YACrB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBAClF,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,wBAAwB;IACxB,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC;QAE1F,0EAA0E;QAC1E,wDAAwD;QACxD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,KAAK,GAAoB,IAAI,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,sEAAsE;YACtE,sDAAsD;YACtD,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,gBAAgB;gBAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,yCAAyC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,IAAI,gBAAgB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,aAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC5C,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;oBACzE,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;oBAC3B,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;oBACjC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;iBACjC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC;gBACvD,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3C,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAc,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5I,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,GAAG,CAAC,KAAK,CAAC,2BAA2B,SAAS,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,wEAAwE;YACxE,IAAI,YAAY,GAAoB,IAAI,CAAC;YACzC,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,aAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,wDAAwD,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,OAAO,GACX,GAAG,YAAY,mBAAmB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBACpD,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,sEAAsE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/modules/auth/auth.service.d.ts

@@ -1,6 +1,11 @@
 import type { Database } from '../database/connection.js';
 import type { AuthUser } from '@bevel-software/platform-shared';
 import { type IAccountAdmission } from './account-admission.js';
+import type { IAccountSwitchGuard } from './account-switch-guard.js';
+/** What an admin is told when they try to switch an owner off. */
+export declare const OWNER_SWITCH_OFF_REFUSAL = "The owner can't be switched off.";
+/** What an admin is told when deleting an owner's account would leave them no way to sign in. */
+export declare const OWNER_DELETE_REFUSAL = "The owner's account can't be deleted: they would have no way to sign in.";
 /**
  * What this service needs from the deployment's configuration, and nothing
  * more. Narrowed from `CoreConfig` so the caller can supply a value that is
@@ -39,7 +44,7 @@ export interface SsoLoginOptions {
      */
     admittedByProvider?: boolean;
 }
-export declare class AuthService {
+export declare class AuthService implements IAccountSwitchGuard {
     private readonly db;
     private readonly config;
     /**
@@ -115,7 +120,10 @@ export declare class AuthService {
      * Password sign-in refuses it until a password is set. For an address that
      * already has an account it changes nothing but an explicitly given name.
      *
-     * WITH a password, the deployment admin is the one target this refuses, for the reason
+     * WITH a password, this refuses two kinds of target. The accounts the
+     * platform runs its own work as are refused first
+     * ({@link assertNotSystemAccount}): a password would make them able to sign
+     * in. The deployment admin is refused for the reason
      * {@link changePassword} refuses it: that account's password is the
      * environment's, so a stored hash would not replace it but ADD a second
      * credential — one that keeps signing in after `ADMIN_PASSWORD` is rotated,
@@ -124,6 +132,40 @@ export declare class AuthService {
      * with an arbitrary email.
      */
     createAccount(email: string, name: string | undefined, password?: string): Promise<AuthUser>;
+    /**
+     * An account for single sign-on, or for a password somebody sets later:
+     * created without one, and for an address that already has an account,
+     * nothing changes but an explicitly given name. `created` says which
+     * happened, from the one statement that did it (see {@link CREATED}): an
+     * invite is only an invite when the account is new.
+     */
+    createAccountWithoutPassword(email: string, name: string | undefined): Promise<{
+        user: AuthUser;
+        created: boolean;
+    }>;
+    /**
+     * An invite's starting password: create the account with it, or give it to
+     * an existing account that is switched on and has no password yet — never
+     * to one that has a password of its own or is switched off. The test and
+     * the write are ONE statement (the upsert's `setWhere`), so a password the
+     * person sets between the admin reading the account list and sending the
+     * invite is never overwritten; `passwordSet` says which happened, and
+     * `created` whether the account is new (see {@link CREATED}).
+     *
+     * The deployment admin has its own password (the environment's): it is
+     * left as it is, as {@link createAccount} would refuse to store one. The
+     * accounts the platform runs its own work as are refused outright: a
+     * password would make them able to sign in.
+     *
+     * When nothing was written, `deactivated` tells a switched-off account
+     * apart from one that has a password of its own.
+     */
+    createAccountWithStartingPassword(email: string, password: string): Promise<{
+        user: AuthUser;
+        created: boolean;
+        passwordSet: boolean;
+        deactivated: boolean;
+    }>;
     /**
      * Is `email` the deployment admin — the account whose password is set in
      * the deployment environment (`ADMIN_EMAIL` while `ADMIN_PASSWORD` is set)
@@ -139,6 +181,39 @@ export declare class AuthService {
      * client is TOLD does follow the switch: {@link reportsAsEnvAdmin}.
      */
     private isEnvAdminEmail;
+    /**
+     * Is `email` an owner of this deployment — an address it is configured
+     * with as its owner (`ADMIN_EMAIL`; on Hexis by Bevel cloud, whoever
+     * created the workspace)? Unlike {@link isEnvAdminEmail} this asks nothing
+     * of `ADMIN_PASSWORD`: the cloud never sets one, and its owner must be
+     * protected all the same. Behind {@link deactivate} (which always refuses
+     * an owner) and {@link assertDeletable} (which refuses one who could not
+     * sign back in). Canonicalises both sides, so `email` may be raw.
+     */
+    isOwnerEmail(email: string): boolean;
+    /**
+     * An owner is never switched off, but an earlier version did switch off an
+     * owner without a server-held password, and no admin can undo that for a
+     * workspace's only owner. So wherever an owner's row is read to let them
+     * in, a switch-off left on it is cleared — on the row itself, so that the
+     * credentials that read the column directly (API keys, MCP tokens) are
+     * honoured again too. Returns `row` as it now stands; anyone else's row
+     * unchanged.
+     */
+    private clearOwnerSwitchOff;
+    /**
+     * The configured owner addresses, canonical, blanks dropped. One today
+     * (`ADMIN_EMAIL` is a single string); a list so that every owner is
+     * treated alike should the configuration ever carry more.
+     */
+    private ownerEmails;
+    /**
+     * Refuse to delete `email`'s account when it is an owner who could not
+     * sign back in afterwards: only an owner whose password the server holds,
+     * with password sign-in on (exactly {@link reportsAsEnvAdmin}), still has a
+     * way in once the row is gone. Anyone else's account passes.
+     */
+    assertDeletable(email: string): void;
     /**
      * Whether a client is told `email` is the deployment admin — behind
      * {@link toClientUser} and {@link listAccounts}. The identity is
@@ -189,12 +264,18 @@ export declare class AuthService {
         name: string;
         hasPassword: boolean;
         isEnvAdmin: boolean;
+        /** One of the deployment's owners (`ADMIN_EMAIL`), with or without a server-held password. */
+        isOwner: boolean;
+        /** An owner whose account may be deleted, since they can sign back in (see {@link assertDeletable}); false for everyone else. */
+        ownerCanBeDeleted: boolean;
         /** When an admin switched the account off; null while it is on. */
         deactivatedAt: Date | null;
         /** One of the accounts the platform runs its own work as: never switched off, nobody signs in with it. */
         isSystem: boolean;
         createdAt: Date;
     }>>;
+    /** Every password write calls this first: the system accounts never get one. */
+    private assertNotSystemAccount;
     private assertPasswordPolicy;
     private signToken;
     /**
@@ -245,18 +326,32 @@ export declare class AuthService {
      * environment password signs it in regardless (see `loginWithPassword`),
      * and a session that sign-in mints must then be usable too, or the way
      * back into a deployment would lead nowhere. {@link deactivate} refuses
-     * the account, but a host may write the column itself.
+     * the account, but a host may write the column itself. Any owner's
+     * leftover switch-off is cleared here, as at sign-in
+     * ({@link clearOwnerSwitchOff}).
      */
     isActive(userId: string): Promise<boolean>;
+    /**
+     * Run `write` only while `email` is not switched off, and keep it so until
+     * `write` has finished: a transaction takes the address's switch lock (see
+     * account-switch-lock), reads the account and stays open across `write`.
+     * Every write that switches an account off, or creates one switched off,
+     * takes the same lock first, so it either committed before the read (and
+     * `write` is refused) or waits until `write` is done. An address with no
+     * account yet counts as switched on. A switched-off account throws a 409
+     * `deactivated` and `write` never runs.
+     */
+    whileSwitchedOn(email: string, write: () => Promise<void>): Promise<void>;
     /**
      * Switch an account off. Its row, history and place in roles and groups
      * stay; every credential it holds stops being honoured (see
      * {@link isActive}). Idempotent: an account already off keeps the moment
      * it was first switched off.
      *
-     * The deployment admin is refused: the environment password is the way
-     * back into a deployment whose every other admin is gone, and switching
-     * it off would close that door from inside. So are the machine accounts
+     * An owner is refused, on every deployment, whether or not the server
+     * holds a password for them: switching the owner off locks them out of
+     * their own workspace (and, where `ADMIN_PASSWORD` is set, closes the
+     * way back into a deployment whose every other admin is gone). So are the machine accounts
      * core runs its own work as. Refusing an admin's own account is the
      * route's concern, since it knows who is asking.
      *

package/dist/modules/auth/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,EAOL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAmEhC;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;gBANT,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IACnC;;;OAGG;IACc,SAAS,GAAE,iBAAiC;IAG/D;;;;;OAKG;YACW,cAAc;IA6B5B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAsE7C;;;;;;;;;;;;;;OAcG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAa7C;;;;;;;;;;;;;;;;;;;OAmBG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,CAAC;IA4CpB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;OAgBG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAqBhB;;;;;;OAMG;IACG,YAAY,IAAI,OAAO,CAC3B,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,OAAO,CAAC;QACrB,UAAU,EAAE,OAAO,CAAC;QACpB,mEAAmE;QACnE,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;QAC3B,0GAA0G;QAC1G,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,IAAI,CAAC;KACjB,CAAC,CACH;IAkBD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAUhD,iBAAiB;IAS/B;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;OAMG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAc/E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsD;IAElF;;;;;;;;;;;;;;OAcG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAchD;;;;;;;;;;;;;OAaG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBlD;;;;;;;;OAQG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBlD;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY3D;;;;;;;;;OASG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY7D;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;CAM5B"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,EAOL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAUhC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAyCrE,kEAAkE;AAClE,eAAO,MAAM,wBAAwB,qCAAqC,CAAC;AAE3E,iGAAiG;AACjG,eAAO,MAAM,oBAAoB,6EAA6E,CAAC;AAqC/G;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,qBAAa,WAAY,YAAW,mBAAmB;IAEnD,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;gBANT,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IACnC;;;OAGG;IACc,SAAS,GAAE,iBAAiC;IAG/D;;;;;OAKG;YACW,cAAc;IAiC5B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAyE7C;;;;;;;;;;;;;;OAcG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAa7C;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,CAAC;IAkCpB;;;;;;OAMG;IACG,4BAA4B,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAmBhD;;;;;;;;;;;;;;;;OAgBG;IACG,iCAAiC,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;IAiC5F;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;OAQG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAOpC;;;;;;;;OAQG;YACW,mBAAmB;IAYjC;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAInB;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAMpC;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;OAgBG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;OAMG;IACG,YAAY,IAAI,OAAO,CAC3B,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,OAAO,CAAC;QACrB,UAAU,EAAE,OAAO,CAAC;QACpB,8FAA8F;QAC9F,OAAO,EAAE,OAAO,CAAC;QACjB,iIAAiI;QACjI,iBAAiB,EAAE,OAAO,CAAC;QAC3B,mEAAmE;QACnE,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;QAC3B,0GAA0G;QAC1G,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,IAAI,CAAC;KACjB,CAAC,CACH;IAwBD,gFAAgF;IAChF,OAAO,CAAC,sBAAsB;IAM9B,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAUhD,iBAAiB;IAS/B;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;OAMG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAc/E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsD;IAElF;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAehD;;;;;;;;;OASG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAc/E;;;;;;;;;;;;;;OAcG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBlD;;;;;;;;OAQG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBlD;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY3D;;;;;;;;;OASG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY7D;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;CAM5B"}