@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/CLAUDE.md

@@ -6,8 +6,9 @@ Identity, authentication, and project management API.
 
 - **Sign-up** (`SignUpManager`): Create identity + person with email validation, password strength checking, bcrypt hashing
 - **Sign-in** (`SignInManager`): Password verification with rate limiting (configurable backoff), OTP/2FA support, creates session API key (default 30min expiry)
-- **IDP** (`IDPSignInManager`): OIDC, Facebook, Apple sign-in via `openid-client`. Init → redirect → callback flow with auto sign-up option. Supports RP-initiated (front-channel) Single Logout — `signOut` returns `logoutUrl` for federated sessions
+- **IDP** (`IDPSignInManager`): OIDC, Facebook, Apple sign-in via `openid-client`. Init → redirect → callback flow with auto sign-up option. Supports RP-initiated (front-channel) Single Logout — `signOut` returns `logoutUrl` for federated sessions. **Claim mapping** (A09, `IDPClaimSyncService`): an IdP's `configuration.claimMapping.rules` maps provider claims to **project memberships** (project role + membership variables) at sign-in and on OIDC session refresh — project memberships only, never global/tenant roles
 - **Passwordless** (`PasswordlessSignInManager`): Magic link flow via email tokens with optional MFA
+- **IdP-only authentication** (`LocalAuthDisablingIdpsQuery`): with `options.disableLocalAuthentication` on a provider, a person linked to it loses every local authentication path — password sign-in and passwordless sign-in answer `IDP_REQUIRED`, and `createResetPasswordRequest` reports ok but sends no mail. The `person_identity_provider` link is the marker (not `person.idp_only`, which is written at auto-sign-up but enforced nowhere), so it also covers a person who predates the provider and was linked by e-mail matching. A **disabled** provider does not count: turning the provider off restores local authentication for everyone linked to it, which is the break-glass for an IdP outage. Permanent API keys are unaffected — they hold their own identity with no person. `disconnectMyIdentityProvider` refuses such a link with `IDP_REQUIRED`, even while the provider is disabled — the link is what enforces the policy, so the person it binds must not be able to remove it
 - **API Keys**: Three types (`ApiKeyType` enum) — `SESSION` (short-lived, surfaced as `Identity.sessions`), `PERMANENT` (integrations), `ONE_OFF` (sign-up flows)
 - **Email verification & email change** (`EmailVerificationManager`, `EmailChangeManager`): optional per-account e-mail verification at sign-up (`ConfigSignup.requireEmailVerification`) and a confirm-by-token flow for user-initiated address changes (`ConfigEmailChange.requireVerification`)
 
@@ -37,6 +38,14 @@ GraphQL read fields whose visibility is enforced per-caller (the resolver return
 - **`Project.secrets: [ProjectSecretInfo!]!`** — secret KEYS + timestamps only, **never the values**. Gated by `project:viewSecrets` (`PROJECT_VIEW_SECRETS`). Resolver `ProjectTypeResolver.secrets` → `SecretsManager.listSecretKeys` → model `queries/project/ProjectSecretKeysQuery.ts`.
 - Also note `Identity.sessions: [SessionInfo!]!` (own sessions always visible; others via `person:viewSessions`) and `Query.authLog` (`system:viewAuthLog`, SUPER_ADMIN only by default).
 
+## Permission introspection
+
+`Identity.permissions` (`IdentityGlobalPermissions`) and `Project.permissions` (`ProjectPermissions`) report what the **calling** identity may do, evaluated through the same `permissionContext.isAllowed` the resolvers use. They exist because permission failure is not uniform — some reads answer empty, others throw, and every mutation throws — so a client cannot discover its own rights by trying. **Advisory only:** the resolvers still check everything, so a `true` grants nothing.
+
+Resolvers: `types/IdentityTypeResolver.permissions` (tenant-wide; `null` for another identity whose roles the caller may not see) and `types/ProjectTypeResolver.permissions` (project-scoped, asked through `createProjectScope`). The membership-parameterized actions are asked with an empty membership list — the same coarse gate `Project.members` uses; which roles may actually be granted is still decided per membership at mutation time.
+
+When adding a flag, add it to both the SDL and the resolver, and remember `ProjectResponseFactory` — it carries the placeholder that satisfies the non-nullable `Project.permissions` field on parent objects the type resolver later replaces.
+
 ## Authorization
 
 Tenant-level roles (`Roles.ts`): `LOGIN`, `PERSON`, `SUPER_ADMIN`, `PROJECT_CREATOR`, `PROJECT_ADMIN`, `ENTRYPOINT_DEPLOYER`, `PROJECT_MEMBER`, `SELF`. Permission actions are defined in `PermissionActions.ts` (resource + privilege, some parameterized by `roles` / `memberships`); static grants per role live in `PermissionsFactory.ts`.
@@ -59,7 +68,8 @@ CQRS pattern with Command/Query separation via `CommandBus` and `DatabaseQuery`.
 - `EmailOtpManager` — e-mail OTP 2FA (init/confirm/disable); `BackupCodeManager` — MFA recovery codes
 - `AuthPolicyManager` (+ `AuthPolicyResolver`) — per-role MFA / session auth policies
 - `LoginRiskAnalyzer` — sign-in anomaly scoring (A03); see `RiskWeight` / `RiskAction`
-- `AuthLogService` — writes `person_auth_log` audit entries (the `authLog` query reads them)
+- `AuthLogService` — writes `person_auth_log` audit entries (the `authLog` query reads them). IdP claim mapping (A09) adds the `idp_role_mapped` (before/after membership delta) and `idp_role_mapping_failed` (fail-open marker, no claim values) events, emitted from the resolver on sign-in (`IDPMutationResolver`) and directly from `IdpSessionRevalidator` on OIDC session refresh (the verify hot path, not a GraphQL resolver)
+- `IDPClaimSyncService` — A09 claim→membership sync. Evaluates an IdP's `configuration.claimMapping.rules` against the provider claims and grants the resulting **project memberships** (never global roles). `syncPolicy` (`always`/`sticky`) and `unmatched` (`keep`/`remove`, vocabulary-bounded) control reconciliation. Two-layer validation shared with the direct add-member path via schema-utils `MembershipResolver` (config-time in `IDPManager.assertValidClaimMapping`; apply-time fail-closed backstop here). Fail-open on a malformed config; runs at sign-in and on OIDC refresh (`IdpSessionRevalidator`)
 - `RateLimiter` — generic per-key rate limiting backed by `rate_limit_event` (per-IP windows, email-OTP-per-person, etc.)
 - `EmailVerificationManager` / `EmailChangeManager` — e-mail verification and confirm-by-token address change
 - `EmailValidator`, `PasswordStrengthValidator`, `HibpChecker` — input validation (HIBP = haveibeenpwned breach check)
@@ -97,3 +107,27 @@ Regenerate (works from any worktree; needs `docker compose up -d postgres` + loc
 The script runs the migrations with local `bun` against the current checkout (so it picks up THIS branch's migrations, not whatever the engine container has mounted), auto-discovers the running postgres container, dumps the schema, and formats the result. Do NOT run migrations inside the `engine` container for this — it mounts the main repo, not your worktree.
 
 Verify the snapshot matches the migrations by bootstrapping two fresh DBs — one with `CONTEMBER_MIGRATIONS_NO_SNAPSHOT=1` (replays migrations), one without (uses the snapshot) — and diffing `pg_dump` of both; they must be schema-identical.
+
+**Migration order is forward-only.** The `migration-order` CI job (`scripts/migrations/check-migration-order.sh`, pure git, no DB) rejects any PR whose new migration filename sorts at or before the newest migration already on the base branch — otherwise a fresh DB and an upgraded DB would replay them in a different relative order. Rebasing an older branch onto a main that has gained a migration is what usually trips it, and `bun test`, `tsc` and a local snapshot regen all stay green. Check with `./scripts/migrations/check-migration-order.sh origin/main`; fix by re-timestamping — `git mv` the file to a current `YYYY-MM-DD-HHMMSS-<name>.ts`, update the import, key and position in `runner.ts`, then regenerate the snapshot. For additive, independent migrations it comes back byte-identical; verify with a zero-diff regen.
+
+**The snapshot script discovers its database by container label** (`docker ps --filter label=com.docker.compose.service=postgres | head -n1`). With more than one compose project running it grabs whichever sorts first and dies on `role "contember" does not exist` — cleanly, with no writes, so it reads as broken tooling rather than the wrong database. Name it explicitly, and serialize concurrent runs because the script uses a fixed `migration_snapshot` database:
+
+```bash
+SNAPSHOT_PG_CONTAINER=contember-oss-postgres-1 ./scripts/create-migrations-snapshot/run.sh tenant
+flock /tmp/contember-tenant-snapshot.lock ./scripts/create-migrations-snapshot/run.sh tenant   # when several jobs may run it at once
+```
+
+## Mocked SQL tests
+
+`tests/cases/integration/mocked/**` assert against **exact** mocked SQL (`ExpectedQuery`). When a shared query changes shape on main, a branch that hard-codes the old SQL fails with `Expected query #1 does not match SQL` — with no textual conflict and no type error, so only `bun test` catches it. This is the classic post-rebase failure here (e.g. the person-by-identity query gaining the `person_mfa` join and the `totp_*` / `email_otp_enabled` / `mfa_grace_until` columns).
+
+Copy the current SQL from the shared helper (`tests/cases/integration/mocked/sql/getPersonByIdentity.ts`) verbatim — whitespace and case are normalized by the `SQL` tag — and update the duplicated response columns. Better still, have such a helper reuse the shared one rather than duplicating it.
+
+## Conventions for new tenant features
+
+- **Audit at the resolver layer.** The one exception is `ApiKeyManager.verifyAndProlong`, a hot path that emits its own events.
+- **`AuthActionType` enum values are added in the migration that wires their call site** (`ALTER TYPE ADD VALUE`), never reserved ahead of use. The auth-log payload column is `event_data`, plain `{ before, after }` JSON.
+- **A new mail template ships its migration and its default template in the same PR.**
+- **MFA TOTP must work without an encryption key.** With no `CONTEMBER_ENCRYPTION_KEY` the version-0 plaintext fallback applies; encryption engages when a key is present, gated by `providers.encryptionEnabled` (from `CryptoWrapper.enabled`).
+- Existing behavior stays unchanged: new capability is gated by config or policy, with defaults matching today.
+- **An SDL change reaches beyond this package.** `graphql-client-tenant` is generated from the SDL at build time and surfaces transitively in `react-client-tenant`, whose `build/api/react-client-tenant.api.md` **is** committed and checked by the `api-exporter` CI job. So adding a field can fail `ae:test` with "You have changed the API signature for this project" while `bun test` and `ts:build` pass — regenerate with `bun run ae:update` (Docker) and commit the diff.

package/dist/development/index.cjs

@@ -44,8 +44,10 @@ const RemoveMailTemplateCommand = require("./src/model/commands/mailTemplate/Rem
 const AddProjectMemberCommand = require("./src/model/commands/membership/AddProjectMemberCommand.cjs");
 const CreateOrUpdateProjectMembershipCommand = require("./src/model/commands/membership/CreateOrUpdateProjectMembershipCommand.cjs");
 const RemoveProjectMemberCommand = require("./src/model/commands/membership/RemoveProjectMemberCommand.cjs");
+const RemoveProjectMembershipCommand = require("./src/model/commands/membership/RemoveProjectMembershipCommand.cjs");
 const UpdateProjectMemberCommand = require("./src/model/commands/membership/UpdateProjectMemberCommand.cjs");
 const PatchProjectMembershipVariablesCommand = require("./src/model/commands/membership/variables/PatchProjectMembershipVariablesCommand.cjs");
+const SetProjectMembershipVariableValuesCommand = require("./src/model/commands/membership/variables/SetProjectMembershipVariableValuesCommand.cjs");
 const ConfirmOtpCommand = require("./src/model/commands/otp/ConfirmOtpCommand.cjs");
 const DisableOtpCommand = require("./src/model/commands/otp/DisableOtpCommand.cjs");
 const PrepareOtpCommand = require("./src/model/commands/otp/PrepareOtpCommand.cjs");
@@ -82,6 +84,7 @@ const IdentityProvidersQuery = require("./src/model/queries/idp/IdentityProvider
 const IdpSessionByApiKeyQuery = require("./src/model/queries/idp/IdpSessionByApiKeyQuery.cjs");
 const IdpSessionsBySidQuery = require("./src/model/queries/idp/IdpSessionsBySidQuery.cjs");
 const IdpSessionsBySubQuery = require("./src/model/queries/idp/IdpSessionsBySubQuery.cjs");
+const LocalAuthDisablingIdpsQuery = require("./src/model/queries/idp/LocalAuthDisablingIdpsQuery.cjs");
 const PersonIdentityProvidersQuery = require("./src/model/queries/idp/PersonIdentityProvidersQuery.cjs");
 const ProjectSecretsQuery = require("./src/model/queries/project/ProjectSecretsQuery.cjs");
 const ProjectSecretKeysQuery = require("./src/model/queries/project/ProjectSecretKeysQuery.cjs");
@@ -106,6 +109,10 @@ const BackchannelLogoutManager = require("./src/model/service/idp/BackchannelLog
 const IDPRevalidation = require("./src/model/service/idp/IDPRevalidation.cjs");
 const IDPManager = require("./src/model/service/idp/IDPManager.cjs");
 const PersonIdentityProviderManager = require("./src/model/service/idp/PersonIdentityProviderManager.cjs");
+const ClaimMapping = require("./src/model/service/idp/ClaimMapping.cjs");
+const ClaimMappingEvaluator = require("./src/model/service/idp/ClaimMappingEvaluator.cjs");
+const ClaimMappingValidation = require("./src/model/service/idp/ClaimMappingValidation.cjs");
+const IDPClaimSyncService = require("./src/model/service/idp/IDPClaimSyncService.cjs");
 const IDPResponseError = require("./src/model/service/idp/IDPResponseError.cjs");
 const IDPValidationError = require("./src/model/service/idp/IDPValidationError.cjs");
 const InvalidIDPConfigurationError = require("./src/model/service/idp/InvalidIDPConfigurationError.cjs");
@@ -127,6 +134,7 @@ const MailTemplateManager = require("./src/model/service/MailTemplateManager.cjs
 const MembershipValidator = require("./src/model/service/MembershipValidator.cjs");
 const OtpAuthenticator = require("./src/model/service/OtpAuthenticator.cjs");
 const OtpManager = require("./src/model/service/OtpManager.cjs");
+const PanelAccessResolver = require("./src/model/service/PanelAccessResolver.cjs");
 const PasswordChangeManager = require("./src/model/service/PasswordChangeManager.cjs");
 const PasswordResetManager = require("./src/model/service/PasswordResetManager.cjs");
 const PersonAccessManager = require("./src/model/service/PersonAccessManager.cjs");
@@ -235,8 +243,10 @@ exports.RemoveMailTemplateCommand = RemoveMailTemplateCommand.RemoveMailTemplate
 exports.AddProjectMemberCommand = AddProjectMemberCommand.AddProjectMemberCommand;
 exports.CreateOrUpdateProjectMembershipCommand = CreateOrUpdateProjectMembershipCommand.CreateOrUpdateProjectMembershipCommand;
 exports.RemoveProjectMemberCommand = RemoveProjectMemberCommand.RemoveProjectMemberCommand;
+exports.RemoveProjectMembershipCommand = RemoveProjectMembershipCommand.RemoveProjectMembershipCommand;
 exports.UpdateProjectMemberCommand = UpdateProjectMemberCommand.UpdateProjectMemberCommand;
 exports.PatchProjectMembershipVariablesCommand = PatchProjectMembershipVariablesCommand.PatchProjectMembershipVariablesCommand;
+exports.SetProjectMembershipVariableValuesCommand = SetProjectMembershipVariableValuesCommand.SetProjectMembershipVariableValuesCommand;
 exports.ConfirmOtpCommand = ConfirmOtpCommand.ConfirmOtpCommand;
 exports.DisableOtpCommand = DisableOtpCommand.DisableOtpCommand;
 exports.PrepareOtpCommand = PrepareOtpCommand.PrepareOtpCommand;
@@ -277,6 +287,7 @@ exports.IdentityProvidersQuery = IdentityProvidersQuery.IdentityProvidersQuery;
 exports.IdpSessionByApiKeyQuery = IdpSessionByApiKeyQuery.IdpSessionByApiKeyQuery;
 exports.IdpSessionsBySidQuery = IdpSessionsBySidQuery.IdpSessionsBySidQuery;
 exports.IdpSessionsBySubQuery = IdpSessionsBySubQuery.IdpSessionsBySubQuery;
+exports.LocalAuthDisablingIdpsQuery = LocalAuthDisablingIdpsQuery.LocalAuthDisablingIdpsQuery;
 exports.PersonIdentityProvidersQuery = PersonIdentityProvidersQuery.PersonIdentityProvidersQuery;
 exports.ProjectSecretsQuery = ProjectSecretsQuery.ProjectSecretsQuery;
 exports.ProjectSecretKeysQuery = ProjectSecretKeysQuery.ProjectSecretKeysQuery;
@@ -294,8 +305,11 @@ exports.VerifyErrorCode = ApiKeyManager.VerifyErrorCode;
 exports.VerifyResult = ApiKeyManager.VerifyResult;
 exports.ApiKeyService = ApiKeyService.ApiKeyService;
 exports.CreateApiKeyResult = ApiKeyService.CreateApiKeyResult;
+exports.UNPERSISTED_LOGIN_IDENTITY_ID = UnpersistedApiKeyManager.UNPERSISTED_LOGIN_IDENTITY_ID;
 exports.UNPERSISTED_ROOT_IDENTITY_ID = UnpersistedApiKeyManager.UNPERSISTED_ROOT_IDENTITY_ID;
 exports.UnpersistedApiKeyManager = UnpersistedApiKeyManager.UnpersistedApiKeyManager;
+exports.createUnpersistedLoginVerifyResult = UnpersistedApiKeyManager.createUnpersistedLoginVerifyResult;
+exports.isUnpersistedIdentityId = UnpersistedApiKeyManager.isUnpersistedIdentityId;
 exports.CaptchaValidator = CaptchaValidator.CaptchaValidator;
 exports.HCaptchaProvider = HCaptchaProvider.HCaptchaProvider;
 exports.RecaptchaV3Provider = RecaptchaV3Provider.RecaptchaV3Provider;
@@ -310,6 +324,23 @@ exports.REVALIDATION_DEFAULT_MIN_INTERVAL = IDPRevalidation.REVALIDATION_DEFAULT
 exports.REVALIDATION_DEFAULT_SOFT_THRESHOLD = IDPRevalidation.REVALIDATION_DEFAULT_SOFT_THRESHOLD;
 exports.IDPManager = IDPManager.IDPManager;
 exports.PersonIdentityProviderManager = PersonIdentityProviderManager.PersonIdentityProviderManager;
+exports.ClaimMapping = ClaimMapping.ClaimMapping;
+exports.ClaimMappingMembership = ClaimMapping.ClaimMappingMembership;
+exports.ClaimMappingRule = ClaimMapping.ClaimMappingRule;
+exports.ClaimMappingVariable = ClaimMapping.ClaimMappingVariable;
+exports.ClaimValueSource = ClaimMapping.ClaimValueSource;
+exports.DEFAULT_SYNC_POLICY = ClaimMapping.DEFAULT_SYNC_POLICY;
+exports.DEFAULT_UNMATCHED = ClaimMapping.DEFAULT_UNMATCHED;
+exports.findClaimMappingShapeErrors = ClaimMapping.findClaimMappingShapeErrors;
+exports.findRemovedRuleKeys = ClaimMapping.findRemovedRuleKeys;
+exports.isRecord = ClaimMapping.isRecord;
+exports.parseClaimMapping = ClaimMapping.parseClaimMapping;
+exports.evaluateClaimMapping = ClaimMappingEvaluator.evaluateClaimMapping;
+exports.extractClaimValues = ClaimMappingEvaluator.extractClaimValues;
+exports.resolveVariableValues = ClaimMappingEvaluator.resolveVariableValues;
+exports.ClaimMappingMembershipErrorType = ClaimMappingValidation.ClaimMappingMembershipErrorType;
+exports.validateClaimMappingMembership = ClaimMappingValidation.validateClaimMappingMembership;
+exports.IDPClaimSyncService = IDPClaimSyncService.IDPClaimSyncService;
 exports.IDPResponseError = IDPResponseError.IDPResponseError;
 exports.IDPValidationError = IDPValidationError.IDPValidationError;
 exports.InvalidIDPConfigurationError = InvalidIDPConfigurationError.InvalidIDPConfigurationError;
@@ -340,6 +371,7 @@ exports.MembershipValidator = MembershipValidator.MembershipValidator;
 exports.OtpAuthenticator = OtpAuthenticator.OtpAuthenticator;
 exports.OtpError = OtpManager.OtpError;
 exports.OtpManager = OtpManager.OtpManager;
+exports.PanelAccessResolver = PanelAccessResolver.PanelAccessResolver;
 exports.PasswordChangeManager = PasswordChangeManager.PasswordChangeManager;
 exports.PasswordResetManager = PasswordResetManager.PasswordResetManager;
 exports.PersonAccessManager = PersonAccessManager.PersonAccessManager;

package/dist/development/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.cjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/development/index.js

@@ -42,8 +42,10 @@ import { RemoveMailTemplateCommand } from "./src/model/commands/mailTemplate/Rem
 import { AddProjectMemberCommand } from "./src/model/commands/membership/AddProjectMemberCommand.js";
 import { CreateOrUpdateProjectMembershipCommand } from "./src/model/commands/membership/CreateOrUpdateProjectMembershipCommand.js";
 import { RemoveProjectMemberCommand } from "./src/model/commands/membership/RemoveProjectMemberCommand.js";
+import { RemoveProjectMembershipCommand } from "./src/model/commands/membership/RemoveProjectMembershipCommand.js";
 import { UpdateProjectMemberCommand } from "./src/model/commands/membership/UpdateProjectMemberCommand.js";
 import { PatchProjectMembershipVariablesCommand } from "./src/model/commands/membership/variables/PatchProjectMembershipVariablesCommand.js";
+import { SetProjectMembershipVariableValuesCommand } from "./src/model/commands/membership/variables/SetProjectMembershipVariableValuesCommand.js";
 import { ConfirmOtpCommand } from "./src/model/commands/otp/ConfirmOtpCommand.js";
 import { DisableOtpCommand } from "./src/model/commands/otp/DisableOtpCommand.js";
 import { PrepareOtpCommand } from "./src/model/commands/otp/PrepareOtpCommand.js";
@@ -80,6 +82,7 @@ import { IdentityProvidersQuery } from "./src/model/queries/idp/IdentityProvider
 import { IdpSessionByApiKeyQuery } from "./src/model/queries/idp/IdpSessionByApiKeyQuery.js";
 import { IdpSessionsBySidQuery } from "./src/model/queries/idp/IdpSessionsBySidQuery.js";
 import { IdpSessionsBySubQuery } from "./src/model/queries/idp/IdpSessionsBySubQuery.js";
+import { LocalAuthDisablingIdpsQuery } from "./src/model/queries/idp/LocalAuthDisablingIdpsQuery.js";
 import { PersonIdentityProvidersQuery } from "./src/model/queries/idp/PersonIdentityProvidersQuery.js";
 import { ProjectSecretsQuery } from "./src/model/queries/project/ProjectSecretsQuery.js";
 import { ProjectSecretKeysQuery } from "./src/model/queries/project/ProjectSecretKeysQuery.js";
@@ -92,7 +95,7 @@ import { UserMailer } from "./src/model/mailing/UserMailer.js";
 import { MailType, mailTypeFromDbToSchema, mailTypeFromSchemaToDb } from "./src/model/mailing/type.js";
 import { ApiKeyManager, VerifyErrorCode, VerifyResult } from "./src/model/service/apiKey/ApiKeyManager.js";
 import { ApiKeyService, CreateApiKeyResult } from "./src/model/service/apiKey/ApiKeyService.js";
-import { UNPERSISTED_ROOT_IDENTITY_ID, UnpersistedApiKeyManager } from "./src/model/service/apiKey/UnpersistedApiKeyManager.js";
+import { UNPERSISTED_LOGIN_IDENTITY_ID, UNPERSISTED_ROOT_IDENTITY_ID, UnpersistedApiKeyManager, createUnpersistedLoginVerifyResult, isUnpersistedIdentityId } from "./src/model/service/apiKey/UnpersistedApiKeyManager.js";
 import { CaptchaValidator } from "./src/model/service/captcha/CaptchaValidator.js";
 import { HCaptchaProvider } from "./src/model/service/captcha/HCaptchaProvider.js";
 import { RecaptchaV3Provider } from "./src/model/service/captcha/RecaptchaV3Provider.js";
@@ -104,6 +107,10 @@ import { BackchannelLogoutManager } from "./src/model/service/idp/BackchannelLog
 import { IDPRevalidationConfig, REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from "./src/model/service/idp/IDPRevalidation.js";
 import { IDPManager } from "./src/model/service/idp/IDPManager.js";
 import { PersonIdentityProviderManager } from "./src/model/service/idp/PersonIdentityProviderManager.js";
+import { ClaimMapping, ClaimMappingMembership, ClaimMappingRule, ClaimMappingVariable, ClaimValueSource, DEFAULT_SYNC_POLICY, DEFAULT_UNMATCHED, findClaimMappingShapeErrors, findRemovedRuleKeys, isRecord, parseClaimMapping } from "./src/model/service/idp/ClaimMapping.js";
+import { evaluateClaimMapping, extractClaimValues, resolveVariableValues } from "./src/model/service/idp/ClaimMappingEvaluator.js";
+import { ClaimMappingMembershipErrorType, validateClaimMappingMembership } from "./src/model/service/idp/ClaimMappingValidation.js";
+import { IDPClaimSyncService } from "./src/model/service/idp/IDPClaimSyncService.js";
 import { IDPResponseError } from "./src/model/service/idp/IDPResponseError.js";
 import { IDPValidationError } from "./src/model/service/idp/IDPValidationError.js";
 import { InvalidIDPConfigurationError } from "./src/model/service/idp/InvalidIDPConfigurationError.js";
@@ -125,6 +132,7 @@ import { MailTemplateManager } from "./src/model/service/MailTemplateManager.js"
 import { MembershipValidator } from "./src/model/service/MembershipValidator.js";
 import { OtpAuthenticator } from "./src/model/service/OtpAuthenticator.js";
 import { OtpError, OtpManager } from "./src/model/service/OtpManager.js";
+import { PanelAccessResolver } from "./src/model/service/PanelAccessResolver.js";
 import { PasswordChangeManager } from "./src/model/service/PasswordChangeManager.js";
 import { PasswordResetManager } from "./src/model/service/PasswordResetManager.js";
 import { PersonAccessManager } from "./src/model/service/PersonAccessManager.js";
@@ -212,7 +220,13 @@ export {
   ChangePasswordCommand,
   ChangePasswordMutationResolver,
   ChangeProfileMutationResolver,
+  ClaimMapping,
+  ClaimMappingMembership,
+  ClaimMappingMembershipErrorType,
+  ClaimMappingRule,
+  ClaimMappingVariable,
   ClaimOtpAttemptCommand,
+  ClaimValueSource,
   CommandBus,
   ConfigurationQuery,
   ConfirmOtpCommand,
@@ -231,6 +245,8 @@ export {
   CreateProjectCommand,
   CreateProjectMutationResolver,
   CreateProjectResult,
+  DEFAULT_SYNC_POLICY,
+  DEFAULT_UNMATCHED,
   DatabaseContext,
   DeleteAuthPolicyCommand,
   DeleteBackupCodesCommand,
@@ -251,6 +267,7 @@ export {
   FacebookProvider,
   GlobalApiKeysQuery,
   HCaptchaProvider,
+  IDPClaimSyncService,
   IDPHandlerRegistry,
   IDPManager,
   IDPMutationResolver,
@@ -277,6 +294,7 @@ export {
   InviteManager,
   InviteMutationResolver,
   InviteResult,
+  LocalAuthDisablingIdpsQuery,
   LoginRiskAnalyzer,
   MAX_OTP_ATTEMPTS,
   MailTemplateListQuery,
@@ -298,6 +316,7 @@ export {
   OtpManager,
   OtpMutationResolver,
   PROLONG_THROTTLE_MS,
+  PanelAccessResolver,
   PasswordChangeManager,
   PasswordHash,
   PasswordPlain,
@@ -351,6 +370,7 @@ export {
   RemoveMailTemplateCommand,
   RemoveProjectMemberCommand,
   RemoveProjectMemberMutationResolver,
+  RemoveProjectMembershipCommand,
   ResetPasswordCommand,
   ResetPasswordMutationResolver,
   ResetPersonMfaCommand,
@@ -363,6 +383,7 @@ export {
   SecretsManager,
   SetEmailOtpEnabledCommand,
   SetMfaGraceUntilCommand,
+  SetProjectMembershipVariableValuesCommand,
   SetProjectSecretCommand,
   SetProjectSecretMutationResolver,
   SignInManager,
@@ -380,6 +401,7 @@ export {
   TenantRole,
   TogglePersonPasswordlessCommand,
   TurnstileProvider,
+  UNPERSISTED_LOGIN_IDENTITY_ID,
   UNPERSISTED_ROOT_IDENTITY_ID,
   UnpersistedApiKeyManager,
   UpdateAuthPolicyCommand,
@@ -395,13 +417,23 @@ export {
   computeTokenHash,
   createMailer,
   createResolverContext,
+  createUnpersistedLoginVerifyResult,
+  evaluateClaimMapping,
+  extractClaimValues,
+  findClaimMappingShapeErrors,
+  findRemovedRuleKeys,
   generateToken,
   ipPrefix,
+  isRecord,
   isTokenHash,
+  isUnpersistedIdentityId,
   mailTypeFromDbToSchema,
   mailTypeFromSchemaToDb,
+  parseClaimMapping,
+  resolveVariableValues,
   timingSafeCompareHash,
   default2 as typeDefs,
+  validateClaimMappingMembership,
   validateToken
 };
 //# sourceMappingURL=index.js.map

package/dist/development/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/development/src/TenantContainer.cjs

@@ -29,6 +29,9 @@ const BackchannelLogoutManager = require("./model/service/idp/BackchannelLogoutM
 require("./model/service/idp/IDPRevalidation.cjs");
 const IDPManager = require("./model/service/idp/IDPManager.cjs");
 const PersonIdentityProviderManager = require("./model/service/idp/PersonIdentityProviderManager.cjs");
+require("./model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
+const IDPClaimSyncService = require("./model/service/idp/IDPClaimSyncService.cjs");
 const AppleProvider = require("./model/service/idp/providers/AppleProvider.cjs");
 const OIDCProvider = require("./model/service/idp/providers/OIDCProvider.cjs");
 const FacebookProvider = require("./model/service/idp/providers/FacebookProvider.cjs");
@@ -47,6 +50,7 @@ const MailTemplateManager = require("./model/service/MailTemplateManager.cjs");
 const MembershipValidator = require("./model/service/MembershipValidator.cjs");
 const OtpAuthenticator = require("./model/service/OtpAuthenticator.cjs");
 const OtpManager = require("./model/service/OtpManager.cjs");
+const PanelAccessResolver = require("./model/service/PanelAccessResolver.cjs");
 const PasswordChangeManager = require("./model/service/PasswordChangeManager.cjs");
 const PasswordResetManager = require("./model/service/PasswordResetManager.cjs");
 const PersonAccessManager = require("./model/service/PersonAccessManager.cjs");
@@ -105,6 +109,7 @@ const IDPQueryResolver = require("./resolvers/query/IDPQueryResolver.cjs");
 const UpdateIDPMutationResolver = require("./resolvers/mutation/idp/UpdateIDPMutationResolver.cjs");
 const runner = require("./migrations/runner.cjs");
 const DisablePersonMutationResolver = require("./resolvers/mutation/person/DisablePersonMutationResolver.cjs");
+const EnablePersonMutationResolver = require("./resolvers/mutation/person/EnablePersonMutationResolver.cjs");
 const ForceSignOutMutationResolver = require("./resolvers/mutation/person/ForceSignOutMutationResolver.cjs");
 const RevokeSessionMutationResolver = require("./resolvers/mutation/person/RevokeSessionMutationResolver.cjs");
 const MailTemplateQueryResolver = require("./resolvers/query/MailTemplateQueryResolver.cjs");
@@ -128,6 +133,7 @@ class TenantContainerFactory {
       "backchannelLogoutManager",
       "projectMemberManager",
       "projectManager",
+      "panelAccessResolver",
       "signUpManager",
       "resolvers",
       "authorizator",
@@ -141,13 +147,13 @@ class TenantContainerFactory {
     );
   }
   createBuilder(args) {
-    return new dic.Builder({}).addService("providers", () => ({ ...this.providers, ...args.cryptoProviders })).addService("mailer", () => Mailer.createMailer(args.mailOptions)).addService("projectSchemaResolver", () => args.projectSchemaResolver).addService("templateRenderer", () => new TemplateRenderer.TemplateRenderer()).addService("accessEvaluator", ({}) => new authorization.AccessEvaluator.PermissionEvaluator(new PermissionsFactory.PermissionsFactory().create())).addService("authorizator", ({ accessEvaluator }) => new authorization.Authorizator.Default(accessEvaluator)).addService("userMailer", ({ mailer, templateRenderer }) => new UserMailer.UserMailer(mailer, templateRenderer)).addService("apiKeyService", () => new ApiKeyService.ApiKeyService()).addService("authPolicyResolver", () => new AuthPolicyResolver.AuthPolicyResolver()).addService("authLogService", () => new AuthLogService.AuthLogService()).addService("loginRiskAnalyzer", ({ providers }) => new LoginRiskAnalyzer.LoginRiskAnalyzer(providers.hash)).addService("idpRegistry", () => {
+    return new dic.Builder({}).addService("providers", () => ({ ...this.providers, ...args.cryptoProviders })).addService("mailer", () => Mailer.createMailer(args.mailOptions)).addService("projectSchemaResolver", () => args.projectSchemaResolver).addService("templateRenderer", () => new TemplateRenderer.TemplateRenderer()).addService("accessEvaluator", ({}) => new authorization.AccessEvaluator.PermissionEvaluator(new PermissionsFactory.PermissionsFactory().create())).addService("authorizator", ({ accessEvaluator }) => new authorization.Authorizator.Default(accessEvaluator)).addService("userMailer", ({ mailer, templateRenderer }) => new UserMailer.UserMailer(mailer, templateRenderer)).addService("apiKeyService", () => new ApiKeyService.ApiKeyService()).addService("authPolicyResolver", () => new AuthPolicyResolver.AuthPolicyResolver()).addService("panelAccessResolver", ({ providers }) => new PanelAccessResolver.PanelAccessResolver(providers)).addService("authLogService", () => new AuthLogService.AuthLogService()).addService("loginRiskAnalyzer", ({ providers }) => new LoginRiskAnalyzer.LoginRiskAnalyzer(providers.hash)).addService("idpRegistry", () => {
       const idpRegistry = new IDPHandlerRegistry.IDPHandlerRegistry();
       idpRegistry.registerHandler("oidc", new OIDCProvider.OIDCProvider());
       idpRegistry.registerHandler("facebook", new FacebookProvider.FacebookProvider());
       idpRegistry.registerHandler("apple", new AppleProvider.AppleProvider());
       return idpRegistry;
-    }).addService("idpSessionRevalidator", ({ idpRegistry }) => new IdpSessionRevalidator.IdpSessionRevalidator(idpRegistry)).addService("backchannelLogoutManager", ({ idpRegistry }) => new BackchannelLogoutManager.BackchannelLogoutManager(idpRegistry)).addService("unpersistedApiKeyManager", () => UnpersistedApiKeyManager.UnpersistedApiKeyManager.createForRootTokens({
+    }).addService("idpClaimSyncService", ({ projectSchemaResolver }) => new IDPClaimSyncService.IDPClaimSyncService(projectSchemaResolver)).addService("idpSessionRevalidator", ({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator.IdpSessionRevalidator(idpRegistry, idpClaimSyncService)).addService("backchannelLogoutManager", ({ idpRegistry }) => new BackchannelLogoutManager.BackchannelLogoutManager(idpRegistry)).addService("unpersistedApiKeyManager", () => UnpersistedApiKeyManager.UnpersistedApiKeyManager.createForRootTokens({
       tokens: args.tenantCredentials.rootTokens,
       tokenHashes: args.tenantCredentials.rootTokenHashes
     })).addService(
@@ -172,7 +178,10 @@ class TenantContainerFactory {
     ).addService(
       "emailChangeManager",
       ({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) => new EmailChangeManager.EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory)
-    ).addService("idpSignInManager", ({ apiKeyManager, idpRegistry }) => new IDPSignInManager.IDPSignInManager(apiKeyManager, idpRegistry)).addService("idpManager", ({ idpRegistry }) => new IDPManager.IDPManager(idpRegistry)).addService("personIdentityProviderManager", () => new PersonIdentityProviderManager.PersonIdentityProviderManager()).addService("otpAuthenticator", ({ providers }) => new OtpAuthenticator.OtpAuthenticator(providers)).addService("otpManager", ({ otpAuthenticator, providers }) => new OtpManager.OtpManager(otpAuthenticator, providers)).addService("backupCodeManager", ({ providers, userMailer }) => new BackupCodeManager.BackupCodeManager(userMailer, providers)).addService("emailOtpManager", ({ userMailer, providers, rateLimiter }) => new EmailOtpManager.EmailOtpManager(userMailer, providers, rateLimiter)).addService("authPolicyManager", ({ projectManager }) => new AuthPolicyManager.AuthPolicyManager(projectManager)).addService(
+    ).addService(
+      "idpSignInManager",
+      ({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager.IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService)
+    ).addService("idpManager", ({ idpRegistry, projectSchemaResolver }) => new IDPManager.IDPManager(idpRegistry, projectSchemaResolver)).addService("personIdentityProviderManager", () => new PersonIdentityProviderManager.PersonIdentityProviderManager()).addService("otpAuthenticator", ({ providers }) => new OtpAuthenticator.OtpAuthenticator(providers)).addService("otpManager", ({ otpAuthenticator, providers }) => new OtpManager.OtpManager(otpAuthenticator, providers)).addService("backupCodeManager", ({ providers, userMailer }) => new BackupCodeManager.BackupCodeManager(userMailer, providers)).addService("emailOtpManager", ({ userMailer, providers, rateLimiter }) => new EmailOtpManager.EmailOtpManager(userMailer, providers, rateLimiter)).addService("authPolicyManager", ({ projectManager }) => new AuthPolicyManager.AuthPolicyManager(projectManager)).addService(
       "signInManager",
       ({ apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer }) => new SignInManager.SignInManager(
         apiKeyManager,
@@ -253,6 +262,9 @@ class TenantContainerFactory {
     ).addService("createProjectMutationResolver", ({ projectManager }) => new CreateProjectMutationResolver.CreateProjectMutationResolver(projectManager)).addService(
       "disablePersonMutationResolver",
       ({ personAccessManager, personManager }) => new DisablePersonMutationResolver.DisablePersonMutationResolver(personAccessManager, personManager)
+    ).addService(
+      "enablePersonMutationResolver",
+      ({ personAccessManager, personManager }) => new EnablePersonMutationResolver.EnablePersonMutationResolver(personAccessManager, personManager)
     ).addService(
       "forceSignOutMutationResolver",
       ({ apiKeyManager, personManager, userMailer }) => new ForceSignOutMutationResolver.ForceSignOutMutationResolver(apiKeyManager, personManager, userMailer)

package/dist/development/src/TenantContainer.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"TenantContainer.cjs","sources":["../../../../packages/engine-tenant-api/src/TenantContainer.ts"],"sourcesContent":["import { AccessEvaluator, Authorizator } from '@contember/authorization'\nimport { Connection, DatabaseConfig } from '@contember/database'\nimport { Builder } from '@contember/dic'\nimport {\n\tAclSchemaAccessNodeFactory,\n\tApiKeyManager,\n\tApiKeyService,\n\tAppleProvider,\n\tAuthPolicyManager,\n\tAuthPolicyResolver,\n\tBackchannelLogoutManager,\n\tBackupCodeManager,\n\tCaptchaValidator,\n\tDatabaseContext,\n\tEmailChangeManager,\n\tEmailOtpManager,\n\tEmailValidator,\n\tEmailVerificationManager,\n\tFacebookProvider,\n\tHCaptchaProvider,\n\tIdentity,\n\tIdentityFactory,\n\tIDPHandlerRegistry,\n\tIDPManager,\n\tIdpSessionRevalidator,\n\tIDPSignInManager,\n\tInviteManager,\n\tLoginRiskAnalyzer,\n\tMailTemplateManager,\n\tMembershipValidator,\n\tOIDCProvider,\n\tOtpAuthenticator,\n\tOtpManager,\n\tPasswordChangeManager,\n\tPasswordResetManager,\n\tPermissionContextFactory,\n\tPermissionsFactory,\n\tPersonAccessManager,\n\tPersonIdentityProviderManager,\n\tPersonManager,\n\tProjectInitializer,\n\tProjectManager,\n\tProjectMemberManager,\n\tProjectSchemaResolver,\n\tProjectScopeFactory,\n\tProviders,\n\tRateLimiter,\n\tRecaptchaV3Provider,\n\tRolesManager,\n\tSecretsManager,\n\tSignInManager,\n\tSignOutManager,\n\tSignUpManager,\n\tTurnstileProvider,\n\tUnpersistedApiKeyManager,\n\tUserMailer,\n} from './model/index.js'\nimport { HibpChecker, HttpHibpChecker, NoopHibpChecker } from './model/service/HibpChecker.js'\nimport {\n\tAddIDPMutationResolver,\n\tAddProjectMemberMutationResolver,\n\tChangePasswordMutationResolver,\n\tChangeProfileMutationResolver,\n\tCreateApiKeyMutationResolver,\n\tCreateProjectMutationResolver,\n\tDisableApiKeyMutationResolver,\n\tDisableIDPMutationResolver,\n\tDisconnectMyIdentityProviderMutationResolver,\n\tEmailOtpMutationResolver,\n\tEmailVerificationMutationResolver,\n\tEnableIDPMutationResolver,\n\tIdentityGlobalRolesMutationResolver,\n\tIdentityTypeResolver,\n\tIDPMutationResolver,\n\tInviteMutationResolver,\n\tMailTemplateMutationResolver,\n\tMeQueryResolver,\n\tOtpMutationResolver,\n\tPersonQueryResolver,\n\tPersonTypeResolver,\n\tProjectMembersQueryResolver,\n\tProjectQueryResolver,\n\tProjectTypeResolver,\n\tRegenerateBackupCodesMutationResolver,\n\tRemoveProjectMemberMutationResolver,\n\tResetPasswordMutationResolver,\n\tResolverFactory,\n\tSetProjectSecretMutationResolver,\n\tSignInMutationResolver,\n\tSignOutMutationResolver,\n\tSignUpMutationResolver,\n\tTenantResolverContextFactory,\n\tUpdateProjectMemberMutationResolver,\n\tUpdateProjectMutationResolver,\n} from './resolvers/index.js'\nimport * as Schema from './schema/index.js'\nimport { createMailer, MailerOptions, TemplateRenderer } from './utils/index.js'\nimport { IdentityFetcher } from './bridges/system/IdentityFetcher.js'\nimport { SignInResponseFactory } from './resolvers/responseHelpers/SignInResponseFactory.js'\nimport { IDPQueryResolver } from './resolvers/query/IDPQueryResolver.js'\nimport { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver.js'\nimport { TenantCredentials, TenantMigrationsRunner } from './migrations/index.js'\nimport { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver.js'\nimport { ForceSignOutMutationResolver } from './resolvers/mutation/person/ForceSignOutMutationResolver.js'\nimport { RevokeSessionMutationResolver } from './resolvers/mutation/person/RevokeSessionMutationResolver.js'\nimport { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver.js'\nimport { ConfigurationManager } from './model/service/ConfigurationManager.js'\nimport { ConfigurationMutationResolver } from './resolvers/mutation/configuration/ConfigurationMutationResolver.js'\nimport { ConfigurationQueryResolver } from './resolvers/query/ConfigurationQueryResolver.js'\nimport { AuthPolicyMutationResolver } from './resolvers/mutation/configuration/AuthPolicyMutationResolver.js'\nimport { AuthPolicyQueryResolver } from './resolvers/query/AuthPolicyQueryResolver.js'\nimport { ResetPersonMfaMutationResolver } from './resolvers/mutation/person/ResetPersonMfaMutationResolver.js'\nimport { AuthLogQueryResolver } from './resolvers/query/AuthLogQueryResolver.js'\nimport { ApiKeyQueryResolver } from './resolvers/query/ApiKeyQueryResolver.js'\nimport { PasswordlessMutationResolver } from './resolvers/mutation/person/PasswordlessMutationResolver.js'\nimport { PasswordlessSignInManager } from './model/service/PasswordlessSignInManager.js'\nimport { TogglePasswordlessMutationResolver } from './resolvers/mutation/person/TogglePasswordlessMutationResolver.js'\nimport { PasswordStrengthValidator } from './model/service/PasswordStrengthValidator.js'\nimport { AuthLogService } from './model/service/AuthLogService.js'\n\nexport interface TenantContainer {\n\tprojectMemberManager: ProjectMemberManager\n\tapiKeyManager: ApiKeyManager\n\tbackchannelLogoutManager: BackchannelLogoutManager\n\tsignUpManager: SignUpManager\n\tprojectManager: ProjectManager\n\tresolvers: Schema.Resolvers\n\tresolverContextFactory: TenantResolverContextFactory\n\tauthorizator: Authorizator<Identity>\n\tidentityFetcher: IdentityFetcher\n\tdatabaseContext: DatabaseContext\n\treadDatabaseContext: DatabaseContext\n\tmigrationsRunner: TenantMigrationsRunner\n\tconnection: Connection.ConnectionType\n\treadConnection: Connection.ConnectionType\n}\n\nexport interface TenantContainerArgs {\n\tconnection: Connection.ConnectionType\n\treadConnection: Connection.ConnectionType\n\tdbCredentials: DatabaseConfig\n\tmailOptions: MailerOptions\n\tprojectSchemaResolver: ProjectSchemaResolver\n\tprojectInitializer: ProjectInitializer\n\ttenantCredentials: TenantCredentials\n\tcryptoProviders: Pick<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>\n}\n\nexport class TenantContainerFactory {\n\tconstructor(\n\t\tprivate readonly providers: Omit<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>,\n\t) {}\n\n\tcreate(args: TenantContainerArgs): TenantContainer {\n\t\treturn this.createBuilder(args)\n\t\t\t.build()\n\t\t\t.pick(\n\t\t\t\t'apiKeyManager',\n\t\t\t\t'backchannelLogoutManager',\n\t\t\t\t'projectMemberManager',\n\t\t\t\t'projectManager',\n\t\t\t\t'signUpManager',\n\t\t\t\t'resolvers',\n\t\t\t\t'authorizator',\n\t\t\t\t'resolverContextFactory',\n\t\t\t\t'identityFetcher',\n\t\t\t\t'databaseContext',\n\t\t\t\t'readDatabaseContext',\n\t\t\t\t'migrationsRunner',\n\t\t\t\t'connection',\n\t\t\t\t'readConnection',\n\t\t\t)\n\t}\n\n\tcreateBuilder(args: TenantContainerArgs) {\n\t\treturn new Builder({})\n\t\t\t.addService('providers', () => ({ ...this.providers, ...args.cryptoProviders }))\n\t\t\t.addService('mailer', () => createMailer(args.mailOptions))\n\t\t\t.addService('projectSchemaResolver', () => args.projectSchemaResolver)\n\t\t\t.addService('templateRenderer', () => new TemplateRenderer())\n\t\t\t.addService('accessEvaluator', ({}) => new AccessEvaluator.PermissionEvaluator(new PermissionsFactory().create()))\n\t\t\t.addService('authorizator', ({ accessEvaluator }) => new Authorizator.Default(accessEvaluator))\n\t\t\t.addService('userMailer', ({ mailer, templateRenderer }) => new UserMailer(mailer, templateRenderer))\n\t\t\t.addService('apiKeyService', () => new ApiKeyService())\n\t\t\t.addService('authPolicyResolver', () => new AuthPolicyResolver())\n\t\t\t.addService('authLogService', () => new AuthLogService())\n\t\t\t.addService('loginRiskAnalyzer', ({ providers }) => new LoginRiskAnalyzer(providers.hash))\n\t\t\t.addService('idpRegistry', () => {\n\t\t\t\tconst idpRegistry = new IDPHandlerRegistry()\n\t\t\t\tidpRegistry.registerHandler('oidc', new OIDCProvider())\n\t\t\t\tidpRegistry.registerHandler('facebook', new FacebookProvider())\n\t\t\t\tidpRegistry.registerHandler('apple', new AppleProvider())\n\t\t\t\treturn idpRegistry\n\t\t\t})\n\t\t\t.addService('idpSessionRevalidator', ({ idpRegistry }) => new IdpSessionRevalidator(idpRegistry))\n\t\t\t.addService('backchannelLogoutManager', ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry))\n\t\t\t.addService('unpersistedApiKeyManager', () =>\n\t\t\t\tUnpersistedApiKeyManager.createForRootTokens({\n\t\t\t\t\ttokens: args.tenantCredentials.rootTokens,\n\t\t\t\t\ttokenHashes: args.tenantCredentials.rootTokenHashes,\n\t\t\t\t}))\n\t\t\t.addService(\n\t\t\t\t'apiKeyManager',\n\t\t\t\t({ apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator }) =>\n\t\t\t\t\tnew ApiKeyManager(apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator),\n\t\t\t)\n\t\t\t.addService('signOutManager', ({ apiKeyManager, idpRegistry }) => new SignOutManager(apiKeyManager, idpRegistry))\n\t\t\t.addService('emailValidator', () => new EmailValidator())\n\t\t\t.addService('hibpChecker', (): HibpChecker => new HttpHibpChecker())\n\t\t\t.addService('noopHibpChecker', (): HibpChecker => new NoopHibpChecker())\n\t\t\t.addService('passwordStrengthValidator', ({ hibpChecker }) => new PasswordStrengthValidator(hibpChecker))\n\t\t\t.addService('captchaValidator', () =>\n\t\t\t\tnew CaptchaValidator({\n\t\t\t\t\tturnstile: new TurnstileProvider(),\n\t\t\t\t\thcaptcha: new HCaptchaProvider(),\n\t\t\t\t\trecaptchaV3: new RecaptchaV3Provider(),\n\t\t\t\t}))\n\t\t\t.addService('rateLimiter', ({ providers }) => new RateLimiter(providers))\n\t\t\t.addService(\n\t\t\t\t'signUpManager',\n\t\t\t\t({ emailValidator, passwordStrengthValidator }) => new SignUpManager(emailValidator, passwordStrengthValidator),\n\t\t\t)\n\t\t\t.addService('passwordChangeManager', ({ providers, passwordStrengthValidator }) => new PasswordChangeManager(providers, passwordStrengthValidator))\n\t\t\t.addService('projectMemberManager', () => new ProjectMemberManager())\n\t\t\t.addService('identityFactory', ({ projectMemberManager }) => new IdentityFactory(projectMemberManager))\n\t\t\t.addService('projectScopeFactory', () => new ProjectScopeFactory(new AclSchemaAccessNodeFactory()))\n\t\t\t.addService(\n\t\t\t\t'permissionContextFactory',\n\t\t\t\t({ authorizator, identityFactory, projectScopeFactory, projectSchemaResolver }) =>\n\t\t\t\t\tnew PermissionContextFactory(authorizator, identityFactory, projectScopeFactory, projectSchemaResolver),\n\t\t\t)\n\t\t\t.addService('secretManager', ({ providers }) => new SecretsManager(providers))\n\t\t\t.addService('projectManager', ({ secretManager, apiKeyService }) => new ProjectManager(secretManager, args.projectInitializer, apiKeyService))\n\t\t\t.addService('personAccessManager', ({ apiKeyManager }) => new PersonAccessManager(apiKeyManager))\n\t\t\t.addService('personManager', ({ emailValidator }) => new PersonManager(emailValidator))\n\t\t\t.addService(\n\t\t\t\t'passwordResetManager',\n\t\t\t\t({ userMailer, projectManager, passwordStrengthValidator }) => new PasswordResetManager(userMailer, projectManager, passwordStrengthValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailVerificationManager',\n\t\t\t\t({ userMailer, projectManager }) => new EmailVerificationManager(userMailer, projectManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailChangeManager',\n\t\t\t\t({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) =>\n\t\t\t\t\tnew EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService('idpSignInManager', ({ apiKeyManager, idpRegistry }) => new IDPSignInManager(apiKeyManager, idpRegistry))\n\t\t\t.addService('idpManager', ({ idpRegistry }) => new IDPManager(idpRegistry))\n\t\t\t.addService('personIdentityProviderManager', () => new PersonIdentityProviderManager())\n\t\t\t.addService('otpAuthenticator', ({ providers }) => new OtpAuthenticator(providers))\n\t\t\t.addService('otpManager', ({ otpAuthenticator, providers }) => new OtpManager(otpAuthenticator, providers))\n\t\t\t.addService('backupCodeManager', ({ providers, userMailer }) => new BackupCodeManager(userMailer, providers))\n\t\t\t.addService('emailOtpManager', ({ userMailer, providers, rateLimiter }) => new EmailOtpManager(userMailer, providers, rateLimiter))\n\t\t\t.addService('authPolicyManager', ({ projectManager }) => new AuthPolicyManager(projectManager))\n\t\t\t.addService(\n\t\t\t\t'signInManager',\n\t\t\t\t({ apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer }) =>\n\t\t\t\t\tnew SignInManager(\n\t\t\t\t\t\tapiKeyManager,\n\t\t\t\t\t\tproviders,\n\t\t\t\t\t\totpManager,\n\t\t\t\t\t\tbackupCodeManager,\n\t\t\t\t\t\temailOtpManager,\n\t\t\t\t\t\tauthPolicyResolver,\n\t\t\t\t\t\tloginRiskAnalyzer,\n\t\t\t\t\t\tuserMailer,\n\t\t\t\t\t),\n\t\t\t)\n\t\t\t.addService('membershipValidator', ({ projectSchemaResolver }) => new MembershipValidator(projectSchemaResolver))\n\t\t\t.addService('inviteManager', ({ providers, userMailer, projectSchemaResolver }) => new InviteManager(providers, userMailer, projectSchemaResolver))\n\t\t\t.addService('mailTemplateManager', () => new MailTemplateManager())\n\t\t\t.addService('rolesManager', () => new RolesManager())\n\t\t\t.addService('configurationManager', () => new ConfigurationManager())\n\t\t\t.addService(\n\t\t\t\t'passwordlessSignInManager',\n\t\t\t\t({ apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager }) =>\n\t\t\t\t\tnew PasswordlessSignInManager(apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'identityTypeResolver',\n\t\t\t\t({ projectMemberManager, projectManager, permissionContextFactory }) =>\n\t\t\t\t\tnew IdentityTypeResolver(projectMemberManager, projectManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'projectTypeResolver',\n\t\t\t\t({ projectMemberManager, projectSchemaResolver, secretManager }) =>\n\t\t\t\t\tnew ProjectTypeResolver(projectMemberManager, projectSchemaResolver, secretManager),\n\t\t\t)\n\t\t\t.addService('personTypeResolver', ({ personIdentityProviderManager }) => new PersonTypeResolver(personIdentityProviderManager))\n\t\t\t.addService(\n\t\t\t\t'signInResponseFactory',\n\t\t\t\t({ permissionContextFactory, identityTypeResolver }) => new SignInResponseFactory(permissionContextFactory, identityTypeResolver),\n\t\t\t)\n\t\t\t.addService('meQueryResolver', () => new MeQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'personQueryResolver',\n\t\t\t\t({ personManager, projectManager, projectMemberManager }) => new PersonQueryResolver(personManager, projectManager, projectMemberManager),\n\t\t\t)\n\t\t\t.addService('idpQueryResolver', ({ idpManager }) => new IDPQueryResolver(idpManager))\n\t\t\t.addService('projectQueryResolver', ({ projectManager }) => new ProjectQueryResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'projectMembersQueryResolver',\n\t\t\t\t({ projectManager, projectMemberManager }) => new ProjectMembersQueryResolver(projectManager, projectMemberManager),\n\t\t\t)\n\t\t\t.addService('mailTemplateQueryResolver', () => new MailTemplateQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'signUpMutationResolver',\n\t\t\t\t({ signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory }) =>\n\t\t\t\t\tnew SignUpMutationResolver(signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'signInMutationResolver',\n\t\t\t\t({ signInManager, signInResponseFactory, rateLimiter }) => new SignInMutationResolver(signInManager, signInResponseFactory, rateLimiter),\n\t\t\t)\n\t\t\t.addService('signOutMutationResolver', ({ signOutManager }) => new SignOutMutationResolver(signOutManager))\n\t\t\t.addService(\n\t\t\t\t'changeProfileMutationResolver',\n\t\t\t\t({ personManager, emailChangeManager, permissionContextFactory }) =>\n\t\t\t\t\tnew ChangeProfileMutationResolver(personManager, emailChangeManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailVerificationMutationResolver',\n\t\t\t\t({ emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew EmailVerificationMutationResolver(emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService('changePasswordMutationResolver', ({ passwordChangeManager }) => new ChangePasswordMutationResolver(passwordChangeManager))\n\t\t\t.addService(\n\t\t\t\t'resetPasswordMutationResolver',\n\t\t\t\t({ passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew ResetPasswordMutationResolver(passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'inviteMutationResolver',\n\t\t\t\t({ inviteManager, projectManager, membershipValidator }) => new InviteMutationResolver(inviteManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'addProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager, membershipValidator }) =>\n\t\t\t\t\tnew AddProjectMemberMutationResolver(projectMemberManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'updateProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager, membershipValidator }) =>\n\t\t\t\t\tnew UpdateProjectMemberMutationResolver(projectMemberManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'removeProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager }) => new RemoveProjectMemberMutationResolver(projectMemberManager, projectManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'createApiKeyMutationResolver',\n\t\t\t\t({ apiKeyManager, projectManager, membershipValidator }) => new CreateApiKeyMutationResolver(apiKeyManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService('disableApiKeyMutationResolver', ({ apiKeyManager }) => new DisableApiKeyMutationResolver(apiKeyManager))\n\t\t\t.addService(\n\t\t\t\t'otpMutationResolver',\n\t\t\t\t({ otpManager, backupCodeManager, authPolicyResolver }) => new OtpMutationResolver(otpManager, backupCodeManager, authPolicyResolver),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailOtpMutationResolver',\n\t\t\t\t({ emailOtpManager, backupCodeManager, authPolicyResolver }) =>\n\t\t\t\t\tnew EmailOtpMutationResolver(emailOtpManager, backupCodeManager, authPolicyResolver),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'regenerateBackupCodesMutationResolver',\n\t\t\t\t({ backupCodeManager }) => new RegenerateBackupCodesMutationResolver(backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'mailTemplateMutationResolver',\n\t\t\t\t({ projectManager, mailTemplateManager }) => new MailTemplateMutationResolver(projectManager, mailTemplateManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'idpMutationResolver',\n\t\t\t\t({ idpSignInManager, signInResponseFactory }) => new IDPMutationResolver(idpSignInManager, signInResponseFactory),\n\t\t\t)\n\t\t\t.addService('registerIdpMutationResolver', ({ idpManager }) => new AddIDPMutationResolver(idpManager))\n\t\t\t.addService('updateIdpMutationResolver', ({ idpManager }) => new UpdateIDPMutationResolver(idpManager))\n\t\t\t.addService('disableIdpMutationResolver', ({ idpManager }) => new DisableIDPMutationResolver(idpManager))\n\t\t\t.addService('enableIdpMutationResolver', ({ idpManager }) => new EnableIDPMutationResolver(idpManager))\n\t\t\t.addService(\n\t\t\t\t'disconnectMyIdentityProviderMutationResolver',\n\t\t\t\t({ personIdentityProviderManager }) => new DisconnectMyIdentityProviderMutationResolver(personIdentityProviderManager),\n\t\t\t)\n\t\t\t.addService('createProjectMutationResolver', ({ projectManager }) => new CreateProjectMutationResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'disablePersonMutationResolver',\n\t\t\t\t({ personAccessManager, personManager }) => new DisablePersonMutationResolver(personAccessManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'forceSignOutMutationResolver',\n\t\t\t\t({ apiKeyManager, personManager, userMailer }) => new ForceSignOutMutationResolver(apiKeyManager, personManager, userMailer),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'resetPersonMfaMutationResolver',\n\t\t\t\t({ personManager, backupCodeManager }) => new ResetPersonMfaMutationResolver(personManager, backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'revokeSessionMutationResolver',\n\t\t\t\t({ apiKeyManager }) => new RevokeSessionMutationResolver(apiKeyManager),\n\t\t\t)\n\t\t\t.addService('updateProjectMutationResolver', ({ projectManager }) => new UpdateProjectMutationResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'setProjectSecretMutationResolver',\n\t\t\t\t({ projectManager, secretManager }) => new SetProjectSecretMutationResolver(projectManager, secretManager),\n\t\t\t)\n\t\t\t.addService('identityGlobalRolesMutationResolver', ({ rolesManager }) => new IdentityGlobalRolesMutationResolver(rolesManager))\n\t\t\t.addService('configurationMutationResolver', ({ configurationManager }) => new ConfigurationMutationResolver(configurationManager))\n\t\t\t.addService('configurationQueryResolver', ({ configurationManager }) => new ConfigurationQueryResolver(configurationManager))\n\t\t\t.addService('authPolicyMutationResolver', ({ authPolicyManager }) => new AuthPolicyMutationResolver(authPolicyManager))\n\t\t\t.addService('authPolicyQueryResolver', ({ authPolicyManager }) => new AuthPolicyQueryResolver(authPolicyManager))\n\t\t\t.addService('authLogQueryResolver', () => new AuthLogQueryResolver())\n\t\t\t.addService('apiKeyQueryResolver', () => new ApiKeyQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'passwordlessMutationResolver',\n\t\t\t\t({ passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'togglePasswordlessMutationResolver',\n\t\t\t\t({ configurationManager, personManager }) => new TogglePasswordlessMutationResolver(configurationManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'resolverContextFactory',\n\t\t\t\t({ permissionContextFactory, authLogService, loginRiskAnalyzer }) =>\n\t\t\t\t\tnew TenantResolverContextFactory(permissionContextFactory, authLogService, loginRiskAnalyzer),\n\t\t\t)\n\t\t\t.addService('resolvers', container => new ResolverFactory(container).create())\n\t\t\t.addService('connection', () => args.connection)\n\t\t\t.addService('readConnection', () => args.readConnection)\n\t\t\t.addService(\n\t\t\t\t'databaseContext',\n\t\t\t\t({ connection, providers }) => new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'readDatabaseContext',\n\t\t\t\t({ readConnection, providers }) => new DatabaseContext(readConnection.createClient('tenant', { module: 'tenant' }), providers),\n\t\t\t)\n\t\t\t.addService('identityFetcher', ({ databaseContext }) => new IdentityFetcher(databaseContext.client))\n\t\t\t.addService('migrationsRunner', ({ providers }) => new TenantMigrationsRunner(args.dbCredentials, 'tenant', args.tenantCredentials, providers))\n\t}\n}\n"],"names":["Builder","createMailer","TemplateRenderer","AccessEvaluator","PermissionsFactory","Authorizator","UserMailer","ApiKeyService","AuthPolicyResolver","AuthLogService","LoginRiskAnalyzer","IDPHandlerRegistry","OIDCProvider","FacebookProvider","AppleProvider","IdpSessionRevalidator","BackchannelLogoutManager","UnpersistedApiKeyManager","ApiKeyManager","SignOutManager","EmailValidator","HttpHibpChecker","NoopHibpChecker","PasswordStrengthValidator","CaptchaValidator","TurnstileProvider","HCaptchaProvider","RecaptchaV3Provider","RateLimiter","SignUpManager","PasswordChangeManager","ProjectMemberManager","IdentityFactory","ProjectScopeFactory","AclSchemaAccessNodeFactory","PermissionContextFactory","SecretsManager","ProjectManager","PersonAccessManager","PersonManager","PasswordResetManager","EmailVerificationManager","EmailChangeManager","IDPSignInManager","IDPManager","PersonIdentityProviderManager","OtpAuthenticator","OtpManager","BackupCodeManager","EmailOtpManager","AuthPolicyManager","SignInManager","MembershipValidator","InviteManager","MailTemplateManager","RolesManager","ConfigurationManager","PasswordlessSignInManager","IdentityTypeResolver","ProjectTypeResolver","PersonTypeResolver","SignInResponseFactory","MeQueryResolver","PersonQueryResolver","IDPQueryResolver","ProjectQueryResolver","ProjectMembersQueryResolver","MailTemplateQueryResolver","SignUpMutationResolver","SignInMutationResolver","SignOutMutationResolver","ChangeProfileMutationResolver","EmailVerificationMutationResolver","ChangePasswordMutationResolver","ResetPasswordMutationResolver","InviteMutationResolver","AddProjectMemberMutationResolver","UpdateProjectMemberMutationResolver","RemoveProjectMemberMutationResolver","CreateApiKeyMutationResolver","DisableApiKeyMutationResolver","OtpMutationResolver","EmailOtpMutationResolver","RegenerateBackupCodesMutationResolver","MailTemplateMutationResolver","IDPMutationResolver","AddIDPMutationResolver","UpdateIDPMutationResolver","DisableIDPMutationResolver","EnableIDPMutationResolver","DisconnectMyIdentityProviderMutationResolver","CreateProjectMutationResolver","DisablePersonMutationResolver","ForceSignOutMutationResolver","ResetPersonMfaMutationResolver","RevokeSessionMutationResolver","UpdateProjectMutationResolver","SetProjectSecretMutationResolver","IdentityGlobalRolesMutationResolver","ConfigurationMutationResolver","ConfigurationQueryResolver","AuthPolicyMutationResolver","AuthPolicyQueryResolver","AuthLogQueryResolver","ApiKeyQueryResolver","PasswordlessMutationResolver","TogglePasswordlessMutationResolver","TenantResolverContextFactory","ResolverFactory","DatabaseContext","IdentityFetcher","TenantMigrationsRunner"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoJO,MAAM,uBAAuB;AAAA,EACnC,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,OAAO,MAA4C;AAClD,WAAO,KAAK,cAAc,IAAI,EAC5B,QACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEA,cAAc,MAA2B;AACxC,WAAO,IAAIA,IAAAA,QAAQ,CAAA,CAAE,EACnB,WAAW,aAAa,OAAO,EAAE,GAAG,KAAK,WAAW,GAAG,KAAK,gBAAA,EAAkB,EAC9E,WAAW,UAAU,MAAMC,OAAAA,aAAa,KAAK,WAAW,CAAC,EACzD,WAAW,yBAAyB,MAAM,KAAK,qBAAqB,EACpE,WAAW,oBAAoB,MAAM,IAAIC,iBAAAA,iBAAA,CAAkB,EAC3D,WAAW,mBAAmB,CAAC,CAAA,MAAO,IAAIC,cAAAA,gBAAgB,oBAAoB,IAAIC,mBAAAA,mBAAA,EAAqB,QAAQ,CAAC,EAChH,WAAW,gBAAgB,CAAC,EAAE,sBAAsB,IAAIC,cAAAA,aAAa,QAAQ,eAAe,CAAC,EAC7F,WAAW,cAAc,CAAC,EAAE,QAAQ,uBAAuB,IAAIC,WAAAA,WAAW,QAAQ,gBAAgB,CAAC,EACnG,WAAW,iBAAiB,MAAM,IAAIC,cAAAA,eAAe,EACrD,WAAW,sBAAsB,MAAM,IAAIC,mBAAAA,mBAAA,CAAoB,EAC/D,WAAW,kBAAkB,MAAM,IAAIC,8BAAA,CAAgB,EACvD,WAAW,qBAAqB,CAAC,EAAE,gBAAgB,IAAIC,oCAAkB,UAAU,IAAI,CAAC,EACxF,WAAW,eAAe,MAAM;AAChC,YAAM,cAAc,IAAIC,sCAAA;AACxB,kBAAY,gBAAgB,QAAQ,IAAIC,aAAAA,aAAA,CAAc;AACtD,kBAAY,gBAAgB,YAAY,IAAIC,iBAAAA,iBAAA,CAAkB;AAC9D,kBAAY,gBAAgB,SAAS,IAAIC,cAAAA,cAAA,CAAe;AACxD,aAAO;AAAA,IACR,CAAC,EACA,WAAW,yBAAyB,CAAC,EAAE,YAAA,MAAkB,IAAIC,sBAAAA,sBAAsB,WAAW,CAAC,EAC/F,WAAW,4BAA4B,CAAC,EAAE,YAAA,MAAkB,IAAIC,yBAAAA,yBAAyB,WAAW,CAAC,EACrG,WAAW,4BAA4B,MACvCC,yBAAAA,yBAAyB,oBAAoB;AAAA,MAC5C,QAAQ,KAAK,kBAAkB;AAAA,MAC/B,aAAa,KAAK,kBAAkB;AAAA,IAAA,CACpC,CAAC,EACF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,oBAAoB,gBAAgB,0BAA0B,sBAAA,MAC/E,IAAIC,cAAAA,cAAc,eAAe,oBAAoB,gBAAgB,0BAA0B,qBAAqB;AAAA,IAAA,EAErH,WAAW,kBAAkB,CAAC,EAAE,eAAe,YAAA,MAAkB,IAAIC,eAAAA,eAAe,eAAe,WAAW,CAAC,EAC/G,WAAW,kBAAkB,MAAM,IAAIC,eAAAA,gBAAgB,EACvD,WAAW,eAAe,MAAmB,IAAIC,YAAAA,iBAAiB,EAClE,WAAW,mBAAmB,MAAmB,IAAIC,YAAAA,iBAAiB,EACtE,WAAW,6BAA6B,CAAC,EAAE,kBAAkB,IAAIC,0BAAAA,0BAA0B,WAAW,CAAC,EACvG,WAAW,oBAAoB,MAC/B,IAAIC,kCAAiB;AAAA,MACpB,WAAW,IAAIC,kBAAAA,kBAAA;AAAA,MACf,UAAU,IAAIC,iBAAAA,iBAAA;AAAA,MACd,aAAa,IAAIC,oBAAAA,oBAAA;AAAA,IAAoB,CACrC,CAAC,EACF,WAAW,eAAe,CAAC,EAAE,UAAA,MAAgB,IAAIC,YAAAA,YAAY,SAAS,CAAC,EACvE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,0BAAA,MAAgC,IAAIC,cAAAA,cAAc,gBAAgB,yBAAyB;AAAA,IAAA,EAE9G,WAAW,yBAAyB,CAAC,EAAE,WAAW,gCAAgC,IAAIC,sBAAAA,sBAAsB,WAAW,yBAAyB,CAAC,EACjJ,WAAW,wBAAwB,MAAM,IAAIC,qBAAAA,qBAAA,CAAsB,EACnE,WAAW,mBAAmB,CAAC,EAAE,2BAA2B,IAAIC,gBAAAA,gBAAgB,oBAAoB,CAAC,EACrG,WAAW,uBAAuB,MAAM,IAAIC,oBAAAA,oBAAoB,IAAIC,2BAAAA,2BAAA,CAA4B,CAAC,EACjG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,cAAc,iBAAiB,qBAAqB,sBAAA,MACtD,IAAIC,yBAAAA,yBAAyB,cAAc,iBAAiB,qBAAqB,qBAAqB;AAAA,IAAA,EAEvG,WAAW,iBAAiB,CAAC,EAAE,UAAA,MAAgB,IAAIC,eAAAA,eAAe,SAAS,CAAC,EAC5E,WAAW,kBAAkB,CAAC,EAAE,eAAe,oBAAoB,IAAIC,eAAAA,eAAe,eAAe,KAAK,oBAAoB,aAAa,CAAC,EAC5I,WAAW,uBAAuB,CAAC,EAAE,cAAA,MAAoB,IAAIC,oBAAAA,oBAAoB,aAAa,CAAC,EAC/F,WAAW,iBAAiB,CAAC,EAAE,eAAA,MAAqB,IAAIC,4BAAc,cAAc,CAAC,EACrF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,gBAAgB,0BAAA,MAAgC,IAAIC,0CAAqB,YAAY,gBAAgB,yBAAyB;AAAA,IAAA,EAE7I;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,eAAA,MAAqB,IAAIC,yBAAAA,yBAAyB,YAAY,cAAc;AAAA,IAAA,EAE3F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,gBAAgB,gBAAgB,eAAe,yBAAA,MAC7D,IAAIC,mBAAAA,mBAAmB,YAAY,gBAAgB,gBAAgB,eAAe,wBAAwB;AAAA,IAAA,EAE3G,WAAW,oBAAoB,CAAC,EAAE,eAAe,YAAA,MAAkB,IAAIC,kCAAiB,eAAe,WAAW,CAAC,EACnH,WAAW,cAAc,CAAC,EAAE,YAAA,MAAkB,IAAIC,sBAAW,WAAW,CAAC,EACzE,WAAW,iCAAiC,MAAM,IAAIC,8BAAAA,8BAAA,CAA+B,EACrF,WAAW,oBAAoB,CAAC,EAAE,UAAA,MAAgB,IAAIC,iBAAAA,iBAAiB,SAAS,CAAC,EACjF,WAAW,cAAc,CAAC,EAAE,kBAAkB,UAAA,MAAgB,IAAIC,WAAAA,WAAW,kBAAkB,SAAS,CAAC,EACzG,WAAW,qBAAqB,CAAC,EAAE,WAAW,WAAA,MAAiB,IAAIC,oCAAkB,YAAY,SAAS,CAAC,EAC3G,WAAW,mBAAmB,CAAC,EAAE,YAAY,WAAW,kBAAkB,IAAIC,gBAAAA,gBAAgB,YAAY,WAAW,WAAW,CAAC,EACjI,WAAW,qBAAqB,CAAC,EAAE,eAAA,MAAqB,IAAIC,oCAAkB,cAAc,CAAC,EAC7F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,WAAW,YAAY,mBAAmB,iBAAiB,oBAAoB,mBAAmB,WAAA,MACnH,IAAIC,cAAAA;AAAAA,QACH;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IACD,EAED,WAAW,uBAAuB,CAAC,EAAE,sBAAA,MAA4B,IAAIC,oBAAAA,oBAAoB,qBAAqB,CAAC,EAC/G,WAAW,iBAAiB,CAAC,EAAE,WAAW,YAAY,sBAAA,MAA4B,IAAIC,cAAAA,cAAc,WAAW,YAAY,qBAAqB,CAAC,EACjJ,WAAW,uBAAuB,MAAM,IAAIC,oBAAAA,oBAAA,CAAqB,EACjE,WAAW,gBAAgB,MAAM,IAAIC,aAAAA,aAAA,CAAc,EACnD,WAAW,wBAAwB,MAAM,IAAIC,qBAAAA,qBAAA,CAAsB,EACnE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,YAAY,gBAAgB,YAAY,kBAAA,MACzD,IAAIC,0BAAAA,0BAA0B,eAAe,YAAY,gBAAgB,YAAY,iBAAiB;AAAA,IAAA,EAEvG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,yBAAA,MACxC,IAAIC,0CAAqB,sBAAsB,gBAAgB,wBAAwB;AAAA,IAAA,EAExF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,uBAAuB,cAAA,MAC/C,IAAIC,wCAAoB,sBAAsB,uBAAuB,aAAa;AAAA,IAAA,EAEnF,WAAW,sBAAsB,CAAC,EAAE,8BAAA,MAAoC,IAAIC,mBAAAA,mBAAmB,6BAA6B,CAAC,EAC7H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,qBAAA,MAA2B,IAAIC,sBAAAA,sBAAsB,0BAA0B,oBAAoB;AAAA,IAAA,EAEhI,WAAW,mBAAmB,MAAM,IAAIC,gBAAAA,gBAAA,CAAiB,EACzD;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,qBAAA,MAA2B,IAAIC,wCAAoB,eAAe,gBAAgB,oBAAoB;AAAA,IAAA,EAExI,WAAW,oBAAoB,CAAC,EAAE,WAAA,MAAiB,IAAIC,iBAAAA,iBAAiB,UAAU,CAAC,EACnF,WAAW,wBAAwB,CAAC,EAAE,eAAA,MAAqB,IAAIC,0CAAqB,cAAc,CAAC,EACnG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,qBAAA,MAA2B,IAAIC,4BAAAA,4BAA4B,gBAAgB,oBAAoB;AAAA,IAAA,EAElH,WAAW,6BAA6B,MAAM,IAAIC,0BAAAA,0BAAA,CAA2B,EAC7E;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,eAAe,kBAAkB,aAAa,0BAA0B,yBAAA,MACzF,IAAIC,uBAAAA,uBAAuB,eAAe,eAAe,kBAAkB,aAAa,0BAA0B,wBAAwB;AAAA,IAAA,EAE3I;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,uBAAuB,YAAA,MAAkB,IAAIC,8CAAuB,eAAe,uBAAuB,WAAW;AAAA,IAAA,EAEvI,WAAW,2BAA2B,CAAC,EAAE,eAAA,MAAqB,IAAIC,wBAAAA,wBAAwB,cAAc,CAAC,EACzG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,oBAAoB,yBAAA,MACrC,IAAIC,4DAA8B,eAAe,oBAAoB,wBAAwB;AAAA,IAAA,EAE9F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,0BAA0B,kBAAkB,YAAA,MACxE,IAAIC,kCAAAA,kCAAkC,0BAA0B,0BAA0B,kBAAkB,WAAW;AAAA,IAAA,EAExH,WAAW,kCAAkC,CAAC,EAAE,sBAAA,MAA4B,IAAIC,+BAAAA,+BAA+B,qBAAqB,CAAC,EACrI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,0BAA0B,kBAAkB,YAAA,MACpE,IAAIC,8BAAAA,8BAA8B,sBAAsB,0BAA0B,kBAAkB,WAAW;AAAA,IAAA,EAEhH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,oBAAA,MAA0B,IAAIC,8CAAuB,eAAe,gBAAgB,mBAAmB;AAAA,IAAA,EAEzI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,oBAAA,MACxC,IAAIC,kEAAiC,sBAAsB,gBAAgB,mBAAmB;AAAA,IAAA,EAE/F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,oBAAA,MACxC,IAAIC,wEAAoC,sBAAsB,gBAAgB,mBAAmB;AAAA,IAAA,EAElG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,eAAA,MAAqB,IAAIC,oCAAAA,oCAAoC,sBAAsB,cAAc;AAAA,IAAA,EAE1H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,oBAAA,MAA0B,IAAIC,0DAA6B,eAAe,gBAAgB,mBAAmB;AAAA,IAAA,EAE/I,WAAW,iCAAiC,CAAC,EAAE,cAAA,MAAoB,IAAIC,8BAAAA,8BAA8B,aAAa,CAAC,EACnH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,mBAAmB,mBAAA,MAAyB,IAAIC,wCAAoB,YAAY,mBAAmB,kBAAkB;AAAA,IAAA,EAEpI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,iBAAiB,mBAAmB,mBAAA,MACtC,IAAIC,kDAAyB,iBAAiB,mBAAmB,kBAAkB;AAAA,IAAA,EAEpF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,kBAAA,MAAwB,IAAIC,sCAAAA,sCAAsC,iBAAiB;AAAA,IAAA,EAEtF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,oBAAA,MAA0B,IAAIC,6BAAAA,6BAA6B,gBAAgB,mBAAmB;AAAA,IAAA,EAEjH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,kBAAkB,sBAAA,MAA4B,IAAIC,oBAAAA,oBAAoB,kBAAkB,qBAAqB;AAAA,IAAA,EAEhH,WAAW,+BAA+B,CAAC,EAAE,WAAA,MAAiB,IAAIC,uBAAAA,uBAAuB,UAAU,CAAC,EACpG,WAAW,6BAA6B,CAAC,EAAE,iBAAiB,IAAIC,0BAAAA,0BAA0B,UAAU,CAAC,EACrG,WAAW,8BAA8B,CAAC,EAAE,WAAA,MAAiB,IAAIC,2BAAAA,2BAA2B,UAAU,CAAC,EACvG,WAAW,6BAA6B,CAAC,EAAE,WAAA,MAAiB,IAAIC,0BAAAA,0BAA0B,UAAU,CAAC,EACrG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,8BAAA,MAAoC,IAAIC,6CAAAA,6CAA6C,6BAA6B;AAAA,IAAA,EAErH,WAAW,iCAAiC,CAAC,EAAE,eAAA,MAAqB,IAAIC,8BAAAA,8BAA8B,cAAc,CAAC,EACrH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,qBAAqB,cAAA,MAAoB,IAAIC,8BAAAA,8BAA8B,qBAAqB,aAAa;AAAA,IAAA,EAEhH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,eAAe,WAAA,MAAiB,IAAIC,0DAA6B,eAAe,eAAe,UAAU;AAAA,IAAA,EAE3H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,kBAAA,MAAwB,IAAIC,+BAAAA,+BAA+B,eAAe,iBAAiB;AAAA,IAAA,EAE7G;AAAA,MACA;AAAA,MACA,CAAC,EAAE,cAAA,MAAoB,IAAIC,8BAAAA,8BAA8B,aAAa;AAAA,IAAA,EAEtE,WAAW,iCAAiC,CAAC,EAAE,eAAA,MAAqB,IAAIC,8BAAAA,8BAA8B,cAAc,CAAC,EACrH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,cAAA,MAAoB,IAAIC,iCAAAA,iCAAiC,gBAAgB,aAAa;AAAA,IAAA,EAEzG,WAAW,uCAAuC,CAAC,EAAE,aAAA,MAAmB,IAAIC,gEAAoC,YAAY,CAAC,EAC7H,WAAW,iCAAiC,CAAC,EAAE,2BAA2B,IAAIC,4DAA8B,oBAAoB,CAAC,EACjI,WAAW,8BAA8B,CAAC,EAAE,2BAA2B,IAAIC,sDAA2B,oBAAoB,CAAC,EAC3H,WAAW,8BAA8B,CAAC,EAAE,wBAAwB,IAAIC,2BAAAA,2BAA2B,iBAAiB,CAAC,EACrH,WAAW,2BAA2B,CAAC,EAAE,wBAAwB,IAAIC,wBAAAA,wBAAwB,iBAAiB,CAAC,EAC/G,WAAW,wBAAwB,MAAM,IAAIC,qBAAAA,qBAAA,CAAsB,EACnE,WAAW,uBAAuB,MAAM,IAAIC,oBAAAA,oBAAA,CAAqB,EACjE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,2BAA2B,uBAAuB,kBAAkB,YAAA,MACtE,IAAIC,6BAAAA,6BAA6B,2BAA2B,uBAAuB,kBAAkB,WAAW;AAAA,IAAA,EAEjH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,cAAA,MAAoB,IAAIC,mCAAAA,mCAAmC,sBAAsB,aAAa;AAAA,IAAA,EAEvH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,gBAAgB,kBAAA,MAC5C,IAAIC,0DAA6B,0BAA0B,gBAAgB,iBAAiB;AAAA,IAAA,EAE7F,WAAW,aAAa,CAAA,cAAa,IAAIC,gBAAAA,gBAAgB,SAAS,EAAE,OAAA,CAAQ,EAC5E,WAAW,cAAc,MAAM,KAAK,UAAU,EAC9C,WAAW,kBAAkB,MAAM,KAAK,cAAc,EACtD;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,UAAA,MAAgB,IAAIC,gBAAAA,gBAAgB,WAAW,aAAa,UAAU,EAAE,QAAQ,SAAA,CAAU,GAAG,SAAS;AAAA,IAAA,EAErH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,UAAA,MAAgB,IAAIA,gBAAAA,gBAAgB,eAAe,aAAa,UAAU,EAAE,QAAQ,SAAA,CAAU,GAAG,SAAS;AAAA,IAAA,EAE7H,WAAW,mBAAmB,CAAC,EAAE,gBAAA,MAAsB,IAAIC,gBAAAA,gBAAgB,gBAAgB,MAAM,CAAC,EAClG,WAAW,oBAAoB,CAAC,EAAE,UAAA,MAAgB,IAAIC,OAAAA,uBAAuB,KAAK,eAAe,UAAU,KAAK,mBAAmB,SAAS,CAAC;AAAA,EAChJ;AACD;;"}
+{"version":3,"file":"TenantContainer.cjs","sources":["../../../../packages/engine-tenant-api/src/TenantContainer.ts"],"sourcesContent":["import { AccessEvaluator, Authorizator } from '@contember/authorization'\nimport { Connection, DatabaseConfig } from '@contember/database'\nimport { Builder } from '@contember/dic'\nimport {\n\tAclSchemaAccessNodeFactory,\n\tApiKeyManager,\n\tApiKeyService,\n\tAppleProvider,\n\tAuthPolicyManager,\n\tAuthPolicyResolver,\n\tBackchannelLogoutManager,\n\tBackupCodeManager,\n\tCaptchaValidator,\n\tDatabaseContext,\n\tEmailChangeManager,\n\tEmailOtpManager,\n\tEmailValidator,\n\tEmailVerificationManager,\n\tFacebookProvider,\n\tHCaptchaProvider,\n\tIdentity,\n\tIdentityFactory,\n\tIDPClaimSyncService,\n\tIDPHandlerRegistry,\n\tIDPManager,\n\tIdpSessionRevalidator,\n\tIDPSignInManager,\n\tInviteManager,\n\tLoginRiskAnalyzer,\n\tMailTemplateManager,\n\tMembershipValidator,\n\tOIDCProvider,\n\tOtpAuthenticator,\n\tOtpManager,\n\tPanelAccessResolver,\n\tPasswordChangeManager,\n\tPasswordResetManager,\n\tPermissionContextFactory,\n\tPermissionsFactory,\n\tPersonAccessManager,\n\tPersonIdentityProviderManager,\n\tPersonManager,\n\tProjectInitializer,\n\tProjectManager,\n\tProjectMemberManager,\n\tProjectSchemaResolver,\n\tProjectScopeFactory,\n\tProviders,\n\tRateLimiter,\n\tRecaptchaV3Provider,\n\tRolesManager,\n\tSecretsManager,\n\tSignInManager,\n\tSignOutManager,\n\tSignUpManager,\n\tTurnstileProvider,\n\tUnpersistedApiKeyManager,\n\tUserMailer,\n} from './model/index.js'\nimport { HibpChecker, HttpHibpChecker, NoopHibpChecker } from './model/service/HibpChecker.js'\nimport {\n\tAddIDPMutationResolver,\n\tAddProjectMemberMutationResolver,\n\tChangePasswordMutationResolver,\n\tChangeProfileMutationResolver,\n\tCreateApiKeyMutationResolver,\n\tCreateProjectMutationResolver,\n\tDisableApiKeyMutationResolver,\n\tDisableIDPMutationResolver,\n\tDisconnectMyIdentityProviderMutationResolver,\n\tEmailOtpMutationResolver,\n\tEmailVerificationMutationResolver,\n\tEnableIDPMutationResolver,\n\tIdentityGlobalRolesMutationResolver,\n\tIdentityTypeResolver,\n\tIDPMutationResolver,\n\tInviteMutationResolver,\n\tMailTemplateMutationResolver,\n\tMeQueryResolver,\n\tOtpMutationResolver,\n\tPersonQueryResolver,\n\tPersonTypeResolver,\n\tProjectMembersQueryResolver,\n\tProjectQueryResolver,\n\tProjectTypeResolver,\n\tRegenerateBackupCodesMutationResolver,\n\tRemoveProjectMemberMutationResolver,\n\tResetPasswordMutationResolver,\n\tResolverFactory,\n\tSetProjectSecretMutationResolver,\n\tSignInMutationResolver,\n\tSignOutMutationResolver,\n\tSignUpMutationResolver,\n\tTenantResolverContextFactory,\n\tUpdateProjectMemberMutationResolver,\n\tUpdateProjectMutationResolver,\n} from './resolvers/index.js'\nimport * as Schema from './schema/index.js'\nimport { createMailer, MailerOptions, TemplateRenderer } from './utils/index.js'\nimport { IdentityFetcher } from './bridges/system/IdentityFetcher.js'\nimport { SignInResponseFactory } from './resolvers/responseHelpers/SignInResponseFactory.js'\nimport { IDPQueryResolver } from './resolvers/query/IDPQueryResolver.js'\nimport { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver.js'\nimport { TenantCredentials, TenantMigrationsRunner } from './migrations/index.js'\nimport { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver.js'\nimport { EnablePersonMutationResolver } from './resolvers/mutation/person/EnablePersonMutationResolver.js'\nimport { ForceSignOutMutationResolver } from './resolvers/mutation/person/ForceSignOutMutationResolver.js'\nimport { RevokeSessionMutationResolver } from './resolvers/mutation/person/RevokeSessionMutationResolver.js'\nimport { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver.js'\nimport { ConfigurationManager } from './model/service/ConfigurationManager.js'\nimport { ConfigurationMutationResolver } from './resolvers/mutation/configuration/ConfigurationMutationResolver.js'\nimport { ConfigurationQueryResolver } from './resolvers/query/ConfigurationQueryResolver.js'\nimport { AuthPolicyMutationResolver } from './resolvers/mutation/configuration/AuthPolicyMutationResolver.js'\nimport { AuthPolicyQueryResolver } from './resolvers/query/AuthPolicyQueryResolver.js'\nimport { ResetPersonMfaMutationResolver } from './resolvers/mutation/person/ResetPersonMfaMutationResolver.js'\nimport { AuthLogQueryResolver } from './resolvers/query/AuthLogQueryResolver.js'\nimport { ApiKeyQueryResolver } from './resolvers/query/ApiKeyQueryResolver.js'\nimport { PasswordlessMutationResolver } from './resolvers/mutation/person/PasswordlessMutationResolver.js'\nimport { PasswordlessSignInManager } from './model/service/PasswordlessSignInManager.js'\nimport { TogglePasswordlessMutationResolver } from './resolvers/mutation/person/TogglePasswordlessMutationResolver.js'\nimport { PasswordStrengthValidator } from './model/service/PasswordStrengthValidator.js'\nimport { AuthLogService } from './model/service/AuthLogService.js'\n\nexport interface TenantContainer {\n\tprojectMemberManager: ProjectMemberManager\n\tapiKeyManager: ApiKeyManager\n\tbackchannelLogoutManager: BackchannelLogoutManager\n\tsignUpManager: SignUpManager\n\tprojectManager: ProjectManager\n\tpanelAccessResolver: PanelAccessResolver\n\tresolvers: Schema.Resolvers\n\tresolverContextFactory: TenantResolverContextFactory\n\tauthorizator: Authorizator<Identity>\n\tidentityFetcher: IdentityFetcher\n\tdatabaseContext: DatabaseContext\n\treadDatabaseContext: DatabaseContext\n\tmigrationsRunner: TenantMigrationsRunner\n\tconnection: Connection.ConnectionType\n\treadConnection: Connection.ConnectionType\n}\n\nexport interface TenantContainerArgs {\n\tconnection: Connection.ConnectionType\n\treadConnection: Connection.ConnectionType\n\tdbCredentials: DatabaseConfig\n\tmailOptions: MailerOptions\n\tprojectSchemaResolver: ProjectSchemaResolver\n\tprojectInitializer: ProjectInitializer\n\ttenantCredentials: TenantCredentials\n\tcryptoProviders: Pick<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>\n}\n\nexport class TenantContainerFactory {\n\tconstructor(\n\t\tprivate readonly providers: Omit<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>,\n\t) {}\n\n\tcreate(args: TenantContainerArgs): TenantContainer {\n\t\treturn this.createBuilder(args)\n\t\t\t.build()\n\t\t\t.pick(\n\t\t\t\t'apiKeyManager',\n\t\t\t\t'backchannelLogoutManager',\n\t\t\t\t'projectMemberManager',\n\t\t\t\t'projectManager',\n\t\t\t\t'panelAccessResolver',\n\t\t\t\t'signUpManager',\n\t\t\t\t'resolvers',\n\t\t\t\t'authorizator',\n\t\t\t\t'resolverContextFactory',\n\t\t\t\t'identityFetcher',\n\t\t\t\t'databaseContext',\n\t\t\t\t'readDatabaseContext',\n\t\t\t\t'migrationsRunner',\n\t\t\t\t'connection',\n\t\t\t\t'readConnection',\n\t\t\t)\n\t}\n\n\tcreateBuilder(args: TenantContainerArgs) {\n\t\treturn new Builder({})\n\t\t\t.addService('providers', () => ({ ...this.providers, ...args.cryptoProviders }))\n\t\t\t.addService('mailer', () => createMailer(args.mailOptions))\n\t\t\t.addService('projectSchemaResolver', () => args.projectSchemaResolver)\n\t\t\t.addService('templateRenderer', () => new TemplateRenderer())\n\t\t\t.addService('accessEvaluator', ({}) => new AccessEvaluator.PermissionEvaluator(new PermissionsFactory().create()))\n\t\t\t.addService('authorizator', ({ accessEvaluator }) => new Authorizator.Default(accessEvaluator))\n\t\t\t.addService('userMailer', ({ mailer, templateRenderer }) => new UserMailer(mailer, templateRenderer))\n\t\t\t.addService('apiKeyService', () => new ApiKeyService())\n\t\t\t.addService('authPolicyResolver', () => new AuthPolicyResolver())\n\t\t\t.addService('panelAccessResolver', ({ providers }) => new PanelAccessResolver(providers))\n\t\t\t.addService('authLogService', () => new AuthLogService())\n\t\t\t.addService('loginRiskAnalyzer', ({ providers }) => new LoginRiskAnalyzer(providers.hash))\n\t\t\t.addService('idpRegistry', () => {\n\t\t\t\tconst idpRegistry = new IDPHandlerRegistry()\n\t\t\t\tidpRegistry.registerHandler('oidc', new OIDCProvider())\n\t\t\t\tidpRegistry.registerHandler('facebook', new FacebookProvider())\n\t\t\t\tidpRegistry.registerHandler('apple', new AppleProvider())\n\t\t\t\treturn idpRegistry\n\t\t\t})\n\t\t\t.addService('idpClaimSyncService', ({ projectSchemaResolver }) => new IDPClaimSyncService(projectSchemaResolver))\n\t\t\t.addService('idpSessionRevalidator', ({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator(idpRegistry, idpClaimSyncService))\n\t\t\t.addService('backchannelLogoutManager', ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry))\n\t\t\t.addService('unpersistedApiKeyManager', () =>\n\t\t\t\tUnpersistedApiKeyManager.createForRootTokens({\n\t\t\t\t\ttokens: args.tenantCredentials.rootTokens,\n\t\t\t\t\ttokenHashes: args.tenantCredentials.rootTokenHashes,\n\t\t\t\t}))\n\t\t\t.addService(\n\t\t\t\t'apiKeyManager',\n\t\t\t\t({ apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator }) =>\n\t\t\t\t\tnew ApiKeyManager(apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator),\n\t\t\t)\n\t\t\t.addService('signOutManager', ({ apiKeyManager, idpRegistry }) => new SignOutManager(apiKeyManager, idpRegistry))\n\t\t\t.addService('emailValidator', () => new EmailValidator())\n\t\t\t.addService('hibpChecker', (): HibpChecker => new HttpHibpChecker())\n\t\t\t.addService('noopHibpChecker', (): HibpChecker => new NoopHibpChecker())\n\t\t\t.addService('passwordStrengthValidator', ({ hibpChecker }) => new PasswordStrengthValidator(hibpChecker))\n\t\t\t.addService('captchaValidator', () =>\n\t\t\t\tnew CaptchaValidator({\n\t\t\t\t\tturnstile: new TurnstileProvider(),\n\t\t\t\t\thcaptcha: new HCaptchaProvider(),\n\t\t\t\t\trecaptchaV3: new RecaptchaV3Provider(),\n\t\t\t\t}))\n\t\t\t.addService('rateLimiter', ({ providers }) => new RateLimiter(providers))\n\t\t\t.addService(\n\t\t\t\t'signUpManager',\n\t\t\t\t({ emailValidator, passwordStrengthValidator }) => new SignUpManager(emailValidator, passwordStrengthValidator),\n\t\t\t)\n\t\t\t.addService('passwordChangeManager', ({ providers, passwordStrengthValidator }) => new PasswordChangeManager(providers, passwordStrengthValidator))\n\t\t\t.addService('projectMemberManager', () => new ProjectMemberManager())\n\t\t\t.addService('identityFactory', ({ projectMemberManager }) => new IdentityFactory(projectMemberManager))\n\t\t\t.addService('projectScopeFactory', () => new ProjectScopeFactory(new AclSchemaAccessNodeFactory()))\n\t\t\t.addService(\n\t\t\t\t'permissionContextFactory',\n\t\t\t\t({ authorizator, identityFactory, projectScopeFactory, projectSchemaResolver }) =>\n\t\t\t\t\tnew PermissionContextFactory(authorizator, identityFactory, projectScopeFactory, projectSchemaResolver),\n\t\t\t)\n\t\t\t.addService('secretManager', ({ providers }) => new SecretsManager(providers))\n\t\t\t.addService('projectManager', ({ secretManager, apiKeyService }) => new ProjectManager(secretManager, args.projectInitializer, apiKeyService))\n\t\t\t.addService('personAccessManager', ({ apiKeyManager }) => new PersonAccessManager(apiKeyManager))\n\t\t\t.addService('personManager', ({ emailValidator }) => new PersonManager(emailValidator))\n\t\t\t.addService(\n\t\t\t\t'passwordResetManager',\n\t\t\t\t({ userMailer, projectManager, passwordStrengthValidator }) => new PasswordResetManager(userMailer, projectManager, passwordStrengthValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailVerificationManager',\n\t\t\t\t({ userMailer, projectManager }) => new EmailVerificationManager(userMailer, projectManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailChangeManager',\n\t\t\t\t({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) =>\n\t\t\t\t\tnew EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'idpSignInManager',\n\t\t\t\t({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService),\n\t\t\t)\n\t\t\t.addService('idpManager', ({ idpRegistry, projectSchemaResolver }) => new IDPManager(idpRegistry, projectSchemaResolver))\n\t\t\t.addService('personIdentityProviderManager', () => new PersonIdentityProviderManager())\n\t\t\t.addService('otpAuthenticator', ({ providers }) => new OtpAuthenticator(providers))\n\t\t\t.addService('otpManager', ({ otpAuthenticator, providers }) => new OtpManager(otpAuthenticator, providers))\n\t\t\t.addService('backupCodeManager', ({ providers, userMailer }) => new BackupCodeManager(userMailer, providers))\n\t\t\t.addService('emailOtpManager', ({ userMailer, providers, rateLimiter }) => new EmailOtpManager(userMailer, providers, rateLimiter))\n\t\t\t.addService('authPolicyManager', ({ projectManager }) => new AuthPolicyManager(projectManager))\n\t\t\t.addService(\n\t\t\t\t'signInManager',\n\t\t\t\t({ apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer }) =>\n\t\t\t\t\tnew SignInManager(\n\t\t\t\t\t\tapiKeyManager,\n\t\t\t\t\t\tproviders,\n\t\t\t\t\t\totpManager,\n\t\t\t\t\t\tbackupCodeManager,\n\t\t\t\t\t\temailOtpManager,\n\t\t\t\t\t\tauthPolicyResolver,\n\t\t\t\t\t\tloginRiskAnalyzer,\n\t\t\t\t\t\tuserMailer,\n\t\t\t\t\t),\n\t\t\t)\n\t\t\t.addService('membershipValidator', ({ projectSchemaResolver }) => new MembershipValidator(projectSchemaResolver))\n\t\t\t.addService('inviteManager', ({ providers, userMailer, projectSchemaResolver }) => new InviteManager(providers, userMailer, projectSchemaResolver))\n\t\t\t.addService('mailTemplateManager', () => new MailTemplateManager())\n\t\t\t.addService('rolesManager', () => new RolesManager())\n\t\t\t.addService('configurationManager', () => new ConfigurationManager())\n\t\t\t.addService(\n\t\t\t\t'passwordlessSignInManager',\n\t\t\t\t({ apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager }) =>\n\t\t\t\t\tnew PasswordlessSignInManager(apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'identityTypeResolver',\n\t\t\t\t({ projectMemberManager, projectManager, permissionContextFactory }) =>\n\t\t\t\t\tnew IdentityTypeResolver(projectMemberManager, projectManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'projectTypeResolver',\n\t\t\t\t({ projectMemberManager, projectSchemaResolver, secretManager }) =>\n\t\t\t\t\tnew ProjectTypeResolver(projectMemberManager, projectSchemaResolver, secretManager),\n\t\t\t)\n\t\t\t.addService('personTypeResolver', ({ personIdentityProviderManager }) => new PersonTypeResolver(personIdentityProviderManager))\n\t\t\t.addService(\n\t\t\t\t'signInResponseFactory',\n\t\t\t\t({ permissionContextFactory, identityTypeResolver }) => new SignInResponseFactory(permissionContextFactory, identityTypeResolver),\n\t\t\t)\n\t\t\t.addService('meQueryResolver', () => new MeQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'personQueryResolver',\n\t\t\t\t({ personManager, projectManager, projectMemberManager }) => new PersonQueryResolver(personManager, projectManager, projectMemberManager),\n\t\t\t)\n\t\t\t.addService('idpQueryResolver', ({ idpManager }) => new IDPQueryResolver(idpManager))\n\t\t\t.addService('projectQueryResolver', ({ projectManager }) => new ProjectQueryResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'projectMembersQueryResolver',\n\t\t\t\t({ projectManager, projectMemberManager }) => new ProjectMembersQueryResolver(projectManager, projectMemberManager),\n\t\t\t)\n\t\t\t.addService('mailTemplateQueryResolver', () => new MailTemplateQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'signUpMutationResolver',\n\t\t\t\t({ signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory }) =>\n\t\t\t\t\tnew SignUpMutationResolver(signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'signInMutationResolver',\n\t\t\t\t({ signInManager, signInResponseFactory, rateLimiter }) => new SignInMutationResolver(signInManager, signInResponseFactory, rateLimiter),\n\t\t\t)\n\t\t\t.addService('signOutMutationResolver', ({ signOutManager }) => new SignOutMutationResolver(signOutManager))\n\t\t\t.addService(\n\t\t\t\t'changeProfileMutationResolver',\n\t\t\t\t({ personManager, emailChangeManager, permissionContextFactory }) =>\n\t\t\t\t\tnew ChangeProfileMutationResolver(personManager, emailChangeManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailVerificationMutationResolver',\n\t\t\t\t({ emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew EmailVerificationMutationResolver(emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService('changePasswordMutationResolver', ({ passwordChangeManager }) => new ChangePasswordMutationResolver(passwordChangeManager))\n\t\t\t.addService(\n\t\t\t\t'resetPasswordMutationResolver',\n\t\t\t\t({ passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew ResetPasswordMutationResolver(passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'inviteMutationResolver',\n\t\t\t\t({ inviteManager, projectManager, membershipValidator }) => new InviteMutationResolver(inviteManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'addProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager, membershipValidator }) =>\n\t\t\t\t\tnew AddProjectMemberMutationResolver(projectMemberManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'updateProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager, membershipValidator }) =>\n\t\t\t\t\tnew UpdateProjectMemberMutationResolver(projectMemberManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'removeProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager }) => new RemoveProjectMemberMutationResolver(projectMemberManager, projectManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'createApiKeyMutationResolver',\n\t\t\t\t({ apiKeyManager, projectManager, membershipValidator }) => new CreateApiKeyMutationResolver(apiKeyManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService('disableApiKeyMutationResolver', ({ apiKeyManager }) => new DisableApiKeyMutationResolver(apiKeyManager))\n\t\t\t.addService(\n\t\t\t\t'otpMutationResolver',\n\t\t\t\t({ otpManager, backupCodeManager, authPolicyResolver }) => new OtpMutationResolver(otpManager, backupCodeManager, authPolicyResolver),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailOtpMutationResolver',\n\t\t\t\t({ emailOtpManager, backupCodeManager, authPolicyResolver }) =>\n\t\t\t\t\tnew EmailOtpMutationResolver(emailOtpManager, backupCodeManager, authPolicyResolver),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'regenerateBackupCodesMutationResolver',\n\t\t\t\t({ backupCodeManager }) => new RegenerateBackupCodesMutationResolver(backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'mailTemplateMutationResolver',\n\t\t\t\t({ projectManager, mailTemplateManager }) => new MailTemplateMutationResolver(projectManager, mailTemplateManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'idpMutationResolver',\n\t\t\t\t({ idpSignInManager, signInResponseFactory }) => new IDPMutationResolver(idpSignInManager, signInResponseFactory),\n\t\t\t)\n\t\t\t.addService('registerIdpMutationResolver', ({ idpManager }) => new AddIDPMutationResolver(idpManager))\n\t\t\t.addService('updateIdpMutationResolver', ({ idpManager }) => new UpdateIDPMutationResolver(idpManager))\n\t\t\t.addService('disableIdpMutationResolver', ({ idpManager }) => new DisableIDPMutationResolver(idpManager))\n\t\t\t.addService('enableIdpMutationResolver', ({ idpManager }) => new EnableIDPMutationResolver(idpManager))\n\t\t\t.addService(\n\t\t\t\t'disconnectMyIdentityProviderMutationResolver',\n\t\t\t\t({ personIdentityProviderManager }) => new DisconnectMyIdentityProviderMutationResolver(personIdentityProviderManager),\n\t\t\t)\n\t\t\t.addService('createProjectMutationResolver', ({ projectManager }) => new CreateProjectMutationResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'disablePersonMutationResolver',\n\t\t\t\t({ personAccessManager, personManager }) => new DisablePersonMutationResolver(personAccessManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'enablePersonMutationResolver',\n\t\t\t\t({ personAccessManager, personManager }) => new EnablePersonMutationResolver(personAccessManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'forceSignOutMutationResolver',\n\t\t\t\t({ apiKeyManager, personManager, userMailer }) => new ForceSignOutMutationResolver(apiKeyManager, personManager, userMailer),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'resetPersonMfaMutationResolver',\n\t\t\t\t({ personManager, backupCodeManager }) => new ResetPersonMfaMutationResolver(personManager, backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'revokeSessionMutationResolver',\n\t\t\t\t({ apiKeyManager }) => new RevokeSessionMutationResolver(apiKeyManager),\n\t\t\t)\n\t\t\t.addService('updateProjectMutationResolver', ({ projectManager }) => new UpdateProjectMutationResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'setProjectSecretMutationResolver',\n\t\t\t\t({ projectManager, secretManager }) => new SetProjectSecretMutationResolver(projectManager, secretManager),\n\t\t\t)\n\t\t\t.addService('identityGlobalRolesMutationResolver', ({ rolesManager }) => new IdentityGlobalRolesMutationResolver(rolesManager))\n\t\t\t.addService('configurationMutationResolver', ({ configurationManager }) => new ConfigurationMutationResolver(configurationManager))\n\t\t\t.addService('configurationQueryResolver', ({ configurationManager }) => new ConfigurationQueryResolver(configurationManager))\n\t\t\t.addService('authPolicyMutationResolver', ({ authPolicyManager }) => new AuthPolicyMutationResolver(authPolicyManager))\n\t\t\t.addService('authPolicyQueryResolver', ({ authPolicyManager }) => new AuthPolicyQueryResolver(authPolicyManager))\n\t\t\t.addService('authLogQueryResolver', () => new AuthLogQueryResolver())\n\t\t\t.addService('apiKeyQueryResolver', () => new ApiKeyQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'passwordlessMutationResolver',\n\t\t\t\t({ passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'togglePasswordlessMutationResolver',\n\t\t\t\t({ configurationManager, personManager }) => new TogglePasswordlessMutationResolver(configurationManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'resolverContextFactory',\n\t\t\t\t({ permissionContextFactory, authLogService, loginRiskAnalyzer }) =>\n\t\t\t\t\tnew TenantResolverContextFactory(permissionContextFactory, authLogService, loginRiskAnalyzer),\n\t\t\t)\n\t\t\t.addService('resolvers', container => new ResolverFactory(container).create())\n\t\t\t.addService('connection', () => args.connection)\n\t\t\t.addService('readConnection', () => args.readConnection)\n\t\t\t.addService(\n\t\t\t\t'databaseContext',\n\t\t\t\t({ connection, providers }) => new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'readDatabaseContext',\n\t\t\t\t({ readConnection, providers }) => new DatabaseContext(readConnection.createClient('tenant', { module: 'tenant' }), providers),\n\t\t\t)\n\t\t\t.addService('identityFetcher', ({ databaseContext }) => new IdentityFetcher(databaseContext.client))\n\t\t\t.addService('migrationsRunner', ({ providers }) => new TenantMigrationsRunner(args.dbCredentials, 'tenant', args.tenantCredentials, providers))\n\t}\n}\n"],"names":["Builder","createMailer","TemplateRenderer","AccessEvaluator","PermissionsFactory","Authorizator","UserMailer","ApiKeyService","AuthPolicyResolver","PanelAccessResolver","AuthLogService","LoginRiskAnalyzer","IDPHandlerRegistry","OIDCProvider","FacebookProvider","AppleProvider","IDPClaimSyncService","IdpSessionRevalidator","BackchannelLogoutManager","UnpersistedApiKeyManager","ApiKeyManager","SignOutManager","EmailValidator","HttpHibpChecker","NoopHibpChecker","PasswordStrengthValidator","CaptchaValidator","TurnstileProvider","HCaptchaProvider","RecaptchaV3Provider","RateLimiter","SignUpManager","PasswordChangeManager","ProjectMemberManager","IdentityFactory","ProjectScopeFactory","AclSchemaAccessNodeFactory","PermissionContextFactory","SecretsManager","ProjectManager","PersonAccessManager","PersonManager","PasswordResetManager","EmailVerificationManager","EmailChangeManager","IDPSignInManager","IDPManager","PersonIdentityProviderManager","OtpAuthenticator","OtpManager","BackupCodeManager","EmailOtpManager","AuthPolicyManager","SignInManager","MembershipValidator","InviteManager","MailTemplateManager","RolesManager","ConfigurationManager","PasswordlessSignInManager","IdentityTypeResolver","ProjectTypeResolver","PersonTypeResolver","SignInResponseFactory","MeQueryResolver","PersonQueryResolver","IDPQueryResolver","ProjectQueryResolver","ProjectMembersQueryResolver","MailTemplateQueryResolver","SignUpMutationResolver","SignInMutationResolver","SignOutMutationResolver","ChangeProfileMutationResolver","EmailVerificationMutationResolver","ChangePasswordMutationResolver","ResetPasswordMutationResolver","InviteMutationResolver","AddProjectMemberMutationResolver","UpdateProjectMemberMutationResolver","RemoveProjectMemberMutationResolver","CreateApiKeyMutationResolver","DisableApiKeyMutationResolver","OtpMutationResolver","EmailOtpMutationResolver","RegenerateBackupCodesMutationResolver","MailTemplateMutationResolver","IDPMutationResolver","AddIDPMutationResolver","UpdateIDPMutationResolver","DisableIDPMutationResolver","EnableIDPMutationResolver","DisconnectMyIdentityProviderMutationResolver","CreateProjectMutationResolver","DisablePersonMutationResolver","EnablePersonMutationResolver","ForceSignOutMutationResolver","ResetPersonMfaMutationResolver","RevokeSessionMutationResolver","UpdateProjectMutationResolver","SetProjectSecretMutationResolver","IdentityGlobalRolesMutationResolver","ConfigurationMutationResolver","ConfigurationQueryResolver","AuthPolicyMutationResolver","AuthPolicyQueryResolver","AuthLogQueryResolver","ApiKeyQueryResolver","PasswordlessMutationResolver","TogglePasswordlessMutationResolver","TenantResolverContextFactory","ResolverFactory","DatabaseContext","IdentityFetcher","TenantMigrationsRunner"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwJO,MAAM,uBAAuB;AAAA,EACnC,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,OAAO,MAA4C;AAClD,WAAO,KAAK,cAAc,IAAI,EAC5B,QACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEA,cAAc,MAA2B;AACxC,WAAO,IAAIA,IAAAA,QAAQ,CAAA,CAAE,EACnB,WAAW,aAAa,OAAO,EAAE,GAAG,KAAK,WAAW,GAAG,KAAK,gBAAA,EAAkB,EAC9E,WAAW,UAAU,MAAMC,OAAAA,aAAa,KAAK,WAAW,CAAC,EACzD,WAAW,yBAAyB,MAAM,KAAK,qBAAqB,EACpE,WAAW,oBAAoB,MAAM,IAAIC,iBAAAA,iBAAA,CAAkB,EAC3D,WAAW,mBAAmB,CAAC,CAAA,MAAO,IAAIC,cAAAA,gBAAgB,oBAAoB,IAAIC,sCAAA,EAAqB,OAAA,CAAQ,CAAC,EAChH,WAAW,gBAAgB,CAAC,EAAE,sBAAsB,IAAIC,2BAAa,QAAQ,eAAe,CAAC,EAC7F,WAAW,cAAc,CAAC,EAAE,QAAQ,uBAAuB,IAAIC,sBAAW,QAAQ,gBAAgB,CAAC,EACnG,WAAW,iBAAiB,MAAM,IAAIC,cAAAA,eAAe,EACrD,WAAW,sBAAsB,MAAM,IAAIC,sCAAA,CAAoB,EAC/D,WAAW,uBAAuB,CAAC,EAAE,UAAA,MAAgB,IAAIC,oBAAAA,oBAAoB,SAAS,CAAC,EACvF,WAAW,kBAAkB,MAAM,IAAIC,eAAAA,gBAAgB,EACvD,WAAW,qBAAqB,CAAC,EAAE,UAAA,MAAgB,IAAIC,kBAAAA,kBAAkB,UAAU,IAAI,CAAC,EACxF,WAAW,eAAe,MAAM;AAChC,YAAM,cAAc,IAAIC,sCAAA;AACxB,kBAAY,gBAAgB,QAAQ,IAAIC,aAAAA,aAAA,CAAc;AACtD,kBAAY,gBAAgB,YAAY,IAAIC,iBAAAA,iBAAA,CAAkB;AAC9D,kBAAY,gBAAgB,SAAS,IAAIC,cAAAA,cAAA,CAAe;AACxD,aAAO;AAAA,IACR,CAAC,EACA,WAAW,uBAAuB,CAAC,EAAE,4BAA4B,IAAIC,oBAAAA,oBAAoB,qBAAqB,CAAC,EAC/G,WAAW,yBAAyB,CAAC,EAAE,aAAa,0BAA0B,IAAIC,sBAAAA,sBAAsB,aAAa,mBAAmB,CAAC,EACzI,WAAW,4BAA4B,CAAC,EAAE,YAAA,MAAkB,IAAIC,yBAAAA,yBAAyB,WAAW,CAAC,EACrG,WAAW,4BAA4B,MACvCC,yBAAAA,yBAAyB,oBAAoB;AAAA,MAC5C,QAAQ,KAAK,kBAAkB;AAAA,MAC/B,aAAa,KAAK,kBAAkB;AAAA,IAAA,CACpC,CAAC,EACF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,oBAAoB,gBAAgB,0BAA0B,sBAAA,MAC/E,IAAIC,cAAAA,cAAc,eAAe,oBAAoB,gBAAgB,0BAA0B,qBAAqB;AAAA,IAAA,EAErH,WAAW,kBAAkB,CAAC,EAAE,eAAe,YAAA,MAAkB,IAAIC,eAAAA,eAAe,eAAe,WAAW,CAAC,EAC/G,WAAW,kBAAkB,MAAM,IAAIC,eAAAA,gBAAgB,EACvD,WAAW,eAAe,MAAmB,IAAIC,YAAAA,iBAAiB,EAClE,WAAW,mBAAmB,MAAmB,IAAIC,YAAAA,iBAAiB,EACtE,WAAW,6BAA6B,CAAC,EAAE,kBAAkB,IAAIC,0BAAAA,0BAA0B,WAAW,CAAC,EACvG,WAAW,oBAAoB,MAC/B,IAAIC,kCAAiB;AAAA,MACpB,WAAW,IAAIC,kBAAAA,kBAAA;AAAA,MACf,UAAU,IAAIC,iBAAAA,iBAAA;AAAA,MACd,aAAa,IAAIC,oBAAAA,oBAAA;AAAA,IAAoB,CACrC,CAAC,EACF,WAAW,eAAe,CAAC,EAAE,UAAA,MAAgB,IAAIC,YAAAA,YAAY,SAAS,CAAC,EACvE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,0BAAA,MAAgC,IAAIC,cAAAA,cAAc,gBAAgB,yBAAyB;AAAA,IAAA,EAE9G,WAAW,yBAAyB,CAAC,EAAE,WAAW,gCAAgC,IAAIC,sBAAAA,sBAAsB,WAAW,yBAAyB,CAAC,EACjJ,WAAW,wBAAwB,MAAM,IAAIC,qBAAAA,qBAAA,CAAsB,EACnE,WAAW,mBAAmB,CAAC,EAAE,2BAA2B,IAAIC,gBAAAA,gBAAgB,oBAAoB,CAAC,EACrG,WAAW,uBAAuB,MAAM,IAAIC,oBAAAA,oBAAoB,IAAIC,2BAAAA,2BAAA,CAA4B,CAAC,EACjG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,cAAc,iBAAiB,qBAAqB,sBAAA,MACtD,IAAIC,yBAAAA,yBAAyB,cAAc,iBAAiB,qBAAqB,qBAAqB;AAAA,IAAA,EAEvG,WAAW,iBAAiB,CAAC,EAAE,UAAA,MAAgB,IAAIC,eAAAA,eAAe,SAAS,CAAC,EAC5E,WAAW,kBAAkB,CAAC,EAAE,eAAe,oBAAoB,IAAIC,eAAAA,eAAe,eAAe,KAAK,oBAAoB,aAAa,CAAC,EAC5I,WAAW,uBAAuB,CAAC,EAAE,cAAA,MAAoB,IAAIC,oBAAAA,oBAAoB,aAAa,CAAC,EAC/F,WAAW,iBAAiB,CAAC,EAAE,eAAA,MAAqB,IAAIC,4BAAc,cAAc,CAAC,EACrF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,gBAAgB,0BAAA,MAAgC,IAAIC,0CAAqB,YAAY,gBAAgB,yBAAyB;AAAA,IAAA,EAE7I;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,eAAA,MAAqB,IAAIC,yBAAAA,yBAAyB,YAAY,cAAc;AAAA,IAAA,EAE3F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,gBAAgB,gBAAgB,eAAe,yBAAA,MAC7D,IAAIC,mBAAAA,mBAAmB,YAAY,gBAAgB,gBAAgB,eAAe,wBAAwB;AAAA,IAAA,EAE3G;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,aAAa,oBAAA,MAA0B,IAAIC,kCAAiB,eAAe,aAAa,mBAAmB;AAAA,IAAA,EAE7H,WAAW,cAAc,CAAC,EAAE,aAAa,sBAAA,MAA4B,IAAIC,WAAAA,WAAW,aAAa,qBAAqB,CAAC,EACvH,WAAW,iCAAiC,MAAM,IAAIC,8BAAAA,8BAAA,CAA+B,EACrF,WAAW,oBAAoB,CAAC,EAAE,UAAA,MAAgB,IAAIC,iBAAAA,iBAAiB,SAAS,CAAC,EACjF,WAAW,cAAc,CAAC,EAAE,kBAAkB,UAAA,MAAgB,IAAIC,WAAAA,WAAW,kBAAkB,SAAS,CAAC,EACzG,WAAW,qBAAqB,CAAC,EAAE,WAAW,WAAA,MAAiB,IAAIC,kBAAAA,kBAAkB,YAAY,SAAS,CAAC,EAC3G,WAAW,mBAAmB,CAAC,EAAE,YAAY,WAAW,YAAA,MAAkB,IAAIC,gBAAAA,gBAAgB,YAAY,WAAW,WAAW,CAAC,EACjI,WAAW,qBAAqB,CAAC,EAAE,eAAA,MAAqB,IAAIC,kBAAAA,kBAAkB,cAAc,CAAC,EAC7F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,WAAW,YAAY,mBAAmB,iBAAiB,oBAAoB,mBAAmB,WAAA,MACnH,IAAIC,cAAAA;AAAAA,QACH;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IACD,EAED,WAAW,uBAAuB,CAAC,EAAE,sBAAA,MAA4B,IAAIC,oBAAAA,oBAAoB,qBAAqB,CAAC,EAC/G,WAAW,iBAAiB,CAAC,EAAE,WAAW,YAAY,sBAAA,MAA4B,IAAIC,cAAAA,cAAc,WAAW,YAAY,qBAAqB,CAAC,EACjJ,WAAW,uBAAuB,MAAM,IAAIC,oBAAAA,oBAAA,CAAqB,EACjE,WAAW,gBAAgB,MAAM,IAAIC,aAAAA,aAAA,CAAc,EACnD,WAAW,wBAAwB,MAAM,IAAIC,qBAAAA,qBAAA,CAAsB,EACnE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,YAAY,gBAAgB,YAAY,kBAAA,MACzD,IAAIC,0BAAAA,0BAA0B,eAAe,YAAY,gBAAgB,YAAY,iBAAiB;AAAA,IAAA,EAEvG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,yBAAA,MACxC,IAAIC,0CAAqB,sBAAsB,gBAAgB,wBAAwB;AAAA,IAAA,EAExF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,uBAAuB,cAAA,MAC/C,IAAIC,wCAAoB,sBAAsB,uBAAuB,aAAa;AAAA,IAAA,EAEnF,WAAW,sBAAsB,CAAC,EAAE,8BAAA,MAAoC,IAAIC,mBAAAA,mBAAmB,6BAA6B,CAAC,EAC7H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,qBAAA,MAA2B,IAAIC,sBAAAA,sBAAsB,0BAA0B,oBAAoB;AAAA,IAAA,EAEhI,WAAW,mBAAmB,MAAM,IAAIC,gBAAAA,gBAAA,CAAiB,EACzD;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,qBAAA,MAA2B,IAAIC,wCAAoB,eAAe,gBAAgB,oBAAoB;AAAA,IAAA,EAExI,WAAW,oBAAoB,CAAC,EAAE,WAAA,MAAiB,IAAIC,iBAAAA,iBAAiB,UAAU,CAAC,EACnF,WAAW,wBAAwB,CAAC,EAAE,eAAA,MAAqB,IAAIC,0CAAqB,cAAc,CAAC,EACnG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,qBAAA,MAA2B,IAAIC,4BAAAA,4BAA4B,gBAAgB,oBAAoB;AAAA,IAAA,EAElH,WAAW,6BAA6B,MAAM,IAAIC,0BAAAA,0BAAA,CAA2B,EAC7E;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,eAAe,kBAAkB,aAAa,0BAA0B,yBAAA,MACzF,IAAIC,uBAAAA,uBAAuB,eAAe,eAAe,kBAAkB,aAAa,0BAA0B,wBAAwB;AAAA,IAAA,EAE3I;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,uBAAuB,YAAA,MAAkB,IAAIC,8CAAuB,eAAe,uBAAuB,WAAW;AAAA,IAAA,EAEvI,WAAW,2BAA2B,CAAC,EAAE,eAAA,MAAqB,IAAIC,wBAAAA,wBAAwB,cAAc,CAAC,EACzG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,oBAAoB,yBAAA,MACrC,IAAIC,4DAA8B,eAAe,oBAAoB,wBAAwB;AAAA,IAAA,EAE9F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,0BAA0B,kBAAkB,YAAA,MACxE,IAAIC,kCAAAA,kCAAkC,0BAA0B,0BAA0B,kBAAkB,WAAW;AAAA,IAAA,EAExH,WAAW,kCAAkC,CAAC,EAAE,sBAAA,MAA4B,IAAIC,+BAAAA,+BAA+B,qBAAqB,CAAC,EACrI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,0BAA0B,kBAAkB,YAAA,MACpE,IAAIC,8BAAAA,8BAA8B,sBAAsB,0BAA0B,kBAAkB,WAAW;AAAA,IAAA,EAEhH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,oBAAA,MAA0B,IAAIC,8CAAuB,eAAe,gBAAgB,mBAAmB;AAAA,IAAA,EAEzI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,oBAAA,MACxC,IAAIC,kEAAiC,sBAAsB,gBAAgB,mBAAmB;AAAA,IAAA,EAE/F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,oBAAA,MACxC,IAAIC,wEAAoC,sBAAsB,gBAAgB,mBAAmB;AAAA,IAAA,EAElG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,eAAA,MAAqB,IAAIC,oCAAAA,oCAAoC,sBAAsB,cAAc;AAAA,IAAA,EAE1H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,oBAAA,MAA0B,IAAIC,0DAA6B,eAAe,gBAAgB,mBAAmB;AAAA,IAAA,EAE/I,WAAW,iCAAiC,CAAC,EAAE,cAAA,MAAoB,IAAIC,8BAAAA,8BAA8B,aAAa,CAAC,EACnH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,mBAAmB,mBAAA,MAAyB,IAAIC,wCAAoB,YAAY,mBAAmB,kBAAkB;AAAA,IAAA,EAEpI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,iBAAiB,mBAAmB,mBAAA,MACtC,IAAIC,kDAAyB,iBAAiB,mBAAmB,kBAAkB;AAAA,IAAA,EAEpF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,kBAAA,MAAwB,IAAIC,sCAAAA,sCAAsC,iBAAiB;AAAA,IAAA,EAEtF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,oBAAA,MAA0B,IAAIC,6BAAAA,6BAA6B,gBAAgB,mBAAmB;AAAA,IAAA,EAEjH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,kBAAkB,sBAAA,MAA4B,IAAIC,oBAAAA,oBAAoB,kBAAkB,qBAAqB;AAAA,IAAA,EAEhH,WAAW,+BAA+B,CAAC,EAAE,WAAA,MAAiB,IAAIC,uBAAAA,uBAAuB,UAAU,CAAC,EACpG,WAAW,6BAA6B,CAAC,EAAE,iBAAiB,IAAIC,0BAAAA,0BAA0B,UAAU,CAAC,EACrG,WAAW,8BAA8B,CAAC,EAAE,WAAA,MAAiB,IAAIC,2BAAAA,2BAA2B,UAAU,CAAC,EACvG,WAAW,6BAA6B,CAAC,EAAE,WAAA,MAAiB,IAAIC,0BAAAA,0BAA0B,UAAU,CAAC,EACrG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,8BAAA,MAAoC,IAAIC,6CAAAA,6CAA6C,6BAA6B;AAAA,IAAA,EAErH,WAAW,iCAAiC,CAAC,EAAE,eAAA,MAAqB,IAAIC,8BAAAA,8BAA8B,cAAc,CAAC,EACrH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,qBAAqB,cAAA,MAAoB,IAAIC,8BAAAA,8BAA8B,qBAAqB,aAAa;AAAA,IAAA,EAEhH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,qBAAqB,cAAA,MAAoB,IAAIC,6BAAAA,6BAA6B,qBAAqB,aAAa;AAAA,IAAA,EAE/G;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,eAAe,WAAA,MAAiB,IAAIC,0DAA6B,eAAe,eAAe,UAAU;AAAA,IAAA,EAE3H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,kBAAA,MAAwB,IAAIC,+BAAAA,+BAA+B,eAAe,iBAAiB;AAAA,IAAA,EAE7G;AAAA,MACA;AAAA,MACA,CAAC,EAAE,cAAA,MAAoB,IAAIC,8BAAAA,8BAA8B,aAAa;AAAA,IAAA,EAEtE,WAAW,iCAAiC,CAAC,EAAE,eAAA,MAAqB,IAAIC,8BAAAA,8BAA8B,cAAc,CAAC,EACrH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,cAAA,MAAoB,IAAIC,iCAAAA,iCAAiC,gBAAgB,aAAa;AAAA,IAAA,EAEzG,WAAW,uCAAuC,CAAC,EAAE,aAAA,MAAmB,IAAIC,gEAAoC,YAAY,CAAC,EAC7H,WAAW,iCAAiC,CAAC,EAAE,2BAA2B,IAAIC,4DAA8B,oBAAoB,CAAC,EACjI,WAAW,8BAA8B,CAAC,EAAE,2BAA2B,IAAIC,sDAA2B,oBAAoB,CAAC,EAC3H,WAAW,8BAA8B,CAAC,EAAE,wBAAwB,IAAIC,2BAAAA,2BAA2B,iBAAiB,CAAC,EACrH,WAAW,2BAA2B,CAAC,EAAE,wBAAwB,IAAIC,wBAAAA,wBAAwB,iBAAiB,CAAC,EAC/G,WAAW,wBAAwB,MAAM,IAAIC,qBAAAA,qBAAA,CAAsB,EACnE,WAAW,uBAAuB,MAAM,IAAIC,oBAAAA,oBAAA,CAAqB,EACjE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,2BAA2B,uBAAuB,kBAAkB,YAAA,MACtE,IAAIC,6BAAAA,6BAA6B,2BAA2B,uBAAuB,kBAAkB,WAAW;AAAA,IAAA,EAEjH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,cAAA,MAAoB,IAAIC,mCAAAA,mCAAmC,sBAAsB,aAAa;AAAA,IAAA,EAEvH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,gBAAgB,kBAAA,MAC5C,IAAIC,0DAA6B,0BAA0B,gBAAgB,iBAAiB;AAAA,IAAA,EAE7F,WAAW,aAAa,CAAA,cAAa,IAAIC,gBAAAA,gBAAgB,SAAS,EAAE,OAAA,CAAQ,EAC5E,WAAW,cAAc,MAAM,KAAK,UAAU,EAC9C,WAAW,kBAAkB,MAAM,KAAK,cAAc,EACtD;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,UAAA,MAAgB,IAAIC,gBAAAA,gBAAgB,WAAW,aAAa,UAAU,EAAE,QAAQ,SAAA,CAAU,GAAG,SAAS;AAAA,IAAA,EAErH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,UAAA,MAAgB,IAAIA,gBAAAA,gBAAgB,eAAe,aAAa,UAAU,EAAE,QAAQ,SAAA,CAAU,GAAG,SAAS;AAAA,IAAA,EAE7H,WAAW,mBAAmB,CAAC,EAAE,gBAAA,MAAsB,IAAIC,gBAAAA,gBAAgB,gBAAgB,MAAM,CAAC,EAClG,WAAW,oBAAoB,CAAC,EAAE,UAAA,MAAgB,IAAIC,OAAAA,uBAAuB,KAAK,eAAe,UAAU,KAAK,mBAAmB,SAAS,CAAC;AAAA,EAChJ;AACD;;"}