@de-otio/trellis 0.4.0

package/dist/lib/user-deletion-handler-enhanced.js

@@ -0,0 +1,401 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserDeletionHandlerEnhanced = void 0;
+const db_1 = require("../db");
+const email_provider_1 = require("./email-provider");
+const logger_1 = require("./logger");
+const crypto = __importStar(require("node:crypto"));
+class UserDeletionHandlerEnhanced {
+    GRACE_PERIOD_DAYS = 7;
+    DELETION_RATE_LIMIT = 3; // 3 requests per hour
+    DELETION_RATE_WINDOW = 3600; // 1 hour in seconds
+    /**
+     * Request account deletion (step 1: initial request)
+     * Sets grace period and requires confirmation
+     */
+    async requestDeletion(session, env) {
+        const db = (0, db_1.createPrisma)(env);
+        // Check rate limit
+        const rateLimitKey = `ratelimit:delete-account:user:${session.userId}`;
+        if (env.RATE_LIMIT_KV) {
+            const rateLimit = await this.checkRateLimitKV(rateLimitKey, env.RATE_LIMIT_KV);
+            if (!rateLimit.allowed) {
+                throw new Error(`Rate limit exceeded. Please try again after ${Math.ceil(rateLimit.retryAfter / 60)} minutes.`);
+            }
+        }
+        const user = await db.user.findUnique({
+            where: { id: session.userId },
+            select: {
+                id: true,
+                email: true,
+                suspended: true,
+                deletionRequestedAt: true,
+                deletionScheduledAt: true,
+                deletionConfirmedAt: true,
+            },
+        });
+        if (!user) {
+            throw new Error("User not found");
+        }
+        // Check if deletion already requested
+        if (user.deletionRequestedAt) {
+            if (user.deletionConfirmedAt) {
+                // Already confirmed, return scheduled time
+                return {
+                    success: true,
+                    message: "Deletion already confirmed and scheduled",
+                    scheduledAt: user.deletionScheduledAt?.toISOString(),
+                };
+            }
+            // Requested but not confirmed
+            return {
+                success: false,
+                message: "Deletion already requested. Please confirm to proceed.",
+                confirmationRequired: true,
+            };
+        }
+        // Set grace period: request deletion, schedule hard delete in 7 days
+        const now = new Date();
+        const scheduledAt = new Date(now.getTime() + this.GRACE_PERIOD_DAYS * 24 * 60 * 60 * 1000);
+        await db.user.update({
+            where: { id: session.userId },
+            data: {
+                deletionRequestedAt: now,
+                deletionScheduledAt: scheduledAt,
+                suspended: true, // Suspend immediately
+                suspendedAt: now,
+                suspendedReason: "User requested account deletion - grace period active",
+            },
+        });
+        // Generate 6-digit confirmation code and store with 24h TTL
+        const confirmationCode = crypto.randomInt(100000, 999999).toString();
+        if (env.DELETE_JOBS_KV) {
+            await env.DELETE_JOBS_KV.put(`deletion-confirm:${session.userId}`, JSON.stringify({ code: confirmationCode, createdAt: now.toISOString() }), { expirationTtl: 86400 });
+        }
+        // Send confirmation email with code
+        await this.sendDeletionConfirmationRequestEmail(user.email, scheduledAt, confirmationCode, env);
+        return {
+            success: true,
+            message: "Deletion requested. Please check your email to confirm. You have 7 days to cancel.",
+            scheduledAt: scheduledAt.toISOString(),
+            confirmationRequired: true,
+        };
+    }
+    /**
+     * Confirm account deletion (step 2: user confirms via email link)
+     */
+    async confirmDeletion(userId, confirmationCode, env) {
+        const db = (0, db_1.createPrisma)(env);
+        const user = await db.user.findUnique({
+            where: { id: userId },
+            select: {
+                id: true,
+                email: true,
+                deletionRequestedAt: true,
+                deletionScheduledAt: true,
+                deletionConfirmedAt: true,
+            },
+        });
+        if (!user) {
+            throw new Error("User not found");
+        }
+        if (!user.deletionRequestedAt) {
+            throw new Error("No deletion request found");
+        }
+        if (user.deletionConfirmedAt) {
+            return {
+                success: true,
+                message: "Deletion already confirmed",
+                scheduledAt: user.deletionScheduledAt.toISOString(),
+            };
+        }
+        // Validate confirmation code from DynamoDB-backed KV
+        if (env.DELETE_JOBS_KV) {
+            const stored = await env.DELETE_JOBS_KV.get(`deletion-confirm:${userId}`);
+            if (!stored) {
+                throw new Error("Confirmation code expired or not found. Please request deletion again.");
+            }
+            const { code } = JSON.parse(stored);
+            if (code !== confirmationCode) {
+                throw new Error("Invalid confirmation code");
+            }
+            // One-time use: delete after successful validation
+            await env.DELETE_JOBS_KV.delete(`deletion-confirm:${userId}`);
+        }
+        await db.user.update({
+            where: { id: userId },
+            data: {
+                deletionConfirmedAt: new Date(),
+            },
+        });
+        // Send confirmation email
+        await this.sendDeletionConfirmedEmail(user.email, user.deletionScheduledAt, env);
+        return {
+            success: true,
+            message: "Deletion confirmed. Your account will be permanently deleted on the scheduled date.",
+            scheduledAt: user.deletionScheduledAt.toISOString(),
+        };
+    }
+    /**
+     * Cancel account deletion (within grace period)
+     */
+    async cancelDeletion(session, env) {
+        const db = (0, db_1.createPrisma)(env);
+        const user = await db.user.findUnique({
+            where: { id: session.userId },
+            select: {
+                id: true,
+                email: true,
+                deletionRequestedAt: true,
+                deletionScheduledAt: true,
+            },
+        });
+        if (!user || !user.deletionRequestedAt) {
+            throw new Error("No deletion request found to cancel");
+        }
+        // Check if grace period has passed
+        if (user.deletionScheduledAt && new Date() >= user.deletionScheduledAt) {
+            throw new Error("Grace period has expired. Deletion cannot be cancelled.");
+        }
+        await db.user.update({
+            where: { id: session.userId },
+            data: {
+                deletionRequestedAt: null,
+                deletionScheduledAt: null,
+                deletionConfirmedAt: null,
+                suspended: false,
+                suspendedAt: null,
+                suspendedReason: null,
+            },
+        });
+        await this.sendDeletionCancelledEmail(user.email, env);
+        return {
+            success: true,
+            message: "Account deletion has been cancelled. Your account is now active.",
+        };
+    }
+    /**
+     * Check rate limit using KV
+     */
+    async checkRateLimitKV(key, kv) {
+        const stored = await kv.get(key);
+        const now = Date.now();
+        if (!stored) {
+            await kv.put(key, JSON.stringify({
+                count: 1,
+                resetAt: now + this.DELETION_RATE_WINDOW * 1000,
+            }), {
+                expirationTtl: this.DELETION_RATE_WINDOW,
+            });
+            return { allowed: true, retryAfter: 0 };
+        }
+        const data = JSON.parse(stored);
+        if (data.resetAt < now) {
+            // Reset window
+            await kv.put(key, JSON.stringify({
+                count: 1,
+                resetAt: now + this.DELETION_RATE_WINDOW * 1000,
+            }), {
+                expirationTtl: this.DELETION_RATE_WINDOW,
+            });
+            return { allowed: true, retryAfter: 0 };
+        }
+        if (data.count >= this.DELETION_RATE_LIMIT) {
+            return {
+                allowed: false,
+                retryAfter: Math.ceil((data.resetAt - now) / 1000),
+            };
+        }
+        // Increment count
+        data.count++;
+        const ttlRemaining = Math.ceil((data.resetAt - now) / 1000);
+        // KV requires minimum 60 seconds TTL
+        await kv.put(key, JSON.stringify(data), {
+            expirationTtl: Math.max(60, ttlRemaining),
+        });
+        return { allowed: true, retryAfter: 0 };
+    }
+    /**
+     * Send deletion confirmation request email
+     */
+    async sendDeletionConfirmationRequestEmail(email, scheduledAt, confirmationCode, env) {
+        if (!env.RESEND_API_KEY || !env.FROM_EMAIL)
+            return;
+        try {
+            const emailProvider = (0, email_provider_1.createEmailProvider)({
+                provider: env.EMAIL_SERVICE || "resend",
+                resendApiKey: env.RESEND_API_KEY,
+            });
+            await emailProvider.sendEmail({
+                to: email,
+                from: env.FROM_EMAIL,
+                subject: "Confirm Your Trellis Account Deletion",
+                html: `
+          <h2>Account Deletion Request</h2>
+          <p>You have requested to delete your Trellis account.</p>
+          <p><strong>Your account will be permanently deleted on: ${scheduledAt.toLocaleDateString()}</strong></p>
+          <p>Your confirmation code is: <strong>${confirmationCode}</strong></p>
+          <p>Enter this code in the app to confirm your deletion request. The code expires in 24 hours.</p>
+          <p>If you did not request this deletion, you can ignore this email or cancel the deletion from your account settings.</p>
+          <p><strong>You have 7 days to cancel before the deletion becomes permanent.</strong></p>
+        `,
+                text: `
+Account Deletion Request
+
+You have requested to delete your Trellis account.
+
+Your account will be permanently deleted on: ${scheduledAt.toLocaleDateString()}
+
+Your confirmation code is: ${confirmationCode}
+
+Enter this code in the app to confirm your deletion request. The code expires in 24 hours.
+
+If you did not request this deletion, you can ignore this email or cancel the deletion from your account settings.
+
+You have 7 days to cancel before the deletion becomes permanent.
+        `,
+            });
+        }
+        catch (error) {
+            logger_1.Logger.getInstance(env).error("[UserDeletionHandler] Failed to send confirmation email:", error);
+        }
+    }
+    /**
+     * Send deletion confirmed email
+     */
+    async sendDeletionConfirmedEmail(email, scheduledAt, env) {
+        if (!env.RESEND_API_KEY || !env.FROM_EMAIL)
+            return;
+        try {
+            const emailProvider = (0, email_provider_1.createEmailProvider)({
+                provider: env.EMAIL_SERVICE || "resend",
+                resendApiKey: env.RESEND_API_KEY,
+            });
+            await emailProvider.sendEmail({
+                to: email,
+                from: env.FROM_EMAIL,
+                subject: "Account Deletion Confirmed",
+                html: `
+          <h2>Deletion Confirmed</h2>
+          <p>Your account deletion has been confirmed.</p>
+          <p><strong>Your account will be permanently deleted on: ${scheduledAt.toLocaleDateString()}</strong></p>
+          <p>You can still cancel this deletion from your account settings until the scheduled date.</p>
+        `,
+                text: `
+Deletion Confirmed
+
+Your account deletion has been confirmed.
+
+Your account will be permanently deleted on: ${scheduledAt.toLocaleDateString()}
+
+You can still cancel this deletion from your account settings until the scheduled date.
+        `,
+            });
+        }
+        catch (error) {
+            logger_1.Logger.getInstance(env).error("[UserDeletionHandler] Failed to send confirmed email:", error);
+        }
+    }
+    /**
+     * Send deletion cancelled email
+     */
+    async sendDeletionCancelledEmail(email, env) {
+        if (!env.RESEND_API_KEY || !env.FROM_EMAIL)
+            return;
+        try {
+            const emailProvider = (0, email_provider_1.createEmailProvider)({
+                provider: env.EMAIL_SERVICE || "resend",
+                resendApiKey: env.RESEND_API_KEY,
+            });
+            await emailProvider.sendEmail({
+                to: email,
+                from: env.FROM_EMAIL,
+                subject: "Account Deletion Cancelled",
+                html: `
+          <h2>Deletion Cancelled</h2>
+          <p>Your account deletion has been cancelled.</p>
+          <p>Your account is now active and you can continue using Trellis.</p>
+        `,
+                text: `
+Deletion Cancelled
+
+Your account deletion has been cancelled.
+
+Your account is now active and you can continue using Trellis.
+        `,
+            });
+        }
+        catch (error) {
+            logger_1.Logger.getInstance(env).error("[UserDeletionHandler] Failed to send cancelled email:", error);
+        }
+    }
+    /**
+     * Send deletion complete email
+     */
+    async sendDeletionCompleteEmail(email, itemsDeleted, env) {
+        if (!env.RESEND_API_KEY || !env.FROM_EMAIL)
+            return;
+        try {
+            const emailProvider = (0, email_provider_1.createEmailProvider)({
+                provider: env.EMAIL_SERVICE || "resend",
+                resendApiKey: env.RESEND_API_KEY,
+            });
+            const summary = itemsDeleted
+                ? `\n\nSummary of deleted data:\n- Posts: ${itemsDeleted.posts}\n- Comments: ${itemsDeleted.comments}\n- Reactions: ${itemsDeleted.reactions}\n- Media files: ${itemsDeleted.mediaFiles}`
+                : "";
+            await emailProvider.sendEmail({
+                to: email,
+                from: env.FROM_EMAIL,
+                subject: "Your Trellis account has been deleted",
+                html: `
+          <h2>Account Deletion Complete</h2>
+          <p>Your Trellis account and all associated data have been permanently deleted.</p>
+          ${summary}
+        `,
+                text: `
+Account Deletion Complete
+
+Your Trellis account and all associated data have been permanently deleted.${summary}
+        `,
+            });
+        }
+        catch (error) {
+            logger_1.Logger.getInstance(env).error("[UserDeletionHandler] Failed to send completion email:", error);
+        }
+    }
+}
+exports.UserDeletionHandlerEnhanced = UserDeletionHandlerEnhanced;
+//# sourceMappingURL=user-deletion-handler-enhanced.js.map

package/dist/lib/user-deletion-handler-enhanced.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-deletion-handler-enhanced.js","sourceRoot":"","sources":["../../src/lib/user-deletion-handler-enhanced.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,8BAAqC;AACrC,qDAAuD;AAEvD,qCAAkD;AAClD,oDAAsC;AA8CtC,MAAa,2BAA2B;IACrB,iBAAiB,GAAG,CAAC,CAAC;IACtB,mBAAmB,GAAG,CAAC,CAAC,CAAC,sBAAsB;IAC/C,oBAAoB,GAAG,IAAI,CAAC,CAAC,oBAAoB;IAElE;;;OAGG;IACH,KAAK,CAAC,eAAe,CACnB,OAAgB,EAChB,GAAQ;QAOR,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,mBAAmB;QACnB,MAAM,YAAY,GAAG,iCAAiC,OAAO,CAAC,MAAM,EAAE,CAAC;QACvE,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC3C,YAAY,EACZ,GAAG,CAAC,aAAa,CAClB,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,GAAG,EAAE,CAAC,WAAW,CAC/F,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE;YAC7B,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,IAAI;gBACX,SAAS,EAAE,IAAI;gBACf,mBAAmB,EAAE,IAAI;gBACzB,mBAAmB,EAAE,IAAI;gBACzB,mBAAmB,EAAE,IAAI;aAC1B;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QAED,sCAAsC;QACtC,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC7B,2CAA2C;gBAC3C,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,0CAA0C;oBACnD,WAAW,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,EAAE;iBACrD,CAAC;YACJ,CAAC;YACD,8BAA8B;YAC9B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,wDAAwD;gBACjE,oBAAoB,EAAE,IAAI;aAC3B,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,IAAI,IAAI,CAC1B,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAC7D,CAAC;QAEF,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE;YAC7B,IAAI,EAAE;gBACJ,mBAAmB,EAAE,GAAG;gBACxB,mBAAmB,EAAE,WAAW;gBAChC,SAAS,EAAE,IAAI,EAAE,sBAAsB;gBACvC,WAAW,EAAE,GAAG;gBAChB,eAAe,EACb,uDAAuD;aAC1D;SACF,CAAC,CAAC;QAEH,4DAA4D;QAC5D,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrE,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;YACvB,MAAM,GAAG,CAAC,cAAc,CAAC,GAAG,CAC1B,oBAAoB,OAAO,CAAC,MAAM,EAAE,EACpC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,EACxE,EAAE,aAAa,EAAE,KAAK,EAAE,CACzB,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,MAAM,IAAI,CAAC,oCAAoC,CAC7C,IAAI,CAAC,KAAK,EACV,WAAW,EACX,gBAAgB,EAChB,GAAG,CACJ,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EACL,oFAAoF;YACtF,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;YACtC,oBAAoB,EAAE,IAAI;SAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,gBAAwB,EACxB,GAAQ;QAER,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,IAAI;gBACX,mBAAmB,EAAE,IAAI;gBACzB,mBAAmB,EAAE,IAAI;gBACzB,mBAAmB,EAAE,IAAI;aAC1B;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,4BAA4B;gBACrC,WAAW,EAAE,IAAI,CAAC,mBAAoB,CAAC,WAAW,EAAE;aACrD,CAAC;QACJ,CAAC;QAED,qDAAqD;QACrD,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,oBAAoB,MAAM,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAqB,CAAC;YACxD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YACD,mDAAmD;YACnD,MAAM,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,oBAAoB,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,IAAI,EAAE;gBACJ,mBAAmB,EAAE,IAAI,IAAI,EAAE;aAChC;SACF,CAAC,CAAC;QAEH,0BAA0B;QAC1B,MAAM,IAAI,CAAC,0BAA0B,CACnC,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,mBAAoB,EACzB,GAAG,CACJ,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EACL,qFAAqF;YACvF,WAAW,EAAE,IAAI,CAAC,mBAAoB,CAAC,WAAW,EAAE;SACrD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAgB,EAChB,GAAQ;QAER,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE;YAC7B,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,IAAI;gBACX,mBAAmB,EAAE,IAAI;gBACzB,mBAAmB,EAAE,IAAI;aAC1B;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,mCAAmC;QACnC,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE;YAC7B,IAAI,EAAE;gBACJ,mBAAmB,EAAE,IAAI;gBACzB,mBAAmB,EAAE,IAAI;gBACzB,mBAAmB,EAAE,IAAI;gBACzB,SAAS,EAAE,KAAK;gBAChB,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,IAAI;aACtB;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAEvD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EACL,kEAAkE;SACrE,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,GAAW,EACX,EAAe;QAEf,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC,GAAG,CACV,GAAG,EACH,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,oBAAoB,GAAG,IAAI;aAChD,CAAC,EACF;gBACE,aAAa,EAAE,IAAI,CAAC,oBAAoB;aACzC,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAuC,CAAC;QAEtE,IAAI,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YACvB,eAAe;YACf,MAAM,EAAE,CAAC,GAAG,CACV,GAAG,EACH,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,oBAAoB,GAAG,IAAI;aAChD,CAAC,EACF;gBACE,aAAa,EAAE,IAAI,CAAC,oBAAoB;aACzC,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;aACnD,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,qCAAqC;QACrC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;YACtC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC;SAC1C,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAC1C,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,oCAAoC,CAChD,KAAa,EACb,WAAiB,EACjB,gBAAwB,EACxB,GAAQ;QAER,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO;QAEnD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAA,oCAAmB,EAAC;gBACxC,QAAQ,EAAE,GAAG,CAAC,aAAa,IAAI,QAAQ;gBACvC,YAAY,EAAE,GAAG,CAAC,cAAc;aACjC,CAAC,CAAC;YAEH,MAAM,aAAa,CAAC,SAAS,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,GAAG,CAAC,UAAU;gBACpB,OAAO,EAAE,uCAAuC;gBAChD,IAAI,EAAE;;;oEAGsD,WAAW,CAAC,kBAAkB,EAAE;kDAClD,gBAAgB;;;;SAIzD;gBACD,IAAI,EAAE;;;;;+CAKiC,WAAW,CAAC,kBAAkB,EAAE;;6BAElD,gBAAgB;;;;;;;SAOpC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,0DAA0D,EAC1D,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,0BAA0B,CACtC,KAAa,EACb,WAAiB,EACjB,GAAQ;QAER,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO;QAEnD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAA,oCAAmB,EAAC;gBACxC,QAAQ,EAAE,GAAG,CAAC,aAAa,IAAI,QAAQ;gBACvC,YAAY,EAAE,GAAG,CAAC,cAAc;aACjC,CAAC,CAAC;YAEH,MAAM,aAAa,CAAC,SAAS,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,GAAG,CAAC,UAAU;gBACpB,OAAO,EAAE,4BAA4B;gBACrC,IAAI,EAAE;;;oEAGsD,WAAW,CAAC,kBAAkB,EAAE;;SAE3F;gBACD,IAAI,EAAE;;;;;+CAKiC,WAAW,CAAC,kBAAkB,EAAE;;;SAGtE;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,uDAAuD,EACvD,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,0BAA0B,CACtC,KAAa,EACb,GAAQ;QAER,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO;QAEnD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAA,oCAAmB,EAAC;gBACxC,QAAQ,EAAE,GAAG,CAAC,aAAa,IAAI,QAAQ;gBACvC,YAAY,EAAE,GAAG,CAAC,cAAc;aACjC,CAAC,CAAC;YAEH,MAAM,aAAa,CAAC,SAAS,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,GAAG,CAAC,UAAU;gBACpB,OAAO,EAAE,4BAA4B;gBACrC,IAAI,EAAE;;;;SAIL;gBACD,IAAI,EAAE;;;;;;SAML;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,uDAAuD,EACvD,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,yBAAyB,CACrC,KAAa,EACb,YAAyC,EACzC,GAAQ;QAER,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO;QAEnD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAA,oCAAmB,EAAC;gBACxC,QAAQ,EAAE,GAAG,CAAC,aAAa,IAAI,QAAQ;gBACvC,YAAY,EAAE,GAAG,CAAC,cAAc;aACjC,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,YAAY;gBAC1B,CAAC,CAAC,0CAA0C,YAAY,CAAC,KAAK,iBAAiB,YAAY,CAAC,QAAQ,kBAAkB,YAAY,CAAC,SAAS,oBAAoB,YAAY,CAAC,UAAU,EAAE;gBACzL,CAAC,CAAC,EAAE,CAAC;YAEP,MAAM,aAAa,CAAC,SAAS,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,GAAG,CAAC,UAAU;gBACpB,OAAO,EAAE,uCAAuC;gBAChD,IAAI,EAAE;;;YAGF,OAAO;SACV;gBACD,IAAI,EAAE;;;6EAG+D,OAAO;SAC3E;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,wDAAwD,EACxD,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA5dD,kEA4dC"}

package/dist/lib/user-deprovisioning.d.ts

@@ -0,0 +1,43 @@
+/**
+ * User Deprovisioning
+ *
+ * Handles user account suspension and deprovisioning when users are removed from IdP.
+ * Required for GDPR compliance and security best practices.
+ */
+import { type LoggerEnv } from "./logger";
+export interface Env {
+    DATABASE_URL: string;
+    SECURITY_WEBHOOK_URL?: string;
+}
+export interface DeprovisionReason {
+    type: "idp_removal" | "manual" | "compliance" | "security";
+    description: string;
+    initiatedBy?: string;
+}
+/**
+ * User Deprovisioning Handler
+ */
+export declare class UserDeprovisioning {
+    private securityMonitor;
+    private logger;
+    constructor(env?: LoggerEnv);
+    /**
+     * Suspend user account
+     * Used when user is removed from IdP or for security/compliance reasons
+     */
+    suspendUser(userId: string, reason: DeprovisionReason, env: Env): Promise<void>;
+    /**
+     * Check if user is suspended
+     */
+    isUserSuspended(userId: string, env: Env, region?: string): Promise<boolean>;
+    /**
+     * Restore suspended user account
+     */
+    restoreUser(userId: string, reason: string, initiatedBy: string, env: Env): Promise<void>;
+    /**
+     * Check user during SSO login - suspend if removed from IdP
+     * This should be called after successful authentication to verify user still exists in IdP
+     */
+    verifyUserStillInIdP(userId: string, provider: string, env: Env): Promise<boolean>;
+}
+//# sourceMappingURL=user-deprovisioning.d.ts.map

package/dist/lib/user-deprovisioning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-deprovisioning.d.ts","sourceRoot":"","sources":["../../src/lib/user-deprovisioning.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAElD,MAAM,WAAW,GAAG;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,CAAC;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAS;gBAEX,GAAG,CAAC,EAAE,SAAS;IAK3B;;;OAGG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,iBAAiB,EACzB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC;IAwChB;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,GAAG,EACR,MAAM,GAAE,MAAa,GACpB,OAAO,CAAC,OAAO,CAAC;IAqCnB;;OAEG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC;IAsChB;;;OAGG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,OAAO,CAAC;CAapB"}

package/dist/lib/user-deprovisioning.js

@@ -0,0 +1,138 @@
+"use strict";
+/**
+ * User Deprovisioning
+ *
+ * Handles user account suspension and deprovisioning when users are removed from IdP.
+ * Required for GDPR compliance and security best practices.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserDeprovisioning = void 0;
+const db_1 = require("../db");
+const database_connection_manager_1 = require("./database-connection-manager");
+const db_query_helper_1 = require("./db-query-helper");
+const security_monitor_1 = require("./security-monitor");
+const logger_1 = require("./logger");
+/**
+ * User Deprovisioning Handler
+ */
+class UserDeprovisioning {
+    securityMonitor;
+    logger;
+    constructor(env) {
+        this.securityMonitor = new security_monitor_1.SecurityMonitor();
+        this.logger = logger_1.Logger.getInstance(env);
+    }
+    /**
+     * Suspend user account
+     * Used when user is removed from IdP or for security/compliance reasons
+     */
+    async suspendUser(userId, reason, env) {
+        const db = (0, db_1.createPrisma)(env);
+        try {
+            // Update user to suspended
+            await db.user.update({
+                where: { id: userId },
+                data: {
+                    suspended: true,
+                    suspendedAt: new Date(),
+                    suspendedReason: `${reason.type}: ${reason.description}`,
+                },
+            });
+            // Log security event
+            await this.securityMonitor.logSecurityEvent({
+                type: "suspicious_activity",
+                severity: "high",
+                userId,
+                success: false,
+                metadata: {
+                    action: "user_suspended",
+                    reason: reason.type,
+                    description: reason.description,
+                    initiatedBy: reason.initiatedBy,
+                },
+            }, env);
+            this.logger.info(`[UserDeprovisioning] User ${userId} suspended: ${reason.type} - ${reason.description}`);
+        }
+        catch (error) {
+            this.logger.error("[UserDeprovisioning] Failed to suspend user:", error);
+            throw error;
+        }
+    }
+    /**
+     * Check if user is suspended
+     */
+    async isUserSuspended(userId, env, region = "US") {
+        try {
+            // Create connection manager instance
+            const dbManager = database_connection_manager_1.sharedDatabaseConnectionManager;
+            const user = await (0, db_query_helper_1.withQueryTimeoutAndRetry)(dbManager, region, env, async (client) => {
+                return client.user.findUnique({
+                    where: { id: userId },
+                    select: { suspended: true },
+                });
+            }, {
+                ...db_query_helper_1.QueryTimeoutPresets.CRITICAL, // 5s initial, 3s retry = 8s max (auth check)
+                defaultValue: null, // Return null if query fails (will be treated as false below)
+                context: {
+                    operation: "isUserSuspended",
+                    userId,
+                },
+            });
+            return user && "suspended" in user ? user.suspended : false;
+        }
+        catch (error) {
+            this.logger.error("[UserDeprovisioning] Failed to check suspension status:", error);
+            return false; // Fail open - don't block if check fails
+        }
+    }
+    /**
+     * Restore suspended user account
+     */
+    async restoreUser(userId, reason, initiatedBy, env) {
+        const db = (0, db_1.createPrisma)(env);
+        try {
+            await db.user.update({
+                where: { id: userId },
+                data: {
+                    suspended: false,
+                    suspendedAt: null,
+                    suspendedReason: null,
+                },
+            });
+            // Log security event
+            await this.securityMonitor.logSecurityEvent({
+                type: "suspicious_activity",
+                severity: "medium",
+                userId,
+                success: true,
+                metadata: {
+                    action: "user_restored",
+                    reason,
+                    initiatedBy,
+                },
+            }, env);
+            this.logger.info(`[UserDeprovisioning] User ${userId} restored by ${initiatedBy}: ${reason}`);
+        }
+        catch (error) {
+            this.logger.error("[UserDeprovisioning] Failed to restore user:", error);
+            throw error;
+        }
+    }
+    /**
+     * Check user during SSO login - suspend if removed from IdP
+     * This should be called after successful authentication to verify user still exists in IdP
+     */
+    async verifyUserStillInIdP(userId, provider, env) {
+        // This is a placeholder - actual implementation depends on IdP
+        // For Microsoft Entra, we could check via Microsoft Graph API
+        // For SAML, we'd need to check with the partner's IdP
+        // For now, we assume user is valid if they successfully authenticated
+        // In production, you might want to:
+        // 1. Check Microsoft Graph API for user existence
+        // 2. For SAML, maintain a sync job that checks IdP membership
+        // 3. Use SCIM 2.0 for automated provisioning/deprovisioning
+        return true; // Placeholder - assume valid
+    }
+}
+exports.UserDeprovisioning = UserDeprovisioning;
+//# sourceMappingURL=user-deprovisioning.js.map

package/dist/lib/user-deprovisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-deprovisioning.js","sourceRoot":"","sources":["../../src/lib/user-deprovisioning.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,8BAAqC;AACrC,+EAAgF;AAChF,uDAG2B;AAC3B,yDAAqD;AACrD,qCAAkD;AAalD;;GAEG;AACH,MAAa,kBAAkB;IACrB,eAAe,CAAkB;IACjC,MAAM,CAAS;IAEvB,YAAY,GAAe;QACzB,IAAI,CAAC,eAAe,GAAG,IAAI,kCAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,MAAyB,EACzB,GAAQ;QAER,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,2BAA2B;YAC3B,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,IAAI,EAAE;oBACJ,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,IAAI,IAAI,EAAE;oBACvB,eAAe,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE;iBACzD;aACF,CAAC,CAAC;YAEH,qBAAqB;YACrB,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CACzC;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,MAAM;gBAChB,MAAM;gBACN,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE;oBACR,MAAM,EAAE,gBAAgB;oBACxB,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;iBAChC;aACF,EACD,GAAG,CACJ,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,MAAM,eAAe,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,CACxF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,GAAQ,EACR,SAAiB,IAAI;QAErB,IAAI,CAAC;YACH,qCAAqC;YACrC,MAAM,SAAS,GAAG,6DAA+B,CAAC;YAElD,MAAM,IAAI,GAAG,MAAM,IAAA,0CAAwB,EAGzC,SAAS,EACT,MAAM,EACN,GAAG,EACH,KAAK,EAAE,MAAM,EAAE,EAAE;gBACf,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;oBAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;oBACrB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;iBAC5B,CAAC,CAAC;YACL,CAAC,EACD;gBACE,GAAG,qCAAmB,CAAC,QAAQ,EAAE,6CAA6C;gBAC9E,YAAY,EAAE,IAAI,EAAE,8DAA8D;gBAClF,OAAO,EAAE;oBACP,SAAS,EAAE,iBAAiB;oBAC5B,MAAM;iBACP;aACF,CACF,CAAC;YAEF,OAAO,IAAI,IAAI,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yDAAyD,EACzD,KAAK,CACN,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,yCAAyC;QACzD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,MAAc,EACd,WAAmB,EACnB,GAAQ;QAER,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,IAAI,EAAE;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI;oBACjB,eAAe,EAAE,IAAI;iBACtB;aACF,CAAC,CAAC;YAEH,qBAAqB;YACrB,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CACzC;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,QAAQ;gBAClB,MAAM;gBACN,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE;oBACR,MAAM,EAAE,eAAe;oBACvB,MAAM;oBACN,WAAW;iBACZ;aACF,EACD,GAAG,CACJ,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,MAAM,gBAAgB,WAAW,KAAK,MAAM,EAAE,CAC5E,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,QAAgB,EAChB,GAAQ;QAER,+DAA+D;QAC/D,8DAA8D;QAC9D,sDAAsD;QAEtD,sEAAsE;QACtE,oCAAoC;QACpC,kDAAkD;QAClD,8DAA8D;QAC9D,4DAA4D;QAE5D,OAAO,IAAI,CAAC,CAAC,6BAA6B;IAC5C,CAAC;CACF;AAxKD,gDAwKC"}