@happyvertical/smrt-users 0.52.0 → 0.53.5

package/dist/services/DeviceCredentialService.d.ts

@@ -0,0 +1,348 @@
+/**
+ * DeviceCredentialService — per-person sign-in on an enrolled device,
+ * layered on the device's own bearer session (#3276).
+ *
+ * ## The problem
+ *
+ * A shared tablet is enrolled once through the terminal device-code grant and
+ * holds a long-lived bearer session bound to a *device* account. Everything
+ * done on it is attributed to that account. This service lets a person
+ * present a short credential (a PIN today; a fob or badge later) **on that
+ * device only**, and mints a short-lived session for the person that is
+ * valid exactly as long as the device session is.
+ *
+ * ## The pipeline (shared by every credential kind)
+ *
+ * 1. Resolve the device bearer token to a live session and require that it
+ *    was established by device enrollment (`authMethod === 'terminal'` by
+ *    default) and is not itself a layered session.
+ * 2. Ask the host whether this device is still enrolled and active
+ *    (`assertEnrolledDevice`) — smrt-users does not own a Device object.
+ * 3. Reserve a login attempt: subject = whatever the verifier derives from
+ *    the input, source = the device account.
+ * 4. Run the credential verifier. It must do equal work for a missing and a
+ *    present credential.
+ * 5. Require the person to hold an active membership in the device session's
+ *    tenant — a device credential never widens tenant scope.
+ * 6. Ask the host for the device's permission ceiling (`deviceCeiling`,
+ *    optional) and mint the person's session with `authMethod =
+ *    verifier.kind` and `parentSessionId = device session`, and return its
+ *    id. The client sends that id as its bearer from then on;
+ *    `SessionService.loadSessionContext` enforces parent liveness and exposes
+ *    `parent` for host gates.
+ * 7. On a single-occupant device (the default), end every other person's
+ *    session on that device: signing in is how people hand the tablet over.
+ *
+ * ## Whose authority
+ *
+ * The device session authenticates the tablet; the person's session
+ * authorizes the work. Its permissions are resolved from the *person's* own
+ * membership in the device tenant (role plus per-membership overrides) on
+ * every load — never the device account's — then intersected with the
+ * ceiling snapshotted at sign-in, if the host supplied one. Both identities
+ * are on the resolved context (`user` and `parent`).
+ *
+ * Anything that is not an enrolled-device bearer session — a browser cookie
+ * session, a mobile session, a layered session — is refused before any
+ * credential work, with the same error a wrong credential produces.
+ *
+ * ## Adding a credential kind
+ *
+ * Implement {@link DeviceCredentialVerifier} and pass it to
+ * {@link DeviceCredentialService.signIn}. {@link PinVerifier} is the
+ * reference implementation. A fob verifier differs mainly in that the
+ * subject is unknown until the tag is read, which is why `subjectKey` lives
+ * on the verifier.
+ *
+ * @packageDocumentation
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import { UsersPinCredentialCollection } from '../collections/PinCredentialCollection.js';
+import { type SessionAuthMethod } from '../models/Session.js';
+import { InvalidCredentialsError, LoginAttemptLimiter, type LoginAttemptLimiterOptions } from './LoginAttemptLimiter.js';
+import { type PermissionDefinition } from './PermissionCatalogService.js';
+import { type SessionContext } from './SessionService.js';
+/** Default idle timeout of a per-person device session (8 hours — a shift). */
+export declare const DEFAULT_DEVICE_PERSON_IDLE_SECONDS: number;
+/** Default permission required to set, reset, or clear another person's PIN. */
+export declare const DEFAULT_PIN_MANAGE_PERMISSION = "users.pin.manage";
+/** Login-limiter kind reported for PIN attempts. */
+export declare const PIN_LOGIN_KIND = "pin";
+/** Catalog definition for {@link DEFAULT_PIN_MANAGE_PERMISSION}. */
+export declare const PIN_PERMISSION_DEFINITIONS: PermissionDefinition[];
+/** Register the PIN management permission once when the service is used. */
+export declare function ensurePinPermissionsRegistered(): void;
+/** Thrown when the caller is not an enrolled device, or the credential is wrong. */
+export declare class DeviceCredentialError extends InvalidCredentialsError {
+    constructor(message?: string);
+}
+/** Thrown by set/reset/clear when the actor may not manage the credential. */
+export declare class DeviceCredentialForbiddenError extends Error {
+    constructor(message?: string);
+}
+/** Thrown by set/reset when the new secret fails policy. */
+export declare class DeviceCredentialPolicyError extends Error {
+    constructor(message: string);
+}
+/** Everything a verifier gets to see about the device the attempt came from. */
+export interface DeviceSignInContext {
+    /** The enrolled device's resolved bearer session. */
+    device: SessionContext;
+}
+/**
+ * One credential kind. Implementations must do equal work whether or not a
+ * credential is enrolled for the subject (compare against a dummy hash).
+ */
+export interface DeviceCredentialVerifier<Input> {
+    /** Becomes `authMethod` on the minted session and the limiter's audit kind. */
+    readonly kind: SessionAuthMethod;
+    /** The identifier the limiter keys the subject budget on. */
+    subjectKey(input: Input): string;
+    /**
+     * Returns the authenticated user id, or null for any failure. `stillValid`,
+     * when supplied, is called AFTER the session is minted: return false if the
+     * credential that was verified has since been rotated or removed, and the
+     * sign-in is undone. Checking after the mint is what closes the race with
+     * a concurrent reset/clear — their revocation sweep runs after their write,
+     * so either this check sees the write or that sweep sees the session.
+     */
+    verify(input: Input, context: DeviceSignInContext): Promise<DeviceCredentialVerification | null>;
+}
+export interface DeviceCredentialVerification {
+    userId: string;
+    stillValid?: () => Promise<boolean>;
+}
+export interface DeviceCredentialServiceOptions extends SmrtClassOptions {
+    /**
+     * Cookie name passed to the {@link SessionService}; should match the host's
+     * session cookie so one service resolves cookies and bearers alike.
+     */
+    sessionCookieName?: string;
+    /**
+     * Sliding idle timeout of the person's session: it ends this long after
+     * its last activity, independently of the device session's own (long)
+     * life. Stored on the session, so it slides by this value whichever
+     * `SessionService` resolves it. Defaults to
+     * {@link DEFAULT_DEVICE_PERSON_IDLE_SECONDS}.
+     */
+    personIdleSeconds?: number;
+    /**
+     * Absolute lifetime of the person's session: once this long after sign-in
+     * it ends whatever its activity. Default: no absolute cap (the device
+     * session's life still bounds it).
+     */
+    personMaxSeconds?: number;
+    /**
+     * One person at a time. When true (the default) a successful sign-in ends
+     * every other person's session on the same device session, so signing in
+     * as the next person is the hand-over. Set false for devices several
+     * people stay signed in on at once.
+     */
+    singleOccupant?: boolean;
+    /**
+     * Host hook: the most any person may do on this device, as permission
+     * slugs. Called on each successful sign-in; a non-null result is
+     * snapshotted into the person's session and intersected with their own
+     * resolved permissions on every load (an empty array leaves none), and
+     * such a session never receives super-admin bypass or system context.
+     * Return null for no ceiling (the default). The snapshot is taken at
+     * sign-in: a ceiling change applies from each person's next sign-in.
+     * Throwing refuses the sign-in without counting a failed attempt.
+     */
+    deviceCeiling?: (device: SessionContext) => Promise<string[] | null>;
+    /**
+     * Auth methods that count as an enrolled device session. Defaults to
+     * `['terminal']` — the device-code grant is how devices enrol.
+     */
+    deviceAuthMethods?: SessionAuthMethod[];
+    /**
+     * Host hook: return false (or throw) when the device session's account is
+     * not an enrolled, active device. Either refuses the request; only an
+     * explicit `false` is treated as un-enrolment by `loadPersonSession`,
+     * which then revokes the person session — a throw (for example a registry
+     * outage) refuses that one request without revoking anything. smrt-users guarantees only that the
+     * bearer is a live, non-layered device-enrolled session; whether that
+     * device is still active is the host's data. Required.
+     */
+    assertEnrolledDevice: (device: SessionContext) => Promise<boolean | void>;
+    /**
+     * Shared {@link LoginAttemptLimiter}. When omitted one is created from
+     * `limiter` (or defaults). Supplying the host's instance keeps PIN,
+     * password and terminal budgets in one table with one audit sink.
+     */
+    loginLimiter?: LoginAttemptLimiter;
+    /** Options for the private limiter when `loginLimiter` is not supplied. */
+    limiter?: Omit<LoginAttemptLimiterOptions, keyof SmrtClassOptions>;
+    /** Permission slug an administrator needs to manage others' PINs. */
+    managePermission?: string;
+    /** PIN policy. */
+    pin?: PinPolicyOptions;
+}
+export interface PinPolicyOptions {
+    /** Minimum digits. Default 4. */
+    minLength?: number;
+    /** Maximum digits. Default 8. */
+    maxLength?: number;
+    /**
+     * Server-side secret mixed into every hash. Strongly recommended: a 4–8
+     * digit secret is only as strong as the pepper once the table leaks.
+     */
+    pepper?: string;
+    /** Reject repeated and sequential digits (`0000`, `1234`, `9876`). Default true. */
+    rejectTrivial?: boolean;
+    /** scrypt parameters. Defaults: N=2^15, r=8, p=1. */
+    scrypt?: {
+        N?: number;
+        r?: number;
+        p?: number;
+    };
+}
+export interface DeviceSignInInput {
+    /** The device's bearer token (`Authorization: Bearer …`). */
+    deviceToken: string;
+    ipAddress?: string;
+    userAgent?: string;
+}
+export interface DeviceSignInResult {
+    /** The person's session id — the new bearer for person-attributed work. */
+    sessionId: string;
+    userId: string;
+    tenantId: string | null;
+    authMethod: SessionAuthMethod;
+    /** When the session ends if it sees no further activity. */
+    expiresAt: string;
+    /** When the session ends regardless of activity; null without `personMaxSeconds`. */
+    absoluteExpiresAt: string | null;
+    /**
+     * True when the person must choose a new PIN before continuing. Enforced
+     * server-side: this session resolves to no permissions and can only call
+     * `setPin`, which ends it; the person then signs in with the new PIN.
+     */
+    mustReset: boolean;
+}
+export interface PinSignInInput extends DeviceSignInInput {
+    userId: string;
+    pin: string;
+}
+export interface SetPinInput {
+    /** Resolved session of whoever is making the change. */
+    actor: SessionContext;
+    userId: string;
+    pin: string;
+    /** Required when a person changes their own PIN from a PIN session. */
+    currentPin?: string;
+    ipAddress?: string;
+}
+export interface ResetPinInput {
+    actor: SessionContext;
+    userId: string;
+    pin: string;
+    ipAddress?: string;
+}
+export interface ClearPinInput {
+    actor: SessionContext;
+    userId: string;
+    ipAddress?: string;
+}
+/**
+ * Reference {@link DeviceCredentialVerifier}: `{ userId, pin }` against
+ * {@link UsersPinCredential}. Always runs scrypt, against a precomputed dummy
+ * hash when the user has no PIN, so timing does not reveal enrollment.
+ */
+export declare class PinVerifier implements DeviceCredentialVerifier<PinSignInInput> {
+    private readonly credentials;
+    private readonly pepper;
+    private readonly dummyHash;
+    readonly kind: SessionAuthMethod;
+    constructor(credentials: UsersPinCredentialCollection, pepper: string, dummyHash: string);
+    subjectKey(input: PinSignInInput): string;
+    verify(input: PinSignInInput): Promise<DeviceCredentialVerification | null>;
+}
+export declare class DeviceCredentialService {
+    private readonly options;
+    private readonly personIdleSeconds;
+    private readonly personMaxSeconds;
+    private readonly singleOccupant;
+    private readonly deviceAuthMethods;
+    private readonly managePermission;
+    private readonly pinPolicy;
+    private sessionService;
+    /**
+     * Resolves *other* sessions (the device bearer, an actor) without touching
+     * their expiry: `sessionService` auto-extends with the person idle timeout,
+     * which must never be applied to a device session with its own lifetime.
+     */
+    private readonlySessionService;
+    private memberships;
+    private users;
+    private pinCredentials;
+    private limiter;
+    private pinVerifier;
+    constructor(options: DeviceCredentialServiceOptions);
+    static create(options: DeviceCredentialServiceOptions): Promise<DeviceCredentialService>;
+    initialize(): Promise<void>;
+    /** The reference PIN verifier bound to this service's policy. */
+    get pin(): PinVerifier;
+    /** The limiter in use (shared or private), for hosts that add verifiers. */
+    get loginLimiter(): LoginAttemptLimiter;
+    /** PIN sign-in: {@link signIn} with the built-in {@link PinVerifier}. */
+    signInWithPin(input: PinSignInInput): Promise<DeviceSignInResult>;
+    /**
+     * Generic sign-in pipeline. See the module docs for the sequence. Throws
+     * {@link DeviceCredentialError} for every refusal that is not a rate limit
+     * (not a device, inactive device, unknown user, wrong credential, no
+     * membership) and {@link LoginRateLimitError} when the budget is exhausted.
+     */
+    signIn<Input extends DeviceSignInInput>(verifier: DeviceCredentialVerifier<Input>, input: Input): Promise<DeviceSignInResult>;
+    /**
+     * Sign the person out. Ends only the person's layered session; the device
+     * session is untouched. Returns false for anything that is not a live
+     * layered session (never reveals which).
+     */
+    signOut(personToken: string): Promise<boolean>;
+    /**
+     * Resolve a person's bearer. Returns null unless it is a live layered
+     * session whose parent is still an enrolled device — the host's
+     * `assertEnrolledDevice` is consulted on every call, and a person session
+     * on a device that fails it is revoked. Hosts that resolve person bearers
+     * through their own `SessionService` instead must revoke the device's
+     * bearer session when they un-enrol it.
+     */
+    loadPersonSession(personToken: string): Promise<SessionContext | null>;
+    /**
+     * Resolve any bearer or cookie session id to its context without applying
+     * this service's person TTL to it — for handlers that need the acting
+     * session (`setPin` and friends) when the host's hook has not already
+     * resolved it into `locals`. A person (layered) session goes through
+     * {@link loadPersonSession}: the device's enrollment is re-checked, and
+     * resolving it is activity, so it slides by its own idle timeout.
+     */
+    resolveActor(sessionToken: string): Promise<SessionContext | null>;
+    /**
+     * A person sets or changes their own PIN, or an administrator sets one for
+     * them. A person acting from a PIN session must supply their current PIN
+     * (checked through the limiter, so it cannot be used as an oracle); a
+     * person acting from any first-class session (browser, mobile) may set it
+     * outright, and so may an administrator holding `managePermission`.
+     */
+    setPin(input: SetPinInput): Promise<void>;
+    /**
+     * Administrative reset: writes a temporary PIN the person must change on
+     * next use, and revokes every live PIN session the person holds.
+     */
+    resetPin(input: ResetPinInput): Promise<{
+        revokedSessions: number;
+    }>;
+    /** Remove a person's PIN entirely and revoke their live PIN sessions. */
+    clearPin(input: ClearPinInput): Promise<{
+        revokedSessions: number;
+    }>;
+    /** Whether the person has a PIN enrolled (for admin UIs; never for login responses). */
+    hasPin(userId: string): Promise<boolean>;
+    private resolveEnrolledDevice;
+    private resolveDeviceCeiling;
+    private assertCanManage;
+    private assertPinPolicy;
+    private writePin;
+}
+//# sourceMappingURL=DeviceCredentialService.d.ts.map

package/dist/services/DeviceCredentialService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceCredentialService.d.ts","sourceRoot":"","sources":["../../src/services/DeviceCredentialService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAGzF,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,0BAA0B,EAEhC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAI1E,+EAA+E;AAC/E,eAAO,MAAM,kCAAkC,QAAc,CAAC;AAC9D,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,qBAAqB,CAAC;AAChE,oDAAoD;AACpD,eAAO,MAAM,cAAc,QAAQ,CAAC;AAEpC,oEAAoE;AACpE,eAAO,MAAM,0BAA0B,EAAE,oBAAoB,EAO5D,CAAC;AAIF,4EAA4E;AAC5E,wBAAgB,8BAA8B,IAAI,IAAI,CAIrD;AAED,oFAAoF;AACpF,qBAAa,qBAAsB,SAAQ,uBAAuB;gBACpD,OAAO,SAAyB;CAI7C;AAED,8EAA8E;AAC9E,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,OAAO,SAA6C;CAIjE;AAED,4DAA4D;AAC5D,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,MAAM,EAAE,cAAc,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB,CAAC,KAAK;IAC7C,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,6DAA6D;IAC7D,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,MAAM,CACJ,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,8BAA+B,SAAQ,gBAAgB;IACtE;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IACrE;;;OAGG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACxC;;;;;;;;OAQG;IACH,oBAAoB,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC1E;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,IAAI,CAAC,0BAA0B,EAAE,MAAM,gBAAgB,CAAC,CAAC;IACnE,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB;IAClB,GAAG,CAAC,EAAE,gBAAgB,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qDAAqD;IACrD,MAAM,CAAC,EAAE;QAAE,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjD;AAED,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAgFD;;;;GAIG;AACH,qBAAa,WAAY,YAAW,wBAAwB,CAAC,cAAc,CAAC;IAIxE,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAL5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAkB;gBAG/B,WAAW,EAAE,4BAA4B,EACzC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM;IAGpC,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM;IAInC,MAAM,CACV,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;CAmBhD;AAMD,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IACzD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAc;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAKxB;IACF,OAAO,CAAC,cAAc,CAAkB;IACxC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAkB;IAChD,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,KAAK,CAAkB;IAC/B,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,WAAW,CAAe;gBAEtB,OAAO,EAAE,8BAA8B;WAkCtC,MAAM,CACjB,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,uBAAuB,CAAC;IAM7B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA6CjC,iEAAiE;IACjE,IAAI,GAAG,IAAI,WAAW,CAErB;IAED,4EAA4E;IAC5E,IAAI,YAAY,IAAI,mBAAmB,CAEtC;IAMD,yEAAyE;IACnE,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIvE;;;;;OAKG;IACG,MAAM,CAAC,KAAK,SAAS,iBAAiB,EAC1C,QAAQ,EAAE,wBAAwB,CAAC,KAAK,CAAC,EACzC,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,kBAAkB,CAAC;IA6I9B;;;;OAIG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYpD;;;;;;;OAOG;IACG,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IA0B5E;;;;;;;OAOG;IACG,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAgBxE;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAmE/C;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAyB1E,yEAAyE;IACnE,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IA6B1E,wFAAwF;IAClF,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAQhC,qBAAqB;YA4BrB,oBAAoB;YAkBpB,eAAe;IAyC7B,OAAO,CAAC,eAAe;YAmBT,QAAQ;CAmBvB"}

package/dist/services/LoginAttemptLimiter.d.ts

@@ -0,0 +1,227 @@
+/**
+ * LoginAttemptLimiter — shared rate limiting and lockout for every
+ * credential-based sign-in (#3273).
+ *
+ * ## Contract
+ *
+ * ```ts
+ * const lease = await limiter.reserve({ kind: 'password', subject: emailKey, source: ip });
+ * if (!lease.allowed) throw new LoginRateLimitError(lease.retryAfterSeconds);
+ * try {
+ *   const ok = await verifyCredential(...);   // ALWAYS runs — see below
+ *   if (!ok) { await lease.fail(); throw new InvalidCredentialsError(); }
+ *   await lease.succeed();
+ * } catch (error) {
+ *   if (!(error instanceof InvalidCredentialsError)) await lease.release();
+ *   throw error;
+ * }
+ * ```
+ *
+ * Two budgets are drawn from independently: the **subject** (the identifier
+ * the client submitted — an email key or user id, never a resolved account)
+ * and the **source** (client IP, or the device/station the attempt came
+ * from). Either one being exhausted refuses the attempt. Both are stored as
+ * hashes.
+ *
+ * ## Non-enumeration
+ *
+ * The limiter itself cannot tell a known subject from an unknown one: the
+ * key is whatever the client typed. Consumers keep that property by running
+ * the same credential work for a missing account as for a wrong credential
+ * (compare against a precomputed dummy hash) and by surfacing one error for
+ * "unknown", "wrong", and "nothing enrolled". A 429 does reveal that *some*
+ * client has been hammering that identifier, which is standard and accepted;
+ * it must never reveal whether the identifier maps to an account.
+ *
+ * ## Backoff
+ *
+ * Inside a window a key gets `maxAttempts` reservations. The failure that
+ * exhausts the budget — or that completes another `maxAttempts` consecutive
+ * failures, however they were paced across windows — locks the key for
+ * `base × factor^n` seconds (capped), where `n` counts consecutive exhausted
+ * budgets with no success in between. A success resets the streak; so does
+ * going `streakResetSeconds` without a failure. A success resets only the
+ * subject's streak. A shared source keeps its history, shedding one failure
+ * per `sourceStreakDecaySeconds` since its last failure, so spaced-out
+ * mistakes never add up while a burst of guesses still escalates.
+ *
+ * ## Audit
+ *
+ * Every decision is reported to a {@link LoginAuditSink}. The default sink
+ * persists {@link UsersLoginAuditEvent} rows; pass `audit: false` to disable
+ * or supply a sink that forwards to the host's own log.
+ *
+ * @packageDocumentation
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import type { LoginAttemptScope } from '../models/LoginAttempt.js';
+import type { LoginAuditOutcome } from '../models/LoginAuditEvent.js';
+/** Default reservations per key per window. */
+export declare const DEFAULT_LOGIN_MAX_ATTEMPTS = 5;
+/** Default sliding window (5 minutes). */
+export declare const DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS: number;
+/** Default first lockout (1 minute). */
+export declare const DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS = 60;
+/** Default lockout multiplier per consecutive exhausted budget. */
+export declare const DEFAULT_LOGIN_LOCKOUT_FACTOR = 2;
+/** Default lockout ceiling (1 hour). */
+export declare const DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS: number;
+export interface LoginLockoutOptions {
+    baseSeconds?: number;
+    factor?: number;
+    maxSeconds?: number;
+}
+/** One auditable decision. Keys are already hashed; nothing here is raw. */
+export interface LoginAuditEntry {
+    kind: string;
+    outcome: LoginAuditOutcome;
+    subjectKeyHash: string | null;
+    sourceKeyHash: string | null;
+    retryAfterSeconds?: number;
+    occurredAt: Date;
+    metadata?: Record<string, unknown>;
+}
+/** Where sign-in decisions are reported. Must not throw into the sign-in path. */
+export interface LoginAuditSink {
+    record(entry: LoginAuditEntry): Promise<void>;
+}
+export interface LoginAttemptLimiterOptions extends SmrtClassOptions {
+    /** Reservations per key per window. Defaults to {@link DEFAULT_LOGIN_MAX_ATTEMPTS}. */
+    maxAttempts?: number;
+    /** Sliding window in seconds. Defaults to {@link DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS}. */
+    windowSeconds?: number;
+    /**
+     * Exponential lockout once a window's budget is exhausted. `false`
+     * disables lockout and keeps only the fixed window (the pre-#3273
+     * terminal-approve behaviour).
+     */
+    lockout?: LoginLockoutOptions | false;
+    /**
+     * Time since a key's last failure after which its streak is forgiven. Defaults to
+     * twice the larger of the window and the lockout ceiling.
+     */
+    streakResetSeconds?: number;
+    /**
+     * Gradual forgiveness for SOURCE keys, which are shared (a tablet, an
+     * office address) and are not reset by anyone's successful sign-in: one
+     * earlier failure is forgiven for each full interval of this length since
+     * the source's last failure. Ordinary mistakes spaced further apart than
+     * this never accumulate into a lockout of everyone behind the source,
+     * while a burst of guesses still escalates because it leaves no time to
+     * decay. Defaults to twice the window; `0` disables the decay, leaving only
+     * `streakResetSeconds`. Subject keys do not decay: a success resets them.
+     */
+    sourceStreakDecaySeconds?: number;
+    /**
+     * Audit destination. Omit for the durable default; `false` records nothing.
+     */
+    audit?: LoginAuditSink | false;
+    /**
+     * Optional secret mixed into key hashes so a leaked limiter table cannot be
+     * joined against a list of known emails or IPs by brute force.
+     */
+    keyPepper?: string;
+}
+export interface ReserveLoginAttemptOptions {
+    /**
+     * Credential kind, for audit only. Keys are shared across kinds on purpose
+     * (password, passkey and PIN for one person are one budget); a flow that
+     * must not pool with the others prefixes its own subject.
+     */
+    kind: string;
+    /** Identifier the client submitted (email key, user id, tag hash). */
+    subject?: string | null;
+    /** Client IP, or device/station id. */
+    source?: string | null;
+    /** Extra audit metadata. Never credentials, session ids, or the subject itself. */
+    metadata?: Record<string, unknown>;
+}
+/** A granted reservation. Exactly one of the three methods must be awaited. */
+export interface LoginAttemptLease {
+    readonly allowed: true;
+    readonly subjectKeyHash: string | null;
+    readonly sourceKeyHash: string | null;
+    /** The credential was wrong. Keeps the reservation; may lock the key. */
+    fail(metadata?: Record<string, unknown>): Promise<LoginFailureOutcome>;
+    /** The credential was right. Releases the reservation, resets the streak. */
+    succeed(metadata?: Record<string, unknown>): Promise<void>;
+    /** Credential work did not run or did not finish. Releases the reservation. */
+    release(): Promise<void>;
+}
+export interface LoginFailureOutcome {
+    /** True when this failure locked one of the keys out. */
+    lockedOut: boolean;
+    /** Seconds the client should wait when `lockedOut`. */
+    retryAfterSeconds: number | null;
+}
+export interface LoginAttemptDenied {
+    readonly allowed: false;
+    readonly retryAfterSeconds: number;
+    /** True when a lockout (not just a full window) refused the attempt. */
+    readonly lockedOut: boolean;
+    /** Which budget refused the attempt. */
+    readonly scope: LoginAttemptScope;
+}
+export type LoginAttemptDecision = LoginAttemptLease | LoginAttemptDenied;
+/**
+ * Thrown by consumers when a reservation is refused. Surface as HTTP 429
+ * with `Retry-After: retryAfterSeconds`.
+ */
+export declare class LoginRateLimitError extends Error {
+    readonly retryAfterSeconds: number;
+    readonly lockedOut: boolean;
+    constructor(decision: Pick<LoginAttemptDenied, 'retryAfterSeconds' | 'lockedOut'>);
+}
+/**
+ * Thrown by consumers for every credential failure — unknown subject, wrong
+ * credential, nothing enrolled — so responses cannot enumerate accounts.
+ */
+export declare class InvalidCredentialsError extends Error {
+    constructor(message?: string);
+}
+/** Default sink: persist every decision as a {@link UsersLoginAuditEvent}. */
+export declare class DurableLoginAuditSink implements LoginAuditSink {
+    private readonly events;
+    private constructor();
+    static create(options: SmrtClassOptions): Promise<DurableLoginAuditSink>;
+    record(entry: LoginAuditEntry): Promise<void>;
+}
+export declare class LoginAttemptLimiter {
+    private readonly options;
+    private readonly maxAttempts;
+    private readonly windowMs;
+    private readonly lockout;
+    private readonly streakResetMs;
+    private readonly sourceStreakDecayMs;
+    private attempts;
+    private audit;
+    constructor(options: LoginAttemptLimiterOptions);
+    static create(options: LoginAttemptLimiterOptions): Promise<LoginAttemptLimiter>;
+    initialize(): Promise<void>;
+    /** How long a row this limiter writes must outlive the retention sweep. */
+    private get retainMs();
+    /** Stable, peppered hash for a key. Exposed so hosts can correlate audit rows. */
+    hashKey(scope: LoginAttemptScope, raw: string): string;
+    /** Lockout length for the n-th consecutive exhausted budget (0-based). */
+    lockoutMsFor(exhaustedBudgets: number): number;
+    /**
+     * Reserve one attempt against every key supplied. Subject is reserved
+     * first; if the source then refuses, the subject reservation is handed
+     * back so one noisy source cannot burn every account's budget.
+     */
+    reserve(input: ReserveLoginAttemptOptions): Promise<LoginAttemptDecision>;
+    /** Report an administrative credential event through the same sink. */
+    recordManagement(input: {
+        kind: string;
+        subject?: string | null;
+        source?: string | null;
+        metadata?: Record<string, unknown>;
+    }): Promise<void>;
+    /** Prune idle limiter rows (retention sweep). */
+    cleanupIdle(options?: {
+        dryRun?: boolean;
+    }): Promise<number>;
+    private releaseAll;
+    private report;
+}
+//# sourceMappingURL=LoginAttemptLimiter.d.ts.map

package/dist/services/LoginAttemptLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginAttemptLimiter.d.ts","sourceRoot":"","sources":["../../src/services/LoginAttemptLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,+CAA+C;AAC/C,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAC5C,0CAA0C;AAC1C,eAAO,MAAM,oCAAoC,QAAS,CAAC;AAC3D,wCAAwC;AACxC,eAAO,MAAM,kCAAkC,KAAK,CAAC;AACrD,mEAAmE;AACnE,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,wCAAwC;AACxC,eAAO,MAAM,iCAAiC,QAAU,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,0BAA2B,SAAQ,gBAAgB;IAClE,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,OAAO,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;IACtC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;OAEG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,KAAK,CAAC;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvE,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,+EAA+E;IAC/E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,SAAS,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC;AAED,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AAE1E;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAG1B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,GAAG,WAAW,CAAC;CAOxE;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAyB;CAI7C;AAED,8EAA8E;AAC9E,qBAAa,qBAAsB,YAAW,cAAc;IAExD,OAAO,CAAC,QAAQ,CAAC,MAAM;IADzB,OAAO;WAIM,MAAM,CACjB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,qBAAqB,CAAC;IAM3B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAYpD;AAaD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,KAAK,CAA+B;gBAEhC,OAAO,EAAE,0BAA0B;WAgClC,MAAM,CACjB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,mBAAmB,CAAC;IAMzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAWjC,2EAA2E;IAC3E,OAAO,KAAK,QAAQ,GAEnB;IAED,kFAAkF;IAClF,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM;IAQtD,0EAA0E;IAC1E,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM;IAS9C;;;;OAIG;IACG,OAAO,CACX,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,oBAAoB,CAAC;IAyHhC,uEAAuE;IACjE,gBAAgB,CAAC,KAAK,EAAE;QAC5B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC;IAajB,iDAAiD;IAC3C,WAAW,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAIxD,UAAU;YAsBV,MAAM;CASrB"}

package/dist/services/MobileAuthService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MobileAuthService.d.ts","sourceRoot":"","sources":["../../src/services/MobileAuthService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAI7C,OAAO,EACL,KAAK,UAAU,EAEhB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EAGL,KAAK,6BAA6B,EAClC,KAAK,YAAY,EAGlB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAerD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,iBAAiB,GACjB,kBAAkB,GAClB,sBAAsB,GACtB,uBAAuB,GACvB,eAAe,GACf,qBAAqB,GACrB,iBAAiB,GACjB,sBAAsB,GACtB,sBAAsB,GACtB,sBAAsB,GACtB,sBAAsB,GACtB,sBAAsB,CAAC;AAE3B;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;gBAEvB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM;CAMvE;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,OAAO,EAAE,cAAc,CAAC;IACxB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzC;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBACf,SAAQ,gBAAgB,EACtB,6BAA6B;IAC/B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,CACZ,OAAO,EAAE,kBAAkB,KACxB,OAAO,CAAC,kBAAkB,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAChB,OAAO,EAAE,mBAAmB,KACzB,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACxC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CACZ,OAAO,EAAE,sBAAsB,KAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CAC1D;AAED,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,mDAAmD;IACnD,SAAS,EAAE,OAAO,CAAC;CACpB;AA6ID;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,mBAAmB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7C,MAAM,GAAG,IAAI,CAIf;AA+CD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,SAAS,GAAE,MAAM,EAAO,GACvB,MAAM,CAyDR;AAoED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,oBAAoB,CAAwB;IACpD,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuC;gBAExD,OAAO,EAAE,wBAAwB;YA8B/B,UAAU;WAaX,MAAM,CACjB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,iBAAiB,CAAC;IAM7B;;;OAGG;IACH,iBAAiB,IAAI,cAAc;IAInC,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,cAAc;IAmCtB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAiBtB;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAkE5E;;;OAGG;IACG,QAAQ,CACZ,KAAK,EAAE,yBAAyB,EAChC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,iBAAiB,CAAC;YAmIf,oBAAoB;YAgBpB,sBAAsB;IAsBpC;;;OAGG;IACG,SAAS,CACb,mBAAmB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,sBAAsB,CAAC;IAwBlC;;;;OAIG;IACG,qBAAqB,CACzB,mBAAmB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,cAAc,CAAC;IA0B1B;;;OAGG;IACG,MAAM,CACV,mBAAmB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,kBAAkB,CAAC;IAO9B;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAOxD,kBAAkB;YAqFlB,uBAAuB;IA2CrC,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,aAAa;CAGtB"}
+{"version":3,"file":"MobileAuthService.d.ts","sourceRoot":"","sources":["../../src/services/MobileAuthService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,kBAAkB,EAEnB,MAAM,qCAAqC,CAAC;AAI7C,OAAO,EACL,KAAK,UAAU,EAEhB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EAGL,KAAK,6BAA6B,EAClC,KAAK,YAAY,EAGlB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAerD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,iBAAiB,GACjB,kBAAkB,GAClB,sBAAsB,GACtB,uBAAuB,GACvB,eAAe,GACf,qBAAqB,GACrB,iBAAiB,GACjB,sBAAsB,GACtB,sBAAsB,GACtB,sBAAsB,GACtB,sBAAsB,GACtB,sBAAsB,CAAC;AAE3B;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;gBAEvB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM;CAMvE;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,OAAO,EAAE,cAAc,CAAC;IACxB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzC;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBACf,SAAQ,gBAAgB,EACtB,6BAA6B;IAC/B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,CACZ,OAAO,EAAE,kBAAkB,KACxB,OAAO,CAAC,kBAAkB,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAChB,OAAO,EAAE,mBAAmB,KACzB,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACxC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CACZ,OAAO,EAAE,sBAAsB,KAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CAC1D;AAED,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,mDAAmD;IACnD,SAAS,EAAE,OAAO,CAAC;CACpB;AA6ID;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,mBAAmB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7C,MAAM,GAAG,IAAI,CAIf;AA+CD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,SAAS,GAAE,MAAM,EAAO,GACvB,MAAM,CAyDR;AAoED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,oBAAoB,CAAwB;IACpD,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuC;gBAExD,OAAO,EAAE,wBAAwB;YA8B/B,UAAU;WAaX,MAAM,CACjB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,iBAAiB,CAAC;IAM7B;;;OAGG;IACH,iBAAiB,IAAI,cAAc;IAInC,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,cAAc;IAmCtB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAiBtB;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAkE5E;;;OAGG;IACG,QAAQ,CACZ,KAAK,EAAE,yBAAyB,EAChC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,iBAAiB,CAAC;YAoIf,oBAAoB;YAgBpB,sBAAsB;IAsBpC;;;OAGG;IACG,SAAS,CACb,mBAAmB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,sBAAsB,CAAC;IAwBlC;;;;OAIG;IACG,qBAAqB,CACzB,mBAAmB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,cAAc,CAAC;IA0B1B;;;OAGG;IACG,MAAM,CACV,mBAAmB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,kBAAkB,CAAC;IAO9B;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAOxD,kBAAkB;YAqFlB,uBAAuB;IA2CrC,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,aAAa;CAGtB"}

package/dist/services/OperationPermissionService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OperationPermissionService.d.ts","sourceRoot":"","sources":["../../src/services/OperationPermissionService.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAEL,KAAK,kCAAkC,EACvC,KAAK,iBAAiB,EAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,2BAA2B,EAChC,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAGjC,MAAM,MAAM,6BAA6B,GACrC,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,CAAC;AAExB,MAAM,MAAM,8BAA8B,GACtC,oBAAoB,GACpB,oBAAoB,GACpB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,8BAA8B,GAAG,6BAA6B,CAAC;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,0BACf,SAAQ,gBAAgB,EACtB,2BAA2B;IAC7B;;OAEG;IACH,UAAU,EAAE,kCAAkC,CAAC;IAC/C;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;OAEG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,CAAC;CACzD;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,OAAO;gBAEV,QAAQ,EAAE,2BAA2B;CAUlD;AAmED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,2BAA2B,CAAC,CAuEtC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,2BAA2B,CAAC,CAOtC"}
+{"version":3,"file":"OperationPermissionService.d.ts","sourceRoot":"","sources":["../../src/services/OperationPermissionService.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAEL,KAAK,kCAAkC,EACvC,KAAK,iBAAiB,EAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,2BAA2B,EAChC,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAGjC,MAAM,MAAM,6BAA6B,GACrC,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,CAAC;AAExB,MAAM,MAAM,8BAA8B,GACtC,oBAAoB,GACpB,oBAAoB,GACpB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,8BAA8B,GAAG,6BAA6B,CAAC;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,0BACf,SAAQ,gBAAgB,EACtB,2BAA2B;IAC7B;;OAEG;IACH,UAAU,EAAE,kCAAkC,CAAC;IAC/C;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;OAEG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,CAAC;CACzD;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,OAAO;gBAEV,QAAQ,EAAE,2BAA2B;CAUlD;AAmED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,2BAA2B,CAAC,CA0FtC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,2BAA2B,CAAC,CAOtC"}

package/dist/services/PermissionCatalogService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionCatalogService.d.ts","sourceRoot":"","sources":["../../src/services/PermissionCatalogService.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAQlC,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExE,MAAM,MAAM,wBAAwB,GAChC,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,QAAQ,CAAC;AAEb,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,SAAS,CAAC,wBAAwB,CAAC,GAAG,wBAAwB,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,yBAAyB,EAAE,CAAC;KACxC,CAAC;IACF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,oBAAoB,EAAE,CAAC;IAC1C,mBAAmB,EAAE,oBAAoB,EAAE,CAAC;IAC5C,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,iBAAiB,CAAC;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAY,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC1D,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAChC,QAAQ,CAAC,EAAE;YACT,QAAQ,CAAC,EAAE,yBAAyB,EAAE,CAAC;YACvC,OAAO,CAAC,EAAE,OAAO,CAAC;SACnB,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,MAAM,eAAe,CAAC;CACtC;AAED,MAAM,MAAM,kCAAkC,GAC1C,MAAM,GACN,eAAe,GACf,cAAc,GACd,MAAM,CAAC;AAEX,OAAO,CAAC,MAAM,CAAC;IAEb,IAAI,kCAAkC,EAClC,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,GACnC,SAAS,CAAC;IAEd,IAAI,wCAAwC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClE;AAsED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAkBzE;AAmCD,wBAAgB,uCAAuC,CACrD,KAAK,EAAE,kCAAkC,GACxC,MAAM,CAiCR;AAED,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,kCAAkC,EAC9C,MAAM,EAAE,MAAM,GACb,MAAM,CAQR;AAkdD,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,oBAAoB,EAAE,GAClC,MAAM,IAAI,CASZ;AAED,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,gBAAqB;IAE3D,cAAc,IAAI,WAAW;IAI7B,+BAA+B,IAAI,oBAAoB,EAAE;IAIzD,8BAA8B,IAAI,oBAAoB,EAAE;IAIxD,UAAU,IAAI,iBAAiB;IA0B/B,6BAA6B,CAC3B,UAAU,EAAE,kCAAkC,EAC9C,MAAM,EAAE,MAAM,GACb,MAAM;IAIT,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAMlC,qBAAqB,IAAI,OAAO,CAAC,2BAA2B,CAAC;IA0EnE,OAAO,CAAC,gCAAgC;IAgJxC,MAAM,CAAC,MAAM,CAAC,OAAO,GAAE,gBAAqB,GAAG,wBAAwB;CAGxE;AAED,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,2BAA2B,CAAC,CAEtC"}
+{"version":3,"file":"PermissionCatalogService.d.ts","sourceRoot":"","sources":["../../src/services/PermissionCatalogService.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAUlC,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExE,MAAM,MAAM,wBAAwB,GAChC,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,QAAQ,CAAC;AAEb,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,SAAS,CAAC,wBAAwB,CAAC,GAAG,wBAAwB,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,yBAAyB,EAAE,CAAC;KACxC,CAAC;IACF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,oBAAoB,EAAE,CAAC;IAC1C,mBAAmB,EAAE,oBAAoB,EAAE,CAAC;IAC5C,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,iBAAiB,CAAC;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,WAAY,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC1D,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAChC,QAAQ,CAAC,EAAE;YACT,QAAQ,CAAC,EAAE,yBAAyB,EAAE,CAAC;YACvC,OAAO,CAAC,EAAE,OAAO,CAAC;SACnB,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,MAAM,eAAe,CAAC;CACtC;AAED,MAAM,MAAM,kCAAkC,GAC1C,MAAM,GACN,eAAe,GACf,cAAc,GACd,MAAM,CAAC;AAEX,OAAO,CAAC,MAAM,CAAC;IAEb,IAAI,kCAAkC,EAClC,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,GACnC,SAAS,CAAC;IAEd,IAAI,wCAAwC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClE;AAsED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAkBzE;AAmCD,wBAAgB,uCAAuC,CACrD,KAAK,EAAE,kCAAkC,GACxC,MAAM,CAiCR;AAED,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,kCAAkC,EAC9C,MAAM,EAAE,MAAM,GACb,MAAM,CAQR;AAkdD,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,oBAAoB,EAAE,GAClC,MAAM,IAAI,CASZ;AAcD,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,gBAAqB;IAE3D,cAAc,IAAI,WAAW;IAI7B,+BAA+B,IAAI,oBAAoB,EAAE;IAIzD,8BAA8B,IAAI,oBAAoB,EAAE;IAIxD,UAAU,IAAI,iBAAiB;IA0B/B,6BAA6B,CAC3B,UAAU,EAAE,kCAAkC,EAC9C,MAAM,EAAE,MAAM,GACb,MAAM;IAIT,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAMlC,qBAAqB,IAAI,OAAO,CAAC,2BAA2B,CAAC;IA0FnE,OAAO,CAAC,gCAAgC;IAgJxC,MAAM,CAAC,MAAM,CAAC,OAAO,GAAE,gBAAqB,GAAG,wBAAwB;CAGxE;AAED,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,2BAA2B,CAAC,CAEtC"}

package/dist/services/SessionPermissionContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionPermissionContext.d.ts","sourceRoot":"","sources":["../../src/services/SessionPermissionContext.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,KAAK,cAAc,EACnB,cAAc,EAEf,MAAM,qBAAqB,CAAC;AAE7B,UAAU,iBAAkB,SAAQ,iBAAiB;IACnD,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,UAAU,mBAAoB,SAAQ,iBAAiB;IACrD,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACpC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,+BAAgC,SAAQ,gBAAgB;IACvE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iCAAkC,SAAQ,gBAAgB;IACzE,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;CAChB;AAgBD,OAAO,CAAC,MAAM,CAAC;IAEb,IAAI,iCAAiC,EACjC,CAAC,MAAM,+BAA+B,GAAG,SAAS,CAAC,GACnD,SAAS,CAAC;CAMf;AAwBD,wBAAgB,kCAAkC,IAC9C,+BAA+B,GAC/B,SAAS,CAEZ;AAED,wBAAgB,wBAAwB,IAAI,iBAAiB,GAAG,SAAS,CAExE;AAsMD,wBAAsB,4BAA4B,CAAC,CAAC,EAClD,OAAO,EAAE,+BAA+B,EACxC,EAAE,EAAE,CAAC,OAAO,EAAE,+BAA+B,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3D,OAAO,CAAC,CAAC,CAAC,CA6CZ;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,EACpD,OAAO,EAAE,iCAAiC,EAC1C,EAAE,EAAE,CAAC,OAAO,EAAE,+BAA+B,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3D,OAAO,CAAC,CAAC,CAAC,CAoEZ"}
+{"version":3,"file":"SessionPermissionContext.d.ts","sourceRoot":"","sources":["../../src/services/SessionPermissionContext.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,KAAK,cAAc,EACnB,cAAc,EAEf,MAAM,qBAAqB,CAAC;AAE7B,UAAU,iBAAkB,SAAQ,iBAAiB;IACnD,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,UAAU,mBAAoB,SAAQ,iBAAiB;IACrD,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACpC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,+BAAgC,SAAQ,gBAAgB;IACvE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iCAAkC,SAAQ,gBAAgB;IACzE,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;CAChB;AAgBD,OAAO,CAAC,MAAM,CAAC;IAEb,IAAI,iCAAiC,EACjC,CAAC,MAAM,+BAA+B,GAAG,SAAS,CAAC,GACnD,SAAS,CAAC;CAMf;AAwBD,wBAAgB,kCAAkC,IAC9C,+BAA+B,GAC/B,SAAS,CAEZ;AAED,wBAAgB,wBAAwB,IAAI,iBAAiB,GAAG,SAAS,CAExE;AAsMD,wBAAsB,4BAA4B,CAAC,CAAC,EAClD,OAAO,EAAE,+BAA+B,EACxC,EAAE,EAAE,CAAC,OAAO,EAAE,+BAA+B,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3D,OAAO,CAAC,CAAC,CAAC,CAmDZ;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,EACpD,OAAO,EAAE,iCAAiC,EAC1C,EAAE,EAAE,CAAC,OAAO,EAAE,+BAA+B,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3D,OAAO,CAAC,CAAC,CAAC,CAoEZ"}