@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.4

package/dist/identity/allowlist/allowlist.service.js

@@ -0,0 +1,258 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AllowlistService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AllowlistService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const index_1 = require("../../core/index");
+const ports_1 = require("../ports");
+/**
+ * Exported for the reference app's wiring and tests; not a stable extension point (reach identity through IdentityModule and its documented seams).
+ *
+ * @internal
+ */
+let AllowlistService = AllowlistService_1 = class AllowlistService {
+    prisma;
+    notifications;
+    config;
+    logger = new common_1.Logger(AllowlistService_1.name);
+    constructor(prisma, notifications, config) {
+        this.prisma = prisma;
+        this.notifications = notifications;
+        this.config = config;
+    }
+    /**
+     * List allowed emails with pagination and filtering
+     */
+    async listAllowedEmails(query) {
+        const { page, pageSize, search, status, sortBy, sortOrder } = query;
+        const skip = (page - 1) * pageSize;
+        // Build where clause
+        const where = {};
+        if (search) {
+            where.email = { contains: search, mode: 'insensitive' };
+        }
+        if (status === 'pending') {
+            where.claimedById = null;
+        }
+        else if (status === 'claimed') {
+            where.claimedById = { not: null };
+        }
+        // Execute query
+        const [items, total] = await Promise.all([
+            this.prisma.allowedEmail.findMany({
+                where,
+                skip,
+                take: pageSize,
+                orderBy: { [sortBy]: sortOrder },
+                include: {
+                    addedBy: {
+                        select: {
+                            id: true,
+                            email: true,
+                        },
+                    },
+                    claimedBy: {
+                        select: {
+                            id: true,
+                            email: true,
+                        },
+                    },
+                },
+            }),
+            this.prisma.allowedEmail.count({ where }),
+        ]);
+        return {
+            items,
+            total,
+            page,
+            pageSize,
+            totalPages: Math.ceil(total / pageSize),
+        };
+    }
+    /**
+     * Add email to allowlist
+     */
+    async addEmail(dto, adminUserId) {
+        const email = dto.email.toLowerCase();
+        // Check for duplicates
+        const existing = await this.prisma.allowedEmail.findUnique({
+            where: { email },
+        });
+        if (existing) {
+            throw new common_1.ConflictException(`Email ${email} is already in the allowlist`);
+        }
+        // Create entry
+        const entry = await this.prisma.allowedEmail.create({
+            data: {
+                email,
+                notes: dto.notes,
+                addedById: adminUserId,
+            },
+            include: {
+                addedBy: {
+                    select: {
+                        id: true,
+                        email: true,
+                    },
+                },
+            },
+        });
+        // Create audit event
+        await this.createAuditEvent(adminUserId, 'allowlist:add', 'allowed_email', entry.id, { email });
+        this.logger.log(`Email ${email} added to allowlist by admin ${adminUserId}`);
+        // -------------------------------------------------------------------------
+        // Trigger: `allowlist.invitation` (#128, epic #109)
+        // -------------------------------------------------------------------------
+        //
+        // THE ONE NOTIFICATION IN THIS EPIC WITH OBVIOUS USER VALUE: without it an
+        // admin adds an address here and then has to tell the person out of band,
+        // which is a step that gets forgotten and an invitation that never arrives.
+        //
+        // `notifyAddress`, NOT `notify`. The recipient has no user id to pass —
+        // having no account is the entire meaning of being newly allowlisted — and
+        // therefore no `user_settings` row and no preferences to resolve. See the
+        // long note on `NotificationsService.notifyAddress` for why that is a
+        // second way of BUILDING a recipient rather than a bypass of the
+        // preference gate, and why it still resolves the address to an account
+        // when one happens to exist (an admin CAN allowlist an address that
+        // already has a user — the initial admin bypasses this list entirely, and
+        // entries can be removed and re-added).
+        //
+        // AFTER THE ENTRY IS COMMITTED, AND AFTER THE AUDIT ROW. Sending first
+        // would mail somebody an invitation to sign in with an address the
+        // database does not yet allow — the login would be refused and the
+        // recipient would have no way to understand why. The insert above is a
+        // plain, already-committed write, so by the time this line runs the
+        // permission is real.
+        //
+        // FAILURE IS CONTAINED: `notifyAddress` never rejects and never joins a
+        // transaction, so a mail outage cannot fail or roll back the allowlist
+        // entry. The admin's POST succeeds and the failed send is a
+        // `notification_deliveries` row with the provider's error.
+        const signInUrl = this.signInUrl();
+        // Optional fields are SPREAD IN CONDITIONALLY rather than assigned
+        // `undefined`, matching the convention the notification channels already
+        // use: an absent key and a key holding `undefined` render identically
+        // today, but only the former survives being serialised, logged or
+        // compared, and only the former stays correct if
+        // `exactOptionalPropertyTypes` is ever turned on.
+        const payload = {
+            recipientEmail: email,
+            // `addedBy` came free with the `include` on the create above — no extra
+            // query. Optional because `added_by_id` is nullable (`onDelete:
+            // SetNull`), so an entry outlives the admin who created it.
+            ...(entry.addedBy?.email ? { invitedBy: entry.addedBy.email } : {}),
+            ...(signInUrl ? { signInUrl } : {}),
+        };
+        // `dto.notes` IS DELIBERATELY NOT IN THE PAYLOAD. It is an administrator's
+        // private annotation about this person ("contractor, ends in March"),
+        // written with no expectation that they will read it. Omitting it at the
+        // call site rather than in the template means no future edit to the copy
+        // can surface it.
+        await this.notifications.allowlistInvitation(email, payload);
+        return entry;
+    }
+    /**
+     * Remove email from allowlist
+     */
+    async removeEmail(id, adminUserId) {
+        // Find entry
+        const entry = await this.prisma.allowedEmail.findUnique({
+            where: { id },
+        });
+        if (!entry) {
+            throw new common_1.NotFoundException(`Allowlist entry with ID ${id} not found`);
+        }
+        // Check if claimed
+        if (entry.claimedById) {
+            throw new common_1.BadRequestException('Cannot remove allowlist entry that has been claimed by a user');
+        }
+        // Delete entry
+        await this.prisma.allowedEmail.delete({
+            where: { id },
+        });
+        // Create audit event
+        await this.createAuditEvent(adminUserId, 'allowlist:remove', 'allowed_email', id, { email: entry.email });
+        this.logger.log(`Email ${entry.email} removed from allowlist by admin ${adminUserId}`);
+    }
+    /**
+     * Check if email is in allowlist
+     */
+    async isEmailAllowed(email) {
+        const normalizedEmail = email.toLowerCase();
+        const entry = await this.prisma.allowedEmail.findUnique({
+            where: { email: normalizedEmail },
+        });
+        return entry !== null;
+    }
+    /**
+     * Mark email as claimed by a user
+     */
+    async markEmailClaimed(email, userId) {
+        const normalizedEmail = email.toLowerCase();
+        // Find entry
+        const entry = await this.prisma.allowedEmail.findUnique({
+            where: { email: normalizedEmail },
+        });
+        // If entry doesn't exist or already claimed, do nothing (idempotent)
+        if (!entry || entry.claimedById) {
+            return;
+        }
+        // Update entry
+        await this.prisma.allowedEmail.update({
+            where: { id: entry.id },
+            data: {
+                claimedById: userId,
+                claimedAt: new Date(),
+            },
+        });
+        this.logger.log(`Email ${normalizedEmail} claimed by user ${userId}`);
+    }
+    /**
+     * Absolute URL of the sign-in page, for the invitation's CTA.
+     *
+     * Built here rather than in the template, which is a pure function of its
+     * input and has no business reading configuration or knowing the web app's
+     * route table. `undefined` when `APP_URL` is unset — the layout then omits
+     * the button rather than rendering one that goes nowhere.
+     */
+    signInUrl() {
+        const appUrl = this.config.get('appUrl');
+        return appUrl ? `${appUrl.replace(/\/+$/, '')}/login` : undefined;
+    }
+    /**
+     * Create audit event
+     */
+    async createAuditEvent(actorUserId, action, targetType, targetId, meta) {
+        await this.prisma.auditEvent.create({
+            data: {
+                actorUserId,
+                action,
+                targetType,
+                targetId,
+                meta: meta,
+            },
+        });
+    }
+};
+exports.AllowlistService = AllowlistService;
+exports.AllowlistService = AllowlistService = AllowlistService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_1.PLATFORM_PRISMA)),
+    __param(1, (0, common_1.Inject)(ports_1.IDENTITY_NOTIFIER)),
+    __metadata("design:paramtypes", [Object, Object, config_1.ConfigService])
+], AllowlistService);
+//# sourceMappingURL=allowlist.service.js.map

package/dist/identity/allowlist/allowlist.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.service.js","sourceRoot":"","sources":["../../../src/identity/allowlist/allowlist.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAKoD;AACpD,2CAA+C;AAC/C,4CAAmD;AAKnD,oCAAoG;AAEpG;;;;GAIG;AAEI,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAIiB;IACE;IAC3B;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;IAE5D,YAC4C,MAAsB,EACpB,aAA+B,EAC1D,MAAqB;QAFI,WAAM,GAAN,MAAM,CAAgB;QACpB,kBAAa,GAAb,aAAa,CAAkB;QAC1D,WAAM,GAAN,MAAM,CAAe;IACrC,CAAC;IAEJ;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAwB;QAC9C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QACpE,MAAM,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;QAEnC,qBAAqB;QACrB,MAAM,KAAK,GAAQ,EAAE,CAAC;QAEtB,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,CAAC,KAAK,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QAC3B,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,KAAK,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACpC,CAAC;QAED,gBAAgB;QAChB,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC;gBAChC,KAAK;gBACL,IAAI;gBACJ,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE;gBAChC,OAAO,EAAE;oBACP,OAAO,EAAE;wBACP,MAAM,EAAE;4BACN,EAAE,EAAE,IAAI;4BACR,KAAK,EAAE,IAAI;yBACZ;qBACF;oBACD,SAAS,EAAE;wBACT,MAAM,EAAE;4BACN,EAAE,EAAE,IAAI;4BACR,KAAK,EAAE,IAAI;yBACZ;qBACF;iBACF;aACF,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C,CAAC,CAAC;QAEH,OAAO;YACL,KAAK;YACL,KAAK;YACL,IAAI;YACJ,QAAQ;YACR,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,GAAgB,EAAE,WAAmB;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAEtC,uBAAuB;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC;YACzD,KAAK,EAAE,EAAE,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,0BAAiB,CACzB,SAAS,KAAK,8BAA8B,CAC7C,CAAC;QACJ,CAAC;QAED,eAAe;QACf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAEjD;YACA,IAAI,EAAE;gBACJ,KAAK;gBACL,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,SAAS,EAAE,WAAW;aACvB;YACD,OAAO,EAAE;gBACP,OAAO,EAAE;oBACP,MAAM,EAAE;wBACN,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,IAAI;qBACZ;iBACF;aACF;SACF,CAAC,CAAC;QAEH,qBAAqB;QACrB,MAAM,IAAI,CAAC,gBAAgB,CACzB,WAAW,EACX,eAAe,EACf,eAAe,EACf,KAAK,CAAC,EAAE,EACR,EAAE,KAAK,EAAE,CACV,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,gCAAgC,WAAW,EAAE,CAAC,CAAC;QAE7E,4EAA4E;QAC5E,oDAAoD;QACpD,4EAA4E;QAC5E,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,EAAE;QACF,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,iEAAiE;QACjE,uEAAuE;QACvE,oEAAoE;QACpE,0EAA0E;QAC1E,wCAAwC;QACxC,EAAE;QACF,uEAAuE;QACvE,mEAAmE;QACnE,mEAAmE;QACnE,uEAAuE;QACvE,oEAAoE;QACpE,sBAAsB;QACtB,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,4DAA4D;QAC5D,2DAA2D;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAEnC,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,kEAAkE;QAClE,iDAAiD;QACjD,kDAAkD;QAClD,MAAM,OAAO,GAA8B;YACzC,cAAc,EAAE,KAAK;YACrB,wEAAwE;YACxE,gEAAgE;YAChE,4DAA4D;YAC5D,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC;QAEF,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,kBAAkB;QAClB,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,WAAmB;QAC/C,aAAa;QACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC;YACtD,KAAK,EAAE,EAAE,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,0BAAiB,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;QACzE,CAAC;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,4BAAmB,CAC3B,+DAA+D,CAChE,CAAC;QACJ,CAAC;QAED,eAAe;QACf,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,qBAAqB;QACrB,MAAM,IAAI,CAAC,gBAAgB,CACzB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,EAAE,EACF,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,SAAS,KAAK,CAAC,KAAK,oCAAoC,WAAW,EAAE,CACtE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC;YACtD,KAAK,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;SAClC,CAAC,CAAC;QAEH,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,MAAc;QAClD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAE5C,aAAa;QACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC;YACtD,KAAK,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;SAClC,CAAC,CAAC;QAEH,qEAAqE;QACrE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,eAAe;QACf,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;YACvB,IAAI,EAAE;gBACJ,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,eAAe,oBAAoB,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;OAOG;IACK,SAAS;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,QAAQ,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,WAAmB,EACnB,MAAc,EACd,UAAkB,EAClB,QAAgB,EAChB,IAA6B;QAE7B,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE;gBACJ,WAAW;gBACX,MAAM;gBACN,UAAU;gBACV,QAAQ;gBACR,IAAI,EAAE,IAAW;aAClB;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAtRY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;IACvB,WAAA,IAAA,eAAM,EAAC,yBAAiB,CAAC,CAAA;qDACD,sBAAa;GAN7B,gBAAgB,CAsR5B"}

package/dist/identity/allowlist/dto/add-email.dto.d.ts

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+export declare const addEmailSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    notes: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const AddEmailDto_base: import("nestjs-zod").ZodDto<z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    notes: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, false>;
+export declare class AddEmailDto extends AddEmailDto_base {
+}
+export {};
+//# sourceMappingURL=add-email.dto.d.ts.map

package/dist/identity/allowlist/dto/add-email.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-email.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/allowlist/dto/add-email.dto.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,cAAc;;;iBAMzB,CAAC;;;;;AAEH,qBAAa,WAAY,SAAQ,gBAA4B;CAAG"}

package/dist/identity/allowlist/dto/add-email.dto.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AddEmailDto = exports.addEmailSchema = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const zod_1 = require("zod");
+exports.addEmailSchema = zod_1.z.object({
+    email: zod_1.z
+        .string()
+        .email('Invalid email format')
+        .transform((email) => email.toLowerCase()),
+    notes: zod_1.z.string().max(500, 'Notes must be 500 characters or less').optional(),
+});
+class AddEmailDto extends (0, nestjs_zod_1.createZodDto)(exports.addEmailSchema) {
+}
+exports.AddEmailDto = AddEmailDto;
+//# sourceMappingURL=add-email.dto.js.map

package/dist/identity/allowlist/dto/add-email.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-email.dto.js","sourceRoot":"","sources":["../../../../src/identity/allowlist/dto/add-email.dto.ts"],"names":[],"mappings":";;;AAAA,2CAA0C;AAC1C,6BAAwB;AAEX,QAAA,cAAc,GAAG,OAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,OAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,sBAAsB,CAAC;SAC7B,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IAC5C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC,QAAQ,EAAE;CAC9E,CAAC,CAAC;AAEH,MAAa,WAAY,SAAQ,IAAA,yBAAY,EAAC,sBAAc,CAAC;CAAG;AAAhE,kCAAgE"}

package/dist/identity/allowlist/dto/allowlist-query.dto.d.ts

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+export declare const allowlistQuerySchema: z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    search: z.ZodOptional<z.ZodString>;
+    status: z.ZodDefault<z.ZodEnum<{
+        pending: "pending";
+        all: "all";
+        claimed: "claimed";
+    }>>;
+    sortBy: z.ZodDefault<z.ZodEnum<{
+        email: "email";
+        addedAt: "addedAt";
+        claimedAt: "claimedAt";
+    }>>;
+    sortOrder: z.ZodDefault<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+}, z.core.$strip>;
+declare const AllowlistQueryDto_base: import("nestjs-zod").ZodDto<z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    search: z.ZodOptional<z.ZodString>;
+    status: z.ZodDefault<z.ZodEnum<{
+        pending: "pending";
+        all: "all";
+        claimed: "claimed";
+    }>>;
+    sortBy: z.ZodDefault<z.ZodEnum<{
+        email: "email";
+        addedAt: "addedAt";
+        claimedAt: "claimedAt";
+    }>>;
+    sortOrder: z.ZodDefault<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+}, z.core.$strip>, false>;
+export declare class AllowlistQueryDto extends AllowlistQueryDto_base {
+}
+export {};
+//# sourceMappingURL=allowlist-query.dto.d.ts.map

package/dist/identity/allowlist/dto/allowlist-query.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist-query.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/allowlist/dto/allowlist-query.dto.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;iBAO/B,CAAC;;;;;;;;;;;;;;;;;;;;AAEH,qBAAa,iBAAkB,SAAQ,sBAAkC;CAAG"}

package/dist/identity/allowlist/dto/allowlist-query.dto.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AllowlistQueryDto = exports.allowlistQuerySchema = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const zod_1 = require("zod");
+exports.allowlistQuerySchema = zod_1.z.object({
+    page: zod_1.z.coerce.number().int().min(1).default(1),
+    pageSize: zod_1.z.coerce.number().int().min(1).max(100).default(20),
+    search: zod_1.z.string().optional(),
+    status: zod_1.z.enum(['all', 'pending', 'claimed']).default('all'),
+    sortBy: zod_1.z.enum(['email', 'addedAt', 'claimedAt']).default('addedAt'),
+    sortOrder: zod_1.z.enum(['asc', 'desc']).default('desc'),
+});
+class AllowlistQueryDto extends (0, nestjs_zod_1.createZodDto)(exports.allowlistQuerySchema) {
+}
+exports.AllowlistQueryDto = AllowlistQueryDto;
+//# sourceMappingURL=allowlist-query.dto.js.map

package/dist/identity/allowlist/dto/allowlist-query.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist-query.dto.js","sourceRoot":"","sources":["../../../../src/identity/allowlist/dto/allowlist-query.dto.ts"],"names":[],"mappings":";;;AAAA,2CAA0C;AAC1C,6BAAwB;AAEX,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5D,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACpE,SAAS,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACnD,CAAC,CAAC;AAEH,MAAa,iBAAkB,SAAQ,IAAA,yBAAY,EAAC,4BAAoB,CAAC;CAAG;AAA5E,8CAA4E"}

package/dist/identity/allowlist/dto/allowlist-response.dto.d.ts

@@ -0,0 +1,39 @@
+import { z } from 'zod';
+export declare const allowlistEntrySchema: z.ZodObject<{
+    id: z.ZodUUID;
+    email: z.ZodEmail;
+    addedById: z.ZodNullable<z.ZodUUID>;
+    addedAt: z.ZodISODateTime;
+    claimedById: z.ZodNullable<z.ZodUUID>;
+    claimedAt: z.ZodNullable<z.ZodISODateTime>;
+    notes: z.ZodNullable<z.ZodString>;
+    addedBy: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodEmail;
+    }, z.core.$strip>>;
+    claimedBy: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodEmail;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+declare const AllowlistEntryDto_base: import("nestjs-zod").ZodDto<z.ZodObject<{
+    id: z.ZodUUID;
+    email: z.ZodEmail;
+    addedById: z.ZodNullable<z.ZodUUID>;
+    addedAt: z.ZodISODateTime;
+    claimedById: z.ZodNullable<z.ZodUUID>;
+    claimedAt: z.ZodNullable<z.ZodISODateTime>;
+    notes: z.ZodNullable<z.ZodString>;
+    addedBy: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodEmail;
+    }, z.core.$strip>>;
+    claimedBy: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodEmail;
+    }, z.core.$strip>>;
+}, z.core.$strip>, false>;
+export declare class AllowlistEntryDto extends AllowlistEntryDto_base {
+}
+export {};
+//# sourceMappingURL=allowlist-response.dto.d.ts.map

package/dist/identity/allowlist/dto/allowlist-response.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist-response.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/allowlist/dto/allowlist-response.dto.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;iBAW/B,CAAC;;;;;;;;;;;;;;;;;;AAEH,qBAAa,iBAAkB,SAAQ,sBAAkC;CAAG"}

package/dist/identity/allowlist/dto/allowlist-response.dto.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AllowlistEntryDto = exports.allowlistEntrySchema = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const zod_1 = require("zod");
+/**
+ * One allowlist entry as `AllowlistService` returns it: the `allowed_emails`
+ * row plus the two user relations it `include`s, each narrowed to `{ id, email }`.
+ *
+ * Written to match that query, not the Prisma model — the model has more
+ * columns on the relations, and documenting those would describe a payload this
+ * endpoint does not send.
+ */
+const allowlistActorSchema = zod_1.z.object({
+    id: zod_1.z.uuid(),
+    email: zod_1.z.email(),
+});
+exports.allowlistEntrySchema = zod_1.z.object({
+    id: zod_1.z.uuid(),
+    email: zod_1.z.email(),
+    addedById: zod_1.z.uuid().nullable(),
+    addedAt: zod_1.z.iso.datetime(),
+    /** Set once the invited address completes its first sign-in. */
+    claimedById: zod_1.z.uuid().nullable(),
+    claimedAt: zod_1.z.iso.datetime().nullable(),
+    notes: zod_1.z.string().nullable(),
+    addedBy: allowlistActorSchema.nullable(),
+    claimedBy: allowlistActorSchema.nullable(),
+});
+class AllowlistEntryDto extends (0, nestjs_zod_1.createZodDto)(exports.allowlistEntrySchema) {
+}
+exports.AllowlistEntryDto = AllowlistEntryDto;
+//# sourceMappingURL=allowlist-response.dto.js.map

package/dist/identity/allowlist/dto/allowlist-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist-response.dto.js","sourceRoot":"","sources":["../../../../src/identity/allowlist/dto/allowlist-response.dto.ts"],"names":[],"mappings":";;;AAAA,2CAA0C;AAC1C,6BAAwB;AAExB;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,OAAC,CAAC,IAAI,EAAE;IACZ,KAAK,EAAE,OAAC,CAAC,KAAK,EAAE;CACjB,CAAC,CAAC;AAEU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,EAAE,EAAE,OAAC,CAAC,IAAI,EAAE;IACZ,KAAK,EAAE,OAAC,CAAC,KAAK,EAAE;IAChB,SAAS,EAAE,OAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,OAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IACzB,gEAAgE;IAChE,WAAW,EAAE,OAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,OAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAa,iBAAkB,SAAQ,IAAA,yBAAY,EAAC,4BAAoB,CAAC;CAAG;AAA5E,8CAA4E"}

package/dist/identity/auth/admin-bootstrap.service.d.ts

@@ -0,0 +1,35 @@
+import { OnModuleInit } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import type { IdentityPrisma } from '../ports';
+import { PrincipalCache } from './principal-cache/principal-cache.service';
+import { type ResolvedIdentityModuleOptions } from '../identity.options';
+/**
+ * Exported for the reference app's wiring and tests; not a stable extension point (reach identity through IdentityModule and its documented seams).
+ *
+ * @internal
+ */
+export declare class AdminBootstrapService implements OnModuleInit {
+    private readonly prisma;
+    private readonly config;
+    private readonly principalCache;
+    private readonly identityOptions;
+    private readonly logger;
+    constructor(prisma: IdentityPrisma, config: ConfigService, principalCache: PrincipalCache, identityOptions?: ResolvedIdentityModuleOptions);
+    onModuleInit(): Promise<void>;
+    /**
+     * Ensures the initial admin email (from env) has admin role assigned
+     * when they first log in. This is handled during OAuth callback.
+     */
+    private ensureInitialAdminRole;
+    /**
+     * Called during OAuth callback to check if user should be granted admin
+     */
+    shouldGrantAdminRole(email: string): Promise<boolean>;
+    /**
+     * Assigns the system admin role to a user, and `org_admin` on their
+     * default-organization membership (PP-6.3, #723: an administrator holds
+     * both, as the initial administrator does).
+     */
+    assignAdminRole(userId: string): Promise<void>;
+}
+//# sourceMappingURL=admin-bootstrap.service.d.ts.map

package/dist/identity/auth/admin-bootstrap.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-bootstrap.service.d.ts","sourceRoot":"","sources":["../../../src/identity/auth/admin-bootstrap.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,YAAY,EAAY,MAAM,gBAAgB,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAE3E,OAAO,EAA8C,KAAK,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAErH;;;;GAIG;AACH,qBACa,qBAAsB,YAAW,YAAY;IAI7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,eAAe;IARlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAGrB,MAAM,EAAE,cAAc,EAC/C,MAAM,EAAE,aAAa,EAErB,cAAc,EAAE,cAAc,EAE9B,eAAe,GAAE,6BAAwD;IAGtF,YAAY;IAUlB;;;OAGG;YACW,sBAAsB;IAepC;;OAEG;IACG,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoC3D;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoCrD"}

package/dist/identity/auth/admin-bootstrap.service.js

@@ -0,0 +1,138 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AdminBootstrapService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminBootstrapService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const index_1 = require("../../core/index");
+const principal_cache_service_1 = require("./principal-cache/principal-cache.service");
+const identity_constants_1 = require("../identity.constants");
+const identity_options_1 = require("../identity.options");
+/**
+ * Exported for the reference app's wiring and tests; not a stable extension point (reach identity through IdentityModule and its documented seams).
+ *
+ * @internal
+ */
+let AdminBootstrapService = AdminBootstrapService_1 = class AdminBootstrapService {
+    prisma;
+    config;
+    principalCache;
+    identityOptions;
+    logger = new common_1.Logger(AdminBootstrapService_1.name);
+    constructor(prisma, config, 
+    // PP-1.12 (#683): `assignAdminRole` changes what the user's JWT resolves to.
+    principalCache, identityOptions = identity_options_1.DEFAULT_IDENTITY_OPTIONS) {
+        this.prisma = prisma;
+        this.config = config;
+        this.principalCache = principalCache;
+        this.identityOptions = identityOptions;
+    }
+    async onModuleInit() {
+        // Only run in development or when explicitly enabled
+        if (this.config.get('NODE_ENV') === 'production') {
+            this.logger.log('Admin bootstrap disabled in production');
+            return;
+        }
+        await this.ensureInitialAdminRole();
+    }
+    /**
+     * Ensures the initial admin email (from env) has admin role assigned
+     * when they first log in. This is handled during OAuth callback.
+     */
+    async ensureInitialAdminRole() {
+        const initialAdminEmail = this.config.get(this.identityOptions.initialAdminEmailEnv);
+        if (!initialAdminEmail) {
+            this.logger.warn(`${this.identityOptions.initialAdminEmailEnv} not set - no admin will be auto-assigned`);
+            return;
+        }
+        this.logger.log(`Admin bootstrap configured for: ${initialAdminEmail}`);
+    }
+    /**
+     * Called during OAuth callback to check if user should be granted admin
+     */
+    async shouldGrantAdminRole(email) {
+        const initialAdminEmail = this.config.get(this.identityOptions.initialAdminEmailEnv);
+        if (!initialAdminEmail) {
+            return false;
+        }
+        // Check if any admin already exists
+        const adminRole = await this.prisma.role.findUnique({
+            where: { name: 'admin' },
+            include: {
+                userRoles: {
+                    include: { user: true },
+                },
+            },
+        });
+        if (!adminRole) {
+            return false;
+        }
+        const existingAdmins = adminRole.userRoles.filter((ur) => ur.user.isActive);
+        // Only grant admin if:
+        // 1. Email matches INITIAL_ADMIN_EMAIL
+        // 2. No other active admins exist
+        if (existingAdmins.length === 0 && email === initialAdminEmail) {
+            this.logger.log(`Granting admin role to initial admin: ${email}`);
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Assigns the system admin role to a user, and `org_admin` on their
+     * default-organization membership (PP-6.3, #723: an administrator holds
+     * both, as the initial administrator does).
+     */
+    async assignAdminRole(userId) {
+        const adminRole = await this.prisma.role.findUnique({
+            where: { name: identity_constants_1.ROLES.ADMIN },
+        });
+        const orgAdminRole = await this.prisma.role.findUnique({
+            where: { name: identity_constants_1.ORG_ADMIN_ROLE },
+        });
+        if (!adminRole || !orgAdminRole) {
+            throw new Error('Admin role not found - run seeds first');
+        }
+        await this.prisma.membership.updateMany({
+            where: { userId, org: { isDefault: true } },
+            data: { roleId: orgAdminRole.id },
+        });
+        await this.prisma.userRole.upsert({
+            where: {
+                userId_roleId: {
+                    userId,
+                    roleId: adminRole.id,
+                },
+            },
+            update: {},
+            create: {
+                userId,
+                roleId: adminRole.id,
+            },
+        });
+        // Principal cache (PP-1.12, #683): the grant reaches the next request.
+        this.principalCache.invalidate({ userId });
+        this.logger.log(`Admin role assigned to user: ${userId}`);
+    }
+};
+exports.AdminBootstrapService = AdminBootstrapService;
+exports.AdminBootstrapService = AdminBootstrapService = AdminBootstrapService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_1.PLATFORM_PRISMA)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(identity_options_1.IDENTITY_OPTIONS)),
+    __metadata("design:paramtypes", [Object, config_1.ConfigService,
+        principal_cache_service_1.PrincipalCache, Object])
+], AdminBootstrapService);
+//# sourceMappingURL=admin-bootstrap.service.js.map

package/dist/identity/auth/admin-bootstrap.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-bootstrap.service.js","sourceRoot":"","sources":["../../../src/identity/auth/admin-bootstrap.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAoF;AACpF,2CAA+C;AAC/C,4CAAmD;AAEnD,uFAA2E;AAC3E,8DAA8D;AAC9D,0DAAqH;AAErH;;;;GAIG;AAEI,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAIY;IACzB;IAEA;IAEA;IARF,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAEjE,YAC4C,MAAsB,EAC/C,MAAqB;IACtC,6EAA6E;IAC5D,cAA8B,EAE9B,kBAAiD,2CAAwB;QALhD,WAAM,GAAN,MAAM,CAAgB;QAC/C,WAAM,GAAN,MAAM,CAAe;QAErB,mBAAc,GAAd,cAAc,CAAgB;QAE9B,oBAAe,GAAf,eAAe,CAA0D;IACzF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,qDAAqD;QACrD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;IACtC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB;QAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC;QAE7F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,IAAI,CAAC,eAAe,CAAC,oBAAoB,2CAA2C,CACxF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,mCAAmC,iBAAiB,EAAE,CACvD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAAa;QACtC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC;QAE7F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,oCAAoC;QACpC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAwD;YACzG,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACxB,OAAO,EAAE;gBACP,SAAS,EAAE;oBACT,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;iBACxB;aACF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,cAAc,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAC/C,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CACzB,CAAC;QAEF,uBAAuB;QACvB,uCAAuC;QACvC,kCAAkC;QAClC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YAClD,KAAK,EAAE,EAAE,IAAI,EAAE,0BAAK,CAAC,KAAK,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACrD,KAAK,EAAE,EAAE,IAAI,EAAE,mCAAc,EAAE;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;YACtC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YAC3C,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE;SAClC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChC,KAAK,EAAE;gBACL,aAAa,EAAE;oBACb,MAAM;oBACN,MAAM,EAAE,SAAS,CAAC,EAAE;iBACrB;aACF;YACD,MAAM,EAAE,EAAE;YACV,MAAM,EAAE;gBACN,MAAM;gBACN,MAAM,EAAE,SAAS,CAAC,EAAE;aACrB;SACF,CAAC,CAAC;QAEH,uEAAuE;QACvE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAE3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;CACF,CAAA;AAzHY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;IAIvB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,mCAAgB,CAAC,CAAA;6CAHZ,sBAAa;QAEL,wCAAc;GAPtC,qBAAqB,CAyHjC"}