@molecule/api-resource-user 1.0.0

package/dist/index.js

@@ -0,0 +1,88 @@
+/**
+ * The `user` resource types, schema, and definition.
+ *
+ * @remarks
+ * The user record is split across TWO schemas — pick the right one or you leak credentials:
+ * - **{@link Props} (`propsSchema`)** — SAFE, client-facing fields (username, name, email,
+ *   `emailVerified`, `twoFactorEnabled`, plan). This is what handlers return and what lives
+ *   in the `users` table.
+ * - **{@link SecretProps} (`secretPropsSchema`)** — SERVER-ONLY secrets: `passwordHash`, the
+ *   TOTP `twoFactorSecret` (and its pending-setup value). Stored in a SEPARATE secrets table
+ *   and NEVER serialized to the client. Note the pair `twoFactorEnabled` (safe boolean, in
+ *   `Props`) vs `twoFactorSecret` (secret, in `SecretProps`).
+ *
+ * When you extend the user, put a secret (token, hash, key, provider refresh token) in
+ * `SecretProps`; put a display field in `Props`. **Never add a secret to `Props`, never
+ * return a secrets-table value in a response or log, and never `res.json(userRow)` a raw DB
+ * row** — return `Props`.
+ *
+ * Auth is ALREADY wired globally (the router's `verifyMiddleware` → `res.locals.session`),
+ * so a handler reads the current user with `getUserId(res)` and does NOT add per-route auth
+ * middleware (see the `auth` skill). Scope every custom user query by the authenticated id.
+ *
+ * On the CLIENT, the bearer token is held IN MEMORY only — a `localStorage` copy is
+ * XSS-exfiltratable and is forbidden. The session is restored after a reload via the
+ * httpOnly cookie + `GET /users/me`; don't persist the token yourself.
+ *
+ * **Client-facing endpoints** (mounted under the app's `/api` prefix → `/api/users/...`).
+ * The auth CLIENT (`useAuth()` → `login` / `register` / `logout` / `refresh`) already wraps
+ * login / signup / logout — do NOT hand-roll those against the raw routes. The rest have NO
+ * client method; call them with raw `http.*`. Use these EXACT paths — a weak model guesses
+ * `/api/auth/*` or `/api/user` (singular), and neither exists:
+ * - `POST   /api/users/forgot-password` — request a reset email (body `{ email }`)
+ * - `POST   /api/users/reset-password` — confirm with the emailed token (body `{ token, password }`)
+ * - `PATCH  /api/users/:id` — update profile fields (name, username, email, bio); NOT `PUT /api/user`
+ * - `PATCH  /api/users/:id/password` — change password · `DELETE /api/users/:id` — delete account
+ * - `PATCH  /api/users/:id/plan` — update the subscription plan
+ * - `GET    /api/users/me` — the current user (session restore) · `GET /api/users/:id` — read one
+ * The full, authoritative route list is the `routes` export (see `routes.ts`).
+ *
+ * @example
+ * ```ts
+ * // Extend safely: a display field in Props, a secret in SecretProps.
+ * //   propsSchema:       { …, timezone: z.string().optional() }           // safe → client
+ * //   secretPropsSchema: { …, passwordResetToken: z.string().optional() } // server-only, secrets table
+ *
+ * // A custom handler returns SAFE props — never the secrets row.
+ * router.get('/me/timezone', async (req, res) => {
+ *   const userId = getUserId(res)
+ *   if (!userId) return res.status(401).json({ error: 'Authentication required.' })
+ *   const user = await findById('users', userId) // the users table holds Props only
+ *   res.json({ timezone: user?.timezone })        // never spread a secrets-table row here
+ * })
+ * ```
+ *
+ * @e2e
+ * Integration checklist — drive the real UI (live preview, no mocks), adapt
+ * each item to this app's actual screens/flows, and check every box off one
+ * by one. A box you can't check is an integration bug to fix — not a skip:
+ * - [ ] A new user can sign up with email + password and lands authenticated (the
+ *   UI reflects the signed-in user, e.g. their name/menu appears).
+ * - [ ] Any flow that emails a link/code (signup verification, password reset)
+ *   round-trips: the sandbox CAPTURES the message instead of sending — read it
+ *   with the `read_activity` tool (filter type 'email') and follow the link/code
+ *   in its payload; never mock the flow or modify production code to expose it.
+ * - [ ] Logging out and logging back in with the same credentials reaches the same
+ *   account and its data.
+ * - [ ] The session survives a full page reload (restored via the httpOnly cookie +
+ *   `GET /users/me` — never from a token persisted in localStorage).
+ * - [ ] A wrong password shows a visible error and does NOT authenticate.
+ * - [ ] Authenticated-only screens are unreachable when logged out (redirect to
+ *   login or an explicit denial — never a blank page).
+ * - [ ] A profile/account edit (e.g. display name) persists across a reload.
+ *
+ * @module
+ */
+export * as authorization from './authorization.js';
+export * as authorizers from './authorizers/index.js';
+export * from './browser-guard.js';
+export * as handlers from './handlers/index.js';
+export * from './i18n.js';
+export * from './requestHandlerMap.js';
+export * from './resource.js';
+export * from './routes.js';
+export * from './schema.js';
+export * from './secrets.js';
+export * as types from './types.js';
+export * as utilities from './utilities/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAA;AACrD,cAAc,oBAAoB,CAAA;AAClC,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,cAAc,WAAW,CAAA;AACzB,cAAc,wBAAwB,CAAA;AACtC,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA"}

package/dist/requestHandlerMap.d.ts

@@ -0,0 +1,44 @@
+import type { createRequestHandler as CreateRequestHandler, MoleculeRequestHandler } from '@molecule/api-resource';
+type RequestHandlerCreator = typeof CreateRequestHandler;
+/**
+ * Shape of the user request-handler map produced by `createRequestHandlerMap`.
+ * Names match the route definitions in `routes.ts`. Exported so helpers that
+ * accept the map (e.g. `mountDefaultUserAuthRoutes`, `mountDefaultUserCrudRoutes`)
+ * can type their parameter precisely instead of widening to
+ * `Record<string, MoleculeRequestHandler>`.
+ */
+export interface UserRequestHandlerMap {
+    auth: MoleculeRequestHandler;
+    authSelf: MoleculeRequestHandler;
+    rateLimitAuth: MoleculeRequestHandler;
+    rateLimitTwoFactor: MoleculeRequestHandler;
+    create: MoleculeRequestHandler;
+    logIn: MoleculeRequestHandler;
+    oauthAuthorize: MoleculeRequestHandler;
+    logInOAuth: MoleculeRequestHandler;
+    logout: MoleculeRequestHandler;
+    read: MoleculeRequestHandler;
+    readSelf: MoleculeRequestHandler;
+    update: MoleculeRequestHandler;
+    del: MoleculeRequestHandler;
+    updatePassword: MoleculeRequestHandler;
+    forgotPassword: MoleculeRequestHandler;
+    resetPassword: MoleculeRequestHandler;
+    verifyTwoFactor: MoleculeRequestHandler;
+    updatePlan: MoleculeRequestHandler;
+    verifyPayment: MoleculeRequestHandler;
+    handlePaymentNotification: MoleculeRequestHandler;
+    requireWebhookAuthenticity: MoleculeRequestHandler;
+}
+/**
+ * Creates the full request handler map for the User resource.
+ * Optional features (OAuth, payments) are conditionally included
+ * based on bonded providers.
+ *
+ * Handler names match the route definitions in routes.ts.
+ * @param createRequestHandler - Factory from `@molecule/api-resource` that wraps handler configs into Express middleware.
+ * @returns A `UserRequestHandlerMap` of handler names to Express middleware.
+ */
+export declare const createRequestHandlerMap: (createRequestHandler: RequestHandlerCreator) => UserRequestHandlerMap;
+export {};
+//# sourceMappingURL=requestHandlerMap.d.ts.map

package/dist/requestHandlerMap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestHandlerMap.d.ts","sourceRoot":"","sources":["../src/requestHandlerMap.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oBAAoB,IAAI,oBAAoB,EAC5C,sBAAsB,EACvB,MAAM,wBAAwB,CAAA;AAM/B,KAAK,qBAAqB,GAAG,OAAO,oBAAoB,CAAA;AAExD;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,sBAAsB,CAAA;IAChC,aAAa,EAAE,sBAAsB,CAAA;IACrC,kBAAkB,EAAE,sBAAsB,CAAA;IAC1C,MAAM,EAAE,sBAAsB,CAAA;IAC9B,KAAK,EAAE,sBAAsB,CAAA;IAC7B,cAAc,EAAE,sBAAsB,CAAA;IACtC,UAAU,EAAE,sBAAsB,CAAA;IAClC,MAAM,EAAE,sBAAsB,CAAA;IAC9B,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,sBAAsB,CAAA;IAChC,MAAM,EAAE,sBAAsB,CAAA;IAC9B,GAAG,EAAE,sBAAsB,CAAA;IAC3B,cAAc,EAAE,sBAAsB,CAAA;IACtC,cAAc,EAAE,sBAAsB,CAAA;IACtC,aAAa,EAAE,sBAAsB,CAAA;IACrC,eAAe,EAAE,sBAAsB,CAAA;IACvC,UAAU,EAAE,sBAAsB,CAAA;IAClC,aAAa,EAAE,sBAAsB,CAAA;IACrC,yBAAyB,EAAE,sBAAsB,CAAA;IACjD,0BAA0B,EAAE,sBAAsB,CAAA;CACnD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAClC,sBAAsB,qBAAqB,KAC1C,qBA0DF,CAAA"}

package/dist/requestHandlerMap.js

@@ -0,0 +1,68 @@
+import { getAll } from '@molecule/api-bond';
+import * as authorizers from './authorizers/index.js';
+import * as handlers from './handlers/index.js';
+import { resource } from './resource.js';
+/**
+ * Creates the full request handler map for the User resource.
+ * Optional features (OAuth, payments) are conditionally included
+ * based on bonded providers.
+ *
+ * Handler names match the route definitions in routes.ts.
+ * @param createRequestHandler - Factory from `@molecule/api-resource` that wraps handler configs into Express middleware.
+ * @returns A `UserRequestHandlerMap` of handler names to Express middleware.
+ */
+export const createRequestHandlerMap = (createRequestHandler) => {
+    const map = {
+        // Authorizers
+        auth: authorizers.auth(),
+        authSelf: authorizers.authSelf(),
+        // Default brute-force protection for the public/credential-bearing auth
+        // endpoints (login, oauth, forgot/reset-password). Keyed by IP and by the
+        // submitted account, with a low ceiling. No-ops (logs a warning) if no
+        // rate-limit provider is bonded, so apps that opt out still boot.
+        rateLimitAuth: authorizers.rateLimit({
+            scope: 'auth',
+            accountFrom: [authorizers.loginAccountKey, authorizers.emailAccountKey],
+        }),
+        // Stricter limiter for the authSelf-gated 2FA verification route — temp-locks
+        // the second factor per account after consecutive misses.
+        rateLimitTwoFactor: authorizers.rateLimit({
+            scope: '2fa',
+            max: 5,
+            accountFrom: [authorizers.paramIdAccountKey],
+        }),
+        // Authenticity guard for the public payment-notification (IAP S2S) route.
+        requireWebhookAuthenticity: authorizers.requireWebhookAuthenticity(),
+        // Core handlers
+        create: createRequestHandler(handlers.create(resource)),
+        logIn: createRequestHandler(handlers.logIn(resource)),
+        logout: createRequestHandler(handlers.logout()),
+        read: createRequestHandler(handlers.read(resource)),
+        readSelf: createRequestHandler(handlers.readSelf(resource)),
+        update: createRequestHandler(handlers.update(resource)),
+        del: createRequestHandler(handlers.del(resource)),
+        updatePassword: createRequestHandler(handlers.updatePassword(resource)),
+        forgotPassword: createRequestHandler(handlers.forgotPassword(resource)),
+        resetPassword: createRequestHandler(handlers.resetPassword(resource)),
+        verifyTwoFactor: createRequestHandler(handlers.verifyTwoFactor(resource)),
+        updatePlan: createRequestHandler(handlers.updatePlan(resource)),
+        // OAuth initiation + login — both check the bond registry at request
+        // time (a provider that isn't bonded yields a clean 404, so the mounts
+        // never crash when no oauth bond is wired).
+        oauthAuthorize: createRequestHandler(handlers.oauthAuthorize()),
+        logInOAuth: createRequestHandler(handlers.logInOAuth(resource)),
+        // Payment handlers — always registered so route mounts don't crash with
+        // "argument handler must be a function" when no payments bond is wired
+        // at module-init time. The handlers themselves check the bond registry
+        // at REQUEST time and respond with 503 if no provider is bonded for the
+        // requested :provider. Adding a new payment provider requires only a
+        // new bond package — no source changes here.
+        verifyPayment: createRequestHandler(handlers.verifyPayment(resource)),
+        handlePaymentNotification: createRequestHandler(handlers.handlePaymentNotification(resource)),
+    };
+    // Suppress unused-import warning while keeping the bond-registry import
+    // for future reuse (handlers themselves still consult `getAll<PaymentProvider>('payments')`).
+    void getAll;
+    return map;
+};
+//# sourceMappingURL=requestHandlerMap.js.map

package/dist/requestHandlerMap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestHandlerMap.js","sourceRoot":"","sources":["../src/requestHandlerMap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAO3C,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAA;AACrD,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAmCxC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,oBAA2C,EACpB,EAAE;IACzB,MAAM,GAAG,GAA0B;QACjC,cAAc;QACd,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE;QACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE;QAChC,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,kEAAkE;QAClE,aAAa,EAAE,WAAW,CAAC,SAAS,CAAC;YACnC,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,WAAW,CAAC,eAAe,CAAC;SACxE,CAAC;QACF,8EAA8E;QAC9E,0DAA0D;QAC1D,kBAAkB,EAAE,WAAW,CAAC,SAAS,CAAC;YACxC,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,CAAC;YACN,WAAW,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;SAC7C,CAAC;QACF,0EAA0E;QAC1E,0BAA0B,EAAE,WAAW,CAAC,0BAA0B,EAAE;QAEpE,gBAAgB;QAChB,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/C,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,GAAG,EAAE,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,cAAc,EAAE,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvE,cAAc,EAAE,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvE,aAAa,EAAE,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrE,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACzE,UAAU,EAAE,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE/D,qEAAqE;QACrE,uEAAuE;QACvE,4CAA4C;QAC5C,cAAc,EAAE,oBAAoB,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC/D,UAAU,EAAE,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE/D,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,6CAA6C;QAC7C,aAAa,EAAE,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrE,yBAAyB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;KAC9F,CAAA;IAED,wEAAwE;IACxE,8FAA8F;IAC9F,KAAK,MAAuB,CAAA;IAE5B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}

package/dist/resource.d.ts

@@ -0,0 +1,22 @@
+/**
+ * User resource definition.
+ *
+ * @module
+ */
+import type * as types from './types.js';
+/**
+ * Creates a user resource definition with optional OAuth servers and plan keys.
+ * @param options - Optional configuration.
+ * @param options.oauthServers - Tuple of allowed OAuth server names (e.g. `['google', 'github']`). Constrains the `oauthServer` schema field.
+ * @param options.planKeys - Tuple of allowed plan key strings (e.g. `['free', 'pro']`). Constrains the `planKey` schema field.
+ * @returns A `Resource` with name `'User'`, table `'users'`, and a Zod schema reflecting the options.
+ */
+export declare const createResource: <OAuthServers extends readonly [string, ...string[]] | undefined = undefined, PlanKeys extends readonly [string, ...string[]] | undefined = undefined>(options?: {
+    oauthServers?: OAuthServers;
+    planKeys?: PlanKeys;
+}) => types.Resource;
+/**
+ * Default user resource definition.
+ */
+export declare const resource: types.Resource;
+//# sourceMappingURL=resource.d.ts.map

package/dist/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GACzB,YAAY,SAAS,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,SAAS,GAAG,SAAS,EAC3E,QAAQ,SAAS,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,SAAS,GAAG,SAAS,EACvE,UAAU;IACV,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,EAAE,QAAQ,CAAA;CACpB,KAAG,KAAK,CAAC,QAIR,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,QAA2B,CAAA"}

package/dist/resource.js

@@ -0,0 +1,23 @@
+/**
+ * User resource definition.
+ *
+ * @module
+ */
+import { createSchema } from './schema.js';
+/**
+ * Creates a user resource definition with optional OAuth servers and plan keys.
+ * @param options - Optional configuration.
+ * @param options.oauthServers - Tuple of allowed OAuth server names (e.g. `['google', 'github']`). Constrains the `oauthServer` schema field.
+ * @param options.planKeys - Tuple of allowed plan key strings (e.g. `['free', 'pro']`). Constrains the `planKey` schema field.
+ * @returns A `Resource` with name `'User'`, table `'users'`, and a Zod schema reflecting the options.
+ */
+export const createResource = (options) => ({
+    name: `User`,
+    tableName: `users`,
+    schema: createSchema(options),
+});
+/**
+ * Default user resource definition.
+ */
+export const resource = createResource();
+//# sourceMappingURL=resource.js.map

package/dist/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAG5B,OAGD,EAAkB,EAAE,CAAC,CAAC;IACrB,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,OAAO;IAClB,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC;CAC9B,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAmB,cAAc,EAAE,CAAA"}

package/dist/routes.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Route definitions for the User resource.
+ * Routes marked optional require additional packages to be installed.
+ *
+ * Declarative route definitions used by the injection engine.
+ */
+export declare const routes: ({
+    method: "post";
+    path: string;
+    middlewares: string[];
+    handler: string;
+    optional?: undefined;
+} | {
+    method: "get";
+    path: string;
+    middlewares: string[];
+    handler: string;
+    optional: string;
+} | {
+    method: "post";
+    path: string;
+    middlewares: string[];
+    handler: string;
+    optional: string;
+} | {
+    method: "get";
+    path: string;
+    middlewares: string[];
+    handler: string;
+    optional?: undefined;
+} | {
+    method: "patch";
+    path: string;
+    middlewares: string[];
+    handler: string;
+    optional?: undefined;
+} | {
+    method: "delete";
+    path: string;
+    middlewares: string[];
+    handler: string;
+    optional?: undefined;
+})[];
+//# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsHlB,CAAA"}

package/dist/routes.js

@@ -0,0 +1,121 @@
+/**
+ * Route definitions for the User resource.
+ * Routes marked optional require additional packages to be installed.
+ *
+ * Declarative route definitions used by the injection engine.
+ */
+export const routes = [
+    // Auth
+    { method: 'post', path: '/users', middlewares: [], handler: 'create' },
+    {
+        method: 'post',
+        path: '/users/log-in',
+        middlewares: ['rateLimitAuth'],
+        handler: 'logIn',
+    },
+    // OAuth initiation — generates the CSRF state + PKCE verifier cookies and
+    // 302-redirects to the bonded provider's authorization URL. The first half
+    // of the flow whose second half is POST /users/log-in/oauth below; without
+    // it the state cookie logInOAuth requires is never set.
+    //
+    // rateLimitAuth: the GET has no body, so only the generous per-IP bucket
+    // applies (no per-account lockout risk) — it bounds cookie-mint/redirect
+    // flooding from a single source. A trip is a 429 JSON on a top-level
+    // navigation, which is acceptable for an abuse ceiling a legitimate user
+    // never reaches (a login is one GET + one POST against a 60/15min bucket).
+    {
+        method: 'get',
+        path: '/users/oauth/:provider',
+        middlewares: ['rateLimitAuth'],
+        handler: 'oauthAuthorize',
+        optional: 'oauth',
+    },
+    {
+        method: 'post',
+        path: '/users/log-in/oauth',
+        middlewares: ['rateLimitAuth'],
+        handler: 'logInOAuth',
+        optional: 'oauth',
+    },
+    // Logout — revoke the device + clear the credential cookies (token, sessionId,
+    // mol_auth hint). Cookie-authed (`auth`) — the session identifies the user; no
+    // `:id`. [M1-1] under the in-memory-token model logout MUST clear the httpOnly
+    // cookie, else cookie-restore re-logs-in on the next load.
+    { method: 'post', path: '/users/logout', middlewares: ['auth'], handler: 'logout' },
+    {
+        method: 'post',
+        path: '/users/forgot-password',
+        middlewares: ['rateLimitAuth'],
+        handler: 'forgotPassword',
+    },
+    {
+        method: 'post',
+        path: '/users/reset-password',
+        middlewares: ['rateLimitAuth'],
+        handler: 'resetPassword',
+    },
+    // Current user — session restore. MUST precede `/users/:id` so `me` isn't
+    // matched as an `:id`. Cookie-authed (`auth`, not `authSelf` — there is no
+    // `:id` to match); the app calls this on init to restore the session from the
+    // httpOnly cookie after a full page load ([M1-1] the bearer token is in-memory
+    // and lost on reload).
+    { method: 'get', path: '/users/me', middlewares: ['auth'], handler: 'readSelf' },
+    // User CRUD (requires auth)
+    { method: 'get', path: '/users/:id', middlewares: ['authSelf'], handler: 'read' },
+    { method: 'patch', path: '/users/:id', middlewares: ['authSelf'], handler: 'update' },
+    { method: 'delete', path: '/users/:id', middlewares: ['authSelf'], handler: 'del' },
+    // Password & 2FA
+    {
+        method: 'patch',
+        path: '/users/:id/password',
+        middlewares: ['authSelf'],
+        handler: 'updatePassword',
+    },
+    {
+        method: 'post',
+        path: '/users/:id/verify-two-factor',
+        middlewares: ['authSelf', 'rateLimitTwoFactor'],
+        handler: 'verifyTwoFactor',
+    },
+    // Plans
+    {
+        method: 'patch',
+        path: '/users/:id/plan',
+        middlewares: ['authSelf'],
+        handler: 'updatePlan',
+    },
+    // Payment verification — GET (redirect callbacks, e.g. Stripe Checkout). [M3-1]
+    // authSelf like the POST + molecule-dev's router: the plan is granted to `:id` and the
+    // handler echoes the user row, so an unauthenticated/cross-user GET must not reach it.
+    // The Stripe success_url is a top-level browser navigation carrying the session cookie,
+    // so authSelf does not break the legitimate redirect callback.
+    {
+        method: 'get',
+        path: '/users/:id/verify-payment/:provider',
+        middlewares: ['authSelf'],
+        handler: 'verifyPayment',
+        optional: 'payments',
+    },
+    // Payment verification — POST (mobile receipt verification). Requires the
+    // caller to be the user being credited (authSelf): the plan is granted to
+    // `:id`, so an unauthenticated/cross-user POST must never reach the handler.
+    {
+        method: 'post',
+        path: '/users/:id/verify-payment/:provider',
+        middlewares: ['authSelf'],
+        handler: 'verifyPayment',
+        optional: 'payments',
+    },
+    // Payment notifications (webhooks, S2S). The authenticity guard lets
+    // signature-verifying webhook providers (Stripe) through and requires a shared
+    // secret for unsigned server-to-server providers (Apple/Google) so the public
+    // endpoint is not open by default.
+    {
+        method: 'post',
+        path: '/users/payment-notification/:provider',
+        middlewares: ['requireWebhookAuthenticity'],
+        handler: 'handlePaymentNotification',
+        optional: 'payments',
+    },
+];
+//# sourceMappingURL=routes.js.map

package/dist/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,OAAO;IACP,EAAE,MAAM,EAAE,MAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC/E;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,OAAO;KACjB;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,wDAAwD;IACxD,EAAE;IACF,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E;QACE,MAAM,EAAE,KAAc;QACtB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,OAAO;KAClB;IACD;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,OAAO;KAClB;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,2DAA2D;IAC3D,EAAE,MAAM,EAAE,MAAe,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC5F;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,gBAAgB;KAC1B;IACD;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,OAAO,EAAE,eAAe;KACzB;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,uBAAuB;IACvB,EAAE,MAAM,EAAE,KAAc,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE;IAEzF,4BAA4B;IAC5B,EAAE,MAAM,EAAE,KAAc,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;IAC1F,EAAE,MAAM,EAAE,OAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC9F,EAAE,MAAM,EAAE,QAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;IAE5F,iBAAiB;IACjB;QACE,MAAM,EAAE,OAAgB;QACxB,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,gBAAgB;KAC1B;IACD;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,CAAC,UAAU,EAAE,oBAAoB,CAAC;QAC/C,OAAO,EAAE,iBAAiB;KAC3B;IAED,QAAQ;IACR;QACE,MAAM,EAAE,OAAgB;QACxB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,YAAY;KACtB;IAED,gFAAgF;IAChF,uFAAuF;IACvF,uFAAuF;IACvF,wFAAwF;IACxF,+DAA+D;IAC/D;QACE,MAAM,EAAE,KAAc;QACtB,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,UAAU;KACrB;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EAAE,CAAC,UAAU,CAAC;QACzB,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,UAAU;KACrB;IACD,qEAAqE;IACrE,+EAA+E;IAC/E,8EAA8E;IAC9E,mCAAmC;IACnC;QACE,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,uCAAuC;QAC7C,WAAW,EAAE,CAAC,4BAA4B,CAAC;QAC3C,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;KACrB;CACF,CAAA"}

package/dist/schema.d.ts

@@ -0,0 +1,193 @@
+/**
+ * User resource schema definitions using Zod.
+ *
+ * Types are automatically inferred from schemas using z.infer<>.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/**
+ * Maximum length (in characters) of a user's `bio`.
+ */
+export declare const MAX_BIO_LENGTH = 1000;
+/**
+ * Maximum length (in characters) of a user's `avatar`. Sized to permit a small
+ * inline data-URI (~256KB) without requiring an external upload/storage bond.
+ * Larger avatars must be hosted elsewhere and referenced by URL.
+ */
+export declare const MAX_AVATAR_LENGTH: number;
+/**
+ * Creates a full schema for user props.
+ *
+ * OAuth servers and plan keys can be constrained by passing them as options.
+ * @param options - Optional configuration.
+ * @param options.oauthServers - Tuple of allowed OAuth server names. Constrains `oauthServer` to a Zod enum.
+ * @param options.planKeys - Tuple of allowed plan key strings. Constrains `planKey` to a Zod enum.
+ * @returns A Zod object schema extending `basePropsSchema` with user-specific fields (username, email, OAuth, plan).
+ */
+export declare const createSchema: <OAuthServers extends readonly [string, ...string[]] | undefined = undefined, PlanKeys extends readonly [string, ...string[]] | undefined = undefined>(options?: {
+    oauthServers?: OAuthServers;
+    planKeys?: PlanKeys;
+}) => z.ZodObject<{
+    id: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    username: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    emailVerified: z.ZodOptional<z.ZodBoolean>;
+    avatar: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    bio: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    twoFactorEnabled: z.ZodOptional<z.ZodBoolean>;
+    oauthServer: z.ZodOptional<z.ZodString> | z.ZodOptional<z.ZodEnum<{ [k_1 in NonNullable<OAuthServers>[number]]: k_1; } extends infer T ? { [k in keyof T]: T[k]; } : never>>;
+    oauthId: z.ZodOptional<z.ZodString>;
+    oauthData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    planKey: z.ZodOptional<z.ZodString> | z.ZodOptional<z.ZodEnum<{ [k_3 in NonNullable<PlanKeys>[number]]: k_3; } extends infer T_1 ? { [k_2 in keyof T_1]: T_1[k_2]; } : never>>;
+    planExpiresAt: z.ZodOptional<z.ZodString>;
+    planAutoRenews: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+/**
+ * Default schema for user props.
+ */
+export declare const propsSchema: z.ZodObject<{
+    id: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    username: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    emailVerified: z.ZodOptional<z.ZodBoolean>;
+    avatar: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    bio: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    twoFactorEnabled: z.ZodOptional<z.ZodBoolean>;
+    oauthServer: z.ZodOptional<z.ZodString> | z.ZodOptional<z.ZodEnum<{}>>;
+    oauthId: z.ZodOptional<z.ZodString>;
+    oauthData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    planKey: z.ZodOptional<z.ZodString> | z.ZodOptional<z.ZodEnum<{}>>;
+    planExpiresAt: z.ZodOptional<z.ZodString>;
+    planAutoRenews: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+/**
+ * User props type inferred from schema.
+ */
+export type Props = z.infer<typeof propsSchema>;
+/**
+ * Secret properties stored in a separate table.
+ */
+export declare const secretPropsSchema: z.ZodObject<{
+    id: z.ZodString;
+    passwordHash: z.ZodOptional<z.ZodString>;
+    passwordResetToken: z.ZodOptional<z.ZodString>;
+    passwordResetTokenAt: z.ZodOptional<z.ZodString>;
+    pendingTwoFactorSecret: z.ZodOptional<z.ZodString>;
+    twoFactorSecret: z.ZodOptional<z.ZodString>;
+    lastTwoFactorTimeStep: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * Secret Props type.
+ */
+export type SecretProps = z.infer<typeof secretPropsSchema>;
+/**
+ * Schema for creating a user via password.
+ */
+export declare const createPropsSchema: z.ZodObject<{
+    username: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Create Props type.
+ */
+export type CreateProps = z.infer<typeof createPropsSchema>;
+/** Schema for creating secret props (password hash only). */
+export declare const createSecretPropsSchema: z.ZodObject<{
+    passwordHash: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Create Secret Props type.
+ */
+export type CreateSecretProps = z.infer<typeof createSecretPropsSchema>;
+/**
+ * Schema for creating a user via OAuth.
+ */
+export declare const createOAuthPropsSchema: z.ZodObject<{
+    username: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    emailVerified: z.ZodOptional<z.ZodBoolean>;
+    oauthServer: z.ZodOptional<z.ZodString> | z.ZodOptional<z.ZodEnum<{}>>;
+    oauthId: z.ZodOptional<z.ZodString>;
+    oauthData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+/**
+ * Create O Auth Props type.
+ */
+export type CreateOAuthProps = z.infer<typeof createOAuthPropsSchema>;
+/** Schema for updating a user (partial username, name, email, avatar, bio). */
+export declare const updatePropsSchema: z.ZodObject<{
+    username: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    name: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    email: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    avatar: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    bio: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+}, z.core.$strip>;
+/**
+ * Update Props type.
+ */
+export type UpdateProps = z.infer<typeof updatePropsSchema>;
+/** Schema for updating password secret props (partial password hash). */
+export declare const updatePasswordSecretPropsSchema: z.ZodObject<{
+    passwordHash: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Update Password Secret Props type.
+ */
+export type UpdatePasswordSecretProps = z.infer<typeof updatePasswordSecretPropsSchema>;
+/** Schema for updating a user's plan (partial planKey, planExpiresAt, planAutoRenews). */
+export declare const updatePlanPropsSchema: z.ZodObject<{
+    planKey: z.ZodOptional<z.ZodOptional<z.ZodString> | z.ZodOptional<z.ZodEnum<{}>>>;
+    planExpiresAt: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    planAutoRenews: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$strip>;
+/**
+ * Update Plan Props type.
+ */
+export type UpdatePlanProps = z.infer<typeof updatePlanPropsSchema>;
+/**
+ * Schema for verifying two-factor authentication.
+ */
+export declare const verifyTwoFactorPropsSchema: z.ZodObject<{
+    twoFactorEnabled: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$strip>;
+/**
+ * Verify Two Factor Props type.
+ */
+export type VerifyTwoFactorProps = z.infer<typeof verifyTwoFactorPropsSchema>;
+/**
+ * Schema for two-factor secret props.
+ */
+export declare const verifyTwoFactorSecretPropsSchema: z.ZodObject<{
+    pendingTwoFactorSecret: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    twoFactorSecret: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Verify Two Factor Secret Props type.
+ */
+export type VerifyTwoFactorSecretProps = z.infer<typeof verifyTwoFactorSecretPropsSchema>;
+/** Zod schema for JWT session payloads (userId, deviceId, optional OAuth fields). */
+export declare const sessionSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    userId: z.ZodString;
+    deviceId: z.ZodString;
+    oauthServer: z.ZodOptional<z.ZodString>;
+    oauthId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * User session data (userId, email, role, permissions, metadata) inferred from sessionSchema.
+ */
+export type Session = z.infer<typeof sessionSchema>;
+/**
+ * Re-export zod for convenience.
+ */
+export { z };
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB;;GAEG;AACH,eAAO,MAAM,cAAc,OAAO,CAAA;AAElC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,QAAa,CAAA;AAE3C;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GACvB,YAAY,SAAS,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,SAAS,GAAG,SAAS,EAC3E,QAAQ,SAAS,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,SAAS,GAAG,SAAS,EACvE,UAAU;IACV,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAEpB;;;;;;;;;;;;;;;;;iBAmEA,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;iBAAiB,CAAA;AAEzC;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAA;AAE/C;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;iBAgC5B,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,6DAA6D;AAC7D,eAAO,MAAM,uBAAuB;;iBAElC,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;iBAQjC,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB;;;;;;iBAQlB,CAAA;AAEZ;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D,yEAAyE;AACzE,eAAO,MAAM,+BAA+B;;iBAIhC,CAAA;AAEZ;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAEvF,0FAA0F;AAC1F,eAAO,MAAM,qBAAqB;;;;iBAMtB,CAAA;AAEZ;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;GAEG;AACH,eAAO,MAAM,0BAA0B;;iBAI3B,CAAA;AAEZ;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAE7E;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;iBAKjC,CAAA;AAEZ;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAEzF,qFAAqF;AACrF,eAAO,MAAM,aAAa;;;;;;iBAqBxB,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;AAEnD;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,CAAA"}