@nacre.work/api 0.19.0 → 0.20.0

package/dist/login.d.ts

@@ -98,10 +98,44 @@ export type SecondFactorProof = {
  * a caller can ignore, and ignoring it here means issuing a session to somebody
  * who has not produced their second factor.
  */
-export type LoginOutcome = {
+export type SessionOutcome = {
     readonly kind: 'tokens';
     readonly tokens: Tokens;
 } | {
+    /**
+     * A gate admitted this person only as far as enrolling a second factor.
+     *
+     * The challenge reaches the enrolment routes and nothing else, and
+     * confirming a factor is what turns it into a session. Without this
+     * outcome a policy requiring a factor would lock out everybody who had
+     * not already enrolled on the day it was turned on, and the route back
+     * would be the database.
+     */
+    readonly kind: 'enrol-second-factor';
+    readonly challenge: string;
+    readonly expiresIn: number;
+    /** The gate's own words, shown to the person. Never an internal detail. */
+    readonly reason: string;
+} | {
+    /** A gate refused, and no action by this person changes that. */
+    readonly kind: 'refused';
+    readonly reason: string;
+};
+/**
+ * Sign-in's outcomes, which are the ones above plus the second-factor
+ * challenge.
+ *
+ * Split so that every path minting a session shares the first three: the union
+ * came from `issue`, which is the one place a session is made, and a caller
+ * that can reach `issue` can reach all of its answers. Only `login` can ask for
+ * a factor that already exists, so only `login` carries that member.
+ *
+ * A union rather than a nullable pair for the reason it always was: it turns
+ * every call site into a compile error until it says which outcome it means,
+ * and the alternative is an optional field a caller can ignore — where ignoring
+ * it means issuing a session to somebody a policy says may not have one.
+ */
+export type LoginOutcome = SessionOutcome | {
     readonly kind: 'second-factor';
     /** Short-lived, single-purpose, and useless as an access token. */
     readonly challenge: string;
@@ -119,7 +153,15 @@ export type ChangePasswordOutcome = {
     readonly kind: 'changed';
     readonly tokens: Tokens;
     readonly email: string;
-} | 'wrong-password' | 'no-user';
+}
+/**
+ * A shared account: a credential more than one person holds, so none of them
+ * may change it for the rest. Distinct from `wrong-password` because the two
+ * are different facts and only one of them is fixed by retyping.
+ */
+ | 'shared' | Exclude<SessionOutcome, {
+    readonly kind: 'tokens';
+}> | 'wrong-password' | 'no-user';
 export declare class Login {
     private readonly deps;
     constructor(deps: LoginDeps);
@@ -153,7 +195,7 @@ export declare class Login {
      * all of them into one refusal. Which of the four it was is not something a
      * client needs and is something an attacker would use.
      */
-    completeSecondFactor(challenge: string, proof: SecondFactorProof): Promise<Tokens | undefined>;
+    completeSecondFactor(challenge: string, proof: SecondFactorProof): Promise<SessionOutcome | undefined>;
     /**
      * The options a browser needs for the assertion half of a sign-in.
      *
@@ -177,6 +219,29 @@ export declare class Login {
      * to stop.
      */
     private readChallenge;
+    /**
+     * Read an enrolment challenge, for the routes that accept one.
+     *
+     * Public because the enrolment surface is in `server.ts` and this is the only
+     * thing that may turn that token into a person. It answers the org and the
+     * user and nothing else — no role, no permissions — because the only thing
+     * such a token is allowed to do is add a factor to the account it names.
+     */
+    readEnrolmentChallenge(challenge: string): Promise<{
+        readonly orgId: string;
+        readonly userId: string;
+    } | undefined>;
+    /**
+     * A confirmed factor turns an enrolment challenge into a session.
+     *
+     * Called by the enrolment route once a factor is confirmed, so the person who
+     * was sent to enrol is not then asked to sign in again — which is the moment
+     * they would give up. It re-reads the account and runs the gates again rather
+     * than trusting that enrolling was enough: a gate that wanted a *particular*
+     * kind is entitled to refuse the one that was just added, and assuming
+     * otherwise would be this file deciding what a policy means.
+     */
+    sessionAfterEnrolment(orgId: string, userId: string): Promise<SessionOutcome | undefined>;
     /**
      * A person changes their own password, having proved the current one.
      *
@@ -243,7 +308,7 @@ export declare class Login {
      * took it. Which one is unknowable from here, so the whole family is revoked
      * and both sign in again.
      */
-    refresh(token: string): Promise<Tokens | undefined>;
+    refresh(token: string): Promise<SessionOutcome | undefined>;
     /** Sign out. Ends the family, not just this token. */
     logout(token: string): Promise<boolean>;
     /**
@@ -266,6 +331,27 @@ export declare class Login {
      * revoked together; a fresh login starts a new one, so signing out of one
      * device does not sign out of the others.
      */
+    /**
+     * Mint a session, unless a gate says this authentication is not enough.
+     *
+     * **The gates are consulted here rather than beside each caller, and that is
+     * the whole of why this returns a union.** There are four paths from a
+     * verified credential to a session — a password with no factor asked for, a
+     * completed second factor, a spent refresh token, and a password change — and
+     * a check placed beside them is a check the fifth one forgets. That is this
+     * repository's most repeated defect, so the gate goes at the single point all
+     * four already reach, and every caller becomes a compile error until it says
+     * what it does with a refusal.
+     *
+     * A **refresh** is gated too, deliberately. A policy turned on while people
+     * are signed in would otherwise do nothing for any of them for as long as
+     * they kept renewing — authority renewed without the person present is the
+     * same case a delegation's `disabled` check exists for.
+     *
+     * `path` is what the caller is doing, passed rather than inferred: a gate
+     * that wants to demand a factor on sign-in and not interrupt a password
+     * change can only tell those apart if it is told.
+     */
     private issue;
 }
 //# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAG5C,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAI1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAqDlE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CAAA;IACpC,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IACtC,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,qEAAqE;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACzD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrE,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACpG,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAClG;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,UAAU,CAAA;IACtC,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAA;AAEnE;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,CAAA;AAEL;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7E,gBAAgB,GAChB,SAAS,CAAA;AAeb,qBAAa,KAAK;IACJ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,SAAS;IAE5C,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;OAKG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA8CrE;;;;;;;;;;;OAWG;YACW,SAAS;IAevB;;;;;;;OAOG;IACG,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAuBpG;;;;;;;;;;;;OAYG;IACG,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAQjG;;;;;;;OAOG;YACW,aAAa;IAmB3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC;YAoDnB,QAAQ;IAgBtB;;;;;;OAMG;IACH,OAAO,KAAK,eAAe,GAG1B;IAED;;;;;;;;OAQG;YACW,IAAI;YAuBJ,YAAY;YAaZ,SAAS;YAYT,MAAM;IAgBpB;;;;;;;;OAQG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IA+FzD,sDAAsD;IAChD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB7C;;;;;;;;;;;OAWG;YACW,YAAY;IAe1B;;;;;;OAMG;YACW,KAAK;CAoDpB"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAG5C,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAI1C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AA+ElE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CAAA;IACpC,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IACtC,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,qEAAqE;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACzD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrE,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACpG,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAClG;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,UAAU,CAAA;IACtC,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAA;AAEnE;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IACE;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,GACD;IACE,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAEL;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,YAAY,GACpB,cAAc,GACd;IACE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,CAAA;AAEL;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC/E;;;;GAIG;GACD,QAAQ,GASR,OAAO,CAAC,cAAc,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GACpD,gBAAgB,GAChB,SAAS,CAAA;AAeb,qBAAa,KAAK;IACJ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,SAAS;IAE5C,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;OAKG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAkDrE;;;;;;;;;;;OAWG;YACW,SAAS;IAevB;;;;;;;OAOG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IA0BtC;;;;;;;;;;;;OAYG;IACG,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAQjG;;;;;;;OAOG;YACW,aAAa;IAsB3B;;;;;;;OAOG;IACG,sBAAsB,CAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAI3E;;;;;;;;;OASG;IACG,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAM/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC;YAyEnB,QAAQ;IAgBtB;;;;;;OAMG;IACH,OAAO,KAAK,eAAe,GAG1B;IAED;;;;;;;;OAQG;YACW,IAAI;YAuBJ,YAAY;YAaZ,SAAS;YAYT,MAAM;IAgBpB;;;;;;;;OAQG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IA+FjE,sDAAsD;IAChD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB7C;;;;;;;;;;;OAWG;YACW,YAAY;IAe1B;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,KAAK;CAiFpB"}

package/dist/login.js

@@ -1,5 +1,5 @@
 import { createHash, createPublicKey, randomBytes, timingSafeEqual } from 'node:crypto';
-import { hashPassword, needsRehash, spendVerificationTime, verifyPassword, whileAuthenticating, withOrg, } from '@nacre.work/core';
+import { admitSignIn, hashPassword, needsRehash, spendVerificationTime, verifyPassword, whileAuthenticating, withOrg, } from '@nacre.work/core';
 import { jwtVerify, SignJWT } from 'jose';
 /**
  * Email and password sign-in.
@@ -40,6 +40,16 @@ import { jwtVerify, SignJWT } from 'jose';
 const ACCESS_MIN_SECONDS = 60;
 /** Long enough to read a phone, short enough not to survive walking away. */
 const CHALLENGE_SECONDS = 300;
+/**
+ * The enrolment challenge's lifetime, and deliberately longer than the one
+ * above.
+ *
+ * That one is "read six digits off a screen you are already holding". This one
+ * is "install an authenticator, scan a code, and write down ten recovery codes"
+ * — or find a security key in a drawer. Five minutes is a person being told to
+ * start over halfway through the one flow they were sent to complete.
+ */
+const ENROL_SECONDS = 900;
 /**
  * The challenge's audience, which is deliberately not the API's.
  *
@@ -99,9 +109,13 @@ export class Login {
          * for this.
          */
         if (this.deps.secondFactors !== undefined && (await this.deps.secondFactors.required(candidate.org_id, candidate.id))) {
-            return { kind: 'second-factor', challenge: await this.challenge(candidate), expiresIn: CHALLENGE_SECONDS };
+            return {
+                kind: 'second-factor',
+                challenge: await this.challenge(candidate, 'second-factor', CHALLENGE_SECONDS),
+                expiresIn: CHALLENGE_SECONDS,
+            };
         }
-        return { kind: 'tokens', tokens: await this.issue(candidate, undefined) };
+        return this.issue(candidate, undefined, 'password');
     }
     /**
      * The token that says "this password was correct", and nothing else.
@@ -115,9 +129,9 @@ export class Login {
      * well, the code is single-use through `last_step`, and a person holding both
      * has finished signing in anyway.
      */
-    async challenge(user) {
+    async challenge(user, purpose, seconds) {
         const now = this.clock;
-        return new SignJWT({ org: user.org_id, purpose: 'second-factor' })
+        return new SignJWT({ org: user.org_id, purpose })
             .setProtectedHeader({
             alg: this.deps.algorithm ?? 'HS256',
             ...(this.deps.keyId === undefined ? {} : { kid: this.deps.keyId }),
@@ -126,7 +140,7 @@ export class Login {
             .setIssuer(this.deps.issuer)
             .setAudience(challengeAudience(this.deps.audience))
             .setIssuedAt(Math.floor(now.getTime() / 1000))
-            .setExpirationTime(Math.floor(now.getTime() / 1000) + CHALLENGE_SECONDS)
+            .setExpirationTime(Math.floor(now.getTime() / 1000) + seconds)
             .sign(this.deps.key);
     }
     /**
@@ -141,7 +155,7 @@ export class Login {
         const gate = this.deps.secondFactors;
         if (gate === undefined)
             return undefined;
-        const who = await this.readChallenge(challenge);
+        const who = await this.readChallenge(challenge, 'second-factor');
         if (who === undefined)
             return undefined;
         const { orgId, userId } = who;
@@ -156,7 +170,10 @@ export class Login {
         const user = await this.userById(orgId, userId);
         if (user === undefined || user.disabled_at !== null)
             return undefined;
-        return this.issue(user, undefined);
+        // The kind that was proved goes to the gates, because "a second factor" and
+        // "a factor whose signature covers the origin" are not the same claim and a
+        // policy may want the second.
+        return this.issue(user, undefined, 'second-factor', undefined, proof.kind === 'code' ? 'totp' : 'webauthn');
     }
     /**
      * The options a browser needs for the assertion half of a sign-in.
@@ -175,7 +192,7 @@ export class Login {
         const gate = this.deps.secondFactors;
         if (gate === undefined)
             return undefined;
-        const who = await this.readChallenge(challenge);
+        const who = await this.readChallenge(challenge, 'second-factor');
         if (who === undefined)
             return undefined;
         return gate.beginWebAuthnAssertion(who.orgId, who.userId);
@@ -188,7 +205,7 @@ export class Login {
      * accepted as a challenge — which is exactly what `challengeAudience` exists
      * to stop.
      */
-    async readChallenge(challenge) {
+    async readChallenge(challenge, purpose) {
         try {
             const { payload } = await jwtVerify(challenge, this.verificationKey, {
                 issuer: this.deps.issuer,
@@ -196,7 +213,9 @@ export class Login {
                 algorithms: [this.deps.algorithm ?? 'HS256'],
                 currentDate: this.clock,
             });
-            if (payload.purpose !== 'second-factor' || typeof payload.sub !== 'string' || typeof payload.org !== 'string') {
+            // The purpose is a required argument rather than a default, so a second
+            // reader written later has to say which kind of challenge it takes.
+            if (payload.purpose !== purpose || typeof payload.sub !== 'string' || typeof payload.org !== 'string') {
                 return undefined;
             }
             return { orgId: payload.org, userId: payload.sub };
@@ -205,6 +224,33 @@ export class Login {
             return undefined;
         }
     }
+    /**
+     * Read an enrolment challenge, for the routes that accept one.
+     *
+     * Public because the enrolment surface is in `server.ts` and this is the only
+     * thing that may turn that token into a person. It answers the org and the
+     * user and nothing else — no role, no permissions — because the only thing
+     * such a token is allowed to do is add a factor to the account it names.
+     */
+    async readEnrolmentChallenge(challenge) {
+        return this.readChallenge(challenge, 'enrol');
+    }
+    /**
+     * A confirmed factor turns an enrolment challenge into a session.
+     *
+     * Called by the enrolment route once a factor is confirmed, so the person who
+     * was sent to enrol is not then asked to sign in again — which is the moment
+     * they would give up. It re-reads the account and runs the gates again rather
+     * than trusting that enrolling was enough: a gate that wanted a *particular*
+     * kind is entitled to refuse the one that was just added, and assuming
+     * otherwise would be this file deciding what a policy means.
+     */
+    async sessionAfterEnrolment(orgId, userId) {
+        const user = await this.userById(orgId, userId);
+        if (user === undefined || user.disabled_at !== null)
+            return undefined;
+        return this.issue(user, undefined, 'second-factor');
+    }
     /**
      * A person changes their own password, having proved the current one.
      *
@@ -241,7 +287,7 @@ export class Login {
      */
     async changePassword(orgId, userId, current, next) {
         const row = await withOrg(this.deps.pool, orgId, async (client) => {
-            const { rows } = await client.query(`SELECT id, org_id, role, email, password_hash, disabled_at
+            const { rows } = await client.query(`SELECT id, org_id, role, email, password_hash, disabled_at, shared
              FROM users WHERE org_id = $1 AND id = $2`, [orgId, userId]);
             return rows[0];
         }, this.scope);
@@ -251,6 +297,22 @@ export class Login {
         // branch anybody sees.
         if (row === undefined || row.disabled_at !== null || row.password_hash === null)
             return 'no-user';
+        /*
+         * A credential more than one person holds is not one of them may change.
+         *
+         * Refused **before** the current password is verified, which is the one
+         * ordering decision here: checking it first would make this endpoint say
+         * whether the published password is still current, and the whole point is
+         * that the password is public. It costs nothing either, since a shared
+         * account can never pass.
+         *
+         * Here as well as at the route, and that is not a second copy of one check.
+         * The route is what answers `404` to a caller; this is what holds when a
+         * second route is written — the same argument the trigger on
+         * `user_second_factors` makes for the other half of this surface.
+         */
+        if (row.shared)
+            return 'shared';
         // Outside the transaction on purpose: scrypt at OWASP's minimum takes long
         // enough that holding a row lock across it is a lock held on arithmetic.
         if (!(await verifyPassword(current, row.password_hash)))
@@ -265,9 +327,15 @@ export class Login {
             // A new family. Carrying the old one would put the session that
             // replaces every other one in the same chain as the tokens just
             // revoked.
-            return this.issue(row, undefined, client);
+            return this.issue(row, undefined, 'password-change', client);
         }, this.scope);
-        return { kind: 'changed', tokens, email: row.email };
+        // A gate may interrupt a password change as readily as a sign-in, and the
+        // outcome is carried out rather than flattened: a person who has just
+        // proved their current password and is being told to enrol needs the
+        // challenge, not a failure with no next step.
+        if (tokens.kind !== 'tokens')
+            return tokens;
+        return { kind: 'changed', tokens: tokens.tokens, email: row.email };
     }
     async userById(orgId, userId) {
         return withOrg(this.deps.pool, orgId, async (client) => {
@@ -402,7 +470,7 @@ export class Login {
             const user = rows[0];
             if (user === undefined || user.disabled_at !== null)
                 return 'gone';
-            return this.issue(user, row.family_id, client);
+            return this.issue(user, row.family_id, 'refresh', client);
         }, this.scope);
         if (outcome === 'lost') {
             // Someone already spent this one. Two parties hold the same token and
@@ -455,7 +523,52 @@ export class Login {
      * revoked together; a fresh login starts a new one, so signing out of one
      * device does not sign out of the others.
      */
-    async issue(user, family, client) {
+    /**
+     * Mint a session, unless a gate says this authentication is not enough.
+     *
+     * **The gates are consulted here rather than beside each caller, and that is
+     * the whole of why this returns a union.** There are four paths from a
+     * verified credential to a session — a password with no factor asked for, a
+     * completed second factor, a spent refresh token, and a password change — and
+     * a check placed beside them is a check the fifth one forgets. That is this
+     * repository's most repeated defect, so the gate goes at the single point all
+     * four already reach, and every caller becomes a compile error until it says
+     * what it does with a refusal.
+     *
+     * A **refresh** is gated too, deliberately. A policy turned on while people
+     * are signed in would otherwise do nothing for any of them for as long as
+     * they kept renewing — authority renewed without the person present is the
+     * same case a delegation's `disabled` check exists for.
+     *
+     * `path` is what the caller is doing, passed rather than inferred: a gate
+     * that wants to demand a factor on sign-in and not interrupt a password
+     * change can only tell those apart if it is told.
+     */
+    async issue(user, family, path, client, proved) {
+        const refusal = await admitSignIn({
+            orgId: user.org_id,
+            userId: user.id,
+            role: user.role,
+            path,
+            secondFactor: proved,
+            // Asked rather than assumed. `required` answers whether the account holds
+            // a confirmed factor, which is a different question from whether one was
+            // proved on this request — a refresh proves none and the account may
+            // still have one.
+            enrolled: this.deps.secondFactors === undefined
+                ? false
+                : await this.deps.secondFactors.required(user.org_id, user.id),
+        });
+        if (refusal !== undefined) {
+            if (refusal.kind === 'refuse')
+                return { kind: 'refused', reason: refusal.reason };
+            return {
+                kind: 'enrol-second-factor',
+                challenge: await this.challenge(user, 'enrol', ENROL_SECONDS),
+                expiresIn: ENROL_SECONDS,
+                reason: refusal.reason,
+            };
+        }
         const ttl = Math.max(ACCESS_MIN_SECONDS, this.deps.accessTokenTtl);
         const now = this.clock;
         const accessToken = await new SignJWT({
@@ -489,7 +602,10 @@ export class Login {
             await insert(client);
         else
             await withOrg(this.deps.pool, user.org_id, insert, this.scope);
-        return { accessToken, refreshToken, expiresIn: ttl, orgId: user.org_id, userId: user.id };
+        return {
+            kind: 'tokens',
+            tokens: { accessToken, refreshToken, expiresIn: ttl, orgId: user.org_id, userId: user.id },
+        };
     }
 }
 //# sourceMappingURL=login.js.map

package/dist/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,OAAO,GACR,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAOzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAE7B,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAE7B;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,GAAG,QAAQ,gBAAgB,CAAA;AAmInF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE1F,wEAAwE;AACxE,MAAM,IAAI,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEhE,MAAM,OAAO,KAAK;IACa;IAA7B,YAA6B,IAAe;QAAf,SAAI,GAAJ,IAAI,CAAW;IAAG,CAAC;IAEhD,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACrE,CAAC;IAED,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAA;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAChD,IAAI,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,0EAA0E;YAC1E,oCAAoC;YACpC,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAClG,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAExF,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,WAAW,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACrD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,SAAS,CAAC,MAAM,EAChB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAC7F,IAAI,CAAC,KAAK,CACX,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC1B,CAAC;QAED;;;;;;;;WAQG;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACtH,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAA;QAC5G,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAA;IAC3E,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,SAAS,CAAC,IAAa;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAA;QACtB,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;aAC/D,kBAAkB,CAAC;YAClB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO;YACnC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;SACnE,CAAC;aACD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aAClD,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;aAC7C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,iBAAiB,CAAC;aACvE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CAAC,SAAiB,EAAE,KAAwB;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAExC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACvC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;QAE7B,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,MAAM;YACnB,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;YAC9C,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QACvE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAE7B,sEAAsE;QACtE,4EAA4E;QAC5E,kDAAkD;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAErE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACpC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,yBAAyB,CAAC,SAAiB;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACvC,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3D,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE;gBACnE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;gBACxB,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC/C,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;gBAC5C,WAAW,EAAE,IAAI,CAAC,KAAK;aACxB,CAAC,CAAA;YACF,IAAI,OAAO,CAAC,OAAO,KAAK,eAAe,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC9G,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,MAAc,EACd,OAAe,EACf,IAAY;QAEZ,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,4EAA4E;QAC5E,wEAAwE;QACxE,uEAAuE;QACvE,uBAAuB;QACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAEjG,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,gBAAgB,CAAA;QAChF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QAErC,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAChB,mEAAmE,EACnE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CACtB,CAAA;YACD,kEAAkE;YAClE,sEAAsE;YACtE,MAAM,MAAM,CAAC,KAAK,CAChB;sEAC4D,EAC5D,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,gEAAgE;YAChE,gEAAgE;YAChE,WAAW;YACX,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QAC3C,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;IACtD,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,IAAY,eAAe;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,UAAU;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QAC7D,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,YAAgC;QAChE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;YACxE,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACrC,MAAM,KAAK,GAAc,EAAE,CAAA;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YAC3C,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtC,wEAAwE;YACxE,uEAAuE;YACvE,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;QACxC,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAY;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,qEAAqE,EACrE,CAAC,IAAI,CAAC,CACP,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,uDAAuD,CACxD,CAAA;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC9B,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAa;QAC/C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;yDAC+C,EAC/C,CAAC,KAAK,EAAE,KAAK,CAAC,CACf,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAUjC;uDAC6C,EAC7C,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAEvC,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAClD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAE/F,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAE7C,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAAE,OAAO,SAAS,CAAA;QAEtE,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,8DAA8D;QAC9D,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,4CAA4C;QAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,MAAM,EAAqC,EAAE;YAClD,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;YAEjF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;yBAEe,EACf,CAAC,GAAG,CAAC,EAAE,CAAC,CACT,CAAA;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAA;YAEhD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAC1B,CAAA;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACpB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAA;YAElE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAChD,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,qEAAqE;YACrE,yEAAyE;YACzE,+CAA+C;YAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,2FAA2F,EAC3F,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACnC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACxD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC5E,MAAM,MAAM,CAAC,KAAK,CAChB,0FAA0F,EAC1F,CAAC,QAAQ,CAAC,CACX,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,KAAK,CACjB,IAAa,EACb,MAA0B,EAC1B,MAAmB;QAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAA;QAEtB,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC;YACpC,uEAAuE;YACvE,8BAA8B;YAC9B,GAAG,EAAE,IAAI,CAAC,MAAM;YAChB,cAAc,EAAE,MAAM;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;aACC,kBAAkB,CAAC;YAClB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO;YACnC,qEAAqE;YACrE,4CAA4C;YAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;SACnE,CAAC;aACD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC/B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;aAC7C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;aACzD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEtB,MAAM,YAAY,GAAG,IAAI,EAAE,CAAA;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;QAE5E,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAoB,EAAE,CACtD,MAAM,CAAC,KAAK,CACV;wEACgE,EAChE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,CAAC,CACxE,CAAA;QAEH,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;;YACzC,MAAM,OAAO,CAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,IAAI,CAAC,MAAM,EACX,MAAM,EACN,IAAI,CAAC,KAAK,CACX,CAAA;QAED,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;IAC3F,CAAC;CACF"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EACL,WAAW,EACX,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,OAAO,GACR,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAQzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAE7B,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAE7B;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,GAAG,QAAQ,gBAAgB,CAAA;AAsMnF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE1F,wEAAwE;AACxE,MAAM,IAAI,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEhE,MAAM,OAAO,KAAK;IACa;IAA7B,YAA6B,IAAe;QAAf,SAAI,GAAJ,IAAI,CAAW;IAAG,CAAC;IAEhD,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACrE,CAAC;IAED,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAA;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAChD,IAAI,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,0EAA0E;YAC1E,oCAAoC;YACpC,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAClG,MAAM,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAExF,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,WAAW,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACrD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,SAAS,CAAC,MAAM,EAChB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAC7F,IAAI,CAAC,KAAK,CACX,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC1B,CAAC;QAED;;;;;;;;WAQG;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACtH,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,iBAAiB,CAAC;gBAC9E,SAAS,EAAE,iBAAiB;aAC7B,CAAA;QACH,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,SAAS,CAAC,IAAa,EAAE,OAAyB,EAAE,OAAe;QAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAA;QACtB,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;aAC9C,kBAAkB,CAAC;YAClB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO;YACnC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;SACnE,CAAC;aACD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aAClD,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;aAC7C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;aAC7D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CACxB,SAAiB,EACjB,KAAwB;QAExB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAExC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QAChE,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACvC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;QAE7B,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,MAAM;YACnB,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;YAC9C,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QACvE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAE7B,sEAAsE;QACtE,4EAA4E;QAC5E,kDAAkD;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAErE,4EAA4E;QAC5E,4EAA4E;QAC5E,8BAA8B;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IAC7G,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,yBAAyB,CAAC,SAAiB;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QAChE,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACvC,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3D,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,SAAiB,EACjB,OAAyB;QAEzB,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE;gBACnE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;gBACxB,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC/C,UAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;gBAC5C,WAAW,EAAE,IAAI,CAAC,KAAK;aACxB,CAAC,CAAA;YACF,wEAAwE;YACxE,oEAAoE;YACpE,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACtG,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,sBAAsB,CAC1B,SAAiB;QAEjB,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC/C,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,qBAAqB,CAAC,KAAa,EAAE,MAAc;QACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QACrE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,MAAc,EACd,OAAe,EACf,IAAY;QAEZ,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,4EAA4E;QAC5E,wEAAwE;QACxE,uEAAuE;QACvE,uBAAuB;QACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAEjG;;;;;;;;;;;;;WAaG;QACH,IAAI,GAAG,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAA;QAE/B,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,gBAAgB,CAAA;QAChF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QAErC,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAChB,mEAAmE,EACnE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CACtB,CAAA;YACD,kEAAkE;YAClE,sEAAsE;YACtE,MAAM,MAAM,CAAC,KAAK,CAChB;sEAC4D,EAC5D,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,gEAAgE;YAChE,gEAAgE;YAChE,WAAW;YACX,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAA;QAC9D,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,qEAAqE;QACrE,8CAA8C;QAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAA;QAC3C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;IACrE,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,KAAK,EAAE,MAAM,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,IAAY,eAAe;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,UAAU;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QAC7D,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,YAAgC;QAChE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;YACxE,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACrC,MAAM,KAAK,GAAc,EAAE,CAAA;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YAC3C,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtC,wEAAwE;YACxE,uEAAuE;YACvE,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;QACxC,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAY;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,qEAAqE,EACrE,CAAC,IAAI,CAAC,CACP,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,uDAAuD,CACxD,CAAA;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC9B,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAa;QAC/C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;yDAC+C,EAC/C,CAAC,KAAK,EAAE,KAAK,CAAC,CACf,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAUjC;uDAC6C,EAC7C,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAEvC,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAClD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAE/F,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAE7C,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAAE,OAAO,SAAS,CAAA;QAEtE,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,8DAA8D;QAC9D,EAAE;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,4CAA4C;QAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,GAAG,CAAC,MAAM,EACV,KAAK,EAAE,MAAM,EAA6C,EAAE;YAC1D,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;YAEjF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;yBAEe,EACf,CAAC,GAAG,CAAC,EAAE,CAAC,CACT,CAAA;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAA;YAEhD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;sDAC4C,EAC5C,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAC1B,CAAA;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACpB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAA;YAElE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QAC3D,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,qEAAqE;YACrE,yEAAyE;YACzE,+CAA+C;YAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,2FAA2F,EAC3F,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACnC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACxD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC5E,MAAM,MAAM,CAAC,KAAK,CAChB,0FAA0F,EAC1F,CAAC,QAAQ,CAAC,CACX,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,KAAK,CACjB,IAAa,EACb,MAA0B,EAC1B,IAA2B,EAC3B,MAAmB,EACnB,MAA4B;QAE5B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,IAAI,CAAC,IAA6B;YACxC,IAAI;YACJ,YAAY,EAAE,MAAM;YACpB,0EAA0E;YAC1E,yEAAyE;YACzE,qEAAqE;YACrE,kBAAkB;YAClB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;gBAC7C,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;SACjE,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;YACjF,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,SAAS,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC;gBAC7D,SAAS,EAAE,aAAa;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAA;QAEtB,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC;YACpC,uEAAuE;YACvE,8BAA8B;YAC9B,GAAG,EAAE,IAAI,CAAC,MAAM;YAChB,cAAc,EAAE,MAAM;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;aACC,kBAAkB,CAAC;YAClB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO;YACnC,qEAAqE;YACrE,4CAA4C;YAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;SACnE,CAAC;aACD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC/B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;aAC7C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;aACzD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEtB,MAAM,YAAY,GAAG,IAAI,EAAE,CAAA;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;QAE5E,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAoB,EAAE,CACtD,MAAM,CAAC,KAAK,CACV;wEACgE,EAChE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,CAAC,CACxE,CAAA;QAEH,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;;YACzC,MAAM,OAAO,CAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,IAAI,CAAC,MAAM,EACX,MAAM,EACN,IAAI,CAAC,KAAK,CACX,CAAA;QAED,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;SAC3F,CAAA;IACH,CAAC;CACF"}

package/dist/principals.d.ts

@@ -47,6 +47,15 @@ export interface UserView {
      * has no local credential to steal.
      */
     readonly hasPassword: boolean;
+    /**
+     * Whether this credential is one several people hold.
+     *
+     * In the listing because an administrator who ticked that box when creating
+     * the account has no other way to see it afterwards — and it decides whether
+     * the person on the other end can hold a second factor at all, which is
+     * exactly the kind of thing a screen must be able to say.
+     */
+    readonly shared: boolean;
 }
 export interface Users {
     list(auth: AuthContext, page?: Page): Promise<PageResult<UserView>>;
@@ -57,7 +66,15 @@ export interface Users {
      * `UNIQUE (org_id, email)`, and a duplicate is something the caller typed
      * rather than an internal error.
      */
-    create(auth: AuthContext, email: string, role: 'org_admin' | 'member'): Promise<{
+    create(auth: AuthContext, email: string, role: 'org_admin' | 'member', 
+    /**
+     * A credential more than one person will hold — a published demo login.
+     *
+     * It has no `/v1/me` credential surface: no second factor, no password
+     * change, no recovery link. An administrator still resets its password
+     * here, which is how whoever published it rotates one.
+     */
+    shared?: boolean): Promise<{
         user: UserView;
         password: string;
     } | undefined>;
@@ -90,6 +107,19 @@ export interface Users {
     resetPassword(auth: AuthContext, id: string): Promise<{
         password: string;
     } | 'platform-admin' | 'no-user'>;
+    /**
+     * Whether this account is one more than one person holds.
+     *
+     * Takes ids rather than an `AuthContext` because the caller is the request
+     * path asking about *itself*, before any of the administrative checks the
+     * rest of this port makes — there is no administrator here, only a person
+     * finding out whether the surface in front of them is theirs.
+     *
+     * `false` for an account that is not there. The routes that ask have already
+     * authenticated the id, so the row exists; answering `false` for a missing
+     * one keeps this from becoming a way to probe which ids do.
+     */
+    isShared(orgId: string, userId: string): Promise<boolean>;
 }
 export interface GroupView {
     readonly id: string;
@@ -137,7 +167,7 @@ export declare class PostgresUsers implements Users {
     constructor(pool: Pool, role?: string | undefined);
     private get scope();
     list(auth: AuthContext, page?: Page): Promise<PageResult<UserView>>;
-    create(auth: AuthContext, email: string, role: 'org_admin' | 'member'): Promise<{
+    create(auth: AuthContext, email: string, role: 'org_admin' | 'member', shared?: boolean): Promise<{
         user: UserView;
         password: string;
     } | undefined>;
@@ -180,6 +210,7 @@ export declare class PostgresUsers implements Users {
     resetPassword(auth: AuthContext, id: string): Promise<{
         password: string;
     } | 'platform-admin' | 'no-user'>;
+    isShared(orgId: string, userId: string): Promise<boolean>;
 }
 export declare class PostgresGroups implements Groups {
     private readonly pool;

package/dist/principals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principals.d.ts","sourceRoot":"","sources":["../src/principals.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAE1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAU,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,GAAG,QAAQ,CAAA;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;IACnE;;;;;;OAMG;IACH,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,GAAG,QAAQ,GAC3B,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IAC5D;;;;;;;;;;;;;;OAcG;IACH,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5D,OAAO,CAAC,SAAS,GAAG,YAAY,GAAG,gBAAgB,GAAG,SAAS,CAAC,CAAA;IACnE;;;;;;OAMG;IACH,aAAa,CACX,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,GAAG,SAAS,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpE,wEAAwE;IACxE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAA;IACvE,8CAA8C;IAC9C,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACvD,iFAAiF;IACjF,OAAO,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,IAAI,GACV,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,CAAA;IAC/C;;;;OAIG;IACH,SAAS,CACP,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC,CAAA;IAC1D,yCAAyC;IACzC,YAAY,CACV,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;CACpB;AAOD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,qBAAa,aAAc,YAAW,KAAK;IAEvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAEK,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IA+CnE,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,GAAG,QAAQ,GAC3B,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IA2C5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,YAAY;IA4BpB,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5D,OAAO,CAAC,SAAS,GAAG,YAAY,GAAG,gBAAgB,GAAG,SAAS,CAAC;IA0C7D,aAAa,CACjB,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,GAAG,SAAS,CAAC;CAoBhE;AAED,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAEK,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IA2CpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAqBvE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmCvD,OAAO,CACX,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,IAAI,GACV,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IA6DzC,SAAS,CACb,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IAoDpD,YAAY,CAChB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC;CAkBpB"}
+{"version":3,"file":"principals.d.ts","sourceRoot":"","sources":["../src/principals.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAE1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAU,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,GAAG,QAAQ,CAAA;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;IACnE;;;;;;OAMG;IACH,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,GAAG,QAAQ;IAC5B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IAC5D;;;;;;;;;;;;;;OAcG;IACH,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5D,OAAO,CAAC,SAAS,GAAG,YAAY,GAAG,gBAAgB,GAAG,SAAS,CAAC,CAAA;IACnE;;;;;;OAMG;IACH,aAAa,CACX,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,GAAG,SAAS,CAAC,CAAA;IAC/D;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC1D;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpE,wEAAwE;IACxE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAA;IACvE,8CAA8C;IAC9C,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACvD,iFAAiF;IACjF,OAAO,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,IAAI,GACV,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,CAAA;IAC/C;;;;OAIG;IACH,SAAS,CACP,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC,CAAA;IAC1D,yCAAyC;IACzC,YAAY,CACV,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;CACpB;AAOD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,qBAAa,aAAc,YAAW,KAAK;IAEvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAEK,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAiDnE,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,GAAG,QAAQ,EAC5B,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IA4C5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,YAAY;IA4BpB,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5D,OAAO,CAAC,SAAS,GAAG,YAAY,GAAG,gBAAgB,GAAG,SAAS,CAAC;IA0C7D,aAAa,CACjB,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,GAAG,SAAS,CAAC;IAqBzD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAchE;AAED,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAEK,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IA2CpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAqBvE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmCvD,OAAO,CACX,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,IAAI,GACV,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IA6DzC,SAAS,CACb,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IAoDpD,YAAY,CAChB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC;CAkBpB"}

package/dist/principals.js

@@ -21,7 +21,7 @@ export class PostgresUsers {
             const seek = after === undefined ? '' : ' AND (created_at, id) > ($2::timestamptz, $3::uuid)';
             const cap = page === undefined ? '' : ` LIMIT ${page.limit}`;
             const { rows } = await client.query(`SELECT id, email, role, created_at, created_at::text AS created_at_text,
-                  disabled_at, (password_hash IS NOT NULL) AS has_password
+                  disabled_at, (password_hash IS NOT NULL) AS has_password, shared
              FROM users WHERE org_id = $1${seek} ORDER BY created_at, id${cap}`, after === undefined ? [auth.orgId] : [auth.orgId, after.createdAt, after.id]);
             // Disabled ones are listed rather than hidden, on the same grounds as a
             // revoked key: "this account was disabled on Tuesday" is the answer to
@@ -34,6 +34,7 @@ export class PostgresUsers {
                 createdAt: r.created_at.toISOString(),
                 disabledAt: r.disabled_at?.toISOString() ?? null,
                 hasPassword: r.has_password,
+                shared: r.shared,
             }));
             return pageOf(users, page, (u, i) => ({
                 createdAt: rows[i].created_at_text,
@@ -41,7 +42,7 @@ export class PostgresUsers {
             }));
         }, this.scope);
     }
-    async create(auth, email, role) {
+    async create(auth, email, role, shared) {
         const password = generatePassword();
         // Outside the transaction on purpose: scrypt at OWASP's minimum takes long
         // enough that holding a database connection across it is a connection spent
@@ -53,10 +54,10 @@ export class PostgresUsers {
             // transaction `withOrg` opens, a raised constraint error aborts
             // everything after it, so recovering would need a savepoint. The empty
             // result says the same thing without one.
-            const { rows } = await client.query(`INSERT INTO users (org_id, email, role, password_hash)
-           VALUES ($1,$2,$3,$4)
+            const { rows } = await client.query(`INSERT INTO users (org_id, email, role, password_hash, shared)
+           VALUES ($1,$2,$3,$4,$5)
            ON CONFLICT (org_id, email) DO NOTHING
-           RETURNING id, created_at`, [auth.orgId, email, role, passwordHash]);
+           RETURNING id, created_at`, [auth.orgId, email, role, passwordHash, shared === true]);
             const row = rows[0];
             if (row === undefined)
                 return undefined;
@@ -69,6 +70,7 @@ export class PostgresUsers {
                     createdAt: row.created_at.toISOString(),
                     disabledAt: null,
                     hasPassword: true,
+                    shared: shared === true,
                 },
             };
         }, this.scope);
@@ -163,6 +165,12 @@ export class PostgresUsers {
             return (rowCount ?? 0) > 0 ? { password } : 'no-user';
         });
     }
+    async isShared(orgId, userId) {
+        return withOrg(this.pool, orgId, async (client) => {
+            const { rows } = await client.query('SELECT shared FROM users WHERE org_id = $1 AND id = $2', [orgId, userId]);
+            return rows[0]?.shared === true;
+        }, this.scope);
+    }
 }
 export class PostgresGroups {
     pool;