@openora/core 0.4.0 → 0.4.1-canary.100

package/dist/pam/identity/__tests__/login-enforcement.service.int.test.js

@@ -0,0 +1,99 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+import { randomUUID } from 'node:crypto';
+import { eq, sql } from 'drizzle-orm';
+import { createTestDb, seedUser } from '@openora/core/testing';
+import { migrate as migrateProfile } from '@openora/core/pam/migrate/profile';
+import { makeEventBus, makeIdentityReader } from '../../../testing/mock.js';
+import { migrate } from '../migrate.js';
+import { user, session } from '../schema/index.js';
+import { LoginEnforcementService } from '../service/login-enforcement.service.js';
+import { SessionService } from '../service/session.service.js';
+const HOUR = 3600_000;
+let db;
+function makeService() {
+    const events = makeEventBus();
+    const sessions = new SessionService({
+        drizzle: db.drizzle,
+        events,
+        identityReader: makeIdentityReader(),
+    });
+    return { svc: new LoginEnforcementService(db.drizzle, sessions), events };
+}
+async function seedActiveSession(userId) {
+    const [row] = await db.drizzle.db
+        .insert(session)
+        .values({
+        userId,
+        token: randomUUID(),
+        expiresAt: new Date(Date.now() + 24 * HOUR),
+    })
+        .returning();
+    return row;
+}
+async function readUser(id) {
+    const [row] = await db.drizzle.db.select().from(user).where(eq(user.id, id));
+    return row;
+}
+async function activeSessionCount(userId) {
+    const rows = await db.drizzle.db
+        .select()
+        .from(session)
+        .where(sql `${session.userId} = ${userId} AND ${session.expiresAt} > NOW()`);
+    return rows.length;
+}
+beforeAll(async () => {
+    db = await createTestDb([migrate, migrateProfile]);
+});
+afterAll(async () => {
+    await db.drop();
+});
+beforeEach(async () => {
+    await db.drizzle.db.execute(sql `TRUNCATE ${session}, ${user} RESTART IDENTITY CASCADE`);
+});
+describe('LoginEnforcementService (real PG)', () => {
+    it('writes the RG columns and expires every live session on a timed block', async () => {
+        const { svc, events } = makeService();
+        const account = await seedUser(db);
+        await seedActiveSession(account.id);
+        await seedActiveSession(account.id);
+        const until = new Date('2026-08-01T00:00:00.000Z');
+        await svc.block(account.id, { until });
+        expect(await readUser(account.id)).toMatchObject({ rgBlocked: true, rgBlockedUntil: until });
+        expect(await activeSessionCount(account.id)).toBe(0);
+        expect(events.emit).toHaveBeenCalledWith('identity.sessions.revoked_all', expect.objectContaining({ userId: account.id }));
+    });
+    it('stores a null expiry for an indefinite block', async () => {
+        const { svc } = makeService();
+        const account = await seedUser(db);
+        await svc.block(account.id, { until: null });
+        expect(await readUser(account.id)).toMatchObject({ rgBlocked: true, rgBlockedUntil: null });
+    });
+    it('leaves another account session alive when blocking one player', async () => {
+        const { svc } = makeService();
+        const blocked = await seedUser(db);
+        const other = await seedUser(db);
+        await seedActiveSession(blocked.id);
+        await seedActiveSession(other.id);
+        await svc.block(blocked.id, { until: null });
+        expect(await activeSessionCount(other.id)).toBe(1);
+        expect(await readUser(other.id)).toMatchObject({ rgBlocked: false });
+    });
+    it('clears both columns on unblock without reviving or revoking sessions', async () => {
+        const { svc, events } = makeService();
+        const account = await seedUser(db, { rgBlocked: true, rgBlockedUntil: new Date() });
+        await seedActiveSession(account.id);
+        await svc.unblock(account.id);
+        expect(await readUser(account.id)).toMatchObject({ rgBlocked: false, rgBlockedUntil: null });
+        expect(await activeSessionCount(account.id)).toBe(1);
+        expect(events.emit).not.toHaveBeenCalledWith('identity.sessions.revoked_all', expect.anything());
+    });
+    it('overwrites an earlier block with the newer expiry', async () => {
+        const { svc } = makeService();
+        const account = await seedUser(db);
+        const later = new Date('2027-01-01T00:00:00.000Z');
+        await svc.block(account.id, { until: new Date('2026-01-01T00:00:00.000Z') });
+        await svc.block(account.id, { until: later });
+        expect(await readUser(account.id)).toMatchObject({ rgBlockedUntil: later });
+    });
+});
+//# sourceMappingURL=login-enforcement.service.int.test.js.map

package/dist/pam/identity/__tests__/login-enforcement.service.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-enforcement.service.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/login-enforcement.service.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,YAAY,EAAe,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,MAAM,IAAI,GAAG,QAAQ,CAAC;AAEtB,IAAI,EAAU,CAAC;AAEf,SAAS,WAAW;IAClB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC;QAClC,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,MAAM;QACN,cAAc,EAAE,kBAAkB,EAAE;KACrC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,IAAI,uBAAuB,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAc;IAC7C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;SAC9B,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC;QACN,MAAM;QACN,KAAK,EAAE,UAAU,EAAE;QACnB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;KAC5C,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,GAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,EAAU;IAChC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,GAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAc;IAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;SAC7B,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAA,GAAG,OAAO,CAAC,MAAM,MAAM,MAAM,QAAQ,OAAO,CAAC,SAAS,UAAU,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,YAAY,OAAO,KAAK,IAAI,2BAA2B,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAEnD,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvC,MAAM,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,+BAA+B,EAC/B,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAChD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEnC,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7C,MAAM,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAElC,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7C,MAAM,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACpF,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEpC,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE9B,MAAM,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAC1C,+BAA+B,EAC/B,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAEnD,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAE9C,MAAM,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/phone-login.service.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=phone-login.service.int.test.d.ts.map

package/dist/pam/identity/__tests__/phone-login.service.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-login.service.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/phone-login.service.int.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/phone-login.service.int.test.js

@@ -0,0 +1,371 @@
+import { createHash, createHmac } from 'node:crypto';
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
+import { ORPCError } from '@orpc/server';
+import { sql } from 'drizzle-orm';
+import { RedisCache } from '@openora/core/server';
+import { createTestDb, createTestRedis, seedUser as insertUser, } from '@openora/core/testing';
+import { migrate as migrateIdentity } from '@openora/core/pam/migrate/identity';
+import { player } from '@openora/core/pam/schema/profile';
+import { migrate as migrateProfile } from '@openora/core/pam/migrate/profile';
+import { PhoneLoginService } from '../service/phone-login.service.js';
+import { user, session, smsOtpSession } from '../schema/index.js';
+import { makeEventBus, mock, NO_CLIENT_META } from '../../../testing/mock.js';
+const PHONE = '+14155550100';
+const AUTH_SECRET = 'unit-test-secret-do-not-use-in-prod';
+const SESSION_COOKIE_NAME = 'better-auth.session_token';
+const DONT_REMEMBER_COOKIE_NAME = 'better-auth.dont_remember';
+const OTP_TTL_MS = 5 * 60 * 1000;
+const fakeAuth = mock({
+    $context: Promise.resolve({
+        secret: AUTH_SECRET,
+        authCookies: {
+            sessionToken: {
+                name: SESSION_COOKIE_NAME,
+                attributes: {
+                    httpOnly: true,
+                    secure: false,
+                    sameSite: 'lax',
+                    path: '/',
+                    maxAge: 7 * 24 * 60 * 60,
+                },
+            },
+            dontRememberToken: {
+                name: DONT_REMEMBER_COOKIE_NAME,
+                attributes: {
+                    httpOnly: true,
+                    secure: false,
+                    sameSite: 'lax',
+                    path: '/',
+                },
+            },
+        },
+    }),
+});
+let db;
+let redis;
+const allowLimiter = () => ({
+    consume: vi.fn().mockResolvedValue({ allowed: true, retryAfterMs: 0 }),
+    reset: vi.fn(),
+});
+function build({ sms = { sendOtp: vi.fn().mockResolvedValue(undefined) }, cache, } = {}) {
+    const events = makeEventBus();
+    const svc = new PhoneLoginService({
+        drizzle: db.drizzle,
+        events: events,
+        sms,
+        limiter: allowLimiter(),
+        auth: fakeAuth,
+        cache,
+    });
+    return { svc, events, sms };
+}
+const realCache = () => new RedisCache(redis.client);
+function expectedSignature(token) {
+    return createHmac('sha256', AUTH_SECRET).update(token).digest('base64');
+}
+// SHA-256 of a code, mirroring the service's hashCode.
+const hash = (code) => createHash('sha256').update(code).digest('hex');
+const seedUser = (over = {}) => insertUser(db, { name: 'A', phoneNumber: PHONE, phoneVerified: true, ...over });
+async function seedOtp(userId, over = {}) {
+    const [row] = await db.drizzle.db
+        .insert(smsOtpSession)
+        .values({
+        userId,
+        phone: PHONE,
+        codeHash: hash('123456'),
+        expiresAt: new Date(Date.now() + OTP_TTL_MS),
+        ...over,
+    })
+        .returning();
+    return row;
+}
+const otpRows = () => db.drizzle.db.select().from(smsOtpSession);
+const sessionRows = () => db.drizzle.db.select().from(session);
+beforeAll(async () => {
+    db = await createTestDb([migrateIdentity, migrateProfile]);
+    redis = await createTestRedis();
+});
+afterAll(async () => {
+    await db.drop();
+    await redis.quit();
+});
+beforeEach(async () => {
+    await db.drizzle.db.execute(sql `TRUNCATE ${user}, ${session}, ${smsOtpSession}, ${player} RESTART IDENTITY CASCADE`);
+    await redis.flush();
+});
+describe('PhoneLoginService.requestOtp (real PG + real Redis)', () => {
+    it('sends an OTP for a verified phone, persists a hashed session row, and emits requested', async () => {
+        const account = await seedUser();
+        const { svc, events, sms } = build();
+        const out = await svc.requestOtp({ phone: PHONE, ...NO_CLIENT_META });
+        expect(typeof out.expiresAt).toBe('string');
+        expect(typeof out.resendAfter).toBe('string');
+        const sentCode = sms.sendOtp.mock.calls[0]?.[0]?.code;
+        expect(sentCode).toMatch(/^\d{6}$/);
+        const [row] = await otpRows();
+        expect(row).toMatchObject({
+            userId: account.id,
+            phone: PHONE,
+            codeHash: hash(sentCode),
+            failedAttempts: 0,
+        });
+        expect(events.emit).toHaveBeenCalledWith('identity.phone_otp.requested', {
+            userId: account.id,
+            ip: null,
+            userAgent: null,
+        });
+    });
+    it('anti-enumeration: unknown phone returns the success shape, writes no row, and sends no SMS', async () => {
+        const { svc, events, sms } = build();
+        const out = await svc.requestOtp({ phone: PHONE, ...NO_CLIENT_META });
+        expect(out).toEqual({ expiresAt: expect.any(String), resendAfter: expect.any(String) });
+        expect(sms.sendOtp).not.toHaveBeenCalled();
+        expect(events.emit).not.toHaveBeenCalled();
+        expect(await otpRows()).toHaveLength(0);
+    });
+    it('anti-enumeration: unverified phone returns the success shape and writes no row', async () => {
+        await seedUser({ phoneVerified: false });
+        const { svc, sms } = build();
+        const out = await svc.requestOtp({ phone: PHONE, ...NO_CLIENT_META });
+        expect(out).toEqual({ expiresAt: expect.any(String), resendAfter: expect.any(String) });
+        expect(sms.sendOtp).not.toHaveBeenCalled();
+        expect(await otpRows()).toHaveLength(0);
+    });
+    it('anti-enumeration: unknown phone requested twice within 60s throws OtpCooldownError, mirroring a real resend', async () => {
+        const { svc, sms } = build({ cache: realCache() });
+        await svc.requestOtp({ phone: PHONE, ...NO_CLIENT_META });
+        await expect(svc.requestOtp({ phone: PHONE, ...NO_CLIENT_META })).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+        expect(sms.sendOtp).not.toHaveBeenCalled();
+    });
+    it('throws OtpCooldownError when a code was sent under 60s ago, leaving the stored code untouched', async () => {
+        const account = await seedUser();
+        const existing = await seedOtp(account.id, { createdAt: new Date(Date.now() - 10_000) });
+        const { svc, sms } = build();
+        await expect(svc.requestOtp({ phone: PHONE, ...NO_CLIENT_META })).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+        expect(sms.sendOtp).not.toHaveBeenCalled();
+        const [row] = await otpRows();
+        expect(row.codeHash).toBe(existing.codeHash);
+    });
+    it('supersedes an expired-cooldown prior OTP in place and emits cancelled(new_otp_requested)', async () => {
+        const account = await seedUser();
+        const prior = await seedOtp(account.id, {
+            createdAt: new Date(Date.now() - 120_000),
+            failedAttempts: 3,
+        });
+        const { svc, events, sms } = build();
+        await svc.requestOtp({ phone: PHONE, ...NO_CLIENT_META });
+        expect(events.emit).toHaveBeenCalledWith('identity.phone_otp.cancelled', {
+            userId: account.id,
+            reason: 'new_otp_requested',
+            ip: null,
+            userAgent: null,
+        });
+        expect(sms.sendOtp).toHaveBeenCalled();
+        const rows = await otpRows();
+        expect(rows).toHaveLength(1);
+        expect(rows[0].codeHash).not.toBe(prior.codeHash);
+        expect(rows[0].failedAttempts).toBe(0);
+    });
+});
+describe('PhoneLoginService.verifyOtp (real PG + real Redis)', () => {
+    it('rejects a correct OTP while the account lockout is active', async () => {
+        const account = await seedUser({
+            failedLoginAttempts: 5,
+            lockoutUntil: new Date(Date.now() + 60_000),
+        });
+        await seedOtp(account.id);
+        const { svc } = build();
+        await expect(svc.verifyOtp({ phone: PHONE, code: '123456', ...NO_CLIENT_META }, new Headers())).rejects.toMatchObject({
+            data: { code: 'ACCOUNT_LOCKED', attemptsRemaining: 0, lockoutUntil: expect.any(String) },
+        });
+        expect(await sessionRows()).toHaveLength(0);
+    });
+    it('happy path: correct code mints a session row, consumes the OTP, and emits phone_login', async () => {
+        const code = '123456';
+        const account = await seedUser();
+        await seedOtp(account.id, { codeHash: hash(code) });
+        const { svc, events } = build();
+        const out = await svc.verifyOtp({ phone: PHONE, code, ...NO_CLIENT_META }, new Headers());
+        expect(out.user.id).toBe(account.id);
+        expect(out.session.token).toEqual(expect.any(String));
+        const sessions = await sessionRows();
+        expect(sessions).toHaveLength(1);
+        expect(sessions[0]).toMatchObject({ userId: account.id, token: out.session.token });
+        expect(new Date(out.session.expiresAt).toISOString()).toBe(sessions[0].expiresAt.toISOString());
+        expect(await otpRows()).toHaveLength(0);
+        expect(events.emit).toHaveBeenCalledWith('identity.user.phone_login', expect.objectContaining({ userId: account.id, method: 'phone' }));
+    });
+    it('signs a session cookie the same auth instance can verify', async () => {
+        const code = '123456';
+        const account = await seedUser();
+        await seedOtp(account.id, { codeHash: hash(code) });
+        const { svc } = build();
+        const resHeaders = new Headers();
+        const out = await svc.verifyOtp({ phone: PHONE, code, ...NO_CLIENT_META }, resHeaders);
+        const setCookie = resHeaders.get('set-cookie');
+        expect(setCookie).not.toBeNull();
+        expect(setCookie).toContain(`${SESSION_COOKIE_NAME}=`);
+        expect(setCookie).toContain('HttpOnly');
+        expect(setCookie).not.toContain('Max-Age');
+        const cookieValue = decodeURIComponent(setCookie?.split(';')[0]?.split('=').slice(1).join('=') ?? '');
+        const sigPos = cookieValue.lastIndexOf('.');
+        expect(cookieValue.slice(0, sigPos)).toBe(out.session.token);
+        expect(cookieValue.slice(sigPos + 1)).toBe(expectedSignature(out.session.token));
+    });
+    it('without rememberMe emits a signed dont_remember cookie so getSession will not roll the session to 30 days', async () => {
+        const code = '123456';
+        const account = await seedUser();
+        await seedOtp(account.id, { codeHash: hash(code) });
+        const { svc } = build();
+        const resHeaders = new Headers();
+        await svc.verifyOtp({ phone: PHONE, code, ...NO_CLIENT_META }, resHeaders);
+        const dontRemember = resHeaders
+            .getSetCookie()
+            .find((c) => c.startsWith(`${DONT_REMEMBER_COOKIE_NAME}=`));
+        expect(dontRemember).toBeDefined();
+        expect(dontRemember).not.toContain('Max-Age');
+        const value = decodeURIComponent(dontRemember?.split(';')[0]?.split('=').slice(1).join('=') ?? '');
+        const sigPos = value.lastIndexOf('.');
+        expect(value.slice(0, sigPos)).toBe('true');
+        expect(value.slice(sigPos + 1)).toBe(expectedSignature('true'));
+    });
+    it('rememberMe extends the persisted session TTL to ~30 days and the cookie Max-Age to match', async () => {
+        const code = '123456';
+        const account = await seedUser();
+        await seedOtp(account.id, { codeHash: hash(code) });
+        const { svc } = build();
+        const resHeaders = new Headers();
+        await svc.verifyOtp({ phone: PHONE, code, rememberMe: true, ...NO_CLIENT_META }, resHeaders);
+        const [stored] = await sessionRows();
+        expect(stored.expiresAt.getTime() - Date.now()).toBeGreaterThan(29 * 24 * 60 * 60 * 1000);
+        const maxAgeMatch = resHeaders.get('set-cookie')?.match(/Max-Age=(\d+)/);
+        expect(Number(maxAgeMatch?.[1])).toBeGreaterThan(29 * 24 * 60 * 60);
+        const hasDontRemember = resHeaders
+            .getSetCookie()
+            .some((c) => c.startsWith(`${DONT_REMEMBER_COOKIE_NAME}=`));
+        expect(hasDontRemember).toBe(false);
+    });
+    it('wrong code increments failedAttempts in the row and throws OtpInvalidError with reason "wrong_code"', async () => {
+        const account = await seedUser();
+        await seedOtp(account.id, { codeHash: hash('000000'), failedAttempts: 1 });
+        const { svc, events } = build();
+        const promise = svc.verifyOtp({ phone: PHONE, code: '111111', ...NO_CLIENT_META }, new Headers());
+        await expect(promise).rejects.toBeInstanceOf(ORPCError);
+        await expect(promise).rejects.toMatchObject({
+            code: 'UNPROCESSABLE_CONTENT',
+            data: { attemptsRemaining: 3, reason: 'wrong_code' },
+        });
+        const [row] = await otpRows();
+        expect(row.failedAttempts).toBe(2);
+        expect(events.emit).not.toHaveBeenCalledWith('identity.phone_otp.cancelled', expect.anything());
+    });
+    it('concurrent wrong guesses each consume exactly one attempt (atomic SQL increment)', async () => {
+        const account = await seedUser();
+        await seedOtp(account.id, { codeHash: hash('000000') });
+        const { svc } = build();
+        const attempts = await Promise.allSettled(Array.from({ length: 3 }, () => svc.verifyOtp({ phone: PHONE, code: '111111', ...NO_CLIENT_META }, new Headers())));
+        expect(attempts.every((a) => a.status === 'rejected')).toBe(true);
+        const [row] = await otpRows();
+        expect(row.failedAttempts).toBe(3);
+    });
+    it('5th wrong code deletes the session row and emits cancelled(max_attempts)', async () => {
+        const account = await seedUser();
+        await seedOtp(account.id, { codeHash: hash('000000'), failedAttempts: 4 });
+        const { svc, events } = build();
+        await expect(svc.verifyOtp({ phone: PHONE, code: '111111', ...NO_CLIENT_META }, new Headers())).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        expect(await otpRows()).toHaveLength(0);
+        expect(events.emit).toHaveBeenCalledWith('identity.phone_otp.cancelled', {
+            userId: account.id,
+            reason: 'max_attempts',
+            ip: null,
+            userAgent: null,
+        });
+    });
+    it('expired OTP throws OtpInvalidError with reason "expired", not "wrong_code"', async () => {
+        const code = '123456';
+        const account = await seedUser();
+        await seedOtp(account.id, {
+            codeHash: hash(code),
+            expiresAt: new Date(Date.now() - 1000),
+            failedAttempts: 2,
+        });
+        const { svc } = build();
+        await expect(svc.verifyOtp({ phone: PHONE, code, ...NO_CLIENT_META }, new Headers())).rejects.toMatchObject({
+            code: 'UNPROCESSABLE_CONTENT',
+            data: { attemptsRemaining: 3, reason: 'expired' },
+        });
+    });
+    it('missing OTP session (anti-enumeration) mimics a real first wrong guess, not "expired"', async () => {
+        const { svc } = build();
+        await expect(svc.verifyOtp({ phone: PHONE, code: '123456', ...NO_CLIENT_META }, new Headers())).rejects.toMatchObject({
+            code: 'UNPROCESSABLE_CONTENT',
+            data: { attemptsRemaining: 4, reason: 'wrong_code' },
+        });
+    });
+    it('anti-enumeration: repeated wrong guesses against an unknown phone decrement then cancel, mirroring a real session', async () => {
+        const { svc, events } = build({ cache: realCache() });
+        await svc.requestOtp({ phone: PHONE, ...NO_CLIENT_META });
+        for (const expected of [4, 3, 2, 1]) {
+            await expect(svc.verifyOtp({ phone: PHONE, code: 'wrong', ...NO_CLIENT_META }, new Headers())).rejects.toMatchObject({
+                code: 'UNPROCESSABLE_CONTENT',
+                data: { attemptsRemaining: expected, reason: 'wrong_code' },
+            });
+        }
+        await expect(svc.verifyOtp({ phone: PHONE, code: 'wrong', ...NO_CLIENT_META }, new Headers())).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        expect(events.emit).not.toHaveBeenCalled();
+        expect(await otpRows()).toHaveLength(0);
+    });
+    it('anti-enumeration: an untouched shadow past the OTP TTL returns "expired", not "wrong_code"', async () => {
+        vi.useFakeTimers({ toFake: ['Date'] });
+        try {
+            const { svc } = build({ cache: realCache() });
+            await svc.requestOtp({ phone: PHONE, ...NO_CLIENT_META });
+            vi.setSystemTime(Date.now() + OTP_TTL_MS + 1);
+            await expect(svc.verifyOtp({ phone: PHONE, code: 'wrong', ...NO_CLIENT_META }, new Headers())).rejects.toMatchObject({
+                code: 'UNPROCESSABLE_CONTENT',
+                data: { attemptsRemaining: 5, reason: 'expired' },
+            });
+        }
+        finally {
+            vi.useRealTimers();
+        }
+    });
+    it('RG-blocked user is forbidden after the OTP passes, and neither the session nor the OTP is consumed', async () => {
+        const code = '123456';
+        const account = await seedUser({ rgBlocked: true, rgBlockedUntil: null });
+        await seedOtp(account.id, { codeHash: hash(code) });
+        const { svc, events } = build();
+        const resHeaders = new Headers();
+        await expect(svc.verifyOtp({ phone: PHONE, code, ...NO_CLIENT_META }, resHeaders)).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+            data: { reason: 'rg_blocked' },
+        });
+        expect(resHeaders.get('set-cookie')).toBeNull();
+        expect(await sessionRows()).toHaveLength(0);
+        expect(await otpRows()).toHaveLength(1);
+        expect(events.emit).toHaveBeenCalledWith('rg.exclusion.login_blocked', expect.objectContaining({ userId: account.id }));
+        expect(events.emit).not.toHaveBeenCalledWith('identity.user.phone_login', expect.anything());
+    });
+    it('suspended player is forbidden after the OTP passes, and neither the session nor the OTP is consumed', async () => {
+        const code = '123456';
+        const account = await seedUser();
+        await db.drizzle.db.insert(player).values({ userId: account.id, status: 'suspended' });
+        await seedOtp(account.id, { codeHash: hash(code) });
+        const { svc, events } = build();
+        const resHeaders = new Headers();
+        await expect(svc.verifyOtp({ phone: PHONE, code, ...NO_CLIENT_META }, resHeaders)).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+            data: { reason: 'account_suspended' },
+        });
+        expect(resHeaders.get('set-cookie')).toBeNull();
+        expect(await sessionRows()).toHaveLength(0);
+        expect(await otpRows()).toHaveLength(1);
+        expect(events.emit).toHaveBeenCalledWith('player.login_blocked', expect.objectContaining({ userId: account.id, status: 'suspended' }));
+        expect(events.emit).not.toHaveBeenCalledWith('identity.user.phone_login', expect.anything());
+    });
+});
+//# sourceMappingURL=phone-login.service.int.test.js.map

package/dist/pam/identity/__tests__/phone-login.service.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-login.service.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/phone-login.service.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,eAAe,EAGf,QAAQ,IAAI,UAAU,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAC1D,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAG9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE9E,MAAM,KAAK,GAAG,cAAc,CAAC;AAE7B,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AACxD,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAE9D,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjC,MAAM,QAAQ,GAAS,IAAI,CAAO;IAChC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;QACxB,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE;YACX,YAAY,EAAE;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,UAAU,EAAE;oBACV,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,GAAG;oBACT,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,UAAU,EAAE;oBACV,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,GAAG;iBACV;aACF;SACF;KACF,CAAC;CACH,CAAC,CAAC;AAEH,IAAI,EAAU,CAAC;AACf,IAAI,KAAgB,CAAC;AAErB,MAAM,YAAY,GAAG,GAAuB,EAAE,CAAC,CAAC;IAC9C,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACtE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;CACf,CAAC,CAAC;AAEH,SAAS,KAAK,CAAC,EACb,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,EACvD,KAAK,MACyC,EAAE;IAChD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,iBAAiB,CAAC;QAChC,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,MAAM,EAAE,MAAM;QACd,GAAG;QACH,OAAO,EAAE,YAAY,EAAE;QACvB,IAAI,EAAE,QAAQ;QACd,KAAK;KACN,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAErD,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,uDAAuD;AACvD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE/E,MAAM,QAAQ,GAAG,CAAC,OAA0C,EAAE,EAAE,EAAE,CAChE,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAElF,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,OAAmD,EAAE;IAC1F,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;SAC9B,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC;QACN,MAAM;QACN,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;QACxB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;QAC5C,GAAG,IAAI;KACR,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACjE,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAE/D,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3D,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAChB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CACzB,GAAG,CAAA,YAAY,IAAI,KAAK,OAAO,KAAK,aAAa,KAAK,MAAM,2BAA2B,CACxF,CAAC;IACF,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;IACnE,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAErC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAI,GAAG,CAAC,OAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QACpF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEpC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;YACxB,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;YACxB,cAAc,EAAE,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,8BAA8B,EAAE;YACvE,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC1G,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAErC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,QAAQ,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAE7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6GAA6G,EAAE,KAAK,IAAI,EAAE;QAC3H,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAEnD,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACtF,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;QAC7G,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACzF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAE7B,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACtF,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE;YACtC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACzC,cAAc,EAAE,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAErC,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,8BAA8B,EAAE;YACvE,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,MAAM,EAAE,mBAAmB;YAC3B,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC;YAC7B,mBAAmB,EAAE,CAAC;YACtB,YAAY,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAExB,MAAM,MAAM,CACV,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAClF,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;SACzF,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,IAAI,GAAG,QAAQ,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAEhC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;QAE1F,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAEtD,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,2BAA2B,EAC3B,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACjE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,IAAI,GAAG,QAAQ,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,OAAO,EAAE,CAAC;QAEjC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,EAAE,UAAU,CAAC,CAAC;QAEvF,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,mBAAmB,GAAG,CAAC,CAAC;QACvD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAE3C,MAAM,WAAW,GAAG,kBAAkB,CACpC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAC9D,CAAC;QACF,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2GAA2G,EAAE,KAAK,IAAI,EAAE;QACzH,MAAM,IAAI,GAAG,QAAQ,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,OAAO,EAAE,CAAC;QAEjC,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,EAAE,UAAU,CAAC,CAAC;QAE3E,MAAM,YAAY,GAAG,UAAU;aAC5B,YAAY,EAAE;aACd,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,yBAAyB,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAE9C,MAAM,KAAK,GAAG,kBAAkB,CAC9B,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CACjE,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,MAAM,IAAI,GAAG,QAAQ,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,OAAO,EAAE,CAAC;QAEjC,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,EAAE,UAAU,CAAC,CAAC;QAE7F,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1F,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAEpE,MAAM,eAAe,GAAG,UAAU;aAC/B,YAAY,EAAE;aACd,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,yBAAyB,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qGAAqG,EAAE,KAAK,IAAI,EAAE;QACnH,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAEhC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAC3B,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,EACnD,IAAI,OAAO,EAAE,CACd,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC1C,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE;SACrD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,8BAA8B,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CACvC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAC7B,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAClF,CACF,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAEhC,MAAM,MAAM,CACV,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAClF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAE/C,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,8BAA8B,EAAE;YACvE,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,MAAM,EAAE,cAAc;YACtB,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,IAAI,GAAG,QAAQ,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACtC,cAAc,EAAE,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAExB,MAAM,MAAM,CACV,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACxE,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE;SAClD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAExB,MAAM,MAAM,CACV,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAClF,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE;SACrD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mHAAmH,EAAE,KAAK,IAAI,EAAE;QACjI,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAEtD,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC;QAE1D,KAAK,MAAM,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,CACV,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACjF,CAAC,OAAO,CAAC,aAAa,CAAC;gBACtB,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,CACV,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACjF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAE/C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC1G,EAAE,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAE9C,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC;YAC1D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC;YAE9C,MAAM,MAAM,CACV,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACjF,CAAC,OAAO,CAAC,aAAa,CAAC;gBACtB,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,aAAa,EAAE,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oGAAoG,EAAE,KAAK,IAAI,EAAE;QAClH,MAAM,IAAI,GAAG,QAAQ,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,OAAO,EAAE,CAAC;QAEjC,MAAM,MAAM,CACV,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,EAAE,UAAU,CAAC,CACrE,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;SAC/B,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,4BAA4B,EAC5B,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,2BAA2B,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qGAAqG,EAAE,KAAK,IAAI,EAAE;QACnH,MAAM,IAAI,GAAG,QAAQ,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;QACjC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACvF,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,OAAO,EAAE,CAAC;QAEjC,MAAM,MAAM,CACV,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,EAAE,UAAU,CAAC,CACrE,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;SACtC,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,sBAAsB,EACtB,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CACrE,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,2BAA2B,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/play-eligibility.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=play-eligibility.test.d.ts.map

package/dist/pam/identity/__tests__/play-eligibility.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"play-eligibility.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/play-eligibility.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/play-eligibility.test.js

@@ -0,0 +1,30 @@
+import { describe, it, expect } from 'vitest';
+import { makeDrizzle } from '../../../testing/mock.js';
+import { PlayEligibilityService } from '../service/play-eligibility.service.js';
+const HOUR_MS = 60 * 60 * 1000;
+function serviceFor(rows) {
+    return new PlayEligibilityService(makeDrizzle({ select: [rows] }));
+}
+describe('PlayEligibilityService', () => {
+    it('reports an indefinitely blocked player as restricted', async () => {
+        const svc = serviceFor([{ rgBlocked: true, rgBlockedUntil: null }]);
+        await expect(svc.isRestricted('user-1')).resolves.toBe(true);
+    });
+    it('reports a cooling-off still in its window as restricted', async () => {
+        const svc = serviceFor([{ rgBlocked: true, rgBlockedUntil: new Date(Date.now() + HOUR_MS) }]);
+        await expect(svc.isRestricted('user-1')).resolves.toBe(true);
+    });
+    it('reports an elapsed cooling-off as unrestricted before the expiry sweep runs', async () => {
+        const svc = serviceFor([{ rgBlocked: true, rgBlockedUntil: new Date(Date.now() - HOUR_MS) }]);
+        await expect(svc.isRestricted('user-1')).resolves.toBe(false);
+    });
+    it('reports an unblocked player as unrestricted', async () => {
+        const svc = serviceFor([{ rgBlocked: false, rgBlockedUntil: null }]);
+        await expect(svc.isRestricted('user-1')).resolves.toBe(false);
+    });
+    it('fails closed for an unknown user', async () => {
+        const svc = serviceFor([]);
+        await expect(svc.isRestricted('ghost')).resolves.toBe(true);
+    });
+});
+//# sourceMappingURL=play-eligibility.test.js.map

package/dist/pam/identity/__tests__/play-eligibility.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"play-eligibility.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/play-eligibility.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEhF,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/B,SAAS,UAAU,CAAC,IAA+B;IACjD,OAAO,IAAI,sBAAsB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEpE,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAE9F,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAE9F,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAErE,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3B,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/rg-guard.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rg-guard.test.d.ts.map

package/dist/pam/identity/__tests__/rg-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rg-guard.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/rg-guard.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/rg-guard.test.js

@@ -0,0 +1,21 @@
+import { describe, it, expect } from 'vitest';
+import { isRgBlocked } from '../service/rg-guard.service.js';
+const HOUR = 3600_000;
+describe('isRgBlocked', () => {
+    it('lets an unblocked player through', () => {
+        expect(isRgBlocked({ rgBlocked: false, rgBlockedUntil: null })).toBe(false);
+    });
+    it('blocks indefinitely when no expiry is set', () => {
+        expect(isRgBlocked({ rgBlocked: true, rgBlockedUntil: null })).toBe(true);
+    });
+    it('blocks while the exclusion is still running', () => {
+        expect(isRgBlocked({ rgBlocked: true, rgBlockedUntil: new Date(Date.now() + HOUR) })).toBe(true);
+    });
+    it('releases the player once the exclusion has expired', () => {
+        expect(isRgBlocked({ rgBlocked: true, rgBlockedUntil: new Date(Date.now() - HOUR) })).toBe(false);
+    });
+    it('ignores a stale expiry when the flag itself is off', () => {
+        expect(isRgBlocked({ rgBlocked: false, rgBlockedUntil: new Date(Date.now() + HOUR) })).toBe(false);
+    });
+});
+//# sourceMappingURL=rg-guard.test.js.map

package/dist/pam/identity/__tests__/rg-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rg-guard.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/rg-guard.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAE7D,MAAM,IAAI,GAAG,QAAQ,CAAC;AAEtB,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CACxF,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CACxF,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CACzF,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/session.service.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session.service.int.test.d.ts.map

package/dist/pam/identity/__tests__/session.service.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.service.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/session.service.int.test.ts"],"names":[],"mappings":""}