@openora/core 0.4.0

package/dist/pam/identity/adapters/identity-reader.service.d.ts

@@ -0,0 +1,10 @@
+import { DrizzleService } from '@openora/core/server';
+import { Player, type IdentityReader } from '@openora/core/contracts';
+export declare class IdentityReaderService implements IdentityReader {
+    private readonly drizzle;
+    constructor(drizzle: DrizzleService);
+    getLastLoginAt(userId: Player['id']): Promise<Date | null>;
+    getPlayerIdsInactiveSince(sinceDate: Date): Promise<string[]>;
+    getPlayerIdByUserId(userId: string): Promise<string | null>;
+}
+//# sourceMappingURL=identity-reader.service.d.ts.map

package/dist/pam/identity/adapters/identity-reader.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-reader.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/adapters/identity-reader.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAKtE,qBAAa,qBAAsB,YAAW,cAAc;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAE9C,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQ1D,yBAAyB,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAyB7D,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAQlE"}

package/dist/pam/identity/adapters/identity-reader.service.js

@@ -0,0 +1,40 @@
+import { and, eq, isNull, lt, max, or } from 'drizzle-orm';
+import { session, user } from '../schema/index.js';
+import { player } from '@openora/core/pam/schema/profile';
+export class IdentityReaderService {
+    drizzle;
+    constructor(drizzle) {
+        this.drizzle = drizzle;
+    }
+    async getLastLoginAt(userId) {
+        const [row] = await this.drizzle.db
+            .select({ lastAt: max(session.createdAt) })
+            .from(session)
+            .where(eq(session.userId, userId));
+        return row?.lastAt ?? null;
+    }
+    async getPlayerIdsInactiveSince(sinceDate) {
+        // Join users to their most-recent session. Players with no session at all
+        // (registered but never logged in) are included via the LEFT JOIN + isNull check.
+        const lastSessionPerUser = this.drizzle.db
+            .select({ userId: session.userId, lastAt: max(session.createdAt).as('last_at') })
+            .from(session)
+            .groupBy(session.userId)
+            .as('s');
+        const rows = await this.drizzle.db
+            .select({ userId: user.id })
+            .from(user)
+            .leftJoin(lastSessionPerUser, eq(user.id, lastSessionPerUser.userId))
+            .where(and(eq(user.role, 'player'), or(and(isNull(lastSessionPerUser.lastAt), lt(user.createdAt, sinceDate)), lt(lastSessionPerUser.lastAt, sinceDate))));
+        return rows.map((r) => r.userId);
+    }
+    async getPlayerIdByUserId(userId) {
+        const [row] = await this.drizzle.db
+            .select({ id: player.id })
+            .from(player)
+            .where(eq(player.userId, userId))
+            .limit(1);
+        return row?.id ?? null;
+    }
+}
+//# sourceMappingURL=identity-reader.service.js.map

package/dist/pam/identity/adapters/identity-reader.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-reader.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/adapters/identity-reader.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAE1D,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAExD,KAAK,CAAC,cAAc,CAAC,MAAoB;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;aAC1C,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACrC,OAAO,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,SAAe;QAC7C,0EAA0E;QAC1E,kFAAkF;QAClF,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;aACvC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;aAChF,IAAI,CAAC,OAAO,CAAC;aACb,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;aACvB,EAAE,CAAC,GAAG,CAAC,CAAC;QAEX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAC3B,IAAI,CAAC,IAAI,CAAC;aACV,QAAQ,CAAC,kBAAkB,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;aACpE,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EACvB,EAAE,CACA,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EACrE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CACzC,CACF,CACF,CAAC;QACJ,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aACzB,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aAChC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC;IACzB,CAAC;CACF"}

package/dist/pam/identity/adapters/mock/mock-kyc-adapter.d.ts

@@ -0,0 +1,7 @@
+import type { KycAdapter, KycDocument, KycResult, KycVendorStatus } from '@openora/core/contracts';
+export declare class MockKycAdapter implements KycAdapter {
+    readonly autoApproves = true;
+    submit(userId: string, _docs: KycDocument[]): Promise<KycResult>;
+    getStatus(_userId: string): Promise<KycVendorStatus>;
+}
+//# sourceMappingURL=mock-kyc-adapter.d.ts.map

package/dist/pam/identity/adapters/mock/mock-kyc-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-kyc-adapter.d.ts","sourceRoot":"","sources":["../../../../../src/pam/identity/adapters/mock/mock-kyc-adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEnG,qBAAa,cAAe,YAAW,UAAU;IAC/C,QAAQ,CAAC,YAAY,QAAQ;IAEvB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAIhE,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;CAG3D"}

package/dist/pam/identity/adapters/mock/mock-kyc-adapter.js

@@ -0,0 +1,10 @@
+export class MockKycAdapter {
+    autoApproves = true;
+    async submit(userId, _docs) {
+        return { referenceId: `mock-${userId}`, status: 'approved' };
+    }
+    async getStatus(_userId) {
+        return 'approved';
+    }
+}
+//# sourceMappingURL=mock-kyc-adapter.js.map

package/dist/pam/identity/adapters/mock/mock-kyc-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-kyc-adapter.js","sourceRoot":"","sources":["../../../../../src/pam/identity/adapters/mock/mock-kyc-adapter.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,cAAc;IAChB,YAAY,GAAG,IAAI,CAAC;IAE7B,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,KAAoB;QAC/C,OAAO,EAAE,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/pam/identity/admin-user-directory.d.ts

@@ -0,0 +1,53 @@
+import type { AdminUserDirectory, AdminUserListOptions } from '@openora/core/contracts';
+import { DrizzleService } from '@openora/core/server';
+import type { EventBus } from '@openora/core/server';
+export declare class DrizzleAdminUserDirectory implements AdminUserDirectory {
+    private readonly drizzle;
+    private readonly events;
+    constructor(drizzle: DrizzleService, events: EventBus);
+    count(): Promise<number>;
+    list({ page, limit, search }: AdminUserListOptions): Promise<{
+        rows: {
+            id: string;
+            email: string;
+            name: string;
+            createdAt: Date;
+            isActive: boolean;
+            role: "admin" | "player";
+            failedLoginAttempts: number;
+            lockoutUntil: Date | null;
+        }[];
+        total: number;
+    }>;
+    get(id: string): Promise<{
+        id: string;
+        email: string;
+        name: string;
+        createdAt: Date;
+        isActive: boolean;
+        role: "admin" | "player";
+        failedLoginAttempts: number;
+        lockoutUntil: Date | null;
+    } | null>;
+    update(id: string, patch: {
+        isActive?: boolean;
+        role?: string;
+    }, actorId: string): Promise<{
+        id: string;
+        email: string;
+        name: string;
+        createdAt: Date;
+        isActive: boolean;
+        role: "admin" | "player";
+        failedLoginAttempts: number;
+        lockoutUntil: Date | null;
+    } | null>;
+    lookupPlayers(userIds: readonly string[]): Promise<{
+        userId: string;
+        username: string;
+        email: string;
+        kycStatus: "pending" | "not_started" | "verified" | "rejected" | "resubmission_requested" | "manually_overridden" | null;
+    }[]>;
+    findPlayerIds(query: string): Promise<string[]>;
+}
+//# sourceMappingURL=admin-user-directory.d.ts.map

package/dist/pam/identity/admin-user-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-directory.d.ts","sourceRoot":"","sources":["../../../src/pam/identity/admin-user-directory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAExF,OAAO,EAAE,cAAc,EAAgB,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAuBrD,qBAAa,yBAA0B,YAAW,kBAAkB;IAEhE,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,QAAQ;IAG7B,KAAK;IAKL,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,oBAAoB;;;;;;;;;;;;;IAgBlD,GAAG,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;IAKd,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,MAAM;;;;;;;;;;IAkBhF,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE;;;;;;IA4BxC,aAAa,CAAC,KAAK,EAAE,MAAM;CAgBlC"}

package/dist/pam/identity/admin-user-directory.js

@@ -0,0 +1,122 @@
+import { KycStatusSchema, UserRoleSchema } from '@openora/core/contracts';
+import { pageToOffset } from '@openora/core/server';
+import { count, desc, eq, ilike, inArray } from 'drizzle-orm';
+import { user } from './schema/index.js';
+// Read-only cross-domain read of the player/profile table via the public /schema
+// subpath (allowed per ADR-0020) so back-office lists can label players by
+// username + KYC without leaking the schema to the consumer module.
+import { player } from '@openora/core/pam/schema/profile';
+// Identity owns the `user` table, so it owns the admin directory port.
+// admin-console depends only on ADMIN_USER_DIRECTORY - never on this schema. See ADR-0017/0025.
+function toRow(r) {
+    return {
+        id: r.id,
+        email: r.email,
+        name: r.name ?? null,
+        createdAt: r.createdAt,
+        isActive: r.isActive,
+        role: UserRoleSchema.parse(r.role),
+        failedLoginAttempts: r.failedLoginAttempts,
+        lockoutUntil: r.lockoutUntil,
+    };
+}
+export class DrizzleAdminUserDirectory {
+    drizzle;
+    events;
+    constructor(drizzle, events) {
+        this.drizzle = drizzle;
+        this.events = events;
+    }
+    async count() {
+        const [r] = await this.drizzle.db.select({ n: count() }).from(user);
+        return Number(r?.n ?? 0);
+    }
+    async list({ page, limit, search }) {
+        const db = this.drizzle.db;
+        const where = search ? ilike(user.email, `%${search}%`) : undefined;
+        const [rows, [{ n }]] = await Promise.all([
+            db
+                .select()
+                .from(user)
+                .where(where)
+                .orderBy(desc(user.createdAt))
+                .limit(limit)
+                .offset(pageToOffset(page, limit)),
+            db.select({ n: count() }).from(user).where(where),
+        ]);
+        return { rows: rows.map(toRow), total: Number(n) };
+    }
+    async get(id) {
+        const [r] = await this.drizzle.db.select().from(user).where(eq(user.id, id));
+        return r ? toRow(r) : null;
+    }
+    async update(id, patch, actorId) {
+        const [existing] = await this.drizzle.db.select().from(user).where(eq(user.id, id));
+        if (!existing)
+            return null;
+        const set = {};
+        if (patch.isActive !== undefined)
+            set.isActive = patch.isActive;
+        if (patch.role !== undefined)
+            set.role = patch.role;
+        const [r] = await this.drizzle.db.update(user).set(set).where(eq(user.id, id)).returning();
+        if (!r)
+            return null;
+        // Emit only on an actual active-status flip, after the commit. Literal topics
+        // (not a ternary) so the catalog generator's emit-scanner picks them up.
+        if (patch.isActive !== undefined && patch.isActive !== existing.isActive) {
+            if (patch.isActive)
+                this.events.emit('identity.user.reactivated', { userId: id, actorId });
+            else
+                this.events.emit('identity.user.deactivated', { userId: id, actorId });
+        }
+        return toRow(r);
+    }
+    async lookupPlayers(userIds) {
+        if (userIds.length === 0)
+            return [];
+        const rows = await this.drizzle.db
+            .select({
+            userId: player.userId,
+            username: player.displayName,
+            kycStatus: player.kycStatus,
+            email: user.email,
+        })
+            .from(player)
+            .innerJoin(user, eq(player.userId, user.id))
+            .where(inArray(player.userId, [...userIds]));
+        return rows.map((r) => {
+            // The player table stores kycStatus as free text; coerce unknown values to null
+            // so the port's KycStatus contract holds without a cast.
+            const kyc = KycStatusSchema.safeParse(r.kycStatus);
+            return {
+                userId: r.userId,
+                username: r.username,
+                email: r.email,
+                kycStatus: kyc.success ? kyc.data : null,
+            };
+        });
+    }
+    // Substring search is index-backed by the pg_trgm GIN indexes on user.email and
+    // player.display_name; the 1000 cap is a safety bound on the id set, not a perf
+    // crutch - it is effectively unreachable for a real admin search term.
+    async findPlayerIds(query) {
+        const term = `%${query}%`;
+        const cap = 1000;
+        const [byEmail, byName] = await Promise.all([
+            this.drizzle.db.select({ id: user.id }).from(user).where(ilike(user.email, term)).limit(cap),
+            this.drizzle.db
+                .select({ userId: player.userId })
+                .from(player)
+                .where(ilike(player.displayName, term))
+                .limit(cap),
+        ]);
+        const ids = new Set();
+        for (const r of byEmail)
+            ids.add(r.id);
+        for (const r of byName)
+            ids.add(r.userId);
+        return [...ids].slice(0, cap);
+    }
+}
+//# sourceMappingURL=admin-user-directory.js.map

package/dist/pam/identity/admin-user-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-directory.js","sourceRoot":"","sources":["../../../src/pam/identity/admin-user-directory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAkB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,iFAAiF;AACjF,2EAA2E;AAC3E,oEAAoE;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAE1D,uEAAuE;AACvE,gGAAgG;AAChG,SAAS,KAAK,CAAC,CAA2B;IACxC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAClC,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,YAAY,EAAE,CAAC,CAAC,YAAY;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,yBAAyB;IAEjB;IACA;IAFnB,YACmB,OAAuB,EACvB,MAAgB;QADhB,YAAO,GAAP,OAAO,CAAgB;QACvB,WAAM,GAAN,MAAM,CAAU;IAChC,CAAC;IAEJ,KAAK,CAAC,KAAK;QACT,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAwB;QACtD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxC,EAAE;iBACC,MAAM,EAAE;iBACR,IAAI,CAAC,IAAI,CAAC;iBACV,KAAK,CAAC,KAAK,CAAC;iBACZ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBAC7B,KAAK,CAAC,KAAK,CAAC;iBACZ,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAA4C,EAAE,OAAe;QACpF,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAsC,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC3F,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpB,8EAA8E;QAC9E,yEAAyE;QACzE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,QAAQ;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;;gBACtF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAA0B;QAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAC/B,MAAM,CAAC;YACN,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;aACD,IAAI,CAAC,MAAM,CAAC;aACZ,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;aAC3C,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACpB,gFAAgF;YAChF,yDAAyD;YACzD,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnD,OAAO;gBACL,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;aACzC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,uEAAuE;IACvE,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,IAAI,GAAG,IAAI,KAAK,GAAG,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC;QACjB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YAC5F,IAAI,CAAC,OAAO,CAAC,EAAE;iBACZ,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;iBACjC,IAAI,CAAC,MAAM,CAAC;iBACZ,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;iBACtC,KAAK,CAAC,GAAG,CAAC;SACd,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/pam/identity/contract/index.d.ts

@@ -0,0 +1,188 @@
+import * as z from 'zod';
+export declare const SessionItemSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    expiresAt: z.ZodISODateTime;
+    createdAt: z.ZodISODateTime;
+    ipAddress: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    userAgent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type SessionItem = z.infer<typeof SessionItemSchema>;
+export declare const identityContract: {
+    register: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        email: z.ZodEmail;
+        password: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        user: z.ZodObject<{
+            id: z.ZodUUID;
+            email: z.ZodEmail;
+            name: z.ZodString;
+            emailVerified: z.ZodBoolean;
+            image: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
+            theme: z.ZodEnum<{
+                light: "light";
+                dark: "dark";
+                system: "system";
+            }>;
+            language: z.ZodString;
+            createdAt: z.ZodISODateTime;
+            updatedAt: z.ZodISODateTime;
+        }, z.core.$strip>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    login: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        email: z.ZodEmail;
+        password: z.ZodString;
+        rememberMe: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>, z.ZodObject<{
+        user: z.ZodOptional<z.ZodObject<{
+            id: z.ZodUUID;
+            email: z.ZodEmail;
+            name: z.ZodString;
+            emailVerified: z.ZodBoolean;
+            image: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
+            theme: z.ZodEnum<{
+                light: "light";
+                dark: "dark";
+                system: "system";
+            }>;
+            language: z.ZodString;
+            createdAt: z.ZodISODateTime;
+            updatedAt: z.ZodISODateTime;
+        }, z.core.$strip>>;
+        session: z.ZodOptional<z.ZodObject<{
+            token: z.ZodString;
+            expiresAt: z.ZodISODateTime;
+        }, z.core.$strip>>;
+        twoFactorRedirect: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    logout: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, z.ZodObject<{
+        success: z.ZodLiteral<true>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    me: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodEmail;
+        name: z.ZodString;
+        emailVerified: z.ZodBoolean;
+        image: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
+        theme: z.ZodEnum<{
+            light: "light";
+            dark: "dark";
+            system: "system";
+        }>;
+        language: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        updatedAt: z.ZodISODateTime;
+    }, z.core.$strip>>, Record<never, never>, Record<never, never>>;
+    streamSession: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, import("@orpc/contract").Schema<AsyncIteratorObject<{
+        type: "revoked";
+    }, unknown, void>, import("@orpc/contract").AsyncIteratorClass<{
+        type: "revoked";
+    }, unknown, void>>, Record<never, never>, Record<never, never>>;
+    enable2fa: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        password: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        totpUri: z.ZodString;
+        backupCodes: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    verify2fa: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        code: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        success: z.ZodLiteral<true>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    disable2fa: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        password: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        success: z.ZodLiteral<true>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    requestPasswordReset: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        email: z.ZodEmail;
+    }, z.core.$strip>, z.ZodObject<{
+        success: z.ZodLiteral<true>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    resetPassword: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        token: z.ZodString;
+        newPassword: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        success: z.ZodLiteral<true>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    changePassword: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        currentPassword: z.ZodString;
+        newPassword: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        success: z.ZodLiteral<true>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    sendEmailVerification: import("@orpc/contract").ContractProcedureBuilderWithOutput<import("@orpc/contract").Schema<unknown, unknown>, z.ZodObject<{
+        success: z.ZodLiteral<true>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    verifyEmail: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        token: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        success: z.ZodLiteral<true>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    changeEmail: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        newEmail: z.ZodEmail;
+    }, z.core.$strip>, z.ZodObject<{
+        success: z.ZodLiteral<true>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    updateProfile: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        image: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
+        theme: z.ZodOptional<z.ZodEnum<{
+            light: "light";
+            dark: "dark";
+            system: "system";
+        }>>;
+        language: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        user: z.ZodObject<{
+            id: z.ZodUUID;
+            email: z.ZodEmail;
+            name: z.ZodString;
+            emailVerified: z.ZodBoolean;
+            image: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
+            theme: z.ZodEnum<{
+                light: "light";
+                dark: "dark";
+                system: "system";
+            }>;
+            language: z.ZodString;
+            createdAt: z.ZodISODateTime;
+            updatedAt: z.ZodISODateTime;
+        }, z.core.$strip>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    unlockUser: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        userId: z.ZodUUID;
+    }, z.core.$strip>, z.ZodObject<{
+        success: z.ZodLiteral<true>;
+    }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    sessions: {
+        list: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+            limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+            userId: z.ZodUUID;
+        }, z.core.$strip>, z.ZodObject<{
+            items: z.ZodArray<z.ZodObject<{
+                id: z.ZodUUID;
+                expiresAt: z.ZodISODateTime;
+                createdAt: z.ZodISODateTime;
+                ipAddress: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                userAgent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            }, z.core.$strip>>;
+            total: z.ZodNumber;
+            page: z.ZodNumber;
+            limit: z.ZodNumber;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+        revoke: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            userId: z.ZodUUID;
+            id: z.ZodUUID;
+        }, z.core.$strip>, z.ZodObject<{
+            success: z.ZodLiteral<true>;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+        revokeAll: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            userId: z.ZodUUID;
+        }, z.core.$strip>, z.ZodObject<{
+            success: z.ZodLiteral<true>;
+        }, z.core.$strip>, Record<never, never>, Record<never, never>>;
+    };
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/pam/identity/contract/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/contract/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAOzB,eAAO,MAAM,iBAAiB;;;;;;iBAM5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgG5B,CAAC"}

package/dist/pam/identity/contract/index.js

@@ -0,0 +1,93 @@
+import { oc, eventIterator } from '@orpc/contract';
+import { UserSchema, UuidSchema, LoginInputSchema, RegisterInputSchema, Enable2faInputSchema, Enable2faResultSchema, Verify2faInputSchema, Disable2faInputSchema, RequestPasswordResetInputSchema, ResetPasswordInputSchema, VerifyEmailInputSchema, UpdateProfileInputSchema, ChangePasswordInputSchema, ChangeEmailInputSchema, IdentitySuccessSchema, TimestampSchema, } from '@openora/core/contracts';
+import { PageQuerySchema, paginated } from '@openora/core/contracts/kit';
+import * as z from 'zod';
+const SessionSchema = z.object({
+    token: z.string(),
+    expiresAt: TimestampSchema,
+});
+export const SessionItemSchema = z.object({
+    id: UuidSchema,
+    expiresAt: TimestampSchema,
+    createdAt: TimestampSchema,
+    ipAddress: z.string().nullable().optional(),
+    userAgent: z.string().nullable().optional(),
+});
+export const identityContract = {
+    register: oc
+        .route({ method: 'POST', path: '/identity/register' })
+        .input(RegisterInputSchema)
+        .output(z.object({ user: UserSchema })),
+    // When 2FA is enabled, better-auth withholds the session and signals `twoFactorRedirect`; client must then call verify2fa.
+    login: oc
+        .route({ method: 'POST', path: '/identity/login' })
+        .input(LoginInputSchema)
+        .output(z.object({
+        user: UserSchema.optional(),
+        session: SessionSchema.optional(),
+        twoFactorRedirect: z.boolean().optional(),
+    })),
+    logout: oc.route({ method: 'POST', path: '/identity/logout' }).output(IdentitySuccessSchema),
+    me: oc.route({ method: 'GET', path: '/identity/me' }).output(UserSchema.nullable()),
+    streamSession: oc
+        .route({ method: 'GET', path: '/identity/session/stream' })
+        .output(eventIterator(z.object({ type: z.literal('revoked') }))),
+    enable2fa: oc
+        .route({ method: 'POST', path: '/identity/2fa/enable' })
+        .input(Enable2faInputSchema)
+        .output(Enable2faResultSchema),
+    verify2fa: oc
+        .route({ method: 'POST', path: '/identity/2fa/verify' })
+        .input(Verify2faInputSchema)
+        .output(IdentitySuccessSchema),
+    disable2fa: oc
+        .route({ method: 'POST', path: '/identity/2fa/disable' })
+        .input(Disable2faInputSchema)
+        .output(IdentitySuccessSchema),
+    requestPasswordReset: oc
+        .route({ method: 'POST', path: '/identity/password/forgot' })
+        .input(RequestPasswordResetInputSchema)
+        .output(IdentitySuccessSchema),
+    resetPassword: oc
+        .route({ method: 'POST', path: '/identity/password/reset' })
+        .input(ResetPasswordInputSchema)
+        .output(IdentitySuccessSchema),
+    changePassword: oc
+        .route({ method: 'POST', path: '/identity/password/change' })
+        .input(ChangePasswordInputSchema)
+        .output(IdentitySuccessSchema),
+    sendEmailVerification: oc
+        .route({ method: 'POST', path: '/identity/email/verify/send' })
+        .output(IdentitySuccessSchema),
+    verifyEmail: oc
+        .route({ method: 'POST', path: '/identity/email/verify' })
+        .input(VerifyEmailInputSchema)
+        .output(IdentitySuccessSchema),
+    changeEmail: oc
+        .route({ method: 'POST', path: '/identity/email/change' })
+        .input(ChangeEmailInputSchema)
+        .output(IdentitySuccessSchema),
+    updateProfile: oc
+        .route({ method: 'PATCH', path: '/identity/profile' })
+        .input(UpdateProfileInputSchema)
+        .output(z.object({ user: UserSchema })),
+    unlockUser: oc
+        .route({ method: 'POST', path: '/identity/unlock' })
+        .input(z.object({ userId: UuidSchema }))
+        .output(IdentitySuccessSchema),
+    sessions: {
+        list: oc
+            .route({ method: 'GET', path: '/identity/sessions' })
+            .input(PageQuerySchema.extend({ userId: UuidSchema }))
+            .output(paginated(SessionItemSchema)),
+        revoke: oc
+            .route({ method: 'POST', path: '/identity/sessions/revoke' })
+            .input(z.object({ userId: UuidSchema, id: UuidSchema }))
+            .output(IdentitySuccessSchema),
+        revokeAll: oc
+            .route({ method: 'POST', path: '/identity/sessions/revoke-all' })
+            .input(z.object({ userId: UuidSchema }))
+            .output(IdentitySuccessSchema),
+    },
+};
+//# sourceMappingURL=index.js.map

package/dist/pam/identity/contract/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,+BAA+B,EAC/B,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,UAAU;IACd,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,EAAE;SACT,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;SACrD,KAAK,CAAC,mBAAmB,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAEzC,2HAA2H;IAC3H,KAAK,EAAE,EAAE;SACN,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAClD,KAAK,CAAC,gBAAgB,CAAC;SACvB,MAAM,CACL,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC3B,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;QACjC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC,CACH;IAEH,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC;IAE5F,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;IAEnF,aAAa,EAAE,EAAE;SACd,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;SAC1D,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAElE,SAAS,EAAE,EAAE;SACV,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;SACvD,KAAK,CAAC,oBAAoB,CAAC;SAC3B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,SAAS,EAAE,EAAE;SACV,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;SACvD,KAAK,CAAC,oBAAoB,CAAC;SAC3B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,UAAU,EAAE,EAAE;SACX,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;SACxD,KAAK,CAAC,qBAAqB,CAAC;SAC5B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,oBAAoB,EAAE,EAAE;SACrB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;SAC5D,KAAK,CAAC,+BAA+B,CAAC;SACtC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,aAAa,EAAE,EAAE;SACd,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;SAC3D,KAAK,CAAC,wBAAwB,CAAC;SAC/B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,cAAc,EAAE,EAAE;SACf,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;SAC5D,KAAK,CAAC,yBAAyB,CAAC;SAChC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,qBAAqB,EAAE,EAAE;SACtB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC;SAC9D,MAAM,CAAC,qBAAqB,CAAC;IAEhC,WAAW,EAAE,EAAE;SACZ,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;SACzD,KAAK,CAAC,sBAAsB,CAAC;SAC7B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,WAAW,EAAE,EAAE;SACZ,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;SACzD,KAAK,CAAC,sBAAsB,CAAC;SAC7B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,aAAa,EAAE,EAAE;SACd,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;SACrD,KAAK,CAAC,wBAAwB,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAEzC,UAAU,EAAE,EAAE;SACX,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;SACnD,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;SACvC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,QAAQ,EAAE;QACR,IAAI,EAAE,EAAE;aACL,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;aACpD,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;aACrD,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAEvC,MAAM,EAAE,EAAE;aACP,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;aAC5D,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;aACvD,MAAM,CAAC,qBAAqB,CAAC;QAEhC,SAAS,EAAE,EAAE;aACV,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC;aAChE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;aACvC,MAAM,CAAC,qBAAqB,CAAC;KACjC;CACF,CAAC"}