@openora/core 0.4.1-canary.16 → 0.4.1-canary.161

package/dist/pam/identity/service/session.service.d.ts

@@ -1,19 +1,38 @@
 import { type EventBus, DrizzleService } from '@openora/core/server';
-import type { User } from '@openora/core/contracts';
-export declare const SessionNotFoundError: new (id: string) => Error;
+import { type ClientMeta, type IdentityReader, type User, type PaginationOptions } from '@openora/core/contracts';
+import { type Session } from '../schema/index.js';
+import { type SessionSortBy } from '../contract/index.js';
+export declare const SessionNotFoundError: new (id: string) => Error & {
+    data?: Record<string, string>;
+};
+export declare const CurrentSessionRevokeError: new () => Error & {
+    data?: Record<string, string>;
+};
 export type SessionServiceDeps = {
     drizzle: DrizzleService;
     events: EventBus;
+    identityReader: IdentityReader;
 };
 export declare class SessionService {
     private readonly drizzle;
     private readonly events;
-    constructor({ drizzle, events }: SessionServiceDeps);
-    listSessions(userId: User['id'], page: number, limit: number): Promise<{
+    private readonly identityReader;
+    constructor({ drizzle, events, identityReader }: SessionServiceDeps);
+    listSessions({ userId, currentSessionId, activeOnly, page, limit, sortBy, sortOrder, }: PaginationOptions<{
+        userId: User['id'];
+        currentSessionId?: Session['id'];
+        activeOnly?: boolean;
+    }, SessionSortBy>): Promise<{
         items: {
             id: string;
             expiresAt: string;
             createdAt: string;
+            updatedAt: string;
+            lastSeenAt: string | null;
+            deviceLabel: string;
+            browser: string | null;
+            os: string | null;
+            current: boolean;
             ipAddress?: string | null | undefined;
             userAgent?: string | null | undefined;
         }[];
@@ -21,10 +40,48 @@ export declare class SessionService {
         page: number;
         limit: number;
     }>;
-    revokeSession(userId: User['id'], id: string, actorId?: User['id']): Promise<{
+    /**
+     * Every active session on the platform, newest first, with the account each belongs
+     * to. `listSessions` needs a userId and so cannot answer "who is logged in right now",
+     * which is what a Super Admin needs before revoking someone else's session.
+     */
+    listAllActiveSessions({ role, query, currentSessionId, page, limit, sortBy, sortOrder, }: PaginationOptions<{
+        role?: string | undefined;
+        query?: string | undefined;
+        currentSessionId?: string;
+    }, SessionSortBy>): Promise<{
+        items: {
+            id: string;
+            expiresAt: string;
+            createdAt: string;
+            updatedAt: string;
+            lastSeenAt: string | null;
+            deviceLabel: string;
+            browser: string | null;
+            os: string | null;
+            current: boolean;
+            userId: string;
+            email: string;
+            role: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+        }[];
+        total: number;
+        page: number;
+        limit: number;
+    }>;
+    /**
+     * Self-service revoke. Refuses the caller's own session: ending it here would look
+     * like a silent logout rather than the deliberate "sign out" action, and the session
+     * list marks it as current precisely so it is not the one you cut off.
+     */
+    revokeOwnSession(userId: User['id'], id: Session['id'], currentSessionId: Session['id'] | undefined, meta?: ClientMeta): Promise<{
+        success: true;
+    }>;
+    revokeSession(userId: User['id'], id: string, actorId?: User['id'], meta?: ClientMeta): Promise<{
         success: true;
     }>;
-    revokeAllSessions(userId: User['id'], actorId?: User['id']): Promise<{
+    revokeAllSessions(userId: User['id'], actorId?: User['id'], meta?: ClientMeta): Promise<{
         success: true;
     }>;
 }

package/dist/pam/identity/service/session.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/session.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,QAAQ,EACb,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAIpD,eAAO,MAAM,oBAAoB,2BAA+B,CAAC;AAEjE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;CAClB,CAAC;AAEF,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;gBAEtB,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,kBAAkB;IAK7C,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;IA+B5D,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC;;;IAmBlE,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC;;;CASjE"}
+{"version":3,"file":"session.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/session.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,QAAQ,EACb,cAAc,EAIf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,IAAI,EACT,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAA4C,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIpG,eAAO,MAAM,oBAAoB;QAbgB,CAAC;CAac,CAAC;AA4BjE,eAAO,MAAM,yBAAyB;QAzCW,CAAC;CA4CjD,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;CAChC,CAAC;AAmBF,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;gBAEpC,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,kBAAkB;IAM7D,YAAY,CAAC,EACjB,MAAM,EACN,gBAAgB,EAChB,UAAU,EACV,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,GACV,EAAE,iBAAiB,CAClB;QAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,EAC9E,aAAa,CACd;;;;;;;;;;;;;;;;;;IAqCD;;;;OAIG;IACG,qBAAqB,CAAC,EAC1B,IAAI,EACJ,KAAK,EACL,gBAAgB,EAChB,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,GACV,EAAE,iBAAiB,CAClB;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,EACpF,aAAa,CACd;;;;;;;;;;;;;;;;;;;;;IAiDD;;;;OAIG;IACG,gBAAgB,CACpB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EACjB,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,EAC3C,IAAI,CAAC,EAAE,UAAU;;;IAQb,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAwBrF,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;CAepF"}

package/dist/pam/identity/service/session.service.js

@@ -1,64 +1,178 @@
-import { pageToOffset, makeNotFoundError, } from '@openora/core/server';
-import { eq, desc, and, gt, count, sql } from 'drizzle-orm';
-import { session } from '../schema/index.js';
+import { pageToOffset, makeNotFoundError, makeConflictError, } from '@openora/core/server';
+import { eq, asc, desc, and, or, gt, isNull, ne, count, ilike, sql } from 'drizzle-orm';
+import { AUTO_LOGOUT_MINUTES, } from '@openora/core/contracts';
+import { session, user } from '../schema/index.js';
+import { describeDevice } from './device-fingerprint.service.js';
 export const SessionNotFoundError = makeNotFoundError('Session');
+// Idle expiry (`SessionIdleService`) is lazy: it only cuts a session when a request for
+// it arrives, so `expiresAt` alone goes stale for a session nobody has used since. Both
+// "active session" reads below need this alongside `expiresAt > now()` for a player row,
+// or a closed laptop on a 15-minute window keeps showing as logged in for up to 30 days.
+// Built from the same contract map `SessionIdleService` reads, not restated by hand, so
+// the two cannot disagree on what a window means.
+function autoLogoutMinutesCase() {
+    return sql.join([
+        sql `CASE ${user.autoLogoutDuration}`,
+        ...Object.entries(AUTO_LOGOUT_MINUTES).map(([duration, minutes]) => sql `WHEN ${duration} THEN ${minutes}`),
+        sql `END`,
+    ], sql ` `);
+}
+function notIdledOut() {
+    return or(ne(user.role, 'player'), isNull(session.lastSeenAt), gt(session.lastSeenAt, sql `now() - make_interval(mins => (${autoLogoutMinutesCase()})::int)`));
+}
+export const CurrentSessionRevokeError = makeConflictError('CurrentSessionRevokeError', 'The current session cannot be revoked - sign out instead');
+function toSessionItem(row, currentSessionId) {
+    const { label, browser, os } = describeDevice(row.userAgent);
+    return {
+        id: row.id,
+        expiresAt: row.expiresAt.toISOString(),
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString(),
+        lastSeenAt: row.lastSeenAt?.toISOString() ?? null,
+        ipAddress: row.ipAddress,
+        userAgent: row.userAgent,
+        deviceLabel: label,
+        browser,
+        os,
+        current: row.id === currentSessionId,
+    };
+}
 export class SessionService {
     drizzle;
     events;
-    constructor({ drizzle, events }) {
+    identityReader;
+    constructor({ drizzle, events, identityReader }) {
         this.drizzle = drizzle;
         this.events = events;
+        this.identityReader = identityReader;
     }
-    async listSessions(userId, page, limit) {
-        const where = eq(session.userId, userId);
+    async listSessions({ userId, currentSessionId, activeOnly, page, limit, sortBy, sortOrder, }) {
+        const where = activeOnly
+            ? and(eq(session.userId, userId), gt(session.expiresAt, sql `now()`), notIdledOut())
+            : eq(session.userId, userId);
         const db = this.drizzle.db;
-        // Active sessions first (expiresAt > now), newest-first within each group.
+        // Active sessions first (expiresAt > now), then user-chosen sort within each group.
         const activeFirst = sql `CASE WHEN ${session.expiresAt} > NOW() THEN 0 ELSE 1 END`;
+        const dir = (sortOrder ?? 'desc') === 'asc' ? asc : desc;
+        const col = sortBy === 'expiresAt'
+            ? session.expiresAt
+            : sortBy === 'updatedAt'
+                ? session.updatedAt
+                : session.createdAt;
         const [rows, [{ n }]] = await Promise.all([
             db
-                .select()
+                .select({ session })
                 .from(session)
+                .innerJoin(user, eq(session.userId, user.id))
                 .where(where)
-                .orderBy(activeFirst, desc(session.createdAt))
+                .orderBy(...(sortBy ? [dir(col)] : [activeFirst, dir(col)]))
                 .limit(limit)
                 .offset(pageToOffset(page, limit)),
-            db.select({ n: count() }).from(session).where(where),
+            db
+                .select({ n: count() })
+                .from(session)
+                .innerJoin(user, eq(session.userId, user.id))
+                .where(where),
         ]);
         return {
-            items: rows.map((s) => ({
-                id: s.id,
-                expiresAt: s.expiresAt.toISOString(),
-                createdAt: s.createdAt.toISOString(),
-                ipAddress: s.ipAddress,
-                userAgent: s.userAgent,
-            })),
+            items: rows.map((row) => toSessionItem(row.session, currentSessionId)),
             total: Number(n),
             page,
             limit,
         };
     }
-    async revokeSession(userId, id, actorId) {
+    /**
+     * Every active session on the platform, newest first, with the account each belongs
+     * to. `listSessions` needs a userId and so cannot answer "who is logged in right now",
+     * which is what a Super Admin needs before revoking someone else's session.
+     */
+    async listAllActiveSessions({ role, query, currentSessionId, page, limit, sortBy, sortOrder, }) {
+        const db = this.drizzle.db;
+        const filters = [gt(session.expiresAt, sql `now()`), notIdledOut()];
+        if (role) {
+            filters.push(eq(user.role, role));
+        }
+        if (query) {
+            filters.push(ilike(user.email, `%${query}%`));
+        }
+        const where = and(...filters);
+        const dir = (sortOrder ?? 'desc') === 'asc' ? asc : desc;
+        const col = sortBy === 'expiresAt'
+            ? session.expiresAt
+            : sortBy === 'updatedAt'
+                ? session.updatedAt
+                : session.createdAt;
+        const [rows, [countRow]] = await Promise.all([
+            db
+                .select({ session, email: user.email, role: user.role })
+                .from(session)
+                .innerJoin(user, eq(session.userId, user.id))
+                .where(where)
+                .orderBy(dir(col))
+                .limit(limit)
+                .offset(pageToOffset(page, limit)),
+            db
+                .select({ n: count() })
+                .from(session)
+                .innerJoin(user, eq(session.userId, user.id))
+                .where(where),
+        ]);
+        return {
+            items: rows.map((row) => ({
+                ...toSessionItem(row.session, currentSessionId),
+                userId: row.session.userId,
+                email: row.email,
+                role: row.role,
+            })),
+            total: Number(countRow?.n ?? 0),
+            page,
+            limit,
+        };
+    }
+    /**
+     * Self-service revoke. Refuses the caller's own session: ending it here would look
+     * like a silent logout rather than the deliberate "sign out" action, and the session
+     * list marks it as current precisely so it is not the one you cut off.
+     */
+    async revokeOwnSession(userId, id, currentSessionId, meta) {
+        if (currentSessionId && id === currentSessionId) {
+            throw new CurrentSessionRevokeError();
+        }
+        return this.revokeSession(userId, id, userId, meta);
+    }
+    async revokeSession(userId, id, actorId, meta) {
         const updated = await this.drizzle.db
             .update(session)
-            .set({ expiresAt: sql `now()` })
+            // Keep updatedAt as-is: it is the session's last-used time in the device
+            // list, and the $onUpdateFn would otherwise overwrite it with the revoke time.
+            .set({ expiresAt: sql `now()`, updatedAt: session.updatedAt })
             .where(and(eq(session.id, id), eq(session.userId, userId)))
             .returning({ id: session.id });
         if (updated.length === 0) {
             throw new SessionNotFoundError(id);
         }
         this.events.emit('identity.session.revoked', {
-            userId: userId,
+            userId,
+            playerId: await this.identityReader.getPlayerIdByUserIdSafe(userId),
             sessionId: id,
             actorId,
+            ip: meta?.ip ?? null,
+            userAgent: meta?.userAgent ?? null,
         });
         return { success: true };
     }
-    async revokeAllSessions(userId, actorId) {
+    async revokeAllSessions(userId, actorId, meta) {
         await this.drizzle.db
             .update(session)
-            .set({ expiresAt: sql `now()` })
+            .set({ expiresAt: sql `now()`, updatedAt: session.updatedAt })
             .where(and(eq(session.userId, userId), gt(session.expiresAt, sql `now()`)));
-        this.events.emit('identity.sessions.revoked_all', { userId: userId, actorId });
+        this.events.emit('identity.sessions.revoked_all', {
+            userId,
+            playerId: await this.identityReader.getPlayerIdByUserIdSafe(userId),
+            actorId,
+            ip: meta?.ip ?? null,
+            userAgent: meta?.userAgent ?? null,
+        });
         return { success: true };
     }
 }

package/dist/pam/identity/service/session.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/session.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,YAAY,EACZ,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE5D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;AAOjE,MAAM,OAAO,cAAc;IACR,OAAO,CAAiB;IACxB,MAAM,CAAW;IAElC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAsB;QACjD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAkB,EAAE,IAAY,EAAE,KAAa;QAChE,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,2EAA2E;QAC3E,MAAM,WAAW,GAAG,GAAG,CAAQ,aAAa,OAAO,CAAC,SAAS,4BAA4B,CAAC;QAC1F,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxC,EAAE;iBACC,MAAM,EAAE;iBACR,IAAI,CAAC,OAAO,CAAC;iBACb,KAAK,CAAC,KAAK,CAAC;iBACZ,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;iBAC7C,KAAK,CAAC,KAAK,CAAC;iBACZ,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;SACrD,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,GAAG,CACb,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC;gBACnB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;gBACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;gBACpC,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CACH;YACD,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAChB,IAAI;YACJ,KAAK;SACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAkB,EAAE,EAAU,EAAE,OAAoB;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1D,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,EAAE;YACb,OAAO;SACR,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAkB,EAAE,OAAoB;QAC9D,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAAC,CAAC,CAAC;QAE7E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"session.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/session.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EACL,mBAAmB,GAKpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAgB,MAAM,oBAAoB,CAAC;AAGjE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;AAEjE,wFAAwF;AACxF,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,wFAAwF;AACxF,kDAAkD;AAClD,SAAS,qBAAqB;IAC5B,OAAO,GAAG,CAAC,IAAI,CACb;QACE,GAAG,CAAA,QAAQ,IAAI,CAAC,kBAAkB,EAAE;QACpC,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CACxC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,CAAA,QAAQ,QAAQ,SAAS,OAAO,EAAE,CAC/D;QACD,GAAG,CAAA,KAAK;KACT,EACD,GAAG,CAAA,GAAG,CACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,EAAE,CACP,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EACvB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAC1B,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAA,kCAAkC,qBAAqB,EAAE,SAAS,CAAC,CAC9F,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CACxD,2BAA2B,EAC3B,0DAA0D,CAC3D,CAAC;AAQF,SAAS,aAAa,CAAC,GAAY,EAAE,gBAAgC;IACnE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;QACjD,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,KAAK;QAClB,OAAO;QACP,EAAE;QACF,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,gBAAgB;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAc;IACR,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,cAAc,CAAiB;IAEhD,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAsB;QACjE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EACjB,MAAM,EACN,gBAAgB,EAChB,UAAU,EACV,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,GAIV;QACC,MAAM,KAAK,GAAG,UAAU;YACtB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;YACnF,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,oFAAoF;QACpF,MAAM,WAAW,GAAG,GAAG,CAAQ,aAAa,OAAO,CAAC,SAAS,4BAA4B,CAAC;QAC1F,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,MAAM,GAAG,GACP,MAAM,KAAK,WAAW;YACpB,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,MAAM,KAAK,WAAW;gBACtB,CAAC,CAAC,OAAO,CAAC,SAAS;gBACnB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxC,EAAE;iBACC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;iBACnB,IAAI,CAAC,OAAO,CAAC;iBACb,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;iBAC5C,KAAK,CAAC,KAAK,CAAC;iBACZ,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBAC3D,KAAK,CAAC,KAAK,CAAC;iBACZ,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,EAAE;iBACC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;iBACtB,IAAI,CAAC,OAAO,CAAC;iBACb,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;iBAC5C,KAAK,CAAC,KAAK,CAAC;SAChB,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YACtE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAChB,IAAI;YACJ,KAAK;SACN,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,qBAAqB,CAAC,EAC1B,IAAI,EACJ,KAAK,EACL,gBAAgB,EAChB,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,GAIV;QACC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACnE,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,MAAM,GAAG,GACP,MAAM,KAAK,WAAW;YACpB,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,MAAM,KAAK,WAAW;gBACtB,CAAC,CAAC,OAAO,CAAC,SAAS;gBACnB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAE1B,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,EAAE;iBACC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;iBACvD,IAAI,CAAC,OAAO,CAAC;iBACb,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;iBAC5C,KAAK,CAAC,KAAK,CAAC;iBACZ,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;iBACjB,KAAK,CAAC,KAAK,CAAC;iBACZ,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,EAAE;iBACC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;iBACtB,IAAI,CAAC,OAAO,CAAC;iBACb,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;iBAC5C,KAAK,CAAC,KAAK,CAAC;SAChB,CAAC,CAAC;QAEH,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,GAAG,CACb,CAAC,GAAG,EAAqB,EAAE,CAAC,CAAC;gBAC3B,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBAC/C,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;gBAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CACH;YACD,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI;YACJ,KAAK;SACN,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CACpB,MAAkB,EAClB,EAAiB,EACjB,gBAA2C,EAC3C,IAAiB;QAEjB,IAAI,gBAAgB,IAAI,EAAE,KAAK,gBAAgB,EAAE,CAAC;YAChD,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAkB,EAAE,EAAU,EAAE,OAAoB,EAAE,IAAiB;QACzF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,OAAO,CAAC;YAChB,yEAAyE;YACzE,+EAA+E;aAC9E,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC5D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1D,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC3C,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,SAAS,EAAE,EAAE;YACb,OAAO;YACP,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YACpB,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAkB,EAAE,OAAoB,EAAE,IAAiB;QACjF,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC5D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAAC,CAAC,CAAC;QAE7E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAChD,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,OAAO;YACP,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YACpB,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;CACF"}

package/dist/pam/identity/service/trusted-device.service.d.ts

@@ -0,0 +1,57 @@
+import { type EventBus, DrizzleService } from '@openora/core/server';
+import type { ClientMeta, User } from '@openora/core/contracts';
+import { type AdminTrustedDevice } from '../schema/index.js';
+export declare const TrustedDeviceNotFoundError: new (id: string) => Error & {
+    data?: Record<string, string>;
+};
+export type TrustedDeviceItem = {
+    id: string;
+    label: string;
+    ipAddress: string | null;
+    browser: string | null;
+    os: string | null;
+    lastUsedAt: string;
+    expiresAt: string;
+    isCurrent: boolean;
+};
+export type TrustedDeviceServiceDeps = {
+    drizzle: DrizzleService;
+    events: EventBus;
+    trustedDeviceDays: number;
+};
+/**
+ * Server-side half of "trusted device". better-auth issues an opaque trust cookie that
+ * nothing can enumerate or revoke; a device skips the second factor only when that
+ * cookie AND an unrevoked row here are both present, which is what makes the 30-day
+ * window listable, auditable, and revocable by the user or a Super Admin.
+ */
+export declare class TrustedDeviceService {
+    private readonly drizzle;
+    private readonly events;
+    private readonly trustedDeviceDays;
+    constructor({ drizzle, events, trustedDeviceDays }: TrustedDeviceServiceDeps);
+    getTrustedDeviceDays(): number;
+    trust(userId: User['id'], meta: ClientMeta): Promise<{
+        id: string;
+        expiresAt: Date;
+    } | null>;
+    isTrusted(userId: User['id'], userAgent: string | null): Promise<boolean>;
+    list(userId: User['id'], currentUserAgent: string | null): Promise<TrustedDeviceItem[]>;
+    revoke(userId: User['id'], deviceId: AdminTrustedDevice['id'], actorId: User['id'], meta?: ClientMeta): Promise<{
+        success: true;
+        userAgent: string | null;
+    }>;
+    /**
+     * Drops the trust granted to the device a compromised session was riding on, so the
+     * forced logout is followed by a full re-authentication instead of a silent skip.
+     */
+    /**
+     * `actorId` is absent when `AdminGuard` forces this itself (a fingerprint mismatch,
+     * not an admin or the device owner acting) - the audit trail attributes that case to
+     * the system rather than mislabeling it as a self-revoke.
+     */
+    revokeForDevice(userId: User['id'], userAgent: string | null, actorId?: User['id']): Promise<void>;
+    revokeAllForUser(userId: User['id'], actorId: User['id']): Promise<void>;
+    private activeDeviceWhere;
+}
+//# sourceMappingURL=trusted-device.service.d.ts.map

package/dist/pam/identity/service/trusted-device.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-device.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/trusted-device.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,cAAc,EAAqB,MAAM,sBAAsB,CAAC;AAExF,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGjF,eAAO,MAAM,0BAA0B;QAJR,CAAC;CAI6C,CAAC;AAE9E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,wBAAwB;IAS5E,oBAAoB,IAAI,MAAM;IAIxB,KAAK,CACT,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IA6C5C,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IASzE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAuBvF,MAAM,CACV,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAClC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EACnB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IA4BvD;;;OAGG;IACH;;;;OAIG;IACG,eAAe,CACnB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GACnB,OAAO,CAAC,IAAI,CAAC;IAkBV,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB9E,OAAO,CAAC,iBAAiB;CAQ1B"}

package/dist/pam/identity/service/trusted-device.service.js

@@ -0,0 +1,163 @@
+import { makeNotFoundError } from '@openora/core/server';
+import { and, desc, eq, gt, isNull, sql } from 'drizzle-orm';
+import { adminTrustedDevice } from '../schema/index.js';
+import { deviceHash, describeDevice, trustedDeviceExpiry } from './device-fingerprint.service.js';
+export const TrustedDeviceNotFoundError = makeNotFoundError('Trusted device');
+/**
+ * Server-side half of "trusted device". better-auth issues an opaque trust cookie that
+ * nothing can enumerate or revoke; a device skips the second factor only when that
+ * cookie AND an unrevoked row here are both present, which is what makes the 30-day
+ * window listable, auditable, and revocable by the user or a Super Admin.
+ */
+export class TrustedDeviceService {
+    drizzle;
+    events;
+    trustedDeviceDays;
+    constructor({ drizzle, events, trustedDeviceDays }) {
+        this.drizzle = drizzle;
+        this.events = events;
+        this.trustedDeviceDays = trustedDeviceDays;
+    }
+    // Read by `securityControlsFor` so a player's own copy - "trust this device for the
+    // next N days" - names the operator's actual configured window instead of a hardcoded
+    // guess that silently lies the moment `adminSecurityConfig.trustedDeviceDays` changes.
+    getTrustedDeviceDays() {
+        return this.trustedDeviceDays;
+    }
+    async trust(userId, meta) {
+        if (this.trustedDeviceDays <= 0) {
+            return null;
+        }
+        const hash = deviceHash(meta.userAgent);
+        const { label } = describeDevice(meta.userAgent);
+        const expiresAt = trustedDeviceExpiry(this.trustedDeviceDays);
+        const [row] = await this.drizzle.db
+            .insert(adminTrustedDevice)
+            .values({
+            userId,
+            deviceHash: hash,
+            label,
+            ipAddress: meta.ip ?? null,
+            userAgent: meta.userAgent ?? null,
+            expiresAt,
+        })
+            .onConflictDoUpdate({
+            target: [adminTrustedDevice.userId, adminTrustedDevice.deviceHash],
+            set: {
+                label,
+                ipAddress: meta.ip ?? null,
+                userAgent: meta.userAgent ?? null,
+                expiresAt,
+                lastUsedAt: sql `now()`,
+                revokedAt: null,
+                revokedBy: null,
+            },
+        })
+            .returning({ id: adminTrustedDevice.id, expiresAt: adminTrustedDevice.expiresAt });
+        if (!row) {
+            return null;
+        }
+        this.events.emit('identity.trusted_device.added', {
+            userId,
+            deviceId: row.id,
+            label,
+            expiresAt: row.expiresAt.toISOString(),
+            ip: meta.ip ?? null,
+            userAgent: meta.userAgent ?? null,
+        });
+        return row;
+    }
+    async isTrusted(userId, userAgent) {
+        const [row] = await this.drizzle.db
+            .select({ id: adminTrustedDevice.id })
+            .from(adminTrustedDevice)
+            .where(this.activeDeviceWhere(userId, deviceHash(userAgent)))
+            .limit(1);
+        return row !== undefined;
+    }
+    async list(userId, currentUserAgent) {
+        const currentHash = deviceHash(currentUserAgent);
+        const rows = await this.drizzle.db
+            .select()
+            .from(adminTrustedDevice)
+            .where(and(eq(adminTrustedDevice.userId, userId), isNull(adminTrustedDevice.revokedAt)))
+            .orderBy(desc(adminTrustedDevice.lastUsedAt));
+        return rows.map((row) => {
+            const { browser, os } = describeDevice(row.userAgent);
+            return {
+                id: row.id,
+                label: row.label,
+                ipAddress: row.ipAddress,
+                browser,
+                os,
+                lastUsedAt: row.lastUsedAt.toISOString(),
+                expiresAt: row.expiresAt.toISOString(),
+                isCurrent: row.deviceHash === currentHash,
+            };
+        });
+    }
+    async revoke(userId, deviceId, actorId, meta) {
+        const revoked = await this.drizzle.db
+            .update(adminTrustedDevice)
+            .set({ revokedAt: sql `now()`, revokedBy: actorId })
+            .where(and(eq(adminTrustedDevice.id, deviceId), eq(adminTrustedDevice.userId, userId), isNull(adminTrustedDevice.revokedAt)))
+            .returning({ id: adminTrustedDevice.id, userAgent: adminTrustedDevice.userAgent });
+        const [row] = revoked;
+        if (!row) {
+            throw new TrustedDeviceNotFoundError(deviceId);
+        }
+        this.events.emit('identity.trusted_device.revoked', {
+            userId,
+            deviceId,
+            actorId,
+            ip: meta?.ip ?? null,
+            userAgent: meta?.userAgent ?? null,
+        });
+        return { success: true, userAgent: row.userAgent };
+    }
+    /**
+     * Drops the trust granted to the device a compromised session was riding on, so the
+     * forced logout is followed by a full re-authentication instead of a silent skip.
+     */
+    /**
+     * `actorId` is absent when `AdminGuard` forces this itself (a fingerprint mismatch,
+     * not an admin or the device owner acting) - the audit trail attributes that case to
+     * the system rather than mislabeling it as a self-revoke.
+     */
+    async revokeForDevice(userId, userAgent, actorId) {
+        const revoked = await this.drizzle.db
+            .update(adminTrustedDevice)
+            .set({ revokedAt: sql `now()`, revokedBy: actorId ?? null })
+            .where(this.activeDeviceWhere(userId, deviceHash(userAgent)))
+            .returning({ id: adminTrustedDevice.id });
+        for (const row of revoked) {
+            this.events.emit('identity.trusted_device.revoked', {
+                userId,
+                deviceId: row.id,
+                actorId,
+                ip: null,
+                userAgent,
+            });
+        }
+    }
+    async revokeAllForUser(userId, actorId) {
+        const revoked = await this.drizzle.db
+            .update(adminTrustedDevice)
+            .set({ revokedAt: sql `now()`, revokedBy: actorId })
+            .where(and(eq(adminTrustedDevice.userId, userId), isNull(adminTrustedDevice.revokedAt), gt(adminTrustedDevice.expiresAt, sql `now()`)))
+            .returning({ id: adminTrustedDevice.id, userAgent: adminTrustedDevice.userAgent });
+        for (const row of revoked) {
+            this.events.emit('identity.trusted_device.revoked', {
+                userId,
+                deviceId: row.id,
+                actorId,
+                ip: null,
+                userAgent: row.userAgent,
+            });
+        }
+    }
+    activeDeviceWhere(userId, hash) {
+        return and(eq(adminTrustedDevice.userId, userId), eq(adminTrustedDevice.deviceHash, hash), isNull(adminTrustedDevice.revokedAt), gt(adminTrustedDevice.expiresAt, sql `now()`));
+    }
+}
+//# sourceMappingURL=trusted-device.service.js.map

package/dist/pam/identity/service/trusted-device.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-device.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/trusted-device.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,kBAAkB,EAA2B,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAElG,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;AAmB9E;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,iBAAiB,CAAS;IAE3C,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAA4B;QAC1E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED,oFAAoF;IACpF,sFAAsF;IACtF,uFAAuF;IACvF,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,KAAK,CACT,MAAkB,EAClB,IAAgB;QAEhB,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,MAAM,CAAC;YACN,MAAM;YACN,UAAU,EAAE,IAAI;YAChB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;YAC1B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;YACjC,SAAS;SACV,CAAC;aACD,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,CAAC,UAAU,CAAC;YAClE,GAAG,EAAE;gBACH,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;gBAC1B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,SAAS;gBACT,UAAU,EAAE,GAAG,CAAA,OAAO;gBACtB,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,IAAI;aAChB;SACF,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;QAErF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAChD,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,KAAK;YACL,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;YACtC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;SAClC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAkB,EAAE,SAAwB;QAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,CAAC;aACrC,IAAI,CAAC,kBAAkB,CAAC;aACxB,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;aAC5D,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,KAAK,SAAS,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAkB,EAAE,gBAA+B;QAC5D,MAAM,WAAW,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAC/B,MAAM,EAAE;aACR,IAAI,CAAC,kBAAkB,CAAC;aACxB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;aACvF,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;QAEhD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAqB,EAAE;YACzC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtD,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO;gBACP,EAAE;gBACF,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;gBACxC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;gBACtC,SAAS,EAAE,GAAG,CAAC,UAAU,KAAK,WAAW;aAC1C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CACV,MAAkB,EAClB,QAAkC,EAClC,OAAmB,EACnB,IAAiB;QAEjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;aAClD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,EACnC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CACrC,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;QAErF,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;QACtB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAClD,MAAM;YACN,QAAQ;YACR,OAAO;YACP,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YACpB,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,MAAkB,EAClB,SAAwB,EACxB,OAAoB;QAEpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;aAC1D,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;aAC5D,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC;QAE5C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAClD,MAAM;gBACN,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAChB,OAAO;gBACP,EAAE,EAAE,IAAI;gBACR,SAAS;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAkB,EAAE,OAAmB;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;aAClD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACpC,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAC7C,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;QAErF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAClD,MAAM;gBACN,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAChB,OAAO;gBACP,EAAE,EAAE,IAAI;gBACR,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,MAAkB,EAAE,IAAY;QACxD,OAAO,GAAG,CACR,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,EACvC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACpC,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAC7C,CAAC;IACJ,CAAC;CACF"}

package/dist/pam/identity/service/two-factor-challenge.service.d.ts

@@ -0,0 +1,36 @@
+import type { DrizzleService } from '@openora/core/server';
+import type { TwoFactorChallengeMethod, User } from '@openora/core/contracts';
+/**
+ * Library boundary: the base Auth API type omits the endpoints contributed by the
+ * twoFactor plugin, but createAuth always installs that plugin for identity.
+ */
+export type TwoFactorVerifyApi = {
+    verifyTOTP(opts: VerifyOpts): Promise<Response>;
+    verifyTwoFactorOTP(opts: VerifyOpts): Promise<Response>;
+    verifyBackupCode(opts: VerifyOpts): Promise<Response>;
+};
+type VerifyOpts = {
+    body: {
+        code: string;
+        trustDevice: boolean;
+    };
+    headers: Headers;
+    asResponse: true;
+};
+/**
+ * Which endpoint can spend this account's challenge answer. All three delivery
+ * methods share one enrolment, so this is purely about the credential the caller
+ * presents: an account on `email`/`sms` has no authenticator to read a TOTP off, so
+ * verifying one against the shared secret would reject every code it was actually
+ * sent - and, on the step-up paths, bank a lockout failure for it.
+ *
+ * An enrolment that predates the `two_factor_method` column reads as null, and every
+ * one of those was an authenticator.
+ */
+export declare function resolveChallengeMethod(drizzle: DrizzleService, userId: User['id']): Promise<Extract<TwoFactorChallengeMethod, 'otp' | 'totp'>>;
+export declare function verifyChallengeCode(api: TwoFactorVerifyApi, method: TwoFactorChallengeMethod, body: {
+    code: string;
+    trustDevice: boolean;
+}, headers: Headers): Promise<Response>;
+export {};
+//# sourceMappingURL=two-factor-challenge.service.d.ts.map

package/dist/pam/identity/service/two-factor-challenge.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-challenge.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/two-factor-challenge.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAG9E;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxD,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACvD,CAAC;AAEF,KAAK,UAAU,GAAG;IAChB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GACjB,OAAO,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC,CAO5D;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,kBAAkB,EACvB,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,EAC5C,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,CAAC,CAQnB"}

package/dist/pam/identity/service/two-factor-challenge.service.js

@@ -0,0 +1,30 @@
+import { eq } from 'drizzle-orm';
+import { user } from '../schema/index.js';
+/**
+ * Which endpoint can spend this account's challenge answer. All three delivery
+ * methods share one enrolment, so this is purely about the credential the caller
+ * presents: an account on `email`/`sms` has no authenticator to read a TOTP off, so
+ * verifying one against the shared secret would reject every code it was actually
+ * sent - and, on the step-up paths, bank a lockout failure for it.
+ *
+ * An enrolment that predates the `two_factor_method` column reads as null, and every
+ * one of those was an authenticator.
+ */
+export async function resolveChallengeMethod(drizzle, userId) {
+    const [row] = await drizzle.db
+        .select({ twoFactorMethod: user.twoFactorMethod })
+        .from(user)
+        .where(eq(user.id, userId))
+        .limit(1);
+    return row?.twoFactorMethod === 'email' || row?.twoFactorMethod === 'sms' ? 'otp' : 'totp';
+}
+export function verifyChallengeCode(api, method, body, headers) {
+    if (method === 'backup_code') {
+        return api.verifyBackupCode({ body, headers, asResponse: true });
+    }
+    if (method === 'otp') {
+        return api.verifyTwoFactorOTP({ body, headers, asResponse: true });
+    }
+    return api.verifyTOTP({ body, headers, asResponse: true });
+}
+//# sourceMappingURL=two-factor-challenge.service.js.map

package/dist/pam/identity/service/two-factor-challenge.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-challenge.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/two-factor-challenge.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAkB1C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAuB,EACvB,MAAkB;IAElB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;SAC3B,MAAM,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;SACjD,IAAI,CAAC,IAAI,CAAC;SACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,EAAE,eAAe,KAAK,OAAO,IAAI,GAAG,EAAE,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,GAAuB,EACvB,MAAgC,EAChC,IAA4C,EAC5C,OAAgB;IAEhB,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC"}