@openora/core 0.4.1-canary.160 → 0.4.1-canary.161

package/dist/pam/identity/router/index.d.ts

@@ -1,11 +1,23 @@
-import { type OssContext, AdminGuard, type EventBus } from '@openora/core/server';
+import { type OssContext, AdminGuard } from '@openora/core/server';
+import type { RealtimeTransport } from '@openora/core/contracts';
+import type { User, Session } from '../schema/index.js';
 import { PhoneLoginService } from '../service/phone-login.service.js';
 import { PhoneVerificationService } from '../service/phone-verification.service.js';
 import type { WithdrawalPinService } from '../service/withdrawal-pin.service.js';
 import { IdentityService } from '../service/identity.service.js';
 import { SessionService } from '../service/session.service.js';
 import { type AdminSecurityService } from '../service/admin-security.service.js';
-export declare function createIdentityRouter(identity: IdentityService, sessionSvc: SessionService, phoneLogin: PhoneLoginService, phoneVerification: PhoneVerificationService, adminGuard: AdminGuard, eventBus: EventBus, adminSecurity: AdminSecurityService, withdrawalPin: WithdrawalPinService): {
+export declare function sessionEventsChannel(userId: User['id']): string;
+export type SessionEventsPush = {
+    type: 'revoked-all';
+    exceptSessionId?: Session['id'];
+} | {
+    type: 'session-revoked';
+    sessionId: Session['id'];
+} | {
+    type: 'unlocked';
+};
+export declare function createIdentityRouter(identity: IdentityService, sessionSvc: SessionService, phoneLogin: PhoneLoginService, phoneVerification: PhoneVerificationService, adminGuard: AdminGuard, realtime: RealtimeTransport, adminSecurity: AdminSecurityService, withdrawalPin: WithdrawalPinService): {
     register: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
         email: import("zod").ZodEmail;
         password: import("zod").ZodString;

package/dist/pam/identity/router/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/router/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,UAAU,EACf,UAAU,EAKV,KAAK,QAAQ,EACd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EACL,eAAe,EAGhB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,cAAc,EAGf,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,sCAAsC,CAAC;AAW9C,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,eAAe,EACzB,UAAU,EAAE,cAAc,EAC1B,UAAU,EAAE,iBAAiB,EAC7B,iBAAiB,EAAE,wBAAwB,EAC3C,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,QAAQ,EAClB,aAAa,EAAE,oBAAoB,EACnC,aAAa,EAAE,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0VpC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/router/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,UAAU,EACf,UAAU,EAKX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EACL,eAAe,EAGhB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,cAAc,EAGf,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,sCAAsC,CAAC;AAmB9C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAE/D;AAID,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzB,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,eAAe,EACzB,UAAU,EAAE,cAAc,EAC1B,UAAU,EAAE,iBAAiB,EAC7B,iBAAiB,EAAE,wBAAwB,EAC3C,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,iBAAiB,EAC3B,aAAa,EAAE,oBAAoB,EACnC,aAAa,EAAE,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0VpC"}

package/dist/pam/identity/router/index.js

@@ -13,7 +13,18 @@ function requireSessionId(context) {
     }
     return sessionId;
 }
-export function createIdentityRouter(identity, sessionSvc, phoneLogin, phoneVerification, adminGuard, eventBus, adminSecurity, withdrawalPin) {
+// Server-to-client push channel for a user's own session-lifecycle notices
+// (revoke-all, single-session revoke, unlock). Per
+// docs/standards/messaging-and-microservices.md, push belongs on REALTIME_TRANSPORT
+// (Redis Pub/Sub, fans out to every replica), not the domain EventBus (a Redis
+// Streams consumer group delivers each event to only ONE replica - a tab connected
+// to any other replica would never see the push). The plugin republishes here off
+// the durable `identity.sessions.revoked_all` / `identity.session.revoked` /
+// `identity.user.unlocked` domain events; see plugin.ts.
+export function sessionEventsChannel(userId) {
+    return `identity:session-events:${userId}`;
+}
+export function createIdentityRouter(identity, sessionSvc, phoneLogin, phoneVerification, adminGuard, realtime, adminSecurity, withdrawalPin) {
     const os = implement(identityContract).$context();
     return os.router({
         register: os.register.handler(({ input, context }) => mapErrors({ CONFLICT: UsernameConflictError }, () => identity.register(input, context.request.headers))),
@@ -63,33 +74,29 @@ export function createIdentityRouter(identity, sessionSvc, phoneLogin, phoneVeri
         },
         streamSession: os.streamSession.handler(({ signal, context }) => {
             const userId = getUserId(context);
-            const sessionId = getSessionId(context);
-            return createEventStreamGenerator((push) => {
-                const unsubscribeRevoked = eventBus.on('identity.sessions.revoked_all', (event) => {
-                    if (event.userId === userId) {
-                        push({ type: 'revoked' });
-                    }
-                });
-                // A single-session revoke - including the idle-timeout expiry `SessionIdleService`
-                // performs - only ever names one session. Without this, the tab it just killed
-                // gets no signal at all: the DB write and the audit row already happened, but the
-                // open tab keeps rendering as signed in until its next request happens to 401.
-                const unsubscribeSessionRevoked = eventBus.on('identity.session.revoked', (event) => {
-                    if (event.userId === userId && event.sessionId === sessionId) {
+            const connectionSessionId = getSessionId(context);
+            return createEventStreamGenerator((push) => realtime.subscribe(sessionEventsChannel(userId), (event) => {
+                if (event.type === 'unlocked') {
+                    push({ type: 'unlocked' });
+                    return;
+                }
+                // A single-session revoke - including the idle-timeout expiry
+                // `SessionIdleService` performs - names exactly one session, so only that tab
+                // is told. Without it the tab it just killed keeps rendering as signed in
+                // until its next request happens to 401.
+                if (event.type === 'session-revoked') {
+                    if (event.sessionId === connectionSessionId) {
                         push({ type: 'revoked' });
                     }
-                });
-                const unsubscribeUnlocked = eventBus.on('identity.user.unlocked', (event) => {
-                    if (event.userId === userId) {
-                        push({ type: 'unlocked' });
-                    }
-                });
-                return () => {
-                    unsubscribeRevoked();
-                    unsubscribeSessionRevoked();
-                    unsubscribeUnlocked();
-                };
-            }, { signal });
+                    return;
+                }
+                // Self-service password change spares the acting session via
+                // exceptSessionId; the admin revoke-all path leaves it unset and kicks all.
+                if (event.exceptSessionId && event.exceptSessionId === connectionSessionId) {
+                    return;
+                }
+                push({ type: 'revoked' });
+            }), { signal });
         }),
         enable2fa: os.enable2fa.handler(({ input, context }) => identity.enableTwoFactor(input, context.request.headers, context.resHeaders ?? new Headers())),
         verify2fa: os.verify2fa.handler(({ input, context }) => identity.verifyTwoFactor(input, context.request.headers, context.resHeaders ?? new Headers())),
@@ -100,7 +107,10 @@ export function createIdentityRouter(identity, sessionSvc, phoneLogin, phoneVeri
         requestPasswordReset: os.requestPasswordReset.handler(({ input }) => identity.requestPasswordReset(input)),
         verifyPasswordResetOtp: os.verifyPasswordResetOtp.handler(({ input }) => identity.verifyPasswordResetOtp(input)),
         resetPassword: os.resetPassword.handler(({ input }) => identity.resetPassword(input)),
-        changePassword: os.changePassword.handler(({ input, context }) => identity.changePassword(input, context.request.headers, context.resHeaders ?? new Headers())),
+        changePassword: os.changePassword.handler(({ input, context }) => identity.changePassword(input, context.request.headers, context.resHeaders ?? new Headers(), {
+            userId: getUserId(context),
+            sessionId: requireSessionId(context),
+        })),
         sendEmailVerification: os.sendEmailVerification.handler(({ input, context }) => identity.sendEmailVerification(input, context.request.headers)),
         verifyEmail: os.verifyEmail.handler(({ input, context }) => identity.verifyEmail(input, context.request.headers, context.resHeaders ?? new Headers())),
         changeEmail: os.changeEmail.handler(({ input, context }) => identity.changeEmail(input, context.request.headers, context.resHeaders ?? new Headers())),

package/dist/pam/identity/router/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/router/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAGL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,0BAA0B,GAE3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAIxD,OAAO,EAEL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAEL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAEL,uBAAuB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,SAAS,gBAAgB,CAAC,OAAmB;IAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAyB,EACzB,UAA0B,EAC1B,UAA6B,EAC7B,iBAA2C,EAC3C,UAAsB,EACtB,QAAkB,EAClB,aAAmC,EACnC,aAAmC;IAEnC,MAAM,EAAE,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAc,CAAC;IAE9D,OAAO,EAAE,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACnD,SAAS,CAAC,EAAE,QAAQ,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAClD,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAClD,CACF;QAED,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrE,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACpE;QAED,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7C,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CACpF;QAED,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACrE,OAAO,UAAU,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC;QAEF,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACnE,OAAO,UAAU,CAAC,SAAS,CACzB,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,EACnC,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACxC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9E;QAED,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YAChC,gFAAgF;YAChF,mFAAmF;YACnF,oDAAoD;YACpD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;gBAC/E,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC7C,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,QAAQ,EAAE;YACR,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACzC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACtD;YAED,qBAAqB,EAAE,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACtF,QAAQ,CAAC,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAClE;YAED,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAChE,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAC/D;YAED,uBAAuB,EAAE,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1F,QAAQ,CAAC,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACpE;YAED,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC5E,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAC1F;YAED,mBAAmB,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC3E,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAC7D;YAED,mBAAmB,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAClF,QAAQ,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAC7D;SACF;QAED,iBAAiB,EAAE;YACjB,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACnE,iBAAiB,CAAC,OAAO,CAAC;gBACxB,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;gBAC1B,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC;gBACpC,KAAK;gBACL,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;gBACnC,IAAI,EAAE,OAAO,CAAC,UAAU;aACzB,CAAC,CACH;YAED,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACnE,iBAAiB,CAAC,OAAO,CAAC;gBACxB,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;gBAC1B,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC;gBACpC,KAAK;gBACL,IAAI,EAAE,OAAO,CAAC,UAAU;aACzB,CAAC,CACH;SACF;QAED,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;YAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,0BAA0B,CAC/B,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,kBAAkB,GAAG,QAAQ,CAAC,EAAE,CAAC,+BAA+B,EAAE,CAAC,KAAK,EAAE,EAAE;oBAChF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,mFAAmF;gBACnF,+EAA+E;gBAC/E,kFAAkF;gBAClF,+EAA+E;gBAC/E,MAAM,yBAAyB,GAAG,QAAQ,CAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,KAAK,EAAE,EAAE;oBAClF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC7D,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,MAAM,mBAAmB,GAAG,QAAQ,CAAC,EAAE,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO,GAAG,EAAE;oBACV,kBAAkB,EAAE,CAAC;oBACrB,yBAAyB,EAAE,CAAC;oBAC5B,mBAAmB,EAAE,CAAC;gBACxB,CAAC,CAAC;YACJ,CAAC,EACD,EAAE,MAAM,EAAE,CACX,CAAC;QACJ,CAAC,CAAC;QAEF,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrD,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9F;QAED,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrD,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9F;QAED,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACvD,QAAQ,CAAC,gBAAgB,CACvB,KAAK,EACL,OAAO,CAAC,OAAO,CAAC,OAAO,EACvB,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CACF;QAED,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC5D,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CACxF;QAED,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1D,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAClD;QAED,qBAAqB,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7E,QAAQ,CAAC,qBAAqB,CAC5B,KAAK,EACL,OAAO,CAAC,OAAO,CAAC,OAAO,EACvB,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CACF;QAED,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,CACrC;QAED,sBAAsB,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACtE,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,CACvC;QAED,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAErF,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC/D,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC7F;QAED,qBAAqB,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7E,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAC/D;QAED,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC1F;QAED,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC1F;QAED,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7D,SAAS,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,GAAG,EAAE,CACxD,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC5F,CACF;QAED,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CACtD,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC/C,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QAEF,yBAAyB,EAAE,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC3F,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CACtD,QAAQ,CAAC,yBAAyB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC9D,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QAEF,QAAQ,EAAE;YACR,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC1D,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACrD,OAAO,UAAU,CAAC,YAAY,CAAC;oBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,gBAAgB,EAAE,YAAY,CAAC,OAAO,CAAC;oBACvC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;YACL,CAAC,CAAC;YACF,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,CACzD,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;oBAC9D,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CACH,CAAC;YACJ,CAAC,CAAC;YACF,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;oBAC/D,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC5D,UAAU,CAAC,YAAY,CAAC;gBACtB,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;gBAC1B,gBAAgB,EAAE,YAAY,CAAC,OAAO,CAAC;gBACvC,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CACH;YAED,wEAAwE;YACxE,4DAA4D;YAC5D,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAChE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;gBAClC,OAAO,SAAS,CACd,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,yBAAyB,EAAE,EACxE,GAAG,EAAE,CACH,UAAU,CAAC,gBAAgB,CACzB,MAAM,EACN,KAAK,CAAC,EAAE,EACR,YAAY,CAAC,OAAO,CAAC,EACrB,OAAO,CAAC,UAAU,CACnB,CACJ,CAAC;YACJ,CAAC,CAAC;YAEF,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAChE,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACrD,wEAAwE;gBACxE,4EAA4E;gBAC5E,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACnD,OAAO,UAAU,CAAC,qBAAqB,CAAC;oBACtC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,gBAAgB,EAAE,YAAY,CAAC,OAAO,CAAC;oBACvC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;YACL,CAAC,CAAC;SACH;QAED,aAAa,EAAE;YACb,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACtD,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CACvE;YAED,cAAc,EAAE,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACtE,aAAa,CAAC,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CACnF;YAED,kBAAkB,EAAE,EAAE,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrF,QAAQ,CAAC,kBAAkB,CACzB,KAAK,EACL,OAAO,CAAC,OAAO,CAAC,OAAO,EACvB,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CACF;YAED,mBAAmB,EAAE,EAAE,CAAC,aAAa,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBACvF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;gBAClC,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAC/D,aAAa,CAAC,mBAAmB,CAC/B,MAAM,EACN,KAAK,CAAC,EAAE,EACR,MAAM,EACN,OAAO,CAAC,UAAU,EAClB,YAAY,CAAC,OAAO,CAAC,CACtB,CACF,CAAC;YACJ,CAAC,CAAC;YAEF,kBAAkB,EAAE,EAAE,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAC7D,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC1D,OAAO,SAAS,CACd,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,EACnE,GAAG,EAAE,CACH,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;oBACtE,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CACL,CAAC;YACJ,CAAC,CACF;YAED,uBAAuB,EAAE,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,OAAO,CACvE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC1D,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAC/D,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;oBACvE,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CACH,CAAC;YACJ,CAAC,CACF;SACF;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/router/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAGL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKxD,OAAO,EAEL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAEL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAEL,uBAAuB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,SAAS,gBAAgB,CAAC,OAAmB;IAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2EAA2E;AAC3E,mDAAmD;AACnD,oFAAoF;AACpF,+EAA+E;AAC/E,mFAAmF;AACnF,kFAAkF;AAClF,6EAA6E;AAC7E,yDAAyD;AACzD,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,OAAO,2BAA2B,MAAM,EAAE,CAAC;AAC7C,CAAC;AASD,MAAM,UAAU,oBAAoB,CAClC,QAAyB,EACzB,UAA0B,EAC1B,UAA6B,EAC7B,iBAA2C,EAC3C,UAAsB,EACtB,QAA2B,EAC3B,aAAmC,EACnC,aAAmC;IAEnC,MAAM,EAAE,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAc,CAAC;IAE9D,OAAO,EAAE,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACnD,SAAS,CAAC,EAAE,QAAQ,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAClD,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAClD,CACF;QAED,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrE,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACpE;QAED,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7C,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CACpF;QAED,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACrE,OAAO,UAAU,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC;QAEF,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACnE,OAAO,UAAU,CAAC,SAAS,CACzB,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,EACnC,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACxC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9E;QAED,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YAChC,gFAAgF;YAChF,mFAAmF;YACnF,oDAAoD;YACpD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;gBAC/E,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC7C,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,QAAQ,EAAE;YACR,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACzC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACtD;YAED,qBAAqB,EAAE,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACtF,QAAQ,CAAC,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAClE;YAED,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAChE,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAC/D;YAED,uBAAuB,EAAE,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1F,QAAQ,CAAC,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACpE;YAED,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC5E,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAC1F;YAED,mBAAmB,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC3E,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAC7D;YAED,mBAAmB,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAClF,QAAQ,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAC7D;SACF;QAED,iBAAiB,EAAE;YACjB,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACnE,iBAAiB,CAAC,OAAO,CAAC;gBACxB,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;gBAC1B,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC;gBACpC,KAAK;gBACL,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;gBACnC,IAAI,EAAE,OAAO,CAAC,UAAU;aACzB,CAAC,CACH;YAED,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACnE,iBAAiB,CAAC,OAAO,CAAC;gBACxB,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;gBAC1B,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC;gBACpC,KAAK;gBACL,IAAI,EAAE,OAAO,CAAC,UAAU;aACzB,CAAC,CACH;SACF;QAED,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;YAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,mBAAmB,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YAClD,OAAO,0BAA0B,CAC/B,CAAC,IAAI,EAAE,EAAE,CACP,QAAQ,CAAC,SAAS,CAAoB,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC9B,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC3B,OAAO;gBACT,CAAC;gBACD,8DAA8D;gBAC9D,8EAA8E;gBAC9E,0EAA0E;gBAC1E,yCAAyC;gBACzC,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACrC,IAAI,KAAK,CAAC,SAAS,KAAK,mBAAmB,EAAE,CAAC;wBAC5C,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC5B,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,6DAA6D;gBAC7D,4EAA4E;gBAC5E,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,eAAe,KAAK,mBAAmB,EAAE,CAAC;oBAC3E,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC,EACJ,EAAE,MAAM,EAAE,CACX,CAAC;QACJ,CAAC,CAAC;QAEF,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrD,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9F;QAED,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrD,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9F;QAED,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACvD,QAAQ,CAAC,gBAAgB,CACvB,KAAK,EACL,OAAO,CAAC,OAAO,CAAC,OAAO,EACvB,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CACF;QAED,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC5D,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CACxF;QAED,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1D,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAClD;QAED,qBAAqB,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7E,QAAQ,CAAC,qBAAqB,CAC5B,KAAK,EACL,OAAO,CAAC,OAAO,CAAC,OAAO,EACvB,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CACF;QAED,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,CACrC;QAED,sBAAsB,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACtE,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,CACvC;QAED,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAErF,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC/D,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,EAAE;YAC3F,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;YAC1B,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC;SACrC,CAAC,CACH;QAED,qBAAqB,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7E,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAC/D;QAED,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC1F;QAED,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC1F;QAED,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7D,SAAS,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,GAAG,EAAE,CACxD,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC5F,CACF;QAED,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CACtD,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC/C,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QAEF,yBAAyB,EAAE,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC3F,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CACtD,QAAQ,CAAC,yBAAyB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC9D,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QAEF,QAAQ,EAAE;YACR,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC1D,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACrD,OAAO,UAAU,CAAC,YAAY,CAAC;oBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,gBAAgB,EAAE,YAAY,CAAC,OAAO,CAAC;oBACvC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;YACL,CAAC,CAAC;YACF,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,CACzD,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;oBAC9D,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CACH,CAAC;YACJ,CAAC,CAAC;YACF,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;oBAC/D,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC5D,UAAU,CAAC,YAAY,CAAC;gBACtB,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;gBAC1B,gBAAgB,EAAE,YAAY,CAAC,OAAO,CAAC;gBACvC,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CACH;YAED,wEAAwE;YACxE,4DAA4D;YAC5D,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAChE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;gBAClC,OAAO,SAAS,CACd,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,yBAAyB,EAAE,EACxE,GAAG,EAAE,CACH,UAAU,CAAC,gBAAgB,CACzB,MAAM,EACN,KAAK,CAAC,EAAE,EACR,YAAY,CAAC,OAAO,CAAC,EACrB,OAAO,CAAC,UAAU,CACnB,CACJ,CAAC;YACJ,CAAC,CAAC;YAEF,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAChE,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACrD,wEAAwE;gBACxE,4EAA4E;gBAC5E,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACnD,OAAO,UAAU,CAAC,qBAAqB,CAAC;oBACtC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,gBAAgB,EAAE,YAAY,CAAC,OAAO,CAAC;oBACvC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;YACL,CAAC,CAAC;SACH;QAED,aAAa,EAAE;YACb,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACtD,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CACvE;YAED,cAAc,EAAE,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACtE,aAAa,CAAC,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CACnF;YAED,kBAAkB,EAAE,EAAE,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrF,QAAQ,CAAC,kBAAkB,CACzB,KAAK,EACL,OAAO,CAAC,OAAO,CAAC,OAAO,EACvB,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CACF;YAED,mBAAmB,EAAE,EAAE,CAAC,aAAa,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBACvF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;gBAClC,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAC/D,aAAa,CAAC,mBAAmB,CAC/B,MAAM,EACN,KAAK,CAAC,EAAE,EACR,MAAM,EACN,OAAO,CAAC,UAAU,EAClB,YAAY,CAAC,OAAO,CAAC,CACtB,CACF,CAAC;YACJ,CAAC,CAAC;YAEF,kBAAkB,EAAE,EAAE,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAC7D,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC1D,OAAO,SAAS,CACd,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,EACnE,GAAG,EAAE,CACH,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;oBACtE,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CACL,CAAC;YACJ,CAAC,CACF;YAED,uBAAuB,EAAE,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,OAAO,CACvE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC1D,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAC/D,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;oBACvE,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CACH,CAAC;YACJ,CAAC,CACF;SACF;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/pam/identity/service/identity.service.d.ts

@@ -1,9 +1,15 @@
 import { type EventBus, type NodeHeaders, DrizzleService } from '@openora/core/server';
+import { type Session } from '../schema/index.js';
 import type { SessionService } from './session.service.js';
 import type { TrustedDeviceService } from './trusted-device.service.js';
 import type { TwoFactorLockoutService } from './two-factor-lockout.service.js';
 import { type TwoFactorDeliveryService } from './two-factor-delivery.service.js';
 import type { CacheAdapter, RateLimiterAdapter, RateLimitKey, MailDispatchPort, LoginInput, RegisterInput, Enable2faInput, Enable2faResult, Verify2faInput, TwoFactorStatus, Disable2faInput, RegenerateBackupCodesInput, TrustCurrentDeviceInput, RequestPasswordResetInput, VerifyPasswordResetOtpInput, ResetPasswordInput, ResendEmailVerificationInput, VerifyEmailInput, UpdateProfileInput, User, IdentityReader, ChangePasswordInput, ChangeEmailInput, IdentityServiceOptions, PlatformConfig, ClientMeta, GeoCheckCommands, PlayerProvisioning, SecurityControls, SetAntiPhishingCodeInput, SetAutoLogoutInput, SetLoginWithdrawalAlertsInput, SetRequireTwoFactorOnLoginInput } from '@openora/core/contracts';
+export declare function sweepRacedSessionsAfterPasswordChange(db: DrizzleService['db'], params: {
+    userId: User['id'];
+    sparedToken: Session['token'];
+    deadline: Date;
+}): Promise<Session['id'][]>;
 export declare const UserNotFoundError: new (id: string) => Error & {
     data?: Record<string, string>;
 };
@@ -58,6 +64,7 @@ export declare class IdentityService {
     private get api();
     private forwardCookies;
     private currentUserId;
+    private currentSession;
     private securityControlsFor;
     private assertAccountNotBlocked;
     /**
@@ -242,7 +249,10 @@ export declare class IdentityService {
     resetPassword(input: ResetPasswordInput): Promise<{
         success: true;
     }>;
-    changePassword(input: ChangePasswordInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
+    changePassword(input: ChangePasswordInput, reqHeaders: NodeHeaders, resHeaders: Headers, caller: {
+        userId: User['id'];
+        sessionId: Session['id'];
+    }): Promise<{
         success: true;
     }>;
     getSecurityControls(reqHeaders: NodeHeaders): Promise<SecurityControls>;

package/dist/pam/identity/service/identity.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,cAAc,EAQf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,cAAc,EACd,eAAe,EACf,cAAc,EAGd,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,kBAAkB,EAElB,IAAI,EACJ,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,UAAU,EAEV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,EAChC,MAAM,yBAAyB,CAAC;AA+JjC,eAAO,MAAM,iBAAiB;QAzN5B,CAAA;CAyNwD,CAAC;AAC3D,eAAO,MAAM,qBAAqB;QA1NhC,CAAA;CA0N8F,CAAC;AA+CjG,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AA+F7D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAI3C,iBAAiB,EAAE,wBAAwB,CAAC;IAG5C,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAmB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAe;IAMtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAqB;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAuB;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAiB;gBAE/B,EACV,OAAO,EACP,MAAM,EACN,cAAc,EACd,YAAY,EACZ,OAAO,EACP,OAAO,EACP,cAAc,EACd,QAAQ,EACR,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,GACT,EAAE,mBAAmB;YAoER,eAAe;IAS7B,OAAO,KAAK,GAAG,GAId;IAED,OAAO,CAAC,cAAc;YAOR,aAAa;YAKb,mBAAmB;IAgBjC,OAAO,CAAC,uBAAuB;IAU/B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAcxB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;;;YAiH9C,oBAAoB;YASpB,iBAAiB;IAS/B;;;;OAIG;YACW,yBAAyB;IAoCjC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW;;;IAUjE;;;;;;;;;;;OAWG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAgW3E,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,gBAAgB;YAaV,cAAc;YAYd,cAAc;IAW5B,OAAO,CAAC,2BAA2B;YAIrB,oBAAoB;IAiB5B,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAuCpF,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAiCrE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAmBnD,EAAE,CAAC,UAAU,EAAE,WAAW;;;;;;;;;;;;IAShC;;;;;;;;;;;;;OAaG;IACG,eAAe,CACnB,KAAK,EAAE,cAAc,EACrB,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,eAAe,CAAC;IA8C3B;;;;;OAKG;IACG,gBAAgB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAgBnE,wFAAwF;IAClF,eAAe,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;IA+BxE;;;;OAIG;YACW,qBAAqB;IAgCnC;;;OAGG;YACW,sBAAsB;YAStB,kBAAkB;YASlB,kBAAkB;IAOhC,OAAO,CAAC,mBAAmB;YAQb,uBAAuB;IA4BrC;;;;OAIG;YACW,2BAA2B;IAcnC,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;IAgFzF;;;;;OAKG;IACG,kBAAkB,CACtB,KAAK,EAAE,uBAAuB,EAC9B,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IA4FrB;;;;;OAKG;YACW,uBAAuB;IAmB/B,qBAAqB,CACzB,KAAK,EAAE,0BAA0B,EACjC,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IAqCf,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAkDrF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB;;;IAsBrD,sBAAsB,CAAC,KAAK,EAAE,2BAA2B;;;IAgBzD,aAAa,CAAC,KAAK,EAAE,kBAAkB;;;IAqBvC,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAwBvF,mBAAmB,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQ7E;;;;;OAKG;YACW,4BAA4B;IA+BpC,wBAAwB,CAC5B,KAAK,EAAE,6BAA6B,EACpC,UAAU,EAAE,WAAW,GACtB,OAAO,CAAC,gBAAgB,CAAC;IA6BtB,qBAAqB,CACzB,KAAK,EAAE,kBAAkB,EACzB,UAAU,EAAE,WAAW,GACtB,OAAO,CAAC,gBAAgB,CAAC;IAwB5B;;;;;OAKG;IACG,0BAA0B,CAC9B,KAAK,EAAE,+BAA+B,EACtC,UAAU,EAAE,WAAW,GACtB,OAAO,CAAC,gBAAgB,CAAC;IAgC5B;;;;;;OAMG;IACG,mBAAmB,CACvB,KAAK,EAAE,wBAAwB,EAC/B,UAAU,EAAE,WAAW,GACtB,OAAO,CAAC,gBAAgB,CAAC;IAqE5B;;;;;;OAMG;IACG,qBAAqB,CAAC,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,WAAW;;;IAsBxF;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwFjF,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IA4CjF,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;CAgC5F"}
+{"version":3,"file":"identity.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,cAAc,EAQf,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAmD,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEnG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,cAAc,EACd,eAAe,EACf,cAAc,EAGd,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,kBAAkB,EAElB,IAAI,EACJ,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,UAAU,EAEV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,EAChC,MAAM,yBAAyB,CAAC;AAmCjC,wBAAsB,qCAAqC,CACzD,EAAE,EAAE,cAAc,CAAC,IAAI,CAAC,EACxB,MAAM,EAAE;IAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAC5E,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAa1B;AA2JD,eAAO,MAAM,iBAAiB;QAxQ5B,CAAA;CAwQwD,CAAC;AAC3D,eAAO,MAAM,qBAAqB;QAzQhC,CAAA;CAyQ8F,CAAC;AA+CjG,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AAwG7D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAI3C,iBAAiB,EAAE,wBAAwB,CAAC;IAG5C,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAmB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAe;IAMtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAqB;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAuB;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAiB;gBAE/B,EACV,OAAO,EACP,MAAM,EACN,cAAc,EACd,YAAY,EACZ,OAAO,EACP,OAAO,EACP,cAAc,EACd,QAAQ,EACR,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,GACT,EAAE,mBAAmB;YAoER,eAAe;IAS7B,OAAO,KAAK,GAAG,GAId;IAED,OAAO,CAAC,cAAc;YAOR,aAAa;YAOb,cAAc;YAQd,mBAAmB;IAgBjC,OAAO,CAAC,uBAAuB;IAU/B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAcxB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;;;YAiH9C,oBAAoB;YASpB,iBAAiB;IAS/B;;;;OAIG;YACW,yBAAyB;IAoCjC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW;;;IAUjE;;;;;;;;;;;OAWG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAgW3E,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,gBAAgB;YAaV,cAAc;YAYd,cAAc;IAW5B,OAAO,CAAC,2BAA2B;YAIrB,oBAAoB;IAiB5B,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAuCpF,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAiCrE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAmBnD,EAAE,CAAC,UAAU,EAAE,WAAW;;;;;;;;;;;;IAShC;;;;;;;;;;;;;OAaG;IACG,eAAe,CACnB,KAAK,EAAE,cAAc,EACrB,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,eAAe,CAAC;IA8C3B;;;;;OAKG;IACG,gBAAgB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAgBnE,wFAAwF;IAClF,eAAe,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;IA+BxE;;;;OAIG;YACW,qBAAqB;IAgCnC;;;OAGG;YACW,sBAAsB;YAStB,kBAAkB;YASlB,kBAAkB;IAOhC,OAAO,CAAC,mBAAmB;YAQb,uBAAuB;IA4BrC;;;;OAIG;YACW,2BAA2B;IAcnC,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;IAgFzF;;;;;OAKG;IACG,kBAAkB,CACtB,KAAK,EAAE,uBAAuB,EAC9B,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IA4FrB;;;;;OAKG;YACW,uBAAuB;IAmB/B,qBAAqB,CACzB,KAAK,EAAE,0BAA0B,EACjC,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IAqCf,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAkDrF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB;;;IAsBrD,sBAAsB,CAAC,KAAK,EAAE,2BAA2B;;;IAgBzD,aAAa,CAAC,KAAK,EAAE,kBAAkB;;;IAqBvC,cAAc,CAClB,KAAK,EAAE,mBAAmB,EAC1B,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO,EACnB,MAAM,EAAE;QAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE;;;IAgIpD,mBAAmB,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQ7E;;;;;OAKG;YACW,4BAA4B;IA+BpC,wBAAwB,CAC5B,KAAK,EAAE,6BAA6B,EACpC,UAAU,EAAE,WAAW,GACtB,OAAO,CAAC,gBAAgB,CAAC;IA6BtB,qBAAqB,CACzB,KAAK,EAAE,kBAAkB,EACzB,UAAU,EAAE,WAAW,GACtB,OAAO,CAAC,gBAAgB,CAAC;IAwB5B;;;;;OAKG;IACG,0BAA0B,CAC9B,KAAK,EAAE,+BAA+B,EACtC,UAAU,EAAE,WAAW,GACtB,OAAO,CAAC,gBAAgB,CAAC;IAgC5B;;;;;;OAMG;IACG,mBAAmB,CACvB,KAAK,EAAE,wBAAwB,EAC/B,UAAU,EAAE,WAAW,GACtB,OAAO,CAAC,gBAAgB,CAAC;IAqE5B;;;;;;OAMG;IACG,qBAAqB,CAAC,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,WAAW;;;IAsBxF;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwFjF,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IA4CjF,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;CAgC5F"}

package/dist/pam/identity/service/identity.service.js

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { ORPCError } from '@orpc/server';
 import { createAuth, assertRateLimit, extractClientMeta, getCurrentClientMeta, findOneOrThrow, makeConflictError, makeNotFoundError, createLogger, } from '@openora/core/server';
 import { parseCookies } from 'better-auth/cookies';
-import { and, eq, isNull, sql } from 'drizzle-orm';
+import { and, eq, isNull, lte, ne, sql } from 'drizzle-orm';
 import * as z from 'zod';
 import { user, session, account, verification, twoFactor } from '../schema/index.js';
 import { captureTimezone } from './capture-timezone.service.js';
@@ -23,6 +23,23 @@ function nodeHeadersToHeaders(nodeHeaders) {
     }
     return headers;
 }
+// Deletes every session row for `userId` created at or before `deadline`, except the
+// caller's freshly minted one (matched by `sparedToken`), and returns the ids of what
+// it deleted. Run a short delay after a password change: better-auth rotates the
+// password hash and deletes sessions in separate, untransacted statements, so a
+// sign-in that verified the OLD password just before the rotation can still insert
+// its session row immediately after `deleteUserSessions()` ran. That row predates
+// `deadline` (captured once the change is known committed), so this catches it while
+// sparing anything created afterwards.
+// Exported for direct testing; the service schedules it via setTimeout.
+export async function sweepRacedSessionsAfterPasswordChange(db, params) {
+    const { userId, sparedToken, deadline } = params;
+    const deleted = await db
+        .delete(session)
+        .where(and(eq(session.userId, userId), ne(session.token, sparedToken), lte(session.createdAt, deadline)))
+        .returning({ id: session.id });
+    return deleted.map((row) => row.id);
+}
 function toIso(value) {
     return value instanceof Date ? value.toISOString() : value;
 }
@@ -81,6 +98,21 @@ function hasTrustDeviceCookie(headers) {
     }
     return false;
 }
+// better-auth sets `<prefix>.dont_remember` when a user signs in with `rememberMe: false`.
+// Presence is enough here: we only use it to shorten the caller's own rotated session,
+// so a forged cookie can at worst clamp its owner's session earlier - never extend one.
+function hasDontRememberCookie(headers) {
+    const cookieHeader = headers.get('cookie');
+    if (!cookieHeader) {
+        return false;
+    }
+    for (const [name] of parseCookies(cookieHeader)) {
+        if (name.endsWith('.dont_remember') || name === 'dont_remember') {
+            return true;
+        }
+    }
+    return false;
+}
 // Drops the one pair and leaves every other byte alone: the cookies that stay carry
 // signed, percent-encoded values better-auth re-verifies exactly as the browser sent them.
 function withoutTrustDeviceCookie(headers) {
@@ -189,6 +221,15 @@ const VERIFY_EMAIL_RATE_LIMIT = {
     onUnavailable: 'deny',
 };
 const CHANGE_PASSWORD_RATE_LIMIT = { limit: 5, windowMs: 15 * MINUTE_MS };
+// How long after a password change to re-sweep the user's sessions for a row that a
+// concurrent old-password sign-in raced in just after better-auth's revoke ran. This
+// is the residual exposure window; keep it short.
+const RACED_SESSION_SWEEP_DELAY_MS = 2_000;
+// better-auth's `createSession` gives a `dontRememberMe` session this fixed TTL
+// (`getDate(3600 * 24, 'sec')`). `revokeOtherSessions` mints the caller's replacement
+// session without that flag, so we re-apply the clamp when the request carries the
+// `dont_remember` cookie. Matches `SESSION_TTL_MS` in phone-login.service.
+const DONT_REMEMBER_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
 const TWO_FACTOR_PASSWORD_RATE_LIMIT = { limit: 5, windowMs: 5 * MINUTE_MS };
 // Fails closed: every call spends real money on an `sms` enrolment and fills a mailbox
 // on an `email` one, and better-auth issues a fresh code per send, so an unbounded
@@ -337,8 +378,15 @@ export class IdentityService {
         }
     }
     async currentUserId(headers) {
-        const session = await this.auth.api.getSession({ headers });
-        return session?.user?.id ?? null;
+        return (await this.currentSession(headers))?.userId ?? null;
+    }
+    // Both the caller's userId and the id of the session row they are authenticating
+    // with, for handlers that must tell the caller's own device apart from their others
+    // (eg sparing the acting session from a revoke-all).
+    async currentSession(headers) {
+        const resolved = await this.auth.api.getSession({ headers });
+        const userId = resolved?.user?.id;
+        return userId ? { userId, sessionId: resolved?.session?.id } : null;
     }
     async securityControlsFor(userId) {
         // 0 when trusted devices are not wired at all (some deployments), matching what
@@ -1471,22 +1519,126 @@ export class IdentityService {
         // clearing on every real reset).
         return SUCCESS;
     }
-    async changePassword(input, reqHeaders, resHeaders) {
+    async changePassword(input, reqHeaders, resHeaders, caller) {
         const headers = nodeHeadersToHeaders(reqHeaders);
-        const userId = await this.currentUserId(headers);
-        await assertRateLimit(this.limiter, `change-password:${userId ?? 'anonymous'}`, CHANGE_PASSWORD_RATE_LIMIT);
+        const { userId, sessionId } = caller;
+        await assertRateLimit(this.limiter, `change-password:${userId}`, CHANGE_PASSWORD_RATE_LIMIT);
         const res = await this.api.changePassword({
-            body: { currentPassword: input.currentPassword, newPassword: input.newPassword },
+            // revokeOtherSessions: better-auth deletes every session for this user and
+            // mints a fresh one for the caller; forwardCookies below ships that cookie.
+            body: {
+                currentPassword: input.currentPassword,
+                newPassword: input.newPassword,
+                revokeOtherSessions: true,
+            },
             headers,
             asResponse: true,
         });
         await ensureOk(res);
         this.forwardCookies(res, resHeaders);
-        if (userId) {
+        // Captured once the rotation is known committed - the deferred sweep below deletes
+        // any session row created at or before this instant (i.e. one a concurrent
+        // old-password sign-in raced in), sparing anything created afterwards.
+        const sweepDeadline = new Date();
+        // The token of the session better-auth just minted for the caller. `ensureOk` only
+        // reads the body on failure, so this read is safe here.
+        // Library boundary: `Response.json()` resolves to `any`, and better-auth publishes no
+        // response type for this route, so its shape is asserted once here.
+        const rotatedToken = (await res.json().catch(() => ({}))).token ?? null;
+        // better-auth's response only carries the token, not the row id - look the row up
+        // once here and reuse its id both to clamp the dontRememberMe TTL below and to
+        // spare this (legitimate) session from the sweep's own revoke push further down.
+        const rotated = rotatedToken
+            ? (await this.drizzle.db
+                .select({ id: session.id })
+                .from(session)
+                .where(eq(session.token, rotatedToken))
+                .limit(1))[0]
+            : undefined;
+        // `revokeOtherSessions` makes better-auth mint the replacement session via
+        // `createSession(userId)` with no `dontRememberMe` argument, so a caller who signed
+        // in with `rememberMe: false` silently gets a full-TTL row. better-auth's own
+        // `setSessionCookie` still honours the `dont_remember` cookie for the cookie maxAge,
+        // but not the DB row - clamp it back to the non-remembered TTL to match.
+        if (rotated && hasDontRememberCookie(headers)) {
             await this.drizzle.db
-                .update(user)
-                .set({ passwordMeetsPolicy: true })
-                .where(eq(user.id, userId));
+                .update(session)
+                .set({ expiresAt: new Date(Date.now() + DONT_REMEMBER_SESSION_TTL_MS) })
+                .where(eq(session.id, rotated.id));
+        }
+        const { ip, userAgent } = extractClientMeta(reqHeaders);
+        // Independent of each other and of `rotated` - one round trip instead of two on a
+        // user-facing endpoint. (The TTL clamp above does depend on `rotated`, so it stays
+        // sequential.)
+        const [, playerId] = await Promise.all([
+            this.drizzle.db.update(user).set({ passwordMeetsPolicy: true }).where(eq(user.id, userId)),
+            this.identityReader.getPlayerIdByUserIdSafe(userId),
+        ]);
+        // Dedicated, non-sensitive record that the login credential itself changed -
+        // the audit mapper keys the action off the topic, so a plain
+        // `identity.sessions.revoked_all` alone would read as "revoked all sessions",
+        // not "changed password". Every state-changing credential action needs its own
+        // accurately named audit record.
+        this.events.emit('identity.password.changed', {
+            userId,
+            playerId,
+            ip: ip ?? null,
+            userAgent: userAgent ?? null,
+        });
+        // Same event the admin "revoke all sessions" path emits, so the streamSession
+        // SSE handler pushes { type: 'revoked' } to this user's OTHER tabs.
+        // exceptSessionId is the caller's PRE-rotation session id - it's the id the
+        // caller's already-open streamSession connection captured at stream-open, and the
+        // only value its SSE compare can ever match, so this is what spares the
+        // initiating tab.
+        this.events.emit('identity.sessions.revoked_all', {
+            userId,
+            playerId,
+            actorId: userId,
+            ip: ip ?? null,
+            userAgent: userAgent ?? null,
+            exceptSessionId: sessionId,
+        });
+        // better-auth rotates the password hash and deletes sessions in separate,
+        // untransacted statements; a sign-in that verified the OLD password just before
+        // the rotation can still insert its session row right after. Re-sweep shortly
+        // after to delete it, sparing the caller's fresh session by token. Skipped when
+        // the rotated token is unknown - without it the sweep cannot tell the caller's
+        // own new session apart. Residual exposure: RACED_SESSION_SWEEP_DELAY_MS.
+        if (rotatedToken) {
+            const timer = setTimeout(() => {
+                void sweepRacedSessionsAfterPasswordChange(this.drizzle.db, {
+                    userId,
+                    sparedToken: rotatedToken,
+                    deadline: sweepDeadline,
+                })
+                    .then((deletedIds) => {
+                    // A session the sweep just force-deleted got no push and no audit record
+                    // otherwise: it raced in after the primary revoked_all above already
+                    // fired, so this is the only notice it gets of either.
+                    if (deletedIds.length === 0) {
+                        return;
+                    }
+                    this.events.emit('identity.sessions.revoked_all', {
+                        userId,
+                        playerId,
+                        actorId: userId,
+                        ip: ip ?? null,
+                        userAgent: userAgent ?? null,
+                        // The caller's PRE-rotation session id, same as the primary emit above -
+                        // it's what the initiating tab's already-open streamSession connection
+                        // captured at stream-open, and the only value its SSE compare can match.
+                        // `rotated.id` (the NEW row) can never match that, so using it here would
+                        // force-revoke the legitimate acting tab the moment the sweep actually
+                        // deletes a raced session.
+                        exceptSessionId: sessionId,
+                    });
+                })
+                    .catch((err) => {
+                    identityLogger.warn({ err, userId }, 'post-password-change session sweep failed');
+                });
+            }, RACED_SESSION_SWEEP_DELAY_MS);
+            timer.unref?.();
         }
         return SUCCESS;
     }