@openora/core 0.4.1-canary.17 → 0.4.1-canary.170

package/dist/pam/identity/contract/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/contract/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAOzB,eAAO,MAAM,iBAAiB;;;;;;iBAM5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgG5B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/contract/index.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,eAAO,MAAM,aAAa;;;iBAGxB,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;iBAkB5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAG5D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,uBAAuB;;;;;;;;;iBASlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,yBAAyB;;;;;;;iBAWpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,sBAAsB,kDAAmD,CAAC;AACvF,eAAO,MAAM,mBAAmB;;;;GAAsD,CAAC;AACvF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+S5B,CAAC"}

package/dist/pam/identity/contract/index.js

@@ -1,8 +1,8 @@
 import { oc, eventIterator } from '@orpc/contract';
-import { UserSchema, UuidSchema, LoginInputSchema, RegisterInputSchema, Enable2faInputSchema, Enable2faResultSchema, Verify2faInputSchema, Disable2faInputSchema, RequestPasswordResetInputSchema, ResetPasswordInputSchema, VerifyEmailInputSchema, UpdateProfileInputSchema, ChangePasswordInputSchema, ChangeEmailInputSchema, IdentitySuccessSchema, TimestampSchema, } from '@openora/core/contracts';
-import { PageQuerySchema, paginated } from '@openora/core/contracts/kit';
+import { UserSchema, UuidSchema, LoginInputSchema, RegisterInputSchema, RegisterOutputSchema, UsernameAvailabilityInputSchema, UsernameAvailabilityOutputSchema, Enable2faInputSchema, Enable2faResultSchema, Verify2faInputSchema, Disable2faInputSchema, SendTwoFactorOtpResultSchema, TwoFactorDeliveryMethodSchema, TwoFactorStatusSchema, RegenerateBackupCodesInputSchema, BackupCodesResultSchema, TrustCurrentDeviceInputSchema, RequestPasswordResetInputSchema, VerifyPasswordResetOtpInputSchema, ResetPasswordInputSchema, ResendEmailVerificationInputSchema, VerifyEmailInputSchema, UpdateProfileInputSchema, ChangePasswordInputSchema, RequestEmailChangeInputSchema, ConfirmEmailChangeInputSchema, IdentitySuccessSchema, Verify2faOutputSchema, TimestampSchema, PhoneLoginRequestInputSchema, PhoneLoginRequestOutputSchema, PhoneLoginVerifyInputSchema, LoginSecurityStateSchema, SecurityControlsSchema, SetAutoLogoutInputSchema, SetLoginWithdrawalAlertsInputSchema, SetRequireTwoFactorOnLoginInputSchema, SetWithdrawalPinInputSchema, SetAntiPhishingCodeInputSchema, PhoneVerificationRequestInputSchema, PhoneVerificationRequestOutputSchema, PhoneVerificationConfirmInputSchema, } from '@openora/core/contracts';
+import { PageQuerySchema, SortOrderSchema, paginated } from '@openora/core/contracts/kit';
 import * as z from 'zod';
-const SessionSchema = z.object({
+export const SessionSchema = z.object({
     token: z.string(),
     expiresAt: TimestampSchema,
 });
@@ -10,14 +10,60 @@ export const SessionItemSchema = z.object({
     id: UuidSchema,
     expiresAt: TimestampSchema,
     createdAt: TimestampSchema,
+    // Last time better-auth refreshed the session - "last used" in a device list.
+    updatedAt: TimestampSchema,
+    // Last admin request seen on this session. Finer-grained than `updatedAt`, which
+    // better-auth only refreshes once per updateAge window.
+    lastSeenAt: TimestampSchema.nullable(),
     ipAddress: z.string().nullable().optional(),
     userAgent: z.string().nullable().optional(),
+    // Human-readable rendering of userAgent for the session list.
+    deviceLabel: z.string(),
+    browser: z.string().nullable(),
+    os: z.string().nullable(),
+    // True for the session making the request; false everywhere it cannot be known
+    // (eg an admin listing someone else's devices).
+    current: z.boolean(),
 });
+// A session row plus who it belongs to - the cross-user list is useless without it.
+export const ActiveSessionItemSchema = SessionItemSchema.extend({
+    userId: UuidSchema,
+    email: z.email(),
+    role: z.string(),
+});
+export const TrustedDeviceItemSchema = z.object({
+    id: UuidSchema,
+    label: z.string(),
+    browser: z.string().nullable(),
+    os: z.string().nullable(),
+    ipAddress: z.string().nullable(),
+    lastUsedAt: TimestampSchema,
+    expiresAt: TimestampSchema,
+    isCurrent: z.boolean(),
+});
+export const AdminSecurityStatusSchema = z.object({
+    twoFactorEnabled: z.boolean(),
+    // Null when no second factor is set up, or when the operator stores backup codes in a
+    // form this process cannot read back.
+    backupCodesRemaining: z.number().int().nonnegative().nullable(),
+    // True when the operator requires a second factor and this account has none - the
+    // Backoffice renders the enrolment flow and nothing else while it holds.
+    enrollmentRequired: z.boolean(),
+    trustedDeviceDays: z.number().int().nonnegative(),
+    trustedDeviceUntil: TimestampSchema.nullable(),
+    lockedUntil: TimestampSchema.nullable(),
+});
+export const SESSION_SORT_BY_VALUES = ['createdAt', 'expiresAt', 'updatedAt'];
+export const SessionSortBySchema = z.enum(SESSION_SORT_BY_VALUES).default('createdAt');
 export const identityContract = {
     register: oc
         .route({ method: 'POST', path: '/identity/register' })
         .input(RegisterInputSchema)
-        .output(z.object({ user: UserSchema })),
+        .output(RegisterOutputSchema),
+    usernameAvailable: oc
+        .route({ method: 'GET', path: '/identity/username-available' })
+        .input(UsernameAvailabilityInputSchema)
+        .output(UsernameAvailabilityOutputSchema),
     // When 2FA is enabled, better-auth withholds the session and signals `twoFactorRedirect`; client must then call verify2fa.
     login: oc
         .route({ method: 'POST', path: '/identity/login' })
@@ -26,12 +72,75 @@ export const identityContract = {
         user: UserSchema.optional(),
         session: SessionSchema.optional(),
         twoFactorRedirect: z.boolean().optional(),
+        // Which second factor the challenge should ask for. Absent when the attempt
+        // never resolved to an account, so the client falls back to an authenticator.
+        twoFactorMethod: TwoFactorDeliveryMethodSchema.optional(),
+        security: LoginSecurityStateSchema.optional(),
+        // So the challenge screen's "trust this device" copy can name the operator's
+        // actual configured window - there is no session yet to read it from
+        // `security.me`. Same value `SecurityControlsSchema.trustedDeviceDays` carries
+        // post-login; present only alongside `twoFactorRedirect`.
+        trustedDeviceDays: z.number().int().nonnegative().optional(),
     })),
+    phoneLoginRequest: oc
+        .route({ method: 'POST', path: '/identity/phone-login/request' })
+        .input(PhoneLoginRequestInputSchema)
+        .output(PhoneLoginRequestOutputSchema),
+    phoneLoginVerify: oc
+        .route({ method: 'POST', path: '/identity/phone-login/verify' })
+        .input(PhoneLoginVerifyInputSchema)
+        .output(z.object({ user: UserSchema, session: SessionSchema, security: LoginSecurityStateSchema })),
     logout: oc.route({ method: 'POST', path: '/identity/logout' }).output(IdentitySuccessSchema),
     me: oc.route({ method: 'GET', path: '/identity/me' }).output(UserSchema.nullable()),
+    security: {
+        me: oc.route({ method: 'GET', path: '/identity/security/me' }).output(SecurityControlsSchema),
+        loginWithdrawalAlerts: oc
+            .route({ method: 'POST', path: '/identity/security/login-withdrawal-alerts' })
+            .input(SetLoginWithdrawalAlertsInputSchema)
+            .output(SecurityControlsSchema),
+        // The two halves of "Remember Device". Kept as separate routes rather than one
+        // patch so each carries its own audit event - a licence review asks when 2FA
+        // enforcement changed, not when any security preference did.
+        autoLogout: oc
+            .route({ method: 'POST', path: '/identity/security/auto-logout' })
+            .input(SetAutoLogoutInputSchema)
+            .output(SecurityControlsSchema),
+        requireTwoFactorOnLogin: oc
+            .route({ method: 'POST', path: '/identity/security/require-two-factor' })
+            .input(SetRequireTwoFactorOnLoginInputSchema)
+            .output(SecurityControlsSchema),
+        // Set and Change share this one upsert route (identical New PIN/Confirm PIN/Save
+        // flow); Remove is a separate route with no confirmation step, per AC.
+        setWithdrawalPin: oc
+            .route({ method: 'POST', path: '/identity/security/withdrawal-pin' })
+            .input(SetWithdrawalPinInputSchema)
+            .output(SecurityControlsSchema),
+        removeWithdrawalPin: oc
+            .route({ method: 'DELETE', path: '/identity/security/withdrawal-pin' })
+            .output(SecurityControlsSchema),
+        // No reauth (not money-moving, unlike the withdrawal PIN); set/overwrite only, no
+        // remove route. Calling it again with a new value changes the code.
+        setAntiPhishingCode: oc
+            .route({ method: 'POST', path: '/identity/security/anti-phishing-code' })
+            .input(SetAntiPhishingCodeInputSchema)
+            .output(SecurityControlsSchema),
+    },
+    phoneVerification: {
+        request: oc
+            .route({ method: 'POST', path: '/identity/phone-verification/request' })
+            .input(PhoneVerificationRequestInputSchema)
+            .output(PhoneVerificationRequestOutputSchema),
+        confirm: oc
+            .route({ method: 'POST', path: '/identity/phone-verification/confirm' })
+            .input(PhoneVerificationConfirmInputSchema)
+            .output(SecurityControlsSchema),
+    },
     streamSession: oc
         .route({ method: 'GET', path: '/identity/session/stream' })
-        .output(eventIterator(z.object({ type: z.literal('revoked') }))),
+        .output(eventIterator(z.discriminatedUnion('type', [
+        z.object({ type: z.literal('revoked') }),
+        z.object({ type: z.literal('unlocked') }),
+    ]))),
     enable2fa: oc
         .route({ method: 'POST', path: '/identity/2fa/enable' })
         .input(Enable2faInputSchema)
@@ -39,15 +148,35 @@ export const identityContract = {
     verify2fa: oc
         .route({ method: 'POST', path: '/identity/2fa/verify' })
         .input(Verify2faInputSchema)
-        .output(IdentitySuccessSchema),
+        .output(Verify2faOutputSchema),
     disable2fa: oc
         .route({ method: 'POST', path: '/identity/2fa/disable' })
         .input(Disable2faInputSchema)
         .output(IdentitySuccessSchema),
+    // Pushes a fresh code to an `email`/`sms` account. The subject is resolved from a
+    // live session or, failing that, the signed pending-challenge cookie, so this
+    // answers during enrolment ("Resend code") and mid-login alike - and takes no body,
+    // so the caller can never name an account other than its own.
+    sendTwoFactorOtp: oc
+        .route({ method: 'POST', path: '/identity/2fa/otp/send' })
+        .output(SendTwoFactorOtpResultSchema),
+    twoFactorStatus: oc
+        .route({ method: 'GET', path: '/identity/2fa/status' })
+        .output(TwoFactorStatusSchema),
+    // Backup codes are spent one per use and are shown exactly once, so an account that
+    // burns through them needs a way back to a full set without dropping its second factor.
+    regenerateBackupCodes: oc
+        .route({ method: 'POST', path: '/identity/2fa/backup-codes/regenerate' })
+        .input(RegenerateBackupCodesInputSchema)
+        .output(BackupCodesResultSchema),
     requestPasswordReset: oc
         .route({ method: 'POST', path: '/identity/password/forgot' })
         .input(RequestPasswordResetInputSchema)
         .output(IdentitySuccessSchema),
+    verifyPasswordResetOtp: oc
+        .route({ method: 'POST', path: '/identity/password/verify-otp' })
+        .input(VerifyPasswordResetOtpInputSchema)
+        .output(IdentitySuccessSchema),
     resetPassword: oc
         .route({ method: 'POST', path: '/identity/password/reset' })
         .input(ResetPasswordInputSchema)
@@ -56,16 +185,32 @@ export const identityContract = {
         .route({ method: 'POST', path: '/identity/password/change' })
         .input(ChangePasswordInputSchema)
         .output(IdentitySuccessSchema),
+    // Unauthenticated: the player has no session until the emailed code is verified.
+    // Always answers success, so it never reveals whether the address has an account.
     sendEmailVerification: oc
         .route({ method: 'POST', path: '/identity/email/verify/send' })
+        .input(ResendEmailVerificationInputSchema)
         .output(IdentitySuccessSchema),
+    // Verifying the registration code is what mints the session (sign-up never does). A
+    // 2FA-enrolled account is verified but NOT signed in - it gets `twoFactorRedirect` and
+    // completes the challenge through `login`, exactly as that route signals it.
     verifyEmail: oc
         .route({ method: 'POST', path: '/identity/email/verify' })
         .input(VerifyEmailInputSchema)
+        .output(z.object({
+        user: UserSchema.optional(),
+        session: SessionSchema.optional(),
+        twoFactorRedirect: z.boolean().optional(),
+    })),
+    // Two-step change: `requestEmailChange` mails an OTP to the new address,
+    // `confirmEmailChange` verifies it and swaps the login email.
+    requestEmailChange: oc
+        .route({ method: 'POST', path: '/identity/email/change/request' })
+        .input(RequestEmailChangeInputSchema)
         .output(IdentitySuccessSchema),
-    changeEmail: oc
-        .route({ method: 'POST', path: '/identity/email/change' })
-        .input(ChangeEmailInputSchema)
+    confirmEmailChange: oc
+        .route({ method: 'POST', path: '/identity/email/change/confirm' })
+        .input(ConfirmEmailChangeInputSchema)
         .output(IdentitySuccessSchema),
     updateProfile: oc
         .route({ method: 'PATCH', path: '/identity/profile' })
@@ -75,10 +220,18 @@ export const identityContract = {
         .route({ method: 'POST', path: '/identity/unlock' })
         .input(z.object({ userId: UuidSchema }))
         .output(IdentitySuccessSchema),
+    adminRequestPasswordReset: oc
+        .route({ method: 'POST', path: '/identity/admin/password-reset' })
+        .input(z.object({ userId: UuidSchema }))
+        .output(IdentitySuccessSchema),
     sessions: {
         list: oc
             .route({ method: 'GET', path: '/identity/sessions' })
-            .input(PageQuerySchema.extend({ userId: UuidSchema }))
+            .input(PageQuerySchema.extend({
+            userId: UuidSchema,
+            sortBy: SessionSortBySchema.optional(),
+            sortOrder: SortOrderSchema.default('desc').optional(),
+        }))
             .output(paginated(SessionItemSchema)),
         revoke: oc
             .route({ method: 'POST', path: '/identity/sessions/revoke' })
@@ -88,6 +241,61 @@ export const identityContract = {
             .route({ method: 'POST', path: '/identity/sessions/revoke-all' })
             .input(z.object({ userId: UuidSchema }))
             .output(IdentitySuccessSchema),
+        // Self-service twins of the admin routes above: the caller's own devices only,
+        // scoped by the verified session rather than a `userId` input.
+        listMine: oc
+            .route({ method: 'GET', path: '/identity/sessions/me' })
+            .input(PageQuerySchema.extend({
+            sortBy: SessionSortBySchema.optional(),
+            sortOrder: SortOrderSchema.default('desc').optional(),
+        }))
+            .output(paginated(SessionItemSchema)),
+        revokeMine: oc
+            .route({ method: 'POST', path: '/identity/sessions/me/revoke' })
+            .input(z.object({ id: UuidSchema }))
+            .output(IdentitySuccessSchema),
+        // Cross-user view: every active session on the platform, for the admin who holds
+        // sessions:view. The per-user route above needs a userId and so cannot answer
+        // "who is logged in right now".
+        listAll: oc
+            .route({ method: 'GET', path: '/identity/sessions/all' })
+            .input(PageQuerySchema.extend({
+            role: z.string().optional(),
+            query: z.string().optional(),
+            sortBy: SessionSortBySchema.optional(),
+            sortOrder: SortOrderSchema.default('desc').optional(),
+        }))
+            .output(paginated(ActiveSessionItemSchema)),
+    },
+    adminSecurity: {
+        status: oc
+            .route({ method: 'GET', path: '/identity/admin-security/status' })
+            .output(AdminSecurityStatusSchema),
+        trustedDevices: oc
+            .route({ method: 'GET', path: '/identity/admin-security/trusted-devices' })
+            .output(z.array(TrustedDeviceItemSchema)),
+        // better-auth mints its trust cookie only on the sign-in leg of a challenge, so
+        // granting the trust from inside the account re-runs that leg behind this route.
+        trustCurrentDevice: oc
+            .route({ method: 'POST', path: '/identity/admin-security/trusted-devices/trust' })
+            .input(TrustCurrentDeviceInputSchema)
+            .output(IdentitySuccessSchema),
+        revokeTrustedDevice: oc
+            .route({ method: 'POST', path: '/identity/admin-security/trusted-devices/revoke' })
+            .input(z.object({ id: UuidSchema }))
+            .output(IdentitySuccessSchema),
+        // Clears someone else's second factor entirely, back to the unenrolled state.
+        // Super Admin only; the `reason` is recorded on identity.2fa.reset so the audit
+        // trail carries why an account was put back to the unenrolled state.
+        resetUserTwoFactor: oc
+            .route({ method: 'POST', path: '/identity/admin-security/2fa/reset' })
+            .input(z.object({ userId: UuidSchema, reason: z.string().trim().min(10).max(500) }))
+            .output(IdentitySuccessSchema),
+        // Cross-user twin, for a Super Admin cutting off someone else's trusted device.
+        revokeUserTrustedDevice: oc
+            .route({ method: 'POST', path: '/identity/admin-security/trusted-devices/revoke-for-user' })
+            .input(z.object({ userId: UuidSchema, id: UuidSchema }))
+            .output(IdentitySuccessSchema),
     },
 };
 //# sourceMappingURL=index.js.map

package/dist/pam/identity/contract/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,+BAA+B,EAC/B,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,UAAU;IACd,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,EAAE;SACT,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;SACrD,KAAK,CAAC,mBAAmB,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAEzC,2HAA2H;IAC3H,KAAK,EAAE,EAAE;SACN,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAClD,KAAK,CAAC,gBAAgB,CAAC;SACvB,MAAM,CACL,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC3B,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;QACjC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC,CACH;IAEH,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC;IAE5F,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;IAEnF,aAAa,EAAE,EAAE;SACd,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;SAC1D,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAElE,SAAS,EAAE,EAAE;SACV,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;SACvD,KAAK,CAAC,oBAAoB,CAAC;SAC3B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,SAAS,EAAE,EAAE;SACV,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;SACvD,KAAK,CAAC,oBAAoB,CAAC;SAC3B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,UAAU,EAAE,EAAE;SACX,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;SACxD,KAAK,CAAC,qBAAqB,CAAC;SAC5B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,oBAAoB,EAAE,EAAE;SACrB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;SAC5D,KAAK,CAAC,+BAA+B,CAAC;SACtC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,aAAa,EAAE,EAAE;SACd,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;SAC3D,KAAK,CAAC,wBAAwB,CAAC;SAC/B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,cAAc,EAAE,EAAE;SACf,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;SAC5D,KAAK,CAAC,yBAAyB,CAAC;SAChC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,qBAAqB,EAAE,EAAE;SACtB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC;SAC9D,MAAM,CAAC,qBAAqB,CAAC;IAEhC,WAAW,EAAE,EAAE;SACZ,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;SACzD,KAAK,CAAC,sBAAsB,CAAC;SAC7B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,WAAW,EAAE,EAAE;SACZ,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;SACzD,KAAK,CAAC,sBAAsB,CAAC;SAC7B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,aAAa,EAAE,EAAE;SACd,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;SACrD,KAAK,CAAC,wBAAwB,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAEzC,UAAU,EAAE,EAAE;SACX,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;SACnD,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;SACvC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,QAAQ,EAAE;QACR,IAAI,EAAE,EAAE;aACL,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;aACpD,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;aACrD,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAEvC,MAAM,EAAE,EAAE;aACP,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;aAC5D,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;aACvD,MAAM,CAAC,qBAAqB,CAAC;QAEhC,SAAS,EAAE,EAAE;aACV,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC;aAChE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;aACvC,MAAM,CAAC,qBAAqB,CAAC;KACjC;CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,+BAA+B,EAC/B,gCAAgC,EAChC,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,uBAAuB,EACvB,6BAA6B,EAC7B,+BAA+B,EAC/B,iCAAiC,EACjC,wBAAwB,EACxB,kCAAkC,EAClC,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,4BAA4B,EAC5B,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,mCAAmC,EACnC,qCAAqC,EACrC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,UAAU;IACd,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,eAAe;IAC1B,8EAA8E;IAC9E,SAAS,EAAE,eAAe;IAC1B,iFAAiF;IACjF,wDAAwD;IACxD,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,8DAA8D;IAC9D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,+EAA+E;IAC/E,gDAAgD;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC,MAAM,CAAC;IAC9D,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,eAAe;IAC3B,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,sFAAsF;IACtF,sCAAsC;IACtC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC/D,kFAAkF;IAClF,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACjD,kBAAkB,EAAE,eAAe,CAAC,QAAQ,EAAE;IAC9C,WAAW,EAAE,eAAe,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAU,CAAC;AACvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AAGvF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,EAAE;SACT,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;SACrD,KAAK,CAAC,mBAAmB,CAAC;SAC1B,MAAM,CAAC,oBAAoB,CAAC;IAE/B,iBAAiB,EAAE,EAAE;SAClB,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC;SAC9D,KAAK,CAAC,+BAA+B,CAAC;SACtC,MAAM,CAAC,gCAAgC,CAAC;IAE3C,2HAA2H;IAC3H,KAAK,EAAE,EAAE;SACN,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAClD,KAAK,CAAC,gBAAgB,CAAC;SACvB,MAAM,CACL,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC3B,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;QACjC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACzC,4EAA4E;QAC5E,8EAA8E;QAC9E,eAAe,EAAE,6BAA6B,CAAC,QAAQ,EAAE;QACzD,QAAQ,EAAE,wBAAwB,CAAC,QAAQ,EAAE;QAC7C,6EAA6E;QAC7E,qEAAqE;QACrE,+EAA+E;QAC/E,0DAA0D;QAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KAC7D,CAAC,CACH;IAEH,iBAAiB,EAAE,EAAE;SAClB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC;SAChE,KAAK,CAAC,4BAA4B,CAAC;SACnC,MAAM,CAAC,6BAA6B,CAAC;IAExC,gBAAgB,EAAE,EAAE;SACjB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC;SAC/D,KAAK,CAAC,2BAA2B,CAAC;SAClC,MAAM,CACL,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAC3F;IAEH,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC;IAE5F,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;IAEnF,QAAQ,EAAE;QACR,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC;QAE7F,qBAAqB,EAAE,EAAE;aACtB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4CAA4C,EAAE,CAAC;aAC7E,KAAK,CAAC,mCAAmC,CAAC;aAC1C,MAAM,CAAC,sBAAsB,CAAC;QAEjC,+EAA+E;QAC/E,6EAA6E;QAC7E,6DAA6D;QAC7D,UAAU,EAAE,EAAE;aACX,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC;aACjE,KAAK,CAAC,wBAAwB,CAAC;aAC/B,MAAM,CAAC,sBAAsB,CAAC;QAEjC,uBAAuB,EAAE,EAAE;aACxB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC;aACxE,KAAK,CAAC,qCAAqC,CAAC;aAC5C,MAAM,CAAC,sBAAsB,CAAC;QAEjC,iFAAiF;QACjF,uEAAuE;QACvE,gBAAgB,EAAE,EAAE;aACjB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC;aACpE,KAAK,CAAC,2BAA2B,CAAC;aAClC,MAAM,CAAC,sBAAsB,CAAC;QAEjC,mBAAmB,EAAE,EAAE;aACpB,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC;aACtE,MAAM,CAAC,sBAAsB,CAAC;QAEjC,kFAAkF;QAClF,oEAAoE;QACpE,mBAAmB,EAAE,EAAE;aACpB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC;aACxE,KAAK,CAAC,8BAA8B,CAAC;aACrC,MAAM,CAAC,sBAAsB,CAAC;KAClC;IAED,iBAAiB,EAAE;QACjB,OAAO,EAAE,EAAE;aACR,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC;aACvE,KAAK,CAAC,mCAAmC,CAAC;aAC1C,MAAM,CAAC,oCAAoC,CAAC;QAE/C,OAAO,EAAE,EAAE;aACR,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC;aACvE,KAAK,CAAC,mCAAmC,CAAC;aAC1C,MAAM,CAAC,sBAAsB,CAAC;KAClC;IAED,aAAa,EAAE,EAAE;SACd,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;SAC1D,MAAM,CACL,aAAa,CACX,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC3B,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;KAC1C,CAAC,CACH,CACF;IAEH,SAAS,EAAE,EAAE;SACV,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;SACvD,KAAK,CAAC,oBAAoB,CAAC;SAC3B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,SAAS,EAAE,EAAE;SACV,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;SACvD,KAAK,CAAC,oBAAoB,CAAC;SAC3B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,UAAU,EAAE,EAAE;SACX,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;SACxD,KAAK,CAAC,qBAAqB,CAAC;SAC5B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,kFAAkF;IAClF,8EAA8E;IAC9E,oFAAoF;IACpF,8DAA8D;IAC9D,gBAAgB,EAAE,EAAE;SACjB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;SACzD,MAAM,CAAC,4BAA4B,CAAC;IAEvC,eAAe,EAAE,EAAE;SAChB,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;SACtD,MAAM,CAAC,qBAAqB,CAAC;IAEhC,oFAAoF;IACpF,wFAAwF;IACxF,qBAAqB,EAAE,EAAE;SACtB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC;SACxE,KAAK,CAAC,gCAAgC,CAAC;SACvC,MAAM,CAAC,uBAAuB,CAAC;IAElC,oBAAoB,EAAE,EAAE;SACrB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;SAC5D,KAAK,CAAC,+BAA+B,CAAC;SACtC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,sBAAsB,EAAE,EAAE;SACvB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC;SAChE,KAAK,CAAC,iCAAiC,CAAC;SACxC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,aAAa,EAAE,EAAE;SACd,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;SAC3D,KAAK,CAAC,wBAAwB,CAAC;SAC/B,MAAM,CAAC,qBAAqB,CAAC;IAEhC,cAAc,EAAE,EAAE;SACf,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;SAC5D,KAAK,CAAC,yBAAyB,CAAC;SAChC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,iFAAiF;IACjF,kFAAkF;IAClF,qBAAqB,EAAE,EAAE;SACtB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC;SAC9D,KAAK,CAAC,kCAAkC,CAAC;SACzC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,oFAAoF;IACpF,uFAAuF;IACvF,6EAA6E;IAC7E,WAAW,EAAE,EAAE;SACZ,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;SACzD,KAAK,CAAC,sBAAsB,CAAC;SAC7B,MAAM,CACL,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC3B,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;QACjC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC,CACH;IAEH,yEAAyE;IACzE,8DAA8D;IAC9D,kBAAkB,EAAE,EAAE;SACnB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC;SACjE,KAAK,CAAC,6BAA6B,CAAC;SACpC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,kBAAkB,EAAE,EAAE;SACnB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC;SACjE,KAAK,CAAC,6BAA6B,CAAC;SACpC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,aAAa,EAAE,EAAE;SACd,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;SACrD,KAAK,CAAC,wBAAwB,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAEzC,UAAU,EAAE,EAAE;SACX,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;SACnD,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;SACvC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,yBAAyB,EAAE,EAAE;SAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC;SACjE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;SACvC,MAAM,CAAC,qBAAqB,CAAC;IAEhC,QAAQ,EAAE;QACR,IAAI,EAAE,EAAE;aACL,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;aACpD,KAAK,CACJ,eAAe,CAAC,MAAM,CAAC;YACrB,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACtC,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;SACtD,CAAC,CACH;aACA,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAEvC,MAAM,EAAE,EAAE;aACP,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;aAC5D,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;aACvD,MAAM,CAAC,qBAAqB,CAAC;QAEhC,SAAS,EAAE,EAAE;aACV,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC;aAChE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;aACvC,MAAM,CAAC,qBAAqB,CAAC;QAEhC,+EAA+E;QAC/E,+DAA+D;QAC/D,QAAQ,EAAE,EAAE;aACT,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;aACvD,KAAK,CACJ,eAAe,CAAC,MAAM,CAAC;YACrB,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACtC,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;SACtD,CAAC,CACH;aACA,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAEvC,UAAU,EAAE,EAAE;aACX,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC;aAC/D,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;aACnC,MAAM,CAAC,qBAAqB,CAAC;QAEhC,iFAAiF;QACjF,8EAA8E;QAC9E,gCAAgC;QAChC,OAAO,EAAE,EAAE;aACR,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;aACxD,KAAK,CACJ,eAAe,CAAC,MAAM,CAAC;YACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACtC,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;SACtD,CAAC,CACH;aACA,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;KAC9C;IAED,aAAa,EAAE;QACb,MAAM,EAAE,EAAE;aACP,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC;aACjE,MAAM,CAAC,yBAAyB,CAAC;QAEpC,cAAc,EAAE,EAAE;aACf,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0CAA0C,EAAE,CAAC;aAC1E,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAE3C,gFAAgF;QAChF,iFAAiF;QACjF,kBAAkB,EAAE,EAAE;aACnB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gDAAgD,EAAE,CAAC;aACjF,KAAK,CAAC,6BAA6B,CAAC;aACpC,MAAM,CAAC,qBAAqB,CAAC;QAEhC,mBAAmB,EAAE,EAAE;aACpB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAAC;aAClF,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;aACnC,MAAM,CAAC,qBAAqB,CAAC;QAEhC,8EAA8E;QAC9E,gFAAgF;QAChF,qEAAqE;QACrE,kBAAkB,EAAE,EAAE;aACnB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAAC;aACrE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aACnF,MAAM,CAAC,qBAAqB,CAAC;QAEhC,gFAAgF;QAChF,uBAAuB,EAAE,EAAE;aACxB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0DAA0D,EAAE,CAAC;aAC3F,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;aACvD,MAAM,CAAC,qBAAqB,CAAC;KACjC;CACF,CAAC"}

package/dist/pam/identity/drizzle/migrations/0001_rainy_peter_quill.sql

@@ -0,0 +1,18 @@
+CREATE TABLE "sms_otp_session" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" uuid NOT NULL,
+	"phone" text NOT NULL,
+	"code_hash" text NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"failed_attempts" integer DEFAULT 0 NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "phone_number" text;--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "phone_verified" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "phone_verified_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "lockout_count" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "last_lockout_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "sms_otp_session" ADD CONSTRAINT "sms_otp_session_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "sms_otp_session_user_id_idx" ON "sms_otp_session" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "sms_otp_session_phone_idx" ON "sms_otp_session" USING btree ("phone");

package/dist/pam/identity/drizzle/migrations/0002_outstanding_patriot.sql

@@ -0,0 +1 @@
+ALTER TABLE "sms_otp_session" ADD CONSTRAINT "sms_otp_session_userId_unique" UNIQUE("user_id");

package/dist/pam/identity/drizzle/migrations/0003_open_shotgun.sql

@@ -0,0 +1 @@
+ALTER TABLE "user" ADD CONSTRAINT "user_phoneNumber_unique" UNIQUE("phone_number");

package/dist/pam/identity/drizzle/migrations/0004_round_giant_girl.sql

@@ -0,0 +1 @@
+DROP INDEX "sms_otp_session_user_id_idx";

package/dist/pam/identity/drizzle/migrations/0005_daily_black_tom.sql

@@ -0,0 +1 @@
+CREATE INDEX "user_created_at_idx" ON "user" USING btree ("created_at");

package/dist/pam/identity/drizzle/migrations/0006_brave_sabra.sql

@@ -0,0 +1 @@
+ALTER TABLE "user" ADD COLUMN "last_failed_login_at" timestamp with time zone;

package/dist/pam/identity/drizzle/migrations/0007_fuzzy_barracuda.sql

@@ -0,0 +1,44 @@
+ALTER TABLE "user" ADD COLUMN "username" text;--> statement-breakpoint
+DO $$
+BEGIN
+  CREATE TEMP TABLE legacy_display_name (user_id uuid PRIMARY KEY, display_name text) ON COMMIT DROP;
+  -- Isolated module tests migrate identity without profile, so the legacy display
+  -- name is only read when that table exists. EXECUTE keeps it out of the plan.
+  IF to_regclass('player') IS NOT NULL THEN
+    EXECUTE 'INSERT INTO legacy_display_name SELECT user_id, display_name FROM player';
+  END IF;
+
+  -- The first holder of a base handle keeps it; every later holder falls back to a
+  -- form suffixed with its own user id, so allocation is globally unique in one pass
+  -- rather than a per-row probe against the growing set of taken handles.
+  WITH normalized AS (
+    SELECT
+      u.id,
+      left(
+        regexp_replace(
+          lower(coalesce(nullif(l.display_name, ''), nullif(u.name, ''), 'player')),
+          '[^a-z0-9_]+', '_', 'g'
+        ),
+        20
+      ) AS base
+    FROM "user" AS u
+    LEFT JOIN legacy_display_name AS l ON l.user_id = u.id
+    WHERE u.username IS NULL
+  ), sanitized AS (
+    SELECT id, CASE WHEN base IS NULL OR length(base) < 3 THEN 'player' ELSE base END AS base
+    FROM normalized
+  ), ranked AS (
+    SELECT id, base, row_number() OVER (PARTITION BY base ORDER BY id) AS rank
+    FROM sanitized
+  )
+  UPDATE "user" AS u
+  SET username = CASE
+    WHEN ranked.rank = 1 THEN ranked.base
+    ELSE left(ranked.base, 7) || '_' || left(replace(u.id::text, '-', ''), 12)
+  END
+  FROM ranked
+  WHERE u.id = ranked.id;
+END $$;--> statement-breakpoint
+ALTER TABLE "user" ALTER COLUMN "username" SET NOT NULL;--> statement-breakpoint
+CREATE UNIQUE INDEX "user_username_unique" ON "user" USING btree (lower("username"));--> statement-breakpoint
+CREATE INDEX "user_username_trgm_idx" ON "user" USING gin ("username" gin_trgm_ops);

package/dist/pam/identity/drizzle/migrations/0008_pink_bucky.sql

@@ -0,0 +1,23 @@
+CREATE TABLE "admin_trusted_device" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" uuid NOT NULL,
+	"device_hash" text NOT NULL,
+	"label" text NOT NULL,
+	"ip_address" text,
+	"user_agent" text,
+	"last_used_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"revoked_at" timestamp with time zone,
+	"revoked_by" uuid,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "session" ADD COLUMN "last_seen_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "failed_two_factor_attempts" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "two_factor_lockout_until" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "two_factor_lockout_count" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "last_failed_two_factor_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "admin_trusted_device" ADD CONSTRAINT "admin_trusted_device_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "admin_trusted_device_user_hash_idx" ON "admin_trusted_device" USING btree ("user_id","device_hash");--> statement-breakpoint
+CREATE INDEX "admin_trusted_device_user_id_idx" ON "admin_trusted_device" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "admin_trusted_device_expires_at_idx" ON "admin_trusted_device" USING btree ("expires_at");

package/dist/pam/identity/drizzle/migrations/0009_hard_sauron.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "two_factor" ADD COLUMN "failed_verification_count" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "two_factor" ADD COLUMN "locked_until" timestamp with time zone;

package/dist/pam/identity/drizzle/migrations/0010_lying_young_avengers.sql

@@ -0,0 +1,19 @@
+CREATE TABLE "phone_verification_session" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" uuid NOT NULL,
+	"session_id" uuid NOT NULL,
+	"phone" text NOT NULL,
+	"code_hash" text NOT NULL,
+	"reauthenticated_at" timestamp with time zone NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"failed_attempts" integer DEFAULT 0 NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "phone_verification_session_userId_unique" UNIQUE("user_id")
+);
+--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "password_meets_policy" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "login_withdrawal_alerts_enabled" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "phone_verification_session" ADD CONSTRAINT "phone_verification_session_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "phone_verification_session" ADD CONSTRAINT "phone_verification_session_session_id_session_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."session"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "phone_verification_session_phone_idx" ON "phone_verification_session" USING btree ("phone");--> statement-breakpoint
+CREATE INDEX "phone_verification_session_session_id_idx" ON "phone_verification_session" USING btree ("session_id");

package/dist/pam/identity/drizzle/migrations/0011_useful_the_executioner.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "user" ADD COLUMN "withdrawal_pin_hash" text;--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "withdrawal_pin_set_at" timestamp with time zone;

package/dist/pam/identity/drizzle/migrations/0012_worried_nuke.sql

@@ -0,0 +1,2 @@
+CREATE TYPE "public"."two_factor_method" AS ENUM('app', 'email', 'sms');--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "two_factor_method" "two_factor_method";

package/dist/pam/identity/drizzle/migrations/0013_backfill_two_factor_method.sql

@@ -0,0 +1,6 @@
+-- 0012 added two_factor_method nullable, so every account enrolled before it kept NULL -
+-- the value the column otherwise reserves for an account with no second factor. `app` was
+-- the only method the platform could enrol into, so that is what those rows are. Left NULL
+-- they would read as enabled with no active method, and their step-up codes would route to
+-- the TOTP endpoint or the pushed-code one by accident rather than by enrolment.
+UPDATE "user" SET "two_factor_method" = 'app' WHERE "two_factor_enabled" = true;

package/dist/pam/identity/drizzle/migrations/0014_spicy_mephistopheles.sql

@@ -0,0 +1 @@
+ALTER TABLE "user" ADD COLUMN "anti_phishing_code" text;

package/dist/pam/identity/drizzle/migrations/0015_parallel_moira_mactaggert.sql

@@ -0,0 +1,3 @@
+CREATE TYPE "public"."auto_logout_duration" AS ENUM('15m', '1h', '24h', '7d', '30d');--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "auto_logout_duration" "auto_logout_duration" DEFAULT '7d' NOT NULL;--> statement-breakpoint
+ALTER TABLE "user" ADD COLUMN "require_two_factor_on_login" boolean DEFAULT false NOT NULL;