@proteinjs/user-server 1.22.1 → 1.22.3

package/dist/src/throttle/SignInThrottle.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signInThrottle = exports.SignInThrottle = void 0;
+var SlidingWindow_1 = require("./SlidingWindow");
+/**
+ * The sign-in door's two windows (`POST /user/login`), keyed by digests (`RequestDigests`),
+ * never by an address:
+ * - per CLIENT: every try that is not a success counts — wrong passwords, blank ones too, the
+ *   client made them — so one device cannot sweep many accounts; a successful sign-in never
+ *   counts (it is forgiven the moment it succeeds), so the people behind one shared address
+ *   signing in do not spend the window on each other;
+ * - per ACCOUNT: every try that carries a password counts (a blank submission judges no
+ *   password, so it never counts), so guesses spread over many devices still stop; a success
+ *   clears the account's count. A try is counted as it ARRIVES, before it is judged: tries in
+ *   flight at the same moment cannot all pass the window together.
+ *
+ * A throttled try is told `ANSWER` whichever window refused it and whether or not the address
+ * has an account, in the same time a refused password takes (the door runs the same password
+ * check and discards its verdict).
+ *
+ * The windows are in process memory (`SlidingWindow`): per replica. A deployment of three
+ * replicas behind a load balancer (up to ten under load) keeps three sets of windows, so its
+ * effective ceiling is ~3× the numbers below (up to ~10×). Friction, not the wall — a shared
+ * store is a separate step.
+ */
+var SignInThrottle = /** @class */ (function () {
+    function SignInThrottle(options) {
+        this.clients = new SlidingWindow_1.SlidingWindow({
+            windowMs: SignInThrottle.CLIENT_WINDOW_MS,
+            limit: SignInThrottle.CLIENT_LIMIT,
+            now: options === null || options === void 0 ? void 0 : options.now,
+        });
+        this.accounts = new SlidingWindow_1.SlidingWindow({
+            windowMs: SignInThrottle.ACCOUNT_WINDOW_MS,
+            limit: SignInThrottle.ACCOUNT_LIMIT,
+            now: options === null || options === void 0 ? void 0 : options.now,
+        });
+    }
+    /**
+     * Count this try against the client and against the account, and answer which window refuses
+     * it, if any. `account` is the digest of the address tried, given only when a password came
+     * with it (a blank submission judges no password, so it never counts toward an account). The
+     * count is taken here, before the try is judged, so tries in flight at once cannot all pass
+     * the window; a success clears it (`recordSuccess`).
+     */
+    SignInThrottle.prototype.admit = function (client, account) {
+        if (this.clients.hit(client)) {
+            return 'client';
+        }
+        if (account !== undefined && this.accounts.hit(account)) {
+            return 'account';
+        }
+        return undefined;
+    };
+    /**
+     * The account proved itself: its window opens again. When it was a sign-in try from `client`
+     * (rather than a reset link redeemed), that try is forgiven — a success never counts against
+     * the device.
+     */
+    SignInThrottle.prototype.recordSuccess = function (account, client) {
+        this.accounts.clear(account);
+        if (client !== undefined) {
+            this.clients.forgive(client);
+        }
+    };
+    /** What a throttled try is told — in plain words, the same for every address, known or not. */
+    SignInThrottle.ANSWER = 'Too many attempts. Try again in a few minutes.';
+    /**
+     * Per client: 50 tries that are not successes in 10 minutes (the founder's number, 2026-09-23).
+     * Successes never count, so an office or a school behind one address signing in at nine o'clock
+     * never spends this window on itself — only its mistypes do, and fifty wrong or blank tries in
+     * ten minutes is beyond any human population behind one address; a guessing script from one
+     * device is held to ~300 tries an hour per replica.
+     */
+    SignInThrottle.CLIENT_LIMIT = 50;
+    SignInThrottle.CLIENT_WINDOW_MS = 10 * 60 * 1000;
+    /**
+     * Per account: 10 tries in 15 minutes (a success clears them, so only wrong ones ever add up).
+     * Someone who has forgotten a password tries a handful and asks for a reset link; ten wrong in
+     * a quarter of an hour is guessing, and counting per account holds however many devices the
+     * guesses come from. "A few minutes" in the answer is honest: the oldest try leaves the window
+     * within 15.
+     */
+    SignInThrottle.ACCOUNT_LIMIT = 10;
+    SignInThrottle.ACCOUNT_WINDOW_MS = 15 * 60 * 1000;
+    return SignInThrottle;
+}());
+exports.SignInThrottle = SignInThrottle;
+/** The process-wide windows the sign-in door shares — they must span requests. */
+exports.signInThrottle = new SignInThrottle();
+//# sourceMappingURL=SignInThrottle.js.map

package/dist/src/throttle/SignInThrottle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInThrottle.js","sourceRoot":"","sources":["../../../src/throttle/SignInThrottle.ts"],"names":[],"mappings":";;;AAAA,iDAAgD;AAKhD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;IA2BE,wBAAY,OAAgC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,6BAAa,CAAC;YAC/B,QAAQ,EAAE,cAAc,CAAC,gBAAgB;YACzC,KAAK,EAAE,cAAc,CAAC,YAAY;YAClC,GAAG,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,6BAAa,CAAC;YAChC,QAAQ,EAAE,cAAc,CAAC,iBAAiB;YAC1C,KAAK,EAAE,cAAc,CAAC,aAAa;YACnC,GAAG,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,8BAAK,GAAL,UAAM,MAAc,EAAE,OAAgB;QACpC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YAC5B,OAAO,QAAQ,CAAC;SACjB;QACD,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YACvD,OAAO,SAAS,CAAC;SAClB;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,sCAAa,GAAb,UAAc,OAAe,EAAE,MAAe;QAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SAC9B;IACH,CAAC;IAlED,+FAA+F;IAC/E,qBAAM,GAAG,gDAAgD,CAAC;IAE1E;;;;;;OAMG;IACqB,2BAAY,GAAG,EAAE,CAAC;IAClB,+BAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE1D;;;;;;OAMG;IACqB,4BAAa,GAAG,EAAE,CAAC;IACnB,gCAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IA8C7D,qBAAC;CAAA,AApED,IAoEC;AApEY,wCAAc;AAsE3B,kFAAkF;AACrE,QAAA,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC"}

package/dist/src/throttle/SlidingWindow.d.ts

@@ -0,0 +1,51 @@
+/**
+ * A per-key sliding window: how many attempts a key made in the last `windowMs`, against a
+ * `limit`. The one window every throttled door shares — the sign-in and password-reset doors in
+ * this package, and any consumer door throttling per client (lifted from the invite-request
+ * door's per-IP throttle, which it replaces).
+ *
+ * Held in process memory only, which is what makes it cheap and what bounds it:
+ * - PER PROCESS. Each replica keeps its own windows, so behind a load balancer spreading a
+ *   client over N replicas the effective ceiling is ~N× the limit; a restart forgets them.
+ *   A throttle built on this is friction, not the wall. A shared store is a separate step.
+ * - BOUNDED. At most `maxKeys` keys are tracked; at the bound the oldest-touched key is
+ *   forgotten first, so a flood of fresh keys degrades the friction before it grows memory.
+ *
+ * Keys are whatever the caller passes — callers pass digests (see `RequestDigests`), never raw
+ * addresses, so nothing identifying is held here either.
+ */
+export declare class SlidingWindow {
+    private static readonly DEFAULT_MAX_KEYS;
+    private readonly windowMs;
+    private readonly limit;
+    private readonly maxKeys;
+    private readonly now;
+    /** key → the counted attempt times inside the window (pruned on touch), in touch order. */
+    private readonly attempts;
+    constructor(options: {
+        windowMs: number;
+        limit: number;
+        maxKeys?: number;
+        now?: () => number;
+    });
+    /**
+     * Record an attempt for `key` and answer whether it was over the window — `true` means refuse.
+     * A refused attempt is not counted, so a key drains one window after its last counted attempt.
+     */
+    hit(key: string): boolean;
+    /** Whether `key` has used up its window, without counting anything. */
+    isOver(key: string): boolean;
+    /** Count an attempt for `key` without answering (for doors that judge the attempt first). */
+    record(key: string): void;
+    /** Forget `key`'s attempts. */
+    clear(key: string): void;
+    /**
+     * Uncount `key`'s latest attempt (for doors that count a try as it arrives and learn afterwards
+     * that it should never have counted — a sign-in that succeeded).
+     */
+    forgive(key: string): void;
+    private inWindow;
+    /** Store `key`'s attempts as the most recently touched, evicting the oldest-touched key at the bound. */
+    private touch;
+}
+//# sourceMappingURL=SlidingWindow.d.ts.map

package/dist/src/throttle/SlidingWindow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlidingWindow.d.ts","sourceRoot":"","sources":["../../../src/throttle/SlidingWindow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAElD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;gBAE5C,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE;IAO9F;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IASzB,uEAAuE;IACvE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI5B,6FAA6F;IAC7F,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMzB,+BAA+B;IAC/B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIxB;;;OAGG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM1B,OAAO,CAAC,QAAQ;IAKhB,yGAAyG;IACzG,OAAO,CAAC,KAAK;CAUd"}

package/dist/src/throttle/SlidingWindow.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SlidingWindow = void 0;
+/**
+ * A per-key sliding window: how many attempts a key made in the last `windowMs`, against a
+ * `limit`. The one window every throttled door shares — the sign-in and password-reset doors in
+ * this package, and any consumer door throttling per client (lifted from the invite-request
+ * door's per-IP throttle, which it replaces).
+ *
+ * Held in process memory only, which is what makes it cheap and what bounds it:
+ * - PER PROCESS. Each replica keeps its own windows, so behind a load balancer spreading a
+ *   client over N replicas the effective ceiling is ~N× the limit; a restart forgets them.
+ *   A throttle built on this is friction, not the wall. A shared store is a separate step.
+ * - BOUNDED. At most `maxKeys` keys are tracked; at the bound the oldest-touched key is
+ *   forgotten first, so a flood of fresh keys degrades the friction before it grows memory.
+ *
+ * Keys are whatever the caller passes — callers pass digests (see `RequestDigests`), never raw
+ * addresses, so nothing identifying is held here either.
+ */
+var SlidingWindow = /** @class */ (function () {
+    function SlidingWindow(options) {
+        var _a, _b;
+        /** key → the counted attempt times inside the window (pruned on touch), in touch order. */
+        this.attempts = new Map();
+        this.windowMs = options.windowMs;
+        this.limit = options.limit;
+        this.maxKeys = (_a = options.maxKeys) !== null && _a !== void 0 ? _a : SlidingWindow.DEFAULT_MAX_KEYS;
+        this.now = (_b = options.now) !== null && _b !== void 0 ? _b : Date.now;
+    }
+    /**
+     * Record an attempt for `key` and answer whether it was over the window — `true` means refuse.
+     * A refused attempt is not counted, so a key drains one window after its last counted attempt.
+     */
+    SlidingWindow.prototype.hit = function (key) {
+        if (this.isOver(key)) {
+            this.touch(key, this.inWindow(key));
+            return true;
+        }
+        this.record(key);
+        return false;
+    };
+    /** Whether `key` has used up its window, without counting anything. */
+    SlidingWindow.prototype.isOver = function (key) {
+        return this.inWindow(key).length >= this.limit;
+    };
+    /** Count an attempt for `key` without answering (for doors that judge the attempt first). */
+    SlidingWindow.prototype.record = function (key) {
+        var attempts = this.inWindow(key);
+        attempts.push(this.now());
+        this.touch(key, attempts);
+    };
+    /** Forget `key`'s attempts. */
+    SlidingWindow.prototype.clear = function (key) {
+        this.attempts.delete(key);
+    };
+    /**
+     * Uncount `key`'s latest attempt (for doors that count a try as it arrives and learn afterwards
+     * that it should never have counted — a sign-in that succeeded).
+     */
+    SlidingWindow.prototype.forgive = function (key) {
+        var attempts = this.inWindow(key);
+        attempts.pop();
+        this.touch(key, attempts);
+    };
+    SlidingWindow.prototype.inWindow = function (key) {
+        var _a;
+        var cutoff = this.now() - this.windowMs;
+        return ((_a = this.attempts.get(key)) !== null && _a !== void 0 ? _a : []).filter(function (time) { return time > cutoff; });
+    };
+    /** Store `key`'s attempts as the most recently touched, evicting the oldest-touched key at the bound. */
+    SlidingWindow.prototype.touch = function (key, attempts) {
+        if (!this.attempts.has(key) && this.attempts.size >= this.maxKeys) {
+            var oldest = this.attempts.keys().next().value;
+            if (oldest !== undefined) {
+                this.attempts.delete(oldest);
+            }
+        }
+        this.attempts.delete(key);
+        this.attempts.set(key, attempts);
+    };
+    SlidingWindow.DEFAULT_MAX_KEYS = 10000;
+    return SlidingWindow;
+}());
+exports.SlidingWindow = SlidingWindow;
+//# sourceMappingURL=SlidingWindow.js.map

package/dist/src/throttle/SlidingWindow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlidingWindow.js","sourceRoot":"","sources":["../../../src/throttle/SlidingWindow.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;GAeG;AACH;IAUE,uBAAY,OAAkF;;QAH9F,2FAA2F;QAC1E,aAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;QAGtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,aAAa,CAAC,gBAAgB,CAAC;QACjE,IAAI,CAAC,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,2BAAG,GAAH,UAAI,GAAW;QACb,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACpB,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;SACb;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uEAAuE;IACvE,8BAAM,GAAN,UAAO,GAAW;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC;IACjD,CAAC;IAED,6FAA6F;IAC7F,8BAAM,GAAN,UAAO,GAAW;QAChB,IAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,+BAA+B;IAC/B,6BAAK,GAAL,UAAM,GAAW;QACf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,+BAAO,GAAP,UAAQ,GAAW;QACjB,IAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAEO,gCAAQ,GAAhB,UAAiB,GAAW;;QAC1B,IAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1C,OAAO,CAAC,MAAA,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,UAAC,IAAI,IAAK,OAAA,IAAI,GAAG,MAAM,EAAb,CAAa,CAAC,CAAC;IACxE,CAAC;IAED,yGAAyG;IACjG,6BAAK,GAAb,UAAc,GAAW,EAAE,QAAkB;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE;YACjE,IAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,MAAM,KAAK,SAAS,EAAE;gBACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;aAC9B;SACF;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAvEuB,8BAAgB,GAAG,KAAM,AAAT,CAAU;IAwEpD,oBAAC;CAAA,AAzED,IAyEC;AAzEY,sCAAa"}

package/dist/test/ClientAddress.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ClientAddress.test.d.ts.map

package/dist/test/ClientAddress.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientAddress.test.d.ts","sourceRoot":"","sources":["../../test/ClientAddress.test.ts"],"names":[],"mappings":""}

package/dist/test/ClientAddress.test.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+var ClientAddress_1 = require("../src/throttle/ClientAddress");
+/**
+ * Which address a throttle keys on. Behind Google's external Application Load Balancer the
+ * header ends `<client-ip>,<load-balancer-ip>` — the balancer appends both, and anything before
+ * them is whatever the client itself sent. So the client is the SECOND entry from the right:
+ * never the last (the balancer's own address, the same for every visitor — a throttle keyed on
+ * it is one bucket for the whole world) and never the first (client-supplied, rotatable at will).
+ */
+describe('ClientAddress', function () {
+    var behindTheBalancer = function (forwardedFor, socketAddress) {
+        var _a, _b;
+        if (socketAddress === void 0) { socketAddress = '35.191.0.10'; }
+        return ({
+            app: { get: function (setting) { return (setting === 'trust proxy' ? 1 : undefined); } },
+            headers: forwardedFor === undefined ? {} : { 'x-forwarded-for': forwardedFor },
+            socket: { remoteAddress: socketAddress },
+            // What express's own `request.ip` resolves to under `trust proxy 1`: the header's last entry.
+            ip: (_b = (_a = forwardedFor === null || forwardedFor === void 0 ? void 0 : forwardedFor.split(',').pop()) === null || _a === void 0 ? void 0 : _a.trim()) !== null && _b !== void 0 ? _b : socketAddress,
+        });
+    };
+    it("reads the client the balancer appended, not the balancer's own address", function () {
+        var request = behindTheBalancer('198.51.100.23, 34.120.1.1');
+        expect(new ClientAddress_1.ClientAddress().of(request)).toBe('198.51.100.23');
+        expect(request.ip).toBe('34.120.1.1');
+    });
+    it('ignores whatever the client put in the header itself', function () {
+        var spoofed = behindTheBalancer('203.0.113.99, 10.0.0.1, 198.51.100.23, 34.120.1.1');
+        expect(new ClientAddress_1.ClientAddress().of(spoofed)).toBe('198.51.100.23');
+    });
+    it('reads IPv6 clients the same way', function () {
+        expect(new ClientAddress_1.ClientAddress().of(behindTheBalancer('2001:db8:1:2:3:4:5:6,34.120.1.1'))).toBe('2001:db8:1:2:3:4:5:6');
+    });
+    it('a request that did not come through the balancer (no appended pair) keys on its own connection', function () {
+        expect(new ClientAddress_1.ClientAddress().of(behindTheBalancer(undefined, '10.8.0.7'))).toBe('10.8.0.7');
+        expect(new ClientAddress_1.ClientAddress().of(behindTheBalancer('10.8.0.9', '10.8.0.7'))).toBe('10.8.0.7');
+    });
+    it('with no proxy trusted (development) the connection is the client, and a forwarded header is ignored', function () {
+        var direct = {
+            app: { get: function () { return false; } },
+            headers: { 'x-forwarded-for': '203.0.113.99, 198.51.100.23' },
+            socket: { remoteAddress: '::1' },
+        };
+        expect(new ClientAddress_1.ClientAddress().of(direct)).toBe('::1');
+    });
+    it('a request with no connection details at all reads as the empty address', function () {
+        expect(new ClientAddress_1.ClientAddress().of({})).toBe('');
+    });
+});
+//# sourceMappingURL=ClientAddress.test.js.map

package/dist/test/ClientAddress.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientAddress.test.js","sourceRoot":"","sources":["../../test/ClientAddress.test.ts"],"names":[],"mappings":";;AAAA,+DAA8D;AAE9D;;;;;;GAMG;AACH,QAAQ,CAAC,eAAe,EAAE;IACxB,IAAM,iBAAiB,GAAG,UAAC,YAAgC,EAAE,aAA6B;;QAA7B,8BAAA,EAAA,6BAA6B;QAAK,OAAA,CAAC;YAC9F,GAAG,EAAE,EAAE,GAAG,EAAE,UAAC,OAAe,IAAK,OAAA,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAA3C,CAA2C,EAAE;YAC9E,OAAO,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,YAAY,EAAE;YAC9E,MAAM,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;YACxC,8FAA8F;YAC9F,EAAE,EAAE,MAAA,MAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,0CAAE,IAAI,EAAE,mCAAI,aAAa;SAC5D,CAAC,CAAA;KAAA,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE;QAC3E,IAAM,OAAO,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;QAE/D,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE;QACzD,IAAM,OAAO,GAAG,iBAAiB,CAAC,mDAAmD,CAAC,CAAC;QAEvF,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE;QACpC,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACpH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gGAAgG,EAAE;QACnG,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1F,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qGAAqG,EAAE;QACxG,IAAM,MAAM,GAAG;YACb,GAAG,EAAE,EAAE,GAAG,EAAE,cAAM,OAAA,KAAK,EAAL,CAAK,EAAE;YACzB,OAAO,EAAE,EAAE,iBAAiB,EAAE,6BAA6B,EAAE;YAC7D,MAAM,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE;SACjC,CAAC;QAEF,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE;QAC3E,MAAM,CAAC,IAAI,6BAAa,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/DevLogin.test.js

@@ -1,4 +1,19 @@
 "use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -37,6 +52,7 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 var db_1 = require("@proteinjs/db");
+var reflection_1 = require("@proteinjs/reflection");
 var user_1 = require("@proteinjs/user");
 var PasswordHasher_1 = require("../src/authentication/PasswordHasher");
 var devLoginHarness_1 = require("./devLoginHarness");
@@ -190,6 +206,58 @@ describe('devLogin route', function () {
             }
         });
     }); });
+    it('refuses a ?email a machine-account declaration owns with 400 in plain words — no session, no row', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var DeclaredMachineAccount, repo, outcome, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    DeclaredMachineAccount = /** @class */ (function (_super) {
+                        __extends(DeclaredMachineAccount, _super);
+                        // The declared machine accounts of the build are the list signup refuses from; the dev door
+                        // creates missing accounts through the same function and must answer the way its other
+                        // refusals do — in words, not as an unhandled throw.
+                        function DeclaredMachineAccount() {
+                            var _this = _super !== null && _super.apply(this, arguments) || this;
+                            _this.id = 'declared-machine';
+                            _this.email = 'declared.machine@test.local';
+                            _this.accountName = 'Declared machine';
+                            _this.roles = [];
+                            _this.secretName = 'declared-machine-secret';
+                            return _this;
+                        }
+                        return DeclaredMachineAccount;
+                    }(user_1.MachineAccount));
+                    repo = reflection_1.SourceRepository.get();
+                    repo.namedObjectCache['@proteinjs/db/SourceRecordLoader'] = [
+                        {
+                            qualifiedName: '@proteinjs/user-server-test/DeclaredMachineAccount',
+                            packageName: '@test/declarer',
+                            object: new DeclaredMachineAccount(),
+                        },
+                    ];
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 4, 5]);
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: 'declared.machine@test.local' })];
+                case 2:
+                    outcome = _b.sent();
+                    expect(outcome.status).toBe(400);
+                    expect(String(outcome.body)).toContain("This address can't be registered.");
+                    expect(outcome.loggedInAs).toBeUndefined();
+                    expect(outcome.sessionSaved).toBe(false);
+                    expect(outcome.redirect).toBeUndefined();
+                    _a = expect;
+                    return [4 /*yield*/, getUserRow('declared.machine@test.local')];
+                case 3:
+                    _a.apply(void 0, [_b.sent()]).toBeUndefined();
+                    return [3 /*break*/, 5];
+                case 4:
+                    delete repo.namedObjectCache['@proteinjs/db/SourceRecordLoader'];
+                    return [7 /*endfinally*/];
+                case 5: return [2 /*return*/];
+            }
+        });
+    }); });
     it('rejects a malformed same-domain ?email with 400 — no session, no stray account', function () { return __awaiter(void 0, void 0, void 0, function () {
         var malformed, outcome, _a;
         return __generator(this, function (_b) {

package/dist/test/DevLogin.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"DevLogin.test.js","sourceRoot":"","sources":["../../test/DevLogin.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAyC;AACzC,uEAAsE;AACtE,qDAAmD;AACnD,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD;;;;;;;;;;;GAWG;AAEH,IAAM,SAAS,GAAG,gBAAgB,CAAC;AAEnC,IAAM,UAAU,GAAG,UAAO,KAAa;;gBAAK,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;gBAAjD,sBAAA,SAAiD,EAAA;;SAAA,CAAC;AAE9F,QAAQ,CAAC,gBAAgB,EAAE;IACzB,IAAM,WAAW,GAAG;QAClB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACpC,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACtD,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAChE,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;KACrD,CAAC;IAEF,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,UAAU,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC;QAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC;QACR,KAA2B,UAA2B,EAA3B,KAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAA3B,cAA2B,EAA3B,IAA2B,EAAE;YAA7C,IAAA,WAAY,EAAX,GAAG,QAAA,EAAE,KAAK,QAAA;YACpB,IAAI,KAAK,KAAK,SAAS,EAAE;gBACvB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACzB;iBAAM;gBACL,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aAC1B;SACF;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE;;;;wBACvF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAAnE,SAAmE,CAAC;oBAEpD,qBAAM,IAAA,gCAAc,GAAE,EAAA;;oBAAhC,OAAO,GAAG,SAAsB;oBAEtC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,0CAA0C;oBACzF,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SACxC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE;;;;wBACnE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA3E,SAA2E,CAAC;oBAE5D,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACrD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;SACpC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE;;;;;oBAChG,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;oBAE9C,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACrD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAInB,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA/C,OAAO,GAAG,SAAqC;oBACrD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC9B,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9D,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAI,+BAAc,EAAE,CAAC,MAAM,CAAC,OAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAA;;oBAAnE,kBAAO,SAA4D,EAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChF,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACnC,MAAM,CAAC,OAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;;;;SACpC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE;;;;wBAC/E,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAA;;oBAAlE,OAAO,GAAG,SAAwD;oBAExE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,uBAAuB,CAAC,EAAA;;oBAAhD,kBAAO,SAAyC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SACnE,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE;;;;;oBAI7E,SAAS,GAAG,+BAA+B,CAAC;oBAElC,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAApD,OAAO,GAAG,SAA0C;oBAE1D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;oBAC3D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAqC;oBAClF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,SAAS,CAAC,EAAA;;oBAAlC,kBAAO,SAA2B,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SACrD,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE;;;;wBACtE,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,EAAA;;oBAArE,OAAO,GAAG,SAA2D;oBAE3E,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;oBAC5D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,0BAA0B,CAAC,EAAA;;oBAAnD,kBAAO,SAA4C,EAAC,CAAC,WAAW,EAAE,CAAC;;;;SACpE,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE;;;;;oBACvD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;oBAEf,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC/D,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE;;;;;oBAChE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBAExB,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC/D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"DevLogin.test.js","sourceRoot":"","sources":["../../test/DevLogin.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,oDAAyD;AACzD,wCAAyD;AACzD,uEAAsE;AACtE,qDAAmD;AACnD,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD;;;;;;;;;;;GAWG;AAEH,IAAM,SAAS,GAAG,gBAAgB,CAAC;AAEnC,IAAM,UAAU,GAAG,UAAO,KAAa;;gBAAK,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;gBAAjD,sBAAA,SAAiD,EAAA;;SAAA,CAAC;AAE9F,QAAQ,CAAC,gBAAgB,EAAE;IACzB,IAAM,WAAW,GAAG;QAClB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACpC,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACtD,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAChE,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;KACrD,CAAC;IAEF,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,UAAU,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC;QAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC;QACR,KAA2B,UAA2B,EAA3B,KAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAA3B,cAA2B,EAA3B,IAA2B,EAAE;YAA7C,IAAA,WAAY,EAAX,GAAG,QAAA,EAAE,KAAK,QAAA;YACpB,IAAI,KAAK,KAAK,SAAS,EAAE;gBACvB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACzB;iBAAM;gBACL,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aAC1B;SACF;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE;;;;wBACvF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAAnE,SAAmE,CAAC;oBAEpD,qBAAM,IAAA,gCAAc,GAAE,EAAA;;oBAAhC,OAAO,GAAG,SAAsB;oBAEtC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,0CAA0C;oBACzF,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SACxC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE;;;;wBACnE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA3E,SAA2E,CAAC;oBAE5D,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACrD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;SACpC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE;;;;;oBAChG,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;oBAE9C,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACrD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAInB,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA/C,OAAO,GAAG,SAAqC;oBACrD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC9B,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9D,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAI,+BAAc,EAAE,CAAC,MAAM,CAAC,OAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAA;;oBAAnE,kBAAO,SAA4D,EAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChF,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACnC,MAAM,CAAC,OAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;;;;SACpC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE;;;;wBAC/E,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAA;;oBAAlE,OAAO,GAAG,SAAwD;oBAExE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,uBAAuB,CAAC,EAAA;;oBAAhD,kBAAO,SAAyC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SACnE,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE;;;;;oBAIrG;wBAAqC,0CAAc;wBAHnD,4FAA4F;wBAC5F,uFAAuF;wBACvF,qDAAqD;wBACrD;4BAAA,qEAMC;4BALC,QAAE,GAAG,kBAAkB,CAAC;4BACxB,WAAK,GAAG,6BAA6B,CAAC;4BACtC,iBAAW,GAAG,kBAAkB,CAAC;4BACjC,WAAK,GAAG,EAAE,CAAC;4BACX,gBAAU,GAAG,yBAAyB,CAAC;;wBACzC,CAAC;wBAAD,6BAAC;oBAAD,CAAC,AAND,CAAqC,qBAAc,GAMlD;oBACK,IAAI,GAAG,6BAAgB,CAAC,GAAG,EAAgE,CAAC;oBAClG,IAAI,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,GAAG;wBAC1D;4BACE,aAAa,EAAE,oDAAoD;4BACnE,WAAW,EAAE,gBAAgB;4BAC7B,MAAM,EAAE,IAAI,sBAAsB,EAAE;yBACrC;qBACF,CAAC;;;;oBAEgB,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,EAAA;;oBAAxE,OAAO,GAAG,SAA8D;oBAE9E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;oBAC5E,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,6BAA6B,CAAC,EAAA;;oBAAtD,kBAAO,SAA+C,EAAC,CAAC,aAAa,EAAE,CAAC;;;oBAExE,OAAO,IAAI,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,CAAC;;;;;SAEpE,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE;;;;;oBAI7E,SAAS,GAAG,+BAA+B,CAAC;oBAElC,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAApD,OAAO,GAAG,SAA0C;oBAE1D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;oBAC3D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAqC;oBAClF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,SAAS,CAAC,EAAA;;oBAAlC,kBAAO,SAA2B,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SACrD,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE;;;;wBACtE,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,EAAA;;oBAArE,OAAO,GAAG,SAA2D;oBAE3E,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;oBAC5D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,0BAA0B,CAAC,EAAA;;oBAAnD,kBAAO,SAA4C,EAAC,CAAC,WAAW,EAAE,CAAC;;;;SACpE,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE;;;;;oBACvD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;oBAEf,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC/D,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE;;;;;oBAChE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBAExB,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC/D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}