@shipfox/api-auth 5.0.0 → 6.0.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 54 files with swc (372.54ms)
+Successfully compiled: 52 files with swc (551.72ms)

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # @shipfox/api-auth
 
+## 6.0.0
+
+### Major Changes
+
+- 6a52909: Replaces separate API auth secrets with domain-separated keys derived from one required AUTH_ROOT_KEY.
+- ba2e3dc: Migrates password email verification from magic links to shared eight-digit email challenges.
+
+### Minor Changes
+
+- 326f4c0: Exposes Workspaces inter-module operations and moves Auth and OAuth providers onto injected clients.
+- 4a91956: Publishes a shared provider-neutral `emailSchema` in `@shipfox/api-common-dto` and adopts it across auth and workspace invitation inputs. Adds a read-only `findUserByEmail`/`EmailOwner` seam to `@shipfox/api-auth` for looking up the current owner of a normalized email without creating a session or mutating that user. Extends the packed external consumer gate to exercise both seams against PostgreSQL through installed tarballs.
+
+### Patch Changes
+
+- 7366f04: Adds a configured shared mailer that owns SMTP delivery settings. `@shipfox/api-auth` and `@shipfox/api-workspaces` drop their own mailer environment variables and factory logic and use the shared `mailer` from `@shipfox/node-mailer` instead.
+- 112c0fa: Adds the Auth inter-module token-minting contract and removes Auth implementation and configuration coupling from its consumers.
+- f73da5d: Enforces bounded API context imports and routes inter-module consumers through producer contracts.
+- Updated dependencies [905b6a3]
+- Updated dependencies [b70f920]
+- Updated dependencies [7366f04]
+- Updated dependencies [6a52909]
+- Updated dependencies [e6eba5b]
+- Updated dependencies [54ce48b]
+- Updated dependencies [ba2e3dc]
+- Updated dependencies [c0162b0]
+- Updated dependencies [7ac43a4]
+- Updated dependencies [a01e917]
+- Updated dependencies [1b79cda]
+- Updated dependencies [c2db8c3]
+- Updated dependencies [112c0fa]
+- Updated dependencies [8bdc149]
+- Updated dependencies [3810996]
+- Updated dependencies [b00ed29]
+- Updated dependencies [8aa7cd3]
+- Updated dependencies [326f4c0]
+- Updated dependencies [4a91956]
+- Updated dependencies [81f9544]
+  - @shipfox/api-email-challenges@0.2.0
+  - @shipfox/node-tokens@0.3.0
+  - @shipfox/node-mailer@0.2.0
+  - @shipfox/node-auth-root-key@0.2.0
+  - @shipfox/node-jwt@0.3.0
+  - @shipfox/node-rate-limit@0.3.0
+  - @shipfox/api-auth-dto@6.0.0
+  - @shipfox/node-module@0.4.0
+  - @shipfox/node-drizzle@0.3.2
+  - @shipfox/node-outbox@0.2.4
+  - @shipfox/api-workspaces-dto@6.0.0
+  - @shipfox/api-auth-context@6.0.0
+  - @shipfox/node-fastify@0.2.4
+  - @shipfox/inter-module@0.2.0
+
 ## 5.0.0
 
 ### Patch Changes

package/README.md

@@ -7,12 +7,23 @@ Shipfox API Auth provides the server-side auth module for Shipfox APIs. It owns
 Register the module with the API module runner:
 
 ```ts
-import {authModule} from '@shipfox/api-auth';
+import {createAuthModule} from '@shipfox/api-auth';
+import {workspacesModule} from '@shipfox/api-workspaces';
+import {workspacesInterModuleContract} from '@shipfox/api-workspaces-dto/inter-module';
 import {createApp, listen} from '@shipfox/node-fastify';
-import {initializeModules} from '@shipfox/node-module';
-
+import {
+  initializeModules,
+  registerInterModulePresentations,
+} from '@shipfox/node-module';
+import {createInMemoryInterModuleTransport} from '@shipfox/node-module/inter-module';
+
+const interModuleTransport = createInMemoryInterModuleTransport();
+const workspaces = interModuleTransport.createClient(workspacesInterModuleContract);
+const modules = [workspacesModule, createAuthModule({workspaces})];
+registerInterModulePresentations({transport: interModuleTransport, modules});
+interModuleTransport.seal();
 const {auth, routes} = await initializeModules({
-  modules: [authModule],
+  modules,
 });
 
 await createApp({auth, routes});
@@ -37,24 +48,17 @@ Required environment:
 
 | Variable | Default | Purpose |
 | --- | --- | --- |
-| `AUTH_JWT_SECRET` | none | Secret used to sign and verify access tokens. |
+| `AUTH_ROOT_KEY` | none | Canonical base64 for 32 random bytes used to derive separate authentication and email-challenge keys. Generate it with `openssl rand -base64 32`. |
 | `AUTH_JWT_EXPIRES_IN` | `15m` | Access token lifetime. |
-| `AUTH_JOB_LEASE_TOKEN_SECRET` | none | Secret used to sign and verify job lease tokens. |
 | `AUTH_JOB_LEASE_TOKEN_EXPIRES_IN` | `90m` | Job lease token lifetime. |
-| `AUTH_RUNNER_SESSION_TOKEN_SECRET` | none | Secret used to sign and verify runner session tokens. |
 | `AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN` | `1h` | Runner session token lifetime. |
 | `AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS` | `14` | Refresh token and cookie lifetime. |
 | `AUTH_REFRESH_ROTATION_GRACE_SECONDS` | `30` | Grace window for accepting a just-rotated refresh token during concurrent refreshes. |
 | `AUTH_REFRESH_COOKIE_NAME` | `shipfox_refresh_token` | HTTP cookie name for refresh sessions. |
 | `AUTH_PASSWORD_ENABLED` | `true` | Enables password and email-verification routes. Set to `false` when another module provides login. Server construction fails if no login method is available. |
-| `RATE_LIMIT_IDENTIFIER_SECRET` | none | Optional secret used to HMAC identifiers before storing rate-limit counters. When unset, the module derives a stable key from `AUTH_JWT_SECRET`. |
 | `CLIENT_BASE_URL` | `http://localhost:5173` | Base URL used in email verification and password reset links. |
-| `MAILER_TRANSPORT` | `console` | Mail transport. Set to `smtp` to send real mail. |
-| `MAILER_FROM` | `noreply@shipfox.local` | Sender used by auth emails. |
-| `SMTP_HOST` | none | Required when `MAILER_TRANSPORT=smtp`. |
-| `SMTP_PORT` | `587` | SMTP server port. |
-| `SMTP_USER` | none | Optional SMTP user. |
-| `SMTP_PASSWORD` | none | Optional SMTP password. |
+
+Email delivery uses the shared `@shipfox/node-mailer` configuration.
 
 When `AUTH_PASSWORD_ENABLED=false`, the module does not register signup, login, password-reset, password-change, or email-verification routes. Refresh, logout, and current-session routes stay available. Another module must contribute a login method before the API server starts.
 
@@ -65,8 +69,13 @@ The module issues three kinds of bearer token, all presented as
 HMAC-SHA256 and verified by checking its signature and expiry alone, with no
 database read on the request path. They differ in who they authenticate and what
 they grant, and the stateless tradeoff is accepted for a different reason in each
-case. Each token class has a dedicated secret and audience, so one token type
-cannot be used in place of another.
+case. Each token class uses a separate key derived from `AUTH_ROOT_KEY` and a
+fixed audience, so one token type cannot be used in place of another.
+
+Changing `AUTH_ROOT_KEY` invalidates every user session token, runner session
+token, job lease token, email challenge, and rate-limit identifier created with
+the previous root. The module does not support rotating one derived key by
+itself.
 
 ### User session token
 
@@ -105,7 +114,7 @@ use the per-job lease token instead.
   the labels it registers with. The labels are immutable after registration and
   signed into the session token, but they are not an authorization boundary in v1.
   Treat the registration token's workspace scope as the trust boundary.
-- **Mechanics.** Signed with HMAC-SHA256 using `AUTH_RUNNER_SESSION_TOKEN_SECRET`
+- **Mechanics.** Signed with HMAC-SHA256 using the derived runner-session key
   and the `runner-session` audience. The default lifetime is `1h`, short enough
   to bound the residual claim window when a registration token is revoked.
 - **Tradeoff — no per-session revocation in v1.** Claim stays stateless and does
@@ -139,14 +148,14 @@ progress and drives that job to completion.
   downstream only *verifies* — an in-process signature check, with no callback to
   the issuer. The runner, and the untrusted agent workload it hosts, never mints
   or modifies a token; it only presents the one it was handed.
-- **Mechanics.** Signed with HMAC-SHA256 using a dedicated secret, separate from
-  the user-session secret. Its claims name the job, job execution, and surrounding
+- **Mechanics.** Signed with HMAC-SHA256 using the job-lease key derived from
+  `AUTH_ROOT_KEY`. Its claims name the job, job execution, and surrounding
   context and nothing more, and it carries a fixed audience so a token minted for
   one purpose cannot be replayed against another. It is short-lived (bounded in
   hours, not days), with heartbeat issuing a fresh short lease for the same live
-  execution. The signing secret is supplied through configuration, never embedded
-  in code or committed. The raw token must **never** be written to logs, traces, or
-  error payloads — there is no automatic redaction to fall back on.
+  execution. The root key is supplied through configuration, never embedded in
+  code or committed. The raw token must **never** be written to logs, traces, or
+  error payloads. There is no automatic redaction to fall back on.
 - **Defense in depth — server state is the final authority.** A valid token is
   never sufficient on its own to advance work. On the lease's own request path the
   gate is server-side step and progression state: a report against a step that has
@@ -164,10 +173,9 @@ progress and drives that job to completion.
 - **Threat model.** A leaked or replayed token has a deliberately small blast
   radius: it grants action on one already-claimed job execution while that
   execution remains live. It cannot claim new work, impersonate a runner, or reach
-  other workspaces. If the *signing secret* leaks, the response is to rotate it;
-  rotation invalidates every live lease at once (they fail signature verification)
-  and forces fresh claims. Isolating this secret from the user-session secret is
-  what lets one be rotated without disrupting the other.
+  other workspaces. If `AUTH_ROOT_KEY` leaks, rotate it. This invalidates every
+  live token and email challenge derived from the old root, including every live
+  lease, and forces fresh claims.
 - **Tradeoff — no per-token revocation.** A single outstanding lease cannot be
   revoked on its own by token ID. The claiming runner's credential is not
   re-checked on each request, so a lease for already-claimed work can continue to
@@ -187,9 +195,9 @@ All routes are mounted under `/auth`.
 
 | Method | Path | Auth | Result |
 | --- | --- | --- | --- |
-| `POST` | `/signup` | none | Creates a user and sends an email verification link. |
-| `POST` | `/verify-email/confirm` | none | Verifies email, returns an access token, and sets the refresh cookie. |
-| `POST` | `/verify-email/resend` | none | Sends a new verification email when the account is eligible. |
+| `POST` | `/signup` | none | Creates a user and sends an eight-digit email verification code. |
+| `POST` | `/verify-email/confirm` | none | Confirms a verification code, returns an access token, and sets the refresh cookie. |
+| `POST` | `/verify-email/resend` | none | Sends a new verification code when the account is eligible. |
 | `POST` | `/login` | none | Returns an access token and sets the refresh cookie. |
 | `POST` | `/refresh` | refresh cookie | Rotates the refresh token when needed and returns a new access token. |
 | `POST` | `/logout` | refresh cookie | Revokes the current refresh token and clears the cookie. |
@@ -215,7 +223,7 @@ The public auth endpoints include an application-layer abuse baseline for open s
 | `POST /auth/password-reset` | 30 email-send attempts per hour | 3 email-send attempts per hour |
 | `POST /auth/verify-email/resend` | Shared with password reset | Shared with password reset |
 
-Counters are stored in PostgreSQL as fixed windows in `auth_rate_limits`. IP addresses and email addresses are HMAC-SHA256 values before storage; raw identifiers are not persisted. `RATE_LIMIT_IDENTIFIER_SECRET` is optional. Set it when you want a dedicated HMAC secret, or leave it unset to derive the key from `AUTH_JWT_SECRET`.
+Counters are stored in PostgreSQL as fixed windows in `auth_rate_limits`. IP addresses and email addresses are HMAC-SHA256 values before storage; raw identifiers are not persisted. The identifier key is derived from `AUTH_ROOT_KEY` separately from every token key.
 
 The limiter uses `request.ip`, so production deployments behind a reverse proxy must configure the API app's `API_TRUST_PROXY` setting. Keep the default `false` when clients connect directly. Use a positive hop count such as `1`, or a trusted proxy IP/CIDR such as `10.0.0.0/8`, when proxy headers are controlled by infrastructure you operate.
 
@@ -223,10 +231,13 @@ This app-layer limiter protects semantic auth work such as Argon2 verification a
 
 ## API
 
-The package exports the module entry point:
+The package exports a module factory. Pass it the Workspaces inter-module client from the
+application composition:
 
 ```ts
-import {authModule} from '@shipfox/api-auth';
+import {createAuthModule} from '@shipfox/api-auth';
+
+const authModule = createAuthModule({workspaces});
 ```
 
 It also exports lower-level pieces for tests and advanced integration:
@@ -239,7 +250,8 @@ It also exports lower-level pieces for tests and advanced integration:
 - `issueRunnerSessionToken(claims)` / `verifyRunnerSessionToken(token)`: mint and verify runner session tokens.
 - `issueJobLeaseToken(claims)` / `verifyJobLeaseToken(token)`: mint and verify job lease tokens.
 - `getClientContext(request)`: reads the authenticated user context from a Fastify request.
-- Entity types: `User`, `UserStatus`, `RefreshToken`, `EmailVerification`, and `PasswordReset`.
+- `findUserByEmail({email})`: read-only lookup of the current owner of a normalized email; see below.
+- Entity types: `User`, `UserStatus`, `RefreshToken`, `PasswordReset`, and `EmailOwner`.
 
 ### External identity callbacks
 
@@ -287,6 +299,29 @@ safe.
 
 This pre-verified user state lets an external login method create a session when password login and email-verification routes are disabled.
 
+### Email ownership lookup
+
+`findUserByEmail({email})` answers "who currently owns this email?" without
+creating a session or changing that user:
+
+```ts
+import {findUserByEmail} from '@shipfox/api-auth';
+
+const owner = await findUserByEmail({email: rawEmail});
+if (owner) {
+  // owner: {id, email, status}
+}
+```
+
+It parses `rawEmail` through the same shared `emailSchema` used by every other
+auth entry point, so whitespace and casing differences resolve to the same
+owner. It returns an owner for every account status (`active`, `suspended`, or
+`deleted`), and `undefined` when no user owns the address. The returned
+`EmailOwner` is an explicit projection of `id`, `email`, and `status` only; it
+never carries a password hash, profile fields, or verification timestamps.
+This seam performs no writes, so it is safe to call before deciding whether to
+provision, link, or reject an identity.
+
 `createSessionForUser` accepts either a `userId` or an `email`. It only creates
 a session for an active, verified user. It can throw `UserNotFoundError`,
 `EmailNotVerifiedError`, `InvalidCredentialsError`, or
@@ -304,18 +339,17 @@ The module creates tables with the `auth_` prefix:
 
 - `auth_users`
 - `auth_refresh_tokens`
-- `auth_email_verifications`
 - `auth_password_resets`
 - `auth_rate_limits`
 
-Passwords use Argon2id. Email verification tokens, password reset tokens, and refresh tokens are opaque tokens stored as hashes.
+Passwords use Argon2id. Password reset tokens and refresh tokens are opaque tokens stored as hashes. Email verification uses the shared email-challenges module.
 
 ## Behavior Notes
 
-- Signup sends a verification email and returns the new user.
+- Signup sends an eight-digit verification code and returns the new user with its challenge ID.
 - Login only succeeds for active users with verified email addresses and a password hash.
 - Refresh tokens rotate on each refresh.
-- Password reset and email verification consume their tokens once.
+- Password reset tokens and email challenge proofs are consumed once.
 - Password change revokes other refresh sessions. It keeps the current session when the current refresh cookie is valid.
 - Password reset requests and verification resend requests do not reveal whether an account exists.
 - Login, password reset, and verification resend requests are rate-limited by IP address and email address.

package/dist/config.d.ts

@@ -1,23 +1,11 @@
-import { type Mailer } from '@shipfox/node-mailer';
 export declare const config: Readonly<{
-    AUTH_JWT_SECRET: string;
     AUTH_JWT_EXPIRES_IN: string;
-    AUTH_JOB_LEASE_TOKEN_SECRET: string;
     AUTH_JOB_LEASE_TOKEN_EXPIRES_IN: string;
-    AUTH_RUNNER_SESSION_TOKEN_SECRET: string;
     AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN: string;
     AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: number;
     AUTH_REFRESH_ROTATION_GRACE_SECONDS: number;
     AUTH_REFRESH_COOKIE_NAME: string;
     AUTH_PASSWORD_ENABLED: boolean;
-    RATE_LIMIT_IDENTIFIER_SECRET: string | undefined;
     CLIENT_BASE_URL: string;
-    MAILER_TRANSPORT: "console" | "smtp";
-    MAILER_FROM: string;
-    SMTP_HOST: string | undefined;
-    SMTP_PORT: number;
-    SMTP_USER: string | undefined;
-    SMTP_PASSWORD: string | undefined;
 } & import("@shipfox/config").CleanedEnvAccessors>;
-export declare const mailer: Mailer;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAwC,KAAK,MAAM,EAAC,MAAM,sBAAsB,CAAC;AAExF,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;kDAuEjB,CAAC;AAiBH,eAAO,MAAM,MAAM,QAAiB,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,MAAM;;;;;;;;;kDAiCjB,CAAC"}

package/dist/config.js

@@ -1,23 +1,13 @@
 import { bool, createConfig, num, str } from '@shipfox/config';
-import { createConsoleMailer, createSmtpMailer } from '@shipfox/node-mailer';
 export const config = createConfig({
-    AUTH_JWT_SECRET: str({
-        desc: 'Secret used to sign and verify user access tokens (JWTs). Required, with no default, so startup fails when it is missing.'
-    }),
     AUTH_JWT_EXPIRES_IN: str({
         desc: 'How long an access token stays valid. Accepts a duration string such as 15m, 1h, or 7d.',
         default: '15m'
     }),
-    AUTH_JOB_LEASE_TOKEN_SECRET: str({
-        desc: 'Secret used to sign and verify job lease tokens. Required, with no default, so startup fails when it is missing.'
-    }),
     AUTH_JOB_LEASE_TOKEN_EXPIRES_IN: str({
         desc: 'How long a job lease token stays valid. Set it longer than the longest job (JOB_MAX_DURATION is 60 minutes) plus a safety margin.',
         default: '90m'
     }),
-    AUTH_RUNNER_SESSION_TOKEN_SECRET: str({
-        desc: 'Secret used to sign and verify runner session tokens. Required, with no default, so startup fails when it is missing.'
-    }),
     AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN: str({
         desc: 'How long a runner session token stays valid. A revoked registration token can leave existing sessions usable until this lifetime ends.',
         default: '1h'
@@ -38,62 +28,10 @@ export const config = createConfig({
         desc: 'Whether password login is available. Use true or false. Defaults to true. When false, password and email-verification routes are not registered, and server startup requires another module to contribute a login method.',
         default: true
     }),
-    RATE_LIMIT_IDENTIFIER_SECRET: str({
-        desc: 'Optional secret used to HMAC identifiers before storing rate-limit counters. Leave it unset to derive a stable key from AUTH_JWT_SECRET.',
-        default: undefined
-    }),
     CLIENT_BASE_URL: str({
         desc: 'Base URL of the client app. Used to build links in emails such as password resets.',
         default: 'http://localhost:5173'
-    }),
-    MAILER_TRANSPORT: str({
-        desc: 'How emails are delivered. Use console to print them to the log, or smtp to send them through an SMTP server.',
-        choices: [
-            'console',
-            'smtp'
-        ],
-        default: 'console'
-    }),
-    MAILER_FROM: str({
-        desc: 'Sender address shown on outgoing emails.',
-        default: 'noreply@shipfox.local'
-    }),
-    SMTP_HOST: str({
-        desc: 'Hostname of the SMTP server. Required when MAILER_TRANSPORT is smtp.',
-        default: undefined
-    }),
-    SMTP_PORT: num({
-        desc: 'Port of the SMTP server.',
-        default: 587
-    }),
-    SMTP_USER: str({
-        desc: 'Username for SMTP authentication. Leave it unset if the server needs no login.',
-        default: undefined
-    }),
-    SMTP_PASSWORD: str({
-        desc: 'Password for SMTP authentication. Leave it unset if the server needs no login.',
-        default: undefined
     })
 });
-function createMailer() {
-    if (config.MAILER_TRANSPORT === 'smtp') {
-        if (!config.SMTP_HOST) throw new Error('SMTP_HOST is required when MAILER_TRANSPORT=smtp');
-        return createSmtpMailer({
-            host: config.SMTP_HOST,
-            port: config.SMTP_PORT,
-            ...config.SMTP_USER ? {
-                user: config.SMTP_USER
-            } : {},
-            ...config.SMTP_PASSWORD ? {
-                password: config.SMTP_PASSWORD
-            } : {},
-            from: config.MAILER_FROM
-        });
-    }
-    return createConsoleMailer({
-        from: config.MAILER_FROM
-    });
-}
-export const mailer = createMailer();
 
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import {bool, createConfig, num, str} from '@shipfox/config';\nimport {createConsoleMailer, createSmtpMailer, type Mailer} from '@shipfox/node-mailer';\n\nexport const config = createConfig({\n  AUTH_JWT_SECRET: str({\n    desc: 'Secret used to sign and verify user access tokens (JWTs). Required, with no default, so startup fails when it is missing.',\n  }),\n  AUTH_JWT_EXPIRES_IN: str({\n    desc: 'How long an access token stays valid. Accepts a duration string such as 15m, 1h, or 7d.',\n    default: '15m',\n  }),\n  AUTH_JOB_LEASE_TOKEN_SECRET: str({\n    desc: 'Secret used to sign and verify job lease tokens. Required, with no default, so startup fails when it is missing.',\n  }),\n  AUTH_JOB_LEASE_TOKEN_EXPIRES_IN: str({\n    desc: 'How long a job lease token stays valid. Set it longer than the longest job (JOB_MAX_DURATION is 60 minutes) plus a safety margin.',\n    default: '90m',\n  }),\n  AUTH_RUNNER_SESSION_TOKEN_SECRET: str({\n    desc: 'Secret used to sign and verify runner session tokens. Required, with no default, so startup fails when it is missing.',\n  }),\n  AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN: str({\n    desc: 'How long a runner session token stays valid. A revoked registration token can leave existing sessions usable until this lifetime ends.',\n    default: '1h',\n  }),\n  AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: num({\n    desc: 'How many days a refresh token stays valid before the user must sign in again.',\n    default: 14,\n  }),\n  AUTH_REFRESH_ROTATION_GRACE_SECONDS: num({\n    desc: 'Window after a refresh token is rotated during which the now-rotated token is still accepted, so concurrent refreshes from parallel tabs do not log the user out. Reuse past this window is treated as a compromise and revokes the session.',\n    default: 30,\n  }),\n  AUTH_REFRESH_COOKIE_NAME: str({\n    desc: 'Name of the browser cookie that stores the refresh token.',\n    default: 'shipfox_refresh_token',\n  }),\n  AUTH_PASSWORD_ENABLED: bool({\n    desc: 'Whether password login is available. Use true or false. Defaults to true. When false, password and email-verification routes are not registered, and server startup requires another module to contribute a login method.',\n    default: true,\n  }),\n  RATE_LIMIT_IDENTIFIER_SECRET: str({\n    desc: 'Optional secret used to HMAC identifiers before storing rate-limit counters. Leave it unset to derive a stable key from AUTH_JWT_SECRET.',\n    default: undefined,\n  }),\n  CLIENT_BASE_URL: str({\n    desc: 'Base URL of the client app. Used to build links in emails such as password resets.',\n    default: 'http://localhost:5173',\n  }),\n  MAILER_TRANSPORT: str({\n    desc: 'How emails are delivered. Use console to print them to the log, or smtp to send them through an SMTP server.',\n    choices: ['console', 'smtp'],\n    default: 'console',\n  }),\n  MAILER_FROM: str({\n    desc: 'Sender address shown on outgoing emails.',\n    default: 'noreply@shipfox.local',\n  }),\n  SMTP_HOST: str({\n    desc: 'Hostname of the SMTP server. Required when MAILER_TRANSPORT is smtp.',\n    default: undefined,\n  }),\n  SMTP_PORT: num({\n    desc: 'Port of the SMTP server.',\n    default: 587,\n  }),\n  SMTP_USER: str({\n    desc: 'Username for SMTP authentication. Leave it unset if the server needs no login.',\n    default: undefined,\n  }),\n  SMTP_PASSWORD: str({\n    desc: 'Password for SMTP authentication. Leave it unset if the server needs no login.',\n    default: undefined,\n  }),\n});\n\nfunction createMailer(): Mailer {\n  if (config.MAILER_TRANSPORT === 'smtp') {\n    if (!config.SMTP_HOST) throw new Error('SMTP_HOST is required when MAILER_TRANSPORT=smtp');\n    return createSmtpMailer({\n      host: config.SMTP_HOST,\n      port: config.SMTP_PORT,\n      ...(config.SMTP_USER ? {user: config.SMTP_USER} : {}),\n      ...(config.SMTP_PASSWORD ? {password: config.SMTP_PASSWORD} : {}),\n      from: config.MAILER_FROM,\n    });\n  }\n\n  return createConsoleMailer({from: config.MAILER_FROM});\n}\n\nexport const mailer = createMailer();\n"],"names":["bool","createConfig","num","str","createConsoleMailer","createSmtpMailer","config","AUTH_JWT_SECRET","desc","AUTH_JWT_EXPIRES_IN","default","AUTH_JOB_LEASE_TOKEN_SECRET","AUTH_JOB_LEASE_TOKEN_EXPIRES_IN","AUTH_RUNNER_SESSION_TOKEN_SECRET","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS","AUTH_REFRESH_ROTATION_GRACE_SECONDS","AUTH_REFRESH_COOKIE_NAME","AUTH_PASSWORD_ENABLED","RATE_LIMIT_IDENTIFIER_SECRET","undefined","CLIENT_BASE_URL","MAILER_TRANSPORT","choices","MAILER_FROM","SMTP_HOST","SMTP_PORT","SMTP_USER","SMTP_PASSWORD","createMailer","Error","host","port","user","password","from","mailer"],"mappings":"AAAA,SAAQA,IAAI,EAAEC,YAAY,EAAEC,GAAG,EAAEC,GAAG,QAAO,kBAAkB;AAC7D,SAAQC,mBAAmB,EAAEC,gBAAgB,QAAoB,uBAAuB;AAExF,OAAO,MAAMC,SAASL,aAAa;IACjCM,iBAAiBJ,IAAI;QACnBK,MAAM;IACR;IACAC,qBAAqBN,IAAI;QACvBK,MAAM;QACNE,SAAS;IACX;IACAC,6BAA6BR,IAAI;QAC/BK,MAAM;IACR;IACAI,iCAAiCT,IAAI;QACnCK,MAAM;QACNE,SAAS;IACX;IACAG,kCAAkCV,IAAI;QACpCK,MAAM;IACR;IACAM,sCAAsCX,IAAI;QACxCK,MAAM;QACNE,SAAS;IACX;IACAK,oCAAoCb,IAAI;QACtCM,MAAM;QACNE,SAAS;IACX;IACAM,qCAAqCd,IAAI;QACvCM,MAAM;QACNE,SAAS;IACX;IACAO,0BAA0Bd,IAAI;QAC5BK,MAAM;QACNE,SAAS;IACX;IACAQ,uBAAuBlB,KAAK;QAC1BQ,MAAM;QACNE,SAAS;IACX;IACAS,8BAA8BhB,IAAI;QAChCK,MAAM;QACNE,SAASU;IACX;IACAC,iBAAiBlB,IAAI;QACnBK,MAAM;QACNE,SAAS;IACX;IACAY,kBAAkBnB,IAAI;QACpBK,MAAM;QACNe,SAAS;YAAC;YAAW;SAAO;QAC5Bb,SAAS;IACX;IACAc,aAAarB,IAAI;QACfK,MAAM;QACNE,SAAS;IACX;IACAe,WAAWtB,IAAI;QACbK,MAAM;QACNE,SAASU;IACX;IACAM,WAAWxB,IAAI;QACbM,MAAM;QACNE,SAAS;IACX;IACAiB,WAAWxB,IAAI;QACbK,MAAM;QACNE,SAASU;IACX;IACAQ,eAAezB,IAAI;QACjBK,MAAM;QACNE,SAASU;IACX;AACF,GAAG;AAEH,SAASS;IACP,IAAIvB,OAAOgB,gBAAgB,KAAK,QAAQ;QACtC,IAAI,CAAChB,OAAOmB,SAAS,EAAE,MAAM,IAAIK,MAAM;QACvC,OAAOzB,iBAAiB;YACtB0B,MAAMzB,OAAOmB,SAAS;YACtBO,MAAM1B,OAAOoB,SAAS;YACtB,GAAIpB,OAAOqB,SAAS,GAAG;gBAACM,MAAM3B,OAAOqB,SAAS;YAAA,IAAI,CAAC,CAAC;YACpD,GAAIrB,OAAOsB,aAAa,GAAG;gBAACM,UAAU5B,OAAOsB,aAAa;YAAA,IAAI,CAAC,CAAC;YAChEO,MAAM7B,OAAOkB,WAAW;QAC1B;IACF;IAEA,OAAOpB,oBAAoB;QAAC+B,MAAM7B,OAAOkB,WAAW;IAAA;AACtD;AAEA,OAAO,MAAMY,SAASP,eAAe"}
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import {bool, createConfig, num, str} from '@shipfox/config';\n\nexport const config = createConfig({\n  AUTH_JWT_EXPIRES_IN: str({\n    desc: 'How long an access token stays valid. Accepts a duration string such as 15m, 1h, or 7d.',\n    default: '15m',\n  }),\n  AUTH_JOB_LEASE_TOKEN_EXPIRES_IN: str({\n    desc: 'How long a job lease token stays valid. Set it longer than the longest job (JOB_MAX_DURATION is 60 minutes) plus a safety margin.',\n    default: '90m',\n  }),\n  AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN: str({\n    desc: 'How long a runner session token stays valid. A revoked registration token can leave existing sessions usable until this lifetime ends.',\n    default: '1h',\n  }),\n  AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: num({\n    desc: 'How many days a refresh token stays valid before the user must sign in again.',\n    default: 14,\n  }),\n  AUTH_REFRESH_ROTATION_GRACE_SECONDS: num({\n    desc: 'Window after a refresh token is rotated during which the now-rotated token is still accepted, so concurrent refreshes from parallel tabs do not log the user out. Reuse past this window is treated as a compromise and revokes the session.',\n    default: 30,\n  }),\n  AUTH_REFRESH_COOKIE_NAME: str({\n    desc: 'Name of the browser cookie that stores the refresh token.',\n    default: 'shipfox_refresh_token',\n  }),\n  AUTH_PASSWORD_ENABLED: bool({\n    desc: 'Whether password login is available. Use true or false. Defaults to true. When false, password and email-verification routes are not registered, and server startup requires another module to contribute a login method.',\n    default: true,\n  }),\n  CLIENT_BASE_URL: str({\n    desc: 'Base URL of the client app. Used to build links in emails such as password resets.',\n    default: 'http://localhost:5173',\n  }),\n});\n"],"names":["bool","createConfig","num","str","config","AUTH_JWT_EXPIRES_IN","desc","default","AUTH_JOB_LEASE_TOKEN_EXPIRES_IN","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS","AUTH_REFRESH_ROTATION_GRACE_SECONDS","AUTH_REFRESH_COOKIE_NAME","AUTH_PASSWORD_ENABLED","CLIENT_BASE_URL"],"mappings":"AAAA,SAAQA,IAAI,EAAEC,YAAY,EAAEC,GAAG,EAAEC,GAAG,QAAO,kBAAkB;AAE7D,OAAO,MAAMC,SAASH,aAAa;IACjCI,qBAAqBF,IAAI;QACvBG,MAAM;QACNC,SAAS;IACX;IACAC,iCAAiCL,IAAI;QACnCG,MAAM;QACNC,SAAS;IACX;IACAE,sCAAsCN,IAAI;QACxCG,MAAM;QACNC,SAAS;IACX;IACAG,oCAAoCR,IAAI;QACtCI,MAAM;QACNC,SAAS;IACX;IACAI,qCAAqCT,IAAI;QACvCI,MAAM;QACNC,SAAS;IACX;IACAK,0BAA0BT,IAAI;QAC5BG,MAAM;QACNC,SAAS;IACX;IACAM,uBAAuBb,KAAK;QAC1BM,MAAM;QACNC,SAAS;IACX;IACAO,iBAAiBX,IAAI;QACnBG,MAAM;QACNC,SAAS;IACX;AACF,GAAG"}

package/dist/core/auth.d.ts

@@ -1,3 +1,4 @@
+import { type WorkspacesInterModuleClient } from '@shipfox/api-workspaces-dto/inter-module';
 import type { User } from './entities/user.js';
 import { AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError } from './errors.js';
 export interface SignupParams {
@@ -14,9 +15,18 @@ export interface ProvisionUserParams {
  * Existing users are returned unchanged, including their password and profile.
  */
 export declare function provisionUser(params: ProvisionUserParams): Promise<User>;
-export declare function signup(params: SignupParams): Promise<User>;
+export type SignupResult = User & {
+    emailChallenge: {
+        id: string;
+        nextResendAvailableAt: Date;
+    };
+};
+export declare function signup(params: SignupParams & {
+    sourceIp?: string;
+}): Promise<SignupResult>;
 export interface SignupWithInvitationParams extends SignupParams {
     invitationToken: string;
+    workspaces: WorkspacesInterModuleClient;
 }
 export interface SignupWithInvitationResult extends LoginResult {
     membership: {
@@ -37,6 +47,7 @@ export declare function createUser(params: CreateUserParams): Promise<User>;
 export interface LoginParams {
     email: string;
     password: string;
+    workspaces: WorkspacesInterModuleClient;
 }
 export interface LoginResult {
     token: string;
@@ -47,6 +58,7 @@ export declare function login(params: LoginParams): Promise<LoginResult>;
 export interface CreateSessionForUserParams {
     userId?: string | undefined;
     email?: string | undefined;
+    workspaces: WorkspacesInterModuleClient;
 }
 export interface CreateSessionForUserResult {
     token: string;
@@ -63,6 +75,7 @@ export interface RefreshAccessTokenResult {
 }
 export declare function refreshAccessToken(params: {
     refreshToken: string;
+    workspaces: WorkspacesInterModuleClient;
 }): Promise<RefreshAccessTokenResult>;
 export interface ConfirmEmailVerificationResult {
     token: string;
@@ -73,10 +86,15 @@ export interface ResendEmailVerificationResult {
     nextResendAvailableAt: Date;
 }
 export declare function confirmEmailVerification(params: {
-    token: string;
+    email: string;
+    challengeId: string;
+    code: string;
+    workspaces: WorkspacesInterModuleClient;
 }): Promise<ConfirmEmailVerificationResult>;
 export declare function resendEmailVerification(params: {
     email: string;
+    challengeId: string;
+    sourceIp: string;
 }): Promise<ResendEmailVerificationResult>;
 export declare function requestPasswordReset(params: {
     email: string;
@@ -89,6 +107,7 @@ export interface ConfirmPasswordResetResult {
 export declare function confirmPasswordReset(params: {
     token: string;
     newPassword: string;
+    workspaces: WorkspacesInterModuleClient;
 }): Promise<ConfirmPasswordResetResult>;
 export declare function changePassword(params: {
     userId: string;

package/dist/core/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EAErB,uBAAuB,EAEvB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AA8ErB,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9E;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhE;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC9D,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,0BAA2B,SAAQ,WAAW;IAC7D,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IACrE,WAAW,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC;CAC/C;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CA2ErC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAyBrE;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,qBAAqB,GACrB,uBAAuB,GACvB,iBAAiB,CAAC;AAEtB,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAqBrC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAmDpC;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAe1C;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAazC;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjF;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAuBtC;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvF;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAO5F"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,2BAA2B,EAEjC,MAAM,0CAA0C,CAAC;AAwBlD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EAErB,uBAAuB,EAKvB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AA6FrB,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9E;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG;IAChC,cAAc,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,IAAI,CAAA;KAAC,CAAC;CAC3D,CAAC;AAEF,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAoC9F;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA2B,SAAQ,WAAW;IAC7D,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IACrE,WAAW,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC;CAC/C;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAkErC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAyBrE;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,qBAAqB,GACrB,uBAAuB,GACvB,iBAAiB,CAAC;AAEtB,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAqBrC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAmDpC;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAmB1C;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAYzC;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjF;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAuBtC;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvF;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAO5F"}