@spinajs/rbac 2.0.485 → 2.0.487

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kEAA+B;AAC/B,iDAA8C;AAkCrC,8FAlCA,6BAAa,OAkCA;AAhCtB,oCAAuE;AACvE,0DAAuD;AACvD,sCAAmC;AAEnC,qBAAmB;AACnB,yBAAuB;AACvB,wBAAsB;AACtB,mCAAiC;AACjC,8BAA4B;AAC5B,0BAAwB;AACxB,8CAAwC;AAExC,kDAAgC;AAChC,4CAA0B;AAC1B,gDAA8B;AAC9B,+CAA6B;AAC7B,0DAAwC;AACxC,qDAAmC;AACnC,mDAAiC;AACjC,2DAAyC;AACzC,kFAAgE;AAChE,oDAAkC;AAClC,+CAA6B;AAC7B,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,+CAA6B;AAC7B,qDAAmC;AACnC,iDAA+B;AAE/B,wEAAwE;AACxE,MAAM,EAAE,UAAU,EAAE,GAAG,uBAAE,CAAC;AACF,gCAAU;AAG3B,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,iBAAY;IACzC,SAAS;QACd,MAAM,EAAE,GAAG,IAAI,6BAAa,EAAE,CAAC;QAC/B,OAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACzC,OAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,SAAqB,EAAE,aAA4B,EAAE,EAAE;YAC3F,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAgB,eAAe,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,SAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,wGAAwG,CAAC,CAAC;YACrH,CAAC;iBAAM,CAAC;gBACN,EAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH;;WAEG;QACH,OAAE,CAAC,QAAQ,CAAC,CAAC,CAAa,EAAE,QAAgB,EAAE,EAAE;YAC9C,OAAO,cAAI,CAAC,KAAK,CAAC;gBAChB,IAAI,EAAE,QAAQ;aACf,CAAC;iBACC,QAAQ,CAAC,UAAU,CAAC;iBACpB,YAAY,EAAE;iBACd,WAAW,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC;QAEzB,OAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,OAAE,CAAC,GAAG,CAAC,6BAAa,CAAC,CAAC;YACnC,MAAM,YAAY,GAAG,IAAK,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAEjE,OAAO,IAAI,cAAI,CAAC;gBACd,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,mBAAmB;gBAC1B,IAAI,EAAE,CAAC,OAAO,CAAC;gBACf,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC;QAE9B,OAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,cAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YACvG,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC;QAE/B,OAAE,CAAC,QAAQ,CAAE,KAAK,EAAE,CAAC,EAAE,IAAY,EAAG,EAAE;YAEtC,OAAO,IAAI,cAAI,CAAC;gBACd,KAAK,EAAE,oBAAoB,IAAI,IAAI;gBACnC,KAAK,EAAE,oBAAoB,IAAI,WAAW;gBAC1C,IAAI,EAAE,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QAGL,CAAC,CAAC,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC;IACnC,CAAC;CACF,CAAA;AAzDY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,eAAU,EAAC,iBAAY,CAAC;GACZ,gBAAgB,CAyD5B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kEAA+B;AAC/B,iDAA8C;AAoCrC,8FApCA,6BAAa,OAoCA;AAlCtB,oCAAuE;AACvE,0DAAuD;AACvD,sCAAmC;AAEnC,qBAAmB;AACnB,yBAAuB;AACvB,wBAAsB;AACtB,mCAAiC;AACjC,8BAA4B;AAC5B,0BAAwB;AACxB,8CAAqE;AACrE,8DAA4D;AAE5D,kDAAgC;AAChC,4CAA0B;AAC1B,gDAA8B;AAC9B,+CAA6B;AAC7B,0DAAwC;AACxC,qDAAmC;AACnC,mDAAiC;AACjC,2DAAyC;AACzC,kFAAgE;AAChE,uFAAqE;AACrE,oDAAkC;AAClC,+CAA6B;AAC7B,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,+CAA6B;AAC7B,qDAAmC;AACnC,iDAA+B;AAE/B,wEAAwE;AACxE,MAAM,EAAE,UAAU,EAAE,GAAG,uBAAE,CAAC;AACF,gCAAU;AAG3B,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,iBAAY;IACzC,SAAS;QACd;;;;;;WAMG;QACH,kCAAgB,CAAC,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,kCAAgB,CAAC,WAAW,EAAE,GAAG,qCAA2B,CAAC,CAAC,CAAC,CAAC;QAE/G,MAAM,EAAE,GAAG,IAAI,6BAAa,EAAE,CAAC;QAC/B,OAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACzC,OAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,SAAqB,EAAE,aAA4B,EAAE,EAAE;YAC3F,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAgB,eAAe,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,SAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,wGAAwG,CAAC,CAAC;YACrH,CAAC;iBAAM,CAAC;gBACN,EAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH;;WAEG;QACH,OAAE,CAAC,QAAQ,CAAC,CAAC,CAAa,EAAE,QAAgB,EAAE,EAAE;YAC9C,OAAO,cAAI,CAAC,KAAK,CAAC;gBAChB,IAAI,EAAE,QAAQ;aACf,CAAC;iBACC,QAAQ,CAAC,UAAU,CAAC;iBACpB,YAAY,EAAE;iBACd,WAAW,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC;QAEzB,OAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,OAAE,CAAC,GAAG,CAAC,6BAAa,CAAC,CAAC;YACnC,MAAM,YAAY,GAAG,IAAK,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAEjE,OAAO,IAAI,cAAI,CAAC;gBACd,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,mBAAmB;gBAC1B,IAAI,EAAE,CAAC,OAAO,CAAC;gBACf,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC;QAE9B,OAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,cAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YACxG,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC;QAE/B,OAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,IAAY,EAAE,EAAE;YACpC,OAAO,IAAI,cAAI,CAAC;gBACd,KAAK,EAAE,oBAAoB,IAAI,IAAI;gBACnC,KAAK,EAAE,oBAAoB,IAAI,WAAW;gBAC1C,IAAI,EAAE,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC;IACnC,CAAC;CACF,CAAA;AA/DY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,eAAU,EAAC,iBAAY,CAAC;GACZ,gBAAgB,CA+D5B"}

package/lib/cjs/migrations/RBACRegisteredAt_2026_07_28_00_00_00.d.ts

@@ -0,0 +1,21 @@
+import { OrmMigration, OrmDriver } from '@spinajs/orm';
+/**
+ * Adds the missing `RegisteredAt` column to `users`.
+ *
+ * `UserBase.RegisteredAt` has been declared on the model — and stamped by the
+ * `create()` action — since the beginning, but the initial migration never
+ * created the column. The ORM writes only columns the table description
+ * actually reports, so the value was dropped on every insert without a word:
+ * the field read back as null forever and anything distinguishing "account
+ * created" from "registration completed" quietly did not work.
+ *
+ * Nullable on purpose. Existing rows genuinely have no registration instant to
+ * backfill with, and inventing one ( CreatedAt, say ) would assert that every
+ * account that predates this migration completed registration, which is exactly
+ * the claim the column exists to make.
+ */
+export declare class RBACRegisteredAt_2026_07_28_00_00_00 extends OrmMigration {
+    up(connection: OrmDriver): Promise<void>;
+    down(_connection: OrmDriver): Promise<void>;
+}
+//# sourceMappingURL=RBACRegisteredAt_2026_07_28_00_00_00.d.ts.map

package/lib/cjs/migrations/RBACRegisteredAt_2026_07_28_00_00_00.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RBACRegisteredAt_2026_07_28_00_00_00.d.ts","sourceRoot":"","sources":["../../../src/migrations/RBACRegisteredAt_2026_07_28_00_00_00.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAa,MAAM,cAAc,CAAC;AAElE;;;;;;;;;;;;;;GAcG;AACH,qBACa,oCAAqC,SAAQ,YAAY;IACvD,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxC,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CACzD"}

package/lib/cjs/migrations/RBACRegisteredAt_2026_07_28_00_00_00.js

@@ -0,0 +1,49 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RBACRegisteredAt_2026_07_28_00_00_00 = void 0;
+/* eslint-disable @typescript-eslint/no-unused-vars */
+const orm_1 = require("@spinajs/orm");
+/**
+ * Adds the missing `RegisteredAt` column to `users`.
+ *
+ * `UserBase.RegisteredAt` has been declared on the model — and stamped by the
+ * `create()` action — since the beginning, but the initial migration never
+ * created the column. The ORM writes only columns the table description
+ * actually reports, so the value was dropped on every insert without a word:
+ * the field read back as null forever and anything distinguishing "account
+ * created" from "registration completed" quietly did not work.
+ *
+ * Nullable on purpose. Existing rows genuinely have no registration instant to
+ * backfill with, and inventing one ( CreatedAt, say ) would assert that every
+ * account that predates this migration completed registration, which is exactly
+ * the claim the column exists to make.
+ */
+let RBACRegisteredAt_2026_07_28_00_00_00 = class RBACRegisteredAt_2026_07_28_00_00_00 extends orm_1.OrmMigration {
+    async up(connection) {
+        // Applications that hit this gap already have added the column by hand;
+        // running ALTER TABLE against them would fail the whole migration on
+        // startup. Checked rather than assumed, because a migration that can only
+        // run on a pristine database is a migration that strands everybody who
+        // worked around the bug.
+        const columns = await connection.tableInfo('users');
+        if (columns?.some((c) => c.Name === 'RegisteredAt')) {
+            return;
+        }
+        await connection.schema().alterTable('users', (table) => {
+            table.dateTime('RegisteredAt');
+        });
+    }
+    // eslint-disable-next-line @typescript-eslint/no-empty-function
+    async down(_connection) { }
+};
+exports.RBACRegisteredAt_2026_07_28_00_00_00 = RBACRegisteredAt_2026_07_28_00_00_00;
+exports.RBACRegisteredAt_2026_07_28_00_00_00 = RBACRegisteredAt_2026_07_28_00_00_00 = __decorate([
+    (0, orm_1.Migration)('default')
+], RBACRegisteredAt_2026_07_28_00_00_00);
+//# sourceMappingURL=RBACRegisteredAt_2026_07_28_00_00_00.js.map

package/lib/cjs/migrations/RBACRegisteredAt_2026_07_28_00_00_00.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RBACRegisteredAt_2026_07_28_00_00_00.js","sourceRoot":"","sources":["../../../src/migrations/RBACRegisteredAt_2026_07_28_00_00_00.ts"],"names":[],"mappings":";;;;;;;;;AAAA,sDAAsD;AACtD,sCAAkE;AAElE;;;;;;;;;;;;;;GAcG;AAEI,IAAM,oCAAoC,GAA1C,MAAM,oCAAqC,SAAQ,kBAAY;IAC7D,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACtD,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IACzD,KAAK,CAAC,IAAI,CAAC,WAAsB,IAAkB,CAAC;CAC5D,CAAA;AApBY,oFAAoC;+CAApC,oCAAoC;IADhD,IAAA,eAAS,EAAC,SAAS,CAAC;GACR,oCAAoC,CAoBhD"}

package/lib/cjs/models/User.d.ts

@@ -65,8 +65,27 @@ export declare enum USER_COMMON_METADATA {
     USER_PWD_RESET_START_DATE = "user:pwd_reset:start_date",
     USER_PWD_RESET_WAIT_TIME = "user:pwd_reset:wait_time",
     USER_PWD_RESET_TOKEN = "user:pwd_reset:token",
-    USER_PWD_RESET_LAST_ATTEMPT = "user:pwd_reset:last_attempt"
+    USER_PWD_RESET_LAST_ATTEMPT = "user:pwd_reset:last_attempt",
+    /** Login throttling */
+    USER_LOGIN_ATTEMPTS = "user:login:attempts",
+    USER_LOGIN_LOCKED_UNTIL = "user:login:locked_until"
 }
+/**
+ * Metadata that decides whether somebody gets INTO an account, and therefore must
+ * never travel out of one — not to the account owner and not to an administrator
+ * reading the record through the API.
+ *
+ * `user:pwd_reset:token` is the sharp one: it is a bearer credential for
+ * `POST /auth/password/reset`, and the reset can be requested for anybody without
+ * being logged in at all. Handing it back in a user payload turns "read a user"
+ * into "take over that user". Ban and lockout state are here for a smaller reason
+ * — they tell an attacker exactly how much of the throttle they have burned.
+ *
+ * Applied to {@link UserMetadataBase._hiddenKeys} by the rbac bootstrapper, so it
+ * covers every `dehydrateWithRelations` in every package. Keys that a client
+ * legitimately needs ( avatar, phone, ... ) are deliberately absent.
+ */
+export declare const USER_SECURITY_METADATA_KEYS: string[];
 /**
  * Base model for users used by auth and ACL system
  *

package/lib/cjs/models/User.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../../src/models/User.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAW,SAAS,EAAmF,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAY,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAC9O,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAgB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAMnE,qBAAa,eAAgB,YAAW,UAAU;IAEhD;;;;;;OAMG;IACI,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;IAKpF;;;;;;;OAOG;IACI,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG;IAU1F,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,WAAW,EAAE,IAAI,GAAG,MAAM;IAMnF,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAejE,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAKvE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAMrE;;;;OAIG;IACI,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAOhE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM;IAQ7E,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM;IAQ7E,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,IAAI,EAAE,MAAM;IAQlF;;;;;;;;;OASG;IACI,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;CAmB7G;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,6BAA6B;IAC7B,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,iBAAiB,sBAAsB;IACvC,eAAe,oBAAoB;IAEnC,wBAAwB;IAExB,WAAW,gBAAgB;IAC3B,UAAU,eAAe;IACzB,uBAAuB,4BAA4B;IAEnD,gBAAgB;IAEhB,cAAc,mBAAmB;IAEjC,qBAAqB;IAGrB,cAAc,mBAAmB;IAEjC,yBAAyB,8BAA8B;IAEvD,wBAAwB,6BAA6B;IAErD,oBAAoB,yBAAyB;IAE7C,2BAA2B,gCAAgC;CAC5D;AAED;;;;GAIG;AACH,qBAEa,QAAS,SAAQ,SAAS,CAAC,QAAQ,CAAC;IAC/C;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,CAAsB;IAEjD,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC;IAE7B,gBAAuB,YAAY,EAAE,eAAe,CAAyB;gBAE1D,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC;IAUhC,EAAE,EAAG,MAAM,CAAC;IAEZ,IAAI,EAAG,MAAM,CAAC;IAEd,KAAK,EAAG,MAAM,CAAC;IAEtB;;OAEG;IACI,QAAQ,EAAG,MAAM,CAAC;IAEzB;;OAEG;IACI,KAAK,EAAG,MAAM,CAAC;IAEtB;;OAEG;IAEI,IAAI,EAAG,MAAM,EAAE,CAAC;IAEvB;;OAEG;IAEI,SAAS,EAAG,QAAQ,CAAC;IAE5B;;OAEG;IAEI,YAAY,EAAG,QAAQ,CAAC;IAE/B;;OAEG;IAEI,SAAS,EAAG,QAAQ,CAAC;IAGrB,WAAW,EAAG,QAAQ,CAAC;IAE9B;;;OAGG;IACI,QAAQ,EAAG,OAAO,CAAC;IAE1B;;;;;OAKG;IAII,QAAQ,EAAG,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAE3D,IAAW,OAAO,IAAI,OAAO,CAE5B;IAED,IAAW,QAAQ,IAAI,OAAO,CAoB7B;IAEM,sBAAsB,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,CAAC,IAAI,CAAC;IAcpF,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU;IAO5D;;;;OAIG;IACI,UAAU,CAAC,QAAQ,EAAE,MAAM;IAIlC;;;;;OAKG;IACI,UAAU,CAAC,QAAQ,EAAE,MAAM;IAIlC;;;;;OAKG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;WAItB,UAAU,CAAC,KAAK,EAAE,MAAM;WAMxB,UAAU,CAAC,KAAK,EAAE,MAAM;WAMxB,SAAS,CAAC,IAAI,EAAE,MAAM;IAMpC;;;;;OAKG;WACW,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;CAGxD;AAED;;GAEG;AACH,qBAEa,IAAK,SAAQ,QAAQ;CAEjC"}
+{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../../src/models/User.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAW,SAAS,EAAmF,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAY,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAC9O,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAgB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAMnE,qBAAa,eAAgB,YAAW,UAAU;IAChD;;;;;;OAMG;IACI,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;IAKpF;;;;;;;OAOG;IACI,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG;IAU1F,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,WAAW,EAAE,IAAI,GAAG,MAAM;IAMnF,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAcjE,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAKvE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAMrE;;;;OAIG;IACI,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe;IAOhE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM;IAQ7E,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,KAAK,EAAE,MAAM;IAQ7E,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,GAAG,eAAe,EAAE,IAAI,EAAE,MAAM;IAQlF;;;;;;;;;OASG;IACI,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;CAmB7G;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,6BAA6B;IAC7B,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,iBAAiB,sBAAsB;IACvC,eAAe,oBAAoB;IAEnC,wBAAwB;IAExB,WAAW,gBAAgB;IAC3B,UAAU,eAAe;IACzB,uBAAuB,4BAA4B;IAEnD,gBAAgB;IAEhB,cAAc,mBAAmB;IAEjC,qBAAqB;IAGrB,cAAc,mBAAmB;IAEjC,yBAAyB,8BAA8B;IAEvD,wBAAwB,6BAA6B;IAErD,oBAAoB,yBAAyB;IAE7C,2BAA2B,gCAAgC;IAE3D,uBAAuB;IAGvB,mBAAmB,wBAAwB;IAE3C,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,EAAogB,CAAC;AAErjB;;;;GAIG;AACH,qBAEa,QAAS,SAAQ,SAAS,CAAC,QAAQ,CAAC;IAC/C;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,CAAsB;IAEjD,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC;IAE7B,gBAAuB,YAAY,EAAE,eAAe,CAAyB;gBAE1D,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC;IAUhC,EAAE,EAAG,MAAM,CAAC;IAEZ,IAAI,EAAG,MAAM,CAAC;IAEd,KAAK,EAAG,MAAM,CAAC;IAEtB;;OAEG;IACI,QAAQ,EAAG,MAAM,CAAC;IAEzB;;OAEG;IACI,KAAK,EAAG,MAAM,CAAC;IAEtB;;OAEG;IAEI,IAAI,EAAG,MAAM,EAAE,CAAC;IAEvB;;OAEG;IAEI,SAAS,EAAG,QAAQ,CAAC;IAE5B;;OAEG;IAEI,YAAY,EAAG,QAAQ,CAAC;IAE/B;;OAEG;IAEI,SAAS,EAAG,QAAQ,CAAC;IAGrB,WAAW,EAAG,QAAQ,CAAC;IAE9B;;;OAGG;IACI,QAAQ,EAAG,OAAO,CAAC;IAE1B;;;;;OAKG;IAII,QAAQ,EAAG,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAE3D,IAAW,OAAO,IAAI,OAAO,CAE5B;IAED,IAAW,QAAQ,IAAI,OAAO,CAoB7B;IAEM,sBAAsB,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,CAAC,IAAI,CAAC;IAapF,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU;IAO5D;;;;OAIG;IACI,UAAU,CAAC,QAAQ,EAAE,MAAM;IAIlC;;;;;OAKG;IACI,UAAU,CAAC,QAAQ,EAAE,MAAM;IAIlC;;;;;OAKG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;IAIpC;;;;OAIG;IACI,YAAY,CAAC,QAAQ,EAAE,MAAM;WAItB,UAAU,CAAC,KAAK,EAAE,MAAM;WAMxB,UAAU,CAAC,KAAK,EAAE,MAAM;WAMxB,SAAS,CAAC,IAAI,EAAE,MAAM;IAMpC;;;;;OAKG;WACW,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;CAGxD;AAED;;GAEG;AACH,qBAEa,IAAK,SAAQ,QAAQ;CAAG"}

package/lib/cjs/models/User.js

@@ -10,7 +10,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 var UserBase_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.User = exports.UserBase = exports.USER_COMMON_METADATA = exports.UserQueryScopes = void 0;
+exports.User = exports.UserBase = exports.USER_SECURITY_METADATA_KEYS = exports.USER_COMMON_METADATA = exports.UserQueryScopes = void 0;
 const luxon_1 = require("luxon");
 const orm_1 = require("@spinajs/orm");
 const di_1 = require("@spinajs/di");
@@ -41,9 +41,9 @@ class UserQueryScopes {
     whereMetadata(key, value) {
         const k = (0, util_1._check_arg)((0, util_1._or)((0, util_1._is_object)((0, util_1._non_nil)()), (0, util_1._is_string)((0, util_1._trim)(), (0, util_1._non_empty)())))(key, 'key');
         const v = (0, util_1._check_arg)((0, util_1._non_nil)())(value, 'value');
-        return this.whereExist("Metadata", function () {
-            this.where("Key", k);
-            this.where("Value", v);
+        return this.whereExist('Metadata', function () {
+            this.where('Key', k);
+            this.where('Value', v);
         });
     }
     whereUser(userOrEmail) {
@@ -150,7 +150,28 @@ var USER_COMMON_METADATA;
     USER_COMMON_METADATA["USER_PWD_RESET_TOKEN"] = "user:pwd_reset:token";
     // reset password last succesyfull  attempt
     USER_COMMON_METADATA["USER_PWD_RESET_LAST_ATTEMPT"] = "user:pwd_reset:last_attempt";
+    /** Login throttling */
+    // consecutive failed login attempts since the last success
+    USER_COMMON_METADATA["USER_LOGIN_ATTEMPTS"] = "user:login:attempts";
+    // ISO instant until which authentication is refused for this account
+    USER_COMMON_METADATA["USER_LOGIN_LOCKED_UNTIL"] = "user:login:locked_until";
 })(USER_COMMON_METADATA || (exports.USER_COMMON_METADATA = USER_COMMON_METADATA = {}));
+/**
+ * Metadata that decides whether somebody gets INTO an account, and therefore must
+ * never travel out of one — not to the account owner and not to an administrator
+ * reading the record through the API.
+ *
+ * `user:pwd_reset:token` is the sharp one: it is a bearer credential for
+ * `POST /auth/password/reset`, and the reset can be requested for anybody without
+ * being logged in at all. Handing it back in a user payload turns "read a user"
+ * into "take over that user". Ban and lockout state are here for a smaller reason
+ * — they tell an attacker exactly how much of the throttle they have burned.
+ *
+ * Applied to {@link UserMetadataBase._hiddenKeys} by the rbac bootstrapper, so it
+ * covers every `dehydrateWithRelations` in every package. Keys that a client
+ * legitimately needs ( avatar, phone, ... ) are deliberately absent.
+ */
+exports.USER_SECURITY_METADATA_KEYS = [USER_COMMON_METADATA.USER_2FA_TOKEN, USER_COMMON_METADATA.USER_PWD_RESET, USER_COMMON_METADATA.USER_PWD_RESET_TOKEN, USER_COMMON_METADATA.USER_PWD_RESET_START_DATE, USER_COMMON_METADATA.USER_PWD_RESET_WAIT_TIME, USER_COMMON_METADATA.USER_PWD_RESET_LAST_ATTEMPT, USER_COMMON_METADATA.USER_BAN_IS_BANNED, USER_COMMON_METADATA.USER_BAN_START_DATE, USER_COMMON_METADATA.USER_BAN_DURATION, USER_COMMON_METADATA.USER_BAN_REASON, USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS, USER_COMMON_METADATA.USER_LOGIN_LOCKED_UNTIL];
 /**
  * Base model for users used by auth and ACL system
  *
@@ -195,7 +216,7 @@ let UserBase = UserBase_1 = class UserBase extends orm_1.ModelBase {
          * Hide meta keys we dont want to show publicly
          */
         if (base.Metadata) {
-            base.Metadata = base.Metadata.filter(m => !UserMetadata_js_1.UserMetadataBase._hiddenKeys.includes(m.Key));
+            base.Metadata = base.Metadata.filter((m) => !UserMetadata_js_1.UserMetadataBase._hiddenKeys.includes(m.Key));
         }
         return base;
     }
@@ -320,7 +341,7 @@ __decorate([
 ], UserBase.prototype, "LastLoginAt", void 0);
 __decorate([
     (0, orm_1.HasMany)(UserMetadata_js_1.UserMetadataBase, {
-        foreignKey: "user_id"
+        foreignKey: 'user_id',
     }),
     __metadata("design:type", orm_1.MetadataRelation)
 ], UserBase.prototype, "Metadata", void 0);

package/lib/cjs/models/User.js.map

@@ -1 +1 @@
-{"version":3,"file":"User.js","sourceRoot":"","sources":["../../../src/models/User.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,iCAAiC;AACjC,sCAA8O;AAE9O,oCAAiC;AACjC,uDAAmE;AACnE,+BAAoC;AACpC,wCAAwM;AAExM,0DAA8C;AAE9C,MAAa,eAAe;IAE1B;;;;;;OAMG;IACI,QAAQ,CAAsD,KAAe;QAClF,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACI,aAAa,CAAsD,GAAW,EAAE,KAAU;QAC/F,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;YACjC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAsD,WAA0B;QAC9F,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAEjH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAEM,KAAK,CAAC,aAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE;aACrC,UAAU,CACT,8BAAY,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,cAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CACH;aACA,WAAW,EAAE,CAAA;QAGhB,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAEM,KAAK,CAAC,aAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/E,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,SAAS,EAAE,IAAW;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,YAAY;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAW;SACvB,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAsD,KAAa;QAClF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAsD,KAAa;QAClF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAsD,IAAY;QAChF,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,aAAa,CAA6D,UAA2B;QAC1G,UAAU,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,CAAC,CAAC,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAE9G,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,uDAAuD;QACvD,MAAM,EAAE,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE3H,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,KAAK,IAAI,EACX;YACE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC,EACD;YACE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3F,CAAC,CACF,CAAC;IACJ,CAAC;CACF;AAjID,0CAiIC;AAED;;GAEG;AACH,IAAY,oBA6BX;AA7BD,WAAY,oBAAoB;IAC9B,6BAA6B;IAC7B,iEAAyC,CAAA;IACzC,mEAA2C,CAAA;IAC3C,+DAAuC,CAAA;IACvC,2DAAmC,CAAA;IAEnC,wBAAwB;IAExB,mDAA2B,CAAA;IAC3B,iDAAyB,CAAA;IACzB,2EAAmD,CAAA;IAEnD,gBAAgB;IAEhB,yDAAiC,CAAA;IAEjC,qBAAqB;IAErB,gCAAgC;IAChC,yDAAiC,CAAA;IACjC,+BAA+B;IAC/B,+EAAuD,CAAA;IACvD,+BAA+B;IAC/B,6EAAqD,CAAA;IACrD,uBAAuB;IACvB,qEAA6C,CAAA;IAC7C,2CAA2C;IAC3C,mFAA2D,CAAA;AAC7D,CAAC,EA7BW,oBAAoB,oCAApB,oBAAoB,QA6B/B;AAED;;;;GAIG;AAGI,IAAM,QAAQ,gBAAd,MAAM,QAAS,SAAQ,eAAmB;IAY/C,YAAmB,IAAoB;QACrC,KAAK,CAAC,IAAI,CAAC,CAAC;QAZd;;;;WAIG;QACO,YAAO,GAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAS/C,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAA,SAAM,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,CAAC,IAAA,oBAAI,EAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAElF,IAAI,CAAC,GAAG,GAAG,OAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACtC,CAAC;IA+DD,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,IAAW,QAAQ;QACjB,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QAEvE,yDAAyD;QACzD,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,YAAY,gBAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oEAAoE;QACpE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC;IACtE,CAAC;IAEM,sBAAsB,CAAC,OAA2B;QAEvD,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAA+C,CAAA;QAEhG;;WAEG;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,kCAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAQ,CAAA;QACjG,CAAC;QAED,OAAO,IAAW,CAAC;IACrB,CAAC;IAEM,GAAG,CAAC,QAAgB,EAAE,UAAkB;QAC7C,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnE,UAAU,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzE,OAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACI,UAAU,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACI,UAAU,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,KAAa;QACpC,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,KAAa;QACpC,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvE,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,IAAY;QAClC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,aAAa,CAAC,UAA2B;QACrD,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5D,CAAC;;AArOU,4BAAQ;AAUI,qBAAY,GAAoB,IAAI,eAAe,EAAE,AAAzC,CAA0C;AAYtE;IADN,IAAA,aAAO,GAAE;;oCACS;AAoBZ;IADN,IAAA,SAAG,GAAE;;sCACiB;AAMhB;IADN,IAAA,eAAS,GAAE;8BACO,gBAAQ;2CAAC;AAMrB;IADN,IAAA,cAAE,GAAE;8BACiB,gBAAQ;8CAAC;AAMxB;IADN,IAAA,gBAAU,GAAE;8BACM,gBAAQ;2CAAC;AAGrB;IADN,IAAA,cAAE,GAAE;8BACgB,gBAAQ;6CAAC;AAiBvB;IAHN,IAAA,aAAO,EAAC,kCAAgB,EAAE;QACzB,UAAU,EAAE,SAAS;KACtB,CAAC;8BACgB,sBAAgB;0CAAyB;mBAhFhD,QAAQ;IAFpB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,OAAO,CAAC;;GACF,QAAQ,CAsOpB;AAED;;GAEG;AAGI,IAAM,IAAI,GAAV,MAAM,IAAK,SAAQ,QAAQ;CAEjC,CAAA;AAFY,oBAAI;eAAJ,IAAI;IAFhB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,OAAO,CAAC;GACF,IAAI,CAEhB"}
+{"version":3,"file":"User.js","sourceRoot":"","sources":["../../../src/models/User.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,iCAAiC;AACjC,sCAA8O;AAE9O,oCAAiC;AACjC,uDAAmE;AACnE,+BAAoC;AACpC,wCAAwM;AAExM,0DAA8C;AAE9C,MAAa,eAAe;IAC1B;;;;;;OAMG;IACI,QAAQ,CAAsD,KAAe;QAClF,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACI,aAAa,CAAsD,GAAW,EAAE,KAAU;QAC/F,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;YACjC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAsD,WAA0B;QAC9F,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAEjH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAEM,KAAK,CAAC,aAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE;aACrC,UAAU,CACT,8BAAY,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,cAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CACH;aACA,WAAW,EAAE,CAAC;QAEjB,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAEM,KAAK,CAAC,aAAa;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/E,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,SAAS,EAAE,IAAW;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,YAAY;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAW;SACvB,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAsD,KAAa;QAClF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAEM,UAAU,CAAsD,KAAa;QAClF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAEM,SAAS,CAAsD,IAAY;QAChF,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,aAAa,CAA6D,UAA2B;QAC1G,UAAU,GAAG,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,CAAC,CAAC,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAE9G,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,uDAAuD;QACvD,MAAM,EAAE,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE3H,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,KAAK,IAAI,EACX;YACE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC,EACD;YACE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3F,CAAC,CACF,CAAC;IACJ,CAAC;CACF;AA/HD,0CA+HC;AAED;;GAEG;AACH,IAAY,oBAoCX;AApCD,WAAY,oBAAoB;IAC9B,6BAA6B;IAC7B,iEAAyC,CAAA;IACzC,mEAA2C,CAAA;IAC3C,+DAAuC,CAAA;IACvC,2DAAmC,CAAA;IAEnC,wBAAwB;IAExB,mDAA2B,CAAA;IAC3B,iDAAyB,CAAA;IACzB,2EAAmD,CAAA;IAEnD,gBAAgB;IAEhB,yDAAiC,CAAA;IAEjC,qBAAqB;IAErB,gCAAgC;IAChC,yDAAiC,CAAA;IACjC,+BAA+B;IAC/B,+EAAuD,CAAA;IACvD,+BAA+B;IAC/B,6EAAqD,CAAA;IACrD,uBAAuB;IACvB,qEAA6C,CAAA;IAC7C,2CAA2C;IAC3C,mFAA2D,CAAA;IAE3D,uBAAuB;IAEvB,2DAA2D;IAC3D,mEAA2C,CAAA;IAC3C,qEAAqE;IACrE,2EAAmD,CAAA;AACrD,CAAC,EApCW,oBAAoB,oCAApB,oBAAoB,QAoC/B;AAED;;;;;;;;;;;;;;GAcG;AACU,QAAA,2BAA2B,GAAa,CAAC,oBAAoB,CAAC,cAAc,EAAE,oBAAoB,CAAC,cAAc,EAAE,oBAAoB,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,wBAAwB,EAAE,oBAAoB,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,eAAe,EAAE,oBAAoB,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;AAErjB;;;;GAIG;AAGI,IAAM,QAAQ,gBAAd,MAAM,QAAS,SAAQ,eAAmB;IAY/C,YAAmB,IAAoB;QACrC,KAAK,CAAC,IAAI,CAAC,CAAC;QAZd;;;;WAIG;QACO,YAAO,GAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAS/C,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAA,SAAM,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,CAAC,IAAA,oBAAI,EAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAElF,IAAI,CAAC,GAAG,GAAG,OAAE,CAAC,GAAG,CAAC,eAAe,CAAE,CAAC;IACtC,CAAC;IA+DD,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,IAAW,QAAQ;QACjB,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QAEvE,yDAAyD;QACzD,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,YAAY,gBAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oEAAoE;QACpE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC;IACtE,CAAC;IAEM,sBAAsB,CAAC,OAA2B;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAA+C,CAAC;QAEjG;;WAEG;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kCAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAQ,CAAC;QACpG,CAAC;QAED,OAAO,IAAW,CAAC;IACrB,CAAC;IAEM,GAAG,CAAC,QAAgB,EAAE,UAAkB;QAC7C,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnE,UAAU,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzE,OAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACI,UAAU,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACI,UAAU,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,KAAa;QACpC,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,KAAa;QACpC,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvE,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,IAAY;QAClC,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErD,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,aAAa,CAAC,UAA2B;QACrD,OAAO,UAAQ,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5D,CAAC;;AApOU,4BAAQ;AAUI,qBAAY,GAAoB,IAAI,eAAe,EAAE,AAAzC,CAA0C;AAYtE;IADN,IAAA,aAAO,GAAE;;oCACS;AAoBZ;IADN,IAAA,SAAG,GAAE;;sCACiB;AAMhB;IADN,IAAA,eAAS,GAAE;8BACO,gBAAQ;2CAAC;AAMrB;IADN,IAAA,cAAE,GAAE;8BACiB,gBAAQ;8CAAC;AAMxB;IADN,IAAA,gBAAU,GAAE;8BACM,gBAAQ;2CAAC;AAGrB;IADN,IAAA,cAAE,GAAE;8BACgB,gBAAQ;6CAAC;AAiBvB;IAHN,IAAA,aAAO,EAAC,kCAAgB,EAAE;QACzB,UAAU,EAAE,SAAS;KACtB,CAAC;8BACgB,sBAAgB;0CAAyB;mBAhFhD,QAAQ;IAFpB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,OAAO,CAAC;;GACF,QAAQ,CAqOpB;AAED;;GAEG;AAGI,IAAM,IAAI,GAAV,MAAM,IAAK,SAAQ,QAAQ;CAAG,CAAA;AAAxB,oBAAI;eAAJ,IAAI;IAFhB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,OAAO,CAAC;GACF,IAAI,CAAoB"}

package/lib/cjs/session.d.ts

@@ -27,6 +27,88 @@ export declare class UserSession implements ISession {
  * @param session - the session whose expiry drives the cookie lifetime
  */
 export declare function sessionCookieMaxAge(session: ISession): number | undefined;
+/**
+ * Base name of the session cookie, before any `__Host-` / `__Secure-` prefix.
+ */
+export declare const SESSION_COOKIE_BASE_NAME = "ssid";
+/**
+ * Everything an application may tune about the session cookie, read from
+ * `rbac.session.cookie`. Unknown keys are passed through to express untouched,
+ * so `domain`, `path`, `priority`… still work.
+ *
+ * `httpOnly` and `signed` are deliberately NOT tunable: a session cookie that
+ * javascript can read, or that carries no signature, is not a session cookie
+ * this package is willing to issue.
+ */
+export interface ISessionCookieConfig {
+    /** Base cookie name. Default `ssid`. */
+    name?: string;
+    /**
+     * Emit the cookie as `__Host-<name>`. The prefix is only honored by browsers
+     * when the cookie is `Secure`, has `Path=/` and carries no `Domain`, so
+     * enabling it forces exactly that and drops any configured `domain`.
+     */
+    hostPrefix?: boolean;
+    /** Default `true`. Set false ONLY for local http development. */
+    secure?: boolean;
+    /** Default `strict`. */
+    sameSite?: 'strict' | 'lax' | 'none' | boolean;
+    [key: string]: unknown;
+}
+/**
+ * Name the session cookie is issued and read under.
+ *
+ * @param config - the `rbac.session.cookie` configuration block
+ */
+export declare function sessionCookieName(config?: ISessionCookieConfig): string;
+/**
+ * Cookie options for the session cookie.
+ *
+ * Application configuration is applied FIRST and the security-critical flags
+ * last, so a stray `httpOnly: false` in an app config cannot downgrade the
+ * cookie — previously every call site spread the config after its own hardening
+ * and the config won. `secure` and `sameSite` stay tunable ( http development
+ * needs `secure: false` ) but default to the hardened value rather than to
+ * whatever the browser assumes.
+ *
+ * @param config - the `rbac.session.cookie` configuration block
+ * @param maxAge - cookie lifetime in ms; `undefined` = browser-session cookie
+ */
+export declare function sessionCookieOptions(config?: ISessionCookieConfig, maxAge?: number): Record<string, unknown>;
+/**
+ * Session cookie in the shape the http `Coockies` response option accepts.
+ */
+export interface ISessionCookieDescriptor {
+    Name: string;
+    Value: string;
+    Options: Record<string, unknown>;
+}
+/**
+ * Descriptor of the session cookie carrying an active session, in the shape the
+ * http `Coockies` response option accepts.
+ *
+ * @param session - session whose id and expiration the cookie carries
+ * @param config - the `rbac.session.cookie` configuration block
+ */
+export declare function sessionCookie(session: ISession, config?: ISessionCookieConfig): ISessionCookieDescriptor;
+/**
+ * Descriptor of an already-expired session cookie — clears the session client
+ * side on logout.
+ *
+ * @param config - the `rbac.session.cookie` configuration block
+ */
+export declare function clearSessionCookie(config?: ISessionCookieConfig): ISessionCookieDescriptor;
+/**
+ * Stable, non-reversible handle for a session id.
+ *
+ * Session ids must never reach a log file or a response body — a leaked log is
+ * then a leaked account. The hash correlates entries across the session's life
+ * and identifies a session in the "active devices" API without handing the
+ * caller a usable credential for it.
+ *
+ * @param sessionId - raw session id
+ */
+export declare function hashSessionId(sessionId: string): string;
 /**
  * Session-fixation protection helper. Mints a NEW session id, copies the
  * ownership identity and data across, deletes the old id and persists the new

package/lib/cjs/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAI5D;;GAEG;AACH,qBACa,WAAY,YAAW,QAAQ;IACnC,SAAS,EAAE,MAAM,CAAY;IAEpC;;OAEG;IACI,MAAM,EAAE,MAAM,CAAC;IAEf,QAAQ,EAAE,QAAQ,CAAkB;IAE3C;;;OAGG;IACI,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAa;IAE7C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAa;gBAElC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC;CAKxC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWvG;AAED;;;GAGG;AACH,qBACa,kBAAmB,SAAQ,eAAe,CAAC,QAAQ,CAAC;IAC/D,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAA+B;IAE3D,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAepD,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtC,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAc1C,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAU/C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAItC,OAAO,CAAC,gBAAgB;CAMzB"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAI5D;;GAEG;AACH,qBACa,WAAY,YAAW,QAAQ;IACnC,SAAS,EAAE,MAAM,CAAY;IAEpC;;OAEG;IACI,MAAM,EAAE,MAAM,CAAC;IAEf,QAAQ,EAAE,QAAQ,CAAkB;IAE3C;;;OAGG;IACI,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAa;IAE7C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAa;gBAElC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC;CAKxC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;IAE/C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAKD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,oBAAyB,GAAG,MAAM,CAG3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,GAAE,oBAAyB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0BhH;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAE,oBAAyB,GAAG,wBAAwB,CAS5G;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,GAAE,oBAAyB,GAAG,wBAAwB,CAS9F;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWvG;AAED;;;GAGG;AACH,qBACa,kBAAmB,SAAQ,eAAe,CAAC,QAAQ,CAAC;IAC/D,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAA+B;IAE3D,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAepD,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtC,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAc1C,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAU/C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAItC,OAAO,CAAC,gBAAgB;CAMzB"}

package/lib/cjs/session.js

@@ -9,10 +9,16 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MemorySessionStore = exports.UserSession = void 0;
+exports.MemorySessionStore = exports.SESSION_COOKIE_BASE_NAME = exports.UserSession = void 0;
 exports.sessionCookieMaxAge = sessionCookieMaxAge;
+exports.sessionCookieName = sessionCookieName;
+exports.sessionCookieOptions = sessionCookieOptions;
+exports.sessionCookie = sessionCookie;
+exports.clearSessionCookie = clearSessionCookie;
+exports.hashSessionId = hashSessionId;
 exports.regenerateSession = regenerateSession;
 const luxon_1 = require("luxon");
+const crypto_1 = require("crypto");
 const interfaces_js_1 = require("./interfaces.js");
 const di_1 = require("@spinajs/di");
 const uuid_1 = require("uuid");
@@ -53,6 +59,104 @@ function sessionCookieMaxAge(session) {
     }
     return Math.max(0, Math.floor(session.Expiration.diff(luxon_1.DateTime.now()).milliseconds));
 }
+/**
+ * Base name of the session cookie, before any `__Host-` / `__Secure-` prefix.
+ */
+exports.SESSION_COOKIE_BASE_NAME = 'ssid';
+/** Keys consumed by this module rather than handed to express. */
+const COOKIE_CONTROL_KEYS = ['name', 'hostPrefix'];
+/**
+ * Name the session cookie is issued and read under.
+ *
+ * @param config - the `rbac.session.cookie` configuration block
+ */
+function sessionCookieName(config = {}) {
+    const base = config.name ?? exports.SESSION_COOKIE_BASE_NAME;
+    return config.hostPrefix ? `__Host-${base}` : base;
+}
+/**
+ * Cookie options for the session cookie.
+ *
+ * Application configuration is applied FIRST and the security-critical flags
+ * last, so a stray `httpOnly: false` in an app config cannot downgrade the
+ * cookie — previously every call site spread the config after its own hardening
+ * and the config won. `secure` and `sameSite` stay tunable ( http development
+ * needs `secure: false` ) but default to the hardened value rather than to
+ * whatever the browser assumes.
+ *
+ * @param config - the `rbac.session.cookie` configuration block
+ * @param maxAge - cookie lifetime in ms; `undefined` = browser-session cookie
+ */
+function sessionCookieOptions(config = {}, maxAge) {
+    const passthrough = {};
+    for (const [key, value] of Object.entries(config)) {
+        if (!COOKIE_CONTROL_KEYS.includes(key)) {
+            passthrough[key] = value;
+        }
+    }
+    const options = {
+        ...passthrough,
+        httpOnly: true,
+        secure: config.secure ?? true,
+        sameSite: config.sameSite ?? 'strict',
+        maxAge,
+    };
+    // A `__Host-` cookie is rejected by the browser unless it is Secure, rooted at
+    // `/` and has no Domain. Enforce the whole set rather than emitting a cookie
+    // the client will silently drop.
+    if (config.hostPrefix) {
+        options.secure = true;
+        options.path = '/';
+        delete options.domain;
+    }
+    return options;
+}
+/**
+ * Descriptor of the session cookie carrying an active session, in the shape the
+ * http `Coockies` response option accepts.
+ *
+ * @param session - session whose id and expiration the cookie carries
+ * @param config - the `rbac.session.cookie` configuration block
+ */
+function sessionCookie(session, config = {}) {
+    return {
+        Name: sessionCookieName(config),
+        Value: session.SessionId,
+        Options: {
+            ...sessionCookieOptions(config, sessionCookieMaxAge(session)),
+            signed: true,
+        },
+    };
+}
+/**
+ * Descriptor of an already-expired session cookie — clears the session client
+ * side on logout.
+ *
+ * @param config - the `rbac.session.cookie` configuration block
+ */
+function clearSessionCookie(config = {}) {
+    return {
+        Name: sessionCookieName(config),
+        Value: '',
+        Options: {
+            ...sessionCookieOptions(config, 0),
+            signed: false,
+        },
+    };
+}
+/**
+ * Stable, non-reversible handle for a session id.
+ *
+ * Session ids must never reach a log file or a response body — a leaked log is
+ * then a leaked account. The hash correlates entries across the session's life
+ * and identifies a session in the "active devices" API without handing the
+ * caller a usable credential for it.
+ *
+ * @param sessionId - raw session id
+ */
+function hashSessionId(sessionId) {
+    return (0, crypto_1.createHash)('sha256').update(`spinajs:session:${sessionId}`).digest('hex').substring(0, 32);
+}
 /**
  * Session-fixation protection helper. Mints a NEW session id, copies the
  * ownership identity and data across, deletes the old id and persists the new

package/lib/cjs/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":";;;;;;;;;;;;AA0CA,kDAKC;AAgBD,8CAWC;AA1ED,iCAAiC;AACjC,mDAA4D;AAC5D,oCAAsD;AACtD,+BAAoC;AAEpC;;GAEG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAkBtB,YAAY,OAA2B;QAjBhC,cAAS,GAAW,IAAA,SAAM,GAAE,CAAC;QAO7B,aAAQ,GAAa,gBAAQ,CAAC,GAAG,EAAE,CAAC;QAE3C;;;WAGG;QACI,eAAU,GAAyB,SAAS,CAAC;QAE7C,SAAI,GAAyB,IAAI,GAAG,EAAE,CAAC;QAG5C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF,CAAA;AAvBY,kCAAW;sBAAX,WAAW;IADvB,IAAA,gBAAW,GAAE;;GACD,WAAW,CAuBvB;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,OAAiB;IACnD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,iBAAiB,CAAC,QAAyB,EAAE,OAAiB;IAClF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEjC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,+BAAyB;IAA1D;;QACK,aAAQ,GAA0B,IAAI,GAAG,EAAoB,CAAC;IA0E1E,CAAC;IAxEQ,KAAK,CAAC,OAAO,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oDAAoD;QACpD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,OAAiB;QACjC,sEAAsE;QACtE,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,OAAiB;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE/C,qEAAqE;QACrE,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,SAAiB;QACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,MAAc;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,MAAc;QACpC,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,QAAQ;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,CAAC;IAEO,gBAAgB,CAAC,CAAuB,EAAE,CAAuB;QACvE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;CACF,CAAA;AA3EY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,eAAU,EAAC,+BAAe,CAAC;GACf,kBAAkB,CA2E9B"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":";;;;;;;;;;;;AA2CA,kDAKC;AA4CD,8CAGC;AAeD,oDA0BC;AAkBD,sCASC;AAQD,gDASC;AAYD,sCAEC;AAgBD,8CAWC;AA7ND,iCAAiC;AACjC,mCAAoC;AACpC,mDAA4D;AAC5D,oCAAsD;AACtD,+BAAoC;AAEpC;;GAEG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAkBtB,YAAY,OAA2B;QAjBhC,cAAS,GAAW,IAAA,SAAM,GAAE,CAAC;QAO7B,aAAQ,GAAa,gBAAQ,CAAC,GAAG,EAAE,CAAC;QAE3C;;;WAGG;QACI,eAAU,GAAyB,SAAS,CAAC;QAE7C,SAAI,GAAyB,IAAI,GAAG,EAAE,CAAC;QAG5C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF,CAAA;AAvBY,kCAAW;sBAAX,WAAW;IADvB,IAAA,gBAAW,GAAE;;GACD,WAAW,CAuBvB;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,OAAiB;IACnD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;GAEG;AACU,QAAA,wBAAwB,GAAG,MAAM,CAAC;AA+B/C,kEAAkE;AAClE,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAEnD;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,SAA+B,EAAE;IACjE,MAAM,IAAI,GAAI,MAAM,CAAC,IAAe,IAAI,gCAAwB,CAAC;IACjE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,oBAAoB,CAAC,SAA+B,EAAE,EAAE,MAAe;IACrF,MAAM,WAAW,GAA4B,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAA4B;QACvC,GAAG,WAAW;QACd,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ;QACrC,MAAM;KACP,CAAC;IAEF,+EAA+E;IAC/E,6EAA6E;IAC7E,iCAAiC;IACjC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;QACtB,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC;QACnB,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAWD;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,OAAiB,EAAE,SAA+B,EAAE;IAChF,OAAO;QACL,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC;QAC/B,KAAK,EAAE,OAAO,CAAC,SAAS;QACxB,OAAO,EAAE;YACP,GAAG,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC7D,MAAM,EAAE,IAAI;SACb;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,SAA+B,EAAE;IAClE,OAAO;QACL,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC;QAC/B,KAAK,EAAE,EAAE;QACT,OAAO,EAAE;YACP,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;YAClC,MAAM,EAAE,KAAK;SACd;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,aAAa,CAAC,SAAiB;IAC7C,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,iBAAiB,CAAC,QAAyB,EAAE,OAAiB;IAClF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEjC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,+BAAyB;IAA1D;;QACK,aAAQ,GAA0B,IAAI,GAAG,EAAoB,CAAC;IA0E1E,CAAC;IAxEQ,KAAK,CAAC,OAAO,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oDAAoD;QACpD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,OAAiB;QACjC,sEAAsE;QACtE,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,OAAiB;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE/C,qEAAqE;QACrE,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,SAAiB;QACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,MAAc;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,MAAc;QACpC,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,QAAQ;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,CAAC;IAEO,gBAAgB,CAAC,CAAuB,EAAE,CAAuB;QACvE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;CACF,CAAA;AA3EY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,eAAU,EAAC,+BAAe,CAAC;GACf,kBAAkB,CA2E9B"}

package/lib/cjs/util.d.ts

@@ -3,12 +3,31 @@
  *
  * @param role - The role for which grants need to be resolved.
  * @param grants - An object containing all roles and their associated grants.
+ * @param seen - Roles already visited on this branch; guards against cyclic `$extend`.
  * @returns An object representing the combined grants for the given role and its inherited roles.
  *
  * This function resolves the `$extend` property in the grants object to include
  * permissions from inherited roles, merging them into a single object.
+ *
+ * Inherited roles are merged first and the role's own grants last, so the role always wins
+ * on a conflicting action — the same precedence accesscontrol applies when it resolves
+ * `$extend` itself. The result mirrors what `ac.can(role)` answers server-side; it is what
+ * gets shipped to clients that rebuild an ACL from it.
  */
 export declare const _unwindGrants: (role: string, grants: {
     [key: string]: any;
-}) => any;
+}, seen?: Set<string>) => {
+    [key: string]: any;
+};
+/**
+ * Combines already unwound grant sets — eg. one per role of a multi-role user — into a single
+ * map, merging per action for the same reason `_unwindGrants` does.
+ *
+ * @param grants - unwound grant maps; later entries win on a conflicting action
+ */
+export declare const _combineGrants: (...grants: {
+    [key: string]: any;
+}[]) => {
+    [key: string]: any;
+};
 //# sourceMappingURL=util.d.ts.map

package/lib/cjs/util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../src/util.ts"],"names":[],"mappings":"AACA;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,EAAE,QAAQ;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,QAWzE,CAAA"}
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../src/util.ts"],"names":[],"mappings":"AA6BA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,EAAE,QAAQ;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EAAE,OAAM,GAAG,CAAC,MAAM,CAAa;;CAiBxG,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,GAAG,QAAQ;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EAAE;;CAEjE,CAAA"}

package/lib/cjs/util.js

@@ -1,26 +1,67 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports._unwindGrants = void 0;
+exports._combineGrants = exports._unwindGrants = void 0;
+/**
+ * Merges a grants fragment into an accumulator, one resource at a time.
+ *
+ * A plain object spread merges at the RESOURCE level, so a later fragment that names a
+ * resource replaces the whole action map already collected for it. Grants have to merge one
+ * level deeper — per action — otherwise a role that adds `create:any` to a resource an
+ * inherited role also grants loses that action entirely.
+ *
+ * `$extend` is bookkeeping for the caller, not a resource, so it never reaches the output.
+ *
+ * @param base - accumulated grants
+ * @param add - fragment to merge in; its actions win on conflict
+ * @returns a new object, neither argument is mutated
+ */
+const _mergeResourceGrants = (base, add) => {
+    const merged = { ...base };
+    for (const [resource, actions] of Object.entries(add)) {
+        if (resource === '$extend') {
+            continue;
+        }
+        merged[resource] = { ...(merged[resource] ?? {}), ...actions };
+    }
+    return merged;
+};
 /**
  * Recursively unwinds and combines grants for a given role, including inherited roles.
  *
  * @param role - The role for which grants need to be resolved.
  * @param grants - An object containing all roles and their associated grants.
+ * @param seen - Roles already visited on this branch; guards against cyclic `$extend`.
  * @returns An object representing the combined grants for the given role and its inherited roles.
  *
  * This function resolves the `$extend` property in the grants object to include
  * permissions from inherited roles, merging them into a single object.
+ *
+ * Inherited roles are merged first and the role's own grants last, so the role always wins
+ * on a conflicting action — the same precedence accesscontrol applies when it resolves
+ * `$extend` itself. The result mirrors what `ac.can(role)` answers server-side; it is what
+ * gets shipped to clients that rebuild an ACL from it.
  */
-const _unwindGrants = (role, grants) => {
+const _unwindGrants = (role, grants, seen = new Set()) => {
+    // a role reachable twice contributes the same grants both times, so skipping it only
+    // stops the recursion from looping forever on a cyclic $extend
+    if (seen.has(role)) {
+        return {};
+    }
+    seen.add(role);
     const roleGrants = grants[role] || {};
     const inheritedRoles = roleGrants['$extend'] || [];
-    // Combine the current role's grants with inherited roles' grants
-    return inheritedRoles.reduce((acc, inheritedRole) => {
-        return {
-            ...acc,
-            ...(0, exports._unwindGrants)(inheritedRole, grants),
-        };
-    }, roleGrants);
+    const inherited = inheritedRoles.reduce((acc, inheritedRole) => _mergeResourceGrants(acc, (0, exports._unwindGrants)(inheritedRole, grants, seen)), {});
+    return _mergeResourceGrants(inherited, roleGrants);
 };
 exports._unwindGrants = _unwindGrants;
+/**
+ * Combines already unwound grant sets — eg. one per role of a multi-role user — into a single
+ * map, merging per action for the same reason `_unwindGrants` does.
+ *
+ * @param grants - unwound grant maps; later entries win on a conflicting action
+ */
+const _combineGrants = (...grants) => {
+    return grants.reduce((acc, g) => _mergeResourceGrants(acc, g), {});
+};
+exports._combineGrants = _combineGrants;
 //# sourceMappingURL=util.js.map

package/lib/cjs/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../../src/util.ts"],"names":[],"mappings":";;;AACA;;;;;;;;;GASG;AACI,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,MAA8B,EAAE,EAAE;IAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAEnD,iEAAiE;IACjE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,GAAQ,EAAE,aAAkB,EAAE,EAAE;QAC1D,OAAO;YACH,GAAG,GAAG;YACN,GAAG,IAAA,qBAAa,EAAC,aAAa,EAAE,MAAM,CAAC;SAC1C,CAAC;IACN,CAAC,EAAE,UAAU,CAAC,CAAC;AACnB,CAAC,CAAA;AAXY,QAAA,aAAa,iBAWzB"}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../../src/util.ts"],"names":[],"mappings":";;;AACA;;;;;;;;;;;;;GAaG;AACH,MAAM,oBAAoB,GAAG,CAAC,IAA4B,EAAE,GAA2B,EAAE,EAAE;IACvF,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAE3B,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,SAAS;QACb,CAAC;QAED,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACI,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,MAA8B,EAAE,OAAoB,IAAI,GAAG,EAAE,EAAE,EAAE;IACzG,qFAAqF;IACrF,+DAA+D;IAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEf,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAEnD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CACnC,CAAC,GAAQ,EAAE,aAAkB,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,IAAA,qBAAa,EAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EACvG,EAAE,CACL,CAAC;IAEF,OAAO,oBAAoB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AACvD,CAAC,CAAA;AAjBY,QAAA,aAAa,iBAiBzB;AAED;;;;;GAKG;AACI,MAAM,cAAc,GAAG,CAAC,GAAG,MAAgC,EAAE,EAAE;IAClE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC,CAAA;AAFY,QAAA,cAAc,kBAE1B"}