@spinajs/rbac 2.0.485 → 2.0.487

package/lib/mjs/actions.d.ts

@@ -104,6 +104,22 @@ export declare function _user(identifier: number | string | User): () => Promise
  * @returns
  */
 export declare function _user_unsafe(identifier: number | string | User): () => Promise<User>;
+/**
+ * Destroys every session belonging to a user, on every device.
+ *
+ * Called from each action that invalidates what a live session was granted on:
+ * a password change or reset ( the credential behind the session is gone ), a
+ * ban or a deactivation ( the account may no longer act at all ). Without this
+ * an attacker who is already inside keeps their session while the victim
+ * changes the password that was supposed to lock them out.
+ *
+ * Errors are NOT swallowed: a session store that cannot be reached means the
+ * revocation did not happen, and the caller must learn that rather than be told
+ * the account is secure.
+ *
+ * @param user - the user whose sessions are destroyed, or their numeric id
+ */
+export declare function revokeUserSessions(user: User | number): Promise<void>;
 /**
  * ===============================================
  * USER ACTIONS
@@ -159,11 +175,11 @@ export declare function deleteUser(identifier: number | string | User): Promise<
  * Grants an additional role to a user.
  * The role is added only if not already present. Emits a {@link UserRoleGranted} event.
  *
- * @param identifier - numeric id or uuid / email / login string
+ * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  * @param role - role name to grant
  * @returns the updated {@link User}
  */
-export declare function grant(identifier: number | string, role: string): Promise<User>;
+export declare function grant(identifier: number | string | User, role: string): Promise<User>;
 /**
  * Revokes a role from a user.
  * Removes the role from the user's role list and emits a {@link UserRoleRevoked} event.

package/lib/mjs/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAKA,OAAO,EAAwB,IAAI,EAAY,MAAM,kBAAkB,CAAC;AAGxE,OAAO,EAAE,WAAW,EAAM,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AASlD,oBAAY,OAAO;IACjB,eAAe,IAAA;IAEf,eAAe,IAAA;IAEf,qCAAqC,IAAA;IAErC,gBAAgB,IAAA;IAEhB,qBAAqB,IAAA;IAErB,iBAAiB,IAAA;IAEjB,aAAa,IAAA;IAEb,oBAAoB,IAAA;IAEpB,wBAAwB,IAAA;IAExB,sBAAsB,IAAA;IAEtB,mBAAmB,KAAA;IAEnB,YAAY,KAAA;CACb;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAgB,gBAAgB,qBAiB/B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,yGAEhD;AAID;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,uBAWrD;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAG,CAAA;CAAE,EAAE,EAAE,KAAK,GAAE,GAAU,IAC9E,GAAG,IAAI,mBAoBtB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,IAC1B,GAAG,IAAI,kBAMtB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,oBAAoB,GAAG,iBAAiB,IAO9K,GAAG,IAAI,mBAmBtB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IACtD,GAAG,IAAI,mBAItB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,IACjC,GAAG,IAAI,mBAItB;AAED;;;;;;;GAOG;AACH,wBAAgB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAEhE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAiBjE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDvL;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlF;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASpF;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5F;AAED;;;;;;;;GAQG;AACH,wBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB/G;AAED;;;;;;GAMG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB7E;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAY7E;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,oBA4BhH;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAmB3E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,IAG9B,GAAG,IAAI,KAAG,OAAO,CAAC,OAAO,CAAC,CAQzC;AAED;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB/F"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAKA,OAAO,EAAwB,IAAI,EAAY,MAAM,kBAAkB,CAAC;AAGxE,OAAO,EAAE,WAAW,EAAM,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAUlD,oBAAY,OAAO;IACjB,eAAe,IAAA;IAEf,eAAe,IAAA;IAEf,qCAAqC,IAAA;IAErC,gBAAgB,IAAA;IAEhB,qBAAqB,IAAA;IAErB,iBAAiB,IAAA;IAEjB,aAAa,IAAA;IAEb,oBAAoB,IAAA;IAEpB,wBAAwB,IAAA;IAExB,sBAAsB,IAAA;IAEtB,mBAAmB,KAAA;IAEnB,YAAY,KAAA;CACb;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAgB,gBAAgB,qBAW/B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,yGAEhD;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,uBAUrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAG,CAAA;CAAE,EAAE,EAAE,KAAK,GAAE,GAAU,IAC9E,GAAG,IAAI,mBAoBtB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,IAC1B,GAAG,IAAI,kBAMtB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,oBAAoB,GAAG,iBAAiB,IAO9K,GAAG,IAAI,mBAmBtB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IACtD,GAAG,IAAI,mBAItB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,IACjC,GAAG,IAAI,mBAItB;AAED;;;;;;;GAOG;AACH,wBAAgB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3E;AAYD;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAEhE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAiBjE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAuDvL;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAelF;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5F;AAED;;;;;;;;GAQG;AACH,wBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B/G;AAED;;;;;;GAMG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB7E;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAY7E;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,oBAqDhH;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAuC3E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,IAG9B,GAAG,IAAI,KAAG,OAAO,CAAC,OAAO,CAAC,CAQzC;AAED;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC/F"}

package/lib/mjs/actions.js

@@ -8,9 +8,10 @@ import { _cfg, _service } from '@spinajs/configuration';
 import { UserActivated, UserBanned, UserChanged, UserCreated, UserDeactivated, UserDeleted, UserLogged, UserPasswordChangeRequest, UserPasswordChanged, UserRoleGranted, UserRoleRevoked, UserUnbanned } from './events/index.js';
 import { DI } from '@spinajs/di';
 import { Configuration } from '@spinajs/configuration';
-import { AuthProvider, PasswordProvider, PasswordValidationProvider } from './interfaces.js';
+import { AthenticationErrorCodes, AuthProvider, PasswordProvider, PasswordValidationProvider, SessionProvider } from './interfaces.js';
 import { DateTime } from 'luxon';
 import { ErrorCode } from '@spinajs/exceptions';
+import { createHash, timingSafeEqual } from 'crypto';
 import { v4 as uuidv4 } from 'uuid';
 import { UserLoginFailed } from './events/UserLoginFailed.js';
 import { UserMetadataChange } from './events/UserMetadataChange.js';
@@ -46,9 +47,7 @@ export function _get_system_user() {
         const s = _check_arg(_trim(), _non_empty())(systemRole, 'rbac.systemRole');
         const c = _check_arg(_trim(), _non_empty())(roleColumn, 'rbac.roleColumn');
         return [s, c];
-    }, ([systemRole, roleColumn]) => User.query()
-        .where(roleColumn, systemRole)
-        .firstOrFail());
+    }, ([systemRole, roleColumn]) => User.query().where(roleColumn, systemRole).firstOrFail());
 }
 /**
  *
@@ -190,7 +189,39 @@ export function _user_unsafe(identifier) {
     if (id instanceof UserBase) {
         return () => Promise.resolve(id);
     }
-    return () => UserBase.query().whereAnything(id).populate("Metadata").firstOrFail();
+    return () => UserBase.query().whereAnything(id).populate('Metadata').firstOrFail();
+}
+/**
+ * Destroys every session belonging to a user, on every device.
+ *
+ * Called from each action that invalidates what a live session was granted on:
+ * a password change or reset ( the credential behind the session is gone ), a
+ * ban or a deactivation ( the account may no longer act at all ). Without this
+ * an attacker who is already inside keeps their session while the victim
+ * changes the password that was supposed to lock them out.
+ *
+ * Errors are NOT swallowed: a session store that cannot be reached means the
+ * revocation did not happen, and the caller must learn that rather than be told
+ * the account is secure.
+ *
+ * @param user - the user whose sessions are destroyed, or their numeric id
+ */
+export async function revokeUserSessions(user) {
+    const userId = _.isNumber(user) ? user : user?.Id;
+    if (!userId) {
+        return;
+    }
+    const provider = await _service('rbac.session', SessionProvider)();
+    await provider.deleteByUser(userId);
+}
+/**
+ * Chain step form of {@link revokeUserSessions} — revokes and forwards the user.
+ */
+function _revoke_sessions() {
+    return async (u) => {
+        await revokeUserSessions(u);
+        return u;
+    };
 }
 /**
  * ===============================================
@@ -213,7 +244,9 @@ export async function activate(identifier) {
  * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  */
 export async function deactivate(identifier) {
-    return _chain(_user(identifier), _user_update({ IsActive: false }), _user_ev(UserDeactivated), _user_email('deactivated'));
+    // Sessions go with the account: a deactivated user must stop acting NOW, not
+    // whenever their session happens to expire.
+    return _chain(_user(identifier), _user_update({ IsActive: false }), _revoke_sessions(), _user_ev(UserDeactivated), _user_email('deactivated'));
 }
 /**
  * Reads a create-middleware list from configuration.
@@ -285,13 +318,19 @@ export async function create(email, login, password, roles, id, metadata) {
  * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  */
 export async function deleteUser(identifier) {
-    return _chain(_user(identifier), _tap((u) => u.destroy()), _user_ev(UserDeleted), _user_email('deleted'));
+    return _chain(_user(identifier), _tap((u) => u.destroy()), 
+    // Same reason a deactivation revokes: the account may no longer act. A live
+    // session outlasting the deletion is worse here than there — the session
+    // middleware resolves its user through `isActiveUser()`, which no longer
+    // matches a soft-deleted row, so every request from that session dies in
+    // the middleware instead of being cleanly logged out.
+    _revoke_sessions(), _user_ev(UserDeleted), _user_email('deleted'));
 }
 /**
  * Grants an additional role to a user.
  * The role is added only if not already present. Emits a {@link UserRoleGranted} event.
  *
- * @param identifier - numeric id or uuid / email / login string
+ * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  * @param role - role name to grant
  * @returns the updated {@link User}
  */
@@ -333,7 +372,11 @@ export async function ban(identifier, reason, duration) {
         { key: USER_COMMON_METADATA.USER_BAN_REASON, value: reason },
         { key: USER_COMMON_METADATA.USER_BAN_IS_BANNED, value: true },
         { key: USER_COMMON_METADATA.USER_BAN_START_DATE, value: DateTime.now() },
-    ]), _user_ev(UserBanned), _user_email('banned'));
+    ]), 
+    // A ban that leaves the banned user's session alive bans nothing until that
+    // session expires — `isActiveUser` does not filter on the ban flag, so the
+    // session would keep resolving happily.
+    _revoke_sessions(), _user_ev(UserBanned), _user_email('banned'));
 }
 /**
  *
@@ -383,7 +426,19 @@ export async function passwordChangeRequest(identifier) {
  * @param token - the reset token that was issued by {@link passwordChangeRequest}
  */
 export async function confirmPasswordReset(identifier, newPassword, token) {
-    return _chain(_user(identifier), _tap((u) => _chain(u, _zip(_get_user_meta(USER_COMMON_METADATA.USER_PWD_RESET_START_DATE), _get_user_meta(USER_COMMON_METADATA.USER_PWD_RESET_WAIT_TIME)), ([dueDate, waitTime]) => {
+    return _chain(_user(identifier), 
+    // A reset must not resurrect an account that is banned, deactivated or
+    // deleted — otherwise the reset flow is a way around every one of those
+    // states. Same ErrorCode family the caller already collapses into one
+    // opaque failure, so this does not become an account-state oracle.
+    _tap(async (u) => {
+        if (u.Metadata[USER_COMMON_METADATA.USER_BAN_IS_BANNED]) {
+            throw new ErrorCode(E_CODES.E_USER_BANNED, `Password reset refused: user is banned`, { user: u });
+        }
+        if (!u.IsActive || u.DeletedAt) {
+            throw new ErrorCode(E_CODES.E_USER_NOT_ACTIVE, `Password reset refused: user is not active`, { user: u });
+        }
+    }), _tap((u) => _chain(u, _zip(_get_user_meta(USER_COMMON_METADATA.USER_PWD_RESET_START_DATE), _get_user_meta(USER_COMMON_METADATA.USER_PWD_RESET_WAIT_TIME)), ([dueDate, waitTime]) => {
         if (dueDate.plus({ seconds: waitTime }) < DateTime.now()) {
             throw new ErrorCode(E_CODES.E_TOKEN_EXPIRED, `Password change token expired, token expiration date is: ${dueDate.toISO()}`, {
                 dueDate,
@@ -393,14 +448,44 @@ export async function confirmPasswordReset(identifier, newPassword, token) {
             });
         }
     })), _tap((u) => _chain(u, _get_user_meta(USER_COMMON_METADATA.USER_PWD_RESET_TOKEN), async (resetToken) => {
-        if (resetToken !== token) {
+        if (!_secure_compare(String(resetToken), token)) {
             throw new ErrorCode(E_CODES.E_TOKEN_INVALID, `Password change token invalid, operation not permitted`, {
                 token,
                 resetToken,
                 user: u,
             });
         }
-    })), changePassword(newPassword));
+    })), changePassword(newPassword), 
+    // Burn the token. Validating it and leaving it in place made it a
+    // multi-use credential for the whole `passwordResetWaitTime` window:
+    // anyone who saw the reset mail once could keep re-taking the account.
+    _tap(async (u) => {
+        await u.Metadata.delete(USER_COMMON_METADATA.USER_PWD_RESET_TOKEN);
+        await u.Metadata.delete(USER_COMMON_METADATA.USER_PWD_RESET_START_DATE);
+        await u.Metadata.delete(USER_COMMON_METADATA.USER_PWD_RESET_WAIT_TIME);
+        await u.Metadata.delete(USER_COMMON_METADATA.USER_PWD_RESET);
+    }));
+}
+/**
+ * Length-independent, constant-time string comparison for secrets.
+ *
+ * `!==` on a token leaks how many leading characters matched through timing.
+ * The margin is small over a network and the tokens are uuid-shaped, but a
+ * comparison of a secret is the wrong place to rely on that.
+ *
+ * @param a - value read from storage
+ * @param b - value supplied by the caller
+ */
+function _secure_compare(a, b) {
+    const ha = createHash('sha256')
+        .update(a ?? '')
+        .digest();
+    const hb = createHash('sha256')
+        .update(b ?? '')
+        .digest();
+    // hashing first makes both operands the same length, which timingSafeEqual
+    // requires and which also stops the length itself from leaking
+    return timingSafeEqual(ha, hb);
 }
 /**
  * Returns a function that changes a user's password.
@@ -420,7 +505,18 @@ export function changePassword(password) {
             }
         }), 
         // update password
-        ({ pwd }) => pwd.hash(password), (hPassword) => _chain(u, _update({ Password: hPassword }), _set_user_meta(USER_COMMON_METADATA.USER_PWD_RESET_LAST_ATTEMPT, DateTime.now().toISO()), _user_ev(UserPasswordChanged)));
+        ({ pwd }) => pwd.hash(password), (hPassword) => _chain(u, _update({ Password: hPassword }), _set_user_meta([
+            { key: USER_COMMON_METADATA.USER_PWD_RESET_LAST_ATTEMPT, value: DateTime.now().toISO() },
+            // a successful password change clears the login throttle: the
+            // credential the failures were counted against no longer exists
+            { key: USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS, value: 0 },
+            { key: USER_COMMON_METADATA.USER_LOGIN_LOCKED_UNTIL, value: null },
+        ]), 
+        // Every session was authorized by the OLD password. Whoever holds one
+        // — including whoever the user is changing the password because of —
+        // loses it here. Callers that want the acting user to stay logged in
+        // ( eg. PATCH /user/password ) mint a fresh session afterwards.
+        _revoke_sessions(), _user_ev(UserPasswordChanged)));
     };
 }
 /**
@@ -463,9 +559,17 @@ export function passwordMatch(password) {
 export async function login(identifier, password) {
     password = _check_arg(_trim(), _non_empty())(password, 'password');
     return await _chain(_user_unsafe(identifier), _catch((u) => {
-        return _chain(_service('rbac.auth', AuthProvider), async (sAuth) => sAuth.authenticate(u.Email, password), _update({ LastLoginAt: DateTime.now() }), _user_ev(UserLogged));
+        return _chain(async () => {
+            // Refuse before the password is even checked, so a locked account
+            // cannot be probed at all during the lockout window.
+            await _assert_not_locked(u);
+            return _service('rbac.auth', AuthProvider)();
+        }, async (sAuth) => sAuth.authenticate(u.Email, password), _update({ LastLoginAt: DateTime.now() }), _clear_login_throttle(), _user_ev(UserLogged));
     }, (err, u) => {
         return _chain(() => u, 
+        // count the failure and lock the account once the configured
+        // threshold is reached
+        _register_failed_login(err), 
         // send event of failed login
         _user_ev(UserLoginFailed, err), 
         // rethrow error for caller
@@ -474,4 +578,79 @@ export async function login(identifier, password) {
         });
     }));
 }
+/**
+ * Throws when the account is inside a lockout window opened by
+ * {@link _register_failed_login}.
+ *
+ * @param u - user attempting to authenticate
+ */
+async function _assert_not_locked(u) {
+    const raw = u?.Metadata?.[USER_COMMON_METADATA.USER_LOGIN_LOCKED_UNTIL];
+    if (!raw) {
+        return;
+    }
+    const lockedUntil = raw instanceof DateTime ? raw : DateTime.fromISO(String(raw));
+    if (lockedUntil.isValid && lockedUntil > DateTime.now()) {
+        throw new ErrorCode(AthenticationErrorCodes.E_LOGIN_ATTEMPTS_EXCEEDED, `Too many failed login attempts, account is temporarily locked until ${lockedUntil.toISO()}`, {
+            user: u,
+            lockedUntil,
+        });
+    }
+}
+/**
+ * Clears the failure counter and any expired lock after a successful login.
+ */
+function _clear_login_throttle() {
+    return async (u) => {
+        const meta = u?.Metadata;
+        if (!meta) {
+            return u;
+        }
+        const hasAttempts = Number(meta[USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS] ?? 0) > 0;
+        const hasLock = Boolean(meta[USER_COMMON_METADATA.USER_LOGIN_LOCKED_UNTIL]);
+        if (!hasAttempts && !hasLock) {
+            return u;
+        }
+        await meta.delete(USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS);
+        await meta.delete(USER_COMMON_METADATA.USER_LOGIN_LOCKED_UNTIL);
+        return u;
+    };
+}
+/**
+ * Records one failed authentication and, at `rbac.password.blockAfterAttempts`
+ * consecutive failures, locks the account for `rbac.password.lockoutTime`
+ * seconds.
+ *
+ * `blockAfterAttempts <= 0` disables throttling entirely. A rejection that was
+ * itself the lockout is not counted — otherwise hammering a locked account
+ * would keep extending the lock indefinitely.
+ *
+ * @param err - the error that ended the login attempt
+ */
+function _register_failed_login(err) {
+    return async (u) => {
+        const meta = u?.Metadata;
+        if (!meta) {
+            return u;
+        }
+        if (err instanceof ErrorCode && err.code === AthenticationErrorCodes.E_LOGIN_ATTEMPTS_EXCEEDED) {
+            return u;
+        }
+        const blockAfter = await _cfg('rbac.password.blockAfterAttempts', 5)();
+        const lockoutTime = await _cfg('rbac.password.lockoutTime', 15 * 60)();
+        if (!blockAfter || blockAfter <= 0) {
+            return u;
+        }
+        const attempts = Number(meta[USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS] ?? 0) + 1;
+        if (attempts >= blockAfter) {
+            meta[USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS] = 0;
+            meta[USER_COMMON_METADATA.USER_LOGIN_LOCKED_UNTIL] = DateTime.now().plus({ seconds: lockoutTime }).toISO();
+        }
+        else {
+            meta[USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS] = attempts;
+        }
+        await meta.update();
+        return u;
+    };
+}
 //# sourceMappingURL=actions.js.map

package/lib/mjs/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAO,UAAU,EAAW,QAAQ,EAAY,WAAW,EAA0B,SAAS,EAAE,MAAM,eAAe,CAAC;AAC7O,OAAO,CAAC,MAAM,QAAQ,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAClO,OAAO,EAAe,EAAE,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,MAAM,CAAN,IAAY,OAwBX;AAxBD,WAAY,OAAO;IACjB,2DAAe,CAAA;IAEf,2DAAe,CAAA;IAEf,uGAAqC,CAAA;IAErC,6DAAgB,CAAA;IAEhB,uEAAqB,CAAA;IAErB,+DAAiB,CAAA;IAEjB,uDAAa,CAAA;IAEb,qEAAoB,CAAA;IAEpB,6EAAwB,CAAA;IAExB,yEAAsB,CAAA;IAEtB,oEAAmB,CAAA;IAEnB,sDAAY,CAAA;AACd,CAAC,EAxBW,OAAO,KAAP,OAAO,QAwBlB;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,MAAM,CACX,IAAI,CACF,IAAI,CAAS,iBAAiB,CAAC,EAC/B,IAAI,CAAS,iBAAiB,CAAC,CAChC,EACD,CAAC,CAAC,UAAU,EAAE,UAAU,CAAmB,EAAE,EAAE;QAC7C,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAE3E,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACf,CAAC,EACD,CAAC,CAAC,UAAU,EAAE,UAAU,CAAmB,EAAE,EAAE,CAC7C,IAAI,CAAC,KAAK,EAAE;SACT,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC;SAC7B,WAAW,EAAE,CACnB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAC/C,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAID;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAA4B;IAEpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAID;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAA4C,EAAE,QAAa,IAAI;IAC5F,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAE5J,KAAK,CAAC,OAAO,CAAC,CAAC,CAAuC,EAAE,EAAE;YACxD,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,CAAC,EAED,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAC/B,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;YAChC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAuC,EAAE,EAAE;gBAC3D,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,UAAU,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5I,UAAU,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,iCAAiC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;QAE3J,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,WAAkK;IAO5L,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,OAAO,MAAM,CAAO,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,WAAW,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAA2C,EAAE,EAAE;YAC3M,UAAU,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,kBAAkB,WAAW,6CAA6C,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACnK,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAC5F,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAE1F,OAAO,CACL,QAAQ,CAAC,OAAO;gBAChB,eAAe,CAAC;oBACd,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;oBACb,UAAU;oBACV,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;oBACjB,GAAG,EAAE,aAAa,WAAW,EAAE;oBAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,KAA6B,EAAE,GAAG,IAAW;IACpE,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAoB;IAC/C,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,MAAM,CAAC,CAAC,EAAE,OAAO,CAAO,IAAI,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,KAAK,CAAC,UAAkC;IACtD,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAErE,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;QACvB,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkC;IAC7D,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAErE,IAAI,EAAE,YAAY,QAAQ,EAAE,CAAC;QAC3B,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;AACrF,CAAC;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAAkC;IAC/D,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACxH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkC;IACjE,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;AAC7H,CAAC;AAOD;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,CAAqB,IAAI,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,KAAa,EAAE,QAAgB,EAAE,KAAe,EAAE,EAAW,EAAE,QAAiC;IAC1I,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAmB,eAAe,EAAE,gBAAgB,CAAC,EAAE,CAAC;IAExF,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxF,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3E,QAAQ,GAAG,UAAU,CACnB,KAAK,EAAE,EACP,QAAQ,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CACrC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAExB,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEjD,OAAO,MAAM;IACX,cAAc;IACd,GAAG,EAAE,CACH,OAAO,CAAC,OAAO,CACb,IAAI,IAAI,CAAC;QACP,EAAE,EAAE,EAAE;QACN,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,KAAK;QACX,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE;QAC5B,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE;QACzB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,MAAM,EAAE;KACf,CAAC,CACH;IAEH,+BAA+B;IAC/B,CAAC,CAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;IAEjF,eAAe;IACf,OAAO,EAAE,EAET,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,KAAK,SAAS,EAClC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAChG,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAEvB,8BAA8B;IAC9B,CAAC,CAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;IAEhF,aAAa;IACb,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAE9C,aAAa;IACb,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAE5B,4EAA4E;IAC5E,CAAC,CAAO,EAAE,EAAE;QACV,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkC;IACjE,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAC9B,QAAQ,CAAC,WAAW,CAAC,EACrB,WAAW,CAAC,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,UAA2B,EAAE,IAAY;IACnE,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAC7D,YAAY,EAAE,EACd,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,UAAkC,EAAE,IAAY;IAC3E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EACpE,YAAY,EAAE,EACd,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,UAAkC,EAAE,MAAe,EAAE,QAAiB;IAC9F,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxF,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE/E,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC,EACjB,CAAC,CAAO,EAAE,EAAE;QACV,IAAI,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,CAAC,CAAC;IACX,CAAC,EACD,cAAc,CAAC;QACb,EAAE,GAAG,EAAE,oBAAoB,CAAC,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE;QAChE,EAAE,GAAG,EAAE,oBAAoB,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;QAC5D,EAAE,GAAG,EAAE,oBAAoB,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE;QAC7D,EAAE,GAAG,EAAE,oBAAoB,CAAC,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE;KACzE,CAAC,EACF,QAAQ,CAAC,UAAU,CAAC,EACpB,WAAW,CAAC,QAAQ,CAAC,CACtB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,UAAkC;IAC5D,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC;IAEjB,yEAAyE;IACzE,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC;IAEF,uEAAuE;IACvE,2EAA2E;IAC3E,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QAChE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC,CAAC,EAEF,QAAQ,CAAC,YAAY,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAkC;IAC5E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAS,qCAAqC,CAAC,EAAE,CAAC;IAEhF,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC,EACjB,cAAc,CAAC;QACb,EAAE,GAAG,EAAE,oBAAoB,CAAC,yBAAyB,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE;QAC9E,EAAE,GAAG,EAAE,oBAAoB,CAAC,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACnE,EAAE,GAAG,EAAE,oBAAoB,CAAC,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE;KAC3E,CAAC,EACF,QAAQ,CAAC,yBAAyB,CAAC,CACpC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAAkC,EAAE,WAAmB,EAAE,KAAa;IAC/G,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CACf,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,EAAE,cAAc,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAqB,EAAE,EAAE;QACzL,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,4DAA4D,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE;gBAC1H,OAAO;gBACP,QAAQ;gBACR,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE;gBACpB,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,EACD,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CACf,MAAM,CAAC,CAAC,EAAE,cAAc,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,UAAkB,EAAE,EAAE;QAChG,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,wDAAwD,EAAE;gBACrG,KAAK;gBACL,UAAU;gBACV,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,EACD,cAAc,CAAC,WAAW,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,OAAO,MAAM,CACX,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC,EACxD,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,0BAA0B,CAAC,EAAE,WAAW,CAAC,EAEnF,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,EAA6C,EAAE,EAAE;YACtE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC;QAEF,kBAAkB;QAClB,CAAC,EAAE,GAAG,EAA6B,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC1D,CAAC,SAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,cAAc,CAAC,oBAAoB,CAAC,2BAA2B,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAClM,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkC;IACrE,OAAO,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,KAAK,EAAE,CAAO,EAAoB,EAAE;QACzC,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE,mBAAmB;QACnB,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxI,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,UAAkC,EAAE,QAAgB;IAC9E,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,MAAM,MAAM,CACjB,YAAY,CAAC,UAAU,CAAC,EACxB,MAAM,CACJ,CAAC,CAAO,EAAE,EAAE;QACV,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,KAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACjM,CAAC,EACD,CAAC,GAAG,EAAE,CAAO,EAAE,EAAE;QACf,OAAO,MAAM,CACX,GAAG,EAAE,CAAC,CAAC;QAEP,6BAA6B;QAC7B,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC;QAE9B,2BAA2B;QAC3B,GAAG,EAAE;YACH,MAAM,GAAG,CAAC;QACZ,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAO,UAAU,EAAW,QAAQ,EAAY,WAAW,EAA0B,SAAS,EAAE,MAAM,eAAe,CAAC;AAC7O,OAAO,CAAC,MAAM,QAAQ,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAClO,OAAO,EAAe,EAAE,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvI,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,MAAM,CAAN,IAAY,OAwBX;AAxBD,WAAY,OAAO;IACjB,2DAAe,CAAA;IAEf,2DAAe,CAAA;IAEf,uGAAqC,CAAA;IAErC,6DAAgB,CAAA;IAEhB,uEAAqB,CAAA;IAErB,+DAAiB,CAAA;IAEjB,uDAAa,CAAA;IAEb,qEAAoB,CAAA;IAEpB,6EAAwB,CAAA;IAExB,yEAAsB,CAAA;IAEtB,oEAAmB,CAAA;IAEnB,sDAAY,CAAA;AACd,CAAC,EAxBW,OAAO,KAAP,OAAO,QAwBlB;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,MAAM,CACX,IAAI,CAAC,IAAI,CAAS,iBAAiB,CAAC,EAAE,IAAI,CAAS,iBAAiB,CAAC,CAAC,EACtE,CAAC,CAAC,UAAU,EAAE,UAAU,CAAmB,EAAE,EAAE;QAC7C,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAE3E,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChB,CAAC,EACD,CAAC,CAAC,UAAU,EAAE,UAAU,CAAmB,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CACzG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAC/C,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAA4B;IACpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAA4C,EAAE,QAAa,IAAI;IAC5F,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAE5J,KAAK,CAAC,OAAO,CAAC,CAAC,CAAuC,EAAE,EAAE;YACxD,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,CAAC,EAED,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAC/B,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;YAChC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAuC,EAAE,EAAE;gBAC3D,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,UAAU,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5I,UAAU,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,iCAAiC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;QAE3J,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,WAAkK;IAO5L,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,OAAO,MAAM,CAAO,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,WAAW,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAA2C,EAAE,EAAE;YAC3M,UAAU,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,kBAAkB,WAAW,6CAA6C,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACnK,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAC5F,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAE1F,OAAO,CACL,QAAQ,CAAC,OAAO;gBAChB,eAAe,CAAC;oBACd,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;oBACb,UAAU;oBACV,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;oBACjB,GAAG,EAAE,aAAa,WAAW,EAAE;oBAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,KAA6B,EAAE,GAAG,IAAW;IACpE,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAoB;IAC/C,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,MAAM,CAAC,CAAC,EAAE,OAAO,CAAO,IAAI,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,KAAK,CAAC,UAAkC;IACtD,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAErE,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;QACvB,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkC;IAC7D,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAErE,IAAI,EAAE,YAAY,QAAQ,EAAE,CAAC;QAC3B,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAmB;IAC1D,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAElD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;IACnE,MAAM,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB;IACvB,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAAkC;IAC/D,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACxH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkC;IACjE,6EAA6E;IAC7E,4CAA4C;IAC5C,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;AACjJ,CAAC;AAOD;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,CAAqB,IAAI,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,KAAa,EAAE,QAAgB,EAAE,KAAe,EAAE,EAAW,EAAE,QAAiC;IAC1I,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAmB,eAAe,EAAE,gBAAgB,CAAC,EAAE,CAAC;IAExF,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxF,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3E,QAAQ,GAAG,UAAU,CACnB,KAAK,EAAE,EACP,QAAQ,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CACrC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAExB,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEjD,OAAO,MAAM;IACX,cAAc;IACd,GAAG,EAAE,CACH,OAAO,CAAC,OAAO,CACb,IAAI,IAAI,CAAC;QACP,EAAE,EAAE,EAAE;QACN,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,KAAK;QACX,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE;QAC5B,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE;QACzB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,MAAM,EAAE;KACf,CAAC,CACH;IAEH,+BAA+B;IAC/B,CAAC,CAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;IAEjF,eAAe;IACf,OAAO,EAAE,EAET,OAAO,CACL,GAAG,EAAE,CAAC,QAAQ,KAAK,SAAS,EAC5B,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAChG,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,CAAC,CACrB;IAED,8BAA8B;IAC9B,CAAC,CAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;IAEhF,aAAa;IACb,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAE9C,aAAa;IACb,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAE5B,4EAA4E;IAC5E,CAAC,CAAO,EAAE,EAAE;QACV,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkC;IACjE,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAE9B,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,sDAAsD;IACtD,gBAAgB,EAAE,EAElB,QAAQ,CAAC,WAAW,CAAC,EACrB,WAAW,CAAC,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,UAAkC,EAAE,IAAY;IAC1E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAC7D,YAAY,EAAE,EACd,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,UAAkC,EAAE,IAAY;IAC3E,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EACpE,YAAY,EAAE,EACd,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,UAAkC,EAAE,MAAe,EAAE,QAAiB;IAC9F,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxF,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE/E,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC,EACjB,CAAC,CAAO,EAAE,EAAE;QACV,IAAI,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,CAAC,CAAC;IACX,CAAC,EACD,cAAc,CAAC;QACb,EAAE,GAAG,EAAE,oBAAoB,CAAC,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE;QAChE,EAAE,GAAG,EAAE,oBAAoB,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;QAC5D,EAAE,GAAG,EAAE,oBAAoB,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE;QAC7D,EAAE,GAAG,EAAE,oBAAoB,CAAC,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE;KACzE,CAAC;IAEF,4EAA4E;IAC5E,2EAA2E;IAC3E,wCAAwC;IACxC,gBAAgB,EAAE,EAElB,QAAQ,CAAC,UAAU,CAAC,EACpB,WAAW,CAAC,QAAQ,CAAC,CACtB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,UAAkC;IAC5D,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC;IAEjB,yEAAyE;IACzE,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC;IAEF,uEAAuE;IACvE,2EAA2E;IAC3E,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QAChE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC,CAAC,EAEF,QAAQ,CAAC,YAAY,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAkC;IAC5E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAS,qCAAqC,CAAC,EAAE,CAAC;IAEhF,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC,EACjB,cAAc,CAAC;QACb,EAAE,GAAG,EAAE,oBAAoB,CAAC,yBAAyB,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE;QAC9E,EAAE,GAAG,EAAE,oBAAoB,CAAC,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACnE,EAAE,GAAG,EAAE,oBAAoB,CAAC,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE;KAC3E,CAAC,EACF,QAAQ,CAAC,yBAAyB,CAAC,CACpC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAAkC,EAAE,WAAmB,EAAE,KAAa;IAC/G,OAAO,MAAM,CACX,KAAK,CAAC,UAAU,CAAC;IAEjB,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,mEAAmE;IACnE,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,wCAAwC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,4CAA4C,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC,CAAC,EAEF,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CACf,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,EAAE,cAAc,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAqB,EAAE,EAAE;QACzL,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,4DAA4D,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE;gBAC1H,OAAO;gBACP,QAAQ;gBACR,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE;gBACpB,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,EACD,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CACf,MAAM,CAAC,CAAC,EAAE,cAAc,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,UAAkB,EAAE,EAAE;QAChG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,wDAAwD,EAAE;gBACrG,KAAK;gBACL,UAAU;gBACV,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,EACD,cAAc,CAAC,WAAW,CAAC;IAE3B,kEAAkE;IAClE,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,CAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;QACnE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;QACvE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAC/D,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;SACf,MAAM,EAAE,CAAC;IACZ,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;SACf,MAAM,EAAE,CAAC;IAEZ,2EAA2E;IAC3E,+DAA+D;IAC/D,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,OAAO,MAAM,CACX,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC,EACxD,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,0BAA0B,CAAC,EAAE,WAAW,CAAC,EAEnF,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,EAA6C,EAAE,EAAE;YACtE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC;QAEF,kBAAkB;QAClB,CAAC,EAAE,GAAG,EAA6B,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC1D,CAAC,SAAiB,EAAE,EAAE,CACpB,MAAM,CACJ,CAAC,EACD,OAAO,CAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EACtC,cAAc,CAAC;YACb,EAAE,GAAG,EAAE,oBAAoB,CAAC,2BAA2B,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;YAExF,8DAA8D;YAC9D,gEAAgE;YAChE,EAAE,GAAG,EAAE,oBAAoB,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE;YAC3D,EAAE,GAAG,EAAE,oBAAoB,CAAC,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE;SACnE,CAAC;QAEF,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,gEAAgE;QAChE,gBAAgB,EAAE,EAElB,QAAQ,CAAC,mBAAmB,CAAC,CAC9B,CACJ,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkC;IACrE,OAAO,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,KAAK,EAAE,CAAO,EAAoB,EAAE;QACzC,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE,mBAAmB;QACnB,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxI,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,UAAkC,EAAE,QAAgB;IAC9E,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,MAAM,MAAM,CACjB,YAAY,CAAC,UAAU,CAAC,EACxB,MAAM,CACJ,CAAC,CAAO,EAAE,EAAE;QACV,OAAO,MAAM,CACX,KAAK,IAAI,EAAE;YACT,kEAAkE;YAClE,qDAAqD;YACrD,MAAM,kBAAkB,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/C,CAAC,EACD,KAAK,EAAE,KAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EACpE,OAAO,CAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,EAC9C,qBAAqB,EAAE,EACvB,QAAQ,CAAC,UAAU,CAAC,CACrB,CAAC;IACJ,CAAC,EACD,CAAC,GAAG,EAAE,CAAO,EAAE,EAAE;QACf,OAAO,MAAM,CACX,GAAG,EAAE,CAAC,CAAC;QAEP,6DAA6D;QAC7D,uBAAuB;QACvB,sBAAsB,CAAC,GAAG,CAAC;QAE3B,6BAA6B;QAC7B,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC;QAE9B,2BAA2B;QAC3B,GAAG,EAAE;YACH,MAAM,GAAG,CAAC;QACZ,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAAC,CAAO;IACvC,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;IAExE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAElF,IAAI,WAAW,CAAC,OAAO,IAAI,WAAW,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,yBAAyB,EAAE,uEAAuE,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE;YACnK,IAAI,EAAE,CAAC;YACP,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB;IAC5B,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,EAAE,QAAQ,CAAC;QAEzB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAE5E,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;QAEhE,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAAC,GAAY;IAC1C,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,EAAE,QAAQ,CAAC;QAEzB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,GAAG,YAAY,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,uBAAuB,CAAC,yBAAyB,EAAE,CAAC;YAC/F,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAS,kCAAkC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAS,2BAA2B,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAE/E,IAAI,CAAC,UAAU,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAEjF,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAC7G,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,GAAG,QAAQ,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAEpB,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC"}

package/lib/mjs/config/rbac.d.ts

@@ -178,6 +178,15 @@ declare const rbac: {
              * How long we should wait to reset password ( after this time reset token is invalid )
              */
             passwordResetWaitTime: number;
+            /**
+             * Consecutive failed logins that lock the account. 0 disables throttling.
+             */
+            blockAfterAttempts: number;
+            /**
+             * How long the account stays locked once `blockAfterAttempts` is hit,
+             * in seconds.
+             */
+            lockoutTime: number;
         };
         user: {
             profile: string;
@@ -194,7 +203,32 @@ declare const rbac: {
                 ttl: number;
                 maxLifetime: number;
             };
-            cookie: {};
+            /**
+             * Session cookie. Passed through to express, EXCEPT:
+             *  - `httpOnly` is forced on and cannot be configured away,
+             *  - `secure` and `sameSite` default to `true` / `'strict'`,
+             *  - `name` sets the cookie name ( default `ssid` ),
+             *  - `hostPrefix: true` emits it as `__Host-<name>`, which additionally
+             *    forces `secure`, `path: '/'` and drops `domain`.
+             *
+             * Local http development needs `secure: false`; everything else should be
+             * left alone.
+             */
+            cookie: {
+                /**
+                 * Secure everywhere except local development.
+                 *
+                 * `NODE_ENV=production` is what a deployment sets, and there the cookie
+                 * must never leave over plain http. Anywhere else ( a developer running
+                 * the app on http://localhost ) the browser would simply drop a Secure
+                 * cookie and nobody could log in, so it is relaxed there and only
+                 * there.
+                 *
+                 * An application serving https outside production should set this back
+                 * to `true` in its own config.
+                 */
+                secure: boolean;
+            };
         };
         /**
          * System role is used to perform internal operations on users, like password reset, email change etc.

package/lib/mjs/config/rbac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../src/config/rbac.ts"],"names":[],"mappings":"AAcA,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA2LJ;;eAEG;;;;;YASH;;eAEG;;;;;;;;YASH;;;;eAIG;;;;;;;;QAWL;;WAEG;;QAEH;;;;;eAKO;;;8BAGiB,KAAK,CAAC,QAAQ,CAAC;6BAChB,KAAK,CAAC,QAAQ,CAAC;;;QAMtC;;WAEG;;QAGH;;;WAGG;;YAED;;;eAGG;6BACoB,MAAM,EAAE;;QAGjC;;;;;WAKG;;YAED;;;eAGG;;YAGH;;;eAGG;4BAC2B,MAAM,EAAE;;;CAG3C,CAAC;AAEF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../src/config/rbac.ts"],"names":[],"mappings":"AAcA,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA2LJ;;eAEG;;;;;YASH;;eAEG;;YAGH;;eAEG;;YAGH;;;eAGG;;;;;;;;YASH;;;;eAIG;;;;;;YAWH;;;;;;;;;;eAUG;;gBAED;;;;;;;;;;;mBAWG;;;;QAKP;;WAEG;;QAEH;;;;;eAKO;;;8BAGiB,KAAK,CAAC,QAAQ,CAAC;6BAChB,KAAK,CAAC,QAAQ,CAAC;;;QAMtC;;WAEG;;QAGH;;;WAGG;;YAED;;;eAGG;6BACoB,MAAM,EAAE;;QAGjC;;;;;WAKG;;YAED;;;eAGG;;YAGH;;;eAGG;4BAC2B,MAAM,EAAE;;;CAG3C,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/lib/mjs/config/rbac.js

@@ -185,6 +185,15 @@ const rbac = {
              * How long we should wait to reset password ( after this time reset token is invalid )
              */
             passwordResetWaitTime: 60 * 60,
+            /**
+             * Consecutive failed logins that lock the account. 0 disables throttling.
+             */
+            blockAfterAttempts: 5,
+            /**
+             * How long the account stays locked once `blockAfterAttempts` is hit,
+             * in seconds.
+             */
+            lockoutTime: 15 * 60,
         },
         user: {
             profile: "BasicProfileProvider"
@@ -198,11 +207,37 @@ const rbac = {
              */
             expiration: {
                 service: 'SlidingCappedExpiration',
-                ttl: 120, // minutes
-                maxLifetime: 1440, // minutes (SlidingCappedExpiration only)
+                // idle timeout — OWASP puts a low-risk application at 15-30 minutes
+                ttl: 30, // minutes
+                // hard ceiling on a single session's life, regardless of activity
+                maxLifetime: 480, // minutes (SlidingCappedExpiration only)
+            },
+            /**
+             * Session cookie. Passed through to express, EXCEPT:
+             *  - `httpOnly` is forced on and cannot be configured away,
+             *  - `secure` and `sameSite` default to `true` / `'strict'`,
+             *  - `name` sets the cookie name ( default `ssid` ),
+             *  - `hostPrefix: true` emits it as `__Host-<name>`, which additionally
+             *    forces `secure`, `path: '/'` and drops `domain`.
+             *
+             * Local http development needs `secure: false`; everything else should be
+             * left alone.
+             */
+            cookie: {
+                /**
+                 * Secure everywhere except local development.
+                 *
+                 * `NODE_ENV=production` is what a deployment sets, and there the cookie
+                 * must never leave over plain http. Anywhere else ( a developer running
+                 * the app on http://localhost ) the browser would simply drop a Secure
+                 * cookie and nobody could log in, so it is relaxed there and only
+                 * there.
+                 *
+                 * An application serving https outside production should set this back
+                 * to `true` in its own config.
+                 */
+                secure: process.env.NODE_ENV === 'production',
             },
-            // passthrough express cookie options
-            cookie: {},
         },
         /**
          * System role is used to perform internal operations on users, like password reset, email change etc.

package/lib/mjs/config/rbac.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../src/config/rbac.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAEvJ,4CAA4C;QAC5C,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC/J,CAAC;AACJ,CAAC;AAID,MAAM,IAAI,GAAG;IACX,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;IACD,KAAK,EAAE;QACL,OAAO,EAAE;YACP,OAAO,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAChD,aAAa,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACtD,UAAU,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACnD,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,WAAW,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACpD,UAAU,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACnD,mBAAmB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC5D,YAAY,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACrD,mBAAmB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC5D,yBAAyB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAClE,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,wBAAwB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACjE,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SAChE;QAED,6EAA6E;QAC7E,iDAAiD;QACjD,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,sBAAsB;gBAC/B,mBAAmB,EAAE,WAAW;gBAChC,mBAAmB,EAAE,aAAa;aACnC;SACF;KACF;IACD,IAAI,EAAE;QACJ,kBAAkB,EAAE,KAAK;QAEzB,KAAK,EAAE;YACL,UAAU,EAAE,uBAAuB;YAEnC,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,qCAAqC;gBAC/C,OAAO,EAAE,yBAAyB;aACnC;YAED,2DAA2D;YAC3D,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,oCAAoC;gBAC9C,OAAO,EAAE,2BAA2B;aACrC;YAED,MAAM,EAAE;gBACN,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,kCAAkC;gBAC5C,OAAO,EAAE,gBAAgB;aAC1B;YAED,QAAQ,EAAE;gBACR,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,oCAAoC;gBAC9C,OAAO,EAAE,kBAAkB;aAC5B;YAED,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,mCAAmC;gBAC7C,OAAO,EAAE,iBAAiB;aAC3B;YAED,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,uCAAuC;gBACjD,OAAO,EAAE,qBAAqB;aAC/B;YAED,eAAe,EAAE;gBACf,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,sCAAsC;gBAChD,OAAO,EAAE,kBAAkB;aAC5B;YAED,kBAAkB,EAAE;gBAClB,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,sCAAsC;gBAChD,OAAO,EAAE,gCAAgC;aAC1C;YAED,SAAS,EAAE;gBACT,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,qCAAqC;gBAC/C,OAAO,EAAE,mBAAmB;aAC7B;YAED,gDAAgD;YAChD,wCAAwC;YACxC,yDAAyD;YACzD,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,wCAAwC;gBAClD,OAAO,EAAE,iBAAiB;aAC3B;SACF;QACD,gDAAgD;QAChD,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE,eAAe;aAC7B;YACD;gBACE,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,sCAAsC;aACpD;SACF;QACD,MAAM,EAAE;YACN,KAAK,EAAE;gBACL,UAAU,EAAC;oBACT,UAAU,EAAE,CAAC,GAAG,CAAC;iBAClB;aACF;YAED,sDAAsD;YACtD,MAAM,EAAE;gBACN,OAAO,EAAE,CAAC,OAAO,CAAC;aACnB;YAED,aAAa,EAAE;gBACb,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;gBACD,eAAe,EAAE;oBACf,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;aACF;YACD,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC9B,YAAY,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;iBAC7C;gBACD,eAAe,EAAE;oBACf,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;aACF;YACD,KAAK,EAAE;gBACL,OAAO,EAAE,CAAC,aAAa,CAAC;aACzB;SACF;QACD,WAAW,EAAE,OAAO;QACpB,IAAI,EAAE;YACJ,OAAO,EAAE,sBAAsB;SAChC;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,uBAAuB;YAEhC,UAAU,EAAE;gBACV,OAAO,EAAE,iCAAiC;gBAC1C,IAAI,EAAE;oBACJ,mCAAmC;oBACnC,iCAAiC;oBAEjC,+DAA+D;oBAC/D,OAAO,EAAE,kBAAkB;oBAE3B,uFAAuF;oBACvF,6EAA6E;oBAE7E,+FAA+F;oBAC/F,6DAA6D;oBAE7D,+FAA+F;oBAC/F,mFAAmF;oBAEnF,IAAI,EAAE,QAAQ;iBACf;aACF;YAED;;eAEG;YAEH,UAAU,EAAE;gBACV,OAAO,EAAE,IAAI;gBAEb,aAAa;gBACb,sBAAsB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;aAC1C;YAED;;eAEG;YACH,qBAAqB,EAAE,EAAE,GAAG,EAAE;SAC/B;QACD,IAAI,EAAE;YACJ,OAAO,EAAE,sBAAsB;SAChC;QACD,OAAO,EAAE;YACP,OAAO,EAAE,oBAAoB;YAE7B;;;;eAIG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,yBAAyB;gBAClC,GAAG,EAAE,GAAG,EAAE,UAAU;gBACpB,WAAW,EAAE,IAAI,EAAE,yCAAyC;aAC7D;YAED,qCAAqC;YACrC,MAAM,EAAE,EAAE;SACX;QAED;;WAEG;QACH,UAAU,EAAE,QAAQ;QACpB;;;;;eAKO;QACP,OAAO,EAAE;YACP,MAAM,EAAE;gBACN,YAAY,EAAE,EAAqB;gBACnC,WAAW,EAAE,EAAqB;aACnC;SACF;QAID;;WAEG;QACH,UAAU,EAAE,MAAM;QAElB;;;WAGG;QACH,UAAU,EAAE;YACV;;;eAGG;YACH,eAAe,EAAE,EAAc;SAChC;QAED;;;;;WAKG;QACH,aAAa,EAAE;YACb;;;eAGG;YACH,eAAe,EAAE,IAAI;YAErB;;;eAGG;YACH,cAAc,EAAE,CAAC,QAAQ,CAAa;SACvC;KACF;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../src/config/rbac.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAEvJ,4CAA4C;QAC5C,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC/J,CAAC;AACJ,CAAC;AAID,MAAM,IAAI,GAAG;IACX,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;IACD,KAAK,EAAE;QACL,OAAO,EAAE;YACP,OAAO,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAChD,aAAa,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACtD,UAAU,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACnD,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,WAAW,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACpD,UAAU,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACnD,mBAAmB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC5D,YAAY,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACrD,mBAAmB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC5D,yBAAyB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAClE,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,wBAAwB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACjE,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SAChE;QAED,6EAA6E;QAC7E,iDAAiD;QACjD,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,sBAAsB;gBAC/B,mBAAmB,EAAE,WAAW;gBAChC,mBAAmB,EAAE,aAAa;aACnC;SACF;KACF;IACD,IAAI,EAAE;QACJ,kBAAkB,EAAE,KAAK;QAEzB,KAAK,EAAE;YACL,UAAU,EAAE,uBAAuB;YAEnC,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,qCAAqC;gBAC/C,OAAO,EAAE,yBAAyB;aACnC;YAED,2DAA2D;YAC3D,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,oCAAoC;gBAC9C,OAAO,EAAE,2BAA2B;aACrC;YAED,MAAM,EAAE;gBACN,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,kCAAkC;gBAC5C,OAAO,EAAE,gBAAgB;aAC1B;YAED,QAAQ,EAAE;gBACR,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,oCAAoC;gBAC9C,OAAO,EAAE,kBAAkB;aAC5B;YAED,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,mCAAmC;gBAC7C,OAAO,EAAE,iBAAiB;aAC3B;YAED,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,uCAAuC;gBACjD,OAAO,EAAE,qBAAqB;aAC/B;YAED,eAAe,EAAE;gBACf,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,sCAAsC;gBAChD,OAAO,EAAE,kBAAkB;aAC5B;YAED,kBAAkB,EAAE;gBAClB,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,sCAAsC;gBAChD,OAAO,EAAE,gCAAgC;aAC1C;YAED,SAAS,EAAE;gBACT,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,qCAAqC;gBAC/C,OAAO,EAAE,mBAAmB;aAC7B;YAED,gDAAgD;YAChD,wCAAwC;YACxC,yDAAyD;YACzD,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,wCAAwC;gBAClD,OAAO,EAAE,iBAAiB;aAC3B;SACF;QACD,gDAAgD;QAChD,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE,eAAe;aAC7B;YACD;gBACE,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,sCAAsC;aACpD;SACF;QACD,MAAM,EAAE;YACN,KAAK,EAAE;gBACL,UAAU,EAAC;oBACT,UAAU,EAAE,CAAC,GAAG,CAAC;iBAClB;aACF;YAED,sDAAsD;YACtD,MAAM,EAAE;gBACN,OAAO,EAAE,CAAC,OAAO,CAAC;aACnB;YAED,aAAa,EAAE;gBACb,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;gBACD,eAAe,EAAE;oBACf,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;aACF;YACD,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC9B,YAAY,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;iBAC7C;gBACD,eAAe,EAAE;oBACf,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;aACF;YACD,KAAK,EAAE;gBACL,OAAO,EAAE,CAAC,aAAa,CAAC;aACzB;SACF;QACD,WAAW,EAAE,OAAO;QACpB,IAAI,EAAE;YACJ,OAAO,EAAE,sBAAsB;SAChC;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,uBAAuB;YAEhC,UAAU,EAAE;gBACV,OAAO,EAAE,iCAAiC;gBAC1C,IAAI,EAAE;oBACJ,mCAAmC;oBACnC,iCAAiC;oBAEjC,+DAA+D;oBAC/D,OAAO,EAAE,kBAAkB;oBAE3B,uFAAuF;oBACvF,6EAA6E;oBAE7E,+FAA+F;oBAC/F,6DAA6D;oBAE7D,+FAA+F;oBAC/F,mFAAmF;oBAEnF,IAAI,EAAE,QAAQ;iBACf;aACF;YAED;;eAEG;YAEH,UAAU,EAAE;gBACV,OAAO,EAAE,IAAI;gBAEb,aAAa;gBACb,sBAAsB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;aAC1C;YAED;;eAEG;YACH,qBAAqB,EAAE,EAAE,GAAG,EAAE;YAE9B;;eAEG;YACH,kBAAkB,EAAE,CAAC;YAErB;;;eAGG;YACH,WAAW,EAAE,EAAE,GAAG,EAAE;SACrB;QACD,IAAI,EAAE;YACJ,OAAO,EAAE,sBAAsB;SAChC;QACD,OAAO,EAAE;YACP,OAAO,EAAE,oBAAoB;YAE7B;;;;eAIG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,yBAAyB;gBAElC,oEAAoE;gBACpE,GAAG,EAAE,EAAE,EAAE,UAAU;gBAEnB,kEAAkE;gBAClE,WAAW,EAAE,GAAG,EAAE,yCAAyC;aAC5D;YAED;;;;;;;;;;eAUG;YACH,MAAM,EAAE;gBACN;;;;;;;;;;;mBAWG;gBACH,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;aAC9C;SACF;QAED;;WAEG;QACH,UAAU,EAAE,QAAQ;QACpB;;;;;eAKO;QACP,OAAO,EAAE;YACP,MAAM,EAAE;gBACN,YAAY,EAAE,EAAqB;gBACnC,WAAW,EAAE,EAAqB;aACnC;SACF;QAID;;WAEG;QACH,UAAU,EAAE,MAAM;QAElB;;;WAGG;QACH,UAAU,EAAE;YACV;;;eAGG;YACH,eAAe,EAAE,EAAc;SAChC;QAED;;;;;WAKG;QACH,aAAa,EAAE;YACb;;;eAGG;YACH,eAAe,EAAE,IAAI;YAErB;;;eAGG;YACH,cAAc,EAAE,CAAC,QAAQ,CAAa;SACvC;KACF;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/lib/mjs/index.d.ts

@@ -16,6 +16,7 @@ export * from './session-codec.js';
 export * from './models/User.js';
 export * from './models/UserMetadata.js';
 export * from './migrations/RBACInitial_2022_06_28_01_13_00.js';
+export * from './migrations/RBACRegisteredAt_2026_07_28_00_00_00.js';
 export * from './events/index.js';
 export * from './actions.js';
 export * from './middleware.js';

package/lib/mjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,eAAe,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAc,YAAY,EAAkB,MAAM,aAAa,CAAC;AAIvE,OAAO,WAAW,CAAC;AACnB,OAAO,eAAe,CAAC;AACvB,OAAO,cAAc,CAAC;AACtB,OAAO,yBAAyB,CAAC;AACjC,OAAO,oBAAoB,CAAC;AAC5B,OAAO,gBAAgB,CAAC;AAGxB,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iDAAiD,CAAC;AAChE,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAG/B,QAAA,MAAQ,UAAU,sBAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AAErC,qBACa,gBAAiB,SAAQ,YAAY;IACzC,SAAS,IAAI,IAAI;CAwDzB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,eAAe,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAc,YAAY,EAAkB,MAAM,aAAa,CAAC;AAIvE,OAAO,WAAW,CAAC;AACnB,OAAO,eAAe,CAAC;AACvB,OAAO,cAAc,CAAC;AACtB,OAAO,yBAAyB,CAAC;AACjC,OAAO,oBAAoB,CAAC;AAC5B,OAAO,gBAAgB,CAAC;AAIxB,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iDAAiD,CAAC;AAChE,cAAc,sDAAsD,CAAC;AACrE,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAG/B,QAAA,MAAQ,UAAU,sBAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AAErC,qBACa,gBAAiB,SAAQ,YAAY;IACzC,SAAS,IAAI,IAAI;CA8DzB"}

package/lib/mjs/index.js

@@ -15,7 +15,8 @@ import './session.js';
 import './session-expiration.js';
 import './session-codec.js';
 import './ownership.js';
-import { User } from './models/User.js';
+import { User, USER_SECURITY_METADATA_KEYS } from './models/User.js';
+import { UserMetadataBase } from './models/UserMetadata.js';
 export * from './interfaces.js';
 export * from './auth.js';
 export * from './password.js';
@@ -25,6 +26,7 @@ export * from './session-codec.js';
 export * from './models/User.js';
 export * from './models/UserMetadata.js';
 export * from './migrations/RBACInitial_2022_06_28_01_13_00.js';
+export * from './migrations/RBACRegisteredAt_2026_07_28_00_00_00.js';
 export * from './events/index.js';
 export * from './actions.js';
 export * from './middleware.js';
@@ -38,6 +40,14 @@ const { Permission } = ac;
 export { AccessControl, Permission };
 let RbacBootstrapper = class RbacBootstrapper extends Bootstrapper {
     bootstrap() {
+        /**
+         * Credential-bearing metadata never leaves the server in a dehydrated user.
+         * Seeded here rather than as the field initialiser so an application ( or
+         * another package, eg. rbac-http-user adding its 2FA keys ) can append to
+         * the list without having to restate this one. De-duplicated because tests
+         * run bootstrappers repeatedly against a live static.
+         */
+        UserMetadataBase._hiddenKeys = [...new Set([...UserMetadataBase._hiddenKeys, ...USER_SECURITY_METADATA_KEYS])];
         const ac = new AccessControl();
         DI.register(ac).asValue('AccessControl');
         DI.once('di.resolved.Configuration', (container, configuration) => {
@@ -58,7 +68,7 @@ let RbacBootstrapper = class RbacBootstrapper extends Bootstrapper {
             return User.where({
                 Uuid: userUUID,
             })
-                .populate("Metadata")
+                .populate('Metadata')
                 .isActiveUser()
                 .firstOrFail();
         }).as('RbacUserFactory');
@@ -73,7 +83,7 @@ let RbacBootstrapper = class RbacBootstrapper extends Bootstrapper {
             });
         }).as('RbacGuestUserFactory');
         DI.register(async (_) => {
-            const system = await User.select().where("Role", ["system"]).where("Login", "__system__").firstOrFail();
+            const system = await User.select().where('Role', ['system']).where('Login', '__system__').firstOrFail();
             return system;
         }).as('RbacSystemUserFactory');
         DI.register(async (_, role) => {