@spinajs/rbac 2.0.486 → 2.0.488

package/lib/cjs/actions.d.ts

@@ -104,6 +104,22 @@ export declare function _user(identifier: number | string | User): () => Promise
  * @returns
  */
 export declare function _user_unsafe(identifier: number | string | User): () => Promise<User>;
+/**
+ * Destroys every session belonging to a user, on every device.
+ *
+ * Called from each action that invalidates what a live session was granted on:
+ * a password change or reset ( the credential behind the session is gone ), a
+ * ban or a deactivation ( the account may no longer act at all ). Without this
+ * an attacker who is already inside keeps their session while the victim
+ * changes the password that was supposed to lock them out.
+ *
+ * Errors are NOT swallowed: a session store that cannot be reached means the
+ * revocation did not happen, and the caller must learn that rather than be told
+ * the account is secure.
+ *
+ * @param user - the user whose sessions are destroyed, or their numeric id
+ */
+export declare function revokeUserSessions(user: User | number): Promise<void>;
 /**
  * ===============================================
  * USER ACTIONS
@@ -159,11 +175,11 @@ export declare function deleteUser(identifier: number | string | User): Promise<
  * Grants an additional role to a user.
  * The role is added only if not already present. Emits a {@link UserRoleGranted} event.
  *
- * @param identifier - numeric id or uuid / email / login string
+ * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  * @param role - role name to grant
  * @returns the updated {@link User}
  */
-export declare function grant(identifier: number | string, role: string): Promise<User>;
+export declare function grant(identifier: number | string | User, role: string): Promise<User>;
 /**
  * Revokes a role from a user.
  * Removes the role from the user's role list and emits a {@link UserRoleRevoked} event.

package/lib/cjs/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAKA,OAAO,EAAwB,IAAI,EAAY,MAAM,kBAAkB,CAAC;AAGxE,OAAO,EAAE,WAAW,EAAM,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AASlD,oBAAY,OAAO;IACjB,eAAe,IAAA;IAEf,eAAe,IAAA;IAEf,qCAAqC,IAAA;IAErC,gBAAgB,IAAA;IAEhB,qBAAqB,IAAA;IAErB,iBAAiB,IAAA;IAEjB,aAAa,IAAA;IAEb,oBAAoB,IAAA;IAEpB,wBAAwB,IAAA;IAExB,sBAAsB,IAAA;IAEtB,mBAAmB,KAAA;IAEnB,YAAY,KAAA;CACb;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAgB,gBAAgB,qBAiB/B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,yGAEhD;AAID;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,uBAWrD;AAID;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAG,CAAA;CAAE,EAAE,EAAE,KAAK,GAAE,GAAU,IAC9E,GAAG,IAAI,mBAoBtB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,IAC1B,GAAG,IAAI,kBAMtB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,oBAAoB,GAAG,iBAAiB,IAO9K,GAAG,IAAI,mBAmBtB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IACtD,GAAG,IAAI,mBAItB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,IACjC,GAAG,IAAI,mBAItB;AAED;;;;;;;GAOG;AACH,wBAAgB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAEhE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAiBjE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDvL;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlF;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASpF;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5F;AAED;;;;;;;;GAQG;AACH,wBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB/G;AAED;;;;;;GAMG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB7E;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAY7E;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,oBA4BhH;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAmB3E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,IAG9B,GAAG,IAAI,KAAG,OAAO,CAAC,OAAO,CAAC,CAQzC;AAED;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB/F"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAKA,OAAO,EAAwB,IAAI,EAAY,MAAM,kBAAkB,CAAC;AAGxE,OAAO,EAAE,WAAW,EAAM,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAUlD,oBAAY,OAAO;IACjB,eAAe,IAAA;IAEf,eAAe,IAAA;IAEf,qCAAqC,IAAA;IAErC,gBAAgB,IAAA;IAEhB,qBAAqB,IAAA;IAErB,iBAAiB,IAAA;IAEjB,aAAa,IAAA;IAEb,oBAAoB,IAAA;IAEpB,wBAAwB,IAAA;IAExB,sBAAsB,IAAA;IAEtB,mBAAmB,KAAA;IAEnB,YAAY,KAAA;CACb;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAgB,gBAAgB,qBAW/B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,yGAEhD;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,uBAUrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAG,CAAA;CAAE,EAAE,EAAE,KAAK,GAAE,GAAU,IAC9E,GAAG,IAAI,mBAoBtB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,IAC1B,GAAG,IAAI,kBAMtB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,oBAAoB,GAAG,iBAAiB,IAO9K,GAAG,IAAI,mBAmBtB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IACtD,GAAG,IAAI,mBAItB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,IACjC,GAAG,IAAI,mBAItB;AAED;;;;;;;GAOG;AACH,wBAAgB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3E;AAYD;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAEhE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAiBjE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAuDvL;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAelF;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5F;AAED;;;;;;;;GAQG;AACH,wBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B/G;AAED;;;;;;GAMG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB7E;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAY7E;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,oBAqDhH;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAuC3E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,IAG9B,GAAG,IAAI,KAAG,OAAO,CAAC,OAAO,CAAC,CAQzC;AAED;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC/F"}

package/lib/cjs/actions.js

@@ -14,6 +14,7 @@ exports._user_ev = _user_ev;
 exports._user_update = _user_update;
 exports._user = _user;
 exports._user_unsafe = _user_unsafe;
+exports.revokeUserSessions = revokeUserSessions;
 exports.activate = activate;
 exports.deactivate = deactivate;
 exports.create = create;
@@ -41,6 +42,7 @@ const configuration_2 = require("@spinajs/configuration");
 const interfaces_js_1 = require("./interfaces.js");
 const luxon_1 = require("luxon");
 const exceptions_1 = require("@spinajs/exceptions");
+const crypto_1 = require("crypto");
 const uuid_1 = require("uuid");
 const UserLoginFailed_js_1 = require("./events/UserLoginFailed.js");
 const UserMetadataChange_js_1 = require("./events/UserMetadataChange.js");
@@ -76,9 +78,7 @@ function _get_system_user() {
         const s = (0, util_1._check_arg)((0, util_1._trim)(), (0, util_1._non_empty)())(systemRole, 'rbac.systemRole');
         const c = (0, util_1._check_arg)((0, util_1._trim)(), (0, util_1._non_empty)())(roleColumn, 'rbac.roleColumn');
         return [s, c];
-    }, ([systemRole, roleColumn]) => User_js_1.User.query()
-        .where(roleColumn, systemRole)
-        .firstOrFail());
+    }, ([systemRole, roleColumn]) => User_js_1.User.query().where(roleColumn, systemRole).firstOrFail());
 }
 /**
  *
@@ -220,7 +220,39 @@ function _user_unsafe(identifier) {
     if (id instanceof User_js_1.UserBase) {
         return () => Promise.resolve(id);
     }
-    return () => User_js_1.UserBase.query().whereAnything(id).populate("Metadata").firstOrFail();
+    return () => User_js_1.UserBase.query().whereAnything(id).populate('Metadata').firstOrFail();
+}
+/**
+ * Destroys every session belonging to a user, on every device.
+ *
+ * Called from each action that invalidates what a live session was granted on:
+ * a password change or reset ( the credential behind the session is gone ), a
+ * ban or a deactivation ( the account may no longer act at all ). Without this
+ * an attacker who is already inside keeps their session while the victim
+ * changes the password that was supposed to lock them out.
+ *
+ * Errors are NOT swallowed: a session store that cannot be reached means the
+ * revocation did not happen, and the caller must learn that rather than be told
+ * the account is secure.
+ *
+ * @param user - the user whose sessions are destroyed, or their numeric id
+ */
+async function revokeUserSessions(user) {
+    const userId = lodash_1.default.isNumber(user) ? user : user?.Id;
+    if (!userId) {
+        return;
+    }
+    const provider = await (0, configuration_1._service)('rbac.session', interfaces_js_1.SessionProvider)();
+    await provider.deleteByUser(userId);
+}
+/**
+ * Chain step form of {@link revokeUserSessions} — revokes and forwards the user.
+ */
+function _revoke_sessions() {
+    return async (u) => {
+        await revokeUserSessions(u);
+        return u;
+    };
 }
 /**
  * ===============================================
@@ -243,7 +275,9 @@ async function activate(identifier) {
  * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  */
 async function deactivate(identifier) {
-    return (0, util_1._chain)(_user(identifier), _user_update({ IsActive: false }), _user_ev(index_js_1.UserDeactivated), _user_email('deactivated'));
+    // Sessions go with the account: a deactivated user must stop acting NOW, not
+    // whenever their session happens to expire.
+    return (0, util_1._chain)(_user(identifier), _user_update({ IsActive: false }), _revoke_sessions(), _user_ev(index_js_1.UserDeactivated), _user_email('deactivated'));
 }
 /**
  * Reads a create-middleware list from configuration.
@@ -315,13 +349,19 @@ async function create(email, login, password, roles, id, metadata) {
  * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  */
 async function deleteUser(identifier) {
-    return (0, util_1._chain)(_user(identifier), (0, util_1._tap)((u) => u.destroy()), _user_ev(index_js_1.UserDeleted), _user_email('deleted'));
+    return (0, util_1._chain)(_user(identifier), (0, util_1._tap)((u) => u.destroy()), 
+    // Same reason a deactivation revokes: the account may no longer act. A live
+    // session outlasting the deletion is worse here than there — the session
+    // middleware resolves its user through `isActiveUser()`, which no longer
+    // matches a soft-deleted row, so every request from that session dies in
+    // the middleware instead of being cleanly logged out.
+    _revoke_sessions(), _user_ev(index_js_1.UserDeleted), _user_email('deleted'));
 }
 /**
  * Grants an additional role to a user.
  * The role is added only if not already present. Emits a {@link UserRoleGranted} event.
  *
- * @param identifier - numeric id or uuid / email / login string
+ * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  * @param role - role name to grant
  * @returns the updated {@link User}
  */
@@ -363,7 +403,11 @@ async function ban(identifier, reason, duration) {
         { key: User_js_1.USER_COMMON_METADATA.USER_BAN_REASON, value: reason },
         { key: User_js_1.USER_COMMON_METADATA.USER_BAN_IS_BANNED, value: true },
         { key: User_js_1.USER_COMMON_METADATA.USER_BAN_START_DATE, value: luxon_1.DateTime.now() },
-    ]), _user_ev(index_js_1.UserBanned), _user_email('banned'));
+    ]), 
+    // A ban that leaves the banned user's session alive bans nothing until that
+    // session expires — `isActiveUser` does not filter on the ban flag, so the
+    // session would keep resolving happily.
+    _revoke_sessions(), _user_ev(index_js_1.UserBanned), _user_email('banned'));
 }
 /**
  *
@@ -413,7 +457,19 @@ async function passwordChangeRequest(identifier) {
  * @param token - the reset token that was issued by {@link passwordChangeRequest}
  */
 async function confirmPasswordReset(identifier, newPassword, token) {
-    return (0, util_1._chain)(_user(identifier), (0, util_1._tap)((u) => (0, util_1._chain)(u, (0, util_1._zip)(_get_user_meta(User_js_1.USER_COMMON_METADATA.USER_PWD_RESET_START_DATE), _get_user_meta(User_js_1.USER_COMMON_METADATA.USER_PWD_RESET_WAIT_TIME)), ([dueDate, waitTime]) => {
+    return (0, util_1._chain)(_user(identifier), 
+    // A reset must not resurrect an account that is banned, deactivated or
+    // deleted — otherwise the reset flow is a way around every one of those
+    // states. Same ErrorCode family the caller already collapses into one
+    // opaque failure, so this does not become an account-state oracle.
+    (0, util_1._tap)(async (u) => {
+        if (u.Metadata[User_js_1.USER_COMMON_METADATA.USER_BAN_IS_BANNED]) {
+            throw new exceptions_1.ErrorCode(E_CODES.E_USER_BANNED, `Password reset refused: user is banned`, { user: u });
+        }
+        if (!u.IsActive || u.DeletedAt) {
+            throw new exceptions_1.ErrorCode(E_CODES.E_USER_NOT_ACTIVE, `Password reset refused: user is not active`, { user: u });
+        }
+    }), (0, util_1._tap)((u) => (0, util_1._chain)(u, (0, util_1._zip)(_get_user_meta(User_js_1.USER_COMMON_METADATA.USER_PWD_RESET_START_DATE), _get_user_meta(User_js_1.USER_COMMON_METADATA.USER_PWD_RESET_WAIT_TIME)), ([dueDate, waitTime]) => {
         if (dueDate.plus({ seconds: waitTime }) < luxon_1.DateTime.now()) {
             throw new exceptions_1.ErrorCode(E_CODES.E_TOKEN_EXPIRED, `Password change token expired, token expiration date is: ${dueDate.toISO()}`, {
                 dueDate,
@@ -423,14 +479,44 @@ async function confirmPasswordReset(identifier, newPassword, token) {
             });
         }
     })), (0, util_1._tap)((u) => (0, util_1._chain)(u, _get_user_meta(User_js_1.USER_COMMON_METADATA.USER_PWD_RESET_TOKEN), async (resetToken) => {
-        if (resetToken !== token) {
+        if (!_secure_compare(String(resetToken), token)) {
             throw new exceptions_1.ErrorCode(E_CODES.E_TOKEN_INVALID, `Password change token invalid, operation not permitted`, {
                 token,
                 resetToken,
                 user: u,
             });
         }
-    })), changePassword(newPassword));
+    })), changePassword(newPassword), 
+    // Burn the token. Validating it and leaving it in place made it a
+    // multi-use credential for the whole `passwordResetWaitTime` window:
+    // anyone who saw the reset mail once could keep re-taking the account.
+    (0, util_1._tap)(async (u) => {
+        await u.Metadata.delete(User_js_1.USER_COMMON_METADATA.USER_PWD_RESET_TOKEN);
+        await u.Metadata.delete(User_js_1.USER_COMMON_METADATA.USER_PWD_RESET_START_DATE);
+        await u.Metadata.delete(User_js_1.USER_COMMON_METADATA.USER_PWD_RESET_WAIT_TIME);
+        await u.Metadata.delete(User_js_1.USER_COMMON_METADATA.USER_PWD_RESET);
+    }));
+}
+/**
+ * Length-independent, constant-time string comparison for secrets.
+ *
+ * `!==` on a token leaks how many leading characters matched through timing.
+ * The margin is small over a network and the tokens are uuid-shaped, but a
+ * comparison of a secret is the wrong place to rely on that.
+ *
+ * @param a - value read from storage
+ * @param b - value supplied by the caller
+ */
+function _secure_compare(a, b) {
+    const ha = (0, crypto_1.createHash)('sha256')
+        .update(a ?? '')
+        .digest();
+    const hb = (0, crypto_1.createHash)('sha256')
+        .update(b ?? '')
+        .digest();
+    // hashing first makes both operands the same length, which timingSafeEqual
+    // requires and which also stops the length itself from leaking
+    return (0, crypto_1.timingSafeEqual)(ha, hb);
 }
 /**
  * Returns a function that changes a user's password.
@@ -450,7 +536,18 @@ function changePassword(password) {
             }
         }), 
         // update password
-        ({ pwd }) => pwd.hash(password), (hPassword) => (0, util_1._chain)(u, (0, orm_1._update)({ Password: hPassword }), _set_user_meta(User_js_1.USER_COMMON_METADATA.USER_PWD_RESET_LAST_ATTEMPT, luxon_1.DateTime.now().toISO()), _user_ev(index_js_1.UserPasswordChanged)));
+        ({ pwd }) => pwd.hash(password), (hPassword) => (0, util_1._chain)(u, (0, orm_1._update)({ Password: hPassword }), _set_user_meta([
+            { key: User_js_1.USER_COMMON_METADATA.USER_PWD_RESET_LAST_ATTEMPT, value: luxon_1.DateTime.now().toISO() },
+            // a successful password change clears the login throttle: the
+            // credential the failures were counted against no longer exists
+            { key: User_js_1.USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS, value: 0 },
+            { key: User_js_1.USER_COMMON_METADATA.USER_LOGIN_LOCKED_UNTIL, value: null },
+        ]), 
+        // Every session was authorized by the OLD password. Whoever holds one
+        // — including whoever the user is changing the password because of —
+        // loses it here. Callers that want the acting user to stay logged in
+        // ( eg. PATCH /user/password ) mint a fresh session afterwards.
+        _revoke_sessions(), _user_ev(index_js_1.UserPasswordChanged)));
     };
 }
 /**
@@ -493,9 +590,17 @@ function passwordMatch(password) {
 async function login(identifier, password) {
     password = (0, util_1._check_arg)((0, util_1._trim)(), (0, util_1._non_empty)())(password, 'password');
     return await (0, util_1._chain)(_user_unsafe(identifier), (0, util_1._catch)((u) => {
-        return (0, util_1._chain)((0, configuration_1._service)('rbac.auth', interfaces_js_1.AuthProvider), async (sAuth) => sAuth.authenticate(u.Email, password), (0, orm_1._update)({ LastLoginAt: luxon_1.DateTime.now() }), _user_ev(index_js_1.UserLogged));
+        return (0, util_1._chain)(async () => {
+            // Refuse before the password is even checked, so a locked account
+            // cannot be probed at all during the lockout window.
+            await _assert_not_locked(u);
+            return (0, configuration_1._service)('rbac.auth', interfaces_js_1.AuthProvider)();
+        }, async (sAuth) => sAuth.authenticate(u.Email, password), (0, orm_1._update)({ LastLoginAt: luxon_1.DateTime.now() }), _clear_login_throttle(), _user_ev(index_js_1.UserLogged));
     }, (err, u) => {
         return (0, util_1._chain)(() => u, 
+        // count the failure and lock the account once the configured
+        // threshold is reached
+        _register_failed_login(err), 
         // send event of failed login
         _user_ev(UserLoginFailed_js_1.UserLoginFailed, err), 
         // rethrow error for caller
@@ -504,4 +609,79 @@ async function login(identifier, password) {
         });
     }));
 }
+/**
+ * Throws when the account is inside a lockout window opened by
+ * {@link _register_failed_login}.
+ *
+ * @param u - user attempting to authenticate
+ */
+async function _assert_not_locked(u) {
+    const raw = u?.Metadata?.[User_js_1.USER_COMMON_METADATA.USER_LOGIN_LOCKED_UNTIL];
+    if (!raw) {
+        return;
+    }
+    const lockedUntil = raw instanceof luxon_1.DateTime ? raw : luxon_1.DateTime.fromISO(String(raw));
+    if (lockedUntil.isValid && lockedUntil > luxon_1.DateTime.now()) {
+        throw new exceptions_1.ErrorCode(interfaces_js_1.AthenticationErrorCodes.E_LOGIN_ATTEMPTS_EXCEEDED, `Too many failed login attempts, account is temporarily locked until ${lockedUntil.toISO()}`, {
+            user: u,
+            lockedUntil,
+        });
+    }
+}
+/**
+ * Clears the failure counter and any expired lock after a successful login.
+ */
+function _clear_login_throttle() {
+    return async (u) => {
+        const meta = u?.Metadata;
+        if (!meta) {
+            return u;
+        }
+        const hasAttempts = Number(meta[User_js_1.USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS] ?? 0) > 0;
+        const hasLock = Boolean(meta[User_js_1.USER_COMMON_METADATA.USER_LOGIN_LOCKED_UNTIL]);
+        if (!hasAttempts && !hasLock) {
+            return u;
+        }
+        await meta.delete(User_js_1.USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS);
+        await meta.delete(User_js_1.USER_COMMON_METADATA.USER_LOGIN_LOCKED_UNTIL);
+        return u;
+    };
+}
+/**
+ * Records one failed authentication and, at `rbac.password.blockAfterAttempts`
+ * consecutive failures, locks the account for `rbac.password.lockoutTime`
+ * seconds.
+ *
+ * `blockAfterAttempts <= 0` disables throttling entirely. A rejection that was
+ * itself the lockout is not counted — otherwise hammering a locked account
+ * would keep extending the lock indefinitely.
+ *
+ * @param err - the error that ended the login attempt
+ */
+function _register_failed_login(err) {
+    return async (u) => {
+        const meta = u?.Metadata;
+        if (!meta) {
+            return u;
+        }
+        if (err instanceof exceptions_1.ErrorCode && err.code === interfaces_js_1.AthenticationErrorCodes.E_LOGIN_ATTEMPTS_EXCEEDED) {
+            return u;
+        }
+        const blockAfter = await (0, configuration_1._cfg)('rbac.password.blockAfterAttempts', 5)();
+        const lockoutTime = await (0, configuration_1._cfg)('rbac.password.lockoutTime', 15 * 60)();
+        if (!blockAfter || blockAfter <= 0) {
+            return u;
+        }
+        const attempts = Number(meta[User_js_1.USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS] ?? 0) + 1;
+        if (attempts >= blockAfter) {
+            meta[User_js_1.USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS] = 0;
+            meta[User_js_1.USER_COMMON_METADATA.USER_LOGIN_LOCKED_UNTIL] = luxon_1.DateTime.now().plus({ seconds: lockoutTime }).toISO();
+        }
+        else {
+            meta[User_js_1.USER_COMMON_METADATA.USER_LOGIN_ATTEMPTS] = attempts;
+        }
+        await meta.update();
+        return u;
+    };
+}
 //# sourceMappingURL=actions.js.map

package/lib/cjs/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":";;;;;;AAyDA,4CAiBC;AASD,gDAEC;AAWD,8BAWC;AAaD,wCAqBC;AASD,wCAOC;AASD,kCA0BC;AASD,4BAKC;AAQD,oCAKC;AAUD,sBAQC;AASD,oCAQC;AAcD,4BAEC;AAQD,gCAEC;AAqCD,wBAqDC;AAQD,gCAOC;AAUD,sBASC;AAUD,wBASC;AAWD,kBAsBC;AASD,sBAsBC;AASD,sDAYC;AAUD,oDA4BC;AAWD,wCAmBC;AAQD,wCAEC;AASD,sCAWC;AAYD,sBAwBC;AAloBD,sCAAgD;AAChD,wCAA6O;AAC7O,oDAAuB;AACvB,0CAAiD;AACjD,0CAAqC;AACrC,8CAAwE;AACxE,0DAAwD;AACxD,gDAAkO;AAClO,oCAA8C;AAC9C,0DAAuD;AAEvD,mDAA6F;AAC7F,iCAAiC;AACjC,oDAAgD;AAChD,+BAAoC;AACpC,oEAA8D;AAC9D,0EAAoE;AACpE,4EAAsE;AAEtE,IAAY,OAwBX;AAxBD,WAAY,OAAO;IACjB,2DAAe,CAAA;IAEf,2DAAe,CAAA;IAEf,uGAAqC,CAAA;IAErC,6DAAgB,CAAA;IAEhB,uEAAqB,CAAA;IAErB,+DAAiB,CAAA;IAEjB,uDAAa,CAAA;IAEb,qEAAoB,CAAA;IAEpB,6EAAwB,CAAA;IAExB,yEAAsB,CAAA;IAEtB,oEAAmB,CAAA;IAEnB,sDAAY,CAAA;AACd,CAAC,EAxBW,OAAO,uBAAP,OAAO,QAwBlB;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,SAAgB,gBAAgB;IAC9B,OAAO,IAAA,aAAM,EACX,IAAA,WAAI,EACF,IAAA,oBAAI,EAAS,iBAAiB,CAAC,EAC/B,IAAA,oBAAI,EAAS,iBAAiB,CAAC,CAChC,EACD,CAAC,CAAC,UAAU,EAAE,UAAU,CAAmB,EAAE,EAAE;QAC7C,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAE3E,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACf,CAAC,EACD,CAAC,CAAC,UAAU,EAAE,UAAU,CAAmB,EAAE,EAAE,CAC7C,cAAI,CAAC,KAAK,EAAE;SACT,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC;SAC7B,WAAW,EAAE,CACnB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,IAAc;IAC/C,OAAO,GAAG,EAAE,CAAC,cAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAID;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,IAA4B;IAEpD,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,IAAI,EAAE,CAAC,cAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,IAAI,EAAE,CAAC,cAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAID;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAAC,IAA4C,EAAE,QAAa,IAAI;IAC5F,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAI,sBAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAE5J,KAAK,CAAC,OAAO,CAAC,CAAC,CAAuC,EAAE,EAAE;YACxD,gBAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,MAAM,IAAA,aAAM,EACV,CAAC,EAED,IAAA,WAAI,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAC/B,QAAQ,CAAC,0CAAkB,EAAE,GAAG,EAAE;YAChC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAuC,EAAE,EAAE;gBAC3D,OAAO,gBAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAI,sBAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5I,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAI,sBAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,iCAAiC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;QAE3J,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,WAAkK;IAO5L,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,OAAO,IAAA,aAAM,EAAO,IAAA,WAAI,EAAC,IAAA,oBAAI,EAAC,uBAAuB,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC,EAAE,IAAA,WAAI,EAAC,IAAA,oBAAI,EAAC,cAAc,WAAW,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAA2C,EAAE,EAAE;YAC3M,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAI,sBAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,kBAAkB,WAAW,6CAA6C,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACnK,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAC5F,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAE1F,OAAO,CACL,QAAQ,CAAC,OAAO;gBAChB,IAAA,uBAAe,EAAC;oBACd,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;oBACb,UAAU;oBACV,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;oBACjB,GAAG,EAAE,aAAa,WAAW,EAAE;oBAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,QAAQ,CAAC,KAA6B,EAAE,GAAG,IAAW;IACpE,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,IAAA,WAAG,EAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,IAAoB;IAC/C,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,IAAA,aAAM,EAAC,CAAC,EAAE,IAAA,aAAO,EAAO,IAAI,CAAC,EAAE,QAAQ,CAAC,sBAAW,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,KAAK,CAAC,UAAkC;IACtD,MAAM,EAAE,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAErE,IAAI,EAAE,YAAY,cAAI,EAAE,CAAC;QACvB,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,cAAI,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,UAAkC;IAC7D,MAAM,EAAE,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAErE,IAAI,EAAE,YAAY,kBAAQ,EAAE,CAAC;QAC3B,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,kBAAQ,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;AACrF,CAAC;AAED;;;;GAIG;AAEH;;;;;GAKG;AACI,KAAK,UAAU,QAAQ,CAAC,UAAkC;IAC/D,OAAO,IAAA,aAAM,EAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,wBAAa,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACxH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,UAAU,CAAC,UAAkC;IACjE,OAAO,IAAA,aAAM,EAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,0BAAe,CAAC,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;AAC7H,CAAC;AAOD;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,OAAE,CAAC,GAAG,CAAC,6BAAa,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,CAAqB,IAAI,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,KAAa,EAAE,QAAgB,EAAE,KAAe,EAAE,EAAW,EAAE,QAAiC;IAC1I,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAQ,EAAmB,eAAe,EAAE,gCAAgB,CAAC,EAAE,CAAC;IAExF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,EAAE,IAAA,kBAAW,EAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3E,QAAQ,GAAG,IAAA,iBAAU,EACnB,IAAA,YAAK,GAAE,EACP,IAAA,eAAQ,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CACrC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAExB,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEjD,OAAO,IAAA,aAAM;IACX,cAAc;IACd,GAAG,EAAE,CACH,OAAO,CAAC,OAAO,CACb,IAAI,cAAI,CAAC;QACP,EAAE,EAAE,EAAE;QACN,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,KAAK;QACX,YAAY,EAAE,gBAAQ,CAAC,GAAG,EAAE;QAC5B,SAAS,EAAE,gBAAQ,CAAC,GAAG,EAAE;QACzB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,IAAA,SAAM,GAAE;KACf,CAAC,CACH;IAEH,+BAA+B;IAC/B,CAAC,CAAO,EAAE,EAAE,CAAC,IAAA,aAAM,EAAC,CAAC,EAAE,GAAG,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;IAEjF,eAAe;IACf,IAAA,aAAO,GAAE,EAET,IAAA,cAAO,EAAC,GAAG,EAAE,CAAC,QAAQ,KAAK,SAAS,EAClC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAChG,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAEvB,8BAA8B;IAC9B,CAAC,CAAO,EAAE,EAAE,CAAC,IAAA,aAAM,EAAC,CAAC,EAAE,GAAG,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;IAEhF,aAAa;IACb,QAAQ,CAAC,sBAAW,EAAE,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAE9C,aAAa;IACb,IAAA,WAAI,EAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAE5B,4EAA4E;IAC5E,CAAC,CAAO,EAAE,EAAE;QACV,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,UAAU,CAAC,UAAkC;IACjE,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAA,WAAI,EAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAC9B,QAAQ,CAAC,sBAAW,CAAC,EACrB,WAAW,CAAC,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,KAAK,CAAC,UAA2B,EAAE,IAAY;IACnE,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,gBAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAC7D,YAAY,EAAE,EACd,QAAQ,CAAC,0BAAe,EAAE,IAAI,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,MAAM,CAAC,UAAkC,EAAE,IAAY;IAC3E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EACpE,YAAY,EAAE,EACd,QAAQ,CAAC,0BAAe,EAAE,IAAI,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,GAAG,CAAC,UAAkC,EAAE,MAAe,EAAE,QAAiB;IAC9F,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxF,MAAM,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,WAAW,CAAC,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE/E,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC,EACjB,CAAC,CAAO,EAAE,EAAE;QACV,IAAI,CAAC,CAAC,QAAQ,CAAC,8BAAoB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,sBAAS,CAAC,OAAO,CAAC,aAAa,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,CAAC,CAAC;IACX,CAAC,EACD,cAAc,CAAC;QACb,EAAE,GAAG,EAAE,8BAAoB,CAAC,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE;QAChE,EAAE,GAAG,EAAE,8BAAoB,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;QAC5D,EAAE,GAAG,EAAE,8BAAoB,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE;QAC7D,EAAE,GAAG,EAAE,8BAAoB,CAAC,mBAAmB,EAAE,KAAK,EAAE,gBAAQ,CAAC,GAAG,EAAE,EAAE;KACzE,CAAC,EACF,QAAQ,CAAC,qBAAU,CAAC,EACpB,WAAW,CAAC,QAAQ,CAAC,CACtB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,KAAK,CAAC,UAAkC;IAC5D,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC;IAEjB,yEAAyE;IACzE,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,8BAAoB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,sBAAS,CAAC,OAAO,CAAC,aAAa,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC;IAEF,uEAAuE;IACvE,2EAA2E;IAC3E,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAAoB,CAAC,kBAAkB,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAAoB,CAAC,mBAAmB,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAAoB,CAAC,iBAAiB,CAAC,CAAC;QAChE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAAoB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC,CAAC,EAEF,QAAQ,CAAC,uBAAY,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CAAC,UAAkC;IAC5E,MAAM,WAAW,GAAG,MAAM,IAAA,oBAAI,EAAS,qCAAqC,CAAC,EAAE,CAAC;IAEhF,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC,EACjB,cAAc,CAAC;QACb,EAAE,GAAG,EAAE,8BAAoB,CAAC,yBAAyB,EAAE,KAAK,EAAE,gBAAQ,CAAC,GAAG,EAAE,EAAE;QAC9E,EAAE,GAAG,EAAE,8BAAoB,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAAA,SAAM,GAAE,EAAE;QACnE,EAAE,GAAG,EAAE,8BAAoB,CAAC,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE;KAC3E,CAAC,EACF,QAAQ,CAAC,oCAAyB,CAAC,CACpC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,oBAAoB,CAAC,UAAkC,EAAE,WAAmB,EAAE,KAAa;IAC/G,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAA,WAAI,EAAC,CAAC,CAAO,EAAE,EAAE,CACf,IAAA,aAAM,EAAC,CAAC,EAAE,IAAA,WAAI,EAAC,cAAc,CAAC,8BAAoB,CAAC,yBAAyB,CAAC,EAAE,cAAc,CAAC,8BAAoB,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAqB,EAAE,EAAE;QACzL,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,gBAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,sBAAS,CAAC,OAAO,CAAC,eAAe,EAAE,4DAA4D,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE;gBAC1H,OAAO;gBACP,QAAQ;gBACR,IAAI,EAAE,gBAAQ,CAAC,GAAG,EAAE;gBACpB,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,EACD,IAAA,WAAI,EAAC,CAAC,CAAO,EAAE,EAAE,CACf,IAAA,aAAM,EAAC,CAAC,EAAE,cAAc,CAAC,8BAAoB,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,UAAkB,EAAE,EAAE;QAChG,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAS,CAAC,OAAO,CAAC,eAAe,EAAE,wDAAwD,EAAE;gBACrG,KAAK;gBACL,UAAU;gBACV,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,EACD,cAAc,CAAC,WAAW,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAAC,QAAgB;IAC7C,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,OAAO,IAAA,aAAM,EACX,IAAA,WAAI,EAAC,IAAA,wBAAQ,EAAC,eAAe,EAAE,gCAAgB,CAAC,EAAE,KAAK,CAAC,EACxD,IAAA,WAAI,EAAC,IAAA,wBAAQ,EAAC,0BAA0B,EAAE,0CAA0B,CAAC,EAAE,WAAW,CAAC,EAEnF,IAAA,WAAI,EAAC,KAAK,EAAE,EAAE,SAAS,EAA6C,EAAE,EAAE;YACtE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC;QAEF,kBAAkB;QAClB,CAAC,EAAE,GAAG,EAA6B,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC1D,CAAC,SAAiB,EAAE,EAAE,CAAC,IAAA,aAAM,EAAC,CAAC,EAAE,IAAA,aAAO,EAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,cAAc,CAAC,8BAAoB,CAAC,2BAA2B,EAAE,gBAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,8BAAmB,CAAC,CAAC,CAClM,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,cAAc,CAAC,UAAkC;IACrE,OAAO,MAAM,IAAA,aAAM,EAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,4CAAmB,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,QAAgB;IAC5C,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,KAAK,EAAE,CAAO,EAAoB,EAAE;QACzC,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE,mBAAmB;QACnB,OAAO,MAAM,IAAA,aAAM,EAAC,IAAA,wBAAQ,EAAC,eAAe,EAAE,gCAAgB,CAAC,EAAE,KAAK,EAAE,IAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxI,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,KAAK,CAAC,UAAkC,EAAE,QAAgB;IAC9E,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,MAAM,IAAA,aAAM,EACjB,YAAY,CAAC,UAAU,CAAC,EACxB,IAAA,aAAM,EACJ,CAAC,CAAO,EAAE,EAAE;QACV,OAAO,IAAA,aAAM,EAAC,IAAA,wBAAQ,EAAC,WAAW,EAAE,4BAAY,CAAC,EAAE,KAAK,EAAE,KAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,IAAA,aAAO,EAAO,EAAE,WAAW,EAAE,gBAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,qBAAU,CAAC,CAAC,CAAC;IACjM,CAAC,EACD,CAAC,GAAG,EAAE,CAAO,EAAE,EAAE;QACf,OAAO,IAAA,aAAM,EACX,GAAG,EAAE,CAAC,CAAC;QAEP,6BAA6B;QAC7B,QAAQ,CAAC,oCAAe,EAAE,GAAG,CAAC;QAE9B,2BAA2B;QAC3B,GAAG,EAAE;YACH,MAAM,GAAG,CAAC;QACZ,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":";;;;;;AA0DA,4CAWC;AASD,gDAEC;AASD,8BAUC;AAWD,wCAqBC;AASD,wCAOC;AASD,kCA0BC;AASD,4BAKC;AAQD,oCAKC;AAUD,sBAQC;AASD,oCAQC;AAiBD,gDASC;AAwBD,4BAEC;AAQD,gCAIC;AAqCD,wBAuDC;AAQD,gCAeC;AAUD,sBASC;AAUD,wBASC;AAWD,kBA4BC;AASD,sBAsBC;AASD,sDAYC;AAUD,oDAqDC;AAkCD,wCAuCC;AAQD,wCAEC;AASD,sCAWC;AAYD,sBAuCC;AAjwBD,sCAAgD;AAChD,wCAA6O;AAC7O,oDAAuB;AACvB,0CAAiD;AACjD,0CAAqC;AACrC,8CAAwE;AACxE,0DAAwD;AACxD,gDAAkO;AAClO,oCAA8C;AAC9C,0DAAuD;AAEvD,mDAAuI;AACvI,iCAAiC;AACjC,oDAAgD;AAChD,mCAAqD;AACrD,+BAAoC;AACpC,oEAA8D;AAC9D,0EAAoE;AACpE,4EAAsE;AAEtE,IAAY,OAwBX;AAxBD,WAAY,OAAO;IACjB,2DAAe,CAAA;IAEf,2DAAe,CAAA;IAEf,uGAAqC,CAAA;IAErC,6DAAgB,CAAA;IAEhB,uEAAqB,CAAA;IAErB,+DAAiB,CAAA;IAEjB,uDAAa,CAAA;IAEb,qEAAoB,CAAA;IAEpB,6EAAwB,CAAA;IAExB,yEAAsB,CAAA;IAEtB,oEAAmB,CAAA;IAEnB,sDAAY,CAAA;AACd,CAAC,EAxBW,OAAO,uBAAP,OAAO,QAwBlB;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,SAAgB,gBAAgB;IAC9B,OAAO,IAAA,aAAM,EACX,IAAA,WAAI,EAAC,IAAA,oBAAI,EAAS,iBAAiB,CAAC,EAAE,IAAA,oBAAI,EAAS,iBAAiB,CAAC,CAAC,EACtE,CAAC,CAAC,UAAU,EAAE,UAAU,CAAmB,EAAE,EAAE;QAC7C,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAE3E,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChB,CAAC,EACD,CAAC,CAAC,UAAU,EAAE,UAAU,CAAmB,EAAE,EAAE,CAAC,cAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CACzG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,IAAc;IAC/C,OAAO,GAAG,EAAE,CAAC,cAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,IAA4B;IACpD,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,IAAI,EAAE,CAAC,cAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,IAAI,EAAE,CAAC,cAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAAC,IAA4C,EAAE,QAAa,IAAI;IAC5F,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAI,sBAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,IAAA,gBAAS,GAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAE5J,KAAK,CAAC,OAAO,CAAC,CAAC,CAAuC,EAAE,EAAE;YACxD,gBAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,MAAM,IAAA,aAAM,EACV,CAAC,EAED,IAAA,WAAI,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAC/B,QAAQ,CAAC,0CAAkB,EAAE,GAAG,EAAE;YAChC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAuC,EAAE,EAAE;gBAC3D,OAAO,gBAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAI,sBAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5I,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAI,sBAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,iCAAiC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;QAE3J,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,WAAkK;IAO5L,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,OAAO,IAAA,aAAM,EAAO,IAAA,WAAI,EAAC,IAAA,oBAAI,EAAC,uBAAuB,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC,EAAE,IAAA,WAAI,EAAC,IAAA,oBAAI,EAAC,cAAc,WAAW,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAA2C,EAAE,EAAE;YAC3M,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,IAAI,sBAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,kBAAkB,WAAW,6CAA6C,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACnK,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAC5F,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAE1F,OAAO,CACL,QAAQ,CAAC,OAAO;gBAChB,IAAA,uBAAe,EAAC;oBACd,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;oBACb,UAAU;oBACV,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;oBACjB,GAAG,EAAE,aAAa,WAAW,EAAE;oBAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,QAAQ,CAAC,KAA6B,EAAE,GAAG,IAAW;IACpE,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,IAAA,WAAG,EAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,IAAoB;IAC/C,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,IAAA,aAAM,EAAC,CAAC,EAAE,IAAA,aAAO,EAAO,IAAI,CAAC,EAAE,QAAQ,CAAC,sBAAW,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,KAAK,CAAC,UAAkC;IACtD,MAAM,EAAE,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAErE,IAAI,EAAE,YAAY,cAAI,EAAE,CAAC;QACvB,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,cAAI,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,UAAkC;IAC7D,MAAM,EAAE,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,eAAQ,GAAE,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAErE,IAAI,EAAE,YAAY,kBAAQ,EAAE,CAAC;QAC3B,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,GAAG,EAAE,CAAC,kBAAQ,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,kBAAkB,CAAC,IAAmB;IAC1D,MAAM,MAAM,GAAG,gBAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAElD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAQ,EAAC,cAAc,EAAE,+BAAe,CAAC,EAAE,CAAC;IACnE,MAAM,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB;IACvB,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AAEH;;;;;GAKG;AACI,KAAK,UAAU,QAAQ,CAAC,UAAkC;IAC/D,OAAO,IAAA,aAAM,EAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,wBAAa,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACxH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,UAAU,CAAC,UAAkC;IACjE,6EAA6E;IAC7E,4CAA4C;IAC5C,OAAO,IAAA,aAAM,EAAC,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,QAAQ,CAAC,0BAAe,CAAC,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;AACjJ,CAAC;AAOD;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,OAAE,CAAC,GAAG,CAAC,6BAAa,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,CAAqB,IAAI,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,KAAa,EAAE,QAAgB,EAAE,KAAe,EAAE,EAAW,EAAE,QAAiC;IAC1I,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAQ,EAAmB,eAAe,EAAE,gCAAgB,CAAC,EAAE,CAAC;IAExF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,gBAAS,GAAE,EAAE,IAAA,kBAAW,EAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxF,KAAK,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3E,QAAQ,GAAG,IAAA,iBAAU,EACnB,IAAA,YAAK,GAAE,EACP,IAAA,eAAQ,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CACrC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAExB,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEjD,OAAO,IAAA,aAAM;IACX,cAAc;IACd,GAAG,EAAE,CACH,OAAO,CAAC,OAAO,CACb,IAAI,cAAI,CAAC;QACP,EAAE,EAAE,EAAE;QACN,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,KAAK;QACX,YAAY,EAAE,gBAAQ,CAAC,GAAG,EAAE;QAC5B,SAAS,EAAE,gBAAQ,CAAC,GAAG,EAAE;QACzB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,IAAA,SAAM,GAAE;KACf,CAAC,CACH;IAEH,+BAA+B;IAC/B,CAAC,CAAO,EAAE,EAAE,CAAC,IAAA,aAAM,EAAC,CAAC,EAAE,GAAG,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;IAEjF,eAAe;IACf,IAAA,aAAO,GAAE,EAET,IAAA,cAAO,EACL,GAAG,EAAE,CAAC,QAAQ,KAAK,SAAS,EAC5B,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAChG,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,CAAC,CACrB;IAED,8BAA8B;IAC9B,CAAC,CAAO,EAAE,EAAE,CAAC,IAAA,aAAM,EAAC,CAAC,EAAE,GAAG,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;IAEhF,aAAa;IACb,QAAQ,CAAC,sBAAW,EAAE,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAE9C,aAAa;IACb,IAAA,WAAI,EAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAE5B,4EAA4E;IAC5E,CAAC,CAAO,EAAE,EAAE;QACV,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,UAAU,CAAC,UAAkC;IACjE,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAA,WAAI,EAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAE9B,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,sDAAsD;IACtD,gBAAgB,EAAE,EAElB,QAAQ,CAAC,sBAAW,CAAC,EACrB,WAAW,CAAC,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,KAAK,CAAC,UAAkC,EAAE,IAAY;IAC1E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,gBAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAC7D,YAAY,EAAE,EACd,QAAQ,CAAC,0BAAe,EAAE,IAAI,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,MAAM,CAAC,UAAkC,EAAE,IAAY;IAC3E,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC,EACjB,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EACpE,YAAY,EAAE,EACd,QAAQ,CAAC,0BAAe,EAAE,IAAI,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,GAAG,CAAC,UAAkC,EAAE,MAAe,EAAE,QAAiB;IAC9F,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,IAAA,iBAAU,EAAC,IAAA,UAAG,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxF,MAAM,GAAG,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,WAAW,CAAC,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE/E,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC,EACjB,CAAC,CAAO,EAAE,EAAE;QACV,IAAI,CAAC,CAAC,QAAQ,CAAC,8BAAoB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,sBAAS,CAAC,OAAO,CAAC,aAAa,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,CAAC,CAAC;IACX,CAAC,EACD,cAAc,CAAC;QACb,EAAE,GAAG,EAAE,8BAAoB,CAAC,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE;QAChE,EAAE,GAAG,EAAE,8BAAoB,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;QAC5D,EAAE,GAAG,EAAE,8BAAoB,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE;QAC7D,EAAE,GAAG,EAAE,8BAAoB,CAAC,mBAAmB,EAAE,KAAK,EAAE,gBAAQ,CAAC,GAAG,EAAE,EAAE;KACzE,CAAC;IAEF,4EAA4E;IAC5E,2EAA2E;IAC3E,wCAAwC;IACxC,gBAAgB,EAAE,EAElB,QAAQ,CAAC,qBAAU,CAAC,EACpB,WAAW,CAAC,QAAQ,CAAC,CACtB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,KAAK,CAAC,UAAkC;IAC5D,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC;IAEjB,yEAAyE;IACzE,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,8BAAoB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,sBAAS,CAAC,OAAO,CAAC,aAAa,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC;IAEF,uEAAuE;IACvE,2EAA2E;IAC3E,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAAoB,CAAC,kBAAkB,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAAoB,CAAC,mBAAmB,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAAoB,CAAC,iBAAiB,CAAC,CAAC;QAChE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAAoB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC,CAAC,EAEF,QAAQ,CAAC,uBAAY,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CAAC,UAAkC;IAC5E,MAAM,WAAW,GAAG,MAAM,IAAA,oBAAI,EAAS,qCAAqC,CAAC,EAAE,CAAC;IAEhF,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC,EACjB,cAAc,CAAC;QACb,EAAE,GAAG,EAAE,8BAAoB,CAAC,yBAAyB,EAAE,KAAK,EAAE,gBAAQ,CAAC,GAAG,EAAE,EAAE;QAC9E,EAAE,GAAG,EAAE,8BAAoB,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAAA,SAAM,GAAE,EAAE;QACnE,EAAE,GAAG,EAAE,8BAAoB,CAAC,wBAAwB,EAAE,KAAK,EAAE,WAAW,EAAE;KAC3E,CAAC,EACF,QAAQ,CAAC,oCAAyB,CAAC,CACpC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,oBAAoB,CAAC,UAAkC,EAAE,WAAmB,EAAE,KAAa;IAC/G,OAAO,IAAA,aAAM,EACX,KAAK,CAAC,UAAU,CAAC;IAEjB,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,mEAAmE;IACnE,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,QAAQ,CAAC,8BAAoB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,sBAAS,CAAC,OAAO,CAAC,aAAa,EAAE,wCAAwC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,sBAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,4CAA4C,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC,CAAC,EAEF,IAAA,WAAI,EAAC,CAAC,CAAO,EAAE,EAAE,CACf,IAAA,aAAM,EAAC,CAAC,EAAE,IAAA,WAAI,EAAC,cAAc,CAAC,8BAAoB,CAAC,yBAAyB,CAAC,EAAE,cAAc,CAAC,8BAAoB,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAqB,EAAE,EAAE;QACzL,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,gBAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,sBAAS,CAAC,OAAO,CAAC,eAAe,EAAE,4DAA4D,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE;gBAC1H,OAAO;gBACP,QAAQ;gBACR,IAAI,EAAE,gBAAQ,CAAC,GAAG,EAAE;gBACpB,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,EACD,IAAA,WAAI,EAAC,CAAC,CAAO,EAAE,EAAE,CACf,IAAA,aAAM,EAAC,CAAC,EAAE,cAAc,CAAC,8BAAoB,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,UAAkB,EAAE,EAAE;QAChG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,sBAAS,CAAC,OAAO,CAAC,eAAe,EAAE,wDAAwD,EAAE;gBACrG,KAAK;gBACL,UAAU;gBACV,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,EACD,cAAc,CAAC,WAAW,CAAC;IAE3B,kEAAkE;IAClE,qEAAqE;IACrE,uEAAuE;IACvE,IAAA,WAAI,EAAC,KAAK,EAAE,CAAO,EAAE,EAAE;QACrB,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAAoB,CAAC,oBAAoB,CAAC,CAAC;QACnE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAAoB,CAAC,yBAAyB,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAAoB,CAAC,wBAAwB,CAAC,CAAC;QACvE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAAoB,CAAC,cAAc,CAAC,CAAC;IAC/D,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;SAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;SACf,MAAM,EAAE,CAAC;IACZ,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;SAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;SACf,MAAM,EAAE,CAAC;IAEZ,2EAA2E;IAC3E,+DAA+D;IAC/D,OAAO,IAAA,wBAAe,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAAC,QAAgB;IAC7C,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,OAAO,IAAA,aAAM,EACX,IAAA,WAAI,EAAC,IAAA,wBAAQ,EAAC,eAAe,EAAE,gCAAgB,CAAC,EAAE,KAAK,CAAC,EACxD,IAAA,WAAI,EAAC,IAAA,wBAAQ,EAAC,0BAA0B,EAAE,0CAA0B,CAAC,EAAE,WAAW,CAAC,EAEnF,IAAA,WAAI,EAAC,KAAK,EAAE,EAAE,SAAS,EAA6C,EAAE,EAAE;YACtE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC;QAEF,kBAAkB;QAClB,CAAC,EAAE,GAAG,EAA6B,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC1D,CAAC,SAAiB,EAAE,EAAE,CACpB,IAAA,aAAM,EACJ,CAAC,EACD,IAAA,aAAO,EAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EACtC,cAAc,CAAC;YACb,EAAE,GAAG,EAAE,8BAAoB,CAAC,2BAA2B,EAAE,KAAK,EAAE,gBAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;YAExF,8DAA8D;YAC9D,gEAAgE;YAChE,EAAE,GAAG,EAAE,8BAAoB,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE;YAC3D,EAAE,GAAG,EAAE,8BAAoB,CAAC,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE;SACnE,CAAC;QAEF,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,gEAAgE;QAChE,gBAAgB,EAAE,EAElB,QAAQ,CAAC,8BAAmB,CAAC,CAC9B,CACJ,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,cAAc,CAAC,UAAkC;IACrE,OAAO,MAAM,IAAA,aAAM,EAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,4CAAmB,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,QAAgB;IAC5C,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,KAAK,EAAE,CAAO,EAAoB,EAAE;QACzC,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE,mBAAmB;QACnB,OAAO,MAAM,IAAA,aAAM,EAAC,IAAA,wBAAQ,EAAC,eAAe,EAAE,gCAAgB,CAAC,EAAE,KAAK,EAAE,IAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxI,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,KAAK,CAAC,UAAkC,EAAE,QAAgB;IAC9E,QAAQ,GAAG,IAAA,iBAAU,EAAC,IAAA,YAAK,GAAE,EAAE,IAAA,iBAAU,GAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,MAAM,IAAA,aAAM,EACjB,YAAY,CAAC,UAAU,CAAC,EACxB,IAAA,aAAM,EACJ,CAAC,CAAO,EAAE,EAAE;QACV,OAAO,IAAA,aAAM,EACX,KAAK,IAAI,EAAE;YACT,kEAAkE;YAClE,qDAAqD;YACrD,MAAM,kBAAkB,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,IAAA,wBAAQ,EAAC,WAAW,EAAE,4BAAY,CAAC,EAAE,CAAC;QAC/C,CAAC,EACD,KAAK,EAAE,KAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EACpE,IAAA,aAAO,EAAO,EAAE,WAAW,EAAE,gBAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,EAC9C,qBAAqB,EAAE,EACvB,QAAQ,CAAC,qBAAU,CAAC,CACrB,CAAC;IACJ,CAAC,EACD,CAAC,GAAG,EAAE,CAAO,EAAE,EAAE;QACf,OAAO,IAAA,aAAM,EACX,GAAG,EAAE,CAAC,CAAC;QAEP,6DAA6D;QAC7D,uBAAuB;QACvB,sBAAsB,CAAC,GAAG,CAAC;QAE3B,6BAA6B;QAC7B,QAAQ,CAAC,oCAAe,EAAE,GAAG,CAAC;QAE9B,2BAA2B;QAC3B,GAAG,EAAE;YACH,MAAM,GAAG,CAAC;QACZ,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAAC,CAAO;IACvC,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,8BAAoB,CAAC,uBAAuB,CAAC,CAAC;IAExE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,YAAY,gBAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAElF,IAAI,WAAW,CAAC,OAAO,IAAI,WAAW,GAAG,gBAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,sBAAS,CAAC,uCAAuB,CAAC,yBAAyB,EAAE,uEAAuE,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE;YACnK,IAAI,EAAE,CAAC;YACP,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB;IAC5B,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,EAAE,QAAQ,CAAC;QAEzB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,8BAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,8BAAoB,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAE5E,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,8BAAoB,CAAC,mBAAmB,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,MAAM,CAAC,8BAAoB,CAAC,uBAAuB,CAAC,CAAC;QAEhE,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAAC,GAAY;IAC1C,OAAO,KAAK,EAAE,CAAO,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,EAAE,QAAQ,CAAC;QAEzB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,GAAG,YAAY,sBAAS,IAAI,GAAG,CAAC,IAAI,KAAK,uCAAuB,CAAC,yBAAyB,EAAE,CAAC;YAC/F,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAA,oBAAI,EAAS,kCAAkC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,IAAA,oBAAI,EAAS,2BAA2B,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAE/E,IAAI,CAAC,UAAU,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,8BAAoB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAEjF,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,8BAAoB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,CAAC,8BAAoB,CAAC,uBAAuB,CAAC,GAAG,gBAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAC7G,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,8BAAoB,CAAC,mBAAmB,CAAC,GAAG,QAAQ,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAEpB,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC"}

package/lib/cjs/config/rbac.d.ts

@@ -178,6 +178,15 @@ declare const rbac: {
              * How long we should wait to reset password ( after this time reset token is invalid )
              */
             passwordResetWaitTime: number;
+            /**
+             * Consecutive failed logins that lock the account. 0 disables throttling.
+             */
+            blockAfterAttempts: number;
+            /**
+             * How long the account stays locked once `blockAfterAttempts` is hit,
+             * in seconds.
+             */
+            lockoutTime: number;
         };
         user: {
             profile: string;
@@ -194,7 +203,32 @@ declare const rbac: {
                 ttl: number;
                 maxLifetime: number;
             };
-            cookie: {};
+            /**
+             * Session cookie. Passed through to express, EXCEPT:
+             *  - `httpOnly` is forced on and cannot be configured away,
+             *  - `secure` and `sameSite` default to `true` / `'strict'`,
+             *  - `name` sets the cookie name ( default `ssid` ),
+             *  - `hostPrefix: true` emits it as `__Host-<name>`, which additionally
+             *    forces `secure`, `path: '/'` and drops `domain`.
+             *
+             * Local http development needs `secure: false`; everything else should be
+             * left alone.
+             */
+            cookie: {
+                /**
+                 * Secure everywhere except local development.
+                 *
+                 * `NODE_ENV=production` is what a deployment sets, and there the cookie
+                 * must never leave over plain http. Anywhere else ( a developer running
+                 * the app on http://localhost ) the browser would simply drop a Secure
+                 * cookie and nobody could log in, so it is relaxed there and only
+                 * there.
+                 *
+                 * An application serving https outside production should set this back
+                 * to `true` in its own config.
+                 */
+                secure: boolean;
+            };
         };
         /**
          * System role is used to perform internal operations on users, like password reset, email change etc.

package/lib/cjs/config/rbac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../src/config/rbac.ts"],"names":[],"mappings":"AAcA,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA2LJ;;eAEG;;;;;YASH;;eAEG;;;;;;;;YASH;;;;eAIG;;;;;;;;QAWL;;WAEG;;QAEH;;;;;eAKO;;;8BAGiB,KAAK,CAAC,QAAQ,CAAC;6BAChB,KAAK,CAAC,QAAQ,CAAC;;;QAMtC;;WAEG;;QAGH;;;WAGG;;YAED;;;eAGG;6BACoB,MAAM,EAAE;;QAGjC;;;;;WAKG;;YAED;;;eAGG;;YAGH;;;eAGG;4BAC2B,MAAM,EAAE;;;CAG3C,CAAC;AAEF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../src/config/rbac.ts"],"names":[],"mappings":"AAcA,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA2LJ;;eAEG;;;;;YASH;;eAEG;;YAGH;;eAEG;;YAGH;;;eAGG;;;;;;;;YASH;;;;eAIG;;;;;;YAWH;;;;;;;;;;eAUG;;gBAED;;;;;;;;;;;mBAWG;;;;QAKP;;WAEG;;QAEH;;;;;eAKO;;;8BAGiB,KAAK,CAAC,QAAQ,CAAC;6BAChB,KAAK,CAAC,QAAQ,CAAC;;;QAMtC;;WAEG;;QAGH;;;WAGG;;YAED;;;eAGG;6BACoB,MAAM,EAAE;;QAGjC;;;;;WAKG;;YAED;;;eAGG;;YAGH;;;eAGG;4BAC2B,MAAM,EAAE;;;CAG3C,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/lib/cjs/config/rbac.js

@@ -187,6 +187,15 @@ const rbac = {
              * How long we should wait to reset password ( after this time reset token is invalid )
              */
             passwordResetWaitTime: 60 * 60,
+            /**
+             * Consecutive failed logins that lock the account. 0 disables throttling.
+             */
+            blockAfterAttempts: 5,
+            /**
+             * How long the account stays locked once `blockAfterAttempts` is hit,
+             * in seconds.
+             */
+            lockoutTime: 15 * 60,
         },
         user: {
             profile: "BasicProfileProvider"
@@ -200,11 +209,37 @@ const rbac = {
              */
             expiration: {
                 service: 'SlidingCappedExpiration',
-                ttl: 120, // minutes
-                maxLifetime: 1440, // minutes (SlidingCappedExpiration only)
+                // idle timeout — OWASP puts a low-risk application at 15-30 minutes
+                ttl: 30, // minutes
+                // hard ceiling on a single session's life, regardless of activity
+                maxLifetime: 480, // minutes (SlidingCappedExpiration only)
+            },
+            /**
+             * Session cookie. Passed through to express, EXCEPT:
+             *  - `httpOnly` is forced on and cannot be configured away,
+             *  - `secure` and `sameSite` default to `true` / `'strict'`,
+             *  - `name` sets the cookie name ( default `ssid` ),
+             *  - `hostPrefix: true` emits it as `__Host-<name>`, which additionally
+             *    forces `secure`, `path: '/'` and drops `domain`.
+             *
+             * Local http development needs `secure: false`; everything else should be
+             * left alone.
+             */
+            cookie: {
+                /**
+                 * Secure everywhere except local development.
+                 *
+                 * `NODE_ENV=production` is what a deployment sets, and there the cookie
+                 * must never leave over plain http. Anywhere else ( a developer running
+                 * the app on http://localhost ) the browser would simply drop a Secure
+                 * cookie and nobody could log in, so it is relaxed there and only
+                 * there.
+                 *
+                 * An application serving https outside production should set this back
+                 * to `true` in its own config.
+                 */
+                secure: process.env.NODE_ENV === 'production',
             },
-            // passthrough express cookie options
-            cookie: {},
         },
         /**
          * System role is used to perform internal operations on users, like password reset, email change etc.

package/lib/cjs/config/rbac.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../src/config/rbac.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAEvJ,4CAA4C;QAC5C,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC/J,CAAC;AACJ,CAAC;AAID,MAAM,IAAI,GAAG;IACX,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;IACD,KAAK,EAAE;QACL,OAAO,EAAE;YACP,OAAO,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAChD,aAAa,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACtD,UAAU,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACnD,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,WAAW,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACpD,UAAU,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACnD,mBAAmB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC5D,YAAY,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACrD,mBAAmB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC5D,yBAAyB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAClE,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,wBAAwB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACjE,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SAChE;QAED,6EAA6E;QAC7E,iDAAiD;QACjD,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,sBAAsB;gBAC/B,mBAAmB,EAAE,WAAW;gBAChC,mBAAmB,EAAE,aAAa;aACnC;SACF;KACF;IACD,IAAI,EAAE;QACJ,kBAAkB,EAAE,KAAK;QAEzB,KAAK,EAAE;YACL,UAAU,EAAE,uBAAuB;YAEnC,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,qCAAqC;gBAC/C,OAAO,EAAE,yBAAyB;aACnC;YAED,2DAA2D;YAC3D,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,oCAAoC;gBAC9C,OAAO,EAAE,2BAA2B;aACrC;YAED,MAAM,EAAE;gBACN,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,kCAAkC;gBAC5C,OAAO,EAAE,gBAAgB;aAC1B;YAED,QAAQ,EAAE;gBACR,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,oCAAoC;gBAC9C,OAAO,EAAE,kBAAkB;aAC5B;YAED,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,mCAAmC;gBAC7C,OAAO,EAAE,iBAAiB;aAC3B;YAED,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,uCAAuC;gBACjD,OAAO,EAAE,qBAAqB;aAC/B;YAED,eAAe,EAAE;gBACf,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,sCAAsC;gBAChD,OAAO,EAAE,kBAAkB;aAC5B;YAED,kBAAkB,EAAE;gBAClB,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,sCAAsC;gBAChD,OAAO,EAAE,gCAAgC;aAC1C;YAED,SAAS,EAAE;gBACT,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,qCAAqC;gBAC/C,OAAO,EAAE,mBAAmB;aAC7B;YAED,gDAAgD;YAChD,wCAAwC;YACxC,yDAAyD;YACzD,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,wCAAwC;gBAClD,OAAO,EAAE,iBAAiB;aAC3B;SACF;QACD,gDAAgD;QAChD,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE,eAAe;aAC7B;YACD;gBACE,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,sCAAsC;aACpD;SACF;QACD,MAAM,EAAE;YACN,KAAK,EAAE;gBACL,UAAU,EAAC;oBACT,UAAU,EAAE,CAAC,GAAG,CAAC;iBAClB;aACF;YAED,sDAAsD;YACtD,MAAM,EAAE;gBACN,OAAO,EAAE,CAAC,OAAO,CAAC;aACnB;YAED,aAAa,EAAE;gBACb,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;gBACD,eAAe,EAAE;oBACf,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;aACF;YACD,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC9B,YAAY,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;iBAC7C;gBACD,eAAe,EAAE;oBACf,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;aACF;YACD,KAAK,EAAE;gBACL,OAAO,EAAE,CAAC,aAAa,CAAC;aACzB;SACF;QACD,WAAW,EAAE,OAAO;QACpB,IAAI,EAAE;YACJ,OAAO,EAAE,sBAAsB;SAChC;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,uBAAuB;YAEhC,UAAU,EAAE;gBACV,OAAO,EAAE,iCAAiC;gBAC1C,IAAI,EAAE;oBACJ,mCAAmC;oBACnC,iCAAiC;oBAEjC,+DAA+D;oBAC/D,OAAO,EAAE,kBAAkB;oBAE3B,uFAAuF;oBACvF,6EAA6E;oBAE7E,+FAA+F;oBAC/F,6DAA6D;oBAE7D,+FAA+F;oBAC/F,mFAAmF;oBAEnF,IAAI,EAAE,QAAQ;iBACf;aACF;YAED;;eAEG;YAEH,UAAU,EAAE;gBACV,OAAO,EAAE,IAAI;gBAEb,aAAa;gBACb,sBAAsB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;aAC1C;YAED;;eAEG;YACH,qBAAqB,EAAE,EAAE,GAAG,EAAE;SAC/B;QACD,IAAI,EAAE;YACJ,OAAO,EAAE,sBAAsB;SAChC;QACD,OAAO,EAAE;YACP,OAAO,EAAE,oBAAoB;YAE7B;;;;eAIG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,yBAAyB;gBAClC,GAAG,EAAE,GAAG,EAAE,UAAU;gBACpB,WAAW,EAAE,IAAI,EAAE,yCAAyC;aAC7D;YAED,qCAAqC;YACrC,MAAM,EAAE,EAAE;SACX;QAED;;WAEG;QACH,UAAU,EAAE,QAAQ;QACpB;;;;;eAKO;QACP,OAAO,EAAE;YACP,MAAM,EAAE;gBACN,YAAY,EAAE,EAAqB;gBACnC,WAAW,EAAE,EAAqB;aACnC;SACF;QAID;;WAEG;QACH,UAAU,EAAE,MAAM;QAElB;;;WAGG;QACH,UAAU,EAAE;YACV;;;eAGG;YACH,eAAe,EAAE,EAAc;SAChC;QAED;;;;;WAKG;QACH,aAAa,EAAE;YACb;;;eAGG;YACH,eAAe,EAAE,IAAI;YAErB;;;eAGG;YACH,cAAc,EAAE,CAAC,QAAQ,CAAa;SACvC;KACF;CACF,CAAC;AAEF,kBAAe,IAAI,CAAC"}
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../src/config/rbac.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAEvJ,4CAA4C;QAC5C,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC/J,CAAC;AACJ,CAAC;AAID,MAAM,IAAI,GAAG;IACX,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;IACD,KAAK,EAAE;QACL,OAAO,EAAE;YACP,OAAO,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAChD,aAAa,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACtD,UAAU,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACnD,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,WAAW,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACpD,UAAU,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACnD,mBAAmB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC5D,YAAY,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACrD,mBAAmB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC5D,yBAAyB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAClE,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,eAAe,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACxD,wBAAwB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YACjE,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SAChE;QAED,6EAA6E;QAC7E,iDAAiD;QACjD,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,sBAAsB;gBAC/B,mBAAmB,EAAE,WAAW;gBAChC,mBAAmB,EAAE,aAAa;aACnC;SACF;KACF;IACD,IAAI,EAAE;QACJ,kBAAkB,EAAE,KAAK;QAEzB,KAAK,EAAE;YACL,UAAU,EAAE,uBAAuB;YAEnC,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,qCAAqC;gBAC/C,OAAO,EAAE,yBAAyB;aACnC;YAED,2DAA2D;YAC3D,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,oCAAoC;gBAC9C,OAAO,EAAE,2BAA2B;aACrC;YAED,MAAM,EAAE;gBACN,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,kCAAkC;gBAC5C,OAAO,EAAE,gBAAgB;aAC1B;YAED,QAAQ,EAAE;gBACR,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,oCAAoC;gBAC9C,OAAO,EAAE,kBAAkB;aAC5B;YAED,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,mCAAmC;gBAC7C,OAAO,EAAE,iBAAiB;aAC3B;YAED,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,uCAAuC;gBACjD,OAAO,EAAE,qBAAqB;aAC/B;YAED,eAAe,EAAE;gBACf,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,sCAAsC;gBAChD,OAAO,EAAE,kBAAkB;aAC5B;YAED,kBAAkB,EAAE;gBAClB,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,sCAAsC;gBAChD,OAAO,EAAE,gCAAgC;aAC1C;YAED,SAAS,EAAE;gBACT,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,qCAAqC;gBAC/C,OAAO,EAAE,mBAAmB;aAC7B;YAED,gDAAgD;YAChD,wCAAwC;YACxC,yDAAyD;YACzD,OAAO,EAAE;gBACP,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,wCAAwC;gBAClD,OAAO,EAAE,iBAAiB;aAC3B;SACF;QACD,gDAAgD;QAChD,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE,eAAe;aAC7B;YACD;gBACE,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,sCAAsC;aACpD;SACF;QACD,MAAM,EAAE;YACN,KAAK,EAAE;gBACL,UAAU,EAAC;oBACT,UAAU,EAAE,CAAC,GAAG,CAAC;iBAClB;aACF;YAED,sDAAsD;YACtD,MAAM,EAAE;gBACN,OAAO,EAAE,CAAC,OAAO,CAAC;aACnB;YAED,aAAa,EAAE;gBACb,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;gBACD,eAAe,EAAE;oBACf,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;aACF;YACD,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC9B,YAAY,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;iBAC7C;gBACD,eAAe,EAAE;oBACf,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;aACF;YACD,KAAK,EAAE;gBACL,OAAO,EAAE,CAAC,aAAa,CAAC;aACzB;SACF;QACD,WAAW,EAAE,OAAO;QACpB,IAAI,EAAE;YACJ,OAAO,EAAE,sBAAsB;SAChC;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,uBAAuB;YAEhC,UAAU,EAAE;gBACV,OAAO,EAAE,iCAAiC;gBAC1C,IAAI,EAAE;oBACJ,mCAAmC;oBACnC,iCAAiC;oBAEjC,+DAA+D;oBAC/D,OAAO,EAAE,kBAAkB;oBAE3B,uFAAuF;oBACvF,6EAA6E;oBAE7E,+FAA+F;oBAC/F,6DAA6D;oBAE7D,+FAA+F;oBAC/F,mFAAmF;oBAEnF,IAAI,EAAE,QAAQ;iBACf;aACF;YAED;;eAEG;YAEH,UAAU,EAAE;gBACV,OAAO,EAAE,IAAI;gBAEb,aAAa;gBACb,sBAAsB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;aAC1C;YAED;;eAEG;YACH,qBAAqB,EAAE,EAAE,GAAG,EAAE;YAE9B;;eAEG;YACH,kBAAkB,EAAE,CAAC;YAErB;;;eAGG;YACH,WAAW,EAAE,EAAE,GAAG,EAAE;SACrB;QACD,IAAI,EAAE;YACJ,OAAO,EAAE,sBAAsB;SAChC;QACD,OAAO,EAAE;YACP,OAAO,EAAE,oBAAoB;YAE7B;;;;eAIG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,yBAAyB;gBAElC,oEAAoE;gBACpE,GAAG,EAAE,EAAE,EAAE,UAAU;gBAEnB,kEAAkE;gBAClE,WAAW,EAAE,GAAG,EAAE,yCAAyC;aAC5D;YAED;;;;;;;;;;eAUG;YACH,MAAM,EAAE;gBACN;;;;;;;;;;;mBAWG;gBACH,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;aAC9C;SACF;QAED;;WAEG;QACH,UAAU,EAAE,QAAQ;QACpB;;;;;eAKO;QACP,OAAO,EAAE;YACP,MAAM,EAAE;gBACN,YAAY,EAAE,EAAqB;gBACnC,WAAW,EAAE,EAAqB;aACnC;SACF;QAID;;WAEG;QACH,UAAU,EAAE,MAAM;QAElB;;;WAGG;QACH,UAAU,EAAE;YACV;;;eAGG;YACH,eAAe,EAAE,EAAc;SAChC;QAED;;;;;WAKG;QACH,aAAa,EAAE;YACb;;;eAGG;YACH,eAAe,EAAE,IAAI;YAErB;;;eAGG;YACH,cAAc,EAAE,CAAC,QAAQ,CAAa;SACvC;KACF;CACF,CAAC;AAEF,kBAAe,IAAI,CAAC"}

package/lib/cjs/index.d.ts

@@ -16,6 +16,7 @@ export * from './session-codec.js';
 export * from './models/User.js';
 export * from './models/UserMetadata.js';
 export * from './migrations/RBACInitial_2022_06_28_01_13_00.js';
+export * from './migrations/RBACRegisteredAt_2026_07_28_00_00_00.js';
 export * from './events/index.js';
 export * from './actions.js';
 export * from './middleware.js';

package/lib/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,eAAe,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAc,YAAY,EAAkB,MAAM,aAAa,CAAC;AAIvE,OAAO,WAAW,CAAC;AACnB,OAAO,eAAe,CAAC;AACvB,OAAO,cAAc,CAAC;AACtB,OAAO,yBAAyB,CAAC;AACjC,OAAO,oBAAoB,CAAC;AAC5B,OAAO,gBAAgB,CAAC;AAGxB,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iDAAiD,CAAC;AAChE,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAG/B,QAAA,MAAQ,UAAU,sBAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AAErC,qBACa,gBAAiB,SAAQ,YAAY;IACzC,SAAS,IAAI,IAAI;CAwDzB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,eAAe,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAc,YAAY,EAAkB,MAAM,aAAa,CAAC;AAIvE,OAAO,WAAW,CAAC;AACnB,OAAO,eAAe,CAAC;AACvB,OAAO,cAAc,CAAC;AACtB,OAAO,yBAAyB,CAAC;AACjC,OAAO,oBAAoB,CAAC;AAC5B,OAAO,gBAAgB,CAAC;AAIxB,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iDAAiD,CAAC;AAChE,cAAc,sDAAsD,CAAC;AACrE,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAG/B,QAAA,MAAQ,UAAU,sBAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AAErC,qBACa,gBAAiB,SAAQ,YAAY;IACzC,SAAS,IAAI,IAAI;CA8DzB"}

package/lib/cjs/index.js

@@ -37,6 +37,7 @@ require("./session-expiration.js");
 require("./session-codec.js");
 require("./ownership.js");
 const User_js_1 = require("./models/User.js");
+const UserMetadata_js_1 = require("./models/UserMetadata.js");
 __exportStar(require("./interfaces.js"), exports);
 __exportStar(require("./auth.js"), exports);
 __exportStar(require("./password.js"), exports);
@@ -46,6 +47,7 @@ __exportStar(require("./session-codec.js"), exports);
 __exportStar(require("./models/User.js"), exports);
 __exportStar(require("./models/UserMetadata.js"), exports);
 __exportStar(require("./migrations/RBACInitial_2022_06_28_01_13_00.js"), exports);
+__exportStar(require("./migrations/RBACRegisteredAt_2026_07_28_00_00_00.js"), exports);
 __exportStar(require("./events/index.js"), exports);
 __exportStar(require("./actions.js"), exports);
 __exportStar(require("./middleware.js"), exports);
@@ -59,6 +61,14 @@ const { Permission } = accesscontrol_1.default;
 exports.Permission = Permission;
 let RbacBootstrapper = class RbacBootstrapper extends di_1.Bootstrapper {
     bootstrap() {
+        /**
+         * Credential-bearing metadata never leaves the server in a dehydrated user.
+         * Seeded here rather than as the field initialiser so an application ( or
+         * another package, eg. rbac-http-user adding its 2FA keys ) can append to
+         * the list without having to restate this one. De-duplicated because tests
+         * run bootstrappers repeatedly against a live static.
+         */
+        UserMetadata_js_1.UserMetadataBase._hiddenKeys = [...new Set([...UserMetadata_js_1.UserMetadataBase._hiddenKeys, ...User_js_1.USER_SECURITY_METADATA_KEYS])];
         const ac = new accesscontrol_2.AccessControl();
         di_1.DI.register(ac).asValue('AccessControl');
         di_1.DI.once('di.resolved.Configuration', (container, configuration) => {
@@ -79,7 +89,7 @@ let RbacBootstrapper = class RbacBootstrapper extends di_1.Bootstrapper {
             return User_js_1.User.where({
                 Uuid: userUUID,
             })
-                .populate("Metadata")
+                .populate('Metadata')
                 .isActiveUser()
                 .firstOrFail();
         }).as('RbacUserFactory');
@@ -94,7 +104,7 @@ let RbacBootstrapper = class RbacBootstrapper extends di_1.Bootstrapper {
             });
         }).as('RbacGuestUserFactory');
         di_1.DI.register(async (_) => {
-            const system = await User_js_1.User.select().where("Role", ["system"]).where("Login", "__system__").firstOrFail();
+            const system = await User_js_1.User.select().where('Role', ['system']).where('Login', '__system__').firstOrFail();
             return system;
         }).as('RbacSystemUserFactory');
         di_1.DI.register(async (_, role) => {