@spinajs/rbac 2.0.521 → 2.0.522

package/lib/cjs/actions.d.ts

@@ -1,109 +1,86 @@
 import { User } from './models/User.js';
 import { Constructor } from '@spinajs/di';
 import { UserEvent } from './events/UserEvent.js';
-export declare enum E_CODES {
-    E_TOKEN_EXPIRED = 0,
-    E_TOKEN_INVALID = 1,
-    E_PASSWORD_DOES_NOT_MEET_REQUIREMENTS = 2,
-    E_USER_NOT_FOUND = 3,
-    E_USER_ALREADY_EXISTS = 4,
-    E_USER_NOT_ACTIVE = 5,
-    E_USER_BANNED = 6,
-    E_METADATA_NOT_FOUND = 7,
-    E_METADATA_NOT_POPULATED = 8,
-    E_EMAIL_NOT_CONFIGURED = 9,
-    E_NO_EMAIL_TEMPLATE = 10,
-    E_NOT_LOGGED = 11
-}
+import { DateTime } from 'luxon';
 /**
  * ===============================================
- *  HELPER FUNCTIONS
+ *  FUNDAMENTALS ( imperative helpers )
  * ===============================================
  */
 /**
+ * Resolves a user by identifier with metadata populated.
+ * If a {@link User} instance is passed it is returned as-is; otherwise the user is
+ * looked up by id, uuid, email, or login and its metadata relation is populated.
  *
- * Gets system user account
- *
- * @returns system user
+ * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  */
-export declare function _get_system_user(): Promise<unknown>;
+export declare function getUser(identifier: number | string | User): Promise<User>;
 /**
+ * Unsafe user retrieval. It does not check for rbac permission, so this
+ * function can read ANY user in system. USE IT CAREFULLY
  *
- * Gets users by role helper func.
- *
- * @param role user role
- * @returns
+ * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  */
-export declare function _get_users_by_role(role: string[]): () => import("@spinajs/orm").ISelectQueryBuilder<User[]> & import("./index.js").UserQueryScopes;
+export declare function getUserUnsafe(identifier: number | string | User): Promise<User>;
 /**
+ * Gets system user account
  *
- * Gets rbac user model
+ * @returns system user
+ */
+export declare function getSystemUser(): Promise<User>;
+/**
+ * Gets users by role.
  *
- * @param user
- * @returns
+ * @param role user roles
  */
-export declare function _get_user(user: User | number | string): () => Promise<User>;
+export declare function getUsersByRole(role: string[]): Promise<User[]>;
 /**
  * Sets metadata key-value pairs on a user.
  * Accepts either an array of `{ key, value }` objects or a single metadata key string with a separate value.
  * Emits a {@link UserMetadataChange} event after the metadata is persisted.
  *
+ * @param u - user to modify
  * @param meta - metadata key (string) or array of `{ key, value }` entries to set
  * @param value - value to assign when `meta` is a single key string (default: `null`)
- * @returns a function that receives a {@link User} and returns the updated user
  */
-export declare function _set_user_meta(meta: string | {
+export declare function setUserMeta(u: User, meta: string | {
     key: string;
     value: any;
-}[], value?: any): (u: User) => Promise<User>;
+}[], value?: any): Promise<User>;
 /**
  * Retrieves a single metadata value from a user by key.
  * Throws if the user's metadata has not been populated or the requested key does not exist.
  *
+ * @param u - user to read from
  * @param key - metadata key to retrieve
- * @returns a function that receives a {@link User} and returns the metadata value
- */
-export declare function _get_user_meta(key: string): (u: User) => Promise<any>;
-/**
- * Helper function for sending user notification emails
- * Templates are defined in rbac configuration
- *
- * @param cfgTemplate
- * @returns
  */
-export declare function _user_email(cfgTemplate: 'changePassword' | 'created' | 'confirm' | 'deactivated' | 'activated' | 'deleted' | 'unbanned' | 'banned' | 'passwordWillExpire' | 'passwordExpired'): (u: User) => Promise<User>;
+export declare function getUserMeta(u: User, key: string): Promise<any>;
 /**
- * Emits a user-related event through the queue service.
- *
- * @param event - constructor of the {@link UserEvent} subclass to emit
- * @param args - additional arguments forwarded to the event constructor
- * @returns a function that receives a {@link User}, emits the event, and returns the user
+ * Sends a user notification email. Templates are defined in rbac configuration.
+ *
+ * The email send result is deliberately discarded - actions end with this step
+ * and must resolve with the User, not with an EmailSend job.
+ *
+ * @param u - recipient
+ * @param cfgTemplate - which `rbac.email.*` entry describes the message
+ * @param model - extra template variables merged over the user's own fields.
+ *   Given as a FUNCTION of the user so a caller can compute them from the row it
+ *   has just written ( the password-reset token is the case that needs it ).
+ *   Nothing here is persisted and nothing is logged: whatever it carries goes
+ *   straight into the rendered message.
  */
-export declare function _user_ev(event: Constructor<UserEvent>, ...args: any[]): (u: User) => Promise<User>;
+export declare function sendUserEmail(u: User, cfgTemplate: 'changePassword' | 'created' | 'confirm' | 'deactivated' | 'activated' | 'deleted' | 'unbanned' | 'banned' | 'passwordWillExpire' | 'passwordExpired', model?: (u: User) => Promise<{
+    [key: string]: unknown;
+}> | {
+    [key: string]: unknown;
+}): Promise<User>;
 /**
  * Persists partial changes to a user record and emits a {@link UserChanged} event.
  *
+ * @param u - user to update
  * @param data - optional partial user fields to merge into the existing record
- * @returns a function that receives a {@link User}, applies the update, and returns the user
- */
-export declare function _user_update(data?: Partial<User>): (u: User) => Promise<User>;
-/**
- * Resolves a user by identifier with metadata populated.
- * If a {@link User} instance is passed it is returned as-is; otherwise the user is
- * looked up by id, uuid, email, or login and its metadata relation is populated.
- *
- * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
- * @returns a thunk that resolves to the {@link User}
  */
-export declare function _user(identifier: number | string | User): () => Promise<User>;
-/**
- * Unsafe user retrieval. It does not chack for rbac permission, to this
- * function can read ANY user in system. USE IT CAREFULLY
- *
- * @param identifier
- * @returns
- */
-export declare function _user_unsafe(identifier: number | string | User): () => Promise<User>;
+export declare function updateUser(u: User, data?: Partial<User>): Promise<User>;
 /**
  * Destroys every session belonging to a user, on every device.
  *
@@ -120,6 +97,54 @@ export declare function _user_unsafe(identifier: number | string | User): () =>
  * @param user - the user whose sessions are destroyed, or their numeric id
  */
 export declare function revokeUserSessions(user: User | number): Promise<void>;
+/**
+ * ===============================================
+ *  FP WRAPPERS ( kept for compatibility and for use in chains )
+ * ===============================================
+ */
+/**
+ * Thunk form of {@link getSystemUser}.
+ */
+export declare function _get_system_user(): Promise<User>;
+/**
+ * Thunk form of {@link getUsersByRole}.
+ */
+export declare function _get_users_by_role(role: string[]): () => Promise<User[]>;
+/**
+ * Gets rbac user model by uuid or id, WITHOUT metadata populated.
+ */
+export declare function _get_user(user: User | number | string): () => Promise<User>;
+/**
+ * Thunk form of {@link getUser}.
+ */
+export declare function _user(identifier: number | string | User): () => Promise<User>;
+/**
+ * Thunk form of {@link getUserUnsafe}.
+ */
+export declare function _user_unsafe(identifier: number | string | User): () => Promise<User>;
+/**
+ * Chain step form of {@link setUserMeta}.
+ */
+export declare function _set_user_meta(meta: string | {
+    key: string;
+    value: any;
+}[], value?: any): (u: User) => Promise<User>;
+/**
+ * Chain step form of {@link getUserMeta}.
+ */
+export declare function _get_user_meta(key: string): (u: User) => Promise<any>;
+/**
+ * Chain step form of {@link sendUserEmail}.
+ */
+export declare function _user_email(cfgTemplate: Parameters<typeof sendUserEmail>[1], model?: Parameters<typeof sendUserEmail>[2]): (u: User) => Promise<User>;
+/**
+ * Chain step: emits a user-related event and forwards the user.
+ */
+export declare function _user_ev(event: Constructor<UserEvent>, ...args: any[]): (u: User) => Promise<User>;
+/**
+ * Chain step form of {@link updateUser}.
+ */
+export declare function _user_update(data?: Partial<User>): (u: User) => Promise<User>;
 /**
  * ===============================================
  * USER ACTIONS
@@ -143,24 +168,119 @@ export declare function deactivate(identifier: number | string | User): Promise<
  * Middleware signature used by the `create` action's `beforeCreate` / `afterCreate` hooks.
  */
 export type CreateMiddleware = (u: User) => Promise<User> | User;
+/**
+ * Optional inputs of the {@link create} action.
+ */
+export interface ICreateUserOptions {
+    /**
+     * Plain-text password. Omit it and a random one is generated, the account is
+     * handed to its owner by a password-reset link, and the generated value is
+     * returned for a caller that needs it ( the CLI prints it ).
+     */
+    password?: string;
+    /** Explicit user id. Useful when migrating accounts from another system. */
+    id?: number;
+    /** Key-value metadata attached to the new account. */
+    metadata?: {
+        [key: string]: any;
+    };
+}
+/**
+ * The roles a request denotes, whether it arrives as one name or a list.
+ *
+ * Trimmed, stripped of blanks and de-duplicated. Order is preserved so a caller
+ * that treats the first entry as the primary role keeps that meaning.
+ *
+ * De-duplication is not cosmetic: every downstream guard is charged per entry,
+ * so `['user', ' user ']` costs two checks for one role.
+ *
+ * @param role - a single role name or a list of them
+ */
+export declare function roleList(role?: string | string[]): string[];
+/**
+ * Refuses a role the application has not configured.
+ *
+ * A role counts as configured if it either holds grants in the resolved
+ * {@link AccessControl} instance or is merely declared in `rbac.roles` - the
+ * same definition of "known" `DefaultRoleGuard` (`@spinajs/rbac-http-admin`)
+ * already uses for its own route-level check. A role may legitimately be named
+ * before it is given any permission, and a narrower definition here would
+ * refuse a role the route layer of this same codebase already accepts.
+ * `hasRole` resolves roles defined only through `$extend`, so an
+ * inheritance-only role such as `system` is recognised.
+ *
+ * `rbac.requireKnownRole: false` turns the whole check off - see the comment
+ * at its first use below.
+ *
+ * @param roles - role names to check; every unknown name is reported at once
+ */
+export declare function assertRolesExist(roles: string[]): void;
+/**
+ * Refuses metadata keys that decide account access.
+ *
+ * `user:pwd_reset:token` is a bearer credential redeemable at the PUBLIC reset
+ * endpoint and `user:2fa:*` is the second factor itself — writing either through
+ * a generic key-value merge hands out an account rather than annotating one.
+ * Ban and lockout keys are refused for the same reason bans have their own
+ * action: written directly they skip the event, the email and the session
+ * revocation that make a ban mean something.
+ *
+ * Lives here rather than in one http controller because the keys it protects are
+ * rbac's own, and an account seeded with a known reset token is an account
+ * takeover no matter which caller planted it — a CLI, a migration and a route
+ * all need the same refusal.
+ *
+ * @param metadata - the key-value bag a caller wants attached to an account
+ */
+export declare function assertNoProtectedMetadata(metadata?: {
+    [key: string]: any;
+}): void;
+/**
+ * Refuses a login / email already taken by another account.
+ *
+ * Exported because uniqueness is not only a creation-time rule: an update that
+ * renames an account has to apply exactly the same one, and a second
+ * implementation of it would be a second thing to keep in step. `exceptUserId`
+ * is what an update passes so an account does not clash with itself.
+ *
+ * Queries the base {@link User} rather than `userModel()`: uniqueness is GLOBAL,
+ * and an application's scoped subclass would hide the clashing row — turning a
+ * clean refusal into a driver error on the unique index.
+ *
+ * Soft-deleted rows are included for the same reason. They still occupy the
+ * unique indexes, so ignoring them trades this error for that driver error.
+ *
+ * The thrown {@link UserAlreadyExists} carries `fields`, naming WHICH of login / email
+ * clashed, so an http caller can mark the offending input rather than reporting
+ * that something, somewhere, is already in use.
+ *
+ * @param login - login to check, or undefined to skip the login check
+ * @param email - email to check, or undefined to skip the email check
+ * @param exceptUserId - id of the account being updated, which may keep its own values
+ */
+export declare function assertUserUnique(login?: string, email?: string, exceptUserId?: number): Promise<void>;
 /**
  * Creates a new user account.
  *
- * Validates and normalises inputs, hashes the password, inserts the user record,
- * optionally sets metadata, runs configured `beforeCreate` / `afterCreate` middleware,
- * emits a {@link UserCreated} event, and sends the "created" email.
+ * Validates and normalises inputs, refuses a duplicate login / email and
+ * protected metadata keys, hashes the password, inserts the user record,
+ * optionally sets metadata, runs configured `beforeCreate` / `afterCreate`
+ * middleware, emits a {@link UserCreated} event, and sends the "created" email.
+ *
+ * When no password is given, one is generated AND a password-reset link is
+ * mailed to the address. Those two are one decision, not two: a generated
+ * password is a secret nobody knows, so an account created without the reset
+ * link is an account with no way in at all. Callers that pass a password know
+ * it and own delivery themselves, so they get no link — which is what a CLI
+ * service account or a fixture wants.
  *
  * @param email - user email address (max 64 chars)
  * @param login - user login name (max 32 chars)
- * @param password - plain-text password; if empty a random one is generated
  * @param roles - array of role names to assign
- * @param id - optional explicit user id (useful when migrating from another system)
- * @param metadata - optional key-value metadata to attach to the new user
+ * @param options - see {@link ICreateUserOptions}
  * @returns an object containing the persisted {@link User} and the plain-text password
  */
-export declare function create(email: string, login: string, password: string, roles: string[], id?: number, metadata?: {
-    [key: string]: any;
-}): Promise<{
+export declare function create(email: string, login: string, roles: string[], options?: ICreateUserOptions): Promise<{
     User: User;
     Password: string;
 }>;
@@ -190,31 +310,38 @@ export declare function grant(identifier: number | string | User, role: string):
  */
 export declare function revoke(identifier: number | string | User, role: string): Promise<User>;
 /**
- *
- * Bans user for specified time. If duration is 0 user is banned for 24h
+ * Bans user for specified time. If duration is not given user is banned for 24h
  *
  * @param identifier user identifier one of : id, uuid, email, login
- * @param reason reson for ban
+ * @param reason reason for ban
  * @param duration duration in seconds
- * @returns
  */
 export declare function ban(identifier: number | string | User, reason?: string, duration?: number): Promise<User>;
 /**
- *
  * Unban user
  *
- * @param identifier
- * @returns
+ * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  */
 export declare function unban(identifier: number | string | User): Promise<User>;
 /**
  * Initiates a password-change request for a user.
  * Generates a reset token, stores it along with the current timestamp and configured
- * wait time in the user's metadata, and emits a {@link UserPasswordChangeRequest} event.
+ * wait time in the user's metadata, emits a {@link UserPasswordChangeRequest} event and
+ * sends the `changePassword` mail carrying the token.
+ *
+ * THE MAIL IS THE POINT. The token is issued into metadata and never returned over HTTP —
+ * possession of the mailbox is what authorizes the reset — so an installation that does not
+ * deliver it has a reset flow nobody can complete. It used to be the application's job, via
+ * the event, and every application that had not written that subscriber silently issued
+ * tokens into the void. `rbac.email.changePassword.enabled: false` still turns it off for an
+ * application that really does deliver it some other way.
+ *
+ * The token reaches the template through the model and is NOT logged: it is a bearer
+ * credential for `POST /auth/password/reset`.
  *
  * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  */
-export declare function passwordChangeRequest(identifier: number | string | User): Promise<unknown>;
+export declare function passwordChangeRequest(identifier: number | string | User): Promise<User>;
 /**
  * Confirms a password reset by validating the token and expiration, then changing the password.
  * Throws if the token has expired or does not match the stored value.
@@ -223,30 +350,55 @@ export declare function passwordChangeRequest(identifier: number | string | User
  * @param newPassword - the new plain-text password to set
  * @param token - the reset token that was issued by {@link passwordChangeRequest}
  */
-export declare function confirmPasswordReset(identifier: number | string | User, newPassword: string, token: string): Promise<unknown>;
+export declare function confirmPasswordReset(identifier: number | string | User, newPassword: string, token: string): Promise<User>;
 /**
- * Returns a function that changes a user's password.
+ * Changes a user's password.
  * The new password is validated against the configured {@link PasswordValidationProvider},
  * hashed via the configured {@link PasswordProvider}, persisted, and a
  * {@link UserPasswordChanged} event is emitted.
  *
+ * @param u - user to change the password for
+ * @param password - new plain-text password
+ */
+export declare function changeUserPassword(u: User, password: string): Promise<User>;
+/**
+ * Chain step form of {@link changeUserPassword}.
+ *
  * @param password - new plain-text password
- * @returns a function that receives a {@link User} and returns the updated user
  */
 export declare function changePassword(password: string): (u: User) => Promise<User>;
 /**
+ * Expire password for user.
  *
- * Expire password for user
+ * The stored credential is replaced with a freshly generated random one, so the
+ * expired password stops working even if the account is re-activated without a
+ * reset. The account is deactivated, {@link UserPasswordExpired} is emitted and
+ * the 'passwordExpired' mail is sent.
  *
- * @param identifier
+ * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
  */
 export declare function expirePassword(identifier: number | string | User): Promise<void>;
 /**
- * Check if password match user password stored in db
+ * Sends the 'passwordWillExpire' warning mail. No account state changes -
+ * this is the notification half of the expiry flow, meant to be called by an
+ * application scheduler ahead of {@link expirePassword}.
+ *
+ * @param identifier - numeric id, uuid / email / login string, or an existing {@link User} instance
+ * @param expiresAt - optional instant the password expires, passed to the template
+ */
+export declare function notifyPasswordWillExpire(identifier: number | string | User, expiresAt?: DateTime): Promise<User>;
+/**
+ * Checks if password matches the user's password stored in db.
+ *
+ * @param u - user to check against
+ * @param password - plain-text password to verify
+ */
+export declare function verifyPassword(u: User, password: string): Promise<boolean>;
+/**
+ * Chain step form of {@link verifyPassword}. The user is taken from the step
+ * argument - a regression once read it from a never-passed second parameter.
  *
- * @param identifier
- * @param password
- * @returns
+ * @param password - plain-text password to verify
  */
 export declare function passwordMatch(password: string): (u: User) => Promise<boolean>;
 /**
@@ -260,4 +412,28 @@ export declare function passwordMatch(password: string): (u: User) => Promise<bo
  * @returns the authenticated {@link User}
  */
 export declare function login(identifier: number | string | User, password: string): Promise<User>;
+/**
+ * Throws when the account is inside a lockout window opened by
+ * {@link registerFailedLogin}.
+ *
+ * @param u - user attempting to authenticate
+ */
+export declare function assertNotLocked(u: User): void;
+/**
+ * Clears the failure counter and any expired lock after a successful login.
+ */
+export declare function clearLoginThrottle(u: User): Promise<void>;
+/**
+ * Records one failed authentication and, at `rbac.password.blockAfterAttempts`
+ * consecutive failures, locks the account for `rbac.password.lockoutTime`
+ * seconds.
+ *
+ * `blockAfterAttempts <= 0` disables throttling entirely. A rejection that was
+ * itself the lockout is not counted — otherwise hammering a locked account
+ * would keep extending the lock indefinitely.
+ *
+ * @param u - user whose failed attempt is recorded
+ * @param err - the error that ended the login attempt
+ */
+export declare function registerFailedLogin(u: User, err: unknown): Promise<void>;
 //# sourceMappingURL=actions.d.ts.map

package/lib/cjs/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAKA,OAAO,EAAwB,IAAI,EAAY,MAAM,kBAAkB,CAAC;AAGxE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAWlD,oBAAY,OAAO;IACjB,eAAe,IAAA;IAEf,eAAe,IAAA;IAEf,qCAAqC,IAAA;IAErC,gBAAgB,IAAA;IAEhB,qBAAqB,IAAA;IAErB,iBAAiB,IAAA;IAEjB,aAAa,IAAA;IAEb,oBAAoB,IAAA;IAEpB,wBAAwB,IAAA;IAExB,sBAAsB,IAAA;IAEtB,mBAAmB,KAAA;IAEnB,YAAY,KAAA;CACb;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAgB,gBAAgB,qBAW/B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,mGAEhD;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,uBAUrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAG,CAAA;CAAE,EAAE,EAAE,KAAK,GAAE,GAAU,OAC3E,IAAI,mBAoBtB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,OACvB,IAAI,kBAMtB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,oBAAoB,GAAG,iBAAiB,OAU3K,IAAI,mBAqBtB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,OACnD,IAAI,mBAItB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,OAC9B,IAAI,mBAItB;AAED;;;;;;;GAOG;AACH,wBAAgB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3E;AAYD;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAYjE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAuDvL;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAelF;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5F;AAED;;;;;;;;GAQG;AACH,wBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B/G;AAED;;;;;;GAMG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB7E;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,oBAY7E;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,oBAqDhH;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAuC3E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,OAG3B,IAAI,KAAG,OAAO,CAAC,OAAO,CAAC,CAQzC;AAED;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC/F"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAKA,OAAO,EAAqD,IAAI,EAAY,MAAM,kBAAkB,CAAC;AAGrG,OAAO,EAAE,WAAW,EAAM,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAWjC;;;;GAIG;AAEH;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ/E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAQrF;AAED;;;;GAIG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAMnD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAEpE;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAG,CAAA;CAAE,EAAE,EAAE,KAAK,GAAE,GAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAczH;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAKpE;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,CAAC,EAAE,IAAI,EACP,WAAW,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,oBAAoB,GAAG,iBAAiB,EAClK,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACpF,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3E;AAED;;;;GAIG;AAEH;;GAEG;AACH,wBAAgB,gBAAgB,kBAE/B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,yBAEhD;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,uBAUrD;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAEpF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,GAAG,CAAA;CAAE,EAAE,EAAE,KAAK,GAAE,GAAU,OACjF,IAAI,mBAChB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,OAC7B,IAAI,kBAChB;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,OAC5G,IAAI,mBAChB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,OACnD,IAAI,mBAItB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,OACpC,IAAI,mBAChB;AAED;;;;GAIG;AAEH;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAalF;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAwBjE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,4EAA4E;IAC5E,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAQ3D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAmCtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,GAAG,IAAI,CAmBjF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB3G;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA+FnJ;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAclF;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3F;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU5F;AAED;;;;;;GAMG;AACH,wBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B/G;AAED;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB7E;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB7F;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkDhI;AAyBD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCjF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAE3E;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAUtF;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAMtH;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAKhF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,OACjC,IAAI,KAAG,OAAO,CAAC,OAAO,CAAC,CACnC;AAED;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B/F;AA2BD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAe7C;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B9E"}