@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/features/users/users.service.js

@@ -0,0 +1,509 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UsersService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const auth_error_1 = require("../../common/auth-error.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const auth_events_service_1 = require("../events/auth-events.service.js");
+const session_service_1 = require("../sessions/session.service.js");
+const typeorm_row_1 = require("../../database/typeorm-row.js");
+/**
+ * Accounts and their life cycle:
+ *
+ *   PENDING_VERIFICATION --(required verifications done)--> ACTIVE
+ *   ACTIVE --(admin)--> SUSPENDED --(admin lifts it)--> ACTIVE
+ *   ACTIVE --(user)--> DEACTIVATED --(user reactivates)--> ACTIVE
+ *   any --(user or admin)--> DELETED (personal data wiped; cannot be undone)
+ *
+ * Suspending, deactivating and deleting all sign the user out everywhere.
+ */
+let UsersService = class UsersService {
+    sessions;
+    events;
+    database;
+    constructor(options, sessions, events) {
+        this.sessions = sessions;
+        this.events = events;
+        this.database = options.dataSource;
+    }
+    // -------------------------------------------------------------------------------------------
+    // Finding users
+    // -------------------------------------------------------------------------------------------
+    /**
+     * @param userId - The user's id.
+     * @returns The user (in any status, including DELETED), or null.
+     */
+    findUserById(userId) {
+        return this.database.getRepository(entities_1.UserEntity).findOne({ where: { id: userId } });
+    }
+    /**
+     * @param email - Must already be normalized (see `normalizeEmail`).
+     * @returns The user with this email, or null.
+     */
+    findUserByEmail(email) {
+        return this.database.getRepository(entities_1.UserEntity).findOne({ where: { email } });
+    }
+    /**
+     * @param phoneNumber - Must already be normalized (see `normalizePhoneNumber`).
+     * @returns The user with this phone number, or null.
+     */
+    findUserByPhoneNumber(phoneNumber) {
+        return this.database.getRepository(entities_1.UserEntity).findOne({ where: { phoneNumber } });
+    }
+    /**
+     * Loads a user that must exist. Deleted accounts count as missing.
+     *
+     * @param userId - The user's id.
+     * @returns The user.
+     * @throws AuthError NOT_FOUND when there is no such user, or it was deleted.
+     */
+    async getUserOrThrow(userId) {
+        const user = await this.findUserById(userId);
+        if (!user || user.status === constants_1.ACCOUNT_STATUS.deleted)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notFound);
+        return user;
+    }
+    // -------------------------------------------------------------------------------------------
+    // Creating users
+    // -------------------------------------------------------------------------------------------
+    /**
+     * Creates an account with the app's default roles (users can never pick their own role).
+     * The account starts ACTIVE if the sign-up already proved everything the settings require,
+     * otherwise PENDING_VERIFICATION.
+     *
+     * @param details - Contact details, names, and what the sign-up already verified.
+     * @param settings - The current settings (registration and activation rules).
+     * @param request - Who is asking (for the audit log).
+     * @param transaction - Pass one to create the user together with other rows (e.g. the password).
+     * @returns The saved user.
+     * @throws AuthError SIGN_UP_CLOSED when registration is turned off.
+     * @throws AuthError ACCOUNT_ALREADY_EXISTS when the email or phone number is already taken.
+     */
+    async createUser(details, settings, request, transaction) {
+        if (!settings.registration.enabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.signUpClosed);
+        const now = new Date();
+        const newUser = this.database.getRepository(entities_1.UserEntity).create({
+            email: details.email ?? null,
+            isEmailVerified: details.isEmailVerified ?? false,
+            phoneNumber: details.phoneNumber ?? null,
+            isPhoneVerified: details.isPhoneVerified ?? false,
+            firstName: details.firstName ?? null,
+            lastName: details.lastName ?? null,
+            roles: [...settings.registration.defaultRoles],
+            termsAcceptedAt: details.acceptedTerms ? now : null,
+            privacyPolicyAcceptedAt: details.acceptedPrivacyPolicy ? now : null,
+            metadata: {},
+        });
+        newUser.status = this.getPendingVerifications(newUser, settings).length === 0 ? constants_1.ACCOUNT_STATUS.active : constants_1.ACCOUNT_STATUS.pendingVerification;
+        newUser.statusChangedAt = now;
+        let savedUser;
+        try {
+            savedUser = await (transaction ?? this.database.manager).save(entities_1.UserEntity, newUser);
+        }
+        catch (error) {
+            if (this.isUniqueViolation(error))
+                throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.accountAlreadyExists);
+            throw error;
+        }
+        await this.events.record({
+            name: constants_1.AUTH_EVENTS.userCreated,
+            userId: savedUser.id,
+            request,
+            details: { status: savedUser.status },
+        });
+        return savedUser;
+    }
+    // -------------------------------------------------------------------------------------------
+    // Verification and activation
+    // -------------------------------------------------------------------------------------------
+    /**
+     * Lists what the user still has to verify before the account becomes ACTIVE.
+     *
+     * @param user - The user.
+     * @param settings - The current settings (activation rules).
+     * @returns e.g. ["email"]; empty when nothing is left.
+     */
+    getPendingVerifications(user, settings) {
+        const pending = [];
+        if (settings.activation.requireVerifiedEmail && user.email && !user.isEmailVerified)
+            pending.push(constants_1.PENDING_VERIFICATION.email);
+        if (settings.activation.requireVerifiedPhone && !(user.phoneNumber && user.isPhoneVerified))
+            pending.push(constants_1.PENDING_VERIFICATION.phone);
+        return pending;
+    }
+    /**
+     * Marks the email verified, and activates the account if nothing else is pending.
+     *
+     * @param user - The user; updated in place.
+     * @param settings - The current settings.
+     * @param request - Who is asking (for the audit log).
+     * @returns The same user, with its new status.
+     */
+    async markEmailVerified(user, settings, request) {
+        if (!user.isEmailVerified) {
+            await this.database.getRepository(entities_1.UserEntity).update({ id: user.id }, { isEmailVerified: true });
+            user.isEmailVerified = true;
+            await this.events.record({ name: constants_1.AUTH_EVENTS.emailVerified, userId: user.id, request });
+        }
+        return this.activateIfReady(user, settings, request);
+    }
+    /**
+     * Marks the phone number verified, and activates the account if nothing else is pending.
+     *
+     * @param user - The user; updated in place.
+     * @param settings - The current settings.
+     * @param request - Who is asking (for the audit log).
+     * @returns The same user, with its new status.
+     */
+    async markPhoneVerified(user, settings, request) {
+        if (!user.isPhoneVerified) {
+            await this.database.getRepository(entities_1.UserEntity).update({ id: user.id }, { isPhoneVerified: true });
+            user.isPhoneVerified = true;
+            await this.events.record({ name: constants_1.AUTH_EVENTS.phoneVerified, userId: user.id, request });
+        }
+        return this.activateIfReady(user, settings, request);
+    }
+    /**
+     * Protects against "account pre-hijacking": someone registers YOUR email with THEIR password,
+     * never verifies it, and waits for you to sign in with a code, link or Google. When the real
+     * owner proves the email for the first time this way, any password set before that proof is
+     * removed and all earlier sessions end. Call it BEFORE markEmailVerified.
+     *
+     * A brand-new account (younger than UNVERIFIED_ACCOUNT_GRACE_SECONDS) is left alone: that is the
+     * normal "register with a password, then verify with the emailed code" flow.
+     *
+     * @param user - The user who just proved the email.
+     * @param request - Who is asking (for the audit log).
+     */
+    async removeUnprovenPassword(user, request) {
+        if (user.isEmailVerified)
+            return;
+        const accountAgeSeconds = (Date.now() - user.createdAt.getTime()) / constants_1.SECOND_IN_MILLISECONDS;
+        if (accountAgeSeconds < constants_1.UNVERIFIED_ACCOUNT_GRACE_SECONDS)
+            return;
+        const removed = await this.database.getRepository(entities_1.PasswordEntity).delete({ userId: user.id });
+        await this.sessions.revokeAllSessions(user.id, constants_1.SESSION_END_REASON.emailProvenByOwner);
+        if (removed.affected) {
+            await this.events.record({
+                name: constants_1.AUTH_EVENTS.passwordChanged,
+                userId: user.id,
+                request,
+                details: { how: constants_1.PASSWORD_CHANGE_KIND.removedUnverified },
+            });
+        }
+    }
+    /**
+     * Moves a PENDING_VERIFICATION account to ACTIVE once nothing is left to verify.
+     * Does nothing for accounts in any other status.
+     *
+     * @param user - The user; updated in place.
+     * @param settings - The current settings.
+     * @param request - Who is asking (for the audit log).
+     * @returns The same user.
+     */
+    async activateIfReady(user, settings, request) {
+        if (user.status !== constants_1.ACCOUNT_STATUS.pendingVerification || this.getPendingVerifications(user, settings).length > 0)
+            return user;
+        const wasActivated = await this.changeStatus(user, constants_1.ACCOUNT_STATUS.pendingVerification, constants_1.ACCOUNT_STATUS.active);
+        if (wasActivated)
+            await this.events.record({ name: constants_1.AUTH_EVENTS.userActivated, userId: user.id, request });
+        return user;
+    }
+    // -------------------------------------------------------------------------------------------
+    // Profile
+    // -------------------------------------------------------------------------------------------
+    /**
+     * Changes the user's names and/or app metadata. Fields left undefined are not touched.
+     *
+     * @param userId - The user to change.
+     * @param changes - The new values.
+     * @param performedBy - Who made the change, for the audit log (null when it was the user).
+     * @param request - Who is asking.
+     * @returns The updated user.
+     * @throws AuthError NOT_FOUND when the user doesn't exist.
+     */
+    async updateProfile(userId, changes, performedBy, request) {
+        const user = await this.getUserOrThrow(userId);
+        const changedFields = Object.keys(changes).filter((field) => changes[field] !== undefined);
+        if (changedFields.length === 0)
+            return user;
+        Object.assign(user, Object.fromEntries(changedFields.map((field) => [field, changes[field]])));
+        await this.database.getRepository(entities_1.UserEntity).save(user);
+        await this.events.record({ name: constants_1.AUTH_EVENTS.userUpdated, userId, performedBy, request, details: { changedFields } });
+        return user;
+    }
+    /**
+     * Called by your app's profile module once the user has finished onboarding.
+     * Calling it again changes nothing.
+     *
+     * @param userId - The user.
+     * @param request - Who is asking (for the audit log).
+     * @returns The updated user.
+     */
+    async completeOnboarding(userId, request) {
+        const user = await this.getUserOrThrow(userId);
+        if (user.onboardingCompletedAt)
+            return user;
+        user.onboardingCompletedAt = new Date();
+        await this.database.getRepository(entities_1.UserEntity).update({ id: userId }, { onboardingCompletedAt: user.onboardingCompletedAt });
+        await this.events.record({ name: constants_1.AUTH_EVENTS.onboardingCompleted, userId, request });
+        return user;
+    }
+    /**
+     * Replaces a user's app-wide roles. Admin only. New roles show up in the user's next access token.
+     *
+     * @param userId - The user to change.
+     * @param roles - The full new list; duplicates are removed.
+     * @param adminUserId - The admin doing it (for the audit log).
+     * @param request - Who is asking.
+     * @returns The updated user.
+     * @throws AuthError VALIDATION_ERROR when a role name is invalid or there are too many roles.
+     */
+    async setRoles(userId, roles, adminUserId, request) {
+        const uniqueRoles = [...new Set(roles)];
+        const hasInvalidRole = uniqueRoles.some((role) => !constants_1.ROLE_NAME_PATTERN.test(role));
+        if (hasInvalidRole || uniqueRoles.length > constants_1.MAXIMUM_ROLES_PER_USER)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.validationFailed);
+        const user = await this.getUserOrThrow(userId);
+        const previousRoles = user.roles;
+        user.roles = uniqueRoles;
+        await this.database.getRepository(entities_1.UserEntity).update({ id: userId }, { roles: uniqueRoles });
+        await this.events.record({
+            name: constants_1.AUTH_EVENTS.userRolesChanged,
+            userId,
+            performedBy: constants_1.PERFORMED_BY.admin(adminUserId),
+            request,
+            details: { previousRoles, roles: uniqueRoles },
+        });
+        return user;
+    }
+    /**
+     * Remembers when the user last signed in (shown to admins and in the profile).
+     *
+     * @param user - The user; updated in place.
+     */
+    async recordSignIn(user) {
+        user.lastSignedInAt = new Date();
+        await this.database.getRepository(entities_1.UserEntity).update({ id: user.id }, { lastSignedInAt: user.lastSignedInAt });
+    }
+    // -------------------------------------------------------------------------------------------
+    // Status changes
+    // -------------------------------------------------------------------------------------------
+    /**
+     * Admin blocks an account. The reason is kept for support staff. Signs the user out everywhere.
+     *
+     * @param userId - The user to suspend.
+     * @param reason - Why (kept for support staff, not shown to the user).
+     * @param adminUserId - The admin doing it (for the audit log).
+     * @param request - Who is asking.
+     * @returns The updated user.
+     */
+    async suspendUser(userId, reason, adminUserId, request) {
+        const user = await this.getUserOrThrow(userId);
+        if (user.status !== constants_1.ACCOUNT_STATUS.suspended) {
+            user.suspensionReason = reason;
+            await this.changeStatus(user, user.status, constants_1.ACCOUNT_STATUS.suspended, { suspensionReason: reason });
+        }
+        await this.sessions.revokeAllSessions(userId, constants_1.SESSION_END_REASON.accountSuspended);
+        await this.events.record({
+            name: constants_1.AUTH_EVENTS.userSuspended,
+            userId,
+            performedBy: constants_1.PERFORMED_BY.admin(adminUserId),
+            request,
+            details: { reason },
+        });
+        return user;
+    }
+    /**
+     * Admin lifts a suspension. The account goes back to ACTIVE (or PENDING_VERIFICATION if still unverified).
+     *
+     * @param userId - The suspended user.
+     * @param adminUserId - The admin doing it (for the audit log).
+     * @param settings - The current settings.
+     * @param request - Who is asking.
+     * @returns The updated user (unchanged if it wasn't suspended).
+     */
+    async liftSuspension(userId, adminUserId, settings, request) {
+        const user = await this.getUserOrThrow(userId);
+        if (user.status !== constants_1.ACCOUNT_STATUS.suspended)
+            return user;
+        await this.changeStatus(user, constants_1.ACCOUNT_STATUS.suspended, this.statusAfterReturning(user, settings), { suspensionReason: null });
+        user.suspensionReason = null;
+        await this.events.record({ name: constants_1.AUTH_EVENTS.userReactivated, userId, performedBy: constants_1.PERFORMED_BY.admin(adminUserId), request });
+        return user;
+    }
+    /**
+     * The user switches their own account off for a while. Signs them out everywhere.
+     * They can switch it back on by signing in again.
+     *
+     * @param userId - The signed-in user.
+     * @param request - Who is asking (for the audit log).
+     * @throws AuthError ACCOUNT_SUSPENDED when an admin has suspended the account.
+     */
+    async deactivateAccount(userId, request) {
+        const user = await this.getUserOrThrow(userId);
+        if (user.status === constants_1.ACCOUNT_STATUS.suspended)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.accountSuspended);
+        if (user.status !== constants_1.ACCOUNT_STATUS.deactivated)
+            await this.changeStatus(user, user.status, constants_1.ACCOUNT_STATUS.deactivated);
+        await this.sessions.revokeAllSessions(userId, constants_1.SESSION_END_REASON.accountDeactivated);
+        await this.events.record({ name: constants_1.AUTH_EVENTS.userDeactivated, userId, request });
+    }
+    /**
+     * The user switches their account back on (after proving who they are, see SignInService).
+     *
+     * @param userId - The deactivated user.
+     * @param settings - The current settings.
+     * @param request - Who is asking (for the audit log).
+     * @returns The updated user.
+     * @throws AuthError ACCOUNT_NOT_DEACTIVATED when the account isn't deactivated.
+     */
+    async reactivateAccount(userId, settings, request) {
+        const user = await this.getUserOrThrow(userId);
+        if (user.status !== constants_1.ACCOUNT_STATUS.deactivated)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.accountNotDeactivated);
+        await this.changeStatus(user, constants_1.ACCOUNT_STATUS.deactivated, this.statusAfterReturning(user, settings));
+        await this.events.record({ name: constants_1.AUTH_EVENTS.userReactivated, userId, request });
+        return user;
+    }
+    /**
+     * Deletes the account. The row stays (so ids in your other tables don't dangle and the audit log
+     * still makes sense), but every piece of personal data and every way to sign in is wiped.
+     * This cannot be undone.
+     *
+     * @param userId - The user to delete.
+     * @param performedBy - Who did it, for the audit log (null when it was the user).
+     * @param request - Who is asking.
+     */
+    async deleteUser(userId, performedBy, request) {
+        const user = await this.getUserOrThrow(userId);
+        const deletedUserFilter = { userId };
+        await this.database.transaction(async (transaction) => {
+            await transaction.update(entities_1.UserEntity, { id: userId }, (0, typeorm_row_1.typeormRow)({
+                email: null,
+                isEmailVerified: false,
+                phoneNumber: null,
+                isPhoneVerified: false,
+                firstName: null,
+                lastName: null,
+                roles: [],
+                metadata: {},
+                isTwoFactorEnabled: false,
+                suspensionReason: null,
+                status: constants_1.ACCOUNT_STATUS.deleted,
+                statusChangedAt: new Date(),
+            }));
+            const tablesWithUserRows = [
+                entities_1.PasswordEntity,
+                entities_1.SocialAccountEntity,
+                entities_1.PasskeyEntity,
+                entities_1.TwoFactorSecretEntity,
+                entities_1.BackupCodeEntity,
+                entities_1.SignInChallengeEntity,
+                entities_1.LinkTokenEntity,
+                entities_1.OrganizationMemberEntity,
+            ];
+            for (const table of tablesWithUserRows)
+                await transaction.delete(table, deletedUserFilter);
+            // Pending codes are keyed by where they were sent, not by user.
+            const destinations = [user.email, user.phoneNumber].filter((value) => !!value);
+            for (const destination of destinations)
+                await transaction.delete(entities_1.OneTimeCodeEntity, { destination });
+        });
+        await this.sessions.revokeAllSessions(userId, constants_1.SESSION_END_REASON.accountDeleted);
+        await this.events.record({ name: constants_1.AUTH_EVENTS.userDeleted, userId, performedBy, request });
+    }
+    // -------------------------------------------------------------------------------------------
+    // Responses
+    // -------------------------------------------------------------------------------------------
+    /**
+     * The user as your app may show it. Never includes secrets.
+     *
+     * @param user - The user.
+     * @param settings - The current settings (to work out pending verifications).
+     * @returns The profile to send to the client.
+     */
+    toPublicProfile(user, settings) {
+        return {
+            id: user.id,
+            email: user.email,
+            isEmailVerified: user.isEmailVerified,
+            phoneNumber: user.phoneNumber,
+            isPhoneVerified: user.isPhoneVerified,
+            firstName: user.firstName,
+            lastName: user.lastName,
+            roles: user.roles,
+            status: user.status,
+            pendingVerifications: this.getPendingVerifications(user, settings),
+            onboardingCompleted: user.onboardingCompletedAt !== null,
+            isTwoFactorEnabled: user.isTwoFactorEnabled,
+            metadata: user.metadata,
+            lastSignedInAt: user.lastSignedInAt?.toISOString() ?? null,
+            createdAt: user.createdAt.toISOString(),
+        };
+    }
+    // -------------------------------------------------------------------------------------------
+    // Helpers
+    // -------------------------------------------------------------------------------------------
+    /**
+     * Where a returning (unsuspended / reactivated) account lands: ACTIVE, unless verification is still owed.
+     *
+     * @param user - The returning user.
+     * @param settings - The current settings.
+     * @returns ACTIVE or PENDING_VERIFICATION.
+     */
+    statusAfterReturning(user, settings) {
+        return this.getPendingVerifications(user, settings).length === 0 ? constants_1.ACCOUNT_STATUS.active : constants_1.ACCOUNT_STATUS.pendingVerification;
+    }
+    /**
+     * Changes the status only if it is still `expectedStatus` (so two admins clicking at once can't
+     * clash). Updates `user` in place.
+     *
+     * @param user - The user to change.
+     * @param expectedStatus - The status the user must still have.
+     * @param newStatus - The status to set.
+     * @param extraColumns - Other columns to change in the same UPDATE.
+     * @returns False if someone else changed it first.
+     */
+    async changeStatus(user, expectedStatus, newStatus, extraColumns = {}) {
+        const changedAt = new Date();
+        const result = await this.database
+            .getRepository(entities_1.UserEntity)
+            .update({ id: user.id, status: expectedStatus }, (0, typeorm_row_1.typeormRow)({ status: newStatus, statusChangedAt: changedAt, ...extraColumns }));
+        if (!result.affected)
+            return false;
+        user.status = newStatus;
+        user.statusChangedAt = changedAt;
+        return true;
+    }
+    /**
+     * @param error - An error thrown by the database.
+     * @returns True when Postgres refused a duplicate value (e.g. an email that is already taken).
+     */
+    isUniqueViolation(error) {
+        return error instanceof typeorm_1.QueryFailedError && error.code === constants_1.POSTGRES_UNIQUE_VIOLATION_CODE;
+    }
+};
+exports.UsersService = UsersService;
+exports.UsersService = UsersService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, session_service_1.SessionService,
+        auth_events_service_1.AuthEventsService])
+], UsersService);
+//# sourceMappingURL=users.service.js.map

package/dist/features/users/users.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.service.js","sourceRoot":"","sources":["../../../src/features/users/users.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,qCAAsE;AAEtE,oDAAgD;AAEhD,2CAeqB;AACrB,kDAW6B;AAC7B,+EAA0E;AAC1E,yEAAqE;AAIrE,wDAAoD;AAqBpD;;;;;;;;;GASG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IAKJ;IACA;IALF,QAAQ,CAAa;IAEtC,YAC8B,OAAoB,EAC/B,QAAwB,EACxB,MAAyB;QADzB,aAAQ,GAAR,QAAQ,CAAgB;QACxB,WAAM,GAAN,MAAM,CAAmB;QAE1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED,8FAA8F;IAC9F,gBAAgB;IAChB,8FAA8F;IAE9F;;;OAGG;IACH,YAAY,CAAC,MAAc;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;;OAGG;IACH,qBAAqB,CAAC,WAAmB;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,QAAQ,CAAC,CAAC;QAC/F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8FAA8F;IAC9F,iBAAiB;IACjB,8FAA8F;IAE9F;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,UAAU,CACd,OAAuB,EACvB,QAAsB,EACtB,OAAuB,EACvB,WAA2B;QAE3B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,YAAY,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,MAAM,CAAC;YAC7D,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;YAC5B,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,KAAK;YACjD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;YACxC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,KAAK;YACjD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;YACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC;YAC9C,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACnD,uBAAuB,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACnE,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,0BAAc,CAAC,MAAM,CAAC,CAAC,CAAC,0BAAc,CAAC,mBAAmB,CAAC;QAC3I,OAAO,CAAC,eAAe,GAAG,GAAG,CAAC;QAE9B,IAAI,SAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAU,EAAE,OAAO,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;YACzF,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,uBAAW,CAAC,WAAW;YAC7B,MAAM,EAAE,SAAS,CAAC,EAAE;YACpB,OAAO;YACP,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;SACtC,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,8FAA8F;IAC9F,8BAA8B;IAC9B,8FAA8F;IAE9F;;;;;;OAMG;IACH,uBAAuB,CAAC,IAAgB,EAAE,QAAsB;QAC9D,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,UAAU,CAAC,oBAAoB,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,CAAC,IAAI,CAAC,gCAAoB,CAAC,KAAK,CAAC,CAAC;QAC9H,IAAI,QAAQ,CAAC,UAAU,CAAC,oBAAoB,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,gCAAoB,CAAC,KAAK,CAAC,CAAC;QACtI,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CAAC,IAAgB,EAAE,QAAsB,EAAE,OAAuB;QACvF,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CAAC,IAAgB,EAAE,QAAsB,EAAE,OAAuB;QACvF,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,sBAAsB,CAAC,IAAgB,EAAE,OAAuB;QACpE,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO;QACjC,MAAM,iBAAiB,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,kCAAsB,CAAC;QAC3F,IAAI,iBAAiB,GAAG,4CAAgC;YAAE,OAAO;QACjE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,yBAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,8BAAkB,CAAC,kBAAkB,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBACvB,IAAI,EAAE,uBAAW,CAAC,eAAe;gBACjC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO;gBACP,OAAO,EAAE,EAAE,GAAG,EAAE,gCAAoB,CAAC,iBAAiB,EAAE;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,IAAgB,EAAE,QAAsB,EAAE,OAAuB;QACrF,IAAI,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,mBAAmB,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/H,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,0BAAc,CAAC,mBAAmB,EAAE,0BAAc,CAAC,MAAM,CAAC,CAAC;QAC9G,IAAI,YAAY;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1G,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8FAA8F;IAC9F,UAAU;IACV,8FAA8F;IAE9F;;;;;;;;;OASG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,OAAuB,EAAE,WAA0B,EAAE,OAAuB;QAC9G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAA6B,CAAC,KAAK,SAAS,CAAC,CAAC;QACnH,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,KAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvH,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QACtH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,OAAuB;QAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,CAAC,qBAAqB,GAAG,IAAI,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;QAC5H,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,KAAe,EAAE,WAAmB,EAAE,OAAuB;QAC1F,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,6BAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,IAAI,cAAc,IAAI,WAAW,CAAC,MAAM,GAAG,kCAAsB;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,CAAC,CAAC;QAErH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC;QACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,uBAAW,CAAC,gBAAgB;YAClC,MAAM;YACN,WAAW,EAAE,wBAAY,CAAC,KAAK,CAAC,WAAW,CAAC;YAC5C,OAAO;YACP,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE;SAC/C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,IAAgB;QACjC,IAAI,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,8FAA8F;IAC9F,iBAAiB;IACjB,8FAA8F;IAE9F;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,MAAc,EAAE,WAAmB,EAAE,OAAuB;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,SAAS,EAAE,CAAC;YAC7C,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;YAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,0BAAc,CAAC,SAAS,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,8BAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,uBAAW,CAAC,aAAa;YAC/B,MAAM;YACN,WAAW,EAAE,wBAAY,CAAC,KAAK,CAAC,WAAW,CAAC;YAC5C,OAAO;YACP,OAAO,EAAE,EAAE,MAAM,EAAE;SACpB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,WAAmB,EAAE,QAAsB,EAAE,OAAuB;QACvG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,0BAAc,CAAC,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/H,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAY,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/H,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,OAAuB;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,SAAS;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,WAAW;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,0BAAc,CAAC,WAAW,CAAC,CAAC;QACvH,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,8BAAkB,CAAC,kBAAkB,CAAC,CAAC;QACrF,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,QAAsB,EAAE,OAAuB;QACrF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,WAAW;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,qBAAqB,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,0BAAc,CAAC,WAAW,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,WAA0B,EAAE,OAAuB;QAClF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,iBAAiB,GAAG,EAAE,MAAM,EAAE,CAAC;QAErC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YACpD,MAAM,WAAW,CAAC,MAAM,CACtB,qBAAU,EACV,EAAE,EAAE,EAAE,MAAM,EAAE,EACd,IAAA,wBAAU,EAAa;gBACrB,KAAK,EAAE,IAAI;gBACX,eAAe,EAAE,KAAK;gBACtB,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,KAAK;gBACtB,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,EAAE;gBACT,QAAQ,EAAE,EAAE;gBACZ,kBAAkB,EAAE,KAAK;gBACzB,gBAAgB,EAAE,IAAI;gBACtB,MAAM,EAAE,0BAAc,CAAC,OAAO;gBAC9B,eAAe,EAAE,IAAI,IAAI,EAAE;aAC5B,CAAC,CACH,CAAC;YACF,MAAM,kBAAkB,GAA+C;gBACrE,yBAAc;gBACd,8BAAmB;gBACnB,wBAAa;gBACb,gCAAqB;gBACrB,2BAAgB;gBAChB,gCAAqB;gBACrB,0BAAe;gBACf,mCAAwB;aACzB,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,kBAAkB;gBAAE,MAAM,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC3F,gEAAgE;YAChE,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAChG,KAAK,MAAM,WAAW,IAAI,YAAY;gBAAE,MAAM,WAAW,CAAC,MAAM,CAAC,4BAAiB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QACvG,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,8BAAkB,CAAC,cAAc,CAAC,CAAC;QACjF,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,8FAA8F;IAC9F,YAAY;IACZ,8FAA8F;IAE9F;;;;;;OAMG;IACH,eAAe,CAAC,IAAgB,EAAE,QAAsB;QACtD,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,oBAAoB,EAAE,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC;YAClE,mBAAmB,EAAE,IAAI,CAAC,qBAAqB,KAAK,IAAI;YACxD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,IAAI,IAAI;YAC1D,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;SACxC,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,UAAU;IACV,8FAA8F;IAE9F;;;;;;OAMG;IACK,oBAAoB,CAAC,IAAgB,EAAE,QAAsB;QACnE,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,0BAAc,CAAC,MAAM,CAAC,CAAC,CAAC,0BAAc,CAAC,mBAAmB,CAAC;IAChI,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,YAAY,CACxB,IAAgB,EAChB,cAA6B,EAC7B,SAAwB,EACxB,eAAoC,EAAE;QAEtC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ;aAC/B,aAAa,CAAC,qBAAU,CAAC;aACzB,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,IAAA,wBAAU,EAAa,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC;QAC/I,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,iBAAiB,CAAC,KAAc;QACtC,OAAO,KAAK,YAAY,0BAAgB,IAAK,KAA8C,CAAC,IAAI,KAAK,0CAA8B,CAAC;IACtI,CAAC;CACF,CAAA;AAlfY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACA,gCAAc;QAChB,uCAAiB;GANjC,YAAY,CAkfxB"}

package/dist/features/users/users.types.d.ts

@@ -0,0 +1,24 @@
+import type { AccountStatus, PendingVerification } from '../../constants.js';
+import type { JsonObject } from '../../database/entities/json-object.js';
+/** A verification still owed before the account becomes ACTIVE (see PENDING_VERIFICATION). */
+export type { PendingVerification };
+/** The user as returned by GET /auth/me and the admin API. Never contains secrets. */
+export interface PublicUserProfile {
+    id: string;
+    email: string | null;
+    isEmailVerified: boolean;
+    phoneNumber: string | null;
+    isPhoneVerified: boolean;
+    firstName: string | null;
+    lastName: string | null;
+    roles: string[];
+    status: AccountStatus;
+    /** What the user still has to verify. The app can send them straight to that screen. */
+    pendingVerifications: PendingVerification[];
+    /** Set by your app's profile module through UsersService.completeOnboarding(). */
+    onboardingCompleted: boolean;
+    isTwoFactorEnabled: boolean;
+    metadata: JsonObject;
+    lastSignedInAt: string | null;
+    createdAt: string;
+}

package/dist/features/users/users.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=users.types.js.map

package/dist/features/users/users.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.types.js","sourceRoot":"","sources":["../../../src/features/users/users.types.ts"],"names":[],"mappings":""}

package/dist/features/webhooks/webhook-delivery.worker.d.ts

@@ -0,0 +1,55 @@
+import { OnApplicationBootstrap, OnModuleDestroy } from '@nestjs/common';
+import { AuthOptions } from '../../auth-options.js';
+import { WebhooksService } from './webhooks.service';
+/**
+ * Sends queued webhook deliveries in the background.
+ *
+ * - Runs every few seconds on every server. Each server claims different rows
+ *   (FOR UPDATE SKIP LOCKED), so nothing is sent twice.
+ * - A 2xx response = delivered. Anything else is retried with growing delays
+ *   (1 min, 5 min, 30 min, 2 h, 6 h, 12 h, 24 h), then marked failed.
+ * - Redirects are not followed, and the URL is re-checked before every send, so a receiver
+ *   can't later point us at a private address.
+ */
+export declare class WebhookDeliveryWorker implements OnApplicationBootstrap, OnModuleDestroy {
+    private readonly webhooks;
+    private readonly logger;
+    private readonly database;
+    private timer?;
+    private isRunning;
+    constructor(options: AuthOptions, webhooks: WebhooksService);
+    /**
+     * Starts the timer that sends due deliveries every few seconds.
+     */
+    onApplicationBootstrap(): void;
+    /**
+     * Stops the timer when the app shuts down.
+     */
+    onModuleDestroy(): void;
+    /**
+     * One round: claim due deliveries and send them. Public so tests and scripts can call it.
+     * A round is skipped if the previous one is still running. Errors are logged, never thrown.
+     */
+    sendDueDeliveries(): Promise<void>;
+    /**
+     * Takes due rows and pushes their next attempt a little into the future, in one statement.
+     * If this server crashes mid-send, another server picks them up after the claim times out.
+     *
+     * @returns The deliveries this server should send now.
+     */
+    private claimDueDeliveries;
+    /**
+     * Sends one delivery and records what happened. The webhook's URL is checked again first.
+     *
+     * @param delivery - A claimed delivery.
+     */
+    private sendOne;
+    /**
+     * Saves the result of an attempt and schedules the next retry, or marks the delivery
+     * delivered or failed.
+     *
+     * @param delivery - The delivery that was attempted.
+     * @param outcome - Whether it was delivered, whether to stop retrying, the HTTP status and the error.
+     */
+    private recordOutcome;
+}