@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/common/rate-limiter.service.js

@@ -0,0 +1,158 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RateLimiterService = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("../constants.js");
+const auth_error_1 = require("./auth-error");
+const time_1 = require("./time");
+/**
+ * Counts attempts per key (an IP address, an email, a user id) inside a time window and blocks
+ * once there are too many. Counters live in Redis when `redisUrl` is set (shared by every server),
+ * otherwise in this server's memory.
+ */
+let RateLimiterService = class RateLimiterService {
+    logger = new common_1.Logger(constants_1.LOG_CONTEXT.rateLimiter);
+    redisClient;
+    countersInMemory = new Map();
+    constructor(options) {
+        if (options.redisUrl) {
+            // Loaded only when Redis is used, so apps without Redis don't need the package installed.
+            const ioredis = require('ioredis');
+            // ioredis 5 exports the class itself; newer versions export it as `Redis` (and `default`).
+            const Redis = ioredis.Redis ?? ioredis.default ?? ioredis;
+            this.redisClient = new Redis(options.redisUrl, { maxRetriesPerRequest: 1 });
+        }
+        else if (process.env.NODE_ENV === constants_1.PRODUCTION_ENVIRONMENT) {
+            // Only reachable with singleServer: true (startup validation requires redisUrl otherwise).
+            this.logger.log('Rate limits are counted in memory (singleServer: true).');
+        }
+    }
+    /**
+     * For the health check: is Redis answering?
+     *
+     * @returns "ok", "error", or "not_used" when rate limits live in memory.
+     */
+    async checkRedis() {
+        if (!this.redisClient)
+            return constants_1.HEALTH_STATUS.notUsed;
+        try {
+            await (0, time_1.withTimeout)(this.redisClient.ping(), constants_1.HEALTH_CHECK_TIMEOUT_MS);
+            return constants_1.HEALTH_STATUS.ok;
+        }
+        catch {
+            return constants_1.HEALTH_STATUS.error;
+        }
+    }
+    /**
+     * Closes the Redis connection when the app shuts down, so the process can exit cleanly.
+     */
+    async onModuleDestroy() {
+        await this.redisClient?.quit();
+    }
+    /**
+     * Records one attempt for `key` and blocks when there have been too many inside the rule's window.
+     *
+     * @param key - What is being limited, e.g. an IP address, an email or a user id.
+     * @param rule - How many attempts are allowed and in how long a window.
+     * @throws AuthError TOO_MANY_REQUESTS (with `retryAfterSeconds`) when the limit is exceeded.
+     * @example
+     * await rateLimiter.consume(`sign-in:ip:${ipAddress}`, RATE_LIMITS.signInPerIp);
+     */
+    async consume(key, rule) {
+        const secondsToWait = this.redisClient ? await this.countInRedis(key, rule) : this.countInMemory(key, rule);
+        if (secondsToWait > 0)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.tooManyRequests, { retryAfterSeconds: secondsToWait });
+    }
+    /**
+     * Forgets the attempts for `key`, e.g. the per-account sign-in counter after a successful sign-in.
+     *
+     * @param key - The same key that was passed to `consume`.
+     */
+    async reset(key) {
+        if (this.redisClient)
+            await this.redisClient.del(constants_1.RATE_LIMIT_REDIS_KEY_PREFIX + key);
+        else
+            this.countersInMemory.delete(key);
+    }
+    /**
+     * Counts an attempt in Redis (shared by every server).
+     * If Redis is down the request is blocked, rather than allowing unlimited password or code guessing.
+     *
+     * @param key - What is being limited.
+     * @param rule - The limit to apply.
+     * @returns 0 when allowed, otherwise the seconds until the window resets.
+     */
+    async countInRedis(key, rule) {
+        const redisKey = constants_1.RATE_LIMIT_REDIS_KEY_PREFIX + key;
+        try {
+            const attempts = await this.redisClient.incr(redisKey);
+            if (attempts === 1)
+                await this.redisClient.expire(redisKey, rule.windowSeconds);
+            if (attempts <= rule.maximumAttempts)
+                return 0;
+            const secondsLeft = await this.redisClient.ttl(redisKey);
+            if (secondsLeft < 0) {
+                // The expiry was lost (e.g. a crash between INCR and EXPIRE); set it so the key can't block forever.
+                await this.redisClient.expire(redisKey, rule.windowSeconds);
+                return rule.windowSeconds;
+            }
+            return Math.max(secondsLeft, 1);
+        }
+        catch (error) {
+            // If Redis is down we block, rather than allow unlimited password or code guessing.
+            this.logger.error(`Redis unavailable, blocking request: ${error.message}`);
+            return rule.windowSeconds;
+        }
+    }
+    /**
+     * Counts an attempt in this server's memory (used when there is no Redis).
+     *
+     * @param key - What is being limited.
+     * @param rule - The limit to apply.
+     * @returns 0 when allowed, otherwise the seconds until the window resets.
+     */
+    countInMemory(key, rule) {
+        const now = Date.now();
+        let counter = this.countersInMemory.get(key);
+        if (!counter || counter.windowEndsAt <= now) {
+            counter = { attempts: 0, windowEndsAt: now + rule.windowSeconds * constants_1.SECOND_IN_MILLISECONDS };
+            this.countersInMemory.set(key, counter);
+        }
+        counter.attempts += 1;
+        this.pruneExpiredCounters(now);
+        return counter.attempts > rule.maximumAttempts ? Math.ceil((counter.windowEndsAt - now) / constants_1.SECOND_IN_MILLISECONDS) : 0;
+    }
+    /**
+     * Removes finished windows once the map gets large, so memory stays bounded on long-running servers.
+     *
+     * @param now - The current time in milliseconds.
+     */
+    pruneExpiredCounters(now) {
+        const cleanUpThreshold = constants_1.IN_MEMORY_RATE_LIMIT_MAX_ENTRIES;
+        if (this.countersInMemory.size < cleanUpThreshold)
+            return;
+        for (const [key, counter] of this.countersInMemory) {
+            if (counter.windowEndsAt <= now)
+                this.countersInMemory.delete(key);
+        }
+    }
+};
+exports.RateLimiterService = RateLimiterService;
+exports.RateLimiterService = RateLimiterService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object])
+], RateLimiterService);
+//# sourceMappingURL=rate-limiter.service.js.map

package/dist/common/rate-limiter.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.service.js","sourceRoot":"","sources":["../../src/common/rate-limiter.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA6E;AAE7E,2CAYqB;AACrB,6CAAyC;AACzC,iCAAqC;AAErC;;;;GAIG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IACZ,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAW,CAAC,WAAW,CAAC,CAAC;IAC7C,WAAW,CAAO;IAClB,gBAAgB,GAAG,IAAI,GAAG,EAAsD,CAAC;IAElG,YAAwC,OAAoB;QAC1D,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,0FAA0F;YAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YACnC,2FAA2F;YAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;YAC1D,IAAI,CAAC,WAAW,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,kCAAsB,EAAE,CAAC;YAC3D,2FAA2F;YAC3F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,yBAAa,CAAC,OAAO,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,IAAA,kBAAW,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,mCAAuB,CAAC,CAAC;YACpE,OAAO,yBAAa,CAAC,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,yBAAa,CAAC,KAAK,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,IAAmB;QAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5G,IAAI,aAAa,GAAG,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,eAAe,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC;IAChH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,uCAA2B,GAAG,GAAG,CAAC,CAAC;;YAC/E,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,IAAmB;QACzD,MAAM,QAAQ,GAAG,uCAA2B,GAAG,GAAG,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAW,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/D,IAAI,QAAQ,KAAK,CAAC;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAChF,IAAI,QAAQ,IAAI,IAAI,CAAC,eAAe;gBAAE,OAAO,CAAC,CAAC;YAE/C,MAAM,WAAW,GAAW,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjE,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,qGAAqG;gBACrG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC5D,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oFAAoF;YACpF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAyC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,GAAW,EAAE,IAAmB;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,IAAI,GAAG,EAAE,CAAC;YAC5C,OAAO,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,kCAAsB,EAAE,CAAC;YAC3F,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC,GAAG,kCAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxH,CAAC;IAED;;;;OAIG;IACK,oBAAoB,CAAC,GAAW;QACtC,MAAM,gBAAgB,GAAG,4CAAgC,CAAC;QAC1D,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,gBAAgB;YAAE,OAAO;QAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,YAAY,IAAI,GAAG;gBAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;CACF,CAAA;AA5HY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAME,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;;GAL5B,kBAAkB,CA4H9B"}

package/dist/common/refresh-token-cookie.d.ts

@@ -0,0 +1,78 @@
+import { CallHandler, ExecutionContext, NestInterceptor } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Observable } from 'rxjs';
+import { AuthOptions, RefreshTokenCookieOptions } from '../auth-options.js';
+/** The minimal request/response surface used here (works with Express and Fastify). */
+interface HttpRequestLike {
+    headers: Record<string, string | string[] | undefined>;
+}
+/**
+ * Marks the library's own controllers, so the refresh-token-cookie interceptor never touches the app's routes.
+ *
+ * @returns A class decorator.
+ */
+export declare const LibraryController: () => import("@nestjs/common").CustomDecorator<"techelusive-auth:library-controller">;
+/**
+ * Marks a route (logout) after which the browser should forget the refresh token cookie.
+ *
+ * @returns A method decorator.
+ */
+export declare const ClearsRefreshTokenCookie: () => import("@nestjs/common").CustomDecorator<"techelusive-auth:clears-refresh-token-cookie">;
+/**
+ * Builds the Set-Cookie value for the refresh token:
+ * "name=value; Max-Age=...; Path=/; HttpOnly; Secure; SameSite=Strict"
+ *
+ * @param options - The app's cookie settings (name, path, domain, sameSite).
+ * @param value - The refresh token, or "" when deleting the cookie.
+ * @param maxAgeSeconds - How long the browser should keep it; 0 deletes the cookie.
+ * @returns The cookie string for the Set-Cookie header.
+ */
+export declare function buildRefreshCookie(options: RefreshTokenCookieOptions, value: string, maxAgeSeconds: number): string;
+/**
+ * Reads the refresh token from the request's Cookie header.
+ *
+ * @param options - The app's cookie settings (to know the cookie's name).
+ * @param request - The incoming request.
+ * @returns The refresh token, or undefined if the cookie is missing or malformed.
+ */
+export declare function readRefreshCookie(options: RefreshTokenCookieOptions, request: HttpRequestLike): string | undefined;
+/**
+ * Cross-site request protection for cookie refreshes: the browser always sends the Origin header
+ * on these requests, and it must be one of the app's own websites.
+ *
+ * @param options - The app's cookie settings, including `allowedOrigins`.
+ * @param request - The incoming request.
+ * @throws AuthError FORBIDDEN when the origin is missing or not in the list.
+ */
+export declare function assertAllowedOrigin(options: RefreshTokenCookieOptions, request: HttpRequestLike): void;
+/**
+ * Checks whether the request comes from one of the web app's own origins (browsers send Origin).
+ *
+ * @param options - The app's cookie settings, including `allowedOrigins`.
+ * @param request - The incoming request.
+ * @returns True when the Origin header is in the allowed list.
+ */
+export declare function isAllowedOrigin(options: RefreshTokenCookieOptions, request: HttpRequestLike): boolean;
+/**
+ * Active only when AuthOptions.refreshTokenCookie is set, and only for requests from the allowed
+ * web origins, so mobile apps and servers on the same API keep getting the token in the body.
+ * On the library's routes:
+ * - a response carrying a refresh token: the token moves into the HttpOnly cookie and the body
+ *   says `refreshTokenInCookie: true` instead,
+ * - routes marked @ClearsRefreshTokenCookie() (logout): the cookie is deleted.
+ */
+export declare class RefreshTokenCookieInterceptor implements NestInterceptor {
+    private readonly options;
+    private readonly reflector;
+    constructor(options: AuthOptions, reflector: Reflector);
+    /**
+     * Moves the refresh token from the response body into the cookie (or clears the cookie on logout).
+     * Requests that don't qualify pass through untouched.
+     *
+     * @param context - Nest's view of the current request.
+     * @param next - The route handler.
+     * @returns The response body, with `refreshToken` replaced by `refreshTokenInCookie: true` when it was moved.
+     */
+    intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
+}
+export {};

package/dist/common/refresh-token-cookie.js

@@ -0,0 +1,185 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshTokenCookieInterceptor = exports.ClearsRefreshTokenCookie = exports.LibraryController = void 0;
+exports.buildRefreshCookie = buildRefreshCookie;
+exports.readRefreshCookie = readRefreshCookie;
+exports.assertAllowedOrigin = assertAllowedOrigin;
+exports.isAllowedOrigin = isAllowedOrigin;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const rxjs_1 = require("rxjs");
+const constants_1 = require("../constants.js");
+const auth_error_1 = require("./auth-error");
+/**
+ * Marks the library's own controllers, so the refresh-token-cookie interceptor never touches the app's routes.
+ *
+ * @returns A class decorator.
+ */
+const LibraryController = () => (0, common_1.SetMetadata)(constants_1.METADATA_KEY.libraryController, true);
+exports.LibraryController = LibraryController;
+/**
+ * Marks a route (logout) after which the browser should forget the refresh token cookie.
+ *
+ * @returns A method decorator.
+ */
+const ClearsRefreshTokenCookie = () => (0, common_1.SetMetadata)(constants_1.METADATA_KEY.clearsRefreshTokenCookie, true);
+exports.ClearsRefreshTokenCookie = ClearsRefreshTokenCookie;
+/**
+ * Builds the Set-Cookie value for the refresh token:
+ * "name=value; Max-Age=...; Path=/; HttpOnly; Secure; SameSite=Strict"
+ *
+ * @param options - The app's cookie settings (name, path, domain, sameSite).
+ * @param value - The refresh token, or "" when deleting the cookie.
+ * @param maxAgeSeconds - How long the browser should keep it; 0 deletes the cookie.
+ * @returns The cookie string for the Set-Cookie header.
+ */
+function buildRefreshCookie(options, value, maxAgeSeconds) {
+    const parts = [
+        `${cookieName(options)}${constants_1.COOKIE_NAME_VALUE_SEPARATOR}${encodeURIComponent(value)}`,
+        `${constants_1.COOKIE_ATTRIBUTE.maxAge}${constants_1.COOKIE_NAME_VALUE_SEPARATOR}${Math.max(Math.floor(maxAgeSeconds), 0)}`,
+        `${constants_1.COOKIE_ATTRIBUTE.path}${constants_1.COOKIE_NAME_VALUE_SEPARATOR}${options.path ?? constants_1.REFRESH_TOKEN_COOKIE_DEFAULTS.path}`,
+        ...(options.domain ? [`${constants_1.COOKIE_ATTRIBUTE.domain}${constants_1.COOKIE_NAME_VALUE_SEPARATOR}${options.domain}`] : []),
+        `${constants_1.COOKIE_ATTRIBUTE.sameSite}${constants_1.COOKIE_NAME_VALUE_SEPARATOR}${options.sameSite ?? constants_1.REFRESH_TOKEN_COOKIE_DEFAULTS.sameSite}`,
+        constants_1.COOKIE_ATTRIBUTE.httpOnly,
+        constants_1.COOKIE_ATTRIBUTE.secure,
+    ];
+    return parts.join(constants_1.COOKIE_ATTRIBUTE_SEPARATOR);
+}
+/**
+ * Reads the refresh token from the request's Cookie header.
+ *
+ * @param options - The app's cookie settings (to know the cookie's name).
+ * @param request - The incoming request.
+ * @returns The refresh token, or undefined if the cookie is missing or malformed.
+ */
+function readRefreshCookie(options, request) {
+    const header = request.headers[constants_1.HTTP_HEADER.cookie];
+    const cookieHeader = Array.isArray(header) ? header.join(constants_1.COOKIE_PAIR_SEPARATOR) : header;
+    if (!cookieHeader)
+        return undefined;
+    const wantedName = cookieName(options);
+    for (const pair of cookieHeader.split(constants_1.COOKIE_PAIR_SEPARATOR)) {
+        const separatorIndex = pair.indexOf(constants_1.COOKIE_NAME_VALUE_SEPARATOR);
+        if (separatorIndex > 0 && pair.slice(0, separatorIndex).trim() === wantedName) {
+            try {
+                return decodeURIComponent(pair.slice(separatorIndex + 1).trim());
+            }
+            catch {
+                return undefined;
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * Cross-site request protection for cookie refreshes: the browser always sends the Origin header
+ * on these requests, and it must be one of the app's own websites.
+ *
+ * @param options - The app's cookie settings, including `allowedOrigins`.
+ * @param request - The incoming request.
+ * @throws AuthError FORBIDDEN when the origin is missing or not in the list.
+ */
+function assertAllowedOrigin(options, request) {
+    if (!isAllowedOrigin(options, request))
+        throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.originNotAllowed);
+}
+/**
+ * @param options - The app's cookie settings.
+ * @returns The configured cookie name, or the default one.
+ */
+function cookieName(options) {
+    return options.name ?? constants_1.REFRESH_TOKEN_COOKIE_DEFAULTS.name;
+}
+/**
+ * Adds a Set-Cookie header without removing cookies that other code has already set.
+ *
+ * @param response - The Express or Fastify response.
+ * @param cookie - The full cookie string from `buildRefreshCookie`.
+ */
+function setCookieHeader(response, cookie) {
+    // Express: append() keeps cookies set by other code. Fastify: header() appends Set-Cookie itself.
+    if (typeof response.append === 'function')
+        response.append(constants_1.HTTP_HEADER.setCookie, cookie);
+    else
+        response.header(constants_1.HTTP_HEADER.setCookie, cookie);
+}
+/**
+ * Checks whether the request comes from one of the web app's own origins (browsers send Origin).
+ *
+ * @param options - The app's cookie settings, including `allowedOrigins`.
+ * @param request - The incoming request.
+ * @returns True when the Origin header is in the allowed list.
+ */
+function isAllowedOrigin(options, request) {
+    const origin = request.headers[constants_1.HTTP_HEADER.origin];
+    return typeof origin === 'string' && options.allowedOrigins.includes(origin);
+}
+/**
+ * Active only when AuthOptions.refreshTokenCookie is set, and only for requests from the allowed
+ * web origins, so mobile apps and servers on the same API keep getting the token in the body.
+ * On the library's routes:
+ * - a response carrying a refresh token: the token moves into the HttpOnly cookie and the body
+ *   says `refreshTokenInCookie: true` instead,
+ * - routes marked @ClearsRefreshTokenCookie() (logout): the cookie is deleted.
+ */
+let RefreshTokenCookieInterceptor = class RefreshTokenCookieInterceptor {
+    options;
+    reflector;
+    constructor(options, reflector) {
+        this.options = options;
+        this.reflector = reflector;
+    }
+    /**
+     * Moves the refresh token from the response body into the cookie (or clears the cookie on logout).
+     * Requests that don't qualify pass through untouched.
+     *
+     * @param context - Nest's view of the current request.
+     * @param next - The route handler.
+     * @returns The response body, with `refreshToken` replaced by `refreshTokenInCookie: true` when it was moved.
+     */
+    intercept(context, next) {
+        const cookieOptions = this.options.refreshTokenCookie;
+        if (!cookieOptions || context.getType() !== constants_1.HTTP_CONTEXT_TYPE)
+            return next.handle();
+        if (this.reflector.get(constants_1.METADATA_KEY.libraryController, context.getClass()) !== true)
+            return next.handle();
+        if (!isAllowedOrigin(cookieOptions, context.switchToHttp().getRequest()))
+            return next.handle();
+        const response = context.switchToHttp().getResponse();
+        const clearsCookie = this.reflector.get(constants_1.METADATA_KEY.clearsRefreshTokenCookie, context.getHandler()) === true;
+        return next.handle().pipe((0, rxjs_1.map)((body) => {
+            if (clearsCookie) {
+                setCookieHeader(response, buildRefreshCookie(cookieOptions, '', 0));
+                return body;
+            }
+            if (!body || typeof body !== 'object')
+                return body;
+            const { [constants_1.REFRESH_TOKEN_RESPONSE_FIELD]: refreshToken, ...rest } = body;
+            if (typeof refreshToken !== 'string')
+                return body;
+            const expiresAt = Date.parse(String(rest[constants_1.REFRESH_TOKEN_EXPIRES_AT_RESPONSE_FIELD]));
+            const maxAgeSeconds = Number.isNaN(expiresAt) ? 0 : (expiresAt - Date.now()) / constants_1.SECOND_IN_MILLISECONDS;
+            setCookieHeader(response, buildRefreshCookie(cookieOptions, refreshToken, maxAgeSeconds));
+            return { ...rest, [constants_1.REFRESH_TOKEN_IN_COOKIE_FIELD]: true };
+        }));
+    }
+};
+exports.RefreshTokenCookieInterceptor = RefreshTokenCookieInterceptor;
+exports.RefreshTokenCookieInterceptor = RefreshTokenCookieInterceptor = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, core_1.Reflector])
+], RefreshTokenCookieInterceptor);
+//# sourceMappingURL=refresh-token-cookie.js.map

package/dist/common/refresh-token-cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token-cookie.js","sourceRoot":"","sources":["../../src/common/refresh-token-cookie.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAsDA,gDAWC;AASD,8CAgBC;AAUD,kDAEC;AA6BD,0CAGC;AAtID,2CAAiH;AACjH,uCAAyC;AACzC,+BAAuC;AAEvC,2CAeqB;AACrB,6CAAyC;AAWzC;;;;GAIG;AACI,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,wBAAY,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;AAA5E,QAAA,iBAAiB,qBAA2D;AAEzF;;;;GAIG;AACI,MAAM,wBAAwB,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,wBAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;AAA1F,QAAA,wBAAwB,4BAAkE;AAEvG;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAAC,OAAkC,EAAE,KAAa,EAAE,aAAqB;IACzG,MAAM,KAAK,GAAG;QACZ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,uCAA2B,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAClF,GAAG,4BAAgB,CAAC,MAAM,GAAG,uCAA2B,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE;QACnG,GAAG,4BAAgB,CAAC,IAAI,GAAG,uCAA2B,GAAG,OAAO,CAAC,IAAI,IAAI,yCAA6B,CAAC,IAAI,EAAE;QAC7G,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,4BAAgB,CAAC,MAAM,GAAG,uCAA2B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,GAAG,4BAAgB,CAAC,QAAQ,GAAG,uCAA2B,GAAG,OAAO,CAAC,QAAQ,IAAI,yCAA6B,CAAC,QAAQ,EAAE;QACzH,4BAAgB,CAAC,QAAQ;QACzB,4BAAgB,CAAC,MAAM;KACxB,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,sCAA0B,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,OAAkC,EAAE,OAAwB;IAC5F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,uBAAW,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAqB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzF,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,iCAAqB,CAAC,EAAE,CAAC;QAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,uCAA2B,CAAC,CAAC;QACjE,IAAI,cAAc,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;YAC9E,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,OAAkC,EAAE,OAAwB;IAC9F,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,CAAC,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,OAAkC;IACpD,OAAO,OAAO,CAAC,IAAI,IAAI,yCAA6B,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,QAA0B,EAAE,MAAc;IACjE,kGAAkG;IAClG,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU;QAAE,QAAQ,CAAC,MAAM,CAAC,uBAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;;QACrF,QAAQ,CAAC,MAAM,CAAC,uBAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,OAAkC,EAAE,OAAwB;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,uBAAW,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;GAOG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAEO;IAC5B;IAFnB,YAC+C,OAAoB,EAChD,SAAoB;QADQ,YAAO,GAAP,OAAO,CAAa;QAChD,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ;;;;;;;OAOG;IACH,SAAS,CAAC,OAAyB,EAAE,IAAiB;QACpD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACtD,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,6BAAiB;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACpF,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAU,wBAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACnH,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAmB,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QAChH,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAoB,CAAC;QACxE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAU,wBAAY,CAAC,wBAAwB,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,IAAI,CAAC;QAEvH,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CACvB,IAAA,UAAG,EAAC,CAAC,IAAa,EAAE,EAAE;YACpB,IAAI,YAAY,EAAE,CAAC;gBACjB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACnD,MAAM,EAAE,CAAC,wCAA4B,CAAC,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,IAA+B,CAAC;YAClG,IAAI,OAAO,YAAY,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAClD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAuC,CAAC,CAAC,CAAC,CAAC;YACpF,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,kCAAsB,CAAC;YACtG,eAAe,CAAC,QAAQ,EAAE,kBAAkB,CAAC,aAAa,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;YAC1F,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,yCAA6B,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5D,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;AAtCY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACC,gBAAS;GAH5B,6BAA6B,CAsCzC"}

package/dist/common/request-context.d.ts

@@ -0,0 +1,14 @@
+/** Who is making the request. Used for rate limits, the device list and the audit log. */
+export interface RequestContext {
+    ipAddress: string | null;
+    userAgent: string | null;
+}
+/**
+ * Controller parameter decorator: @CurrentRequest() request: RequestContext
+ *
+ * The IP comes from Express's `request.ip`. Behind a load balancer, set app.set('trust proxy', 1)
+ * in your main.ts, or every request will appear to come from the load balancer.
+ */
+export declare const CurrentRequest: (...dataOrPipes: unknown[]) => ParameterDecorator;
+/** For calls made from your own code (scripts, admin tools) rather than an HTTP request. */
+export declare const SYSTEM_REQUEST: RequestContext;

package/dist/common/request-context.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SYSTEM_REQUEST = exports.CurrentRequest = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("../constants.js");
+/**
+ * Controller parameter decorator: @CurrentRequest() request: RequestContext
+ *
+ * The IP comes from Express's `request.ip`. Behind a load balancer, set app.set('trust proxy', 1)
+ * in your main.ts, or every request will appear to come from the load balancer.
+ */
+exports.CurrentRequest = (0, common_1.createParamDecorator)((_unused, executionContext) => {
+    const request = executionContext.switchToHttp().getRequest();
+    const userAgent = request.headers?.[constants_1.HTTP_HEADER.userAgent];
+    return {
+        ipAddress: request.ip ?? null,
+        userAgent: userAgent ? userAgent.slice(0, constants_1.USER_AGENT_MAX_LENGTH) : null,
+    };
+});
+/** For calls made from your own code (scripts, admin tools) rather than an HTTP request. */
+exports.SYSTEM_REQUEST = { ipAddress: null, userAgent: constants_1.SYSTEM_USER_AGENT };
+//# sourceMappingURL=request-context.js.map

package/dist/common/request-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/common/request-context.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AACxE,2CAAoF;AAQpF;;;;;GAKG;AACU,QAAA,cAAc,GAAG,IAAA,6BAAoB,EAAC,CAAC,OAAgB,EAAE,gBAAkC,EAAkB,EAAE;IAC1H,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAuB,OAAO,CAAC,OAAO,EAAE,CAAC,uBAAW,CAAC,SAAS,CAAC,CAAC;IAC/E,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,EAAE,IAAI,IAAI;QAC7B,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAqB,CAAC,CAAC,CAAC,CAAC,IAAI;KACxE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,4FAA4F;AAC/E,QAAA,cAAc,GAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,6BAAiB,EAAE,CAAC"}

package/dist/common/strict-validation.pipe.d.ts

@@ -0,0 +1,8 @@
+import { ValidationPipe } from '@nestjs/common';
+/**
+ * Checks request bodies against their DTO class.
+ * - whitelist + forbidNonWhitelisted: unknown fields are rejected, so a client cannot sneak in
+ *   fields such as "roles" or "status".
+ * - transform: the body becomes an instance of the DTO, so @Transform (e.g. trimming) runs.
+ */
+export declare const strictValidationPipe: ValidationPipe;

package/dist/common/strict-validation.pipe.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.strictValidationPipe = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Checks request bodies against their DTO class.
+ * - whitelist + forbidNonWhitelisted: unknown fields are rejected, so a client cannot sneak in
+ *   fields such as "roles" or "status".
+ * - transform: the body becomes an instance of the DTO, so @Transform (e.g. trimming) runs.
+ */
+exports.strictValidationPipe = new common_1.ValidationPipe({
+    whitelist: true,
+    forbidNonWhitelisted: true,
+    transform: true,
+});
+//# sourceMappingURL=strict-validation.pipe.js.map

package/dist/common/strict-validation.pipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-validation.pipe.js","sourceRoot":"","sources":["../../src/common/strict-validation.pipe.ts"],"names":[],"mappings":";;;AAAA,2CAAgD;AAEhD;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,IAAI,uBAAc,CAAC;IACrD,SAAS,EAAE,IAAI;IACf,oBAAoB,EAAE,IAAI;IAC1B,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC"}

package/dist/common/time.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The current time in whole seconds since 1970 (the unit JWTs, TOTP and webhook signatures use).
+ *
+ * @returns The Unix time in seconds.
+ */
+export declare function currentUnixTimeSeconds(): number;
+/**
+ * Waits for `work`, but gives up if it takes too long (used by health checks).
+ *
+ * @param work - The promise to wait for.
+ * @param timeoutMs - How long to wait, in milliseconds.
+ * @returns What `work` resolved to.
+ * @throws If `work` rejects, or with "Timed out after N ms" when the time runs out.
+ */
+export declare function withTimeout<Result>(work: Promise<Result>, timeoutMs: number): Promise<Result>;

package/dist/common/time.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.currentUnixTimeSeconds = currentUnixTimeSeconds;
+exports.withTimeout = withTimeout;
+const constants_1 = require("../constants.js");
+/**
+ * The current time in whole seconds since 1970 (the unit JWTs, TOTP and webhook signatures use).
+ *
+ * @returns The Unix time in seconds.
+ */
+function currentUnixTimeSeconds() {
+    return Math.floor(Date.now() / constants_1.SECOND_IN_MILLISECONDS);
+}
+/**
+ * Waits for `work`, but gives up if it takes too long (used by health checks).
+ *
+ * @param work - The promise to wait for.
+ * @param timeoutMs - How long to wait, in milliseconds.
+ * @returns What `work` resolved to.
+ * @throws If `work` rejects, or with "Timed out after N ms" when the time runs out.
+ */
+async function withTimeout(work, timeoutMs) {
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error(`Timed out after ${timeoutMs} ms`)), timeoutMs);
+    });
+    try {
+        return await Promise.race([work, timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=time.js.map

package/dist/common/time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.js","sourceRoot":"","sources":["../../src/common/time.ts"],"names":[],"mappings":";;AAOA,wDAEC;AAUD,kCAUC;AA7BD,2CAAqD;AAErD;;;;GAIG;AACH,SAAgB,sBAAsB;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kCAAsB,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,WAAW,CAAS,IAAqB,EAAE,SAAiB;IAChF,IAAI,KAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,SAAS,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}