@ttt-productions/auth-core 1.6.10 → 1.6.11

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@ttt-productions/auth-core",
-    "version": "1.6.10",
+    "version": "1.6.11",
     "description": "Shared Firebase authentication utilities and React hooks for TTT Productions apps",
     "repository": {
         "type": "git",
@@ -66,12 +66,11 @@
     "devDependencies": {
         "@types/react": "^19.0.0",
         "@types/react-dom": "^19.0.0",
-        "firebase": "^10.0.0",
+        "firebase": "^12.14.0",
         "firebase-admin": "^14.0.0",
         "firebase-functions": "^7.0.0",
         "react": "^19.2.0",
-        "react-dom": "^19.2.0",
-        "typescript": "^5.8.3"
+        "react-dom": "^19.2.0"
     },
     "author": "DJ (TTT Productions)",
     "license": "MIT"

package/dist/server/assertAuth.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=assertAuth.test.d.ts.map

package/dist/server/assertAuth.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assertAuth.test.d.ts","sourceRoot":"","sources":["../../src/server/assertAuth.test.ts"],"names":[],"mappings":""}

package/dist/server/assertAuth.test.js

@@ -1,373 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-// NOTE: there is deliberately NO `vi.mock("firebase-functions/v2/https")` here.
-// assertAuth no longer constructs HttpsError — it throws AuthAssertionError and the
-// consuming app maps it (see authError.ts for why). The only remaining reference to
-// firebase-functions in assertAuth.ts is a TYPE import, which is erased at runtime.
-import { createAssertAuth } from "./assertAuth.js";
-import { AuthAssertionError } from "./authError.js";
-import { ACCEPTANCE_REQUIRED_REASON, isAcceptanceRequiredError } from "../acceptance.js";
-import { EMAIL_VERIFICATION_REQUIRED_REASON, isEmailVerificationRequiredError, } from "../email-verification.js";
-function makeRequest(opts) {
-    const uid = opts?.uid ?? "uid-123";
-    return {
-        data: {},
-        rawRequest: {},
-        auth: {
-            uid,
-            token: { uid, email_verified: opts?.emailVerified ?? true },
-        },
-    };
-}
-function makeUnauthRequest() {
-    return { data: {}, rawRequest: {}, auth: undefined };
-}
-const activeUserDoc = {
-    uid: "uid-123",
-    displayName: "Test User",
-    status: "active",
-};
-// Minimal Firestore stub returning the active user doc, for tests that build
-// their own config instead of using the shared beforeEach harness.
-function fakeDbWithUser() {
-    const userDocRef = {
-        get: vi.fn().mockResolvedValue({ exists: true, data: () => activeUserDoc }),
-    };
-    return { doc: vi.fn(() => userDocRef) };
-}
-// --- harness ---------------------------------------------------------------
-let mockUserGet;
-let mockRequireAdmin;
-let mockDbDoc;
-let assertAuth;
-beforeEach(() => {
-    mockUserGet = vi.fn().mockResolvedValue({ exists: true, data: () => activeUserDoc });
-    mockRequireAdmin = vi.fn().mockResolvedValue(undefined);
-    const userDocRef = { get: mockUserGet };
-    mockDbDoc = vi.fn(() => userDocRef);
-    const fakeDb = { doc: mockDbDoc };
-    const config = {
-        firestore: () => fakeDb,
-        userProfilePath: (uid) => `userProfiles/${uid}`,
-        getUserStatus: (user) => {
-            if (user.status === "banned")
-                return "banned";
-            if (user.status === "suspended")
-                return "suspended";
-            return "active";
-        },
-        requireAdmin: mockRequireAdmin,
-    };
-    assertAuth = createAssertAuth(config);
-});
-// --- tests -----------------------------------------------------------------
-// REGRESSION GUARD (2026-07-20). assertAuth must throw a plain, framework-free
-// AuthAssertionError — never an HttpsError built inside this package. firebase-functions
-// 7.2.5 ships two distinct HttpsError classes (ESM entry vs the CJS callable runtime), so
-// a package-built HttpsError fails the runtime's `instanceof` check and onCall converts a
-// correct 400 into a 500 INTERNAL. Since assertAuth is the first line of every callable,
-// that silently broke EVERY auth rejection in deployed environments. If someone
-// reintroduces `new HttpsError(...)` here, these assertions fail.
-describe("throws a framework-free typed error (never a package-built HttpsError)", () => {
-    it("rejects with an AuthAssertionError instance carrying the HttpsError code string", async () => {
-        const err = await assertAuth(makeUnauthRequest()).catch((e) => e);
-        expect(err).toBeInstanceOf(AuthAssertionError);
-        expect(err.name).toBe("AuthAssertionError");
-        expect(err.code).toBe("unauthenticated");
-    });
-    it("does not decorate the error with HttpsError's own shape", async () => {
-        const err = (await assertAuth(makeUnauthRequest()).catch((e) => e));
-        // `httpErrorCode`/`toJSON` are HttpsError internals — their absence proves the
-        // package is not constructing one, which is the whole point of the fix.
-        expect(err.httpErrorCode).toBeUndefined();
-        expect(err.toJSON).toBeUndefined();
-    });
-    it("uses AuthAssertionError for the email-verification rejection too", async () => {
-        const err = await assertAuth(makeRequest({ emailVerified: false }), {
-            emailVerified: true,
-            allowAnyStatus: true,
-        }).catch((e) => e);
-        expect(err).toBeInstanceOf(AuthAssertionError);
-        expect(err.code).toBe("failed-precondition");
-    });
-});
-describe("Authentication", () => {
-    it("throws unauthenticated when request.auth is absent", async () => {
-        await expect(assertAuth(makeUnauthRequest())).rejects.toMatchObject({
-            code: "unauthenticated",
-        });
-    });
-    it("succeeds with no Firestore reads when only allowAnyStatus is set", async () => {
-        const ctx = await assertAuth(makeRequest(), { allowAnyStatus: true });
-        expect(ctx.uid).toBe("uid-123");
-        expect(ctx.userDoc).toBeUndefined();
-        expect(mockDbDoc).not.toHaveBeenCalled();
-    });
-});
-describe("Email verification", () => {
-    it("throws failed-precondition when emailVerified required and token email_verified is false", async () => {
-        await expect(assertAuth(makeRequest({ emailVerified: false }), {
-            emailVerified: true,
-            allowAnyStatus: true,
-        })).rejects.toMatchObject({ code: "failed-precondition" });
-    });
-    it("carries the email-verification reason in details, with the message unchanged", async () => {
-        const err = await assertAuth(makeRequest({ emailVerified: false }), {
-            emailVerified: true,
-            allowAnyStatus: true,
-        }).catch((e) => e);
-        expect(err).toBeInstanceOf(AuthAssertionError);
-        expect(err).toMatchObject({
-            code: "failed-precondition",
-            message: "Email must be verified",
-            details: { reason: EMAIL_VERIFICATION_REQUIRED_REASON },
-        });
-        expect(isEmailVerificationRequiredError(err)).toBe(true);
-        expect(isAcceptanceRequiredError(err)).toBe(false);
-    });
-    it("succeeds when emailVerified required and token email_verified is true", async () => {
-        await expect(assertAuth(makeRequest({ emailVerified: true }), {
-            emailVerified: true,
-            allowAnyStatus: true,
-        })).resolves.toMatchObject({ uid: "uid-123" });
-    });
-    it("succeeds when allowUnverified is true even if email_verified is false", async () => {
-        await expect(assertAuth(makeRequest({ emailVerified: false }), {
-            emailVerified: true,
-            allowUnverified: true,
-            allowAnyStatus: true,
-        })).resolves.toMatchObject({ uid: "uid-123" });
-    });
-});
-describe("Not-banned check (default behavior)", () => {
-    it("throws permission-denied when user status is banned", async () => {
-        mockUserGet.mockResolvedValue({
-            exists: true,
-            data: () => ({ ...activeUserDoc, status: "banned" }),
-        });
-        await expect(assertAuth(makeRequest())).rejects.toMatchObject({
-            code: "permission-denied",
-        });
-    });
-    it("throws permission-denied when user status is suspended", async () => {
-        mockUserGet.mockResolvedValue({
-            exists: true,
-            data: () => ({ ...activeUserDoc, status: "suspended" }),
-        });
-        await expect(assertAuth(makeRequest())).rejects.toMatchObject({
-            code: "permission-denied",
-        });
-    });
-    it("throws not-found when user doc does not exist", async () => {
-        mockUserGet.mockResolvedValue({ exists: false, data: () => null });
-        await expect(assertAuth(makeRequest())).rejects.toMatchObject({
-            code: "not-found",
-        });
-    });
-    it("succeeds when user doc has no status field", async () => {
-        mockUserGet.mockResolvedValue({
-            exists: true,
-            data: () => ({ uid: "uid-123", displayName: "Test" }),
-        });
-        const ctx = await assertAuth(makeRequest());
-        expect(ctx.uid).toBe("uid-123");
-        expect(ctx.userDoc).toBeDefined();
-    });
-    it("succeeds when user status is active", async () => {
-        const ctx = await assertAuth(makeRequest());
-        expect(ctx.uid).toBe("uid-123");
-        expect(ctx.userDoc).toMatchObject({ status: "active" });
-    });
-    it("skips user doc read entirely when allowAnyStatus is true", async () => {
-        await assertAuth(makeRequest(), { allowAnyStatus: true });
-        expect(mockUserGet).not.toHaveBeenCalled();
-    });
-});
-describe("allowSuspended opt-in", () => {
-    it("allows a suspended user when allowSuspended is true", async () => {
-        mockUserGet.mockResolvedValue({
-            exists: true,
-            data: () => ({ ...activeUserDoc, status: "suspended" }),
-        });
-        const ctx = await assertAuth(makeRequest(), { allowSuspended: true });
-        expect(ctx.uid).toBe("uid-123");
-        expect(ctx.userDoc).toMatchObject({ status: "suspended" });
-    });
-    it("still blocks a banned user even when allowSuspended is true", async () => {
-        mockUserGet.mockResolvedValue({
-            exists: true,
-            data: () => ({ ...activeUserDoc, status: "banned" }),
-        });
-        await expect(assertAuth(makeRequest(), { allowSuspended: true })).rejects.toMatchObject({ code: "permission-denied" });
-    });
-    it("still requires the user doc to exist when allowSuspended is true", async () => {
-        mockUserGet.mockResolvedValue({ exists: false, data: () => null });
-        await expect(assertAuth(makeRequest(), { allowSuspended: true })).rejects.toMatchObject({ code: "not-found" });
-    });
-});
-describe("Admin check", () => {
-    it("propagates the error when requireAdmin throws", async () => {
-        mockRequireAdmin.mockRejectedValue(Object.assign(new Error("Administrator access required"), {
-            code: "permission-denied",
-        }));
-        await expect(assertAuth(makeRequest(), {
-            admin: { allowJrAdmin: false },
-            allowAnyStatus: true,
-        })).rejects.toMatchObject({ code: "permission-denied" });
-    });
-    it("succeeds and returns ctx when requireAdmin resolves", async () => {
-        mockRequireAdmin.mockResolvedValue(undefined);
-        const ctx = await assertAuth(makeRequest(), {
-            admin: { allowJrAdmin: true },
-            allowAnyStatus: true,
-        });
-        expect(ctx.uid).toBe("uid-123");
-        expect(mockRequireAdmin).toHaveBeenCalledWith("uid-123", expect.any(Object), { allowJrAdmin: true });
-    });
-    it("populates ctx.admin with the requireAdmin result when an admin check runs", async () => {
-        const adminMock = vi.fn().mockResolvedValue({ role: "superadmin" });
-        const config = {
-            firestore: () => fakeDbWithUser(),
-            userProfilePath: (uid) => `userProfiles/${uid}`,
-            getUserStatus: (user) => {
-                if (user.status === "banned")
-                    return "banned";
-                if (user.status === "suspended")
-                    return "suspended";
-                return "active";
-            },
-            requireAdmin: adminMock,
-        };
-        const typedAssertAuth = createAssertAuth(config);
-        const ctx = await typedAssertAuth(makeRequest(), {
-            admin: { allowJrAdmin: true },
-        });
-        expect(ctx.admin).toEqual({ role: "superadmin" });
-    });
-    it("leaves ctx.admin undefined when no admin requirement is set", async () => {
-        const ctx = await assertAuth(makeRequest());
-        expect(ctx.admin).toBeUndefined();
-        expect(mockRequireAdmin).not.toHaveBeenCalled();
-    });
-});
-describe("Combined checks", () => {
-    it("returns fully populated ctx when all checks pass", async () => {
-        mockUserGet.mockResolvedValue({ exists: true, data: () => activeUserDoc });
-        mockRequireAdmin.mockResolvedValue(undefined);
-        const ctx = await assertAuth(makeRequest({ emailVerified: true }), {
-            emailVerified: true,
-            admin: { allowJrAdmin: true },
-        });
-        expect(ctx.uid).toBe("uid-123");
-        expect(ctx.userDoc).toMatchObject({ status: "active" });
-        expect(mockRequireAdmin).toHaveBeenCalled();
-    });
-});
-// Acceptance-level gate (optional `acceptance` config). Every case below that expects a
-// refusal passes on the pre-gate factory only if the gate is ignored — i.e. it fails there.
-describe("Acceptance-level gate", () => {
-    const CLAIM = "acceptedLevelClaim";
-    function gatedAssertAuth(requiredLevel) {
-        const requireAdmin = vi.fn().mockResolvedValue("admin");
-        const config = {
-            firestore: () => fakeDbWithUser(),
-            userProfilePath: (uid) => `userProfiles/${uid}`,
-            getUserStatus: (user) => (user.status === "banned" ? "banned" : "active"),
-            requireAdmin: requireAdmin,
-            acceptance: { claimKey: CLAIM, requiredLevel },
-        };
-        return { assert: createAssertAuth(config), requireAdmin };
-    }
-    function requestWithClaim(claim) {
-        const req = makeRequest();
-        if (claim !== undefined)
-            req.auth.token[CLAIM] = claim;
-        return req;
-    }
-    it("refuses a caller below the required level with a structured failed-precondition", async () => {
-        const { assert } = gatedAssertAuth(() => 3);
-        const err = await assert(requestWithClaim(2)).catch((e) => e);
-        expect(err).toBeInstanceOf(AuthAssertionError);
-        expect(err).toMatchObject({
-            code: "failed-precondition",
-            details: { reason: ACCEPTANCE_REQUIRED_REASON, requiredLevel: 3, acceptedLevel: 2 },
-        });
-        expect(isAcceptanceRequiredError(err)).toBe(true);
-        expect(isEmailVerificationRequiredError(err)).toBe(false);
-    });
-    it("treats a missing claim as accepted level 0", async () => {
-        const { assert } = gatedAssertAuth(() => 1);
-        await expect(assert(requestWithClaim(undefined))).rejects.toMatchObject({
-            details: { reason: ACCEPTANCE_REQUIRED_REASON, requiredLevel: 1, acceptedLevel: 0 },
-        });
-    });
-    it.each([["a string", "5"], ["NaN", Number.NaN], ["a negative", -4], ["null", null]])("treats %s claim as accepted level 0 (fails closed)", async (_label, claim) => {
-        const { assert } = gatedAssertAuth(() => 1);
-        await expect(assert(requestWithClaim(claim))).rejects.toMatchObject({
-            details: { acceptedLevel: 0 },
-        });
-    });
-    it("passes a caller at or above the required level", async () => {
-        const { assert } = gatedAssertAuth(() => 3);
-        await expect(assert(requestWithClaim(3))).resolves.toMatchObject({ uid: "uid-123" });
-        await expect(assert(requestWithClaim(7))).resolves.toMatchObject({ uid: "uid-123" });
-    });
-    it("awaits an async required-level reader", async () => {
-        const { assert } = gatedAssertAuth(async () => 2);
-        await expect(assert(requestWithClaim(1))).rejects.toMatchObject({ code: "failed-precondition" });
-    });
-    it.each([["zero", 0], ["NaN", Number.NaN], ["a negative", -1]])("requires nothing when the required level is %s", async (_label, level) => {
-        const { assert } = gatedAssertAuth(() => level);
-        await expect(assert(requestWithClaim(undefined))).resolves.toMatchObject({ uid: "uid-123" });
-    });
-    it("lets an allowUnaccepted callable through without reading the required level", async () => {
-        const requiredLevel = vi.fn(() => 9);
-        const { assert } = gatedAssertAuth(requiredLevel);
-        await expect(assert(requestWithClaim(undefined), { allowUnaccepted: true })).resolves.toMatchObject({
-            uid: "uid-123",
-        });
-        expect(requiredLevel).not.toHaveBeenCalled();
-    });
-    it("propagates a throwing required-level reader", async () => {
-        const failure = new Error("config unavailable");
-        const { assert } = gatedAssertAuth(() => {
-            throw failure;
-        });
-        await expect(assert(requestWithClaim(5))).rejects.toBe(failure);
-    });
-    it("refuses before the admin check runs", async () => {
-        const { assert, requireAdmin } = gatedAssertAuth(() => 2);
-        await expect(assert(requestWithClaim(1), { admin: { allowJrAdmin: true }, allowAnyStatus: true })).rejects.toMatchObject({ code: "failed-precondition" });
-        expect(requireAdmin).not.toHaveBeenCalled();
-    });
-    it("still gates a callable that skips the status check (allowAnyStatus)", async () => {
-        const { assert } = gatedAssertAuth(() => 1);
-        await expect(assert(requestWithClaim(0), { allowAnyStatus: true })).rejects.toMatchObject({
-            code: "failed-precondition",
-        });
-    });
-    it("keeps authentication first — an unauthenticated caller never reaches the gate", async () => {
-        const requiredLevel = vi.fn(() => 1);
-        const { assert } = gatedAssertAuth(requiredLevel);
-        await expect(assert(makeUnauthRequest())).rejects.toMatchObject({ code: "unauthenticated" });
-        expect(requiredLevel).not.toHaveBeenCalled();
-    });
-    it("is absent without config: an app that never sets `acceptance` behaves exactly as before", async () => {
-        // The shared harness config has no `acceptance`; a token with no level claim still passes.
-        await expect(assertAuth(makeRequest(), { allowUnaccepted: false })).resolves.toMatchObject({
-            uid: "uid-123",
-        });
-    });
-    it("leaves `details` undefined on every other rejection", async () => {
-        const unauthenticated = (await assertAuth(makeUnauthRequest()).catch((e) => e));
-        expect(unauthenticated.details).toBeUndefined();
-        mockUserGet.mockResolvedValue({ exists: false, data: () => null });
-        const missingProfile = (await assertAuth(makeRequest()).catch((e) => e));
-        expect(missingProfile.code).toBe("not-found");
-        expect(missingProfile.details).toBeUndefined();
-        mockUserGet.mockResolvedValue({ exists: true, data: () => ({ ...activeUserDoc, status: "banned" }) });
-        const banned = (await assertAuth(makeRequest()).catch((e) => e));
-        expect(banned.code).toBe("permission-denied");
-        expect(banned.details).toBeUndefined();
-    });
-});
-//# sourceMappingURL=assertAuth.test.js.map

package/dist/server/assertAuth.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"assertAuth.test.js","sourceRoot":"","sources":["../../src/server/assertAuth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,gFAAgF;AAChF,oFAAoF;AACpF,oFAAoF;AACpF,oFAAoF;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EACL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,0BAA0B,CAAC;AAUlC,SAAS,WAAW,CAAC,IAAgD;IACnE,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,SAAS,CAAC;IACnC,OAAO;QACL,IAAI,EAAE,EAAE;QACR,UAAU,EAAE,EAAE;QACd,IAAI,EAAE;YACJ,GAAG;YACH,KAAK,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,IAAI,IAAI,EAAE;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,aAAa,GAAa;IAC9B,GAAG,EAAE,SAAS;IACd,WAAW,EAAE,WAAW;IACxB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,6EAA6E;AAC7E,mEAAmE;AACnE,SAAS,cAAc;IACrB,MAAM,UAAU,GAAG;QACjB,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;KAC5E,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAE9E,IAAI,WAAqC,CAAC;AAC1C,IAAI,gBAA0C,CAAC;AAC/C,IAAI,SAAmC,CAAC;AACxC,IAAI,UAAyD,CAAC;AAE9D,UAAU,CAAC,GAAG,EAAE;IACd,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;IACrF,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAExD,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAExC,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IAEpC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,SAAS,EAAS,CAAC;IAEzC,MAAM,MAAM,GAA+B;QACzC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,GAAG,EAAE;QAC/C,aAAa,EAAE,CAAC,IAAI,EAAc,EAAE;YAClC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW;gBAAE,OAAO,WAAW,CAAC;YACpD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,YAAY,EAAE,gBAAuB;KACtC,CAAC;IAEF,UAAU,GAAG,gBAAgB,CAAW,MAAM,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAE9E,+EAA+E;AAC/E,yFAAyF;AACzF,0FAA0F;AAC1F,0FAA0F;AAC1F,yFAAyF;AACzF,gFAAgF;AAChF,kEAAkE;AAClE,QAAQ,CAAC,wEAAwE,EAAE,GAAG,EAAE;IACtF,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;QAC/C,MAAM,CAAE,GAA0B,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpE,MAAM,CAAE,GAA0B,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CACtD,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAClB,CAAuE,CAAC;QACzE,+EAA+E;QAC/E,wEAAwE;QACxE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;YAClE,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;QAC/C,MAAM,CAAE,GAA0B,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,MAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAClE,IAAI,EAAE,iBAAiB;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;YAChD,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;YAClE,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;YACxB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,wBAAwB;YACjC,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;SACxD,CAAC,CAAC;QACH,MAAM,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE;YAC/C,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;YAChD,aAAa,EAAE,IAAI;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5D,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5D,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,WAAW,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5D,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CACpD,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,WAAW,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CACpD,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,gBAAgB,CAAC,iBAAiB,CAChC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;YACxD,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CACH,CAAC;QACF,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,EAAE,EAAE;YACxB,KAAK,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE;YAC9B,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,gBAAgB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE;YAC1C,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;YAC7B,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAC3C,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAClB,EAAE,YAAY,EAAE,IAAI,EAAE,CACvB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QAEzF,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACpE,MAAM,MAAM,GAA4C;YACtD,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE;YACjC,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,GAAG,EAAE;YAC/C,aAAa,EAAE,CAAC,IAAI,EAAc,EAAE;gBAClC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;oBAAE,OAAO,QAAQ,CAAC;gBAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW;oBAAE,OAAO,WAAW,CAAC;gBACpD,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,YAAY,EAAE,SAAgB;SAC/B,CAAC;QACF,MAAM,eAAe,GAAG,gBAAgB,CAAwB,MAAM,CAAC,CAAC;QAExE,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE;YAC/C,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC9B,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,WAAW,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;QAC3E,gBAAgB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE;YACjE,aAAa,EAAE,IAAI;YACnB,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC9B,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,gBAAgB,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,wFAAwF;AACxF,4FAA4F;AAC5F,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,KAAK,GAAG,oBAAoB,CAAC;IAEnC,SAAS,eAAe,CAAC,aAA6C;QACpE,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,MAAM,GAAuC;YACjD,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE;YACjC,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,GAAG,EAAE;YAC/C,aAAa,EAAE,CAAC,IAAI,EAAc,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YACrF,YAAY,EAAE,YAAmB;YACjC,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE;SAC/C,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAmB,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;IAC9E,CAAC;IAED,SAAS,gBAAgB,CAAC,KAAc;QACtC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QACvD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;YACxB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE;SACpF,CAAC,CAAC;QACH,MAAM,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACtE,OAAO,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE;SACpF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CACnF,oDAAoD,EACpD,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAClE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAC7D,gDAAgD,EAChD,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YAClG,GAAG,EAAE,SAAS;SACf,CAAC,CAAC;QACH,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE;YACtC,MAAM,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,CACV,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CACrF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACxF,IAAI,EAAE,qBAAqB;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,2FAA2F;QAC3F,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YACzF,GAAG,EAAE,SAAS;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,eAAe,GAAG,CAAC,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAuB,CAAC;QAC/G,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QAEhD,WAAW,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,CAAC,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAuB,CAAC;QACxG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QAE/C,WAAW,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QACtG,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAuB,CAAC;QAChG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, it, expect, vi, beforeEach } from \"vitest\";\n\n// NOTE: there is deliberately NO `vi.mock(\"firebase-functions/v2/https\")` here.\n// assertAuth no longer constructs HttpsError — it throws AuthAssertionError and the\n// consuming app maps it (see authError.ts for why). The only remaining reference to\n// firebase-functions in assertAuth.ts is a TYPE import, which is erased at runtime.\nimport { createAssertAuth } from \"./assertAuth.js\";\nimport { AuthAssertionError } from \"./authError.js\";\nimport { ACCEPTANCE_REQUIRED_REASON, isAcceptanceRequiredError } from \"../acceptance.js\";\nimport {\n  EMAIL_VERIFICATION_REQUIRED_REASON,\n  isEmailVerificationRequiredError,\n} from \"../email-verification.js\";\nimport type { AssertAuthConfig, UserStatus } from \"./types.js\";\n\ntype TestUser = {\n  uid: string;\n  displayName?: string;\n  status?: \"active\" | \"suspended\" | \"banned\";\n};\n\n\nfunction makeRequest(opts?: { uid?: string; emailVerified?: boolean }): any {\n  const uid = opts?.uid ?? \"uid-123\";\n  return {\n    data: {},\n    rawRequest: {},\n    auth: {\n      uid,\n      token: { uid, email_verified: opts?.emailVerified ?? true },\n    },\n  };\n}\n\nfunction makeUnauthRequest(): any {\n  return { data: {}, rawRequest: {}, auth: undefined };\n}\n\nconst activeUserDoc: TestUser = {\n  uid: \"uid-123\",\n  displayName: \"Test User\",\n  status: \"active\",\n};\n\n// Minimal Firestore stub returning the active user doc, for tests that build\n// their own config instead of using the shared beforeEach harness.\nfunction fakeDbWithUser(): any {\n  const userDocRef = {\n    get: vi.fn().mockResolvedValue({ exists: true, data: () => activeUserDoc }),\n  };\n  return { doc: vi.fn(() => userDocRef) };\n}\n\n// --- harness ---------------------------------------------------------------\n\nlet mockUserGet: ReturnType<typeof vi.fn>;\nlet mockRequireAdmin: ReturnType<typeof vi.fn>;\nlet mockDbDoc: ReturnType<typeof vi.fn>;\nlet assertAuth: ReturnType<typeof createAssertAuth<TestUser>>;\n\nbeforeEach(() => {\n  mockUserGet = vi.fn().mockResolvedValue({ exists: true, data: () => activeUserDoc });\n  mockRequireAdmin = vi.fn().mockResolvedValue(undefined);\n\n  const userDocRef = { get: mockUserGet };\n\n  mockDbDoc = vi.fn(() => userDocRef);\n\n  const fakeDb = { doc: mockDbDoc } as any;\n\n  const config: AssertAuthConfig<TestUser> = {\n    firestore: () => fakeDb,\n    userProfilePath: (uid) => `userProfiles/${uid}`,\n    getUserStatus: (user): UserStatus => {\n      if (user.status === \"banned\") return \"banned\";\n      if (user.status === \"suspended\") return \"suspended\";\n      return \"active\";\n    },\n    requireAdmin: mockRequireAdmin as any,\n  };\n\n  assertAuth = createAssertAuth<TestUser>(config);\n});\n\n// --- tests -----------------------------------------------------------------\n\n// REGRESSION GUARD (2026-07-20). assertAuth must throw a plain, framework-free\n// AuthAssertionError — never an HttpsError built inside this package. firebase-functions\n// 7.2.5 ships two distinct HttpsError classes (ESM entry vs the CJS callable runtime), so\n// a package-built HttpsError fails the runtime's `instanceof` check and onCall converts a\n// correct 400 into a 500 INTERNAL. Since assertAuth is the first line of every callable,\n// that silently broke EVERY auth rejection in deployed environments. If someone\n// reintroduces `new HttpsError(...)` here, these assertions fail.\ndescribe(\"throws a framework-free typed error (never a package-built HttpsError)\", () => {\n  it(\"rejects with an AuthAssertionError instance carrying the HttpsError code string\", async () => {\n    const err = await assertAuth(makeUnauthRequest()).catch((e: unknown) => e);\n    expect(err).toBeInstanceOf(AuthAssertionError);\n    expect((err as AuthAssertionError).name).toBe(\"AuthAssertionError\");\n    expect((err as AuthAssertionError).code).toBe(\"unauthenticated\");\n  });\n\n  it(\"does not decorate the error with HttpsError's own shape\", async () => {\n    const err = (await assertAuth(makeUnauthRequest()).catch(\n      (e: unknown) => e\n    )) as AuthAssertionError & { httpErrorCode?: unknown; toJSON?: unknown };\n    // `httpErrorCode`/`toJSON` are HttpsError internals — their absence proves the\n    // package is not constructing one, which is the whole point of the fix.\n    expect(err.httpErrorCode).toBeUndefined();\n    expect(err.toJSON).toBeUndefined();\n  });\n\n  it(\"uses AuthAssertionError for the email-verification rejection too\", async () => {\n    const err = await assertAuth(makeRequest({ emailVerified: false }), {\n      emailVerified: true,\n      allowAnyStatus: true,\n    }).catch((e: unknown) => e);\n    expect(err).toBeInstanceOf(AuthAssertionError);\n    expect((err as AuthAssertionError).code).toBe(\"failed-precondition\");\n  });\n});\n\ndescribe(\"Authentication\", () => {\n  it(\"throws unauthenticated when request.auth is absent\", async () => {\n    await expect(assertAuth(makeUnauthRequest())).rejects.toMatchObject({\n      code: \"unauthenticated\",\n    });\n  });\n\n  it(\"succeeds with no Firestore reads when only allowAnyStatus is set\", async () => {\n    const ctx = await assertAuth(makeRequest(), { allowAnyStatus: true });\n    expect(ctx.uid).toBe(\"uid-123\");\n    expect(ctx.userDoc).toBeUndefined();\n    expect(mockDbDoc).not.toHaveBeenCalled();\n  });\n});\n\ndescribe(\"Email verification\", () => {\n  it(\"throws failed-precondition when emailVerified required and token email_verified is false\", async () => {\n    await expect(\n      assertAuth(makeRequest({ emailVerified: false }), {\n        emailVerified: true,\n        allowAnyStatus: true,\n      })\n    ).rejects.toMatchObject({ code: \"failed-precondition\" });\n  });\n\n  it(\"carries the email-verification reason in details, with the message unchanged\", async () => {\n    const err = await assertAuth(makeRequest({ emailVerified: false }), {\n      emailVerified: true,\n      allowAnyStatus: true,\n    }).catch((e: unknown) => e);\n    expect(err).toBeInstanceOf(AuthAssertionError);\n    expect(err).toMatchObject({\n      code: \"failed-precondition\",\n      message: \"Email must be verified\",\n      details: { reason: EMAIL_VERIFICATION_REQUIRED_REASON },\n    });\n    expect(isEmailVerificationRequiredError(err)).toBe(true);\n    expect(isAcceptanceRequiredError(err)).toBe(false);\n  });\n\n  it(\"succeeds when emailVerified required and token email_verified is true\", async () => {\n    await expect(\n      assertAuth(makeRequest({ emailVerified: true }), {\n        emailVerified: true,\n        allowAnyStatus: true,\n      })\n    ).resolves.toMatchObject({ uid: \"uid-123\" });\n  });\n\n  it(\"succeeds when allowUnverified is true even if email_verified is false\", async () => {\n    await expect(\n      assertAuth(makeRequest({ emailVerified: false }), {\n        emailVerified: true,\n        allowUnverified: true,\n        allowAnyStatus: true,\n      })\n    ).resolves.toMatchObject({ uid: \"uid-123\" });\n  });\n});\n\ndescribe(\"Not-banned check (default behavior)\", () => {\n  it(\"throws permission-denied when user status is banned\", async () => {\n    mockUserGet.mockResolvedValue({\n      exists: true,\n      data: () => ({ ...activeUserDoc, status: \"banned\" }),\n    });\n    await expect(assertAuth(makeRequest())).rejects.toMatchObject({\n      code: \"permission-denied\",\n    });\n  });\n\n  it(\"throws permission-denied when user status is suspended\", async () => {\n    mockUserGet.mockResolvedValue({\n      exists: true,\n      data: () => ({ ...activeUserDoc, status: \"suspended\" }),\n    });\n    await expect(assertAuth(makeRequest())).rejects.toMatchObject({\n      code: \"permission-denied\",\n    });\n  });\n\n  it(\"throws not-found when user doc does not exist\", async () => {\n    mockUserGet.mockResolvedValue({ exists: false, data: () => null });\n    await expect(assertAuth(makeRequest())).rejects.toMatchObject({\n      code: \"not-found\",\n    });\n  });\n\n  it(\"succeeds when user doc has no status field\", async () => {\n    mockUserGet.mockResolvedValue({\n      exists: true,\n      data: () => ({ uid: \"uid-123\", displayName: \"Test\" }),\n    });\n    const ctx = await assertAuth(makeRequest());\n    expect(ctx.uid).toBe(\"uid-123\");\n    expect(ctx.userDoc).toBeDefined();\n  });\n\n  it(\"succeeds when user status is active\", async () => {\n    const ctx = await assertAuth(makeRequest());\n    expect(ctx.uid).toBe(\"uid-123\");\n    expect(ctx.userDoc).toMatchObject({ status: \"active\" });\n  });\n\n  it(\"skips user doc read entirely when allowAnyStatus is true\", async () => {\n    await assertAuth(makeRequest(), { allowAnyStatus: true });\n    expect(mockUserGet).not.toHaveBeenCalled();\n  });\n});\n\ndescribe(\"allowSuspended opt-in\", () => {\n  it(\"allows a suspended user when allowSuspended is true\", async () => {\n    mockUserGet.mockResolvedValue({\n      exists: true,\n      data: () => ({ ...activeUserDoc, status: \"suspended\" }),\n    });\n    const ctx = await assertAuth(makeRequest(), { allowSuspended: true });\n    expect(ctx.uid).toBe(\"uid-123\");\n    expect(ctx.userDoc).toMatchObject({ status: \"suspended\" });\n  });\n\n  it(\"still blocks a banned user even when allowSuspended is true\", async () => {\n    mockUserGet.mockResolvedValue({\n      exists: true,\n      data: () => ({ ...activeUserDoc, status: \"banned\" }),\n    });\n    await expect(\n      assertAuth(makeRequest(), { allowSuspended: true })\n    ).rejects.toMatchObject({ code: \"permission-denied\" });\n  });\n\n  it(\"still requires the user doc to exist when allowSuspended is true\", async () => {\n    mockUserGet.mockResolvedValue({ exists: false, data: () => null });\n    await expect(\n      assertAuth(makeRequest(), { allowSuspended: true })\n    ).rejects.toMatchObject({ code: \"not-found\" });\n  });\n});\n\n\ndescribe(\"Admin check\", () => {\n  it(\"propagates the error when requireAdmin throws\", async () => {\n    mockRequireAdmin.mockRejectedValue(\n      Object.assign(new Error(\"Administrator access required\"), {\n        code: \"permission-denied\",\n      })\n    );\n    await expect(\n      assertAuth(makeRequest(), {\n        admin: { allowJrAdmin: false },\n        allowAnyStatus: true,\n      })\n    ).rejects.toMatchObject({ code: \"permission-denied\" });\n  });\n\n  it(\"succeeds and returns ctx when requireAdmin resolves\", async () => {\n    mockRequireAdmin.mockResolvedValue(undefined);\n    const ctx = await assertAuth(makeRequest(), {\n      admin: { allowJrAdmin: true },\n      allowAnyStatus: true,\n    });\n    expect(ctx.uid).toBe(\"uid-123\");\n    expect(mockRequireAdmin).toHaveBeenCalledWith(\n      \"uid-123\",\n      expect.any(Object),\n      { allowJrAdmin: true }\n    );\n  });\n\n  it(\"populates ctx.admin with the requireAdmin result when an admin check runs\", async () => {\n    type AdminResult = { role: string };\n    const adminMock = vi.fn().mockResolvedValue({ role: \"superadmin\" });\n    const config: AssertAuthConfig<TestUser, AdminResult> = {\n      firestore: () => fakeDbWithUser(),\n      userProfilePath: (uid) => `userProfiles/${uid}`,\n      getUserStatus: (user): UserStatus => {\n        if (user.status === \"banned\") return \"banned\";\n        if (user.status === \"suspended\") return \"suspended\";\n        return \"active\";\n      },\n      requireAdmin: adminMock as any,\n    };\n    const typedAssertAuth = createAssertAuth<TestUser, AdminResult>(config);\n\n    const ctx = await typedAssertAuth(makeRequest(), {\n      admin: { allowJrAdmin: true },\n    });\n\n    expect(ctx.admin).toEqual({ role: \"superadmin\" });\n  });\n\n  it(\"leaves ctx.admin undefined when no admin requirement is set\", async () => {\n    const ctx = await assertAuth(makeRequest());\n    expect(ctx.admin).toBeUndefined();\n    expect(mockRequireAdmin).not.toHaveBeenCalled();\n  });\n});\n\ndescribe(\"Combined checks\", () => {\n  it(\"returns fully populated ctx when all checks pass\", async () => {\n    mockUserGet.mockResolvedValue({ exists: true, data: () => activeUserDoc });\n    mockRequireAdmin.mockResolvedValue(undefined);\n\n    const ctx = await assertAuth(makeRequest({ emailVerified: true }), {\n      emailVerified: true,\n      admin: { allowJrAdmin: true },\n    });\n\n    expect(ctx.uid).toBe(\"uid-123\");\n    expect(ctx.userDoc).toMatchObject({ status: \"active\" });\n    expect(mockRequireAdmin).toHaveBeenCalled();\n  });\n});\n\n// Acceptance-level gate (optional `acceptance` config). Every case below that expects a\n// refusal passes on the pre-gate factory only if the gate is ignored — i.e. it fails there.\ndescribe(\"Acceptance-level gate\", () => {\n  const CLAIM = \"acceptedLevelClaim\";\n\n  function gatedAssertAuth(requiredLevel: () => number | Promise<number>) {\n    const requireAdmin = vi.fn().mockResolvedValue(\"admin\");\n    const config: AssertAuthConfig<TestUser, string> = {\n      firestore: () => fakeDbWithUser(),\n      userProfilePath: (uid) => `userProfiles/${uid}`,\n      getUserStatus: (user): UserStatus => (user.status === \"banned\" ? \"banned\" : \"active\"),\n      requireAdmin: requireAdmin as any,\n      acceptance: { claimKey: CLAIM, requiredLevel },\n    };\n    return { assert: createAssertAuth<TestUser, string>(config), requireAdmin };\n  }\n\n  function requestWithClaim(claim: unknown): any {\n    const req = makeRequest();\n    if (claim !== undefined) req.auth.token[CLAIM] = claim;\n    return req;\n  }\n\n  it(\"refuses a caller below the required level with a structured failed-precondition\", async () => {\n    const { assert } = gatedAssertAuth(() => 3);\n    const err = await assert(requestWithClaim(2)).catch((e: unknown) => e);\n    expect(err).toBeInstanceOf(AuthAssertionError);\n    expect(err).toMatchObject({\n      code: \"failed-precondition\",\n      details: { reason: ACCEPTANCE_REQUIRED_REASON, requiredLevel: 3, acceptedLevel: 2 },\n    });\n    expect(isAcceptanceRequiredError(err)).toBe(true);\n    expect(isEmailVerificationRequiredError(err)).toBe(false);\n  });\n\n  it(\"treats a missing claim as accepted level 0\", async () => {\n    const { assert } = gatedAssertAuth(() => 1);\n    await expect(assert(requestWithClaim(undefined))).rejects.toMatchObject({\n      details: { reason: ACCEPTANCE_REQUIRED_REASON, requiredLevel: 1, acceptedLevel: 0 },\n    });\n  });\n\n  it.each([[\"a string\", \"5\"], [\"NaN\", Number.NaN], [\"a negative\", -4], [\"null\", null]])(\n    \"treats %s claim as accepted level 0 (fails closed)\",\n    async (_label, claim) => {\n      const { assert } = gatedAssertAuth(() => 1);\n      await expect(assert(requestWithClaim(claim))).rejects.toMatchObject({\n        details: { acceptedLevel: 0 },\n      });\n    }\n  );\n\n  it(\"passes a caller at or above the required level\", async () => {\n    const { assert } = gatedAssertAuth(() => 3);\n    await expect(assert(requestWithClaim(3))).resolves.toMatchObject({ uid: \"uid-123\" });\n    await expect(assert(requestWithClaim(7))).resolves.toMatchObject({ uid: \"uid-123\" });\n  });\n\n  it(\"awaits an async required-level reader\", async () => {\n    const { assert } = gatedAssertAuth(async () => 2);\n    await expect(assert(requestWithClaim(1))).rejects.toMatchObject({ code: \"failed-precondition\" });\n  });\n\n  it.each([[\"zero\", 0], [\"NaN\", Number.NaN], [\"a negative\", -1]])(\n    \"requires nothing when the required level is %s\",\n    async (_label, level) => {\n      const { assert } = gatedAssertAuth(() => level);\n      await expect(assert(requestWithClaim(undefined))).resolves.toMatchObject({ uid: \"uid-123\" });\n    }\n  );\n\n  it(\"lets an allowUnaccepted callable through without reading the required level\", async () => {\n    const requiredLevel = vi.fn(() => 9);\n    const { assert } = gatedAssertAuth(requiredLevel);\n    await expect(assert(requestWithClaim(undefined), { allowUnaccepted: true })).resolves.toMatchObject({\n      uid: \"uid-123\",\n    });\n    expect(requiredLevel).not.toHaveBeenCalled();\n  });\n\n  it(\"propagates a throwing required-level reader\", async () => {\n    const failure = new Error(\"config unavailable\");\n    const { assert } = gatedAssertAuth(() => {\n      throw failure;\n    });\n    await expect(assert(requestWithClaim(5))).rejects.toBe(failure);\n  });\n\n  it(\"refuses before the admin check runs\", async () => {\n    const { assert, requireAdmin } = gatedAssertAuth(() => 2);\n    await expect(\n      assert(requestWithClaim(1), { admin: { allowJrAdmin: true }, allowAnyStatus: true })\n    ).rejects.toMatchObject({ code: \"failed-precondition\" });\n    expect(requireAdmin).not.toHaveBeenCalled();\n  });\n\n  it(\"still gates a callable that skips the status check (allowAnyStatus)\", async () => {\n    const { assert } = gatedAssertAuth(() => 1);\n    await expect(assert(requestWithClaim(0), { allowAnyStatus: true })).rejects.toMatchObject({\n      code: \"failed-precondition\",\n    });\n  });\n\n  it(\"keeps authentication first — an unauthenticated caller never reaches the gate\", async () => {\n    const requiredLevel = vi.fn(() => 1);\n    const { assert } = gatedAssertAuth(requiredLevel);\n    await expect(assert(makeUnauthRequest())).rejects.toMatchObject({ code: \"unauthenticated\" });\n    expect(requiredLevel).not.toHaveBeenCalled();\n  });\n\n  it(\"is absent without config: an app that never sets `acceptance` behaves exactly as before\", async () => {\n    // The shared harness config has no `acceptance`; a token with no level claim still passes.\n    await expect(assertAuth(makeRequest(), { allowUnaccepted: false })).resolves.toMatchObject({\n      uid: \"uid-123\",\n    });\n  });\n\n  it(\"leaves `details` undefined on every other rejection\", async () => {\n    const unauthenticated = (await assertAuth(makeUnauthRequest()).catch((e: unknown) => e)) as AuthAssertionError;\n    expect(unauthenticated.details).toBeUndefined();\n\n    mockUserGet.mockResolvedValue({ exists: false, data: () => null });\n    const missingProfile = (await assertAuth(makeRequest()).catch((e: unknown) => e)) as AuthAssertionError;\n    expect(missingProfile.code).toBe(\"not-found\");\n    expect(missingProfile.details).toBeUndefined();\n\n    mockUserGet.mockResolvedValue({ exists: true, data: () => ({ ...activeUserDoc, status: \"banned\" }) });\n    const banned = (await assertAuth(makeRequest()).catch((e: unknown) => e)) as AuthAssertionError;\n    expect(banned.code).toBe(\"permission-denied\");\n    expect(banned.details).toBeUndefined();\n  });\n});\n"]}