@warlock.js/auth 5.18.0 → 5.19.1

package/esm/models/access-token/access-token.model.d.mts

@@ -13,17 +13,26 @@ import { Model } from "@warlock.js/cascade";
 declare const accessTokenSchema: import("@warlock.js/seal").ObjectValidator<{
   token: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>; /** Null for tokens issued before family tracking was introduced. */
+  family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
   expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
 }> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
   token: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>; /** Null for tokens issued before family tracking was introduced. */
+  family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
   expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
 }>, import("@warlock.js/seal").InferInputObjectShape<{
   token: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>; /** Null for tokens issued before family tracking was introduced. */
+  family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
   expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
 }>>;
 /**
@@ -41,17 +50,26 @@ declare class AccessToken extends Model {
   static schema: import("@warlock.js/seal").ObjectValidator<{
     token: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>; /** Null for tokens issued before family tracking was introduced. */
+    family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
     expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
   }> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
     token: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>; /** Null for tokens issued before family tracking was introduced. */
+    family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
     expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
   }>, import("@warlock.js/seal").InferInputObjectShape<{
     token: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>; /** Null for tokens issued before family tracking was introduced. */
+    family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
     expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
   }>>;
   /**
@@ -99,7 +117,7 @@ declare class AccessToken extends Model {
   /**
    * Persist a freshly-signed access token for the user.
    */
-  static issue(user: Auth, token: string, expiresAt: Date): Promise<AccessToken>;
+  static issue(user: Auth, token: string, expiresAt: Date, familyId?: string): Promise<AccessToken>;
   /**
    * Find an access-token row by its raw token string.
    */
@@ -112,6 +130,12 @@ declare class AccessToken extends Model {
    * Delete every access token belonging to the user.
    */
   static deleteAllForUser(user: Auth): Promise<number>;
+  /**
+   * Delete every access token attached to one family, plus pre-family rows for
+   * the same user type. The latter is deliberately conservative during the
+   * additive upgrade: old access rows cannot be assigned safely to a family.
+   */
+  static deleteFamilyAndLegacyForUser(user: Auth, familyId: string): Promise<void>;
   /**
    * Hard-delete every expired access-token row. Returns the number removed.
    * Runs from the `auth.cleanup` CLI command (a cold batch path).

package/esm/models/access-token/access-token.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"mappings":";;;;;;AAaA;;;;;;cAAa,iBAAA,6BAAiB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;cAiBjB,WAAA,SAAoB,KAAA;EAAA,OACjB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;SAQN,MAAA;;;AAXhB;;;;;SAoBgB,cAAA;;MAGH,MAAA;;MAKA,QAAA;EAwC+C;;;;;;;;;;;;;;;EAAA,IArB/C,SAAA;EA/CyB;;;;;;EAAA,IA6DzB,YAAA;;;;SAOG,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,SAAA,EAAW,IAAA,GAAI,OAAA,CAAA,WAAA;;;;SAYhD,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,WAAA;;;;SAOpC,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA,WAAa,OAAA;;;;SAOvC,gBAAA,CAAiB,IAAA,EAAM,IAAA,GAAI,OAAA;;;;;SAQrB,YAAA,IAAgB,OAAA;;;;;;;;;;;;SAqBhB,iBAAA,IAAqB,OAAA,CAAQ,WAAA;;;;;;SAW7B,kBAAA,IAAsB,OAAA,CAAQ,WAAA;AAAA"}
+{"version":3,"file":"access-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"mappings":";;;;;;AAaA;;;;;;cAAa,iBAAA,6BAAiB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAmBjB,WAAA,SAAoB,KAAA;EAAA,OACjB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAQN,MAAA;EAyD4C;;;;;;;EAAA,OAhD5C,cAAA;EA2E2B;EAAA,IAxE9B,MAAA;EAiFqE;EAAA,IA5ErE,QAAA;EA0GsC;;;;;;;;;;;;;;;EAAA,IAvFtC,SAAA;;;;;;;MAcA,YAAA;;;;SAOG,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,SAAA,EAAW,IAAA,EAAM,QAAA,YAAiB,OAAA,CAAA,WAAA;;;;SAanE,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,WAAA;;;;SAOpC,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA,WAAa,OAAA;;;;SAOvC,gBAAA,CAAiB,IAAA,EAAM,IAAA,GAAI,OAAA;;;;;;SASrB,4BAAA,CAA6B,IAAA,EAAM,IAAA,EAAM,QAAA,WAAmB,OAAA;;;;;SAS5D,YAAA,IAAgB,OAAA;;;;;;;;;;;;SAqBhB,iBAAA,IAAqB,OAAA,CAAQ,WAAA;;;;;;SAW7B,kBAAA,IAAsB,OAAA,CAAQ,WAAA;AAAA"}

package/esm/models/access-token/access-token.model.mjs

@@ -15,6 +15,8 @@ const accessTokenSchema = v.object({
 	token: v.string().required(),
 	user_id: v.scalar().required(),
 	user_type: v.string().required(),
+	/** Null for tokens issued before family tracking was introduced. */
+	family_id: v.string().optional(),
 	expires_at: v.date().required()
 });
 /**
@@ -80,11 +82,12 @@ var AccessToken = class extends Model {
 	/**
 	* Persist a freshly-signed access token for the user.
 	*/
-	static issue(user, token, expiresAt) {
+	static issue(user, token, expiresAt, familyId) {
 		return this.create({
 			token,
 			user_id: user.id,
 			user_type: user.userType,
+			family_id: familyId,
 			expires_at: expiresAt
 		});
 	}
@@ -110,6 +113,23 @@ var AccessToken = class extends Model {
 		return this.delete({ user_id: user.id });
 	}
 	/**
+	* Delete every access token attached to one family, plus pre-family rows for
+	* the same user type. The latter is deliberately conservative during the
+	* additive upgrade: old access rows cannot be assigned safely to a family.
+	*/
+	static async deleteFamilyAndLegacyForUser(user, familyId) {
+		await this.delete({
+			user_id: user.id,
+			user_type: user.userType,
+			family_id: familyId
+		});
+		await this.delete({
+			user_id: user.id,
+			user_type: user.userType,
+			family_id: null
+		});
+	}
+	/**
 	* Hard-delete every expired access-token row. Returns the number removed.
 	* Runs from the `auth.cleanup` CLI command (a cold batch path).
 	*/

package/esm/models/access-token/access-token.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\r\nimport { v } from \"@warlock.js/seal\";\r\nimport { isNeverExpiring, isUsableExpiry } from \"../../utils/token-expiry\";\r\nimport type { Auth } from \"../auth.model\";\r\n\r\n/**\r\n * Seal schema for the persisted access-token record. Exported so an override\r\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\r\n * base shape.\r\n *\r\n * `last_access` and the `is_active` soft-revoke flag were removed — neither was\r\n * ever read; access tokens are revoked by deleting the row.\r\n */\r\nexport const accessTokenSchema = v.object({\r\n  token: v.string().required(),\r\n  user_id: v.scalar().required(),\r\n  user_type: v.string().required(),\r\n  expires_at: v.date().required(),\r\n});\r\n\r\n/**\r\n * Persisted access-token record + the data layer for access tokens.\r\n *\r\n * **Role.** Owns access-token persistence and lookup. The middleware checks a\r\n * presented JWT against this table so deleting a row (logout) invalidates the\r\n * token immediately, before its JWT expiry. The auth service goes through the\r\n * named statics exclusively, so it never hard-codes a column name and an\r\n * override can rename/add columns by registering under\r\n * `config.auth.accessToken.model`.\r\n */\r\nexport class AccessToken extends Model {\r\n  public static table = \"access_tokens\";\r\n\r\n  public static schema = accessTokenSchema;\r\n\r\n  /**\r\n   * The raw signed JWT is a bearer credential — never serialize it. `hidden`\r\n   * only strips it from `toJSON()` / `JSON.stringify(model)` (so\r\n   * `response.json(token)` or a resource cannot leak it); `get(\"token\")`,\r\n   * `findByToken` and every query still read the column.\r\n   */\r\n  public static hidden = [\"token\"];\r\n\r\n  /**\r\n   * Permanent regardless of the data source default — Mongo's driver default\r\n   * is `\"trash\"`, which would copy live credential material (the JWT itself)\r\n   * into `access_tokensTrash` on every `destroy()` (logout, expiry purge,\r\n   * never-expiring purge). A revoked/expired access token must not survive\r\n   * anywhere.\r\n   */\r\n  public static deleteStrategy = \"permanent\" as const;\r\n\r\n  /** The user this token was issued for. */\r\n  public get userId() {\r\n    return this.get(\"user_id\");\r\n  }\r\n\r\n  /** The user-type slug this token was issued for. */\r\n  public get userType(): string {\r\n    return this.get(\"user_type\");\r\n  }\r\n\r\n  /**\r\n   * Whether the persisted expiry has passed.\r\n   *\r\n   * The middleware asks this on every request, which is what makes the row the\r\n   * authority it always looked like it was: before 4.12.0 the gate only checked\r\n   * that the row *existed*, so a row the database knew was dead still let its\r\n   * token through — the database was never asked.\r\n   *\r\n   * **Fails closed.** A missing or unparseable `expires_at` counts as expired.\r\n   * `expires_at` is `required` in the schema, so a row that cannot answer \"when\r\n   * does this die\" is malformed, and the safe reading of a malformed credential\r\n   * is that it is not one. This is deliberately stricter than a naive\r\n   * `now > expires_at`, which answers `false` for an `Invalid Date` and thereby\r\n   * grants exactly the poisoned rows an unlimited life.\r\n   */\r\n  public get isExpired(): boolean {\r\n    const expiresAt = this.get(\"expires_at\");\r\n\r\n    if (!isUsableExpiry(expiresAt)) return true;\r\n\r\n    return new Date(expiresAt).getTime() <= Date.now();\r\n  }\r\n\r\n  /**\r\n   * Whether nothing about this row can ever retire it — an unusable\r\n   * `expires_at`, or a token carrying no `exp` claim. See\r\n   * {@link isNeverExpiring}; this is the predicate `purgeNeverExpiring` selects\r\n   * on.\r\n   */\r\n  public get neverExpires(): boolean {\r\n    return isNeverExpiring(this.get(\"token\"), this.get(\"expires_at\"));\r\n  }\r\n\r\n  /**\r\n   * Persist a freshly-signed access token for the user.\r\n   */\r\n  public static issue(user: Auth, token: string, expiresAt: Date) {\r\n    return this.create({\r\n      token,\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      expires_at: expiresAt,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Find an access-token row by its raw token string.\r\n   */\r\n  public static findByToken(token: string): Promise<AccessToken | null> {\r\n    return this.first({ token });\r\n  }\r\n\r\n  /**\r\n   * Delete a specific token that belongs to the given user.\r\n   */\r\n  public static deleteForUser(user: Auth, token: string) {\r\n    return this.delete({ token, user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Delete every access token belonging to the user.\r\n   */\r\n  public static deleteAllForUser(user: Auth) {\r\n    return this.delete({ user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every expired access-token row. Returns the number removed.\r\n   * Runs from the `auth.cleanup` CLI command (a cold batch path).\r\n   */\r\n  public static async purgeExpired(): Promise<number> {\r\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\r\n\r\n    for (const token of expiredTokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return expiredTokens.length;\r\n  }\r\n\r\n  /**\r\n   * Every row that can never retire itself — see {@link neverExpires}.\r\n   *\r\n   * **A full scan, filtered in memory, on purpose.** The defining case is a row\r\n   * whose `expires_at` is an `Invalid Date`, which no date predicate can select\r\n   * (`< now` and `> now` are both `false` for it), and the definitive case is a\r\n   * token with no `exp` claim, which lives inside the token string rather than\r\n   * in a column. Neither is expressible as a `where`, so the rows have to be\r\n   * read to be judged. This runs from a one-off remediation command, not a\r\n   * request path.\r\n   */\r\n  public static async findNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.query().get();\r\n\r\n    return tokens.filter((token: AccessToken) => token.neverExpires);\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every never-expiring row, returning the rows removed so the\r\n   * caller can report what it revoked. Deletion *is* revocation for access\r\n   * tokens — the middleware rejects a token with no row.\r\n   */\r\n  public static async purgeNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.findNeverExpiring();\r\n\r\n    for (const token of tokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,oBAAoB,EAAE,OAAO;CACxC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;AAChC,CAAC;;;;;;;;;;;AAYD,IAAa,cAAb,cAAiC,MAAM;;eACf;;;gBAEC;;;gBAQA,CAAC,OAAO;;;wBASA;;;CAG/B,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;;;;;;;;;;;;;CAiBA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI;CACnD;;;;;;;CAQA,IAAW,eAAwB;EACjC,OAAO,gBAAgB,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC;CAClE;;;;CAKA,OAAc,MAAM,MAAY,OAAe,WAAiB;EAC9D,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,YAAY;EACd,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA4C;EACpE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,iBAAiB,MAAY;EACzC,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,GAAG,CAAC;CACzC;;;;;CAMA,aAAoB,eAAgC;EAClD,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO,cAAc;CACvB;;;;;;;;;;;;CAaA,aAAoB,oBAA4C;EAG9D,QAAO,MAFc,KAAK,MAAM,CAAC,CAAC,IAAI,EAEzB,CAAC,QAAQ,UAAuB,MAAM,YAAY;CACjE;;;;;;CAOA,aAAoB,qBAA6C;EAC/D,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAE5C,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}
+{"version":3,"file":"access-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\r\nimport { v } from \"@warlock.js/seal\";\r\nimport { isNeverExpiring, isUsableExpiry } from \"../../utils/token-expiry\";\r\nimport type { Auth } from \"../auth.model\";\r\n\r\n/**\r\n * Seal schema for the persisted access-token record. Exported so an override\r\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\r\n * base shape.\r\n *\r\n * `last_access` and the `is_active` soft-revoke flag were removed — neither was\r\n * ever read; access tokens are revoked by deleting the row.\r\n */\r\nexport const accessTokenSchema = v.object({\r\n  token: v.string().required(),\r\n  user_id: v.scalar().required(),\r\n  user_type: v.string().required(),\r\n  /** Null for tokens issued before family tracking was introduced. */\r\n  family_id: v.string().optional(),\r\n  expires_at: v.date().required(),\r\n});\r\n\r\n/**\r\n * Persisted access-token record + the data layer for access tokens.\r\n *\r\n * **Role.** Owns access-token persistence and lookup. The middleware checks a\r\n * presented JWT against this table so deleting a row (logout) invalidates the\r\n * token immediately, before its JWT expiry. The auth service goes through the\r\n * named statics exclusively, so it never hard-codes a column name and an\r\n * override can rename/add columns by registering under\r\n * `config.auth.accessToken.model`.\r\n */\r\nexport class AccessToken extends Model {\r\n  public static table = \"access_tokens\";\r\n\r\n  public static schema = accessTokenSchema;\r\n\r\n  /**\r\n   * The raw signed JWT is a bearer credential — never serialize it. `hidden`\r\n   * only strips it from `toJSON()` / `JSON.stringify(model)` (so\r\n   * `response.json(token)` or a resource cannot leak it); `get(\"token\")`,\r\n   * `findByToken` and every query still read the column.\r\n   */\r\n  public static hidden = [\"token\"];\r\n\r\n  /**\r\n   * Permanent regardless of the data source default — Mongo's driver default\r\n   * is `\"trash\"`, which would copy live credential material (the JWT itself)\r\n   * into `access_tokensTrash` on every `destroy()` (logout, expiry purge,\r\n   * never-expiring purge). A revoked/expired access token must not survive\r\n   * anywhere.\r\n   */\r\n  public static deleteStrategy = \"permanent\" as const;\r\n\r\n  /** The user this token was issued for. */\r\n  public get userId() {\r\n    return this.get(\"user_id\");\r\n  }\r\n\r\n  /** The user-type slug this token was issued for. */\r\n  public get userType(): string {\r\n    return this.get(\"user_type\");\r\n  }\r\n\r\n  /**\r\n   * Whether the persisted expiry has passed.\r\n   *\r\n   * The middleware asks this on every request, which is what makes the row the\r\n   * authority it always looked like it was: before 4.12.0 the gate only checked\r\n   * that the row *existed*, so a row the database knew was dead still let its\r\n   * token through — the database was never asked.\r\n   *\r\n   * **Fails closed.** A missing or unparseable `expires_at` counts as expired.\r\n   * `expires_at` is `required` in the schema, so a row that cannot answer \"when\r\n   * does this die\" is malformed, and the safe reading of a malformed credential\r\n   * is that it is not one. This is deliberately stricter than a naive\r\n   * `now > expires_at`, which answers `false` for an `Invalid Date` and thereby\r\n   * grants exactly the poisoned rows an unlimited life.\r\n   */\r\n  public get isExpired(): boolean {\r\n    const expiresAt = this.get(\"expires_at\");\r\n\r\n    if (!isUsableExpiry(expiresAt)) return true;\r\n\r\n    return new Date(expiresAt).getTime() <= Date.now();\r\n  }\r\n\r\n  /**\r\n   * Whether nothing about this row can ever retire it — an unusable\r\n   * `expires_at`, or a token carrying no `exp` claim. See\r\n   * {@link isNeverExpiring}; this is the predicate `purgeNeverExpiring` selects\r\n   * on.\r\n   */\r\n  public get neverExpires(): boolean {\r\n    return isNeverExpiring(this.get(\"token\"), this.get(\"expires_at\"));\r\n  }\r\n\r\n  /**\r\n   * Persist a freshly-signed access token for the user.\r\n   */\r\n  public static issue(user: Auth, token: string, expiresAt: Date, familyId?: string) {\r\n    return this.create({\r\n      token,\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      family_id: familyId,\r\n      expires_at: expiresAt,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Find an access-token row by its raw token string.\r\n   */\r\n  public static findByToken(token: string): Promise<AccessToken | null> {\r\n    return this.first({ token });\r\n  }\r\n\r\n  /**\r\n   * Delete a specific token that belongs to the given user.\r\n   */\r\n  public static deleteForUser(user: Auth, token: string) {\r\n    return this.delete({ token, user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Delete every access token belonging to the user.\r\n   */\r\n  public static deleteAllForUser(user: Auth) {\r\n    return this.delete({ user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Delete every access token attached to one family, plus pre-family rows for\r\n   * the same user type. The latter is deliberately conservative during the\r\n   * additive upgrade: old access rows cannot be assigned safely to a family.\r\n   */\r\n  public static async deleteFamilyAndLegacyForUser(user: Auth, familyId: string): Promise<void> {\r\n    await this.delete({ user_id: user.id, user_type: user.userType, family_id: familyId });\r\n    await this.delete({ user_id: user.id, user_type: user.userType, family_id: null });\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every expired access-token row. Returns the number removed.\r\n   * Runs from the `auth.cleanup` CLI command (a cold batch path).\r\n   */\r\n  public static async purgeExpired(): Promise<number> {\r\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\r\n\r\n    for (const token of expiredTokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return expiredTokens.length;\r\n  }\r\n\r\n  /**\r\n   * Every row that can never retire itself — see {@link neverExpires}.\r\n   *\r\n   * **A full scan, filtered in memory, on purpose.** The defining case is a row\r\n   * whose `expires_at` is an `Invalid Date`, which no date predicate can select\r\n   * (`< now` and `> now` are both `false` for it), and the definitive case is a\r\n   * token with no `exp` claim, which lives inside the token string rather than\r\n   * in a column. Neither is expressible as a `where`, so the rows have to be\r\n   * read to be judged. This runs from a one-off remediation command, not a\r\n   * request path.\r\n   */\r\n  public static async findNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.query().get();\r\n\r\n    return tokens.filter((token: AccessToken) => token.neverExpires);\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every never-expiring row, returning the rows removed so the\r\n   * caller can report what it revoked. Deletion *is* revocation for access\r\n   * tokens — the middleware rejects a token with no row.\r\n   */\r\n  public static async purgeNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.findNeverExpiring();\r\n\r\n    for (const token of tokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,oBAAoB,EAAE,OAAO;CACxC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE/B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;AAChC,CAAC;;;;;;;;;;;AAYD,IAAa,cAAb,cAAiC,MAAM;;eACf;;;gBAEC;;;gBAQA,CAAC,OAAO;;;wBASA;;;CAG/B,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;;;;;;;;;;;;;CAiBA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI;CACnD;;;;;;;CAQA,IAAW,eAAwB;EACjC,OAAO,gBAAgB,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC;CAClE;;;;CAKA,OAAc,MAAM,MAAY,OAAe,WAAiB,UAAmB;EACjF,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,WAAW;GACX,YAAY;EACd,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA4C;EACpE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,iBAAiB,MAAY;EACzC,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,GAAG,CAAC;CACzC;;;;;;CAOA,aAAoB,6BAA6B,MAAY,UAAiC;EAC5F,MAAM,KAAK,OAAO;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,WAAW;EAAS,CAAC;EACrF,MAAM,KAAK,OAAO;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,WAAW;EAAK,CAAC;CACnF;;;;;CAMA,aAAoB,eAAgC;EAClD,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO,cAAc;CACvB;;;;;;;;;;;;CAaA,aAAoB,oBAA4C;EAG9D,QAAO,MAFc,KAAK,MAAM,CAAC,CAAC,IAAI,EAEzB,CAAC,QAAQ,UAAuB,MAAM,YAAY;CACjE;;;;;;CAOA,aAAoB,qBAA6C;EAC/D,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAE5C,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}

package/esm/models/access-token/family-association.migration.mjs

@@ -0,0 +1,18 @@
+import { AccessToken } from "./access-token.model.mjs";
+import { migrate } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/access-token/family-association.migration.ts
+/** Adds an optional family association without invalidating existing access tokens. */
+const AccessTokenFamilyAssociationMigration = migrate(AccessToken, {
+	name: "accessTokenFamilyAssociation",
+	up() {
+		this.string("family_id", 64).nullable().index();
+	},
+	down() {
+		this.dropColumn("family_id");
+	}
+});
+
+//#endregion
+export { AccessTokenFamilyAssociationMigration };
+//# sourceMappingURL=family-association.migration.mjs.map

package/esm/models/access-token/family-association.migration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"family-association.migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/access-token/family-association.migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { AccessToken } from \"./access-token.model\";\n\n/** Adds an optional family association without invalidating existing access tokens. */\nexport const AccessTokenFamilyAssociationMigration = migrate(AccessToken, {\n  name: \"accessTokenFamilyAssociation\",\n  up() {\n    this.string(\"family_id\", 64).nullable().index();\n  },\n  down() {\n    this.dropColumn(\"family_id\");\n  },\n});\n"],"mappings":";;;;;AAIA,MAAa,wCAAwC,QAAQ,aAAa;CACxE,MAAM;CACN,KAAK;EACH,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM;CAChD;CACA,OAAO;EACL,KAAK,WAAW,WAAW;CAC7B;AACF,CAAC"}

package/esm/models/auth-token-family/auth-token-family.model.d.mts

@@ -0,0 +1,90 @@
+import { Auth } from "../auth.model.mjs";
+import { Model } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/auth-token-family/auth-token-family.model.d.ts
+/** Durable revision authority for one refresh-token rotation family. */
+declare const authTokenFamilySchema: import("@warlock.js/seal").ObjectValidator<{
+  family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  revision: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+    hasDefault: true;
+  };
+  revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+    isOptional: true;
+  };
+}> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
+  family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  revision: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+    hasDefault: true;
+  };
+  revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+    isOptional: true;
+  };
+}>, import("@warlock.js/seal").InferInputObjectShape<{
+  family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  revision: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+    hasDefault: true;
+  };
+  revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+    isOptional: true;
+  };
+}>>;
+/** Coordinates family-wide refresh, replay containment, and logout transitions. */
+declare class AuthTokenFamily extends Model {
+  static table: string;
+  static schema: import("@warlock.js/seal").ObjectValidator<{
+    family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    revision: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+      hasDefault: true;
+    };
+    revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+      isOptional: true;
+    };
+  }> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
+    family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    revision: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+      hasDefault: true;
+    };
+    revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+      isOptional: true;
+    };
+  }>, import("@warlock.js/seal").InferInputObjectShape<{
+    family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    revision: import("@warlock.js/seal").NumberValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+      hasDefault: true;
+    };
+    revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+      isOptional: true;
+    };
+  }>>;
+  /** Whether a family-wide revoke has made every member unusable. */
+  get isRevoked(): boolean;
+  /** Create the durable family record before its first token pair is issued. */
+  static issue(user: Auth, familyId: string): Promise<AuthTokenFamily>;
+  static findByFamilyId(familyId: string): Promise<AuthTokenFamily | null>;
+  /** Add a durable row for an existing lineage through a driver-native upsert. */
+  static ensure(user: Auth, familyId: string): Promise<AuthTokenFamily>;
+  /** Every non-revoked family for a user, including a rotated refresh row. */
+  static activeFor(user: Auth): Promise<AuthTokenFamily[]>;
+  /**
+   * Compare-and-set the family revision. A zero result is a concurrent family
+   * transition, never a successful no-op.
+   */
+  static advanceRevision(familyId: string, expectedRevision: number): Promise<number>;
+  /** Stamp the durable family revoke marker after a successful CAS. */
+  static revoke(familyId: string, expectedRevision: number): Promise<number>;
+}
+//#endregion
+export { AuthTokenFamily, authTokenFamilySchema };
+//# sourceMappingURL=auth-token-family.model.d.mts.map

package/esm/models/auth-token-family/auth-token-family.model.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-token-family.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/auth-token-family/auth-token-family.model.ts"],"mappings":";;;;;cAKa,qBAAA,6BAAqB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cASrB,eAAA,SAAwB,KAAA;EAAA,OACrB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAGT,SAAA;;SAKG,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,QAAA,WAAgB,OAAA,CAAA,eAAA;EAAA,OASlC,cAAA,CAAe,QAAA,WAAmB,OAAA,CAAQ,eAAA;;SAKpC,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,QAAA,WAAmB,OAAA,CAAQ,eAAA;;SAmBpD,SAAA,CAAU,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,eAAA;;AA5C/C;;;SAsDgB,eAAA,CAAgB,QAAA,UAAkB,gBAAA,WAA2B,OAAA;;SAQ7D,MAAA,CAAO,QAAA,UAAkB,gBAAA,WAA2B,OAAA;AAAA"}

package/esm/models/auth-token-family/auth-token-family.model.mjs

@@ -0,0 +1,80 @@
+import { Model } from "@warlock.js/cascade";
+import { v } from "@warlock.js/seal";
+
+//#region ../auth/src/models/auth-token-family/auth-token-family.model.ts
+/** Durable revision authority for one refresh-token rotation family. */
+const authTokenFamilySchema = v.object({
+	family_id: v.string().required(),
+	user_id: v.scalar().required(),
+	user_type: v.string().required(),
+	revision: v.number().default(0),
+	revoked_at: v.date().optional()
+});
+/** Coordinates family-wide refresh, replay containment, and logout transitions. */
+var AuthTokenFamily = class extends Model {
+	static {
+		this.table = "auth_token_families";
+	}
+	static {
+		this.schema = authTokenFamilySchema;
+	}
+	/** Whether a family-wide revoke has made every member unusable. */
+	get isRevoked() {
+		return Boolean(this.get("revoked_at"));
+	}
+	/** Create the durable family record before its first token pair is issued. */
+	static issue(user, familyId) {
+		return this.create({
+			family_id: familyId,
+			user_id: user.id,
+			user_type: user.userType,
+			revision: 0
+		});
+	}
+	static findByFamilyId(familyId) {
+		return this.first({ family_id: familyId });
+	}
+	/** Add a durable row for an existing lineage through a driver-native upsert. */
+	static async ensure(user, familyId) {
+		await this.atomic({ family_id: familyId }, { $setOnInsert: {
+			user_id: user.id,
+			user_type: user.userType,
+			revision: 0
+		} }, { upsert: true });
+		const family = await this.findByFamilyId(familyId);
+		if (!family) throw new Error("Token family upsert did not return a family");
+		if (family.get("user_id") !== user.id || family.get("user_type") !== user.userType) throw new Error("Token family belongs to a different user");
+		return family;
+	}
+	/** Every non-revoked family for a user, including a rotated refresh row. */
+	static activeFor(user) {
+		return this.query().where({
+			user_id: user.id,
+			user_type: user.userType,
+			revoked_at: null
+		}).get();
+	}
+	/**
+	* Compare-and-set the family revision. A zero result is a concurrent family
+	* transition, never a successful no-op.
+	*/
+	static advanceRevision(familyId, expectedRevision) {
+		return this.atomic({
+			family_id: familyId,
+			revision: expectedRevision,
+			revoked_at: null
+		}, { $inc: { revision: 1 } });
+	}
+	/** Stamp the durable family revoke marker after a successful CAS. */
+	static revoke(familyId, expectedRevision) {
+		return this.atomic({
+			family_id: familyId,
+			revision: expectedRevision + 1,
+			revoked_at: null
+		}, { $set: { revoked_at: /* @__PURE__ */ new Date() } });
+	}
+};
+
+//#endregion
+export { AuthTokenFamily, authTokenFamilySchema };
+//# sourceMappingURL=auth-token-family.model.mjs.map

package/esm/models/auth-token-family/auth-token-family.model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-token-family.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/auth-token-family/auth-token-family.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { Auth } from \"../auth.model\";\n\n/** Durable revision authority for one refresh-token rotation family. */\nexport const authTokenFamilySchema = v.object({\n  family_id: v.string().required(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n  revision: v.number().default(0),\n  revoked_at: v.date().optional(),\n});\n\n/** Coordinates family-wide refresh, replay containment, and logout transitions. */\nexport class AuthTokenFamily extends Model {\n  public static table = \"auth_token_families\";\n\n  public static schema = authTokenFamilySchema;\n\n  /** Whether a family-wide revoke has made every member unusable. */\n  public get isRevoked(): boolean {\n    return Boolean(this.get(\"revoked_at\"));\n  }\n\n  /** Create the durable family record before its first token pair is issued. */\n  public static issue(user: Auth, familyId: string) {\n    return this.create({\n      family_id: familyId,\n      user_id: user.id,\n      user_type: user.userType,\n      revision: 0,\n    });\n  }\n\n  public static findByFamilyId(familyId: string): Promise<AuthTokenFamily | null> {\n    return this.first({ family_id: familyId });\n  }\n\n  /** Add a durable row for an existing lineage through a driver-native upsert. */\n  public static async ensure(user: Auth, familyId: string): Promise<AuthTokenFamily> {\n    await this.atomic(\n      { family_id: familyId },\n      { $setOnInsert: { user_id: user.id, user_type: user.userType, revision: 0 } },\n      { upsert: true },\n    );\n\n    const family = await this.findByFamilyId(familyId);\n\n    if (!family) throw new Error(\"Token family upsert did not return a family\");\n\n    if (family.get(\"user_id\") !== user.id || family.get<string>(\"user_type\") !== user.userType) {\n      throw new Error(\"Token family belongs to a different user\");\n    }\n\n    return family;\n  }\n\n  /** Every non-revoked family for a user, including a rotated refresh row. */\n  public static activeFor(user: Auth): Promise<AuthTokenFamily[]> {\n    return this.query()\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\n      .get();\n  }\n\n  /**\n   * Compare-and-set the family revision. A zero result is a concurrent family\n   * transition, never a successful no-op.\n   */\n  public static advanceRevision(familyId: string, expectedRevision: number): Promise<number> {\n    return this.atomic(\n      { family_id: familyId, revision: expectedRevision, revoked_at: null },\n      { $inc: { revision: 1 } },\n    );\n  }\n\n  /** Stamp the durable family revoke marker after a successful CAS. */\n  public static revoke(familyId: string, expectedRevision: number): Promise<number> {\n    return this.atomic(\n      { family_id: familyId, revision: expectedRevision + 1, revoked_at: null },\n      { $set: { revoked_at: new Date() } },\n    );\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,wBAAwB,EAAE,OAAO;CAC5C,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,UAAU,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;CAC9B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;AAChC,CAAC;;AAGD,IAAa,kBAAb,cAAqC,MAAM;;eACnB;;;gBAEC;;;CAGvB,IAAW,YAAqB;EAC9B,OAAO,QAAQ,KAAK,IAAI,YAAY,CAAC;CACvC;;CAGA,OAAc,MAAM,MAAY,UAAkB;EAChD,OAAO,KAAK,OAAO;GACjB,WAAW;GACX,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,UAAU;EACZ,CAAC;CACH;CAEA,OAAc,eAAe,UAAmD;EAC9E,OAAO,KAAK,MAAM,EAAE,WAAW,SAAS,CAAC;CAC3C;;CAGA,aAAoB,OAAO,MAAY,UAA4C;EACjF,MAAM,KAAK,OACT,EAAE,WAAW,SAAS,GACtB,EAAE,cAAc;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,UAAU;EAAE,EAAE,GAC5E,EAAE,QAAQ,KAAK,CACjB;EAEA,MAAM,SAAS,MAAM,KAAK,eAAe,QAAQ;EAEjD,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,6CAA6C;EAE1E,IAAI,OAAO,IAAI,SAAS,MAAM,KAAK,MAAM,OAAO,IAAY,WAAW,MAAM,KAAK,UAChF,MAAM,IAAI,MAAM,0CAA0C;EAG5D,OAAO;CACT;;CAGA,OAAc,UAAU,MAAwC;EAC9D,OAAO,KAAK,MAAM,CAAC,CAChB,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,IAAI;CACT;;;;;CAMA,OAAc,gBAAgB,UAAkB,kBAA2C;EACzF,OAAO,KAAK,OACV;GAAE,WAAW;GAAU,UAAU;GAAkB,YAAY;EAAK,GACpE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAC1B;CACF;;CAGA,OAAc,OAAO,UAAkB,kBAA2C;EAChF,OAAO,KAAK,OACV;GAAE,WAAW;GAAU,UAAU,mBAAmB;GAAG,YAAY;EAAK,GACxE,EAAE,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,EAAE,CACrC;CACF;AACF"}

package/esm/models/auth-token-family/index.d.mts

@@ -0,0 +1 @@
+import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family.model.mjs";

package/esm/models/auth-token-family/index.mjs

@@ -0,0 +1,3 @@
+import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family.model.mjs";
+
+export {  };

package/esm/models/auth-token-family/migration.mjs

@@ -0,0 +1,25 @@
+import { AuthTokenFamily } from "./auth-token-family.model.mjs";
+import { migrate } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/auth-token-family/migration.ts
+/** Creates the durable authority shared by every token in a refresh family. */
+const AuthTokenFamilyMigration = migrate(AuthTokenFamily, {
+	name: "authTokenFamily",
+	up() {
+		this.createTableIfNotExists();
+		this.primaryUuid();
+		this.string("family_id", 64).unique();
+		this.foreignId("user_id").index();
+		this.string("user_type", 50).nullable();
+		this.integer("revision").default(0);
+		this.timestamp("revoked_at").nullable();
+		this.timestamps();
+	},
+	down() {
+		this.dropTableIfExists();
+	}
+});
+
+//#endregion
+export { AuthTokenFamilyMigration };
+//# sourceMappingURL=migration.mjs.map

package/esm/models/auth-token-family/migration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/auth-token-family/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { AuthTokenFamily } from \"./auth-token-family.model\";\n\n/** Creates the durable authority shared by every token in a refresh family. */\nexport const AuthTokenFamilyMigration = migrate(AuthTokenFamily, {\n  name: \"authTokenFamily\",\n  up() {\n    this.createTableIfNotExists();\n    this.primaryUuid();\n    this.string(\"family_id\", 64).unique();\n    this.foreignId(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n    this.integer(\"revision\").default(0);\n    this.timestamp(\"revoked_at\").nullable();\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;;AAIA,MAAa,2BAA2B,QAAQ,iBAAiB;CAC/D,MAAM;CACN,KAAK;EACH,KAAK,uBAAuB;EAC5B,KAAK,YAAY;EACjB,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,OAAO;EACpC,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EACtC,KAAK,QAAQ,UAAU,CAAC,CAAC,QAAQ,CAAC;EAClC,KAAK,UAAU,YAAY,CAAC,CAAC,SAAS;EACtC,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}

package/esm/models/index.d.mts

@@ -2,6 +2,7 @@ import { Auth } from "./auth.model.mjs";
 import { AccessToken, accessTokenSchema } from "./access-token/access-token.model.mjs";
 import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./one-time-token/one-time-token.model.mjs";
 import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./refresh-token/refresh-token.model.mjs";
+import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family/auth-token-family.model.mjs";
 import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential/passkey-credential.model.mjs";
 import { ProviderAccount, providerAccountSchema } from "./provider-account/provider-account.model.mjs";
 //#region ../auth/src/models/index.d.ts

package/esm/models/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"mappings":";;;;;;;cAaa,cAAA,gCAAc,oBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"mappings":";;;;;;;;cAiBa,cAAA,gCAAc,oBAAA"}

package/esm/models/index.mjs

@@ -1,16 +1,21 @@
 import { AccessToken, accessTokenSchema } from "./access-token/access-token.model.mjs";
 import "./access-token/index.mjs";
+import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family/auth-token-family.model.mjs";
+import "./auth-token-family/index.mjs";
 import { OneTimeToken, oneTimeTokenSchema } from "./one-time-token/one-time-token.model.mjs";
 import "./one-time-token/index.mjs";
 import { RefreshToken, refreshTokenSchema } from "./refresh-token/refresh-token.model.mjs";
 import "./refresh-token/index.mjs";
+import { AccessTokenFamilyAssociationMigration } from "./access-token/family-association.migration.mjs";
 import { AccessTokenMigration } from "./access-token/migration.mjs";
+import { AuthTokenFamilyMigration } from "./auth-token-family/migration.mjs";
 import { OneTimeTokenMigration } from "./one-time-token/migration.mjs";
 import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential/passkey-credential.model.mjs";
 import { PasskeyCredentialMigration } from "./passkey-credential/migration.mjs";
 import { ProviderAccount, providerAccountSchema } from "./provider-account/provider-account.model.mjs";
 import { ProviderAccountMigration } from "./provider-account/migration.mjs";
 import { RefreshTokenMigration } from "./refresh-token/migration.mjs";
+import { RefreshTokenSuccessorAssociationMigration } from "./refresh-token/successor-association.migration.mjs";
 import { Auth } from "./auth.model.mjs";
 import "./passkey-credential/index.mjs";
 import "./provider-account/index.mjs";
@@ -18,7 +23,10 @@ import "./provider-account/index.mjs";
 //#region ../auth/src/models/index.ts
 const authMigrations = [
 	AccessTokenMigration,
+	AccessTokenFamilyAssociationMigration,
 	RefreshTokenMigration,
+	RefreshTokenSuccessorAssociationMigration,
+	AuthTokenFamilyMigration,
 	OneTimeTokenMigration,
 	ProviderAccountMigration,
 	PasskeyCredentialMigration

package/esm/models/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"sourcesContent":["import { AccessTokenMigration } from \"./access-token/migration\";\nimport { OneTimeTokenMigration } from \"./one-time-token/migration\";\nimport { PasskeyCredentialMigration } from \"./passkey-credential/migration\";\nimport { ProviderAccountMigration } from \"./provider-account/migration\";\nimport { RefreshTokenMigration } from \"./refresh-token/migration\";\n\nexport * from \"./access-token\";\nexport * from \"./auth.model\";\nexport * from \"./one-time-token\";\nexport * from \"./passkey-credential\";\nexport * from \"./provider-account\";\nexport * from \"./refresh-token\";\n\nexport const authMigrations = [\n  AccessTokenMigration,\n  RefreshTokenMigration,\n  OneTimeTokenMigration,\n  ProviderAccountMigration,\n  PasskeyCredentialMigration,\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;AAaA,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"sourcesContent":["import { AccessTokenFamilyAssociationMigration } from \"./access-token/family-association.migration\";\nimport { AccessTokenMigration } from \"./access-token/migration\";\nimport { AuthTokenFamilyMigration } from \"./auth-token-family/migration\";\nimport { OneTimeTokenMigration } from \"./one-time-token/migration\";\nimport { PasskeyCredentialMigration } from \"./passkey-credential/migration\";\nimport { ProviderAccountMigration } from \"./provider-account/migration\";\nimport { RefreshTokenMigration } from \"./refresh-token/migration\";\nimport { RefreshTokenSuccessorAssociationMigration } from \"./refresh-token/successor-association.migration\";\n\nexport * from \"./access-token\";\nexport * from \"./auth-token-family\";\nexport * from \"./auth.model\";\nexport * from \"./one-time-token\";\nexport * from \"./passkey-credential\";\nexport * from \"./provider-account\";\nexport * from \"./refresh-token\";\n\nexport const authMigrations = [\n  AccessTokenMigration,\n  AccessTokenFamilyAssociationMigration,\n  RefreshTokenMigration,\n  RefreshTokenSuccessorAssociationMigration,\n  AuthTokenFamilyMigration,\n  OneTimeTokenMigration,\n  ProviderAccountMigration,\n  PasskeyCredentialMigration,\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}

package/esm/models/refresh-token/refresh-token.model.d.mts

@@ -26,6 +26,12 @@ declare const refreshTokenSchema: import("@warlock.js/seal").ObjectValidator<{
   };
   revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
     isOptional: true;
+  }; /** The successor pair a bounded concurrent renewal may reuse. */
+  successor_access_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
+  successor_refresh_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
   };
   device_info: import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
@@ -43,6 +49,12 @@ declare const refreshTokenSchema: import("@warlock.js/seal").ObjectValidator<{
   };
   revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
     isOptional: true;
+  }; /** The successor pair a bounded concurrent renewal may reuse. */
+  successor_access_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
+  successor_refresh_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
   };
   device_info: import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
@@ -60,6 +72,12 @@ declare const refreshTokenSchema: import("@warlock.js/seal").ObjectValidator<{
   };
   revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
     isOptional: true;
+  }; /** The successor pair a bounded concurrent renewal may reuse. */
+  successor_access_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
+  successor_refresh_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
   };
   device_info: import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
@@ -98,6 +116,12 @@ declare class RefreshToken extends Model {
     };
     revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
       isOptional: true;
+    }; /** The successor pair a bounded concurrent renewal may reuse. */
+    successor_access_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
+    successor_refresh_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
     };
     device_info: import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
@@ -115,6 +139,12 @@ declare class RefreshToken extends Model {
     };
     revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
       isOptional: true;
+    }; /** The successor pair a bounded concurrent renewal may reuse. */
+    successor_access_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
+    successor_refresh_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
     };
     device_info: import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
@@ -132,6 +162,12 @@ declare class RefreshToken extends Model {
     };
     revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
       isOptional: true;
+    }; /** The successor pair a bounded concurrent renewal may reuse. */
+    successor_access_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
+    successor_refresh_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
     };
     device_info: import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
@@ -204,6 +240,13 @@ declare class RefreshToken extends Model {
    * revoke a token that actually belongs to them.
    */
   static findForUser(user: Auth, token: string): Promise<RefreshToken | null>;
+  /** Find any member of a family, including an already-revoked legacy member. */
+  static findInFamily(familyId: string): Promise<RefreshToken | null>;
+  /**
+   * Every refresh lineage for a user, including rotated rows. Logout uses this
+   * to bootstrap durable family records before it starts family revocations.
+   */
+  static familiesForUser(user: Auth): Promise<RefreshToken[]>;
   /**
    * Delete a specific refresh token belonging to the user.
    */

package/esm/models/refresh-token/refresh-token.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/refresh-token/refresh-token.model.ts"],"mappings":";;;;;;;AAkBA;;;;;;;;;;cAAa,kBAAA,6BAAkB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAcnB,wBAAA;EACV,QAAA;EACA,SAAA;EACA,UAAA,GAAa,UAAU;AAAA;;;;;;;;;;;cAaZ,YAAA,SAAqB,KAAA;EAAA,OAClB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAQN,MAAA;;;;;;;SAQA,cAAA;;MAGH,QAAA;EAtCuB;;;;;;;;AAGX;AAazB;EAhBoC,IAoDvB,SAAA;;;;;MAYA,YAAA;;MAKA,SAAA;;MAKA,OAAA;;;;EAOE,MAAA,IAAU,OAAA;;;;;;;;EAWV,cAAA,IAAkB,OAAA;;;;EAclB,UAAA,IAAc,OAAA;EAzBJ;;;EAAA,OAgCT,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,OAAA,EAAS,wBAAA,GAAwB,OAAA,CAAA,YAAA;EAAxB;;;EAAA,OAoB1C,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,YAAA;EAAR;;;;EAAA,OAQ5B,WAAA,CAAY,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA,CAAQ,YAAA;EAOT;;;EAAA,OAAvC,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA,WAAa,OAAA;EAuBd;;;EAAA,OAhBzB,SAAA,CAAU,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EAgCO;;;;;;;;EAAA,OAhBhC,YAAA,CAAa,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EA3JtB;;;;EAAA,OA2KZ,YAAA,CAAa,QAAA,WAAmB,OAAA,CAAQ,YAAA;EAxK9C;;;;;EAAA,OAuLM,UAAA,CAAW,IAAA,EAAM,IAAA,EAAM,GAAA,WAAc,OAAA;;;;;;SAoBrC,YAAA,IAAgB,OAAA,CAAQ,YAAA;;;;;;;SAgBxB,iBAAA,IAAqB,OAAA,CAAQ,YAAA;;;;;;;;;;SAe7B,kBAAA,IAAsB,OAAA,CAAQ,YAAA;AAAA"}
+{"version":3,"file":"refresh-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/refresh-token/refresh-token.model.ts"],"mappings":";;;;;;;AAkBA;;;;;;;;;;cAAa,kBAAA,6BAAkB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiBnB,wBAAA;EACV,QAAA;EACA,SAAA;EACA,UAAA,GAAa,UAAU;AAAA;;;;;;;;;;;cAaZ,YAAA,SAAqB,KAAA;EAAA,OAClB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAhBG;;;;;;EAAA,OAwBT,MAAA;EAXH;;;;;;EAAA,OAmBG,cAAA;;MAGH,QAAA;;;;;;;;;;;MAcA,SAAA;;;;;MAYA,YAAA;;MAKA,SAAA;EAYY;EAAA,IAPZ,OAAA;EAgCgB;;;EAzBd,MAAA,IAAU,OAAA;EAgCyD;;;;;;;EArBnE,cAAA,IAAkB,OAAA;EA8DK;;;EAhDvB,UAAA,IAAc,OAAA;EAuD0B;;;EAAA,OAhDvC,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,OAAA,EAAS,wBAAA,GAAwB,OAAA,CAAA,YAAA;EAuEzC;;;EAAA,OAnDzB,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,YAAA;EAmEE;;;;EAAA,OA3DtC,WAAA,CAAY,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA,CAAQ,YAAA;EA8Gb;EAAA,OAzGnC,YAAA,CAAa,QAAA,WAAmB,OAAA,CAAQ,YAAA;EAwHJ;;;;EAAA,OAhHpC,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EA1InB;;;EAAA,OAiJlB,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA,WAAa,OAAA;;;;SAOvC,SAAA,CAAU,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;;;;;;;;;SAgBzB,YAAA,CAAa,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;;;;;SAgBlC,YAAA,CAAa,QAAA,WAAmB,OAAA,CAAQ,YAAA;;;;;;SAexC,UAAA,CAAW,IAAA,EAAM,IAAA,EAAM,GAAA,WAAc,OAAA;;;;;;SAoBrC,YAAA,IAAgB,OAAA,CAAQ,YAAA;;;;;;;SAgBxB,iBAAA,IAAqB,OAAA,CAAQ,YAAA;;;;;;;;;;SAe7B,kBAAA,IAAsB,OAAA,CAAQ,YAAA;AAAA"}