@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/adapters/database/domains/user-role/subscriber.mjs

@@ -23,12 +23,12 @@ var UserRoleSubscriber = class extends EntitySubscriber {
 		super({
 			type: EntityType.USER_ROLE,
 			target: UserRoleEntity,
-			destinations: buildEntityDestinations(EntityType.USER_ROLE, (data) => [data.user_realm_id, data.role_realm_id]),
+			destinations: buildEntityDestinations(EntityType.USER_ROLE, (data) => [data.userRealmId, data.roleRealmId]),
 			cache: {
 				onInsert: true,
 				keys: (data) => [buildRedisKeyPath({
 					prefix: CachePrefix.USER_OWNED_ROLES,
-					key: data.user_id
+					key: data.userId
 				})]
 			}
 		});

package/dist/adapters/database/domains/user-role/subscriber.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"subscriber.mjs","names":["EntityType","buildRedisKeyPath","EventSubscriber","EntitySubscriber","buildEntityDestinations","UserRoleEntity","CachePrefix","UserRoleSubscriber","type","USER_ROLE","target","destinations","data","user_realm_id","role_realm_id","cache","onInsert","keys","prefix","USER_OWNED_ROLES","key","user_id"],"sources":["../../../../../src/adapters/database/domains/user-role/subscriber.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { UserRole } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport { EventSubscriber } from 'typeorm';\nimport { EntitySubscriber, buildEntityDestinations } from '../../subscriber/index.ts';\nimport { UserRoleEntity } from './entity.ts';\nimport { CachePrefix } from '../constants.ts';\n\n@EventSubscriber()\nexport class UserRoleSubscriber extends EntitySubscriber<UserRole> {\n    constructor() {\n        super({\n            type: EntityType.USER_ROLE,\n            target: UserRoleEntity,\n            destinations: buildEntityDestinations(EntityType.USER_ROLE, (data) => [\n                data.user_realm_id,\n                data.role_realm_id,\n            ]),\n            cache: {\n                onInsert: true,\n                keys: (data) => [\n                    buildRedisKeyPath({\n                        prefix: CachePrefix.USER_OWNED_ROLES,\n                        key: data.user_id,\n                    }),\n                ],\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;AAWD,IAAaO,qBAAb,cAAwCJ,iBAAAA;CACpC,cAAc;EACV,MAAM;GACFK,MAAMR,WAAWS;GACjBC,QAAQL;GACRM,cAAcP,wBAAwBJ,WAAWS,YAAYG,SAAS,CAClEA,KAAKC,eACLD,KAAKE,aAAAA,CACR;GACDC,OAAO;IACHC,UAAU;IACVC,OAAOL,SAAS,CACZX,kBAAkB;KACdiB,QAAQZ,YAAYa;KACpBC,KAAKR,KAAKS;IACd,CAAA,CAAA;GAER;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"subscriber.mjs","names":["EntityType","buildRedisKeyPath","EventSubscriber","EntitySubscriber","buildEntityDestinations","UserRoleEntity","CachePrefix","UserRoleSubscriber","type","USER_ROLE","target","destinations","data","userRealmId","roleRealmId","cache","onInsert","keys","prefix","USER_OWNED_ROLES","key","userId"],"sources":["../../../../../src/adapters/database/domains/user-role/subscriber.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { UserRole } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport { EventSubscriber } from 'typeorm';\nimport { EntitySubscriber, buildEntityDestinations } from '../../subscriber/index.ts';\nimport { UserRoleEntity } from './entity.ts';\nimport { CachePrefix } from '../constants.ts';\n\n@EventSubscriber()\nexport class UserRoleSubscriber extends EntitySubscriber<UserRole> {\n    constructor() {\n        super({\n            type: EntityType.USER_ROLE,\n            target: UserRoleEntity,\n            destinations: buildEntityDestinations(EntityType.USER_ROLE, (data) => [\n                data.userRealmId,\n                data.roleRealmId,\n            ]),\n            cache: {\n                onInsert: true,\n                keys: (data) => [\n                    buildRedisKeyPath({\n                        prefix: CachePrefix.USER_OWNED_ROLES,\n                        key: data.userId,\n                    }),\n                ],\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;AAWD,IAAaO,qBAAb,cAAwCJ,iBAAAA;CACpC,cAAc;EACV,MAAM;GACFK,MAAMR,WAAWS;GACjBC,QAAQL;GACRM,cAAcP,wBAAwBJ,WAAWS,YAAYG,SAAS,CAClEA,KAAKC,aACLD,KAAKE,WAAAA,CACR;GACDC,OAAO;IACHC,UAAU;IACVC,OAAOL,SAAS,CACZX,kBAAkB;KACdiB,QAAQZ,YAAYa;KACpBC,KAAKR,KAAKS;IACd,CAAA,CAAA;GAER;EACJ,CAAA;CACJ;AACJ"}

package/dist/adapters/database/errors/driver.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Unwrap the vendor error code from a thrown database error. TypeORM wraps the
+ * raw driver error in a `QueryFailedError`, exposing the vendor code on the
+ * top-level `code` and/or the nested `driverError.code` depending on the
+ * driver — this normalizes both shapes to the vendor code string.
+ */
+export declare function getDatabaseDriverErrorCode(input: unknown): string | undefined;
+/**
+ * True when the error is a unique-constraint (duplicate key) violation from any
+ * supported driver — the benign race outcome when two writers insert the same
+ * unique key concurrently.
+ */
+export declare function isUniqueConstraintDatabaseError(input: unknown): boolean;
+//# sourceMappingURL=driver.d.ts.map

package/dist/adapters/database/errors/driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../../src/adapters/database/errors/driver.ts"],"names":[],"mappings":"AASA;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAsB7E;AAQD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGvE"}

package/dist/adapters/database/errors/driver.mjs

@@ -0,0 +1,32 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { hasOwnProperty, isObject } from "@authup/kit";
+//#region src/adapters/database/errors/driver.ts
+/**
+* Unwrap the vendor error code from a thrown database error. TypeORM wraps the
+* raw driver error in a `QueryFailedError`, exposing the vendor code on the
+* top-level `code` and/or the nested `driverError.code` depending on the
+* driver — this normalizes both shapes to the vendor code string.
+*/ function getDatabaseDriverErrorCode(input) {
+	if (!isObject(input)) return;
+	if (hasOwnProperty(input, "code") && typeof input.code === "string") return input.code;
+	if (hasOwnProperty(input, "driverError") && isObject(input.driverError) && hasOwnProperty(input.driverError, "code") && typeof input.driverError.code === "string") return input.driverError.code;
+}
+const UNIQUE_CONSTRAINT_ERROR_CODES = [
+	"ER_DUP_ENTRY",
+	"23505",
+	"SQLITE_CONSTRAINT_UNIQUE"
+];
+/**
+* True when the error is a unique-constraint (duplicate key) violation from any
+* supported driver — the benign race outcome when two writers insert the same
+* unique key concurrently.
+*/ function isUniqueConstraintDatabaseError(input) {
+	const code = getDatabaseDriverErrorCode(input);
+	return typeof code === "string" && UNIQUE_CONSTRAINT_ERROR_CODES.includes(code);
+}
+//#endregion
+export { getDatabaseDriverErrorCode, isUniqueConstraintDatabaseError };
+
+//# sourceMappingURL=driver.mjs.map

package/dist/adapters/database/errors/driver.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.mjs","names":["hasOwnProperty","isObject","getDatabaseDriverErrorCode","input","undefined","code","driverError","UNIQUE_CONSTRAINT_ERROR_CODES","isUniqueConstraintDatabaseError","includes"],"sources":["../../../../src/adapters/database/errors/driver.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { hasOwnProperty, isObject } from '@authup/kit';\n\n/**\n * Unwrap the vendor error code from a thrown database error. TypeORM wraps the\n * raw driver error in a `QueryFailedError`, exposing the vendor code on the\n * top-level `code` and/or the nested `driverError.code` depending on the\n * driver — this normalizes both shapes to the vendor code string.\n */\nexport function getDatabaseDriverErrorCode(input: unknown): string | undefined {\n    if (!isObject(input)) {\n        return undefined;\n    }\n\n    if (\n        hasOwnProperty(input, 'code') &&\n        typeof input.code === 'string'\n    ) {\n        return input.code;\n    }\n\n    if (\n        hasOwnProperty(input, 'driverError') &&\n        isObject(input.driverError) &&\n        hasOwnProperty(input.driverError, 'code') &&\n        typeof input.driverError.code === 'string'\n    ) {\n        return input.driverError.code;\n    }\n\n    return undefined;\n}\n\nconst UNIQUE_CONSTRAINT_ERROR_CODES = [\n    'ER_DUP_ENTRY', // mysql\n    '23505', // postgres\n    'SQLITE_CONSTRAINT_UNIQUE', // sqlite (better-sqlite3)\n];\n\n/**\n * True when the error is a unique-constraint (duplicate key) violation from any\n * supported driver — the benign race outcome when two writers insert the same\n * unique key concurrently.\n */\nexport function isUniqueConstraintDatabaseError(input: unknown): boolean {\n    const code = getDatabaseDriverErrorCode(input);\n    return typeof code === 'string' && UNIQUE_CONSTRAINT_ERROR_CODES.includes(code);\n}\n"],"mappings":";;;;;;;;;;GAeA,SAAgBE,2BAA2BC,OAAc;CACrD,IAAI,CAACF,SAASE,KAAAA,GACV;CAGJ,IACIH,eAAeG,OAAO,MAAA,KACtB,OAAOA,MAAME,SAAS,UAEtB,OAAOF,MAAME;CAGjB,IACIL,eAAeG,OAAO,aAAA,KACtBF,SAASE,MAAMG,WAAW,KAC1BN,eAAeG,MAAMG,aAAa,MAAA,KAClC,OAAOH,MAAMG,YAAYD,SAAS,UAElC,OAAOF,MAAMG,YAAYD;AAIjC;AAEA,MAAME,gCAAgC;CAClC;CACA;CACA;;;;;;GAQJ,SAAgBC,gCAAgCL,OAAc;CAC1D,MAAME,OAAOH,2BAA2BC,KAAAA;CACxC,OAAO,OAAOE,SAAS,YAAYE,8BAA8BE,SAASJ,IAAAA;AAC9E"}

package/dist/adapters/database/errors/index.d.ts

@@ -1,2 +1,3 @@
 export * from './conflict.ts';
+export * from './driver.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/database/errors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/database/errors/index.ts"],"names":[],"mappings":"AAOA,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/database/errors/index.ts"],"names":[],"mappings":"AAOA,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC"}

package/dist/adapters/database/errors/index.mjs

@@ -2,4 +2,5 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { DatabaseConflictError } from "./conflict.mjs";
-export { DatabaseConflictError };
+import { getDatabaseDriverErrorCode, isUniqueConstraintDatabaseError } from "./driver.mjs";
+export { DatabaseConflictError, getDatabaseDriverErrorCode, isUniqueConstraintDatabaseError };

package/dist/adapters/database/helpers/is-supported.mjs

@@ -7,7 +7,7 @@ function isDatabaseTypeSupported(type) {
 	return type === "mysql" || type === "postgres" || type === "better-sqlite3";
 }
 function isDatabaseTypeSupportedForEnvironment(type, env) {
-	if (env === EnvironmentName.PRODUCTION) return type !== "better-sqlite3" && type !== "sqlite";
+	if (env === EnvironmentName.PRODUCTION) return type !== "better-sqlite3";
 	return true;
 }
 //#endregion

package/dist/adapters/database/helpers/is-supported.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"is-supported.mjs","names":["EnvironmentName","isDatabaseTypeSupported","type","isDatabaseTypeSupportedForEnvironment","env","PRODUCTION"],"sources":["../../../../src/adapters/database/helpers/is-supported.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type { DatabaseType } from 'typeorm';\nimport { EnvironmentName } from '@authup/kit';\n\nexport function isDatabaseTypeSupported(type: DatabaseType) : boolean {\n    return type === 'mysql' ||\n        type === 'postgres' ||\n        type === 'better-sqlite3';\n}\n\nexport function isDatabaseTypeSupportedForEnvironment(type: DatabaseType, env: string) : boolean {\n    if (env === EnvironmentName.PRODUCTION) {\n        return type !== 'better-sqlite3' && type !== 'sqlite';\n    }\n\n    return true;\n}\n"],"mappings":";;;;;AASA,SAAgBC,wBAAwBC,MAAkB;CACtD,OAAOA,SAAS,WACZA,SAAS,cACTA,SAAS;AACjB;AAEA,SAAgBC,sCAAsCD,MAAoBE,KAAW;CACjF,IAAIA,QAAQJ,gBAAgBK,YACxB,OAAOH,SAAS,oBAAoBA,SAAS;CAGjD,OAAO;AACX"}
+{"version":3,"file":"is-supported.mjs","names":["EnvironmentName","isDatabaseTypeSupported","type","isDatabaseTypeSupportedForEnvironment","env","PRODUCTION"],"sources":["../../../../src/adapters/database/helpers/is-supported.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type { DatabaseType } from 'typeorm';\nimport { EnvironmentName } from '@authup/kit';\n\nexport function isDatabaseTypeSupported(type: DatabaseType) : boolean {\n    return type === 'mysql' ||\n        type === 'postgres' ||\n        type === 'better-sqlite3';\n}\n\nexport function isDatabaseTypeSupportedForEnvironment(type: DatabaseType, env: string) : boolean {\n    if (env === EnvironmentName.PRODUCTION) {\n        return type !== 'better-sqlite3';\n    }\n\n    return true;\n}\n"],"mappings":";;;;;AASA,SAAgBC,wBAAwBC,MAAkB;CACtD,OAAOA,SAAS,WACZA,SAAS,cACTA,SAAS;AACjB;AAEA,SAAgBC,sCAAsCD,MAAoBE,KAAW;CACjF,IAAIA,QAAQJ,gBAAgBK,YACxB,OAAOH,SAAS;CAGpB,OAAO;AACX"}

package/dist/adapters/database/index.mjs

@@ -11,6 +11,11 @@ import "./subscriber/index.mjs";
 import { CachePrefix } from "./domains/constants.mjs";
 import { RealmSubscriber } from "./domains/realm/subscriber.mjs";
 import { KeyEntity } from "./domains/key/entity.mjs";
+import { PolicyEntity } from "./domains/policy/entity.mjs";
+import { PolicyAttributeEntity } from "./domains/policy-attribute/entity.mjs";
+import { PolicyAttributeSubscriber } from "./domains/policy-attribute/subscriber.mjs";
+import { PolicyRepository } from "./domains/policy/repository.mjs";
+import { PolicySubscriber } from "./domains/policy/subscriber.mjs";
 import { ClientEntity } from "./domains/client/entity.mjs";
 import { ClientSubscriber } from "./domains/client/subscriber.mjs";
 import { RoleEntity } from "./domains/role/entity.mjs";
@@ -21,45 +26,39 @@ import { ClientRoleEntity } from "./domains/client-role/entity.mjs";
 import { ClientRoleSubscriber } from "./domains/client-role/subscriber.mjs";
 import { PermissionEntity } from "./domains/permission/entity.mjs";
 import { PermissionSubscriber } from "./domains/permission/subscriber.mjs";
-import { PolicyEntity } from "./domains/policy/entity.mjs";
-import { PolicyAttributeEntity } from "./domains/policy-attribute/entity.mjs";
-import { PolicyAttributeSubscriber } from "./domains/policy-attribute/subscriber.mjs";
-import { PolicyRepository } from "./domains/policy/repository.mjs";
-import { PolicySubscriber } from "./domains/policy/subscriber.mjs";
 import { ClientPermissionEntity } from "./domains/client-permission/entity.mjs";
 import { ClientPermissionSubscriber } from "./domains/client-permission/subscriber.mjs";
 import { ScopeEntity } from "./domains/scope/entity.mjs";
 import { ScopeSubscriber } from "./domains/scope/subscriber.mjs";
 import { ClientScopeEntity } from "./domains/client-scope/entity.mjs";
 import { ClientScopeSubscriber } from "./domains/client-scope/subscriber.mjs";
-import { IdentityProviderEntity } from "./domains/identity-provider/entity.mjs";
-import { IdentityProviderAttributeEntity } from "./domains/identity-provider-attribute/entity.mjs";
-import { IdentityProviderAttributeSubscriber } from "./domains/identity-provider-attribute/subscriber.mjs";
-import { IdentityProviderRepository } from "./domains/identity-provider/repository.mjs";
-import { IdentityProviderSubscriber } from "./domains/identity-provider/subscriber.mjs";
 import { UserEntity } from "./domains/user/entity.mjs";
 import { UserAttributeEntity } from "./domains/user-attribute/entity.mjs";
 import { UserAttributeSubscriber } from "./domains/user-attribute/subscriber.mjs";
 import { UserRepository } from "./domains/user/repository.mjs";
 import { UserSubscriber } from "./domains/user/subscriber.mjs";
+import { ConsentEntity } from "./domains/consent/entity.mjs";
+import { ConsentEntitySubscriber } from "./domains/consent/subscriber.mjs";
+import { EventEntity } from "./domains/event/entity.mjs";
+import { IdentityProviderEntity } from "./domains/identity-provider/entity.mjs";
+import { IdentityProviderAttributeEntity } from "./domains/identity-provider-attribute/entity.mjs";
+import { IdentityProviderAttributeSubscriber } from "./domains/identity-provider-attribute/subscriber.mjs";
+import { IdentityProviderRepository } from "./domains/identity-provider/repository.mjs";
+import { IdentityProviderSubscriber } from "./domains/identity-provider/subscriber.mjs";
 import { IdentityProviderAccountEntity } from "./domains/identity-provider-account/entity.mjs";
 import { IdentityProviderAccountSubscriber } from "./domains/identity-provider-account/subscriber.mjs";
 import { IdentityProviderAttributeMappingEntity } from "./domains/identity-provider-attribute-mapping/entity.mjs";
 import { IdentityProviderPermissionMappingEntity } from "./domains/identity-provider-permission-mapping/entity.mjs";
 import { IdentityProviderRoleMappingEntity } from "./domains/identity-provider-role-mapping/entity.mjs";
 import { IdentityProviderRoleSubscriber } from "./domains/identity-provider-role-mapping/subscriber.mjs";
-import { RobotEntity } from "./domains/robot/entity.mjs";
-import { RobotSubscriber } from "./domains/robot/subscriber.mjs";
 import { SessionEntity } from "./domains/session/entity.mjs";
 import { SessionTokenEntity } from "./domains/session-token/entity.mjs";
+import { TrustAnchorEntity } from "./domains/trust-anchor/entity.mjs";
 import { PermissionPolicyEntity } from "./domains/permission-policy/entity.mjs";
-import { RobotPermissionEntity } from "./domains/robot-permission/entity.mjs";
-import { RobotPermissionSubscriber } from "./domains/robot-permission/subscriber.mjs";
-import { RobotRoleEntity } from "./domains/robot-role/entity.mjs";
-import { RobotRoleSubscriber } from "./domains/robot-role/subscriber.mjs";
 import { RoleAttributeSubscriber } from "./domains/role-attribute/subscriber.mjs";
 import { RolePermissionEntity } from "./domains/role-permission/entity.mjs";
 import { RolePermissionSubscriber } from "./domains/role-permission/subscriber.mjs";
+import { UserAuthenticatorEntity } from "./domains/user-authenticator/entity.mjs";
 import { UserPermissionEntity } from "./domains/user-permission/entity.mjs";
 import { UserPermissionSubscriber } from "./domains/user-permission/subscriber.mjs";
 import { UserRoleEntity } from "./domains/user-role/entity.mjs";
@@ -70,5 +69,6 @@ import "./cache/index.mjs";
 import { DataSourceOptionsBuilder } from "./data-source/options/module.mjs";
 import "./data-source/index.mjs";
 import { DatabaseConflictError } from "./errors/conflict.mjs";
+import { getDatabaseDriverErrorCode, isUniqueConstraintDatabaseError } from "./errors/driver.mjs";
 import "./errors/index.mjs";
-export { CachePrefix, ClientEntity, ClientPermissionEntity, ClientPermissionSubscriber, ClientRoleEntity, ClientRoleSubscriber, ClientScopeEntity, ClientScopeSubscriber, ClientSubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseQueryResultCache, EntitySubscriber, IdentityProviderAccountEntity, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeSubscriber, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderRepository, IdentityProviderRoleMappingEntity, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, KeyEntity, PermissionEntity, PermissionPolicyEntity, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyEntity, PolicyRepository, PolicySubscriber, RealmEntity, RealmRepository, RealmSubscriber, RobotEntity, RobotPermissionEntity, RobotPermissionSubscriber, RobotRoleEntity, RobotRoleSubscriber, RobotSubscriber, RoleAttributeEntity, RoleAttributeSubscriber, RoleEntity, RolePermissionEntity, RolePermissionSubscriber, RoleRepository, RoleSubscriber, ScopeEntity, ScopeSubscriber, SessionEntity, SessionTokenEntity, UserAttributeEntity, UserAttributeSubscriber, UserEntity, UserPermissionEntity, UserPermissionSubscriber, UserRepository, UserRoleEntity, UserRoleSubscriber, UserSubscriber, buildEntityDestinations, dateToISOStringTransformer, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment };
+export { CachePrefix, ClientEntity, ClientPermissionEntity, ClientPermissionSubscriber, ClientRoleEntity, ClientRoleSubscriber, ClientScopeEntity, ClientScopeSubscriber, ClientSubscriber, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseQueryResultCache, EntitySubscriber, EventEntity, IdentityProviderAccountEntity, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeSubscriber, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderRepository, IdentityProviderRoleMappingEntity, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, KeyEntity, PermissionEntity, PermissionPolicyEntity, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyEntity, PolicyRepository, PolicySubscriber, RealmEntity, RealmRepository, RealmSubscriber, RoleAttributeEntity, RoleAttributeSubscriber, RoleEntity, RolePermissionEntity, RolePermissionSubscriber, RoleRepository, RoleSubscriber, ScopeEntity, ScopeSubscriber, SessionEntity, SessionTokenEntity, TrustAnchorEntity, UserAttributeEntity, UserAttributeSubscriber, UserAuthenticatorEntity, UserEntity, UserPermissionEntity, UserPermissionSubscriber, UserRepository, UserRoleEntity, UserRoleSubscriber, UserSubscriber, buildEntityDestinations, dateToISOStringTransformer, getDatabaseDriverErrorCode, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isUniqueConstraintDatabaseError };

package/dist/adapters/database/migrations/mysql/1783769340000-Default.d.ts

@@ -0,0 +1,50 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Security event log (plan 057), MFA — authenticator devices (plan 049) +
+ * auth-method claims (plan 050), application access policy (plan 052) +
+ * persisted consent (plan 055), realm key store (plans 069 + 071) and
+ * RFC 8705 client authentication (plan 072).
+ *
+ * - Adds auth_events: append-only, PII-stripped security audit log. No FKs
+ *   by design: a row must survive deletion of the realm/actor/client it
+ *   references. Retention is per-row (`expires_at`, stamped at write from
+ *   `eventLogRetentionDays`; NULL = keep forever) and swept by the
+ *   event-cleaner component (plan 057).
+ * - Adds auth_user_authenticators: polymorphic second-factor device rows
+ *   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed
+ *   (secret) is symmetrically encrypted at rest; recovery codes are hashed.
+ *   FKs to auth_users / auth_realms (ON DELETE CASCADE).
+ * - Adds auth_sessions.mfa_at: instant the subject last passed a
+ *   second-factor challenge for the session (plan 049).
+ * - Adds auth_sessions.auth_method: how the subject authenticated
+ *   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.
+ * - Adds auth_clients.access_policy_id: nullable FK to auth_policies
+ *   (ON DELETE SET NULL) — the policy that must pass for an identity to
+ *   authorize against the client (null = default-allow; plan 052).
+ * - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)
+ *   a subject has approved at POST /authorize. Union/keep (missing tokens
+ *   only, never deleted on re-approval); built_in clients keep zero rows;
+ *   expires_at is dormant (always null in Stage 1) but honored by the
+ *   covering check. FKs to auth_clients / auth_realms and a nullable user_id
+ *   FK (all ON DELETE CASCADE, so a user deletion drops its consents;
+ *   plan 055).
+ * - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —
+ *   generalizes auth_keys into the per-realm key store. enc rows hold the
+ *   realm's auto-generated symmetric at-rest encryption key (oct) that the
+ *   MFA seed cipher rides; existing rows default to sig (plan 069).
+ * - Adds auth_keys.name (canonical identifier, backfilled from id),
+ *   auth_keys.status (lifecycle: active/passive/disabled) and the dormant
+ *   auth_keys.certificate (PEM chain, Stage B) — key management API
+ *   (plan 071 Stage A).
+ * - Adds auth_trust_anchors: realm-scoped public CA certificates used by
+ *   RFC 8705 PKI client authentication (plan 071 Stage C).
+ * - Replaces auth_clients.is_confidential with auth_method
+ *   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705
+ *   client authentication and sender-constrained tokens (plan 072).
+ */
+export declare class Default1783769340000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1783769340000-Default.d.ts.map

package/dist/adapters/database/migrations/mysql/1783769340000-Default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783769340000-Default.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/mysql/1783769340000-Default.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,qBAAa,oBAAqB,YAAW,kBAAkB;IAC3D,IAAI,SAA0B;IAEjB,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA0L3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAqH7D"}

package/dist/adapters/database/migrations/mysql/1783769340000-Default.mjs

@@ -0,0 +1,320 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/mysql/1783769340000-Default.ts
+/**
+* Security event log (plan 057), MFA — authenticator devices (plan 049) +
+* auth-method claims (plan 050), application access policy (plan 052) +
+* persisted consent (plan 055), realm key store (plans 069 + 071) and
+* RFC 8705 client authentication (plan 072).
+*
+* - Adds auth_events: append-only, PII-stripped security audit log. No FKs
+*   by design: a row must survive deletion of the realm/actor/client it
+*   references. Retention is per-row (`expires_at`, stamped at write from
+*   `eventLogRetentionDays`; NULL = keep forever) and swept by the
+*   event-cleaner component (plan 057).
+* - Adds auth_user_authenticators: polymorphic second-factor device rows
+*   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed
+*   (secret) is symmetrically encrypted at rest; recovery codes are hashed.
+*   FKs to auth_users / auth_realms (ON DELETE CASCADE).
+* - Adds auth_sessions.mfa_at: instant the subject last passed a
+*   second-factor challenge for the session (plan 049).
+* - Adds auth_sessions.auth_method: how the subject authenticated
+*   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.
+* - Adds auth_clients.access_policy_id: nullable FK to auth_policies
+*   (ON DELETE SET NULL) — the policy that must pass for an identity to
+*   authorize against the client (null = default-allow; plan 052).
+* - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)
+*   a subject has approved at POST /authorize. Union/keep (missing tokens
+*   only, never deleted on re-approval); built_in clients keep zero rows;
+*   expires_at is dormant (always null in Stage 1) but honored by the
+*   covering check. FKs to auth_clients / auth_realms and a nullable user_id
+*   FK (all ON DELETE CASCADE, so a user deletion drops its consents;
+*   plan 055).
+* - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —
+*   generalizes auth_keys into the per-realm key store. enc rows hold the
+*   realm's auto-generated symmetric at-rest encryption key (oct) that the
+*   MFA seed cipher rides; existing rows default to sig (plan 069).
+* - Adds auth_keys.name (canonical identifier, backfilled from id),
+*   auth_keys.status (lifecycle: active/passive/disabled) and the dormant
+*   auth_keys.certificate (PEM chain, Stage B) — key management API
+*   (plan 071 Stage A).
+* - Adds auth_trust_anchors: realm-scoped public CA certificates used by
+*   RFC 8705 PKI client authentication (plan 071 Stage C).
+* - Replaces auth_clients.is_confidential with auth_method
+*   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705
+*   client authentication and sender-constrained tokens (plan 072).
+*/ var Default1783769340000 = class {
+	name = "Default1783769340000";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            CREATE TABLE \`auth_events\` (
+                \`id\` varchar(36) NOT NULL,
+                \`scope\` varchar(64) NOT NULL,
+                \`name\` varchar(64) NOT NULL,
+                \`ref_type\` varchar(64) NULL,
+                \`ref_id\` varchar(64) NULL,
+                \`client_id\` varchar(36) NULL,
+                \`actor_type\` varchar(16) NULL,
+                \`actor_id\` varchar(36) NULL,
+                \`actor_name\` varchar(128) NULL,
+                \`request_path\` varchar(256) NULL,
+                \`request_method\` varchar(10) NULL,
+                \`request_ip_address\` varchar(45) NULL,
+                \`request_user_agent\` varchar(512) NULL,
+                \`realm_id\` varchar(36) NULL,
+                \`data\` text NULL,
+                \`expiring\` tinyint NOT NULL DEFAULT 0,
+                \`expires_at\` varchar(28) NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                INDEX \`IDX_auth_events_name_scope\` (\`name\`, \`scope\`),
+                INDEX \`IDX_auth_events_ref_type_ref_id\` (\`ref_type\`, \`ref_id\`),
+                INDEX \`IDX_auth_events_client_id\` (\`client_id\`),
+                INDEX \`IDX_auth_events_actor_id\` (\`actor_id\`),
+                INDEX \`IDX_auth_events_actor_name\` (\`actor_name\`),
+                INDEX \`IDX_auth_events_request_ip_address\` (\`request_ip_address\`),
+                INDEX \`IDX_auth_events_realm_id\` (\`realm_id\`),
+                INDEX \`IDX_auth_events_expiring\` (\`expiring\`),
+                INDEX \`IDX_auth_events_expires_at\` (\`expires_at\`),
+                INDEX \`IDX_auth_events_created_at\` (\`created_at\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_user_authenticators\` (
+                \`id\` varchar(36) NOT NULL,
+                \`kind\` varchar(16) NOT NULL,
+                \`name\` varchar(128) NULL,
+                \`secret\` text NULL,
+                \`parameters\` text NULL,
+                \`codes\` text NULL,
+                \`confirmed\` tinyint NOT NULL DEFAULT 0,
+                \`last_used_at\` varchar(28) NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                \`updated_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+                \`user_id\` varchar(36) NOT NULL,
+                \`realm_id\` varchar(36) NOT NULL,
+                INDEX \`IDX_auth_user_authenticators_kind\` (\`kind\`),
+                INDEX \`IDX_auth_user_authenticators_user_id\` (\`user_id\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_user_authenticators\`
+            ADD CONSTRAINT \`FK_auth_user_authenticators_user_id\` FOREIGN KEY (\`user_id\`) REFERENCES \`auth_users\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_user_authenticators\`
+            ADD CONSTRAINT \`FK_auth_user_authenticators_realm_id\` FOREIGN KEY (\`realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` ADD \`mfa_at\` varchar(28) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` ADD \`auth_method\` varchar(16) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`access_policy_id\` varchar(36) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\`
+            ADD CONSTRAINT \`FK_auth_clients_access_policy_id\` FOREIGN KEY (\`access_policy_id\`) REFERENCES \`auth_policies\`(\`id\`) ON DELETE SET NULL ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_consents\` (
+                \`id\` varchar(36) NOT NULL,
+                \`sub\` varchar(64) NOT NULL,
+                \`sub_kind\` varchar(64) NOT NULL,
+                \`scope\` varchar(128) NOT NULL,
+                \`expires_at\` varchar(28) NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                \`updated_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+                \`client_id\` varchar(36) NOT NULL,
+                \`realm_id\` varchar(36) NOT NULL,
+                \`user_id\` varchar(36) NULL,
+                INDEX \`IDX_auth_consents_sub\` (\`sub\`),
+                INDEX \`IDX_auth_consents_client_id\` (\`client_id\`),
+                INDEX \`IDX_auth_consents_realm_id\` (\`realm_id\`),
+                INDEX \`IDX_auth_consents_user_id\` (\`user_id\`),
+                UNIQUE INDEX \`UQ_auth_consents_subject_scope\` (\`client_id\`, \`sub\`, \`sub_kind\`, \`scope\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\`
+            ADD CONSTRAINT \`FK_auth_consents_client_id\` FOREIGN KEY (\`client_id\`) REFERENCES \`auth_clients\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\`
+            ADD CONSTRAINT \`FK_auth_consents_realm_id\` FOREIGN KEY (\`realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\`
+            ADD CONSTRAINT \`FK_auth_consents_user_id\` FOREIGN KEY (\`user_id\`) REFERENCES \`auth_users\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` ADD \`use\` varchar(64) NOT NULL DEFAULT 'sig'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` ADD \`name\` varchar(128) NULL
+        `);
+		await queryRunner.query(`
+            UPDATE \`auth_keys\` SET \`name\` = \`id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`name\` varchar(128) NOT NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\`
+            ADD UNIQUE INDEX \`UQ_auth_keys_name_realm_id\` (\`name\`, \`realm_id\`)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` ADD \`status\` varchar(64) NOT NULL DEFAULT 'active'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` ADD \`certificate\` text NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`decryption_key\` text NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`encryption_key\` text NULL
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_trust_anchors\` (
+                \`id\` varchar(36) NOT NULL,
+                \`name\` varchar(128) NOT NULL,
+                \`certificate\` text NOT NULL,
+                \`enabled\` tinyint NOT NULL DEFAULT 1,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                \`updated_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+                \`realm_id\` varchar(36) NOT NULL,
+                INDEX \`IDX_auth_trust_anchors_realm_id\` (\`realm_id\`),
+                UNIQUE INDEX \`UQ_auth_trust_anchors_name_realm_id\` (\`name\`, \`realm_id\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_trust_anchors\`
+            ADD CONSTRAINT \`FK_auth_trust_anchors_realm_id\` FOREIGN KEY (\`realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`auth_method\` varchar(16) NOT NULL DEFAULT 'none'
+        `);
+		await queryRunner.query(`
+            UPDATE \`auth_clients\` SET \`auth_method\` = 'secret' WHERE \`is_confidential\` = 1
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`token_binding_method\` varchar(16) NOT NULL DEFAULT 'none'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`is_confidential\`
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`is_confidential\` tinyint NOT NULL DEFAULT 0
+        `);
+		await queryRunner.query(`
+            UPDATE \`auth_clients\` SET \`is_confidential\` = 1 WHERE \`auth_method\` <> 'none'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`token_binding_method\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`auth_method\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_trust_anchors\` DROP FOREIGN KEY \`FK_auth_trust_anchors_realm_id\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`UQ_auth_trust_anchors_name_realm_id\` ON \`auth_trust_anchors\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_trust_anchors_realm_id\` ON \`auth_trust_anchors\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_trust_anchors\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`encryption_key\` varchar(4096) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`decryption_key\` varchar(4096) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP COLUMN \`certificate\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP COLUMN \`status\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP INDEX \`UQ_auth_keys_name_realm_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP COLUMN \`name\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP COLUMN \`use\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\` DROP FOREIGN KEY \`FK_auth_consents_user_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\` DROP FOREIGN KEY \`FK_auth_consents_realm_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\` DROP FOREIGN KEY \`FK_auth_consents_client_id\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`UQ_auth_consents_subject_scope\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_consents_user_id\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_consents_realm_id\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_consents_client_id\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_consents_sub\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP FOREIGN KEY \`FK_auth_clients_access_policy_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`access_policy_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` DROP COLUMN \`auth_method\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` DROP COLUMN \`mfa_at\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_user_authenticators\` DROP FOREIGN KEY \`FK_auth_user_authenticators_realm_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_user_authenticators\` DROP FOREIGN KEY \`FK_auth_user_authenticators_user_id\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_user_authenticators_user_id\` ON \`auth_user_authenticators\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_user_authenticators_kind\` ON \`auth_user_authenticators\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_user_authenticators\`
+        `);
+		await queryRunner.query("DROP TABLE `auth_events`");
+	}
+};
+//#endregion
+export { Default1783769340000 };
+
+//# sourceMappingURL=1783769340000-Default.mjs.map

package/dist/adapters/database/migrations/mysql/1783769340000-Default.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783769340000-Default.mjs","names":["Default1783769340000","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/mysql/1783769340000-Default.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Security event log (plan 057), MFA — authenticator devices (plan 049) +\n * auth-method claims (plan 050), application access policy (plan 052) +\n * persisted consent (plan 055), realm key store (plans 069 + 071) and\n * RFC 8705 client authentication (plan 072).\n *\n * - Adds auth_events: append-only, PII-stripped security audit log. No FKs\n *   by design: a row must survive deletion of the realm/actor/client it\n *   references. Retention is per-row (`expires_at`, stamped at write from\n *   `eventLogRetentionDays`; NULL = keep forever) and swept by the\n *   event-cleaner component (plan 057).\n * - Adds auth_user_authenticators: polymorphic second-factor device rows\n *   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed\n *   (secret) is symmetrically encrypted at rest; recovery codes are hashed.\n *   FKs to auth_users / auth_realms (ON DELETE CASCADE).\n * - Adds auth_sessions.mfa_at: instant the subject last passed a\n *   second-factor challenge for the session (plan 049).\n * - Adds auth_sessions.auth_method: how the subject authenticated\n *   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.\n * - Adds auth_clients.access_policy_id: nullable FK to auth_policies\n *   (ON DELETE SET NULL) — the policy that must pass for an identity to\n *   authorize against the client (null = default-allow; plan 052).\n * - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)\n *   a subject has approved at POST /authorize. Union/keep (missing tokens\n *   only, never deleted on re-approval); built_in clients keep zero rows;\n *   expires_at is dormant (always null in Stage 1) but honored by the\n *   covering check. FKs to auth_clients / auth_realms and a nullable user_id\n *   FK (all ON DELETE CASCADE, so a user deletion drops its consents;\n *   plan 055).\n * - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —\n *   generalizes auth_keys into the per-realm key store. enc rows hold the\n *   realm's auto-generated symmetric at-rest encryption key (oct) that the\n *   MFA seed cipher rides; existing rows default to sig (plan 069).\n * - Adds auth_keys.name (canonical identifier, backfilled from id),\n *   auth_keys.status (lifecycle: active/passive/disabled) and the dormant\n *   auth_keys.certificate (PEM chain, Stage B) — key management API\n *   (plan 071 Stage A).\n * - Adds auth_trust_anchors: realm-scoped public CA certificates used by\n *   RFC 8705 PKI client authentication (plan 071 Stage C).\n * - Replaces auth_clients.is_confidential with auth_method\n *   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705\n *   client authentication and sender-constrained tokens (plan 072).\n */\nexport class Default1783769340000 implements MigrationInterface {\n    name = 'Default1783769340000';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        // security event log (plan 057)\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_events\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`scope\\` varchar(64) NOT NULL,\n                \\`name\\` varchar(64) NOT NULL,\n                \\`ref_type\\` varchar(64) NULL,\n                \\`ref_id\\` varchar(64) NULL,\n                \\`client_id\\` varchar(36) NULL,\n                \\`actor_type\\` varchar(16) NULL,\n                \\`actor_id\\` varchar(36) NULL,\n                \\`actor_name\\` varchar(128) NULL,\n                \\`request_path\\` varchar(256) NULL,\n                \\`request_method\\` varchar(10) NULL,\n                \\`request_ip_address\\` varchar(45) NULL,\n                \\`request_user_agent\\` varchar(512) NULL,\n                \\`realm_id\\` varchar(36) NULL,\n                \\`data\\` text NULL,\n                \\`expiring\\` tinyint NOT NULL DEFAULT 0,\n                \\`expires_at\\` varchar(28) NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                INDEX \\`IDX_auth_events_name_scope\\` (\\`name\\`, \\`scope\\`),\n                INDEX \\`IDX_auth_events_ref_type_ref_id\\` (\\`ref_type\\`, \\`ref_id\\`),\n                INDEX \\`IDX_auth_events_client_id\\` (\\`client_id\\`),\n                INDEX \\`IDX_auth_events_actor_id\\` (\\`actor_id\\`),\n                INDEX \\`IDX_auth_events_actor_name\\` (\\`actor_name\\`),\n                INDEX \\`IDX_auth_events_request_ip_address\\` (\\`request_ip_address\\`),\n                INDEX \\`IDX_auth_events_realm_id\\` (\\`realm_id\\`),\n                INDEX \\`IDX_auth_events_expiring\\` (\\`expiring\\`),\n                INDEX \\`IDX_auth_events_expires_at\\` (\\`expires_at\\`),\n                INDEX \\`IDX_auth_events_created_at\\` (\\`created_at\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n\n        // MFA authenticator devices (plan 049)\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_user_authenticators\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`kind\\` varchar(16) NOT NULL,\n                \\`name\\` varchar(128) NULL,\n                \\`secret\\` text NULL,\n                \\`parameters\\` text NULL,\n                \\`codes\\` text NULL,\n                \\`confirmed\\` tinyint NOT NULL DEFAULT 0,\n                \\`last_used_at\\` varchar(28) NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                \\`updated_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),\n                \\`user_id\\` varchar(36) NOT NULL,\n                \\`realm_id\\` varchar(36) NOT NULL,\n                INDEX \\`IDX_auth_user_authenticators_kind\\` (\\`kind\\`),\n                INDEX \\`IDX_auth_user_authenticators_user_id\\` (\\`user_id\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_user_authenticators\\`\n            ADD CONSTRAINT \\`FK_auth_user_authenticators_user_id\\` FOREIGN KEY (\\`user_id\\`) REFERENCES \\`auth_users\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_user_authenticators\\`\n            ADD CONSTRAINT \\`FK_auth_user_authenticators_realm_id\\` FOREIGN KEY (\\`realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` ADD \\`mfa_at\\` varchar(28) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` ADD \\`auth_method\\` varchar(16) NULL\n        `);\n\n        // application access policy (plan 052)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`access_policy_id\\` varchar(36) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\`\n            ADD CONSTRAINT \\`FK_auth_clients_access_policy_id\\` FOREIGN KEY (\\`access_policy_id\\`) REFERENCES \\`auth_policies\\`(\\`id\\`) ON DELETE SET NULL ON UPDATE NO ACTION\n        `);\n\n        // persisted per-scope consent (plan 055)\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_consents\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`sub\\` varchar(64) NOT NULL,\n                \\`sub_kind\\` varchar(64) NOT NULL,\n                \\`scope\\` varchar(128) NOT NULL,\n                \\`expires_at\\` varchar(28) NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                \\`updated_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),\n                \\`client_id\\` varchar(36) NOT NULL,\n                \\`realm_id\\` varchar(36) NOT NULL,\n                \\`user_id\\` varchar(36) NULL,\n                INDEX \\`IDX_auth_consents_sub\\` (\\`sub\\`),\n                INDEX \\`IDX_auth_consents_client_id\\` (\\`client_id\\`),\n                INDEX \\`IDX_auth_consents_realm_id\\` (\\`realm_id\\`),\n                INDEX \\`IDX_auth_consents_user_id\\` (\\`user_id\\`),\n                UNIQUE INDEX \\`UQ_auth_consents_subject_scope\\` (\\`client_id\\`, \\`sub\\`, \\`sub_kind\\`, \\`scope\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\`\n            ADD CONSTRAINT \\`FK_auth_consents_client_id\\` FOREIGN KEY (\\`client_id\\`) REFERENCES \\`auth_clients\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\`\n            ADD CONSTRAINT \\`FK_auth_consents_realm_id\\` FOREIGN KEY (\\`realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\`\n            ADD CONSTRAINT \\`FK_auth_consents_user_id\\` FOREIGN KEY (\\`user_id\\`) REFERENCES \\`auth_users\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        // realm key store use discriminator (plan 069)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` ADD \\`use\\` varchar(64) NOT NULL DEFAULT 'sig'\n        `);\n\n        // key management API (plan 071 Stage A)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` ADD \\`name\\` varchar(128) NULL\n        `);\n        await queryRunner.query(`\n            UPDATE \\`auth_keys\\` SET \\`name\\` = \\`id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`name\\` varchar(128) NOT NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\`\n            ADD UNIQUE INDEX \\`UQ_auth_keys_name_realm_id\\` (\\`name\\`, \\`realm_id\\`)\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` ADD \\`status\\` varchar(64) NOT NULL DEFAULT 'active'\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` ADD \\`certificate\\` text NULL\n        `);\n        // Widen the key-material columns: an imported RSA-4096 private key\n        // wrapped under a SECRETS_ENCRYPTION_KEY exceeds varchar(4096).\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`decryption_key\\` text NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`encryption_key\\` text NULL\n        `);\n\n        // RFC 8705 realm trust anchors (plan 071 Stage C)\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_trust_anchors\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`name\\` varchar(128) NOT NULL,\n                \\`certificate\\` text NOT NULL,\n                \\`enabled\\` tinyint NOT NULL DEFAULT 1,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                \\`updated_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),\n                \\`realm_id\\` varchar(36) NOT NULL,\n                INDEX \\`IDX_auth_trust_anchors_realm_id\\` (\\`realm_id\\`),\n                UNIQUE INDEX \\`UQ_auth_trust_anchors_name_realm_id\\` (\\`name\\`, \\`realm_id\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_trust_anchors\\`\n            ADD CONSTRAINT \\`FK_auth_trust_anchors_realm_id\\` FOREIGN KEY (\\`realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        // RFC 8705 client authentication and token binding (plan 072)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`auth_method\\` varchar(16) NOT NULL DEFAULT 'none'\n        `);\n        await queryRunner.query(`\n            UPDATE \\`auth_clients\\` SET \\`auth_method\\` = 'secret' WHERE \\`is_confidential\\` = 1\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`token_binding_method\\` varchar(16) NOT NULL DEFAULT 'none'\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`is_confidential\\`\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        // RFC 8705 client authentication and token binding (plan 072)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`is_confidential\\` tinyint NOT NULL DEFAULT 0\n        `);\n        await queryRunner.query(`\n            UPDATE \\`auth_clients\\` SET \\`is_confidential\\` = 1 WHERE \\`auth_method\\` <> 'none'\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`token_binding_method\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`auth_method\\`\n        `);\n\n        // RFC 8705 realm trust anchors (plan 071 Stage C)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_trust_anchors\\` DROP FOREIGN KEY \\`FK_auth_trust_anchors_realm_id\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`UQ_auth_trust_anchors_name_realm_id\\` ON \\`auth_trust_anchors\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_trust_anchors_realm_id\\` ON \\`auth_trust_anchors\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_trust_anchors\\`\n        `);\n\n        // key management API (plan 071 Stage A) — reverse last-in-first-out\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`encryption_key\\` varchar(4096) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`decryption_key\\` varchar(4096) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP COLUMN \\`certificate\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP COLUMN \\`status\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP INDEX \\`UQ_auth_keys_name_realm_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP COLUMN \\`name\\`\n        `);\n\n        // realm key store use discriminator (plan 069)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP COLUMN \\`use\\`\n        `);\n\n        // persisted per-scope consent (plan 055)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\` DROP FOREIGN KEY \\`FK_auth_consents_user_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\` DROP FOREIGN KEY \\`FK_auth_consents_realm_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\` DROP FOREIGN KEY \\`FK_auth_consents_client_id\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`UQ_auth_consents_subject_scope\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_consents_user_id\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_consents_realm_id\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_consents_client_id\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_consents_sub\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_consents\\`\n        `);\n\n        // application access policy (plan 052)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP FOREIGN KEY \\`FK_auth_clients_access_policy_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`access_policy_id\\`\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` DROP COLUMN \\`auth_method\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` DROP COLUMN \\`mfa_at\\`\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_user_authenticators\\` DROP FOREIGN KEY \\`FK_auth_user_authenticators_realm_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_user_authenticators\\` DROP FOREIGN KEY \\`FK_auth_user_authenticators_user_id\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_user_authenticators_user_id\\` ON \\`auth_user_authenticators\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_user_authenticators_kind\\` ON \\`auth_user_authenticators\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_user_authenticators\\`\n        `);\n\n        // security event log (plan 057)\n        await queryRunner.query('DROP TABLE `auth_events`');\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDA,IAAaA,uBAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EAErD,MAAMA,YAAYC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAgCvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;;;;SAkBvB;EAED,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;;;;;SAmBvB;EAED,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;SAavB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EAEvD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM,0BAAA;CAC5B;AACJ"}