@brightchain/node-express-suite 0.27.1 → 0.29.0

package/src/lib/services/auth.js

@@ -0,0 +1,278 @@
+"use strict";
+/**
+ * @fileoverview Base AuthService for BrightDB-backed applications.
+ *
+ * Handles core user authentication: register, login, JWT signing/verification,
+ * password change, and mnemonic recovery. Uses MemberStore + EnergyAccountStore
+ * from brightchain-lib, bcrypt for password hashing, and jsonwebtoken for JWTs.
+ *
+ * Domain-specific extensions (e.g. BrightHub profile creation, additional
+ * controllers) are added by subclasses in consuming libraries.
+ *
+ * @module services/auth
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrightDbAuthService = void 0;
+const tslib_1 = require("tslib");
+const brightchain_lib_1 = require("@brightchain/brightchain-lib");
+const ecies_lib_1 = require("@digitaldefiance/ecies-lib");
+const node_ecies_lib_1 = require("@digitaldefiance/node-ecies-lib");
+const node_express_suite_1 = require("@digitaldefiance/node-express-suite");
+const suite_core_lib_1 = require("@digitaldefiance/suite-core-lib");
+const bcrypt = tslib_1.__importStar(require("bcrypt"));
+const crypto_1 = require("crypto");
+const jwt = tslib_1.__importStar(require("jsonwebtoken"));
+const BCRYPT_ROUNDS = 12;
+/**
+ * Base authentication service for BrightDB-backed applications.
+ *
+ * Provides register, login, JWT sign/verify, password change, and
+ * mnemonic recovery. Subclasses can override methods to add domain-specific
+ * behavior (e.g. creating social profiles on registration).
+ */
+class BrightDbAuthService {
+    memberStore;
+    energyStore;
+    jwtSecret;
+    authProvider;
+    application;
+    constructor(application, memberStore, energyStore, jwtSecret, authProvider) {
+        this.application = application;
+        this.memberStore = memberStore;
+        this.energyStore = energyStore;
+        this.jwtSecret = jwtSecret;
+        this.authProvider = authProvider;
+    }
+    async register(username, email, password, mnemonic) {
+        // Check for duplicate email
+        const existing = await this.memberStore.queryIndex({ email });
+        if (existing.length > 0) {
+            throw new Error('Email already registered');
+        }
+        // Hash password before member creation
+        const passwordValue = password.value;
+        if (!passwordValue) {
+            throw new Error('Password value is empty');
+        }
+        const passwordHash = await bcrypt.hash(passwordValue, BCRYPT_ROUNDS);
+        const sp = brightchain_lib_1.ServiceProvider.getInstance();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        let liveMember;
+        let resultMnemonic;
+        let memberId;
+        let memberChecksum;
+        if (mnemonic?.value) {
+            // ── User-provided mnemonic path ──────────────────────────────────
+            const trimmed = mnemonic.value.trim();
+            // Defense-in-depth: validate format even though controller already checked
+            if (!ecies_lib_1.Constants.MnemonicRegex.test(trimmed)) {
+                throw new Error('Invalid mnemonic format');
+            }
+            // HMAC uniqueness check
+            const hmacSecretHex = this.application.environment.get('MNEMONIC_HMAC_SECRET');
+            if (!hmacSecretHex) {
+                throw new Error('MNEMONIC_HMAC_SECRET is not configured');
+            }
+            const hmac = (0, crypto_1.createHmac)('sha256', Buffer.from(hmacSecretHex, 'hex'))
+                .update(Buffer.from(trimmed, 'utf-8'))
+                .digest('hex');
+            // Check if the HMAC already exists in the mnemonic collection
+            const mnemonicsCollection = this.application.db.collection('mnemonics');
+            const existingHmac = await mnemonicsCollection.findOne({
+                hmac,
+            });
+            if (existingHmac) {
+                throw new suite_core_lib_1.TranslatableSuiteError('validation_mnemonicInUse');
+            }
+            // Create member with user-provided mnemonic via memberStore so it gets
+            // properly indexed (same flow as the server-generated path).
+            const { reference: mnemonicRef, mnemonic: returnedMnemonic } = await this.memberStore.createMember({
+                type: ecies_lib_1.MemberType.User,
+                name: username,
+                contactEmail: new brightchain_lib_1.EmailString(email),
+                forceMnemonic: new ecies_lib_1.SecureString(trimmed),
+            });
+            resultMnemonic = returnedMnemonic;
+            const idRawBytes = sp.idProvider.toBytes(mnemonicRef.id);
+            memberId = sp.idProvider.idToString(mnemonicRef.id);
+            memberChecksum = sp.checksumService.calculateChecksum(idRawBytes);
+            // Reconstruct the live member from the mnemonic so we have the private key
+            // for key wrapping. createMember() only returns a reference.
+            const eciesService = sp.eciesService;
+            const { member: reconstructed } = node_ecies_lib_1.Member.newMember(eciesService, ecies_lib_1.MemberType.User, username, new brightchain_lib_1.EmailString(email), new ecies_lib_1.SecureString(trimmed));
+            liveMember = reconstructed;
+            // Store the HMAC in the mnemonic collection for uniqueness tracking
+            await mnemonicsCollection.create({
+                _id: (0, crypto_1.randomUUID)(),
+                hmac,
+            });
+        }
+        else {
+            // ── Server-generated mnemonic path (existing flow) ───────────────
+            const { reference, mnemonic: generatedMnemonic } = await this.memberStore.createMember({
+                type: ecies_lib_1.MemberType.User,
+                name: username,
+                contactEmail: new brightchain_lib_1.EmailString(email),
+            });
+            const idRawBytes = sp.idProvider.toBytes(reference.id);
+            memberId = sp.idProvider.idToString(reference.id);
+            memberChecksum = sp.checksumService.calculateChecksum(idRawBytes);
+            // Reconstruct the member from the mnemonic so we have the private key.
+            // createMember() generates the keypair internally but only returns a
+            // reference — we need the live Member with private key to wrap it.
+            const eciesService = sp.eciesService;
+            const { member: reconstructed } = node_ecies_lib_1.Member.newMember(eciesService, ecies_lib_1.MemberType.User, username, new brightchain_lib_1.EmailString(email), generatedMnemonic);
+            liveMember = reconstructed;
+            resultMnemonic = generatedMnemonic;
+        }
+        // ── Shared code: wrap key, encrypt mnemonic, store user, sign JWT ──
+        // Password-wrap the private key (AES-256-GCM + PBKDF2)
+        let passwordWrappedPrivateKey;
+        if (liveMember.privateKey) {
+            const keyWrappingService = new node_express_suite_1.KeyWrappingService();
+            const wrapped = keyWrappingService.wrapSecret(liveMember.privateKey, password, this.application.constants);
+            passwordWrappedPrivateKey = {
+                salt: wrapped.salt,
+                iv: wrapped.iv,
+                authTag: wrapped.authTag,
+                ciphertext: wrapped.ciphertext,
+                iterations: wrapped.iterations,
+            };
+        }
+        // Encrypt the mnemonic with the system user's ECIES public key for
+        // server-side recovery (backup code generation, key rotation, etc.)
+        const systemUser = node_express_suite_1.SystemUserService.getSystemUser(
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        this.application.environment, this.application.constants);
+        const mnemonicRecovery = (await systemUser.encryptData(Buffer.from(resultMnemonic.value ?? '', 'utf-8'))).toString('hex');
+        // Store password hash, wrapped private key, and encrypted mnemonic.
+        // Use the ID that was registered in the memberStore index.
+        // In the server-generated mnemonic path, createMember() stores the member
+        // under reference.id, but the reconstructed liveMember has a different
+        // random ID. In the user-provided mnemonic path, liveMember.id is the
+        // canonical ID (though that path needs createMember support — see below).
+        // We captured the correct memberId string above for each branch, so derive
+        // the store-lookup ID from that.
+        const storeId = sp.idProvider.idFromString(memberId);
+        await this.memberStore.updateMember(storeId, {
+            id: storeId,
+            privateChanges: {
+                passwordHash,
+                passwordWrappedPrivateKey,
+                mnemonicRecovery,
+            },
+        });
+        const energyAccount = brightchain_lib_1.EnergyAccount.createWithTrialCredits(memberChecksum);
+        await this.energyStore.set(memberChecksum, energyAccount);
+        await this.sendWelcomeEmail(email, username);
+        const token = this.signToken(memberId, username, ecies_lib_1.MemberType.User);
+        // Dispose the live member to zero out private key material
+        liveMember.dispose();
+        return {
+            token,
+            memberId,
+            energyBalance: energyAccount.balance,
+        };
+    }
+    async login(credentials) {
+        const results = await this.memberStore.queryIndex({
+            name: credentials.username,
+            limit: 1,
+        });
+        if (results.length === 0) {
+            throw new Error('Invalid credentials');
+        }
+        const reference = results[0];
+        const storedHash = await this.getPasswordHash(reference.id);
+        const passwordValue = credentials.password.value;
+        if (!passwordValue) {
+            throw new Error('Password value is empty');
+        }
+        const isValid = await bcrypt.compare(passwordValue, storedHash);
+        if (!isValid) {
+            throw new Error('Invalid credentials');
+        }
+        const sp = brightchain_lib_1.ServiceProvider.getInstance();
+        const memberId = sp.idProvider.idToString(reference.id);
+        const idRawBytes = sp.idProvider.toBytes(reference.id);
+        const memberChecksum = sp.checksumService.calculateChecksum(idRawBytes);
+        const energyAccount = await this.energyStore.getOrCreate(memberChecksum);
+        const token = this.signToken(memberId, credentials.username, reference.type);
+        return {
+            token,
+            memberId,
+            energyBalance: energyAccount.balance,
+        };
+    }
+    signToken(memberId, username, type) {
+        const payload = {
+            memberId,
+            username,
+            type,
+        };
+        return jwt.sign(payload, this.jwtSecret, {
+            expiresIn: '7d',
+        });
+    }
+    async verifyToken(token) {
+        try {
+            const decoded = jwt.verify(token, this.jwtSecret);
+            return decoded;
+        }
+        catch {
+            throw new Error('Invalid token');
+        }
+    }
+    async storePasswordHash(memberId, hash) {
+        await this.memberStore.updateMember(memberId, {
+            id: memberId,
+            privateChanges: {
+                passwordHash: hash,
+            },
+        });
+    }
+    async getPasswordHash(memberId) {
+        const profile = await this.memberStore.getMemberProfile(memberId);
+        const passwordHash = profile.privateProfile?.passwordHash;
+        if (!passwordHash) {
+            throw new Error('No password hash found for member');
+        }
+        return passwordHash;
+    }
+    async changePassword(memberId, currentPassword, newPassword) {
+        const storedHash = await this.getPasswordHash(memberId);
+        const isValid = await bcrypt.compare(currentPassword, storedHash);
+        if (!isValid) {
+            throw new Error('Invalid credentials');
+        }
+        const newHash = await bcrypt.hash(newPassword, BCRYPT_ROUNDS);
+        await this.storePasswordHash(memberId, newHash);
+    }
+    async recoverWithMnemonic(email, mnemonic, newPassword) {
+        if (!this.authProvider) {
+            throw new Error('Authentication provider not configured');
+        }
+        const result = await this.authProvider.authenticateWithMnemonic(email, mnemonic);
+        const memberId = result.userId;
+        const member = result.userMember;
+        const token = this.signToken(memberId, member.name, member.type);
+        if (newPassword) {
+            const newHash = await bcrypt.hash(newPassword, BCRYPT_ROUNDS);
+            await this.storePasswordHash(member.id, newHash);
+        }
+        return {
+            token,
+            memberId,
+            passwordReset: !!newPassword,
+        };
+    }
+    /**
+     * Override in subclasses to send a welcome email via your preferred service.
+     * Default implementation logs to console.
+     */
+    async sendWelcomeEmail(email, username) {
+        console.log(`[BrightDbAuthService] Would send welcome email to ${email} for ${username}`);
+    }
+}
+exports.BrightDbAuthService = BrightDbAuthService;
+//# sourceMappingURL=auth.js.map

package/src/lib/services/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../../brightchain-node-express-suite/src/lib/services/auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;AAEH,kEASsC;AACtC,0DAIoC;AACpC,oEAIyC;AACzC,4EAG6C;AAC7C,oEAEyC;AAEzC,uDAAiC;AACjC,mCAAgD;AAChD,0DAAoC;AAOpC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB;;;;;;GAMG;AACH,MAAa,mBAAmB;IACpB,WAAW,CAAc;IACzB,WAAW,CAAqB;IAChC,SAAS,CAAS;IAClB,YAAY,CAAuC;IAC1C,WAAW,CAA4B;IAE1D,YACE,WAAsC,EACtC,WAAwB,EACxB,WAA+B,EAC/B,SAAiB,EACjB,YAAkD;QAElD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,KAAa,EACb,QAAsB,EACtB,QAAuB;QAEvB,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,uCAAuC;QACvC,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC;QACrC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QAErE,MAAM,EAAE,GAAG,iCAAe,CAAC,WAAW,EAAE,CAAC;QAEzC,8DAA8D;QAC9D,IAAI,UAAuB,CAAC;QAC5B,IAAI,cAA4B,CAAC;QACjC,IAAI,QAAgB,CAAC;QACrB,IAAI,cAAwB,CAAC;QAE7B,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC;YACpB,oEAAoE;YACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAEtC,2EAA2E;YAC3E,IAAI,CAAC,qBAAa,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;YAED,wBAAwB;YACxB,MAAM,aAAa,GACjB,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;iBACjE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;iBACrC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEjB,8DAA8D;YAC9D,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,UAAU,CAExD,WAAW,CAAC,CAAC;YACf,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC;gBACrD,IAAI;aACI,CAAC,CAAC;YACZ,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,uCAAsB,CAC9B,0BAAqD,CACtD,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAC1D,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC;gBAClC,IAAI,EAAE,sBAAU,CAAC,IAAI;gBACrB,IAAI,EAAE,QAAQ;gBACd,YAAY,EAAE,IAAI,6BAAW,CAAC,KAAK,CAAC;gBACpC,aAAa,EAAE,IAAI,wBAAY,CAAC,OAAO,CAAC;aACzC,CAAC,CAAC;YACL,cAAc,GAAG,gBAAgB,CAAC;YAElC,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACzD,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACpD,cAAc,GAAG,EAAE,CAAC,eAAe,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAElE,2EAA2E;YAC3E,6DAA6D;YAC7D,MAAM,YAAY,GAAG,EAAE,CAAC,YAA4C,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,uBAAM,CAAC,SAAS,CAChD,YAAY,EACZ,sBAAU,CAAC,IAAI,EACf,QAAQ,EACR,IAAI,6BAAW,CAAC,KAAK,CAAC,EACtB,IAAI,wBAAY,CAAC,OAAO,CAAC,CAC1B,CAAC;YACF,UAAU,GAAG,aAAa,CAAC;YAE3B,oEAAoE;YACpE,MAAM,mBAAmB,CAAC,MAAM,CAAC;gBAC/B,GAAG,EAAE,IAAA,mBAAU,GAAE;gBACjB,IAAI;aACI,CAAC,CAAC;QACd,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAC9C,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC;gBAClC,IAAI,EAAE,sBAAU,CAAC,IAAI;gBACrB,IAAI,EAAE,QAAQ;gBACd,YAAY,EAAE,IAAI,6BAAW,CAAC,KAAK,CAAC;aACrC,CAAC,CAAC;YAEL,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACvD,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAClD,cAAc,GAAG,EAAE,CAAC,eAAe,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAElE,uEAAuE;YACvE,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,YAAY,GAChB,EAAE,CAAC,YAA4D,CAAC;YAClE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,uBAAM,CAAC,SAAS,CAChD,YAAY,EACZ,sBAAU,CAAC,IAAI,EACf,QAAQ,EACR,IAAI,6BAAW,CAAC,KAAK,CAAC,EACtB,iBAAiB,CAClB,CAAC;YACF,UAAU,GAAG,aAAa,CAAC;YAC3B,cAAc,GAAG,iBAAiB,CAAC;QACrC,CAAC;QAED,sEAAsE;QAEtE,uDAAuD;QACvD,IAAI,yBAAiE,CAAC;QACtE,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC1B,MAAM,kBAAkB,GAAG,IAAI,uCAAkB,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAC3C,UAAU,CAAC,UAAU,EACrB,QAAQ,EACR,IAAI,CAAC,WAAW,CAAC,SAAS,CAC3B,CAAC;YACF,yBAAyB,GAAG;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,UAAU,GAAG,sCAAiB,CAAC,aAAa;QAChD,8DAA8D;QAC9D,IAAI,CAAC,WAAW,CAAC,WAAkB,EACnC,IAAI,CAAC,WAAW,CAAC,SAAS,CAC3B,CAAC;QACF,MAAM,gBAAgB,GAAG,CACvB,MAAM,UAAU,CAAC,WAAW,CAC1B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,CAAC,CACjD,CACF,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAElB,oEAAoE;QACpE,2DAA2D;QAC3D,0EAA0E;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,0EAA0E;QAC1E,2EAA2E;QAC3E,iCAAiC;QACjC,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE;YAC3C,EAAE,EAAE,OAAO;YACX,cAAc,EAAE;gBACd,YAAY;gBACZ,yBAAyB;gBACzB,gBAAgB;aACjB;SACF,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,+BAAa,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QAC3E,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QAE1D,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,sBAAU,CAAC,IAAI,CAAC,CAAC;QAElE,2DAA2D;QAC3D,UAAU,CAAC,OAAO,EAAE,CAAC;QAErB,OAAO;YACL,KAAK;YACL,QAAQ;YACR,aAAa,EAAE,aAAa,CAAC,OAAO;SACrC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAA6B;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;YAChD,IAAI,EAAE,WAAW,CAAC,QAAQ;YAC1B,KAAK,EAAE,CAAC;SACT,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAE7B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAoB,CAAC,CAAC;QAC9E,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;QACjD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,EAAE,GAAG,iCAAe,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,cAAc,GAAG,EAAE,CAAC,eAAe,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAExE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QAEzE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAC1B,QAAQ,EACR,WAAW,CAAC,QAAQ,EACpB,SAAS,CAAC,IAAI,CACf,CAAC;QAEF,OAAO;YACL,KAAK;YACL,QAAQ;YACR,aAAa,EAAE,aAAa,CAAC,OAAO;SACrC,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,QAAgB,EAAE,QAAgB,EAAE,IAAgB;QAC5D,MAAM,OAAO,GAAuC;YAClD,QAAQ;YACR,QAAQ;YACR,IAAI;SACL,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE;YACvC,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAkB,CAAC;YACnE,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,QAAa,EAAE,IAAY;QACjD,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAiC,EAAE;YACrE,EAAE,EAAE,QAAiC;YACrC,cAAc,EAAE;gBACd,YAAY,EAAE,IAAI;aACnB;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAa;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAiC,CAAC,CAAC;QAC3F,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC;QAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAAa,EACb,eAAuB,EACvB,WAAmB;QAEnB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,KAAa,EACb,QAAsB,EACtB,WAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAC7D,KAAK,EACL,QAAQ,CACT,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;QAEjC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAEjE,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC9D,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,OAAO;YACL,KAAK;YACL,QAAQ;YACR,aAAa,EAAE,CAAC,CAAC,WAAW;SAC7B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,gBAAgB,CAC9B,KAAa,EACb,QAAgB;QAEhB,OAAO,CAAC,GAAG,CACT,qDAAqD,KAAK,QAAQ,QAAQ,EAAE,CAC7E,CAAC;IACJ,CAAC;CACF;AA3VD,kDA2VC"}

package/src/lib/services/bright-db-authentication-provider.d.ts

@@ -1,6 +1,7 @@
 import type { BrightDb } from '@brightchain/db';
+import type { SecureString } from '@digitaldefiance/ecies-lib';
 import type { PlatformID } from '@digitaldefiance/node-ecies-lib';
-import type { IAuthenticatedUser, IAuthenticationProvider } from '@digitaldefiance/node-express-suite';
+import type { IAuthenticatedUser, IAuthenticationProvider, ICryptoAuthResult } from '@digitaldefiance/node-express-suite';
 import type { IRequestUserDTO, ITokenUser } from '@digitaldefiance/suite-core-lib';
 /**
  * Generic BrightDB-backed authentication provider.
@@ -27,5 +28,16 @@ export declare class BrightDbAuthenticationProvider<TID extends PlatformID = Buf
      * Verify a JWT token and return the decoded user.
      */
     verifyToken<TTokenUser extends ITokenUser = ITokenUser>(token: string): Promise<TTokenUser | null>;
+    /**
+     * Authenticate with a mnemonic and return the crypto result.
+     * Base implementation throws — subclasses (e.g. BrightChainAuthenticationProvider)
+     * override with MemberStore-backed mnemonic verification.
+     */
+    authenticateWithMnemonic(_email: string, _mnemonic: SecureString): Promise<ICryptoAuthResult<TID>>;
+    /**
+     * Authenticate with a password and return the crypto result.
+     * Base implementation throws — subclasses override with real password verification.
+     */
+    authenticateWithPassword(_email: string, _password: string): Promise<ICryptoAuthResult<TID>>;
 }
 //# sourceMappingURL=bright-db-authentication-provider.d.ts.map

package/src/lib/services/bright-db-authentication-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bright-db-authentication-provider.d.ts","sourceRoot":"","sources":["../../../../../brightchain-node-express-suite/src/lib/services/bright-db-authentication-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,eAAe,EACf,UAAU,EACX,MAAM,iCAAiC,CAAC;AAGzC;;;;;;GAMG;AACH,qBAAa,8BAA8B,CACzC,GAAG,SAAS,UAAU,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,CACjC,YAAW,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC;IAGhD,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ;IAC/B,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM;gBADjB,EAAE,EAAE,QAAQ,EACZ,SAAS,EAAE,MAAM;IAGtC;;;OAGG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IA2BhD;;;OAGG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA0C1E;;OAEG;IACG,WAAW,CAAC,UAAU,SAAS,UAAU,GAAG,UAAU,EAC1D,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;CAW9B"}
+{"version":3,"file":"bright-db-authentication-provider.d.ts","sourceRoot":"","sources":["../../../../../brightchain-node-express-suite/src/lib/services/bright-db-authentication-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,eAAe,EACf,UAAU,EACX,MAAM,iCAAiC,CAAC;AAGzC;;;;;;GAMG;AACH,qBAAa,8BAA8B,CACzC,GAAG,SAAS,UAAU,GAAG,MAAM,EAC/B,SAAS,SAAS,MAAM,GAAG,MAAM,CACjC,YAAW,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC;IAGhD,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ;IAC/B,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM;gBADjB,EAAE,EAAE,QAAQ,EACZ,SAAS,EAAE,MAAM;IAGtC;;;OAGG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IA2BhD;;;OAGG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA0C1E;;OAEG;IACG,WAAW,CAAC,UAAU,SAAS,UAAU,GAAG,UAAU,EAC1D,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAY7B;;;;OAIG;IACG,wBAAwB,CAC5B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAIlC;;;OAGG;IACG,wBAAwB,CAC5B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;CAGnC"}

package/src/lib/services/bright-db-authentication-provider.js

@@ -86,6 +86,21 @@ class BrightDbAuthenticationProvider {
             return null;
         }
     }
+    /**
+     * Authenticate with a mnemonic and return the crypto result.
+     * Base implementation throws — subclasses (e.g. BrightChainAuthenticationProvider)
+     * override with MemberStore-backed mnemonic verification.
+     */
+    async authenticateWithMnemonic(_email, _mnemonic) {
+        throw new Error('Mnemonic authentication not implemented in base provider');
+    }
+    /**
+     * Authenticate with a password and return the crypto result.
+     * Base implementation throws — subclasses override with real password verification.
+     */
+    async authenticateWithPassword(_email, _password) {
+        throw new Error('Password authentication not implemented in base provider');
+    }
 }
 exports.BrightDbAuthenticationProvider = BrightDbAuthenticationProvider;
 //# sourceMappingURL=bright-db-authentication-provider.js.map

package/src/lib/services/bright-db-authentication-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"bright-db-authentication-provider.js","sourceRoot":"","sources":["../../../../../brightchain-node-express-suite/src/lib/services/bright-db-authentication-provider.ts"],"names":[],"mappings":";;;AAUA,+CAAsC;AAEtC;;;;;;GAMG;AACH,MAAa,8BAA8B;IAMpB;IACA;IAFrB,YACqB,EAAY,EACZ,SAAiB;QADjB,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAQ;IACnC,CAAC;IAEJ;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,MAAc;QAEd,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAOhC,OAAO,CAAC,CAAC;YAEZ,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAW,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,OAAO;gBACL,EAAE,EAAE,MAAM;gBACV,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,QAAQ;gBAChD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAqC;gBAC3D,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;gBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAYhC,OAAO,CAAC,CAAC;YAEZ,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAW,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBAChE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,MAAM;gBACV,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;gBAChC,KAAK,EAAE,EAAE;gBACT,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;gBAC3E,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;gBAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;gBACnC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;gBAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;gBACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;gBACnC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,KAAK;gBACjD,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,KAAa;QAEb,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAA,qBAAM,EAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAA4B,CAAC;YACzE,OAAO;gBACL,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAW;gBAC9E,KAAK,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAwB;aAC3B,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAzGD,wEAyGC"}
+{"version":3,"file":"bright-db-authentication-provider.js","sourceRoot":"","sources":["../../../../../brightchain-node-express-suite/src/lib/services/bright-db-authentication-provider.ts"],"names":[],"mappings":";;;AAYA,+CAAsC;AAEtC;;;;;;GAMG;AACH,MAAa,8BAA8B;IAMpB;IACA;IAFrB,YACqB,EAAY,EACZ,SAAiB;QADjB,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAQ;IACnC,CAAC;IAEJ;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,MAAc;QAEd,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAOhC,OAAO,CAAC,CAAC;YAEZ,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAW,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,OAAO;gBACL,EAAE,EAAE,MAAM;gBACV,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,QAAQ;gBAChD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAqC;gBAC3D,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;gBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAYhC,OAAO,CAAC,CAAC;YAEZ,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAW,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBAChE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,MAAM;gBACV,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;gBAChC,KAAK,EAAE,EAAE;gBACT,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;gBAC3E,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;gBAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;gBACnC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;gBAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;gBACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;gBACnC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,KAAK;gBACjD,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,KAAa;QAEb,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAA,qBAAM,EAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAA4B,CAAC;YACzE,OAAO;gBACL,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAW;gBAC9E,KAAK,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAwB;aAC3B,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,wBAAwB,CAC5B,MAAc,EACd,SAAuB;QAEvB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAC5B,MAAc,EACd,SAAiB;QAEjB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;CACF;AAhID,wEAgIC"}

package/src/lib/upstream.d.ts

@@ -3,6 +3,6 @@
  * Consumers can import these through @brightchain/node-express-suite
  * instead of depending on the upstream package directly.
  */
-export { Application, createExpressConstants, AppRouter, } from '@digitaldefiance/node-express-suite';
-export type { IApplication, IConstants, IAuthenticationProvider, IDatabasePlugin, IEnvironment, } from '@digitaldefiance/node-express-suite';
+export { Application, createExpressConstants, AppRouter, AbstractJwtService, AbstractRoleService, } from '@digitaldefiance/node-express-suite';
+export type { IApplication, IConstants, IAuthenticationProvider, IDatabasePlugin, IEnvironment, IJwtService, IRoleService, } from '@digitaldefiance/node-express-suite';
 //# sourceMappingURL=upstream.d.ts.map

package/src/lib/upstream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream.d.ts","sourceRoot":"","sources":["../../../../brightchain-node-express-suite/src/lib/upstream.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,SAAS,GACV,MAAM,qCAAqC,CAAC;AAE7C,YAAY,EACV,YAAY,EACZ,UAAU,EACV,uBAAuB,EACvB,eAAe,EACf,YAAY,GACb,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"upstream.d.ts","sourceRoot":"","sources":["../../../../brightchain-node-express-suite/src/lib/upstream.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,SAAS,EACT,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAE7C,YAAY,EACV,YAAY,EACZ,UAAU,EACV,uBAAuB,EACvB,eAAe,EACf,YAAY,EACZ,WAAW,EACX,YAAY,GACb,MAAM,qCAAqC,CAAC"}

package/src/lib/upstream.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AppRouter = exports.createExpressConstants = exports.Application = void 0;
+exports.AbstractRoleService = exports.AbstractJwtService = exports.AppRouter = exports.createExpressConstants = exports.Application = void 0;
 /**
  * Re-exports from @digitaldefiance/node-express-suite (upstream).
  * Consumers can import these through @brightchain/node-express-suite
@@ -10,4 +10,6 @@ var node_express_suite_1 = require("@digitaldefiance/node-express-suite");
 Object.defineProperty(exports, "Application", { enumerable: true, get: function () { return node_express_suite_1.Application; } });
 Object.defineProperty(exports, "createExpressConstants", { enumerable: true, get: function () { return node_express_suite_1.createExpressConstants; } });
 Object.defineProperty(exports, "AppRouter", { enumerable: true, get: function () { return node_express_suite_1.AppRouter; } });
+Object.defineProperty(exports, "AbstractJwtService", { enumerable: true, get: function () { return node_express_suite_1.AbstractJwtService; } });
+Object.defineProperty(exports, "AbstractRoleService", { enumerable: true, get: function () { return node_express_suite_1.AbstractRoleService; } });
 //# sourceMappingURL=upstream.js.map

package/src/lib/upstream.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstream.js","sourceRoot":"","sources":["../../../../brightchain-node-express-suite/src/lib/upstream.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,0EAI6C;AAH3C,iHAAA,WAAW,OAAA;AACX,4HAAA,sBAAsB,OAAA;AACtB,+GAAA,SAAS,OAAA"}
+{"version":3,"file":"upstream.js","sourceRoot":"","sources":["../../../../brightchain-node-express-suite/src/lib/upstream.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,0EAM6C;AAL3C,iHAAA,WAAW,OAAA;AACX,4HAAA,sBAAsB,OAAA;AACtB,+GAAA,SAAS,OAAA;AACT,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA"}

package/src/lib/validation/userValidation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"userValidation.d.ts","sourceRoot":"","sources":["../../../../../brightchain-node-express-suite/src/lib/validation/userValidation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAsCrE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAoB9D;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CA+BvE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAqCjE"}
+{"version":3,"file":"userValidation.d.ts","sourceRoot":"","sources":["../../../../../brightchain-node-express-suite/src/lib/validation/userValidation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CA2DrE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAoB9D;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CA+BvE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAqCjE"}

package/src/lib/validation/userValidation.js

@@ -9,6 +9,7 @@ exports.validateRegistration = validateRegistration;
 exports.validateLogin = validateLogin;
 exports.validatePasswordChange = validatePasswordChange;
 exports.validateRecovery = validateRecovery;
+const ecies_lib_1 = require("@digitaldefiance/ecies-lib");
 /**
  * Validates a registration request body.
  * - username: non-empty, alphanumeric/hyphens/underscores only
@@ -47,6 +48,26 @@ function validateRegistration(body) {
             message: 'Password must be at least 8 characters',
         });
     }
+    // Optional mnemonic validation (Requirements: 2.1, 2.2, 2.3, 2.4)
+    const mnemonic = data['mnemonic'];
+    if (mnemonic !== undefined && mnemonic !== null) {
+        if (typeof mnemonic !== 'string' || mnemonic.trim().length === 0) {
+            errors.push({
+                field: 'mnemonic',
+                message: 'Mnemonic must be a non-empty string',
+            });
+        }
+        else {
+            const trimmed = mnemonic.trim();
+            // MnemonicRegex validates 12/15/18/21/24 word BIP39 format
+            if (!ecies_lib_1.Constants.MnemonicRegex.test(trimmed)) {
+                errors.push({
+                    field: 'mnemonic',
+                    message: 'Invalid mnemonic format: must be 12, 15, 18, 21, or 24 words',
+                });
+            }
+        }
+    }
     return { valid: errors.length === 0, errors };
 }
 /**

package/src/lib/validation/userValidation.js.map

@@ -1 +1 @@
-{"version":3,"file":"userValidation.js","sourceRoot":"","sources":["../../../../../brightchain-node-express-suite/src/lib/validation/userValidation.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAkBH,oDAsCC;AAOD,sCAoBC;AASD,wDA+BC;AAUD,4CAqCC;AA9JD;;;;;GAKG;AACH,SAAgB,oBAAoB,CAAC,IAAa;IAChD,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAElC,IACE,CAAC,QAAQ;QACT,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC5B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtE,CAAC;SAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,UAAU;YACjB,OAAO,EACL,8EAA8E;SACjF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtE,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,IAAa;IACzC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAElC,IACE,CAAC,QAAQ;QACT,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC5B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,IAAa;IAClD,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IAExC,IACE,CAAC,eAAe;QAChB,OAAO,eAAe,KAAK,QAAQ;QACnC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EACnC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,8BAA8B;SACxC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,0BAA0B;SACpC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,IAAa;IAC5C,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IAExC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IACE,CAAC,QAAQ;QACT,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC5B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACtD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,+BAA+B;aACzC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,4CAA4C;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"userValidation.js","sourceRoot":"","sources":["../../../../../brightchain-node-express-suite/src/lib/validation/userValidation.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAmBH,oDA2DC;AAOD,sCAoBC;AASD,wDA+BC;AAUD,4CAqCC;AA9LD,0DAAwE;AAWxE;;;;;GAKG;AACH,SAAgB,oBAAoB,CAAC,IAAa;IAChD,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAElC,IACE,CAAC,QAAQ;QACT,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC5B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtE,CAAC;SAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,UAAU;YACjB,OAAO,EACL,8EAA8E;SACjF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtE,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,2DAA2D;YAC3D,IAAI,CAAC,qBAAa,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,UAAU;oBACjB,OAAO,EACL,8DAA8D;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,IAAa;IACzC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAElC,IACE,CAAC,QAAQ;QACT,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC5B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,IAAa;IAClD,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IAExC,IACE,CAAC,eAAe;QAChB,OAAO,eAAe,KAAK,QAAQ;QACnC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EACnC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,8BAA8B;SACxC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,0BAA0B;SACpC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,IAAa;IAC5C,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IAExC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IACE,CAAC,QAAQ;QACT,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC5B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACtD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,+BAA+B;aACzC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,4CAA4C;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC"}