@carlonicora/nestjs-neo4jsonapi 1.39.0 → 1.40.0

package/dist/foundations/two-factor/repositories/two-factor-config.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-config.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/two-factor/repositories/two-factor-config.repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAE3F,qBACa,yBAA0B,SAAQ,kBAAkB,CAC/D,eAAe,EACf,OAAO,yBAAyB,CAAC,aAAa,CAC/C;IACC,SAAS,CAAC,QAAQ,CAAC,UAAU,2DAA6B;gBAE9C,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU;IAMnF,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAWzE,aAAa,CAAC,MAAM,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,eAAe,CAAC;IAyBtB,cAAc,CAAC,MAAM,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,eAAe,CAAC;IA2BtB,cAAc,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzD,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC;CAK1F"}

package/dist/foundations/two-factor/repositories/two-factor-config.repository.js

@@ -0,0 +1,105 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorConfigRepository = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_cls_1 = require("nestjs-cls");
+const abstract_repository_1 = require("../../../core/neo4j/abstracts/abstract.repository");
+const neo4j_service_1 = require("../../../core/neo4j/services/neo4j.service");
+const security_service_1 = require("../../../core/security/services/security.service");
+const two_factor_config_1 = require("../entities/two-factor-config");
+let TwoFactorConfigRepository = class TwoFactorConfigRepository extends abstract_repository_1.AbstractRepository {
+    constructor(neo4j, securityService, clsService) {
+        super(neo4j, securityService, clsService);
+        this.descriptor = two_factor_config_1.TwoFactorConfigDescriptor;
+    }
+    // onModuleInit is inherited from AbstractRepository - auto-creates constraints
+    async findByUserId(params) {
+        const { nodeName, labelName } = this.descriptor.model;
+        const query = this.neo4j.initQuery({ serialiser: this.descriptor.model });
+        query.queryParams = { userId: params.userId };
+        query.query = `
+      MATCH (user:User {id: $userId})-[:HAS_TWO_FACTOR_CONFIG]->(${nodeName}:${labelName})
+      RETURN ${nodeName}
+    `;
+        return this.neo4j.readOne(query);
+    }
+    async createForUser(params) {
+        const { nodeName, labelName } = this.descriptor.model;
+        const query = this.neo4j.initQuery({ serialiser: this.descriptor.model });
+        query.queryParams = {
+            configId: params.configId,
+            userId: params.userId,
+            isEnabled: params.isEnabled ?? false,
+            preferredMethod: params.preferredMethod ?? "totp",
+        };
+        query.query = `
+      MATCH (user:User {id: $userId})
+      CREATE (${nodeName}:${labelName} {
+        id: $configId,
+        isEnabled: $isEnabled,
+        preferredMethod: $preferredMethod,
+        backupCodesCount: 0,
+        createdAt: datetime(),
+        updatedAt: datetime()
+      })
+      CREATE (user)-[:HAS_TWO_FACTOR_CONFIG]->(${nodeName})
+      RETURN ${nodeName}
+    `;
+        return this.neo4j.writeOne(query);
+    }
+    async updateByUserId(params) {
+        const { nodeName, labelName } = this.descriptor.model;
+        const query = this.neo4j.initQuery({ serialiser: this.descriptor.model });
+        const setClauses = [`${nodeName}.updatedAt = datetime()`];
+        query.queryParams = { userId: params.userId };
+        if (params.isEnabled !== undefined) {
+            setClauses.push(`${nodeName}.isEnabled = $isEnabled`);
+            query.queryParams.isEnabled = params.isEnabled;
+        }
+        if (params.preferredMethod !== undefined) {
+            setClauses.push(`${nodeName}.preferredMethod = $preferredMethod`);
+            query.queryParams.preferredMethod = params.preferredMethod;
+        }
+        if (params.backupCodesCount !== undefined) {
+            setClauses.push(`${nodeName}.backupCodesCount = $backupCodesCount`);
+            query.queryParams.backupCodesCount = params.backupCodesCount;
+        }
+        query.query = `
+      MATCH (user:User {id: $userId})-[:HAS_TWO_FACTOR_CONFIG]->(${nodeName}:${labelName})
+      SET ${setClauses.join(", ")}
+      RETURN ${nodeName}
+    `;
+        return this.neo4j.writeOne(query);
+    }
+    async deleteByUserId(params) {
+        const { nodeName, labelName } = this.descriptor.model;
+        const query = this.neo4j.initQuery();
+        query.queryParams = { userId: params.userId };
+        query.query = `
+      MATCH (user:User {id: $userId})-[:HAS_TWO_FACTOR_CONFIG]->(${nodeName}:${labelName})
+      DETACH DELETE ${nodeName}
+    `;
+        await this.neo4j.writeOne(query);
+    }
+    async getOrCreate(params) {
+        const existing = await this.findByUserId({ userId: params.userId });
+        if (existing)
+            return existing;
+        return this.createForUser({ configId: params.configId, userId: params.userId });
+    }
+};
+exports.TwoFactorConfigRepository = TwoFactorConfigRepository;
+exports.TwoFactorConfigRepository = TwoFactorConfigRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [neo4j_service_1.Neo4jService, security_service_1.SecurityService, nestjs_cls_1.ClsService])
+], TwoFactorConfigRepository);
+//# sourceMappingURL=two-factor-config.repository.js.map

package/dist/foundations/two-factor/repositories/two-factor-config.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-config.repository.js","sourceRoot":"","sources":["../../../../src/foundations/two-factor/repositories/two-factor-config.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2CAAwC;AACxC,2FAAuF;AACvF,8EAA0E;AAC1E,uFAAmF;AACnF,qEAA2F;AAGpF,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,wCAG9C;IAGC,YAAY,KAAmB,EAAE,eAAgC,EAAE,UAAsB;QACvF,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAHzB,eAAU,GAAG,6CAAyB,CAAC;IAI1D,CAAC;IAED,+EAA+E;IAE/E,KAAK,CAAC,YAAY,CAAC,MAA0B;QAC3C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1E,KAAK,CAAC,WAAW,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9C,KAAK,CAAC,KAAK,GAAG;mEACiD,QAAQ,IAAI,SAAS;eACzE,QAAQ;KAClB,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAKnB;QACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1E,KAAK,CAAC,WAAW,GAAG;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;YACpC,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,MAAM;SAClD,CAAC;QACF,KAAK,CAAC,KAAK,GAAG;;gBAEF,QAAQ,IAAI,SAAS;;;;;;;;iDAQY,QAAQ;eAC1C,QAAQ;KAClB,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAKpB;QACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAa,CAAC,GAAG,QAAQ,yBAAyB,CAAC,CAAC;QACpE,KAAK,CAAC,WAAW,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAE9C,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,yBAAyB,CAAC,CAAC;YACtD,KAAK,CAAC,WAAW,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACjD,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACzC,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,qCAAqC,CAAC,CAAC;YAClE,KAAK,CAAC,WAAW,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC7D,CAAC;QACD,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC1C,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,uCAAuC,CAAC,CAAC;YACpE,KAAK,CAAC,WAAW,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC/D,CAAC;QAED,KAAK,CAAC,KAAK,GAAG;mEACiD,QAAQ,IAAI,SAAS;YAC5E,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;eAClB,QAAQ;KAClB,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAA0B;QAC7C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrC,KAAK,CAAC,WAAW,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9C,KAAK,CAAC,KAAK,GAAG;mEACiD,QAAQ,IAAI,SAAS;sBAClE,QAAQ;KACzB,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAA4C;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,OAAO,IAAI,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;CACF,CAAA;AArGY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;qCAOQ,4BAAY,EAAmB,kCAAe,EAAc,uBAAU;GAN9E,yBAAyB,CAqGrC"}

package/dist/foundations/two-factor/services/backup-code.service.d.ts

@@ -0,0 +1,95 @@
+import { JsonApiService } from "../../../core/jsonapi/services/jsonapi.service";
+import { BackupCodeRepository } from "../repositories/backup-code.repository";
+export interface BackupCodeGenerationResult {
+    codes: string[];
+    count: number;
+}
+/**
+ * Backup Code Service
+ *
+ * Manages single-use backup codes for two-factor authentication recovery.
+ * Codes are 8 hex characters, bcrypt hashed, and can only be used once.
+ */
+export declare class BackupCodeService {
+    private readonly jsonApiService;
+    private readonly backupCodeRepository;
+    constructor(jsonApiService: JsonApiService, backupCodeRepository: BackupCodeRepository);
+    /**
+     * Generate a batch of backup codes for a user.
+     * Codes are returned in plain text ONCE - they should be shown to the user
+     * and will never be retrievable again (only hashes are stored).
+     *
+     * @param params.userId - The user's ID
+     * @returns JSON:API response with plain text backup codes (show to user once)
+     */
+    generateCodes(params: {
+        userId: string;
+    }): Promise<any>;
+    /**
+     * Validate a backup code for a user.
+     * If valid, the code is marked as used and cannot be reused.
+     *
+     * @param params.userId - The user's ID
+     * @param params.code - The backup code to validate (8 hex characters)
+     * @returns true if the code was valid and has been consumed
+     */
+    validateCode(params: {
+        userId: string;
+        code: string;
+    }): Promise<boolean>;
+    /**
+     * Get the count of unused backup codes for a user.
+     *
+     * @param params.userId - The user's ID
+     * @returns JSON:API response with unused backup codes count
+     */
+    getUnusedCount(params: {
+        userId: string;
+    }): Promise<any>;
+    /**
+     * Get the raw count of unused backup codes (for internal use).
+     *
+     * @param params.userId - The user's ID
+     * @returns Number of unused backup codes
+     */
+    getRawUnusedCount(params: {
+        userId: string;
+    }): Promise<number>;
+    /**
+     * Regenerate backup codes for a user.
+     * This deletes all existing codes (used and unused) and generates a new batch.
+     *
+     * @param params.userId - The user's ID
+     * @returns JSON:API response with new plain text backup codes (show to user once)
+     */
+    regenerateCodes(params: {
+        userId: string;
+    }): Promise<any>;
+    /**
+     * Check if a user has any backup codes (used or unused).
+     *
+     * @param params.userId - The user's ID
+     * @returns true if the user has any backup codes
+     */
+    hasBackupCodes(params: {
+        userId: string;
+    }): Promise<boolean>;
+    /**
+     * Delete all backup codes for a user.
+     *
+     * @param params.userId - The user's ID
+     */
+    deleteAllCodes(params: {
+        userId: string;
+    }): Promise<void>;
+    /**
+     * Generate a single random backup code.
+     * Format: 8 uppercase hex characters (e.g., "A1B2C3D4")
+     */
+    private generateSingleCode;
+    /**
+     * Create backup codes in the database and return plain text codes.
+     */
+    private createBackupCodes;
+}
+//# sourceMappingURL=backup-code.service.d.ts.map

package/dist/foundations/two-factor/services/backup-code.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-code.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/two-factor/services/backup-code.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAGhF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAM9E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,qBACa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;gBADpB,cAAc,EAAE,cAAc,EAC9B,oBAAoB,EAAE,oBAAoB;IAG7D;;;;;;;OAOG;IACG,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAmB7D;;;;;;;OAOG;IACG,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B9E;;;;;OAKG;IACG,cAAc,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAS9D;;;;;OAKG;IACG,iBAAiB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpE;;;;;;OAMG;IACG,eAAe,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAc/D;;;;;OAKG;IACG,cAAc,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAOlE;;;;OAIG;IACG,cAAc,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/D;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;OAEG;YACW,iBAAiB;CAsBhC"}

package/dist/foundations/two-factor/services/backup-code.service.js

@@ -0,0 +1,216 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BackupCodeService = void 0;
+const common_1 = require("@nestjs/common");
+const bcrypt = __importStar(require("bcrypt"));
+const crypto = __importStar(require("crypto"));
+const jsonapi_service_1 = require("../../../core/jsonapi/services/jsonapi.service");
+const backup_codes_count_1 = require("../entities/backup-codes-count");
+const backup_codes_generation_1 = require("../entities/backup-codes-generation");
+const backup_code_repository_1 = require("../repositories/backup-code.repository");
+const BACKUP_CODE_COUNT = 10;
+const BACKUP_CODE_LENGTH = 8; // 8 hex characters
+const BCRYPT_ROUNDS = 10;
+/**
+ * Backup Code Service
+ *
+ * Manages single-use backup codes for two-factor authentication recovery.
+ * Codes are 8 hex characters, bcrypt hashed, and can only be used once.
+ */
+let BackupCodeService = class BackupCodeService {
+    constructor(jsonApiService, backupCodeRepository) {
+        this.jsonApiService = jsonApiService;
+        this.backupCodeRepository = backupCodeRepository;
+    }
+    /**
+     * Generate a batch of backup codes for a user.
+     * Codes are returned in plain text ONCE - they should be shown to the user
+     * and will never be retrievable again (only hashes are stored).
+     *
+     * @param params.userId - The user's ID
+     * @returns JSON:API response with plain text backup codes (show to user once)
+     */
+    async generateCodes(params) {
+        // Check if user already has backup codes
+        const existingCount = await this.backupCodeRepository.findUnusedCount({
+            userId: params.userId,
+        });
+        if (existingCount > 0) {
+            throw new common_1.BadRequestException("User already has backup codes. Use regenerateCodes to replace them.");
+        }
+        const result = await this.createBackupCodes({ userId: params.userId });
+        return this.jsonApiService.buildSingle(backup_codes_generation_1.BackupCodesGenerationDescriptor.model, {
+            id: params.userId,
+            codes: result.codes,
+            count: result.count,
+        });
+    }
+    /**
+     * Validate a backup code for a user.
+     * If valid, the code is marked as used and cannot be reused.
+     *
+     * @param params.userId - The user's ID
+     * @param params.code - The backup code to validate (8 hex characters)
+     * @returns true if the code was valid and has been consumed
+     */
+    async validateCode(params) {
+        // Normalize the code (uppercase, remove any dashes/spaces)
+        const normalizedCode = params.code.toUpperCase().replace(/[-\s]/g, "");
+        // Validate code format
+        if (!/^[0-9A-F]{8}$/.test(normalizedCode)) {
+            return false;
+        }
+        // Get all unused backup codes for the user
+        const unusedCodes = await this.backupCodeRepository.findUnusedByUserId({
+            userId: params.userId,
+        });
+        // Check each code hash
+        for (const backupCode of unusedCodes) {
+            const isMatch = await bcrypt.compare(normalizedCode, backupCode.codeHash);
+            if (isMatch) {
+                // Mark the code as used
+                await this.backupCodeRepository.markUsed({ codeId: backupCode.id });
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Get the count of unused backup codes for a user.
+     *
+     * @param params.userId - The user's ID
+     * @returns JSON:API response with unused backup codes count
+     */
+    async getUnusedCount(params) {
+        const count = await this.backupCodeRepository.findUnusedCount({ userId: params.userId });
+        return this.jsonApiService.buildSingle(backup_codes_count_1.BackupCodesCountDescriptor.model, {
+            id: params.userId,
+            count,
+        });
+    }
+    /**
+     * Get the raw count of unused backup codes (for internal use).
+     *
+     * @param params.userId - The user's ID
+     * @returns Number of unused backup codes
+     */
+    async getRawUnusedCount(params) {
+        return this.backupCodeRepository.findUnusedCount({ userId: params.userId });
+    }
+    /**
+     * Regenerate backup codes for a user.
+     * This deletes all existing codes (used and unused) and generates a new batch.
+     *
+     * @param params.userId - The user's ID
+     * @returns JSON:API response with new plain text backup codes (show to user once)
+     */
+    async regenerateCodes(params) {
+        // Delete all existing backup codes
+        await this.backupCodeRepository.deleteAllByUserId({ userId: params.userId });
+        // Generate new codes
+        const result = await this.createBackupCodes({ userId: params.userId });
+        return this.jsonApiService.buildSingle(backup_codes_generation_1.BackupCodesGenerationDescriptor.model, {
+            id: params.userId,
+            codes: result.codes,
+            count: result.count,
+        });
+    }
+    /**
+     * Check if a user has any backup codes (used or unused).
+     *
+     * @param params.userId - The user's ID
+     * @returns true if the user has any backup codes
+     */
+    async hasBackupCodes(params) {
+        const codes = await this.backupCodeRepository.findByUserId({
+            userId: params.userId,
+        });
+        return codes.length > 0;
+    }
+    /**
+     * Delete all backup codes for a user.
+     *
+     * @param params.userId - The user's ID
+     */
+    async deleteAllCodes(params) {
+        await this.backupCodeRepository.deleteAllByUserId({ userId: params.userId });
+    }
+    /**
+     * Generate a single random backup code.
+     * Format: 8 uppercase hex characters (e.g., "A1B2C3D4")
+     */
+    generateSingleCode() {
+        const bytes = crypto.randomBytes(BACKUP_CODE_LENGTH / 2); // 4 bytes = 8 hex chars
+        return bytes.toString("hex").toUpperCase();
+    }
+    /**
+     * Create backup codes in the database and return plain text codes.
+     */
+    async createBackupCodes(params) {
+        const plainCodes = [];
+        for (let i = 0; i < BACKUP_CODE_COUNT; i++) {
+            const plainCode = this.generateSingleCode();
+            const codeHash = await bcrypt.hash(plainCode, BCRYPT_ROUNDS);
+            const codeId = crypto.randomUUID();
+            await this.backupCodeRepository.createForUser({
+                codeId,
+                userId: params.userId,
+                codeHash,
+            });
+            plainCodes.push(plainCode);
+        }
+        return {
+            codes: plainCodes,
+            count: plainCodes.length,
+        };
+    }
+};
+exports.BackupCodeService = BackupCodeService;
+exports.BackupCodeService = BackupCodeService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jsonapi_service_1.JsonApiService,
+        backup_code_repository_1.BackupCodeRepository])
+], BackupCodeService);
+//# sourceMappingURL=backup-code.service.js.map

package/dist/foundations/two-factor/services/backup-code.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-code.service.js","sourceRoot":"","sources":["../../../../src/foundations/two-factor/services/backup-code.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAiE;AACjE,+CAAiC;AACjC,+CAAiC;AACjC,oFAAgF;AAChF,uEAA4E;AAC5E,iFAAsF;AACtF,mFAA8E;AAE9E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,kBAAkB,GAAG,CAAC,CAAC,CAAC,mBAAmB;AACjD,MAAM,aAAa,GAAG,EAAE,CAAC;AAOzB;;;;;GAKG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YACmB,cAA8B,EAC9B,oBAA0C;QAD1C,mBAAc,GAAd,cAAc,CAAgB;QAC9B,yBAAoB,GAApB,oBAAoB,CAAsB;IAC1D,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CAAC,MAA0B;QAC5C,yCAAyC;QACzC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC;YACpE,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,4BAAmB,CAAC,qEAAqE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,yDAA+B,CAAC,KAAK,EAAE;YAC5E,EAAE,EAAE,MAAM,CAAC,MAAM;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,MAAwC;QACzD,2DAA2D;QAC3D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAEvE,uBAAuB;QACvB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,2CAA2C;QAC3C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;YACrE,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,uBAAuB;QACvB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YAE1E,IAAI,OAAO,EAAE,CAAC;gBACZ,wBAAwB;gBACxB,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,MAA0B;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAEzF,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,+CAA0B,CAAC,KAAK,EAAE;YACvE,EAAE,EAAE,MAAM,CAAC,MAAM;YACjB,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAA0B;QAChD,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAe,CAAC,MAA0B;QAC9C,mCAAmC;QACnC,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAE7E,qBAAqB;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,yDAA+B,CAAC,KAAK,EAAE;YAC5E,EAAE,EAAE,MAAM,CAAC,MAAM;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,MAA0B;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC;YACzD,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,MAA0B;QAC7C,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;;OAGG;IACK,kBAAkB;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,wBAAwB;QAClF,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB,CAAC,MAA0B;QACxD,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAEnC,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC;gBAC5C,MAAM;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ;aACT,CAAC,CAAC;YAEH,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO;YACL,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;CACF,CAAA;AA3KY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAGwB,gCAAc;QACR,6CAAoB;GAHlD,iBAAiB,CA2K7B"}

package/dist/foundations/two-factor/services/index.d.ts

@@ -0,0 +1,6 @@
+export { BackupCodeGenerationResult, BackupCodeService } from "./backup-code.service";
+export { PasskeyAuthenticationOptions, PasskeyInfo, PasskeyRegistrationOptions, PasskeyService, } from "./passkey.service";
+export { TotpEncryptionService } from "./totp-encryption.service";
+export { TotpAuthenticatorInfo, TotpService, TotpSetupResponse } from "./totp.service";
+export { PendingSession, TwoFactorMethod, TwoFactorService, TwoFactorStatus, VerificationResult, } from "./two-factor.service";
+//# sourceMappingURL=index.d.ts.map

package/dist/foundations/two-factor/services/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/foundations/two-factor/services/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EACL,4BAA4B,EAC5B,WAAW,EACX,0BAA0B,EAC1B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EACL,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,kBAAkB,GACnB,MAAM,sBAAsB,CAAC"}

package/dist/foundations/two-factor/services/index.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorService = exports.TotpService = exports.TotpEncryptionService = exports.PasskeyService = exports.BackupCodeService = void 0;
+var backup_code_service_1 = require("./backup-code.service");
+Object.defineProperty(exports, "BackupCodeService", { enumerable: true, get: function () { return backup_code_service_1.BackupCodeService; } });
+var passkey_service_1 = require("./passkey.service");
+Object.defineProperty(exports, "PasskeyService", { enumerable: true, get: function () { return passkey_service_1.PasskeyService; } });
+var totp_encryption_service_1 = require("./totp-encryption.service");
+Object.defineProperty(exports, "TotpEncryptionService", { enumerable: true, get: function () { return totp_encryption_service_1.TotpEncryptionService; } });
+var totp_service_1 = require("./totp.service");
+Object.defineProperty(exports, "TotpService", { enumerable: true, get: function () { return totp_service_1.TotpService; } });
+var two_factor_service_1 = require("./two-factor.service");
+Object.defineProperty(exports, "TwoFactorService", { enumerable: true, get: function () { return two_factor_service_1.TwoFactorService; } });
+//# sourceMappingURL=index.js.map

package/dist/foundations/two-factor/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/foundations/two-factor/services/index.ts"],"names":[],"mappings":";;;AAAA,6DAAsF;AAAjD,wHAAA,iBAAiB,OAAA;AACtD,qDAK2B;AADzB,iHAAA,cAAc,OAAA;AAEhB,qEAAkE;AAAzD,gIAAA,qBAAqB,OAAA;AAC9B,+CAAuF;AAAvD,2GAAA,WAAW,OAAA;AAC3C,2DAM8B;AAH5B,sHAAA,gBAAgB,OAAA"}

package/dist/foundations/two-factor/services/passkey.service.d.ts

@@ -0,0 +1,132 @@
+import { type AuthenticationResponseJSON, type PublicKeyCredentialCreationOptionsJSON, type PublicKeyCredentialRequestOptionsJSON, type RegistrationResponseJSON } from "@simplewebauthn/server";
+import { JsonApiService } from "../../../core/jsonapi/services/jsonapi.service";
+import { PasskeyRepository } from "../repositories/passkey.repository";
+import { PendingTwoFactorRepository } from "../repositories/pending-two-factor.repository";
+export interface PasskeyRegistrationOptions {
+    pendingId: string;
+    options: PublicKeyCredentialCreationOptionsJSON;
+}
+export interface PasskeyAuthenticationOptions {
+    pendingId: string;
+    options: PublicKeyCredentialRequestOptionsJSON;
+}
+export interface PasskeyInfo {
+    id: string;
+    name: string;
+    backedUp: boolean;
+    lastUsedAt?: Date;
+    createdAt: Date;
+}
+/**
+ * Passkey Service
+ *
+ * Manages WebAuthn passkey registration and authentication for two-factor authentication.
+ * Provides passkey enrollment, verification, and management capabilities.
+ */
+export declare class PasskeyService {
+    private readonly jsonApiService;
+    private readonly passkeyRepository;
+    private readonly pendingTwoFactorRepository;
+    private readonly challengeTtlSeconds;
+    constructor(jsonApiService: JsonApiService, passkeyRepository: PasskeyRepository, pendingTwoFactorRepository: PendingTwoFactorRepository);
+    /**
+     * Get WebAuthn Relying Party configuration from environment.
+     */
+    private getRpConfig;
+    /**
+     * Generate registration options for creating a new passkey.
+     *
+     * @param params.userId - The user's ID
+     * @param params.userName - The user's email or username
+     * @param params.userDisplayName - The user's display name
+     * @returns JSON:API response with registration options
+     */
+    generateRegistrationOptions(params: {
+        userId: string;
+        userName: string;
+        userDisplayName: string;
+    }): Promise<any>;
+    /**
+     * Verify a passkey registration response and create the passkey.
+     *
+     * @param params.pendingId - The pending challenge ID from generateRegistrationOptions
+     * @param params.name - A friendly name for this passkey
+     * @param params.response - The WebAuthn credential response from the client
+     * @returns JSON:API response with the created passkey
+     */
+    verifyRegistration(params: {
+        pendingId: string;
+        name: string;
+        response: RegistrationResponseJSON;
+    }): Promise<any>;
+    /**
+     * Generate authentication options for passkey sign-in.
+     *
+     * @param params.userId - The user's ID
+     * @returns JSON:API response with authentication options
+     */
+    generateAuthenticationOptions(params: {
+        userId: string;
+    }): Promise<any>;
+    /**
+     * Verify a passkey authentication response.
+     *
+     * @param params.pendingId - The pending challenge ID from generateAuthenticationOptions
+     * @param params.response - The WebAuthn assertion response from the client
+     * @returns The passkey ID if verification succeeds
+     */
+    verifyAuthentication(params: {
+        pendingId: string;
+        response: AuthenticationResponseJSON;
+    }): Promise<string>;
+    /**
+     * List all passkeys for a user.
+     *
+     * @param params.userId - The user's ID
+     * @returns JSON:API response with list of passkeys
+     */
+    listPasskeys(params: {
+        userId: string;
+    }): Promise<any>;
+    /**
+     * Remove a passkey.
+     *
+     * @param params.passkeyId - The passkey ID to remove
+     */
+    removePasskey(params: {
+        passkeyId: string;
+    }): Promise<void>;
+    /**
+     * Rename a passkey.
+     *
+     * @param params.passkeyId - The passkey ID to rename
+     * @param params.name - The new name for the passkey
+     */
+    renamePasskey(params: {
+        passkeyId: string;
+        name: string;
+    }): Promise<void>;
+    /**
+     * Check if a user has any registered passkeys.
+     *
+     * @param params.userId - The user's ID
+     * @returns true if the user has at least one passkey
+     */
+    hasPasskeys(params: {
+        userId: string;
+    }): Promise<boolean>;
+    /**
+     * Parse transports JSON string into array.
+     */
+    private parseTransports;
+    /**
+     * Convert Uint8Array to base64url string.
+     */
+    private uint8ArrayToBase64Url;
+    /**
+     * Convert base64url string to Uint8Array.
+     * The type assertion ensures compatibility with @simplewebauthn's expected types.
+     */
+    private base64UrlToUint8Array;
+}
+//# sourceMappingURL=passkey.service.d.ts.map

package/dist/foundations/two-factor/services/passkey.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/two-factor/services/passkey.service.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,0BAA0B,EAE/B,KAAK,sCAAsC,EAE3C,KAAK,qCAAqC,EAC1C,KAAK,wBAAwB,EAC9B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAIhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAE3F,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,sCAAsC,CAAC;CACjD;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qCAAqC,CAAC;CAChD;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;;;GAKG;AACH,qBACa,cAAc;IAIvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAL7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAO;gBAGxB,cAAc,EAAE,cAAc,EAC9B,iBAAiB,EAAE,iBAAiB,EACpC,0BAA0B,EAAE,0BAA0B;IAGzE;;OAEG;IACH,OAAO,CAAC,WAAW;IAQnB;;;;;;;OAOG;IACG,2BAA2B,CAAC,MAAM,EAAE;QACxC,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,GAAG,CAAC;IAmDhB;;;;;;;OAOG;IACG,kBAAkB,CAAC,MAAM,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,wBAAwB,CAAC;KACpC,GAAG,OAAO,CAAC,GAAG,CAAC;IAiEhB;;;;;OAKG;IACG,6BAA6B,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IA4C7E;;;;;;OAMG;IACG,oBAAoB,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,0BAA0B,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAyEhH;;;;;OAKG;IACG,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAQ5D;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjE;;;;;OAKG;IACG,aAAa,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB/E;;;;;OAKG;IACG,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAO/D;;OAEG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;;OAGG;IACH,OAAO,CAAC,qBAAqB;CAQ9B"}