@openora/core 0.4.1-canary.113 → 0.4.1-canary.115

package/dist/pam/identity/drizzle/migrations/meta/_journal.json

@@ -57,6 +57,20 @@
       "when": 1787339175084,
       "tag": "0007_fuzzy_barracuda",
       "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1787656339386,
+      "tag": "0008_pink_bucky",
+      "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "7",
+      "when": 1787830817681,
+      "tag": "0009_hard_sauron",
+      "breakpoints": true
     }
   ]
 }

package/dist/pam/identity/plugin.d.ts

@@ -6,6 +6,7 @@ declare const _default: {
         ADMIN_PERMISSION_RESOLVER: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPermissionResolver>;
         ADMIN_PLAYER_ACTIVITY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPlayerActivity>;
         ADMIN_ROLE_ASSIGNMENT_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminRoleAssignmentDirectory>;
+        ADMIN_SECURITY_POLICY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminSecurityPolicy>;
         ADMIN_USER_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminUserDirectory>;
         ADMIN_WALLET_REPORTING: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminWalletReporting>;
         AUDIT_WRITER: import("@openora/core/contracts").SealedToken<import("@openora/core/contracts").AuditWritePort>;
@@ -80,6 +81,16 @@ declare const _default: {
             chat: {
                 allowedAttachmentHosts: string[];
             };
+            adminSecurity: {
+                requireTwoFactor: boolean;
+                bindSessionToDevice: boolean;
+                trustedDeviceDays: number;
+                ipChangePolicy: "any" | "country" | "off";
+                twoFactorLockout: {
+                    maxAttempts: number;
+                    durationMs: number;
+                };
+            };
             activeBrand?: string | undefined;
             kyc?: {
                 gateWithdrawals: boolean;

package/dist/pam/identity/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/pam/identity/plugin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,wBA+E8C"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/pam/identity/plugin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiFA,wBAgG8C"}

package/dist/pam/identity/plugin.js

@@ -1,4 +1,4 @@
-import { ADMIN_USER_DIRECTORY, CACHE, IDENTITY_READER, KYC_ADAPTER, LOGIN_ENFORCEMENT, PLAY_ELIGIBILITY, NOTIFICATION_DELIVERY_ADAPTER, SEND_EMAIL, EMAIL_TEMPLATE_RENDERER, GEO_CHECK_COMMANDS, PLAYER_PROVISIONING, IDENTITY_OPTIONS, RATE_LIMITER, PLATFORM_CONFIG, SESSION_COMMANDS, USER_COMMANDS, SMS_ADAPTER, } from '@openora/core/contracts';
+import { ADMIN_SECURITY_POLICY, ADMIN_USER_DIRECTORY, CACHE, GEO_IP_ADAPTER, IDENTITY_READER, KYC_ADAPTER, LOGIN_ENFORCEMENT, PLAY_ELIGIBILITY, NOTIFICATION_DELIVERY_ADAPTER, SEND_EMAIL, EMAIL_TEMPLATE_RENDERER, GEO_CHECK_COMMANDS, PLAYER_PROVISIONING, IDENTITY_OPTIONS, RATE_LIMITER, PLATFORM_CONFIG, SESSION_COMMANDS, USER_COMMANDS, SMS_ADAPTER, AdminSecurityConfigSchema, } from '@openora/core/contracts';
 import { ADMIN_GUARD, EVENT_BUS, DRIZZLE, AUTH_SESSION } from '@openora/core/server';
 import { DrizzleUserCommands } from './service/user-commands.service.js';
 import { MockKycAdapter } from './adapters/mock/mock-kyc-adapter.js';
@@ -10,11 +10,56 @@ import { IdentityReaderService } from './adapters/identity-reader.service.js';
 import { createIdentityRouter } from './router/index.js';
 import { IdentityService } from './service/identity.service.js';
 import { SessionService } from './service/session.service.js';
+import { AdminSecurityService } from './service/admin-security.service.js';
+import { TrustedDeviceService } from './service/trusted-device.service.js';
+import { TwoFactorLockoutService } from './service/two-factor-lockout.service.js';
 import { LoginEnforcementService } from './service/login-enforcement.service.js';
 import { PlayEligibilityService } from './service/play-eligibility.service.js';
+function adminSecurityConfig(c) {
+    const platformConfig = c.has(PLATFORM_CONFIG) ? c.get(PLATFORM_CONFIG) : undefined;
+    return platformConfig?.adminSecurity ?? AdminSecurityConfigSchema.parse({});
+}
+function makeTrustedDevices(c) {
+    return new TrustedDeviceService({
+        drizzle: c.get(DRIZZLE),
+        events: c.get(EVENT_BUS),
+        trustedDeviceDays: adminSecurityConfig(c).trustedDeviceDays,
+    });
+}
+function makeTwoFactorLockout(c) {
+    return new TwoFactorLockoutService({
+        drizzle: c.get(DRIZZLE),
+        events: c.get(EVENT_BUS),
+        identityReader: c.get(IDENTITY_READER),
+        config: adminSecurityConfig(c).twoFactorLockout,
+    });
+}
+function makeAdminSecurity(c) {
+    const identityReader = c.get(IDENTITY_READER);
+    return new AdminSecurityService({
+        drizzle: c.get(DRIZZLE),
+        events: c.get(EVENT_BUS),
+        sessions: new SessionService({
+            drizzle: c.get(DRIZZLE),
+            events: c.get(EVENT_BUS),
+            identityReader,
+        }),
+        trustedDevices: makeTrustedDevices(c),
+        identityReader,
+        config: adminSecurityConfig(c),
+        geoIp: c.has(GEO_IP_ADAPTER) ? c.get(GEO_IP_ADAPTER) : undefined,
+    });
+}
 export default {
     id: 'identity',
     register(ctx) {
+        // Built once and shared by ADMIN_SECURITY_POLICY and the router below - two
+        // separate `makeAdminSecurity(c)` calls would construct two independent
+        // instances wrapping the same singletons, harmless today but silently
+        // stranding an overlay's ADMIN_SECURITY_POLICY rebind: the router would keep
+        // calling the original.
+        let adminSecurity;
+        const resolveAdminSecurity = (c) => (adminSecurity ??= makeAdminSecurity(c));
         ctx.provide(KYC_ADAPTER, () => new MockKycAdapter());
         // Platform default SMS transport: logs the OTP to stdout. A consumer overlay
         // rebinds SMS_ADAPTER to a real vendor (Twilio, AWS SNS) after this plugin.
@@ -35,6 +80,10 @@ export default {
             identityReader: c.get(IDENTITY_READER),
         })));
         ctx.provide(PLAY_ELIGIBILITY, (c) => new PlayEligibilityService(c.get(DRIZZLE)));
+        // Mandatory-2FA + session-fingerprint enforcement. AdminGuard resolves this on every
+        // admin request; leaving it unbound turns both checks off, which is why it is bound
+        // here rather than behind a feature flag.
+        ctx.provide(ADMIN_SECURITY_POLICY, (c) => resolveAdminSecurity(c));
         ctx.provide(USER_COMMANDS, (c) => new DrizzleUserCommands(c.get(DRIZZLE)));
         ctx.provide(SESSION_COMMANDS, (c) => {
             const sessionSvc = new SessionService({
@@ -46,31 +95,37 @@ export default {
                 revokeAll: (userId, actorId) => sessionSvc.revokeAllSessions(userId, actorId),
             };
         });
-        ctx.routers.add('identity', (c) => createIdentityRouter(new IdentityService({
-            drizzle: c.get(DRIZZLE),
-            events: c.get(EVENT_BUS),
-            identityReader: c.get(IDENTITY_READER),
-            email: c.get(SEND_EMAIL),
-            templateRenderer: c.get(EMAIL_TEMPLATE_RENDERER),
-            options: c.has(IDENTITY_OPTIONS) ? c.get(IDENTITY_OPTIONS) : undefined,
-            limiter: c.get(RATE_LIMITER),
-            platformConfig: c.has(PLATFORM_CONFIG) ? c.get(PLATFORM_CONFIG) : undefined,
-            geoCheck: c.has(GEO_CHECK_COMMANDS) ? c.get(GEO_CHECK_COMMANDS) : undefined,
-            playerProvisioning: c.has(PLAYER_PROVISIONING) ? c.get(PLAYER_PROVISIONING) : undefined,
-            cache: c.get(CACHE),
-        }), new SessionService({
-            drizzle: c.get(DRIZZLE),
-            events: c.get(EVENT_BUS),
-            identityReader: c.get(IDENTITY_READER),
-        }), new PhoneLoginService({
-            drizzle: c.get(DRIZZLE),
-            events: c.get(EVENT_BUS),
-            sms: c.get(SMS_ADAPTER),
-            limiter: c.get(RATE_LIMITER),
-            auth: c.get(AUTH_SESSION).auth,
-            cache: c.get(CACHE),
-            options: c.has(IDENTITY_OPTIONS) ? c.get(IDENTITY_OPTIONS) : undefined,
-        }), c.get(ADMIN_GUARD), c.get(EVENT_BUS)));
+        ctx.routers.add('identity', (c) => {
+            const sessions = new SessionService({
+                drizzle: c.get(DRIZZLE),
+                events: c.get(EVENT_BUS),
+                identityReader: c.get(IDENTITY_READER),
+            });
+            return createIdentityRouter(new IdentityService({
+                drizzle: c.get(DRIZZLE),
+                events: c.get(EVENT_BUS),
+                identityReader: c.get(IDENTITY_READER),
+                email: c.get(SEND_EMAIL),
+                templateRenderer: c.get(EMAIL_TEMPLATE_RENDERER),
+                options: c.has(IDENTITY_OPTIONS) ? c.get(IDENTITY_OPTIONS) : undefined,
+                limiter: c.get(RATE_LIMITER),
+                platformConfig: c.has(PLATFORM_CONFIG) ? c.get(PLATFORM_CONFIG) : undefined,
+                geoCheck: c.has(GEO_CHECK_COMMANDS) ? c.get(GEO_CHECK_COMMANDS) : undefined,
+                playerProvisioning: c.has(PLAYER_PROVISIONING) ? c.get(PLAYER_PROVISIONING) : undefined,
+                cache: c.get(CACHE),
+                trustedDevices: makeTrustedDevices(c),
+                twoFactorLockout: makeTwoFactorLockout(c),
+                sessions,
+            }), sessions, new PhoneLoginService({
+                drizzle: c.get(DRIZZLE),
+                events: c.get(EVENT_BUS),
+                sms: c.get(SMS_ADAPTER),
+                limiter: c.get(RATE_LIMITER),
+                auth: c.get(AUTH_SESSION).auth,
+                cache: c.get(CACHE),
+                options: c.has(IDENTITY_OPTIONS) ? c.get(IDENTITY_OPTIONS) : undefined,
+            }), c.get(ADMIN_GUARD), c.get(EVENT_BUS), resolveAdminSecurity(c));
+        });
     },
 };
 //# sourceMappingURL=plugin.js.map

package/dist/pam/identity/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/pam/identity/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,KAAK,EACL,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,6BAA6B,EAC7B,UAAU,EACV,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,eAAe;IACb,EAAE,EAAE,UAAU;IACd,QAAQ,CAAC,GAAG;QACV,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;QACrD,6EAA6E;QAC7E,4EAA4E;QAC5E,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;QACrD,6EAA6E;QAC7E,GAAG,CAAC,OAAO,CACT,oBAAoB,EACpB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CACvE,CAAC;QACF,qFAAqF;QACrF,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/E,wFAAwF;QACxF,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9B,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC;SACpE,CAAC,CAAC,CAAC;QACJ,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAI,4BAA4B,EAAE,CAAC,CAAC;QAC/E,kFAAkF;QAClF,GAAG,CAAC,OAAO,CACT,iBAAiB,EACjB,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,uBAAuB,CACzB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EACd,IAAI,cAAc,CAAC;YACjB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;SACvC,CAAC,CACH,CACJ,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjF,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3E,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;YAClC,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC;gBACpC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;gBACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;gBACxB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC;aAC9E,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAChC,oBAAoB,CAClB,IAAI,eAAe,CAAC;YAClB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;YACtC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;YACxB,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;YAChD,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;YACtE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;YAC5B,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3E,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3E,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS;YACvF,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;SACpB,CAAC,EACF,IAAI,cAAc,CAAC;YACjB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;SACvC,CAAC,EACF,IAAI,iBAAiB,CAAC;YACpB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;YACvB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;YAC5B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI;YAC9B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;YACnB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;SACvE,CAAC,EACF,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAClB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CACjB,CACF,CAAC;IACJ,CAAC;CAC0C,CAAC"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/pam/identity/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,EACL,cAAc,EACd,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,6BAA6B,EAC7B,UAAU,EACV,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAI/E,SAAS,mBAAmB,CAAC,CAAoB;IAC/C,MAAM,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,OAAO,cAAc,EAAE,aAAa,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAoB;IAC9C,OAAO,IAAI,oBAAoB,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QACxB,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,iBAAiB;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAoB;IAChD,OAAO,IAAI,uBAAuB,CAAC;QACjC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QACxB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;QACtC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,gBAAgB;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAoB;IAC7C,MAAM,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC9C,OAAO,IAAI,oBAAoB,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QACxB,QAAQ,EAAE,IAAI,cAAc,CAAC;YAC3B,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,cAAc;SACf,CAAC;QACF,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACrC,cAAc;QACd,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC9B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;KACjE,CAAC,CAAC;AACL,CAAC;AAED,eAAe;IACb,EAAE,EAAE,UAAU;IACd,QAAQ,CAAC,GAAG;QACV,4EAA4E;QAC5E,wEAAwE;QACxE,sEAAsE;QACtE,6EAA6E;QAC7E,wBAAwB;QACxB,IAAI,aAA+C,CAAC;QACpD,MAAM,oBAAoB,GAAG,CAAC,CAAoB,EAAE,EAAE,CAAC,CAAC,aAAa,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;QAEhG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;QACrD,6EAA6E;QAC7E,4EAA4E;QAC5E,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;QACrD,6EAA6E;QAC7E,GAAG,CAAC,OAAO,CACT,oBAAoB,EACpB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CACvE,CAAC;QACF,qFAAqF;QACrF,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/E,wFAAwF;QACxF,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9B,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC;SACpE,CAAC,CAAC,CAAC;QACJ,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAI,4BAA4B,EAAE,CAAC,CAAC;QAC/E,kFAAkF;QAClF,GAAG,CAAC,OAAO,CACT,iBAAiB,EACjB,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,uBAAuB,CACzB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EACd,IAAI,cAAc,CAAC;YACjB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;SACvC,CAAC,CACH,CACJ,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjF,qFAAqF;QACrF,oFAAoF;QACpF,0CAA0C;QAC1C,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3E,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;YAClC,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC;gBACpC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;gBACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;gBACxB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC;aAC9E,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;YAChC,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC;gBAClC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;gBACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;gBACxB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;aACvC,CAAC,CAAC;YACH,OAAO,oBAAoB,CACzB,IAAI,eAAe,CAAC;gBAClB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;gBACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;gBACxB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;gBACtC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;gBACxB,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;gBAChD,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;gBACtE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;gBAC5B,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC3E,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC3E,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvF,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;gBACnB,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBACrC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC,CAAC;gBACzC,QAAQ;aACT,CAAC,EACF,QAAQ,EACR,IAAI,iBAAiB,CAAC;gBACpB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;gBACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;gBACxB,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;gBACvB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;gBAC5B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI;gBAC9B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;gBACnB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;aACvE,CAAC,EACF,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAClB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAChB,oBAAoB,CAAC,CAAC,CAAC,CACxB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CAC0C,CAAC"}

package/dist/pam/identity/react/account.d.ts

@@ -17,11 +17,14 @@ export declare function useVerify2fa(): UseMutationResult<{
     success: true;
 }, Error, {
     code: string;
+    method?: "totp" | "backup_code" | undefined;
+    trustDevice?: boolean | undefined;
 }, unknown>;
 export declare function useDisable2fa(): UseMutationResult<{
     success: true;
 }, Error, {
     password: string;
+    code: string;
 }, unknown>;
 export declare function useVerifyEmail(): UseMutationResult<{
     user?: {
@@ -32,6 +35,7 @@ export declare function useVerifyEmail(): UseMutationResult<{
         emailVerified: boolean;
         theme: "light" | "dark" | "system";
         language: string;
+        twoFactorEnabled: boolean;
         createdAt: string;
         updatedAt: string;
         image?: string | null | undefined;
@@ -56,6 +60,7 @@ export declare function useUpdateProfile(): UseMutationResult<{
         emailVerified: boolean;
         theme: "light" | "dark" | "system";
         language: string;
+        twoFactorEnabled: boolean;
         createdAt: string;
         updatedAt: string;
         image?: string | null | undefined;

package/dist/pam/identity/react/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/react/account.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAE1E,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;AAChF,MAAM,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,eAAe,EAAE,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjG,YAAY,EAAE,eAAe,EAAE,CAAC;AAOhC,wBAAgB,YAAY;;;;;YAO3B;AAED,wBAAgB,YAAY;;;;YAO3B;AAED,wBAAgB,aAAa;;;;YAO5B;AAED,wBAAgB,cAAc;;;;;;;;;;;;;;;;;;;;;;;YAO7B;AAED,wBAAgB,gBAAgB;;;;;;;;;;;;;;;;;;;;YAO/B;AAED,wBAAgB,iBAAiB;;;;;YAOhC;AAED,wBAAgB,wBAAwB;;;;YAKvC;AAED,wBAAgB,aAAa,IAAI,mBAAmB,CAGnD;AAED,wBAAgB,kBAAkB,IAAI,wBAAwB,CAO7D"}
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/react/account.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAE1E,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;AAChF,MAAM,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,eAAe,EAAE,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjG,YAAY,EAAE,eAAe,EAAE,CAAC;AAOhC,wBAAgB,YAAY;;;;;YAO3B;AAED,wBAAgB,YAAY;;;;;;YAO3B;AAED,wBAAgB,aAAa;;;;;YAO5B;AAED,wBAAgB,cAAc;;;;;;;;;;;;;;;;;;;;;;;;YAO7B;AAED,wBAAgB,gBAAgB;;;;;;;;;;;;;;;;;;;;;YAO/B;AAED,wBAAgB,iBAAiB;;;;;YAOhC;AAED,wBAAgB,wBAAwB;;;;YAKvC;AAED,wBAAgB,aAAa,IAAI,mBAAmB,CAGnD;AAED,wBAAgB,kBAAkB,IAAI,wBAAwB,CAO7D"}

package/dist/pam/identity/react/auth.d.ts

@@ -6,6 +6,7 @@ export declare function useCurrentUser(): import("@tanstack/react-query").UseQue
     emailVerified: boolean;
     theme: "light" | "dark" | "system";
     language: string;
+    twoFactorEnabled: boolean;
     createdAt: string;
     updatedAt: string;
     image?: string | null | undefined;
@@ -21,6 +22,7 @@ export declare function useLogin(): import("@tanstack/react-query").UseMutationR
         emailVerified: boolean;
         theme: "light" | "dark" | "system";
         language: string;
+        twoFactorEnabled: boolean;
         createdAt: string;
         updatedAt: string;
         image?: string | null | undefined;

package/dist/pam/identity/react/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/react/auth.ts"],"names":[],"mappings":"AAMA,wBAAgB,cAAc;;;;;;;;;;;;;kBAG7B;AAED,wBAAgB,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAOvB;AAED,wBAAgB,SAAS;;4BAOxB;AAED,wBAAgB,WAAW;;;;;;;;YAO1B;AAED,wBAAgB,uBAAuB;;;;YAKtC;AAED,wBAAgB,gBAAgB;;;;;;;YAK/B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/react/auth.ts"],"names":[],"mappings":"AAMA,wBAAgB,cAAc;;;;;;;;;;;;;;kBAG7B;AAED,wBAAgB,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAOvB;AAED,wBAAgB,SAAS;;4BAOxB;AAED,wBAAgB,WAAW;;;;;;;;YAO1B;AAED,wBAAgB,uBAAuB;;;;YAKtC;AAED,wBAAgB,gBAAgB;;;;;;;YAK/B"}

package/dist/pam/identity/router/index.d.ts

@@ -2,7 +2,8 @@ import { type OssContext, AdminGuard, type EventBus } from '@openora/core/server
 import { PhoneLoginService } from '../service/phone-login.service.js';
 import { IdentityService } from '../service/identity.service.js';
 import { SessionService } from '../service/session.service.js';
-export declare function createIdentityRouter(identity: IdentityService, sessionSvc: SessionService, phoneLogin: PhoneLoginService, adminGuard: AdminGuard, eventBus: EventBus): {
+import { type AdminSecurityService } from '../service/admin-security.service.js';
+export declare function createIdentityRouter(identity: IdentityService, sessionSvc: SessionService, phoneLogin: PhoneLoginService, adminGuard: AdminGuard, eventBus: EventBus, adminSecurity: AdminSecurityService): {
     register: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
         email: import("zod").ZodEmail;
         password: import("zod").ZodString;
@@ -37,6 +38,7 @@ export declare function createIdentityRouter(identity: IdentityService, sessionS
             language: import("zod").ZodString;
             phoneNumber: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
             phoneVerified: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            twoFactorEnabled: import("zod").ZodBoolean;
             createdAt: import("zod").ZodISODateTime;
             updatedAt: import("zod").ZodISODateTime;
         }, import("zod/v4/core").$strip>>;
@@ -76,6 +78,7 @@ export declare function createIdentityRouter(identity: IdentityService, sessionS
             language: import("zod").ZodString;
             phoneNumber: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
             phoneVerified: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            twoFactorEnabled: import("zod").ZodBoolean;
             createdAt: import("zod").ZodISODateTime;
             updatedAt: import("zod").ZodISODateTime;
         }, import("zod/v4/core").$strip>;
@@ -106,6 +109,7 @@ export declare function createIdentityRouter(identity: IdentityService, sessionS
         language: import("zod").ZodString;
         phoneNumber: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
         phoneVerified: import("zod").ZodOptional<import("zod").ZodBoolean>;
+        twoFactorEnabled: import("zod").ZodBoolean;
         createdAt: import("zod").ZodISODateTime;
         updatedAt: import("zod").ZodISODateTime;
     }, import("zod/v4/core").$strip>>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
@@ -126,14 +130,26 @@ export declare function createIdentityRouter(identity: IdentityService, sessionS
     }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
     verify2fa: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
         code: import("zod").ZodString;
+        method: import("zod").ZodDefault<import("zod").ZodEnum<{
+            totp: "totp";
+            backup_code: "backup_code";
+        }>>;
+        trustDevice: import("zod").ZodDefault<import("zod").ZodBoolean>;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
         success: import("zod").ZodLiteral<true>;
     }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
     disable2fa: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
         password: import("zod").ZodString;
+        code: import("zod").ZodString;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
         success: import("zod").ZodLiteral<true>;
     }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    regenerateBackupCodes: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        password: import("zod").ZodString;
+        code: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        backupCodes: import("zod").ZodArray<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
     requestPasswordReset: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
         email: import("zod").ZodEmail;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
@@ -183,6 +199,7 @@ export declare function createIdentityRouter(identity: IdentityService, sessionS
             language: import("zod").ZodString;
             phoneNumber: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
             phoneVerified: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            twoFactorEnabled: import("zod").ZodBoolean;
             createdAt: import("zod").ZodISODateTime;
             updatedAt: import("zod").ZodISODateTime;
         }, import("zod/v4/core").$strip>>;
@@ -222,6 +239,7 @@ export declare function createIdentityRouter(identity: IdentityService, sessionS
             language: import("zod").ZodString;
             phoneNumber: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
             phoneVerified: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            twoFactorEnabled: import("zod").ZodBoolean;
             createdAt: import("zod").ZodISODateTime;
             updatedAt: import("zod").ZodISODateTime;
         }, import("zod/v4/core").$strip>;
@@ -256,8 +274,12 @@ export declare function createIdentityRouter(identity: IdentityService, sessionS
                 expiresAt: import("zod").ZodISODateTime;
                 createdAt: import("zod").ZodISODateTime;
                 updatedAt: import("zod").ZodISODateTime;
+                lastSeenAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
                 ipAddress: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
                 userAgent: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+                deviceLabel: import("zod").ZodString;
+                browser: import("zod").ZodNullable<import("zod").ZodString>;
+                os: import("zod").ZodNullable<import("zod").ZodString>;
                 current: import("zod").ZodBoolean;
             }, import("zod/v4/core").$strip>>;
             total: import("zod").ZodNumber;
@@ -293,8 +315,12 @@ export declare function createIdentityRouter(identity: IdentityService, sessionS
                 expiresAt: import("zod").ZodISODateTime;
                 createdAt: import("zod").ZodISODateTime;
                 updatedAt: import("zod").ZodISODateTime;
+                lastSeenAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
                 ipAddress: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
                 userAgent: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+                deviceLabel: import("zod").ZodString;
+                browser: import("zod").ZodNullable<import("zod").ZodString>;
+                os: import("zod").ZodNullable<import("zod").ZodString>;
                 current: import("zod").ZodBoolean;
             }, import("zod/v4/core").$strip>>;
             total: import("zod").ZodNumber;
@@ -306,6 +332,84 @@ export declare function createIdentityRouter(identity: IdentityService, sessionS
         }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
             success: import("zod").ZodLiteral<true>;
         }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        listAll: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+            page: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+            limit: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+            role: import("zod").ZodOptional<import("zod").ZodString>;
+            query: import("zod").ZodOptional<import("zod").ZodString>;
+            sortBy: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+                createdAt: "createdAt";
+                updatedAt: "updatedAt";
+                expiresAt: "expiresAt";
+            }>>>;
+            sortOrder: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+                asc: "asc";
+                desc: "desc";
+            }>>>;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            items: import("zod").ZodArray<import("zod").ZodObject<{
+                id: import("zod").ZodUUID;
+                expiresAt: import("zod").ZodISODateTime;
+                createdAt: import("zod").ZodISODateTime;
+                updatedAt: import("zod").ZodISODateTime;
+                lastSeenAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
+                ipAddress: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+                userAgent: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+                deviceLabel: import("zod").ZodString;
+                browser: import("zod").ZodNullable<import("zod").ZodString>;
+                os: import("zod").ZodNullable<import("zod").ZodString>;
+                current: import("zod").ZodBoolean;
+                userId: import("zod").ZodUUID;
+                email: import("zod").ZodEmail;
+                role: import("zod").ZodString;
+            }, import("zod/v4/core").$strip>>;
+            total: import("zod").ZodNumber;
+            page: import("zod").ZodNumber;
+            limit: import("zod").ZodNumber;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    };
+    adminSecurity: {
+        status: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("@orpc/server").Schema<unknown, unknown>, import("zod").ZodObject<{
+            twoFactorEnabled: import("zod").ZodBoolean;
+            backupCodesRemaining: import("zod").ZodNullable<import("zod").ZodNumber>;
+            enrollmentRequired: import("zod").ZodBoolean;
+            trustedDeviceDays: import("zod").ZodNumber;
+            trustedDeviceUntil: import("zod").ZodNullable<import("zod").ZodISODateTime>;
+            lockedUntil: import("zod").ZodNullable<import("zod").ZodISODateTime>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        trustedDevices: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("@orpc/server").Schema<unknown, unknown>, import("zod").ZodArray<import("zod").ZodObject<{
+            id: import("zod").ZodUUID;
+            label: import("zod").ZodString;
+            browser: import("zod").ZodNullable<import("zod").ZodString>;
+            os: import("zod").ZodNullable<import("zod").ZodString>;
+            ipAddress: import("zod").ZodNullable<import("zod").ZodString>;
+            lastUsedAt: import("zod").ZodISODateTime;
+            expiresAt: import("zod").ZodISODateTime;
+            isCurrent: import("zod").ZodBoolean;
+        }, import("zod/v4/core").$strip>>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        trustCurrentDevice: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+            code: import("zod").ZodString;
+            password: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            success: import("zod").ZodLiteral<true>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        revokeTrustedDevice: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+            id: import("zod").ZodUUID;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            success: import("zod").ZodLiteral<true>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        resetUserTwoFactor: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+            userId: import("zod").ZodUUID;
+            reason: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            success: import("zod").ZodLiteral<true>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        revokeUserTrustedDevice: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+            userId: import("zod").ZodUUID;
+            id: import("zod").ZodUUID;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            success: import("zod").ZodLiteral<true>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
     };
 };
 //# sourceMappingURL=index.d.ts.map

package/dist/pam/identity/router/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/router/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,UAAU,EACf,UAAU,EAKV,KAAK,QAAQ,EACd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,eAAe,EAGhB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,cAAc,EAAwB,MAAM,+BAA+B,CAAC;AAGrF,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,eAAe,EACzB,UAAU,EAAE,cAAc,EAC1B,UAAU,EAAE,iBAAiB,EAC7B,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4LnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/router/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,UAAU,EACf,UAAU,EAKV,KAAK,QAAQ,EACd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,eAAe,EAGhB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,cAAc,EAGf,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,sCAAsC,CAAC;AAG9C,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,eAAe,EACzB,UAAU,EAAE,cAAc,EAC1B,UAAU,EAAE,iBAAiB,EAC7B,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,QAAQ,EAClB,aAAa,EAAE,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoRpC"}

package/dist/pam/identity/router/index.js

@@ -2,9 +2,11 @@ import { implement } from '@orpc/server';
 import { mapErrors, getUserId, getSessionId, createEventStreamGenerator, } from '@openora/core/server';
 import { identityContract } from '../contract/index.js';
 import { UsernameConflictError, UserNotFoundError, } from '../service/identity.service.js';
-import { SessionNotFoundError } from '../service/session.service.js';
+import { SessionNotFoundError, CurrentSessionRevokeError, } from '../service/session.service.js';
+import { TrustedDeviceNotFoundError } from '../service/trusted-device.service.js';
+import { SelfTwoFactorResetError, } from '../service/admin-security.service.js';
 import { UnsupportedLanguageError } from '../../shared/language.js';
-export function createIdentityRouter(identity, sessionSvc, phoneLogin, adminGuard, eventBus) {
+export function createIdentityRouter(identity, sessionSvc, phoneLogin, adminGuard, eventBus, adminSecurity) {
     const os = implement(identityContract).$context();
     return os.router({
         register: os.register.handler(({ input, context }) => mapErrors({ CONFLICT: UsernameConflictError }, () => identity.register(input, context.request.headers))),
@@ -50,6 +52,7 @@ export function createIdentityRouter(identity, sessionSvc, phoneLogin, adminGuar
         enable2fa: os.enable2fa.handler(({ input, context }) => identity.enableTwoFactor(input, context.request.headers, context.resHeaders ?? new Headers())),
         verify2fa: os.verify2fa.handler(({ input, context }) => identity.verifyTwoFactor(input, context.request.headers, context.resHeaders ?? new Headers())),
         disable2fa: os.disable2fa.handler(({ input, context }) => identity.disableTwoFactor(input, context.request.headers, context.resHeaders ?? new Headers())),
+        regenerateBackupCodes: os.regenerateBackupCodes.handler(({ input, context }) => identity.regenerateBackupCodes(input, context.request.headers, context.resHeaders ?? new Headers())),
         requestPasswordReset: os.requestPasswordReset.handler(({ input }) => identity.requestPasswordReset(input)),
         verifyPasswordResetOtp: os.verifyPasswordResetOtp.handler(({ input }) => identity.verifyPasswordResetOtp(input)),
         resetPassword: os.resetPassword.handler(({ input }) => identity.resetPassword(input)),
@@ -111,7 +114,45 @@ export function createIdentityRouter(identity, sessionSvc, phoneLogin, adminGuar
             // else's device - a miss is a 404, not a cross-user revoke.
             revokeMine: os.sessions.revokeMine.handler(({ input, context }) => {
                 const userId = getUserId(context);
-                return mapErrors({ NOT_FOUND: SessionNotFoundError }, () => sessionSvc.revokeSession(userId, input.id, userId, context.clientMeta));
+                return mapErrors({ NOT_FOUND: SessionNotFoundError, CONFLICT: CurrentSessionRevokeError }, () => sessionSvc.revokeOwnSession(userId, input.id, getSessionId(context), context.clientMeta));
+            }),
+            listAll: os.sessions.listAll.handler(async ({ input, context }) => {
+                await adminGuard.assert(context, 'sessions', 'view');
+                // The cross-user list returns player email/role/IP with free-text email
+                // search, so it needs the player-data permission on top of session hygiene.
+                await adminGuard.assert(context, 'player', 'view');
+                return sessionSvc.listAllActiveSessions({
+                    role: input.role,
+                    query: input.query,
+                    currentSessionId: getSessionId(context),
+                    page: input.page,
+                    limit: input.limit,
+                    sortBy: input.sortBy,
+                    sortOrder: input.sortOrder,
+                });
+            }),
+        },
+        adminSecurity: {
+            status: os.adminSecurity.status.handler(({ context }) => adminSecurity.status(getUserId(context), context.clientMeta.userAgent)),
+            trustedDevices: os.adminSecurity.trustedDevices.handler(({ context }) => adminSecurity.listTrustedDevices(getUserId(context), context.clientMeta.userAgent)),
+            trustCurrentDevice: os.adminSecurity.trustCurrentDevice.handler(({ input, context }) => identity.trustCurrentDevice(input, context.request.headers, context.resHeaders ?? new Headers())),
+            revokeTrustedDevice: os.adminSecurity.revokeTrustedDevice.handler(({ input, context }) => {
+                const userId = getUserId(context);
+                return mapErrors({ NOT_FOUND: TrustedDeviceNotFoundError }, () => adminSecurity.revokeTrustedDevice(userId, input.id, userId, context.clientMeta, getSessionId(context)));
+            }),
+            resetUserTwoFactor: os.adminSecurity.resetUserTwoFactor.handler(async ({ input, context }) => {
+                const caller = await adminGuard.assertSuperAdmin(context);
+                return mapErrors({ NOT_FOUND: UserNotFoundError, CONFLICT: SelfTwoFactorResetError }, () => adminSecurity.resetTwoFactor(input.userId, caller.userId, input.reason, {
+                    ip: caller.ip,
+                    userAgent: caller.userAgent,
+                }));
+            }),
+            revokeUserTrustedDevice: os.adminSecurity.revokeUserTrustedDevice.handler(async ({ input, context }) => {
+                const caller = await adminGuard.assertSuperAdmin(context);
+                return mapErrors({ NOT_FOUND: TrustedDeviceNotFoundError }, () => adminSecurity.revokeTrustedDevice(input.userId, input.id, caller.userId, {
+                    ip: caller.ip,
+                    userAgent: caller.userAgent,
+                }));
             }),
         },
     });

package/dist/pam/identity/router/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/router/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAGL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,0BAA0B,GAE3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAEL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAkB,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,MAAM,UAAU,oBAAoB,CAClC,QAAyB,EACzB,UAA0B,EAC1B,UAA6B,EAC7B,UAAsB,EACtB,QAAkB;IAElB,MAAM,EAAE,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAc,CAAC;IAE9D,OAAO,EAAE,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACnD,SAAS,CAAC,EAAE,QAAQ,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAClD,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAClD,CACF;QAED,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrE,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACpE;QAED,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7C,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CACpF;QAED,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACrE,OAAO,UAAU,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC;QAEF,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACnE,OAAO,UAAU,CAAC,SAAS,CACzB,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,EACnC,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACxC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9E;QAED,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YAChC,gFAAgF;YAChF,mFAAmF;YACnF,oDAAoD;YACpD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;gBAC/E,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC7C,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;YAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,0BAA0B,CAC/B,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,kBAAkB,GAAG,QAAQ,CAAC,EAAE,CAAC,+BAA+B,EAAE,CAAC,KAAK,EAAE,EAAE;oBAChF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,MAAM,mBAAmB,GAAG,QAAQ,CAAC,EAAE,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO,GAAG,EAAE;oBACV,kBAAkB,EAAE,CAAC;oBACrB,mBAAmB,EAAE,CAAC;gBACxB,CAAC,CAAC;YACJ,CAAC,EACD,EAAE,MAAM,EAAE,CACX,CAAC;QACJ,CAAC,CAAC;QAEF,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrD,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9F;QAED,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrD,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9F;QAED,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACvD,QAAQ,CAAC,gBAAgB,CACvB,KAAK,EACL,OAAO,CAAC,OAAO,CAAC,OAAO,EACvB,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CACF;QAED,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,CACrC;QAED,sBAAsB,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACtE,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,CACvC;QAED,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAErF,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC/D,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC7F;QAED,qBAAqB,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7E,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAC/D;QAED,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC1F;QAED,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC1F;QAED,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7D,SAAS,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,GAAG,EAAE,CACxD,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC5F,CACF;QAED,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CACtD,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC/C,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QAEF,yBAAyB,EAAE,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC3F,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CACtD,QAAQ,CAAC,yBAAyB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC9D,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QAEF,QAAQ,EAAE;YACR,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC1D,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACrD,OAAO,UAAU,CAAC,YAAY,CAAC;oBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,gBAAgB,EAAE,YAAY,CAAC,OAAO,CAAC;oBACvC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;YACL,CAAC,CAAC;YACF,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,CACzD,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;oBAC9D,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CACH,CAAC;YACJ,CAAC,CAAC;YACF,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;oBAC/D,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC5D,UAAU,CAAC,YAAY,CAAC;gBACtB,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;gBAC1B,gBAAgB,EAAE,YAAY,CAAC,OAAO,CAAC;gBACvC,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CACH;YAED,wEAAwE;YACxE,4DAA4D;YAC5D,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAChE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;gBAClC,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,CACzD,UAAU,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CACvE,CAAC;YACJ,CAAC,CAAC;SACH;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/router/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAGL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,0BAA0B,GAE3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAEL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAEL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAEL,uBAAuB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,MAAM,UAAU,oBAAoB,CAClC,QAAyB,EACzB,UAA0B,EAC1B,UAA6B,EAC7B,UAAsB,EACtB,QAAkB,EAClB,aAAmC;IAEnC,MAAM,EAAE,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAc,CAAC;IAE9D,OAAO,EAAE,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACnD,SAAS,CAAC,EAAE,QAAQ,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAClD,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAClD,CACF;QAED,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrE,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACpE;QAED,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7C,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CACpF;QAED,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACrE,OAAO,UAAU,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC;QAEF,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACnE,OAAO,UAAU,CAAC,SAAS,CACzB,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,EACnC,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACxC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9E;QAED,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YAChC,gFAAgF;YAChF,mFAAmF;YACnF,oDAAoD;YACpD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;gBAC/E,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC7C,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;YAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,0BAA0B,CAC/B,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,kBAAkB,GAAG,QAAQ,CAAC,EAAE,CAAC,+BAA+B,EAAE,CAAC,KAAK,EAAE,EAAE;oBAChF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,MAAM,mBAAmB,GAAG,QAAQ,CAAC,EAAE,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO,GAAG,EAAE;oBACV,kBAAkB,EAAE,CAAC;oBACrB,mBAAmB,EAAE,CAAC;gBACxB,CAAC,CAAC;YACJ,CAAC,EACD,EAAE,MAAM,EAAE,CACX,CAAC;QACJ,CAAC,CAAC;QAEF,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrD,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9F;QAED,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrD,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9F;QAED,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACvD,QAAQ,CAAC,gBAAgB,CACvB,KAAK,EACL,OAAO,CAAC,OAAO,CAAC,OAAO,EACvB,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CACF;QAED,qBAAqB,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7E,QAAQ,CAAC,qBAAqB,CAC5B,KAAK,EACL,OAAO,CAAC,OAAO,CAAC,OAAO,EACvB,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CACF;QAED,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,CACrC;QAED,sBAAsB,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CACtE,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,CACvC;QAED,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAErF,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC/D,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC7F;QAED,qBAAqB,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7E,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAC/D;QAED,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC1F;QAED,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC1F;QAED,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7D,SAAS,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,GAAG,EAAE,CACxD,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC5F,CACF;QAED,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CACtD,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC/C,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QAEF,yBAAyB,EAAE,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC3F,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CACtD,QAAQ,CAAC,yBAAyB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC9D,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC,CAAC;QAEF,QAAQ,EAAE;YACR,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC1D,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACrD,OAAO,UAAU,CAAC,YAAY,CAAC;oBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,gBAAgB,EAAE,YAAY,CAAC,OAAO,CAAC;oBACvC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;YACL,CAAC,CAAC;YACF,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,CACzD,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;oBAC9D,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CACH,CAAC;YACJ,CAAC,CAAC;YACF,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;oBAC/D,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC5D,UAAU,CAAC,YAAY,CAAC;gBACtB,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;gBAC1B,gBAAgB,EAAE,YAAY,CAAC,OAAO,CAAC;gBACvC,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CACH;YAED,wEAAwE;YACxE,4DAA4D;YAC5D,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAChE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;gBAClC,OAAO,SAAS,CACd,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,yBAAyB,EAAE,EACxE,GAAG,EAAE,CACH,UAAU,CAAC,gBAAgB,CACzB,MAAM,EACN,KAAK,CAAC,EAAE,EACR,YAAY,CAAC,OAAO,CAAC,EACrB,OAAO,CAAC,UAAU,CACnB,CACJ,CAAC;YACJ,CAAC,CAAC;YAEF,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAChE,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACrD,wEAAwE;gBACxE,4EAA4E;gBAC5E,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACnD,OAAO,UAAU,CAAC,qBAAqB,CAAC;oBACtC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,gBAAgB,EAAE,YAAY,CAAC,OAAO,CAAC;oBACvC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;YACL,CAAC,CAAC;SACH;QAED,aAAa,EAAE;YACb,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACtD,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CACvE;YAED,cAAc,EAAE,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACtE,aAAa,CAAC,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CACnF;YAED,kBAAkB,EAAE,EAAE,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrF,QAAQ,CAAC,kBAAkB,CACzB,KAAK,EACL,OAAO,CAAC,OAAO,CAAC,OAAO,EACvB,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CACF;YAED,mBAAmB,EAAE,EAAE,CAAC,aAAa,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBACvF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;gBAClC,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAC/D,aAAa,CAAC,mBAAmB,CAC/B,MAAM,EACN,KAAK,CAAC,EAAE,EACR,MAAM,EACN,OAAO,CAAC,UAAU,EAClB,YAAY,CAAC,OAAO,CAAC,CACtB,CACF,CAAC;YACJ,CAAC,CAAC;YAEF,kBAAkB,EAAE,EAAE,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAC7D,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC1D,OAAO,SAAS,CACd,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,EACnE,GAAG,EAAE,CACH,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;oBACtE,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CACL,CAAC;YACJ,CAAC,CACF;YAED,uBAAuB,EAAE,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,OAAO,CACvE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC3B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC1D,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAC/D,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;oBACvE,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CACH,CAAC;YACJ,CAAC,CACF;SACF;KACF,CAAC,CAAC;AACL,CAAC"}