@openora/core 0.4.1-canary.13 → 0.4.1-canary.131

package/dist/pam/identity/service/phone-login.service.js

@@ -0,0 +1,393 @@
+import { randomUUID } from 'node:crypto';
+import { ORPCError } from '@orpc/server';
+import { assertRateLimit, signSessionCookie, createLogger, invalidate, } from '@openora/core/server';
+import { and, eq, gt, sql } from 'drizzle-orm';
+import { PhoneLoginErrorReasonSchema, PhoneLoginOtpInvalidReasonSchema, } from '@openora/core/contracts';
+import { user, session, smsOtpSession } from '../schema/index.js';
+import { captureTimezone } from './capture-timezone.service.js';
+import { assertAccountNotBlocked } from './rg-guard.service.js';
+import { DEFAULT_MAX_LOGIN_ATTEMPTS, createAccountLockedError, hasFailedLoginWindowExpired, makeLoginSecurityState, } from './lockout-policy.service.js';
+import { hashCode, generateCode } from '../../shared/otp.js';
+const MINUTE_MS = 60 * 1000;
+const OTP_TTL_MS = 5 * MINUTE_MS;
+const RESEND_COOLDOWN_MS = MINUTE_MS;
+const MAX_VERIFY_ATTEMPTS = 5;
+const SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+const REMEMBER_ME_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const OTP_REQUEST_RATE_LIMIT = {
+    limit: 3,
+    windowMs: 15 * MINUTE_MS,
+    onUnavailable: 'deny',
+};
+const OTP_VERIFY_RATE_LIMIT = {
+    limit: 10,
+    windowMs: 5 * MINUTE_MS,
+    onUnavailable: 'deny',
+};
+const FAKE_OTP_SHADOW_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+function phoneOtpShadowKey(phone) {
+    return `phone-otp-shadow:${phone}`;
+}
+const logger = createLogger('phone-otp-shadow');
+/** Resend requested before the 60s cooldown elapsed. */
+export function OtpCooldownError(retryAfterMs) {
+    return new ORPCError('TOO_MANY_REQUESTS', {
+        message: 'A code was already sent. Please wait before requesting another.',
+        data: { retryAfterMs },
+    });
+}
+export function OtpInvalidError(attemptsRemaining, reason) {
+    return new ORPCError('UNPROCESSABLE_CONTENT', {
+        message: reason === 'expired' ? 'The code has expired.' : 'The code is invalid.',
+        data: { attemptsRemaining, reason: PhoneLoginOtpInvalidReasonSchema.enum[reason] },
+    });
+}
+/** Max wrong attempts reached; the OTP session was invalidated - restart login. */
+export function OtpCancelledError() {
+    return new ORPCError('FORBIDDEN', {
+        message: 'Too many incorrect attempts. Please request a new code.',
+        data: { reason: PhoneLoginErrorReasonSchema.enum.otp_cancelled },
+    });
+}
+function serializeUser(u) {
+    const base = {
+        id: u.id,
+        email: u.email,
+        name: u.name,
+        username: u.username,
+        emailVerified: u.emailVerified,
+        theme: u.theme,
+        language: u.language,
+        phoneNumber: u.phoneNumber,
+        phoneVerified: u.phoneVerified,
+        twoFactorEnabled: u.twoFactorEnabled ?? false,
+        createdAt: u.createdAt.toISOString(),
+        updatedAt: u.updatedAt.toISOString(),
+    };
+    return u.image !== null && u.image !== undefined ? { ...base, image: u.image } : base;
+}
+export class PhoneLoginService {
+    drizzle;
+    events;
+    sms;
+    limiter;
+    auth;
+    cache;
+    options;
+    playerProvisioning;
+    constructor({ drizzle, events, sms, limiter, auth, cache, options, playerProvisioning, }) {
+        this.drizzle = drizzle;
+        this.events = events;
+        this.sms = sms;
+        this.limiter = limiter;
+        this.auth = auth;
+        this.cache = cache;
+        this.options = options;
+        this.playerProvisioning = playerProvisioning;
+    }
+    async shadowGet(key) {
+        if (!this.cache) {
+            return undefined;
+        }
+        try {
+            return await this.cache.get(key);
+        }
+        catch (err) {
+            logger.warn({ key, err }, 'phone-otp shadow cache read failed');
+            return undefined;
+        }
+    }
+    async shadowSet(key, value) {
+        if (!this.cache) {
+            return;
+        }
+        try {
+            await this.cache.set(key, value, { ttlMs: FAKE_OTP_SHADOW_TTL_MS });
+        }
+        catch (err) {
+            logger.warn({ key, err }, 'phone-otp shadow cache write failed');
+        }
+    }
+    async requestOtp(input) {
+        const { phone } = input;
+        await assertRateLimit(this.limiter, `phone-otp-req:${phone}`, OTP_REQUEST_RATE_LIMIT);
+        const now = Date.now();
+        const expiresAt = new Date(now + OTP_TTL_MS);
+        const resendAfter = new Date(now + RESEND_COOLDOWN_MS);
+        // Role-filtered at the source: SMS is a single factor, so this flow only ever
+        // resolves a player. A backoffice account with a verified number stays on password
+        // plus its own second factor, and never becomes reachable through an SMS code.
+        const [account] = await this.drizzle.db
+            .select({
+            id: user.id,
+            phoneVerified: user.phoneVerified,
+            twoFactorEnabled: user.twoFactorEnabled,
+        })
+            .from(user)
+            .where(and(eq(user.phoneNumber, phone), eq(user.role, 'player')))
+            .limit(1);
+        // Anti-enumeration: an unknown, unverified, non-player, or 2FA-enabled phone gets the
+        // same success-shaped response, minus the SMS. A 2FA-enabled account's phone login is
+        // always rejected once the OTP is entered (see the guard below in `verifyOtp`), so
+        // sending a real code here would just be a billable no-op; folding it into the same
+        // shadow path also keeps a caller from telling 2FA-enabled accounts apart from
+        // unknown/unverified ones by response shape alone.
+        if (!account || !account.phoneVerified || account.twoFactorEnabled) {
+            const key = phoneOtpShadowKey(phone);
+            const shadow = await this.shadowGet(key);
+            if (shadow && now - shadow.createdAt < RESEND_COOLDOWN_MS) {
+                throw OtpCooldownError(RESEND_COOLDOWN_MS - (now - shadow.createdAt));
+            }
+            await this.shadowSet(key, { createdAt: now, failedAttempts: 0 });
+            return { expiresAt: expiresAt.toISOString(), resendAfter: resendAfter.toISOString() };
+        }
+        const [existing] = await this.drizzle.db
+            .select({ createdAt: smsOtpSession.createdAt })
+            .from(smsOtpSession)
+            .where(and(eq(smsOtpSession.userId, account.id), gt(smsOtpSession.expiresAt, new Date())))
+            .limit(1);
+        if (existing && now - existing.createdAt.getTime() < RESEND_COOLDOWN_MS) {
+            throw OtpCooldownError(RESEND_COOLDOWN_MS - (now - existing.createdAt.getTime()));
+        }
+        const code = generateCode();
+        const codeHash = hashCode(code);
+        await this.drizzle.db
+            .insert(smsOtpSession)
+            .values({ userId: account.id, phone, codeHash, expiresAt })
+            .onConflictDoUpdate({
+            target: smsOtpSession.userId,
+            set: { phone, codeHash, expiresAt, failedAttempts: 0, createdAt: new Date() },
+        });
+        await this.sms.sendOtp({ to: phone, code });
+        // Emit events only after SMS delivery so a send failure leaves no misleading
+        // audit trail (no cancelled-without-requested orphan in the audit log).
+        const ip = input.ip ?? null;
+        const userAgent = input.userAgent ?? null;
+        if (existing) {
+            this.events.emit('identity.phone_otp.cancelled', {
+                userId: account.id,
+                reason: 'new_otp_requested',
+                ip,
+                userAgent,
+            });
+        }
+        this.events.emit('identity.phone_otp.requested', { userId: account.id, ip, userAgent });
+        return { expiresAt: expiresAt.toISOString(), resendAfter: resendAfter.toISOString() };
+    }
+    async verifyOtp(input, resHeaders) {
+        const { phone, code, rememberMe, timezone, ip = null, userAgent = null } = input;
+        await assertRateLimit(this.limiter, `phone-otp-verify:${phone}`, OTP_VERIFY_RATE_LIMIT);
+        const [otp] = await this.drizzle.db
+            .select({
+            id: smsOtpSession.id,
+            userId: smsOtpSession.userId,
+            codeHash: smsOtpSession.codeHash,
+            expiresAt: smsOtpSession.expiresAt,
+            failedAttempts: smsOtpSession.failedAttempts,
+        })
+            .from(smsOtpSession)
+            .where(eq(smsOtpSession.phone, phone))
+            .limit(1);
+        if (!otp) {
+            const key = phoneOtpShadowKey(phone);
+            const shadow = await this.shadowGet(key);
+            if (!shadow) {
+                throw OtpInvalidError(MAX_VERIFY_ATTEMPTS - 1, 'wrong_code');
+            }
+            if (Date.now() - shadow.createdAt >= OTP_TTL_MS) {
+                throw OtpInvalidError(MAX_VERIFY_ATTEMPTS - shadow.failedAttempts, 'expired');
+            }
+            const newAttempts = shadow.failedAttempts + 1;
+            if (newAttempts >= MAX_VERIFY_ATTEMPTS) {
+                await invalidate(this.cache, key);
+                throw OtpCancelledError();
+            }
+            await this.shadowSet(key, { createdAt: shadow.createdAt, failedAttempts: newAttempts });
+            throw OtpInvalidError(MAX_VERIFY_ATTEMPTS - newAttempts, 'wrong_code');
+        }
+        if (otp.expiresAt.getTime() < Date.now()) {
+            throw OtpInvalidError(MAX_VERIFY_ATTEMPTS - otp.failedAttempts, 'expired');
+        }
+        if (hashCode(code) !== otp.codeHash) {
+            // Atomic increment so concurrent guesses can't each read a stale count and slip
+            // past the cap.
+            // Individual wrong-code attempts are not emitted as audit events; the final
+            // `identity.phone_otp.cancelled` event captures the outcome. High-volume
+            // per-attempt events would bloat the audit log (same rationale as chat messages).
+            const [row] = await this.drizzle.db
+                .update(smsOtpSession)
+                .set({ failedAttempts: sql `${smsOtpSession.failedAttempts} + 1` })
+                .where(eq(smsOtpSession.id, otp.id))
+                .returning({ failedAttempts: smsOtpSession.failedAttempts });
+            const newAttempts = row?.failedAttempts;
+            // row is undefined when a concurrent request already deleted the session after
+            // hitting the cap — treat it as already cancelled; skip the emit to avoid
+            // duplicates.
+            if (newAttempts === undefined || newAttempts >= MAX_VERIFY_ATTEMPTS) {
+                if (newAttempts !== undefined) {
+                    await this.drizzle.db.delete(smsOtpSession).where(eq(smsOtpSession.id, otp.id));
+                    this.events.emit('identity.phone_otp.cancelled', {
+                        userId: otp.userId,
+                        reason: 'max_attempts',
+                        ip,
+                        userAgent,
+                    });
+                }
+                throw OtpCancelledError();
+            }
+            throw OtpInvalidError(MAX_VERIFY_ATTEMPTS - newAttempts, 'wrong_code');
+        }
+        // Resolve the account before entering the transaction so the RG check can short-
+        // circuit without consuming the OTP: a blocked user can try again once unblocked.
+        let [account] = await this.drizzle.db
+            .select({
+            id: user.id,
+            email: user.email,
+            name: user.name,
+            username: user.username,
+            emailVerified: user.emailVerified,
+            image: user.image,
+            theme: user.theme,
+            language: user.language,
+            phoneNumber: user.phoneNumber,
+            phoneVerified: user.phoneVerified,
+            twoFactorEnabled: user.twoFactorEnabled,
+            createdAt: user.createdAt,
+            updatedAt: user.updatedAt,
+            rgBlocked: user.rgBlocked,
+            rgBlockedUntil: user.rgBlockedUntil,
+            failedLoginAttempts: user.failedLoginAttempts,
+            lockoutUntil: user.lockoutUntil,
+            lockoutCount: user.lockoutCount,
+            lastLockoutAt: user.lastLockoutAt,
+            lastFailedLoginAt: user.lastFailedLoginAt,
+        })
+            .from(user)
+            .where(eq(user.id, otp.userId))
+            .limit(1);
+        if (!account) {
+            throw new ORPCError('INTERNAL_SERVER_ERROR', { message: 'Account not found.' });
+        }
+        const nowMs = Date.now();
+        if (account.lockoutUntil && account.lockoutUntil.getTime() > nowMs) {
+            throw createAccountLockedError(account.lockoutUntil);
+        }
+        if (hasFailedLoginWindowExpired(account.lastFailedLoginAt, account.lastLockoutAt, nowMs)) {
+            await this.drizzle.db
+                .update(user)
+                .set({
+                failedLoginAttempts: 0,
+                lockoutUntil: null,
+                lockoutCount: 0,
+                lastLockoutAt: null,
+                lastFailedLoginAt: null,
+            })
+                .where(eq(user.id, account.id));
+            account = {
+                ...account,
+                failedLoginAttempts: 0,
+                lockoutUntil: null,
+                lockoutCount: 0,
+                lastLockoutAt: null,
+                lastFailedLoginAt: null,
+            };
+        }
+        else if (account.lockoutUntil && account.lockoutUntil.getTime() <= nowMs) {
+            await this.drizzle.db
+                .update(user)
+                .set({ failedLoginAttempts: 0, lockoutUntil: null })
+                .where(eq(user.id, account.id));
+            account = { ...account, failedLoginAttempts: 0, lockoutUntil: null };
+        }
+        // Same RG and backoffice gates as password login, from the one shared implementation.
+        // Checked after the OTP verifies, before the session-minting transaction - no session
+        // exists yet, so unlike the email paths there is nothing to revoke here; the OTP is
+        // left unconsumed so a blocked account reads the same as any other rejection.
+        const playerId = await assertAccountNotBlocked({ drizzle: this.drizzle, events: this.events }, account, { ip, userAgent }, {
+            revokeSessions: false,
+            errorData: {
+                rgBlocked: { reason: PhoneLoginErrorReasonSchema.enum.rg_blocked },
+                suspended: { reason: PhoneLoginErrorReasonSchema.enum.account_suspended },
+            },
+        });
+        // This flow mints sessions directly and cannot hand a challenge to better-auth's
+        // pending-2FA cookie. Refuse rather than silently downgrade a 2FA-protected
+        // account to a single SMS factor; a later dedicated handoff may replace this.
+        if (account.twoFactorEnabled) {
+            throw new ORPCError('FORBIDDEN', {
+                message: 'Phone login requires an authenticator challenge for this account.',
+            });
+        }
+        // Mint the session directly only after the no-2FA guard above.
+        // Delete the OTP and insert the new session atomically: if the insert fails the
+        // OTP is not consumed and the user can retry with the same code.
+        const token = randomUUID();
+        const sessionExpiresAt = new Date(Date.now() + (rememberMe ? REMEMBER_ME_TTL_MS : SESSION_TTL_MS));
+        await this.drizzle.db.transaction(async (t) => {
+            await t.delete(smsOtpSession).where(eq(smsOtpSession.id, otp.id));
+            await t.insert(session).values({
+                id: randomUUID(),
+                token,
+                userId: account.id,
+                expiresAt: sessionExpiresAt,
+                ipAddress: ip,
+                userAgent,
+                createdAt: new Date(),
+                updatedAt: new Date(),
+            });
+            await t
+                .update(user)
+                .set({
+                failedLoginAttempts: 0,
+                lockoutUntil: null,
+                lockoutCount: 0,
+                lastLockoutAt: null,
+                lastFailedLoginAt: null,
+            })
+                .where(eq(user.id, account.id));
+        });
+        this.events.emit('identity.user.phone_login', {
+            userId: account.id,
+            playerId,
+            method: 'phone',
+            ip,
+            userAgent,
+        });
+        this.events.emit('identity.authentication.succeeded', {
+            userId: account.id,
+            playerId,
+            method: 'phone',
+            ip,
+            userAgent,
+        });
+        // Only once the OTP has cleared and the session exists.
+        await captureTimezone(this.playerProvisioning, account.id, timezone);
+        const authContext = await this.auth.$context;
+        const maxAgeSeconds = rememberMe
+            ? Math.max(0, Math.round((sessionExpiresAt.getTime() - Date.now()) / 1000))
+            : undefined;
+        resHeaders.append('set-cookie', signSessionCookie({
+            token,
+            sessionCookie: authContext.authCookies.sessionToken,
+            secret: authContext.secret,
+            maxAgeSeconds,
+        }));
+        if (!rememberMe) {
+            resHeaders.append('set-cookie', signSessionCookie({
+                token: 'true',
+                sessionCookie: authContext.authCookies.dontRememberToken,
+                secret: authContext.secret,
+            }));
+        }
+        return {
+            user: serializeUser(account),
+            session: { token, expiresAt: sessionExpiresAt.toISOString() },
+            security: makeLoginSecurityState({
+                failedLoginAttempts: 0,
+                maxAttempts: this.options?.lockout?.maxAttempts ?? DEFAULT_MAX_LOGIN_ATTEMPTS,
+                lockoutUntil: null,
+            }),
+        };
+    }
+}
+//# sourceMappingURL=phone-login.service.js.map

package/dist/pam/identity/service/phone-login.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-login.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/phone-login.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAIL,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,UAAU,GACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GAYjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE7D,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5B,MAAM,UAAU,GAAG,CAAC,GAAG,SAAS,CAAC;AACjC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AACrC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,MAAM,sBAAsB,GAAG;IAC7B,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,EAAE,GAAG,SAAS;IACxB,aAAa,EAAE,MAAM;CACb,CAAC;AACX,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,CAAC,GAAG,SAAS;IACvB,aAAa,EAAE,MAAM;CACb,CAAC;AAEX,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAIvD,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,oBAAoB,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,MAAM,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;AAEhD,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,OAAO,IAAI,SAAS,CAAC,mBAAmB,EAAE;QACxC,OAAO,EAAE,iEAAiE;QAC1E,IAAI,EAAE,EAAE,YAAY,EAAE;KACvB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,iBAAyB,EAAE,MAAkC;IAC3F,OAAO,IAAI,SAAS,CAAC,uBAAuB,EAAE;QAC5C,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,sBAAsB;QAChF,IAAI,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;KACnF,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,SAAS,CAAC,WAAW,EAAE;QAChC,OAAO,EAAE,yDAAyD;QAClE,IAAI,EAAE,EAAE,MAAM,EAAE,2BAA2B,CAAC,IAAI,CAAC,aAAa,EAAE;KACjE,CAAC,CAAC;AACL,CAAC;AAmBD,SAAS,aAAa,CAAC,CAAU;IAC/B,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,KAAK;QAC7C,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,OAAO,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxF,CAAC;AAaD,MAAM,OAAO,iBAAiB;IACX,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,GAAG,CAAa;IAChB,OAAO,CAAqB;IAC5B,IAAI,CAAO;IACX,KAAK,CAAgB;IACrB,OAAO,CAA0B;IACjC,kBAAkB,CAAsB;IAEzD,YAAY,EACV,OAAO,EACP,MAAM,EACN,GAAG,EACH,OAAO,EACP,IAAI,EACJ,KAAK,EACL,OAAO,EACP,kBAAkB,GACI;QACtB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAW;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;YAChE,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAoB;QACvD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAA0C;QACzD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QACxB,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,KAAK,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAEtF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC;QAEvD,8EAA8E;QAC9E,mFAAmF;QACnF,+EAA+E;QAC/E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACpC,MAAM,CAAC;YACN,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;aAChE,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,sFAAsF;QACtF,sFAAsF;QACtF,mFAAmF;QACnF,oFAAoF;QACpF,+EAA+E;QAC/E,mDAAmD;QACnD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACnE,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,kBAAkB,EAAE,CAAC;gBAC1D,MAAM,gBAAgB,CAAC,kBAAkB,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;YACjE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;QACxF,CAAC;QAED,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACrC,MAAM,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC;aAC9C,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;aACzF,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,QAAQ,IAAI,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;YACxE,MAAM,gBAAgB,CAAC,kBAAkB,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEhC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,aAAa,CAAC;aACrB,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;aAC1D,kBAAkB,CAAC;YAClB,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAC9E,CAAC,CAAC;QAEL,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5C,6EAA6E;QAC7E,wEAAwE;QACxE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC;QAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC;QAC1C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBAC/C,MAAM,EAAE,OAAO,CAAC,EAAE;gBAClB,MAAM,EAAE,mBAAmB;gBAC3B,EAAE;gBACF,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAExF,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAyC,EAAE,UAAmB;QAC5E,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QACjF,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,KAAK,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAExF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC;YACN,EAAE,EAAE,aAAa,CAAC,EAAE;YACpB,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,cAAc,EAAE,aAAa,CAAC,cAAc;SAC7C,CAAC;aACD,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aACrC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,eAAe,CAAC,mBAAmB,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;gBAChD,MAAM,eAAe,CAAC,mBAAmB,GAAG,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC;YAC9C,IAAI,WAAW,IAAI,mBAAmB,EAAE,CAAC;gBACvC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAClC,MAAM,iBAAiB,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACxF,MAAM,eAAe,CAAC,mBAAmB,GAAG,WAAW,EAAE,YAAY,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACzC,MAAM,eAAe,CAAC,mBAAmB,GAAG,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YACpC,gFAAgF;YAChF,gBAAgB;YAChB,4EAA4E;YAC5E,yEAAyE;YACzE,kFAAkF;YAClF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;iBAChC,MAAM,CAAC,aAAa,CAAC;iBACrB,GAAG,CAAC,EAAE,cAAc,EAAE,GAAG,CAAA,GAAG,aAAa,CAAC,cAAc,MAAM,EAAE,CAAC;iBACjE,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;iBACnC,SAAS,CAAC,EAAE,cAAc,EAAE,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;YAC/D,MAAM,WAAW,GAAG,GAAG,EAAE,cAAc,CAAC;YAExC,+EAA+E;YAC/E,0EAA0E;YAC1E,cAAc;YACd,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,IAAI,mBAAmB,EAAE,CAAC;gBACpE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;oBAChF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;wBAC/C,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,MAAM,EAAE,cAAc;wBACtB,EAAE;wBACF,SAAS;qBACV,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,iBAAiB,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,eAAe,CAAC,mBAAmB,GAAG,WAAW,EAAE,YAAY,CAAC,CAAC;QACzE,CAAC;QAED,iFAAiF;QACjF,kFAAkF;QAClF,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC;YACN,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC;aACD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;aAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;YACnE,MAAM,wBAAwB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,2BAA2B,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;iBAClB,MAAM,CAAC,IAAI,CAAC;iBACZ,GAAG,CAAC;gBACH,mBAAmB,EAAE,CAAC;gBACtB,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,CAAC;gBACf,aAAa,EAAE,IAAI;gBACnB,iBAAiB,EAAE,IAAI;aACxB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAClC,OAAO,GAAG;gBACR,GAAG,OAAO;gBACV,mBAAmB,EAAE,CAAC;gBACtB,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,CAAC;gBACf,aAAa,EAAE,IAAI;gBACnB,iBAAiB,EAAE,IAAI;aACxB,CAAC;QACJ,CAAC;aAAM,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;iBAClB,MAAM,CAAC,IAAI,CAAC;iBACZ,GAAG,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;iBACnD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAClC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACvE,CAAC;QAED,sFAAsF;QACtF,sFAAsF;QACtF,oFAAoF;QACpF,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC9C,OAAO,EACP,EAAE,EAAE,EAAE,SAAS,EAAE,EACjB;YACE,cAAc,EAAE,KAAK;YACrB,SAAS,EAAE;gBACT,SAAS,EAAE,EAAE,MAAM,EAAE,2BAA2B,CAAC,IAAI,CAAC,UAAU,EAAE;gBAClE,SAAS,EAAE,EAAE,MAAM,EAAE,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,EAAE;aAC1E;SACF,CACF,CAAC;QAEF,iFAAiF;QACjF,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,mEAAmE;aAC7E,CAAC,CAAC;QACL,CAAC;QAED,+DAA+D;QAC/D,gFAAgF;QAChF,iEAAiE;QACjE,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,gBAAgB,GAAG,IAAI,IAAI,CAC/B,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC,CAChE,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBAC7B,EAAE,EAAE,UAAU,EAAE;gBAChB,KAAK;gBACL,MAAM,EAAE,OAAO,CAAC,EAAE;gBAClB,SAAS,EAAE,gBAAgB;gBAC3B,SAAS,EAAE,EAAE;gBACb,SAAS;gBACT,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAC;YACH,MAAM,CAAC;iBACJ,MAAM,CAAC,IAAI,CAAC;iBACZ,GAAG,CAAC;gBACH,mBAAmB,EAAE,CAAC;gBACtB,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,CAAC;gBACf,aAAa,EAAE,IAAI;gBACnB,iBAAiB,EAAE,IAAI;aACxB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YAC5C,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,QAAQ;YACR,MAAM,EAAE,OAAO;YACf,EAAE;YACF,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;YACpD,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,QAAQ;YACR,MAAM,EAAE,OAAO;YACf,EAAE;YACF,SAAS;SACV,CAAC,CAAC;QAEH,wDAAwD;QACxD,MAAM,eAAe,CAAC,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAErE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAE7C,MAAM,aAAa,GAAG,UAAU;YAC9B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3E,CAAC,CAAC,SAAS,CAAC;QACd,UAAU,CAAC,MAAM,CACf,YAAY,EACZ,iBAAiB,CAAC;YAChB,KAAK;YACL,aAAa,EAAE,WAAW,CAAC,WAAW,CAAC,YAAY;YACnD,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,aAAa;SACd,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,CAAC,MAAM,CACf,YAAY,EACZ,iBAAiB,CAAC;gBAChB,KAAK,EAAE,MAAM;gBACb,aAAa,EAAE,WAAW,CAAC,WAAW,CAAC,iBAAiB;gBACxD,MAAM,EAAE,WAAW,CAAC,MAAM;aAC3B,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC;YAC5B,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,CAAC,WAAW,EAAE,EAAE;YAC7D,QAAQ,EAAE,sBAAsB,CAAC;gBAC/B,mBAAmB,EAAE,CAAC;gBACtB,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,IAAI,0BAA0B;gBAC7E,YAAY,EAAE,IAAI;aACnB,CAAC;SACH,CAAC;IACJ,CAAC;CACF"}

package/dist/pam/identity/service/phone-verification.service.d.ts

@@ -0,0 +1,38 @@
+import { type Auth, type EventBus, type DrizzleService, type NodeHeaders } from '@openora/core/server';
+import type { ClientMeta, IdentityReader, PhoneVerificationConfirmInput, PhoneVerificationRequestInput, PhoneVerificationRequestOutput, RateLimiterAdapter, SecurityControls, SmsAdapter, User } from '@openora/core/contracts';
+import { type Session } from '../schema/index.js';
+import type { TwoFactorLockoutService } from './two-factor-lockout.service.js';
+export type PhoneVerificationServiceDeps = {
+    drizzle: DrizzleService;
+    events: EventBus;
+    sms: SmsAdapter;
+    limiter: RateLimiterAdapter;
+    auth: Auth;
+    identityReader: IdentityReader;
+    twoFactorLockout?: TwoFactorLockoutService;
+};
+export declare class PhoneVerificationService {
+    private readonly drizzle;
+    private readonly events;
+    private readonly sms;
+    private readonly limiter;
+    private readonly auth;
+    private readonly identityReader;
+    private readonly twoFactorLockout?;
+    constructor({ drizzle, events, sms, limiter, auth, identityReader, twoFactorLockout, }: PhoneVerificationServiceDeps);
+    private assertFreshReauthentication;
+    request({ userId, sessionId, input, reqHeaders, meta, }: {
+        userId: User['id'];
+        sessionId: Session['id'];
+        input: PhoneVerificationRequestInput;
+        reqHeaders: NodeHeaders;
+        meta: ClientMeta;
+    }): Promise<PhoneVerificationRequestOutput>;
+    confirm({ userId, sessionId, input, meta, }: {
+        userId: User['id'];
+        sessionId: Session['id'];
+        input: PhoneVerificationConfirmInput;
+        meta: ClientMeta;
+    }): Promise<SecurityControls>;
+}
+//# sourceMappingURL=phone-verification.service.d.ts.map

package/dist/pam/identity/service/phone-verification.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-verification.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/phone-verification.service.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,IAAI,EACT,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,WAAW,EAEjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EACd,6BAA6B,EAC7B,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,IAAI,EACL,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAA2C,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAyC/E,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,GAAG,EAAE,UAAU,CAAC;IAChB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE,cAAc,CAAC;IAC/B,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;CAC5C,CAAC;AAEF,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA0B;gBAEhD,EACV,OAAO,EACP,MAAM,EACN,GAAG,EACH,OAAO,EACP,IAAI,EACJ,cAAc,EACd,gBAAgB,GACjB,EAAE,4BAA4B;YAUjB,2BAA2B;IA0DnC,OAAO,CAAC,EACZ,MAAM,EACN,SAAS,EACT,KAAK,EACL,UAAU,EACV,IAAI,GACL,EAAE;QACD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,EAAE,6BAA6B,CAAC;QACrC,UAAU,EAAE,WAAW,CAAC;QACxB,IAAI,EAAE,UAAU,CAAC;KAClB,GAAG,OAAO,CAAC,8BAA8B,CAAC;IA2FrC,OAAO,CAAC,EACZ,MAAM,EACN,SAAS,EACT,KAAK,EACL,IAAI,GACL,EAAE;QACD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,EAAE,6BAA6B,CAAC;QACrC,IAAI,EAAE,UAAU,CAAC;KAClB,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA8F9B"}