@portaidentity/server 1.7.0

package/dist/cli/commands/migrate.js

@@ -0,0 +1,88 @@
+/**
+ * CLI migration commands.
+ *
+ * Manages database schema migrations using the existing migrator module
+ * (node-pg-migrate). Provides up, down, and status subcommands.
+ *
+ * Usage:
+ *   porta migrate up              # Apply all pending migrations
+ *   porta migrate down            # Rollback last migration
+ *   porta migrate down --count 3  # Rollback last 3 migrations
+ *   porta migrate status          # Show migration status
+ *
+ * @module cli/commands/migrate
+ */
+import { withBootstrap } from '../bootstrap.js';
+import { withErrorHandling } from '../error-handler.js';
+import { success, warn } from '../output.js';
+/** The migrate command module — registered at the top level of the CLI */
+export const migrateCommand = {
+    command: 'migrate',
+    describe: 'Manage database migrations',
+    builder: (yargs) => {
+        return yargs
+            .command('up', 'Apply all pending migrations', {}, async (argv) => {
+            const args = argv;
+            await withErrorHandling(async () => {
+                await withBootstrap(args, async () => {
+                    // Dynamic import to delay config loading until after env overrides
+                    const { runMigrations } = await import('../../lib/migrator.js');
+                    if (args['dry-run']) {
+                        warn('Dry run — no migrations applied');
+                        return;
+                    }
+                    await runMigrations('up');
+                    success('All migrations applied');
+                });
+            }, args.verbose);
+        })
+            .command('down', 'Rollback migrations', (y) => y.option('count', {
+            type: 'number',
+            default: 1,
+            description: 'Number of migrations to rollback',
+        }), async (argv) => {
+            const args = argv;
+            await withErrorHandling(async () => {
+                await withBootstrap(args, async () => {
+                    const { runMigrations } = await import('../../lib/migrator.js');
+                    if (args['dry-run']) {
+                        warn(`Dry run — would rollback ${args.count} migration(s)`);
+                        return;
+                    }
+                    await runMigrations('down', args.count);
+                    success(`Rolled back ${args.count} migration(s)`);
+                });
+            }, args.verbose);
+        })
+            .command('status', 'Show migration status', {}, async (argv) => {
+            const args = argv;
+            await withErrorHandling(async () => {
+                await withBootstrap(args, async () => {
+                    // Query the pgmigrations table directly to show applied migrations
+                    const { getPool } = await import('../../lib/database.js');
+                    const result = await getPool().query('SELECT id, name, run_on FROM pgmigrations ORDER BY id');
+                    if (result.rows.length === 0) {
+                        warn('No migrations have been applied');
+                        return;
+                    }
+                    // Dynamic import for output helpers (keeps top-level imports clean)
+                    const { printTable, outputResult, formatDate, printTotal } = await import('../output.js');
+                    outputResult(args.json, () => {
+                        const rows = result.rows.map((r) => [
+                            String(r.id),
+                            r.name,
+                            formatDate(r.run_on),
+                        ]);
+                        printTable(['ID', 'Name', 'Applied'], rows);
+                        printTotal('migrations applied', result.rows.length);
+                    }, result.rows);
+                });
+            }, args.verbose);
+        })
+            .demandCommand(1, 'Specify a migrate subcommand: up, down, status');
+    },
+    handler: () => {
+        // No-op — subcommands handle execution
+    },
+};
+//# sourceMappingURL=migrate.js.map

package/dist/cli/commands/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../../src/cli/commands/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAO7C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAgD;IACzE,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,4BAA4B;IACtC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACjB,OAAO,KAAK;aACT,OAAO,CACN,IAAI,EACJ,8BAA8B,EAC9B,EAAE,EACF,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,IAAgC,CAAC;YAC9C,MAAM,iBAAiB,CAAC,KAAK,IAAI,EAAE;gBACjC,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;oBACnC,mEAAmE;oBACnE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;oBAEhE,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;wBACpB,IAAI,CAAC,iCAAiC,CAAC,CAAC;wBACxC,OAAO;oBACT,CAAC;oBAED,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;oBAC1B,OAAO,CAAC,wBAAwB,CAAC,CAAC;gBACpC,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CACF;aACA,OAAO,CACN,MAAM,EACN,qBAAqB,EACrB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE;YAChB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,kCAAkC;SAChD,CAAC,EACJ,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,IAAkC,CAAC;YAChD,MAAM,iBAAiB,CAAC,KAAK,IAAI,EAAE;gBACjC,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;oBACnC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;oBAEhE,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;wBACpB,IAAI,CAAC,4BAA4B,IAAI,CAAC,KAAK,eAAe,CAAC,CAAC;wBAC5D,OAAO;oBACT,CAAC;oBAED,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACxC,OAAO,CAAC,eAAe,IAAI,CAAC,KAAK,eAAe,CAAC,CAAC;gBACpD,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CACF;aACA,OAAO,CACN,QAAQ,EACR,uBAAuB,EACvB,EAAE,EACF,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,IAAgC,CAAC;YAC9C,MAAM,iBAAiB,CAAC,KAAK,IAAI,EAAE;gBACjC,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;oBACnC,mEAAmE;oBACnE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;oBAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC,uDAAuD,CACxD,CAAC;oBAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAC7B,IAAI,CAAC,iCAAiC,CAAC,CAAC;wBACxC,OAAO;oBACT,CAAC;oBAED,oEAAoE;oBACpE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,GACxD,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;oBAE/B,YAAY,CACV,IAAI,CAAC,IAAI,EACT,GAAG,EAAE;wBACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAA+C,EAAE,EAAE,CAAC;4BAChF,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;4BACZ,CAAC,CAAC,IAAI;4BACN,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;yBACrB,CAAC,CAAC;wBACH,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;wBAC5C,UAAU,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACvD,CAAC,EACD,MAAM,CAAC,IAAI,CACZ,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CACF;aACA,aAAa,CAAC,CAAC,EAAE,gDAAgD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE;QACZ,uCAAuC;IACzC,CAAC;CACF,CAAC"}

package/dist/cli/commands/seed.d.ts

@@ -0,0 +1,19 @@
+/**
+ * CLI seed command.
+ *
+ * Runs seed data for development environments by executing the seed SQL file
+ * (migrations/011_seed.sql) against the database. Requires confirmation
+ * to prevent accidental execution in production.
+ *
+ * Usage:
+ *   porta seed run           # Run with confirmation prompt
+ *   porta seed run --force   # Skip confirmation
+ *   porta seed run --dry-run # Preview without executing
+ *
+ * @module cli/commands/seed
+ */
+import type { CommandModule } from 'yargs';
+import type { GlobalOptions } from '../index.js';
+/** The seed command module — registered at the top level of the CLI */
+export declare const seedCommand: CommandModule<GlobalOptions, GlobalOptions>;
+//# sourceMappingURL=seed.d.ts.map

package/dist/cli/commands/seed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/seed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAqBjD,uEAAuE;AACvE,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC,aAAa,EAAE,aAAa,CAgDnE,CAAC"}

package/dist/cli/commands/seed.js

@@ -0,0 +1,71 @@
+/**
+ * CLI seed command.
+ *
+ * Runs seed data for development environments by executing the seed SQL file
+ * (migrations/011_seed.sql) against the database. Requires confirmation
+ * to prevent accidental execution in production.
+ *
+ * Usage:
+ *   porta seed run           # Run with confirmation prompt
+ *   porta seed run --force   # Skip confirmation
+ *   porta seed run --dry-run # Preview without executing
+ *
+ * @module cli/commands/seed
+ */
+import { readFile } from 'node:fs/promises';
+import { getSeedSqlPath } from '../../lib/runtime-paths.js';
+import { withBootstrap } from '../bootstrap.js';
+import { withErrorHandling } from '../error-handler.js';
+import { success, warn } from '../output.js';
+import { confirm } from '../prompt.js';
+/** Absolute path to the seed SQL file shipped with the server package. */
+const SEED_FILE = getSeedSqlPath();
+/**
+ * Extract the "Up Migration" portion from the seed SQL file.
+ * The file contains both up and down sections separated by "-- Down Migration".
+ * We only want the up section when seeding.
+ */
+function extractUpMigration(sql) {
+    const downMarker = '-- Down Migration';
+    const downIndex = sql.indexOf(downMarker);
+    // If there's a down section, take only the part before it
+    return downIndex >= 0 ? sql.substring(0, downIndex).trim() : sql.trim();
+}
+/** The seed command module — registered at the top level of the CLI */
+export const seedCommand = {
+    command: 'seed',
+    describe: 'Manage seed data',
+    builder: (yargs) => {
+        return yargs.command('run', 'Insert development seed data', {}, async (argv) => {
+            const args = argv;
+            await withErrorHandling(async () => {
+                // Warn if running in production
+                if (process.env.NODE_ENV === 'production') {
+                    warn('Running seed in production environment!');
+                }
+                if (args['dry-run']) {
+                    warn('Dry run — would execute seed SQL from migrations/011_seed.sql');
+                    return;
+                }
+                // Require confirmation unless --force is set
+                const confirmed = await confirm('This will insert seed data into the database. Continue?', args.force);
+                if (!confirmed) {
+                    warn('Seed operation cancelled');
+                    return;
+                }
+                await withBootstrap(args, async () => {
+                    const { getPool } = await import('../../lib/database.js');
+                    // Read and extract the up portion of the seed SQL
+                    const rawSql = await readFile(SEED_FILE, 'utf-8');
+                    const upSql = extractUpMigration(rawSql);
+                    await getPool().query(upSql);
+                    success('Seed data inserted successfully');
+                });
+            }, args.verbose);
+        }).demandCommand(1, 'Specify a seed subcommand: run');
+    },
+    handler: () => {
+        // No-op — subcommands handle execution
+    },
+};
+//# sourceMappingURL=seed.js.map

package/dist/cli/commands/seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../../src/cli/commands/seed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,0EAA0E;AAC1E,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;AAEnC;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,UAAU,GAAG,mBAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,0DAA0D;IAC1D,OAAO,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAgD;IACtE,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,kBAAkB;IAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACjB,OAAO,KAAK,CAAC,OAAO,CAClB,KAAK,EACL,8BAA8B,EAC9B,EAAE,EACF,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,IAAgC,CAAC;YAC9C,MAAM,iBAAiB,CAAC,KAAK,IAAI,EAAE;gBACjC,gCAAgC;gBAChC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAC1C,IAAI,CAAC,yCAAyC,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACpB,IAAI,CAAC,+DAA+D,CAAC,CAAC;oBACtE,OAAO;gBACT,CAAC;gBAED,6CAA6C;gBAC7C,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,yDAAyD,EACzD,IAAI,CAAC,KAAK,CACX,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,IAAI,CAAC,0BAA0B,CAAC,CAAC;oBACjC,OAAO;gBACT,CAAC;gBAED,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;oBACnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;oBAE1D,kDAAkD;oBAClD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;oBAClD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAEzC,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC7B,OAAO,CAAC,iCAAiC,CAAC,CAAC;gBAC7C,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CACF,CAAC,aAAa,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,GAAG,EAAE;QACZ,uCAAuC;IACzC,CAAC;CACF,CAAC"}

package/dist/cli/commands/user-2fa.d.ts

@@ -0,0 +1,29 @@
+/**
+ * CLI user 2FA subcommands — direct-DB mode only.
+ *
+ * Manages two-factor authentication for users — status, disable, reset.
+ * Uses direct database access via withBootstrap.
+ *
+ * HTTP-based 2FA management is available in the standalone
+ * `@portaidentity/cli` package via the `user` command.
+ *
+ * Usage:
+ *   porta user 2fa status <user-id>
+ *   porta user 2fa disable <user-id> [--force]
+ *   porta user 2fa reset <user-id> [--force]
+ *
+ * @module cli/commands/user-2fa
+ */
+import type { CommandModule } from 'yargs';
+import type { GlobalOptions } from '../index.js';
+/** The user 2fa subcommand group — registered as `user` in the reduced CLI */
+export declare const userTwoFaCommand: CommandModule<GlobalOptions, GlobalOptions>;
+/**
+ * The `user` command for the reduced server CLI.
+ *
+ * In the Docker-embedded CLI, the only `user` subcommand is `2fa`
+ * for direct-DB two-factor administration. All other user management
+ * (CRUD, status, roles, claims) is in `@portaidentity/cli`.
+ */
+export declare const userCommand: CommandModule<GlobalOptions, GlobalOptions>;
+//# sourceMappingURL=user-2fa.d.ts.map

package/dist/cli/commands/user-2fa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-2fa.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/user-2fa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAmBjD,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,EAAE,aAAa,CAAC,aAAa,EAAE,aAAa,CA0GxE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC,aAAa,EAAE,aAAa,CAWnE,CAAC"}

package/dist/cli/commands/user-2fa.js

@@ -0,0 +1,113 @@
+/**
+ * CLI user 2FA subcommands — direct-DB mode only.
+ *
+ * Manages two-factor authentication for users — status, disable, reset.
+ * Uses direct database access via withBootstrap.
+ *
+ * HTTP-based 2FA management is available in the standalone
+ * `@portaidentity/cli` package via the `user` command.
+ *
+ * Usage:
+ *   porta user 2fa status <user-id>
+ *   porta user 2fa disable <user-id> [--force]
+ *   porta user 2fa reset <user-id> [--force]
+ *
+ * @module cli/commands/user-2fa
+ */
+import { withBootstrap } from '../bootstrap.js';
+import { withErrorHandling } from '../error-handler.js';
+import { printTable, success, warn, outputResult, truncateId } from '../output.js';
+import { confirm } from '../prompt.js';
+// ---------------------------------------------------------------------------
+// Command definition
+// ---------------------------------------------------------------------------
+/** The user 2fa subcommand group — registered as `user` in the reduced CLI */
+export const userTwoFaCommand = {
+    command: '2fa',
+    describe: 'Manage user two-factor authentication (direct-DB)',
+    builder: (yargs) => {
+        return yargs
+            // ── status ──────────────────────────────────────────────────────
+            .command('status <id>', 'Check 2FA status for a user', (y) => y.positional('id', { type: 'string', demandOption: true, description: 'User UUID' }), async (argv) => {
+            const args = argv;
+            await withErrorHandling(async () => {
+                await withBootstrap(args, async () => {
+                    const { getTwoFactorStatus } = await import('../../two-factor/service.js');
+                    const { findUserById } = await import('../../users/repository.js');
+                    const user = await findUserById(args.id);
+                    if (!user) {
+                        warn(`User ${args.id} not found`);
+                        return;
+                    }
+                    const status = await getTwoFactorStatus(args.id);
+                    outputResult(args.json, () => {
+                        printTable(['Field', 'Value'], [
+                            ['User ID', truncateId(args.id)],
+                            ['Email', user.email],
+                            ['2FA Enabled', status.enabled ? '✅ Yes' : '❌ No'],
+                            ['Method', status.method ?? '—'],
+                            ['TOTP Configured', status.totpConfigured ? '✅ Yes' : '❌ No'],
+                            ['Recovery Codes', String(status.recoveryCodesRemaining ?? 0)],
+                        ]);
+                    }, { userId: args.id, email: user.email, ...status });
+                });
+            }, args.verbose);
+        })
+            // ── disable ─────────────────────────────────────────────────────
+            .command('disable <id>', 'Disable 2FA for a user (removes TOTP config, OTP codes, and recovery codes)', (y) => y.positional('id', { type: 'string', demandOption: true, description: 'User UUID' }), async (argv) => {
+            const args = argv;
+            await withErrorHandling(async () => {
+                const confirmed = await confirm(`Disable 2FA for user ${args.id}? This will remove all 2FA configuration.`, args.force);
+                if (!confirmed) {
+                    warn('Operation cancelled');
+                    return;
+                }
+                await withBootstrap(args, async () => {
+                    const { disableTwoFactor } = await import('../../two-factor/service.js');
+                    await disableTwoFactor(args.id);
+                    success(`2FA disabled for user ${truncateId(args.id)}`);
+                });
+            }, args.verbose);
+        })
+            // ── reset ───────────────────────────────────────────────────────
+            .command('reset <id>', 'Reset 2FA for a user (disable + clear all 2FA data, user must re-enroll)', (y) => y.positional('id', { type: 'string', demandOption: true, description: 'User UUID' }), async (argv) => {
+            const args = argv;
+            await withErrorHandling(async () => {
+                const confirmed = await confirm(`Reset 2FA for user ${args.id}? This will completely remove all 2FA data and the user will need to re-enroll.`, args.force);
+                if (!confirmed) {
+                    warn('Operation cancelled');
+                    return;
+                }
+                await withBootstrap(args, async () => {
+                    const { disableTwoFactor } = await import('../../two-factor/service.js');
+                    await disableTwoFactor(args.id);
+                    success(`2FA reset for user ${truncateId(args.id)} — user must re-enroll`);
+                });
+            }, args.verbose);
+        })
+            .demandCommand(1, 'Specify a 2fa subcommand: status, disable, reset');
+    },
+    handler: () => {
+        // No-op — subcommands handle execution
+    },
+};
+/**
+ * The `user` command for the reduced server CLI.
+ *
+ * In the Docker-embedded CLI, the only `user` subcommand is `2fa`
+ * for direct-DB two-factor administration. All other user management
+ * (CRUD, status, roles, claims) is in `@portaidentity/cli`.
+ */
+export const userCommand = {
+    command: 'user',
+    describe: 'User administration (2FA only, direct-DB)',
+    builder: (yargs) => {
+        return yargs
+            .command(userTwoFaCommand)
+            .demandCommand(1, 'Specify a user subcommand: 2fa');
+    },
+    handler: () => {
+        // No-op — subcommands handle execution
+    },
+};
+//# sourceMappingURL=user-2fa.js.map

package/dist/cli/commands/user-2fa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-2fa.js","sourceRoot":"","sources":["../../../src/cli/commands/user-2fa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAWvC,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAgD;IAC3E,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,mDAAmD;IAC7D,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACjB,OAAO,KAAK;YACV,mEAAmE;aAClE,OAAO,CACN,aAAa,EACb,6BAA6B,EAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EACtF,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,IAA4B,CAAC;YAC1C,MAAM,iBAAiB,CAAC,KAAK,IAAI,EAAE;gBACjC,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;oBACnC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;oBAC3E,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;oBAEnE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACzC,IAAI,CAAC,IAAI,EAAE,CAAC;wBACV,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;wBAClC,OAAO;oBACT,CAAC;oBAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAEjD,YAAY,CACV,IAAI,CAAC,IAAI,EACT,GAAG,EAAE;wBACH,UAAU,CACR,CAAC,OAAO,EAAE,OAAO,CAAC,EAClB;4BACE,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;4BAChC,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;4BACrB,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;4BAClD,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;4BAChC,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;4BAC7D,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,sBAAsB,IAAI,CAAC,CAAC,CAAC;yBAC/D,CACF,CAAC;oBACJ,CAAC,EACD,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,CAClD,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CACF;YAED,mEAAmE;aAClE,OAAO,CACN,cAAc,EACd,6EAA6E,EAC7E,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EACtF,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,IAA4B,CAAC;YAC1C,MAAM,iBAAiB,CAAC,KAAK,IAAI,EAAE;gBACjC,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,wBAAwB,IAAI,CAAC,EAAE,2CAA2C,EAC1E,IAAI,CAAC,KAAK,CACX,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,IAAI,CAAC,qBAAqB,CAAC,CAAC;oBAC5B,OAAO;gBACT,CAAC;gBAED,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;oBACnC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;oBACzE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAChC,OAAO,CAAC,yBAAyB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1D,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CACF;YAED,mEAAmE;aAClE,OAAO,CACN,YAAY,EACZ,0EAA0E,EAC1E,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EACtF,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,IAA4B,CAAC;YAC1C,MAAM,iBAAiB,CAAC,KAAK,IAAI,EAAE;gBACjC,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,sBAAsB,IAAI,CAAC,EAAE,iFAAiF,EAC9G,IAAI,CAAC,KAAK,CACX,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,IAAI,CAAC,qBAAqB,CAAC,CAAC;oBAC5B,OAAO;gBACT,CAAC;gBAED,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;oBACnC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;oBACzE,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAChC,OAAO,CAAC,sBAAsB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC;gBAC7E,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CACF;aACA,aAAa,CAAC,CAAC,EAAE,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,GAAG,EAAE;QACZ,uCAAuC;IACzC,CAAC;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAgD;IACtE,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,2CAA2C;IACrD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACjB,OAAO,KAAK;aACT,OAAO,CAAC,gBAAgB,CAAC;aACzB,aAAa,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,GAAG,EAAE;QACZ,uCAAuC;IACzC,CAAC;CACF,CAAC"}

package/dist/cli/error-handler.d.ts

@@ -0,0 +1,31 @@
+/**
+ * CLI error handler — infrastructure commands only.
+ *
+ * Wraps command handlers to catch domain errors, displaying
+ * user-friendly messages with appropriate exit codes.
+ *
+ * Domain error detection uses constructor name suffix matching so all
+ * domain modules (organizations, applications, clients, users, RBAC,
+ * custom claims) are handled without importing every error class.
+ *
+ * Exit codes:
+ *   0 — success (set by withErrorHandling on normal completion)
+ *   1 — any error (domain error, unexpected error)
+ *
+ * @module cli/error-handler
+ */
+/**
+ * Wrap a command handler with error handling.
+ *
+ * Catches known domain errors and displays formatted messages.
+ * Unknown errors show a generic message. Verbose mode (--verbose)
+ * additionally prints the full stack trace to stderr.
+ *
+ * Always calls process.exit() — exit(0) on success, exit(1) on error.
+ * This ensures the CLI process terminates cleanly after each command.
+ *
+ * @param fn - The async command handler to execute
+ * @param verbose - Whether to show stack traces (from argv.verbose)
+ */
+export declare function withErrorHandling(fn: () => Promise<void>, verbose?: boolean): Promise<void>;
+//# sourceMappingURL=error-handler.d.ts.map

package/dist/cli/error-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/cli/error-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACvB,OAAO,UAAQ,GACd,OAAO,CAAC,IAAI,CAAC,CAgCf"}

package/dist/cli/error-handler.js

@@ -0,0 +1,65 @@
+/**
+ * CLI error handler — infrastructure commands only.
+ *
+ * Wraps command handlers to catch domain errors, displaying
+ * user-friendly messages with appropriate exit codes.
+ *
+ * Domain error detection uses constructor name suffix matching so all
+ * domain modules (organizations, applications, clients, users, RBAC,
+ * custom claims) are handled without importing every error class.
+ *
+ * Exit codes:
+ *   0 — success (set by withErrorHandling on normal completion)
+ *   1 — any error (domain error, unexpected error)
+ *
+ * @module cli/error-handler
+ */
+import { error } from './output.js';
+/**
+ * Wrap a command handler with error handling.
+ *
+ * Catches known domain errors and displays formatted messages.
+ * Unknown errors show a generic message. Verbose mode (--verbose)
+ * additionally prints the full stack trace to stderr.
+ *
+ * Always calls process.exit() — exit(0) on success, exit(1) on error.
+ * This ensures the CLI process terminates cleanly after each command.
+ *
+ * @param fn - The async command handler to execute
+ * @param verbose - Whether to show stack traces (from argv.verbose)
+ */
+export async function withErrorHandling(fn, verbose = false) {
+    try {
+        await fn();
+        process.exit(0);
+    }
+    catch (err) {
+        if (err instanceof Error) {
+            // ---------------------------------------------------------------
+            // Domain errors (from direct-DB commands like init/migrate)
+            // Detected by constructor name suffix to avoid importing every
+            // error class. All domain modules follow the naming convention:
+            // <Entity>NotFoundError, <Entity>ValidationError.
+            // ---------------------------------------------------------------
+            const name = err.constructor.name;
+            if (name.endsWith('NotFoundError')) {
+                error(`Not found: ${err.message}`);
+            }
+            else if (name.endsWith('ValidationError')) {
+                error(`Validation error: ${err.message}`);
+            }
+            else {
+                error(`Error: ${err.message}`);
+            }
+            // In verbose mode, print full stack trace to stderr for debugging
+            if (verbose && err.stack) {
+                console.error('\n' + err.stack);
+            }
+        }
+        else {
+            error('An unexpected error occurred');
+        }
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=error-handler.js.map

package/dist/cli/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/cli/error-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAuB,EACvB,OAAO,GAAG,KAAK;IAEf,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,kEAAkE;YAClE,4DAA4D;YAC5D,+DAA+D;YAC/D,gEAAgE;YAChE,kDAAkD;YAClD,kEAAkE;YAClE,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC;YAElC,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,cAAc,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACrC,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC5C,KAAK,CAAC,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACjC,CAAC;YAED,kEAAkE;YAClE,IAAI,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/**
+ * Porta server CLI entry point — infrastructure commands only.
+ *
+ * This is the reduced server-embedded CLI that ships inside the Docker image.
+ * It provides only direct-DB commands that need to run before or without
+ * the HTTP server (bootstrap, migrations, seed, health check, 2FA admin).
+ *
+ * All HTTP-based admin commands (org, app, client, user, keys, config,
+ * audit, sessions, stats, bulk, exports, provision) have been extracted
+ * to the standalone `@portaidentity/cli` package.
+ *
+ * Usage: porta <command> <subcommand> [options]
+ *
+ * Commands:
+ *   init       Bootstrap admin infrastructure (first-time setup)
+ *   migrate    Run database migrations (up/down/status)
+ *   seed       Load development seed data
+ *   health     Check server health (--direct mode, DB + Redis)
+ *   user       2FA admin commands (status/disable/reset --direct)
+ *
+ * Global options:
+ *   --json          Output in JSON format (default: table)
+ *   --verbose       Show detailed output including stack traces on error
+ *   --force         Skip confirmation prompts for destructive operations
+ *   --dry-run       Preview destructive operations without executing
+ *   --database-url  Override DATABASE_URL from .env
+ *   --redis-url     Override REDIS_URL from .env
+ */
+import { type Argv } from 'yargs';
+/** Global option types shared by all commands */
+export interface GlobalOptions {
+    json: boolean;
+    verbose: boolean;
+    force: boolean;
+    'dry-run': boolean;
+    'database-url'?: string;
+    'redis-url'?: string;
+}
+/**
+ * Build and configure the CLI application.
+ *
+ * Creates a yargs instance with all global options and command registrations.
+ * Separated from execution for testability — the entry point calls buildCli()
+ * then .parse(), while tests can inspect the builder without executing.
+ */
+export declare function buildCli(argv?: string[]): Argv<GlobalOptions>;
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAc,EAAE,KAAK,IAAI,EAAE,MAAM,OAAO,CAAC;AAQzC,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,CAmD7D"}

package/dist/cli/index.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+/**
+ * Porta server CLI entry point — infrastructure commands only.
+ *
+ * This is the reduced server-embedded CLI that ships inside the Docker image.
+ * It provides only direct-DB commands that need to run before or without
+ * the HTTP server (bootstrap, migrations, seed, health check, 2FA admin).
+ *
+ * All HTTP-based admin commands (org, app, client, user, keys, config,
+ * audit, sessions, stats, bulk, exports, provision) have been extracted
+ * to the standalone `@portaidentity/cli` package.
+ *
+ * Usage: porta <command> <subcommand> [options]
+ *
+ * Commands:
+ *   init       Bootstrap admin infrastructure (first-time setup)
+ *   migrate    Run database migrations (up/down/status)
+ *   seed       Load development seed data
+ *   health     Check server health (--direct mode, DB + Redis)
+ *   user       2FA admin commands (status/disable/reset --direct)
+ *
+ * Global options:
+ *   --json          Output in JSON format (default: table)
+ *   --verbose       Show detailed output including stack traces on error
+ *   --force         Skip confirmation prompts for destructive operations
+ *   --dry-run       Preview destructive operations without executing
+ *   --database-url  Override DATABASE_URL from .env
+ *   --redis-url     Override REDIS_URL from .env
+ */
+import yargs from 'yargs';
+import { hideBin } from 'yargs/helpers';
+import { initCommand } from './commands/init.js';
+import { migrateCommand } from './commands/migrate.js';
+import { seedCommand } from './commands/seed.js';
+import { healthCommand } from './commands/health.js';
+import { userCommand } from './commands/user-2fa.js';
+/**
+ * Build and configure the CLI application.
+ *
+ * Creates a yargs instance with all global options and command registrations.
+ * Separated from execution for testability — the entry point calls buildCli()
+ * then .parse(), while tests can inspect the builder without executing.
+ */
+export function buildCli(argv) {
+    const args = argv ?? hideBin(process.argv);
+    const cli = yargs(args)
+        .scriptName('porta')
+        .usage('$0 <command> [options]')
+        // Global options available to all commands
+        .option('json', {
+        type: 'boolean',
+        default: false,
+        description: 'Output in JSON format',
+    })
+        .option('verbose', {
+        type: 'boolean',
+        default: false,
+        description: 'Verbose output',
+    })
+        .option('force', {
+        type: 'boolean',
+        default: false,
+        description: 'Skip confirmation prompts',
+    })
+        .option('dry-run', {
+        type: 'boolean',
+        default: false,
+        description: 'Preview destructive operations',
+    })
+        .option('database-url', {
+        type: 'string',
+        description: 'PostgreSQL connection URL override',
+    })
+        .option('redis-url', {
+        type: 'string',
+        description: 'Redis connection URL override',
+    })
+        // Infrastructure commands (direct-DB only)
+        .command(initCommand)
+        .command(migrateCommand)
+        .command(seedCommand)
+        .command(healthCommand)
+        .command(userCommand)
+        .demandCommand(1, 'You need to specify a command')
+        .strict()
+        .help()
+        .version()
+        .epilogue('For full admin CLI (org, app, client, user, etc.), install @portaidentity/cli')
+        .wrap(Math.min(120, process.stdout.columns ?? 80));
+    return cli;
+}
+// Only execute when run directly (not when imported for testing)
+// Node ESM doesn't have require.main, so we check if the file is the entry point
+// by looking at process.argv — tsx and node both set argv[1] to the executed file
+const isDirectExecution = process.argv[1]?.includes('cli/index') || process.argv[1]?.endsWith('porta');
+if (isDirectExecution) {
+    await buildCli().parse();
+}
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAoB,MAAM,OAAO,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAYrD;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAe;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;SACpB,UAAU,CAAC,OAAO,CAAC;SACnB,KAAK,CAAC,wBAAwB,CAAC;QAChC,2CAA2C;SAC1C,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,uBAAuB;KACrC,CAAC;SACD,MAAM,CAAC,SAAS,EAAE;QACjB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,gBAAgB;KAC9B,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,2BAA2B;KACzC,CAAC;SACD,MAAM,CAAC,SAAS,EAAE;QACjB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,gCAAgC;KAC9C,CAAC;SACD,MAAM,CAAC,cAAc,EAAE;QACtB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,oCAAoC;KAClD,CAAC;SACD,MAAM,CAAC,WAAW,EAAE;QACnB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,+BAA+B;KAC7C,CAAC;QACF,2CAA2C;SAC1C,OAAO,CAAC,WAAW,CAAC;SACpB,OAAO,CAAC,cAAc,CAAC;SACvB,OAAO,CAAC,WAAW,CAAC;SACpB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,WAAW,CAAC;SACpB,aAAa,CAAC,CAAC,EAAE,+BAA+B,CAAC;SACjD,MAAM,EAAE;SACR,IAAI,EAAE;SACN,OAAO,EAAE;SACT,QAAQ,CACP,+EAA+E,CAChF;SACA,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAErD,OAAO,GAA0B,CAAC;AACpC,CAAC;AAED,iEAAiE;AACjE,iFAAiF;AACjF,kFAAkF;AAClF,MAAM,iBAAiB,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;AAE/E,IAAI,iBAAiB,EAAE,CAAC;IACtB,MAAM,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC"}