@portaidentity/server 1.7.0

package/dist/clients/service.js

@@ -0,0 +1,523 @@
+/**
+ * Client service — business logic orchestrator.
+ *
+ * Composes the repository, cache, validators, crypto utilities, and audit log
+ * to provide the complete client management API. All write operations follow:
+ *   1. Validate inputs (org, app, URIs)
+ *   2. Perform DB operation (via repository)
+ *   3. Invalidate + re-cache (via cache)
+ *   4. Write audit log (fire-and-forget)
+ *
+ * Read operations check cache first, fall back to DB on miss.
+ *
+ * Status lifecycle:
+ *   - activate:   inactive → active
+ *   - deactivate: active → inactive
+ *   - revoke:     active|inactive → revoked (permanent, cannot be undone)
+ *
+ * The findForOidc() function maps internal Client objects to oidc-provider
+ * metadata format, used by the adapter factory during OIDC operations.
+ */
+import { LOGIN_METHODS } from './types.js';
+import { insertClient, findClientById, findClientByClientId, updateClient as repoUpdateClient, listClients as repoListClients, listClientsCursor as repoListClientsCursor, } from './repository.js';
+import { getLatestActiveSha256 } from './secret-repository.js';
+import { getCachedClientByClientId, getCachedClientById, cacheClient, invalidateClientCache, } from './cache.js';
+import { generateClientId } from './crypto.js';
+import { validateRedirectUris, getDefaultGrantTypes, getDefaultTokenEndpointAuthMethod, getDefaultResponseTypes, getDefaultScope, } from './validators.js';
+import { normalizeLoginMethods } from './resolve-login-methods.js';
+import { verify } from './secret-service.js';
+import { writeAuditLog } from '../lib/audit-log.js';
+import { ClientNotFoundError, ClientValidationError } from './errors.js';
+import { getApplicationById } from '../applications/service.js';
+import { getOrganizationById } from '../organizations/service.js';
+// ===========================================================================
+// Validation helpers (private)
+// ===========================================================================
+/**
+ * Validate + normalize a client-level `loginMethods` override.
+ *
+ * Three-state input:
+ *   - `undefined` → returns `undefined` (caller must preserve "leave alone"
+ *     semantics on update and "inherit from org default" on create)
+ *   - `null` → returns `null` (caller clears the override / inherits)
+ *   - non-empty array → returns the normalized (deduplicated, order-preserving)
+ *     array with only recognized {@link LoginMethod} entries
+ *
+ * Throws {@link ClientValidationError} when:
+ *   - the value is neither `undefined`, `null`, nor an array
+ *   - the array is empty (empty = "no login possible" and is never valid)
+ *   - any element is not a valid {@link LoginMethod}
+ *
+ * Empty arrays are rejected explicitly so the DB column carries either
+ * "override present with ≥1 method" or "null = inherit". This mirrors the
+ * contract documented on `UpdateClientInput.loginMethods`.
+ */
+function validateClientLoginMethods(methods) {
+    if (methods === undefined)
+        return undefined;
+    if (methods === null)
+        return null;
+    if (!Array.isArray(methods) || methods.length === 0) {
+        throw new ClientValidationError('loginMethods: must be a non-empty array, null, or omitted');
+    }
+    for (const m of methods) {
+        if (!LOGIN_METHODS.includes(m)) {
+            throw new ClientValidationError(`loginMethods: invalid method "${String(m)}"`);
+        }
+    }
+    return normalizeLoginMethods(methods);
+}
+// ===========================================================================
+// Client CRUD
+// ===========================================================================
+// ---------------------------------------------------------------------------
+// Create
+// ---------------------------------------------------------------------------
+/**
+ * Create a new OIDC client.
+ *
+ * Flow:
+ * 1. Validate organization exists and is active
+ * 2. Validate application exists and is active
+ * 3. Validate redirect URIs
+ * 4. Apply defaults (grant types, response types, scope, auth method, PKCE)
+ * 5. Generate cryptographically random client_id
+ * 6. Insert client row
+ * 7. Cache the client
+ * 8. Write audit log
+ * 9. Return ClientWithSecret (secret is null for public clients;
+ *    for confidential clients, the caller must generate the initial
+ *    secret separately via the secret service)
+ *
+ * @param input - Client creation data
+ * @param actorId - UUID of the user performing the action (for audit)
+ * @returns Created client wrapped in ClientWithSecret (secret always null here)
+ * @throws ClientValidationError if org/app invalid or URIs fail validation
+ */
+export async function createClient(input, actorId) {
+    // Validate organization exists and is active
+    const org = await getOrganizationById(input.organizationId);
+    if (!org) {
+        throw new ClientValidationError('Organization not found');
+    }
+    if (org.status !== 'active') {
+        throw new ClientValidationError('Organization is not active');
+    }
+    // Validate application exists and is active
+    const app = await getApplicationById(input.applicationId);
+    if (!app) {
+        throw new ClientValidationError('Application not found');
+    }
+    if (app.status !== 'active') {
+        throw new ClientValidationError('Application is not active');
+    }
+    // Validate redirect URIs
+    // Use non-production mode for validation (production mode enforcement
+    // is done at the API layer based on environment config)
+    const uriValidation = validateRedirectUris(input.redirectUris, false);
+    if (!uriValidation.isValid) {
+        throw new ClientValidationError(`Invalid redirect URIs: ${uriValidation.errors.join('; ')}`);
+    }
+    // Apply defaults for optional fields
+    const grantTypes = input.grantTypes ??
+        getDefaultGrantTypes(input.clientType, input.applicationType);
+    const responseTypes = input.responseTypes ?? getDefaultResponseTypes();
+    const scope = input.scope ?? getDefaultScope();
+    const tokenEndpointAuthMethod = input.tokenEndpointAuthMethod ??
+        getDefaultTokenEndpointAuthMethod(input.clientType);
+    const requirePkce = input.requirePkce ?? true;
+    // Validate + normalize the login-method override (may throw). Three-state
+    // input: undefined → column omitted → DB DEFAULT NULL → inherit.
+    // null → inherit explicitly. Array → override with validated methods.
+    const loginMethods = validateClientLoginMethods(input.loginMethods);
+    // Generate a unique OIDC client_id
+    const clientId = generateClientId();
+    // Insert into database
+    const client = await insertClient({
+        organizationId: input.organizationId,
+        applicationId: input.applicationId,
+        clientId,
+        clientName: input.clientName,
+        clientType: input.clientType,
+        applicationType: input.applicationType,
+        redirectUris: input.redirectUris,
+        postLogoutRedirectUris: input.postLogoutRedirectUris ?? [],
+        grantTypes,
+        responseTypes,
+        scope,
+        tokenEndpointAuthMethod,
+        allowedOrigins: input.allowedOrigins ?? [],
+        requirePkce,
+        // Pass through validated value as-is: `undefined` triggers column
+        // omission (DB default), `null` inserts NULL explicitly, array inserts
+        // the validated methods. The repo honors all three states.
+        ...(loginMethods !== undefined ? { loginMethods } : {}),
+    });
+    // Cache the new client
+    await cacheClient(client);
+    // Audit log (fire-and-forget) — include the persisted loginMethods value
+    // so operator history captures whether the client inherits or overrides.
+    await writeAuditLog({
+        organizationId: input.organizationId,
+        eventType: 'client.created',
+        eventCategory: 'admin',
+        actorId,
+        metadata: {
+            clientDbId: client.id,
+            clientId: client.clientId,
+            clientName: client.clientName,
+            clientType: client.clientType,
+            applicationType: client.applicationType,
+            applicationId: input.applicationId,
+            loginMethods: client.loginMethods,
+        },
+    });
+    // Return without secret — caller must use secret service for confidential clients
+    return { client, secret: null };
+}
+// ---------------------------------------------------------------------------
+// Read
+// ---------------------------------------------------------------------------
+/**
+ * Find a client by internal UUID.
+ * Checks Redis cache first, falls back to database on miss.
+ *
+ * @param id - Client internal UUID
+ * @returns Client or null if not found
+ */
+export async function getClientById(id) {
+    // Try cache first
+    const cached = await getCachedClientById(id);
+    if (cached)
+        return cached;
+    // Fall back to database
+    const client = await findClientById(id);
+    if (client) {
+        await cacheClient(client);
+    }
+    return client;
+}
+/**
+ * Find a client by OIDC client_id.
+ * Checks Redis cache first, falls back to database on miss.
+ *
+ * @param clientId - OIDC client_id (public identifier)
+ * @returns Client or null if not found
+ */
+export async function getClientByClientId(clientId) {
+    // Try cache first
+    const cached = await getCachedClientByClientId(clientId);
+    if (cached)
+        return cached;
+    // Fall back to database
+    const client = await findClientByClientId(clientId);
+    if (client) {
+        await cacheClient(client);
+    }
+    return client;
+}
+// ---------------------------------------------------------------------------
+// Update
+// ---------------------------------------------------------------------------
+/**
+ * Update a client's configurable fields.
+ *
+ * Validates redirect URIs if they are being changed.
+ *
+ * @param id - Client internal UUID
+ * @param input - Fields to update
+ * @param actorId - UUID of the user performing the action
+ * @returns Updated client
+ * @throws ClientNotFoundError if client not found
+ * @throws ClientValidationError if redirect URIs are invalid
+ */
+export async function updateClient(id, input, actorId) {
+    // Validate redirect URIs if provided
+    if (input.redirectUris) {
+        const uriValidation = validateRedirectUris(input.redirectUris, false);
+        if (!uriValidation.isValid) {
+            throw new ClientValidationError(`Invalid redirect URIs: ${uriValidation.errors.join('; ')}`);
+        }
+    }
+    // Build update data from input
+    const updateData = {};
+    if (input.clientName !== undefined)
+        updateData.clientName = input.clientName;
+    if (input.redirectUris !== undefined)
+        updateData.redirectUris = input.redirectUris;
+    if (input.postLogoutRedirectUris !== undefined)
+        updateData.postLogoutRedirectUris = input.postLogoutRedirectUris;
+    if (input.grantTypes !== undefined)
+        updateData.grantTypes = input.grantTypes;
+    if (input.responseTypes !== undefined)
+        updateData.responseTypes = input.responseTypes;
+    if (input.scope !== undefined)
+        updateData.scope = input.scope;
+    if (input.tokenEndpointAuthMethod !== undefined)
+        updateData.tokenEndpointAuthMethod = input.tokenEndpointAuthMethod;
+    if (input.allowedOrigins !== undefined)
+        updateData.allowedOrigins = input.allowedOrigins;
+    if (input.requirePkce !== undefined)
+        updateData.requirePkce = input.requirePkce;
+    // Validate + normalize the login-method override if the caller passed the
+    // key (including `null` = clear). Capture the previous value first for the
+    // audit log diff — we use the cache-aware accessor so stale reads don't
+    // sneak in; if the client doesn't exist the repo update below will throw
+    // and we short-circuit before audit.
+    let previousLoginMethods;
+    if (Object.prototype.hasOwnProperty.call(input, 'loginMethods')) {
+        const normalized = validateClientLoginMethods(input.loginMethods);
+        // normalized is either null or a validated array here (undefined is only
+        // returned when the key is absent, which we already filtered out).
+        updateData.loginMethods = normalized;
+        const existing = await getClientById(id);
+        if (existing) {
+            previousLoginMethods = existing.loginMethods;
+        }
+    }
+    let client;
+    try {
+        client = await repoUpdateClient(id, updateData);
+    }
+    catch (err) {
+        if (err instanceof Error && err.message === 'Client not found') {
+            throw new ClientNotFoundError(id);
+        }
+        throw err;
+    }
+    // Invalidate old cache and re-cache the updated version
+    await invalidateClientCache(client.clientId, client.id);
+    await cacheClient(client);
+    // Audit log (fire-and-forget) — record the old → new login-methods
+    // transition only when the field actually changed, so audit history
+    // stays readable for updates that touch other fields.
+    const auditMetadata = {
+        clientDbId: client.id,
+        clientId: client.clientId,
+        fields: Object.keys(updateData),
+    };
+    if (previousLoginMethods !== undefined) {
+        auditMetadata.previousLoginMethods = previousLoginMethods;
+        auditMetadata.newLoginMethods = client.loginMethods;
+    }
+    await writeAuditLog({
+        organizationId: client.organizationId,
+        eventType: 'client.updated',
+        eventCategory: 'admin',
+        actorId,
+        metadata: auditMetadata,
+    });
+    return client;
+}
+// ---------------------------------------------------------------------------
+// List
+// ---------------------------------------------------------------------------
+/**
+ * List clients by organization with pagination.
+ *
+ * @param organizationId - Organization UUID
+ * @param options - Pagination and sort options
+ * @returns Paginated result
+ */
+export async function listClientsByOrganization(organizationId, options) {
+    return repoListClients({ ...options, organizationId });
+}
+/**
+ * List clients by application with pagination.
+ *
+ * @param applicationId - Application UUID
+ * @param options - Pagination and sort options
+ * @returns Paginated result
+ */
+export async function listClientsByApplication(applicationId, options) {
+    return repoListClients({ ...options, applicationId });
+}
+/**
+ * List clients with cursor-based keyset pagination.
+ * Supports all existing filters (org, app, status, search).
+ *
+ * @param options - Cursor, limit, filter, and sort options
+ * @returns Cursor-paginated result with nextCursor/hasMore
+ */
+export async function listClientsCursor(options) {
+    return repoListClientsCursor(options);
+}
+// ===========================================================================
+// Status lifecycle
+// ===========================================================================
+/**
+ * Load and validate a client exists before a status change.
+ * @throws ClientNotFoundError if not found
+ */
+async function loadClientForStatusChange(id) {
+    const client = await findClientById(id);
+    if (!client)
+        throw new ClientNotFoundError(id);
+    return client;
+}
+/**
+ * Deactivate a client (active → inactive).
+ *
+ * @param id - Client internal UUID
+ * @param actorId - UUID of the user performing the action
+ * @throws ClientNotFoundError if not found
+ * @throws ClientValidationError if not currently active
+ */
+export async function deactivateClient(id, actorId) {
+    const client = await loadClientForStatusChange(id);
+    if (client.status !== 'active') {
+        throw new ClientValidationError(`Cannot deactivate client from status: ${client.status}`);
+    }
+    await repoUpdateClient(id, { status: 'inactive' });
+    await invalidateClientCache(client.clientId, client.id);
+    await writeAuditLog({
+        organizationId: client.organizationId,
+        eventType: 'client.deactivated',
+        eventCategory: 'admin',
+        actorId,
+        metadata: { clientDbId: client.id, clientId: client.clientId },
+    });
+}
+/**
+ * Activate a client (inactive → active).
+ *
+ * @param id - Client internal UUID
+ * @param actorId - UUID of the user performing the action
+ * @throws ClientNotFoundError if not found
+ * @throws ClientValidationError if not currently inactive
+ */
+export async function activateClient(id, actorId) {
+    const client = await loadClientForStatusChange(id);
+    if (client.status !== 'inactive') {
+        throw new ClientValidationError(`Cannot activate client from status: ${client.status}`);
+    }
+    await repoUpdateClient(id, { status: 'active' });
+    await invalidateClientCache(client.clientId, client.id);
+    await writeAuditLog({
+        organizationId: client.organizationId,
+        eventType: 'client.activated',
+        eventCategory: 'admin',
+        actorId,
+        metadata: { clientDbId: client.id, clientId: client.clientId },
+    });
+}
+/**
+ * Revoke a client (active or inactive → revoked).
+ *
+ * Revocation is permanent — revoked clients cannot be reactivated.
+ * This effectively disables the client for all OIDC operations.
+ *
+ * @param id - Client internal UUID
+ * @param actorId - UUID of the user performing the action
+ * @throws ClientNotFoundError if not found
+ * @throws ClientValidationError if already revoked
+ */
+export async function revokeClient(id, actorId) {
+    const client = await loadClientForStatusChange(id);
+    if (client.status === 'revoked') {
+        throw new ClientValidationError('Client is already revoked');
+    }
+    await repoUpdateClient(id, { status: 'revoked' });
+    await invalidateClientCache(client.clientId, client.id);
+    await writeAuditLog({
+        organizationId: client.organizationId,
+        eventType: 'client.revoked',
+        eventCategory: 'admin',
+        actorId,
+        metadata: {
+            clientDbId: client.id,
+            clientId: client.clientId,
+            previousStatus: client.status,
+        },
+    });
+}
+// ===========================================================================
+// OIDC integration
+// ===========================================================================
+/**
+ * Find a client by OIDC client_id and return oidc-provider metadata format.
+ *
+ * This function is the bridge between Porta's internal client model and
+ * the metadata shape expected by node-oidc-provider. It's called by the
+ * adapter factory during OIDC flows (authorization, token exchange, etc.).
+ *
+ * Returns undefined (not null) for compatibility with oidc-provider which
+ * expects undefined for "client not found".
+ *
+ * @param clientId - OIDC client_id
+ * @returns OIDC client metadata object, or undefined if not found/inactive
+ */
+export async function findForOidc(clientId) {
+    const client = await getClientByClientId(clientId);
+    // Client must exist and be active for OIDC operations
+    if (!client || client.status !== 'active') {
+        return undefined;
+    }
+    // Build base oidc-provider metadata
+    const metadata = {
+        client_id: client.clientId,
+        client_name: client.clientName,
+        application_type: client.applicationType,
+        redirect_uris: client.redirectUris,
+        post_logout_redirect_uris: client.postLogoutRedirectUris,
+        grant_types: client.grantTypes,
+        response_types: client.responseTypes,
+        scope: client.scope,
+        token_endpoint_auth_method: client.clientType === 'public'
+            ? 'none'
+            : client.tokenEndpointAuthMethod,
+        // Porta uses ES256 signing keys — must declare this explicitly
+        // or oidc-provider defaults to RS256 and rejects the client.
+        id_token_signed_response_alg: 'ES256',
+        // allowed_origins needed for CORS checks on OIDC endpoints
+        'urn:porta:allowed_origins': client.allowedOrigins,
+        // Client type for internal use
+        'urn:porta:client_type': client.clientType,
+        // Per-client login-methods override. Null means "inherit org default";
+        // a non-null array is the validated override. The OIDC configuration
+        // layer registers this URN under `extraClientMetadata.properties` so
+        // oidc-provider preserves it on the client metadata object passed to
+        // the interaction handlers — where `resolveLoginMethodsFromOidcClient()`
+        // combines it with the org default to compute the effective methods.
+        'urn:porta:login_methods': client.loginMethods,
+        // Organization ID — used by auto-consent logic in showConsent() to
+        // identify first-party clients (same org → skip consent screen)
+        organizationId: client.organizationId,
+    };
+    // For confidential clients, include the SHA-256 hash as client_secret.
+    // oidc-provider will compare this against the SHA-256 of the presented
+    // secret (pre-hashed by the client-secret-hash middleware).
+    if (client.clientType === 'confidential') {
+        const sha256Hash = await getLatestActiveSha256(client.id);
+        if (sha256Hash) {
+            metadata.client_secret = sha256Hash;
+        }
+    }
+    return metadata;
+}
+/**
+ * Verify a client secret for OIDC authentication.
+ *
+ * Convenience wrapper around secret-service.verify() that resolves the
+ * internal DB id from the OIDC client_id and performs guard checks:
+ * - Client must exist and be active
+ * - Client must be confidential (public clients have no secrets)
+ *
+ * Used during token endpoint authentication via the admin API.
+ *
+ * @param clientId - The OIDC client_id (external identifier)
+ * @param plaintext - The presented secret to verify
+ * @returns true if secret matches any active hash, false otherwise
+ */
+export async function verifyClientSecret(clientId, plaintext) {
+    const client = await getClientByClientId(clientId);
+    // Client must exist and be active
+    if (!client || client.status !== 'active')
+        return false;
+    // Public clients should not have secrets — reject verification attempts
+    if (client.clientType === 'public')
+        return false;
+    // Delegate to secret-service which checks all active, non-expired hashes
+    return verify(client.id, plaintext);
+}
+//# sourceMappingURL=service.js.map

package/dist/clients/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/clients/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,YAAY,IAAI,gBAAgB,EAChC,WAAW,IAAI,eAAe,EAC9B,iBAAiB,IAAI,qBAAqB,GAC3C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,WAAW,EACX,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,iCAAiC,EACjC,uBAAuB,EACvB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,0BAA0B,CACjC,OAAyC;IAEzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,qBAAqB,CAC7B,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,qBAAqB,CAC7B,iCAAiC,MAAM,CAAC,CAAC,CAAC,GAAG,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAGD,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAwB,EACxB,OAAgB;IAEhB,6CAA6C;IAC7C,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,4BAA4B,CAAC,CAAC;IAChE,CAAC;IAED,4CAA4C;IAC5C,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IAED,yBAAyB;IACzB,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,qBAAqB,CAC7B,0BAA0B,aAAa,CAAC,MAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU;QACjC,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,uBAAuB,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;IAC/C,MAAM,uBAAuB,GAAG,KAAK,CAAC,uBAAuB;QAC3D,iCAAiC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;IAE9C,0EAA0E;IAC1E,iEAAiE;IACjE,sEAAsE;IACtE,MAAM,YAAY,GAAG,0BAA0B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEpE,mCAAmC;IACnC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IAEpC,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,QAAQ;QACR,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,IAAI,EAAE;QAC1D,UAAU;QACV,aAAa;QACb,KAAK;QACL,uBAAuB;QACvB,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;QAC1C,WAAW;QACX,kEAAkE;QAClE,uEAAuE;QACvE,2DAA2D;QAC3D,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IAEH,uBAAuB;IACvB,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAE1B,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,gBAAgB;QAC3B,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE;YACR,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC;KACF,CAAC,CAAC;IAEH,kFAAkF;IAClF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAGD,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAU;IAC5C,kBAAkB;IAClB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,wBAAwB;IACxB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,kBAAkB;IAClB,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,wBAAwB;IACxB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAU,EACV,KAAwB,EACxB,OAAgB;IAEhB,qCAAqC;IACrC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,qBAAqB,CAC7B,0BAA0B,aAAa,CAAC,MAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAC7E,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,UAAU,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACnF,IAAI,KAAK,CAAC,sBAAsB,KAAK,SAAS;QAAE,UAAU,CAAC,sBAAsB,GAAG,KAAK,CAAC,sBAAsB,CAAC;IACjH,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAC7E,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;QAAE,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IACtF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,uBAAuB,KAAK,SAAS;QAAE,UAAU,CAAC,uBAAuB,GAAG,KAAK,CAAC,uBAAuB,CAAC;IACpH,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,UAAU,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IACzF,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAEhF,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,oBAAsD,CAAC;IAC3D,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;QAChE,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClE,yEAAyE;QACzE,mEAAmE;QACnE,UAAU,CAAC,YAAY,GAAG,UAAU,CAAC;QAErC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,oBAAoB,GAAG,QAAQ,CAAC,YAAY,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;YAC/D,MAAM,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,wDAAwD;IACxD,MAAM,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAE1B,mEAAmE;IACnE,oEAAoE;IACpE,sDAAsD;IACtD,MAAM,aAAa,GAA4B;QAC7C,UAAU,EAAE,MAAM,CAAC,EAAE;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;KAChC,CAAC;IACF,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,aAAa,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QAC1D,aAAa,CAAC,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC;IACtD,CAAC;IAED,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,gBAAgB;QAC3B,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAGD,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,cAAsB,EACtB,OAAmD;IAEnD,OAAO,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB,EACrB,OAAkD;IAElD,OAAO,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC;IAEjC,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;GAGG;AACH,KAAK,UAAU,yBAAyB,CAAC,EAAU;IACjD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAEnD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,qBAAqB,CAC7B,yCAAyC,MAAM,CAAC,MAAM,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAExD,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAU,EACV,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAEnD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,qBAAqB,CAC7B,uCAAuC,MAAM,CAAC,MAAM,EAAE,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjD,MAAM,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAExD,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,kBAAkB;QAC7B,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAU,EACV,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAEnD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAClD,MAAM,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAExD,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,gBAAgB;QAC3B,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE;YACR,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,MAAM,CAAC,MAAM;SAC9B;KACF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAEnD,sDAAsD;IACtD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,oCAAoC;IACpC,MAAM,QAAQ,GAA4B;QACxC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,gBAAgB,EAAE,MAAM,CAAC,eAAe;QACxC,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,yBAAyB,EAAE,MAAM,CAAC,sBAAsB;QACxD,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,cAAc,EAAE,MAAM,CAAC,aAAa;QACpC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,0BAA0B,EAAE,MAAM,CAAC,UAAU,KAAK,QAAQ;YACxD,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,MAAM,CAAC,uBAAuB;QAClC,+DAA+D;QAC/D,6DAA6D;QAC7D,4BAA4B,EAAE,OAAO;QACrC,2DAA2D;QAC3D,2BAA2B,EAAE,MAAM,CAAC,cAAc;QAClD,+BAA+B;QAC/B,uBAAuB,EAAE,MAAM,CAAC,UAAU;QAC1C,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,qEAAqE;QACrE,yBAAyB,EAAE,MAAM,CAAC,YAAY;QAC9C,mEAAmE;QACnE,gEAAgE;QAChE,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IAGF,uEAAuE;IACvE,uEAAuE;IACvE,4DAA4D;IAC5D,IAAI,MAAM,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CAAC,aAAa,GAAG,UAAU,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAEnD,kCAAkC;IAClC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAExD,wEAAwE;IACxE,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEjD,yEAAyE;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;AACtC,CAAC"}