@portaidentity/server 1.7.0

package/dist/clients/types.d.ts

@@ -0,0 +1,214 @@
+/**
+ * Client types, interfaces, and row mapping functions.
+ *
+ * Defines the shape of OIDC client registrations and their secrets.
+ * Clients are scoped to an organization + application pair and represent
+ * deployment targets (web, mobile, SPA).
+ *
+ * Row mapping functions convert snake_case DB rows to camelCase domain
+ * objects. Array columns (TEXT[]) from PostgreSQL are handled directly —
+ * pg returns them as JavaScript arrays.
+ */
+/** Client type — confidential (has secret) or public (no secret) */
+export type ClientType = 'confidential' | 'public';
+/** Application type — how the client is deployed */
+export type ApplicationType = 'web' | 'native' | 'spa';
+/** Client status values */
+export type ClientStatus = 'active' | 'inactive' | 'revoked';
+/** Secret status values */
+export type SecretStatus = 'active' | 'revoked';
+/**
+ * Supported login methods.
+ *
+ * This is an extensible union — future methods (e.g., `'sso'`, `'passkey'`)
+ * can be added here. The set of currently valid values is mirrored in
+ * {@link LOGIN_METHODS} for runtime validation.
+ */
+export type LoginMethod = 'password' | 'magic_link';
+/**
+ * Runtime list of all currently valid {@link LoginMethod} values.
+ *
+ * Used by validation helpers in the organizations / clients service layers
+ * and by the CLI flag parser to validate user-supplied input.
+ */
+export declare const LOGIN_METHODS: readonly LoginMethod[];
+/** Full client record (camelCase) */
+export interface Client {
+    id: string;
+    organizationId: string;
+    applicationId: string;
+    clientId: string;
+    clientName: string;
+    clientType: ClientType;
+    applicationType: ApplicationType;
+    redirectUris: string[];
+    postLogoutRedirectUris: string[];
+    grantTypes: string[];
+    responseTypes: string[];
+    scope: string;
+    tokenEndpointAuthMethod: string;
+    allowedOrigins: string[];
+    requirePkce: boolean;
+    /**
+     * Per-client login-method override.
+     *   - `null` → inherit from the organization's `defaultLoginMethods`
+     *   - non-empty array → use these methods exclusively
+     *
+     * An empty array is never persisted (rejected by the service layer). The
+     * {@link ./resolve-login-methods.ts | resolveLoginMethods} helper combines
+     * this with the org default to produce the effective methods for render
+     * and enforcement.
+     */
+    loginMethods: LoginMethod[] | null;
+    status: ClientStatus;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** Client secret record (camelCase) — secret_hash is NEVER exposed via this type */
+export interface ClientSecret {
+    id: string;
+    clientId: string;
+    label: string | null;
+    expiresAt: Date | null;
+    status: SecretStatus;
+    lastUsedAt: Date | null;
+    createdAt: Date;
+}
+/** Returned only once at secret creation time */
+export interface SecretWithPlaintext {
+    id: string;
+    clientId: string;
+    label: string | null;
+    plaintext: string;
+    expiresAt: Date | null;
+    createdAt: Date;
+}
+/** Returned when creating a confidential client */
+export interface ClientWithSecret {
+    client: Client;
+    secret: SecretWithPlaintext | null;
+}
+/** Input for creating a new client */
+export interface CreateClientInput {
+    organizationId: string;
+    applicationId: string;
+    clientName: string;
+    clientType: ClientType;
+    applicationType: ApplicationType;
+    redirectUris: string[];
+    postLogoutRedirectUris?: string[];
+    grantTypes?: string[];
+    responseTypes?: string[];
+    scope?: string;
+    tokenEndpointAuthMethod?: string;
+    allowedOrigins?: string[];
+    requirePkce?: boolean;
+    secretLabel?: string;
+    /**
+     * Optional per-client login-method override set at creation time.
+     *   - omitted → field persists as `null` (inherit from org default)
+     *   - explicit `null` → same as omitted (inherit)
+     *   - non-empty array → use these methods exclusively
+     *
+     * The service layer validates and normalizes the value. Empty arrays are
+     * rejected; an empty array means "no login possible" and is never valid.
+     */
+    loginMethods?: LoginMethod[] | null;
+}
+/** Input for updating a client (partial) */
+export interface UpdateClientInput {
+    clientName?: string;
+    redirectUris?: string[];
+    postLogoutRedirectUris?: string[];
+    grantTypes?: string[];
+    responseTypes?: string[];
+    scope?: string;
+    tokenEndpointAuthMethod?: string;
+    allowedOrigins?: string[];
+    requirePkce?: boolean;
+    /**
+     * Per-client login-method override. Three-state input:
+     *   - `undefined` → leave the current value alone (partial update)
+     *   - `null` → clear any existing override (revert to inheriting org default)
+     *   - non-empty array → replace with these methods
+     *
+     * Empty arrays are rejected by the service validator.
+     */
+    loginMethods?: LoginMethod[] | null;
+}
+/** Input for creating a secret */
+export interface CreateSecretInput {
+    label?: string;
+    expiresAt?: Date;
+}
+/** Options for listing clients */
+export interface ListClientsOptions {
+    page: number;
+    pageSize: number;
+    organizationId?: string;
+    applicationId?: string;
+    status?: ClientStatus;
+    search?: string;
+    sortBy?: 'client_name' | 'created_at';
+    sortOrder?: 'asc' | 'desc';
+}
+/** Paginated result (reusable generic) */
+export interface PaginatedResult<T> {
+    data: T[];
+    total: number;
+    page: number;
+    pageSize: number;
+    totalPages: number;
+}
+/** Raw row from the clients table */
+export interface ClientRow {
+    id: string;
+    organization_id: string;
+    application_id: string;
+    client_id: string;
+    client_name: string;
+    client_type: string;
+    application_type: string;
+    redirect_uris: string[];
+    post_logout_redirect_uris: string[];
+    grant_types: string[];
+    response_types: string[];
+    scope: string;
+    token_endpoint_auth_method: string;
+    allowed_origins: string[];
+    require_pkce: boolean;
+    /**
+     * Nullable TEXT[] column. `null` means "inherit org default".
+     * Stored as-is by pg; the domain mapper preserves the null sentinel.
+     */
+    login_methods: string[] | null;
+    status: string;
+    created_at: Date;
+    updated_at: Date;
+}
+/** Raw row from the client_secrets table */
+export interface ClientSecretRow {
+    id: string;
+    client_id: string;
+    secret_hash: string;
+    label: string | null;
+    expires_at: Date | null;
+    status: string;
+    last_used_at: Date | null;
+    created_at: Date;
+}
+/**
+ * Map a snake_case client row to a camelCase Client object.
+ *
+ * Array columns (redirect_uris, grant_types, etc.) are returned as
+ * JavaScript arrays by the pg driver — no parsing needed.
+ */
+export declare function mapRowToClient(row: ClientRow): Client;
+/**
+ * Map a snake_case client_secrets row to a camelCase ClientSecret object.
+ *
+ * IMPORTANT: The secret_hash field is intentionally excluded from the
+ * mapped output. Secret hashes should never leave the repository layer.
+ */
+export declare function mapRowToClientSecret(row: ClientSecretRow): ClientSecret;
+//# sourceMappingURL=types.d.ts.map

package/dist/clients/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/clients/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,oEAAoE;AACpE,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC;AAEnD,oDAAoD;AACpD,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEvD,2BAA2B;AAC3B,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7D,2BAA2B;AAC3B,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,YAAY,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAGtC,CAAC;AAOX,qCAAqC;AACrC,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,uBAAuB,EAAE,MAAM,CAAC;IAChC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;OASG;IACH,YAAY,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAGD,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACpC;AAMD,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;CACrC;AAED,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;CACrC;AAGD,kCAAkC;AAClC,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,kCAAkC;AAClC,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IACtC,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC5B;AAED,0CAA0C;AAC1C,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,qCAAqC;AACrC,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B,EAAE,MAAM,CAAC;IACnC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAGD,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,CAAC;CAClB;AAMD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA4BrD;AAGD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,GAAG,YAAY,CAUvE"}

package/dist/clients/types.js

@@ -0,0 +1,77 @@
+/**
+ * Client types, interfaces, and row mapping functions.
+ *
+ * Defines the shape of OIDC client registrations and their secrets.
+ * Clients are scoped to an organization + application pair and represent
+ * deployment targets (web, mobile, SPA).
+ *
+ * Row mapping functions convert snake_case DB rows to camelCase domain
+ * objects. Array columns (TEXT[]) from PostgreSQL are handled directly —
+ * pg returns them as JavaScript arrays.
+ */
+/**
+ * Runtime list of all currently valid {@link LoginMethod} values.
+ *
+ * Used by validation helpers in the organizations / clients service layers
+ * and by the CLI flag parser to validate user-supplied input.
+ */
+export const LOGIN_METHODS = [
+    'password',
+    'magic_link',
+];
+// ===========================================================================
+// Row mapping functions
+// ===========================================================================
+/**
+ * Map a snake_case client row to a camelCase Client object.
+ *
+ * Array columns (redirect_uris, grant_types, etc.) are returned as
+ * JavaScript arrays by the pg driver — no parsing needed.
+ */
+export function mapRowToClient(row) {
+    return {
+        id: row.id,
+        organizationId: row.organization_id,
+        applicationId: row.application_id,
+        clientId: row.client_id,
+        clientName: row.client_name,
+        clientType: row.client_type,
+        applicationType: row.application_type,
+        redirectUris: row.redirect_uris ?? [],
+        postLogoutRedirectUris: row.post_logout_redirect_uris ?? [],
+        grantTypes: row.grant_types ?? [],
+        responseTypes: row.response_types ?? [],
+        scope: row.scope,
+        tokenEndpointAuthMethod: row.token_endpoint_auth_method,
+        allowedOrigins: row.allowed_origins ?? [],
+        requirePkce: row.require_pkce,
+        // Preserve the null sentinel — null means "inherit org default".
+        // When non-null, the DB column is a TEXT[] of valid LoginMethod values
+        // (enforced by the service-layer validator on write). Cast is safe because
+        // writes are funneled through that validator.
+        loginMethods: row.login_methods === null
+            ? null
+            : row.login_methods,
+        status: row.status,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+/**
+ * Map a snake_case client_secrets row to a camelCase ClientSecret object.
+ *
+ * IMPORTANT: The secret_hash field is intentionally excluded from the
+ * mapped output. Secret hashes should never leave the repository layer.
+ */
+export function mapRowToClientSecret(row) {
+    return {
+        id: row.id,
+        clientId: row.client_id,
+        label: row.label,
+        expiresAt: row.expires_at,
+        status: row.status,
+        lastUsedAt: row.last_used_at,
+        createdAt: row.created_at,
+    };
+}
+//# sourceMappingURL=types.js.map

package/dist/clients/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/clients/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA2BH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,UAAU;IACV,YAAY;CACJ,CAAC;AAkMX,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAc;IAC3C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,cAAc,EAAE,GAAG,CAAC,eAAe;QACnC,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,UAAU,EAAE,GAAG,CAAC,WAAyB;QACzC,eAAe,EAAE,GAAG,CAAC,gBAAmC;QACxD,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE;QACrC,sBAAsB,EAAE,GAAG,CAAC,yBAAyB,IAAI,EAAE;QAC3D,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;QACjC,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,EAAE;QACvC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,uBAAuB,EAAE,GAAG,CAAC,0BAA0B;QACvD,cAAc,EAAE,GAAG,CAAC,eAAe,IAAI,EAAE;QACzC,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,iEAAiE;QACjE,uEAAuE;QACvE,2EAA2E;QAC3E,8CAA8C;QAC9C,YAAY,EAAE,GAAG,CAAC,aAAa,KAAK,IAAI;YACtC,CAAC,CAAC,IAAI;YACN,CAAC,CAAE,GAAG,CAAC,aAA+B;QACxC,MAAM,EAAE,GAAG,CAAC,MAAsB;QAClC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAGD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAoB;IACvD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,MAAsB;QAClC,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC"}

package/dist/clients/validators.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Client validators — redirect URI validation and default grant type logic.
+ *
+ * Redirect URI validation follows OIDC/OAuth 2.0 security best practices:
+ * - HTTPS required in production (localhost exempted for development)
+ * - No fragment components (#) allowed
+ * - No wildcards in path or query
+ * - Custom URI schemes allowed for native apps
+ *
+ * Default grant types and auth methods are determined by the combination
+ * of client type (confidential/public) and application type (web/spa/native).
+ */
+import type { ClientType, ApplicationType } from './types.js';
+/**
+ * Validate a single redirect URI according to OIDC security rules.
+ *
+ * Rules:
+ * 1. Must be a parseable URL
+ * 2. HTTPS required in production (except localhost)
+ * 3. No fragment components (#)
+ * 4. No wildcards (* in path or query)
+ * 5. Custom URI schemes allowed for native apps (e.g., com.example.app:/callback)
+ *
+ * @param uri - The redirect URI to validate
+ * @param isProduction - Whether to enforce HTTPS (true in production)
+ * @returns Validation result with optional error message
+ */
+export declare function validateRedirectUri(uri: string, isProduction: boolean): {
+    isValid: boolean;
+    error?: string;
+};
+/**
+ * Validate an array of redirect URIs.
+ *
+ * Checks each URI individually and enforces a maximum count.
+ *
+ * @param uris - Array of redirect URIs to validate
+ * @param isProduction - Whether to enforce HTTPS
+ * @param max - Maximum allowed URIs (default: 10)
+ * @returns Validation result with optional array of errors
+ */
+export declare function validateRedirectUris(uris: string[], isProduction: boolean, max?: number): {
+    isValid: boolean;
+    errors?: string[];
+};
+/**
+ * Get default grant types based on client type and application type.
+ *
+ * | ClientType    | AppType | Default Grants                                        |
+ * |--------------|---------|-------------------------------------------------------|
+ * | confidential | web     | authorization_code, refresh_token, client_credentials |
+ * | confidential | native  | authorization_code, refresh_token                     |
+ * | confidential | spa     | authorization_code, refresh_token                     |
+ * | public       | spa     | authorization_code, refresh_token                     |
+ * | public       | native  | authorization_code, refresh_token                     |
+ * | public       | web     | authorization_code, refresh_token                     |
+ *
+ * @param clientType - The client type (confidential or public)
+ * @param applicationType - The application deployment type
+ * @returns Array of default grant type strings
+ */
+export declare function getDefaultGrantTypes(clientType: ClientType, applicationType: ApplicationType): string[];
+/**
+ * Get default token endpoint authentication method based on client type.
+ *
+ * - confidential → 'client_secret_basic' (sends credentials in Authorization header)
+ * - public → 'none' (public clients cannot authenticate at token endpoint)
+ *
+ * @param clientType - The client type
+ * @returns Token endpoint auth method string
+ */
+export declare function getDefaultTokenEndpointAuthMethod(clientType: ClientType): string;
+/**
+ * Get default response types.
+ * All clients default to ['code'] (authorization code flow).
+ *
+ * @returns Array of default response type strings
+ */
+export declare function getDefaultResponseTypes(): string[];
+/**
+ * Get default scope.
+ * All clients default to 'openid profile email'.
+ *
+ * @returns Default scope string
+ */
+export declare function getDefaultScope(): string;
+//# sourceMappingURL=validators.d.ts.map

package/dist/clients/validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/clients/validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAS9D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,OAAO,GACpB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA+CtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EAAE,EACd,YAAY,EAAE,OAAO,EACrB,GAAG,GAAE,MAAkC,GACtC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAyBzC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,GAC/B,MAAM,EAAE,CAQV;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAEhF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC"}

package/dist/clients/validators.js

@@ -0,0 +1,164 @@
+/**
+ * Client validators — redirect URI validation and default grant type logic.
+ *
+ * Redirect URI validation follows OIDC/OAuth 2.0 security best practices:
+ * - HTTPS required in production (localhost exempted for development)
+ * - No fragment components (#) allowed
+ * - No wildcards in path or query
+ * - Custom URI schemes allowed for native apps
+ *
+ * Default grant types and auth methods are determined by the combination
+ * of client type (confidential/public) and application type (web/spa/native).
+ */
+// ===========================================================================
+// Redirect URI Validation
+// ===========================================================================
+/** Maximum redirect URIs allowed per client */
+const DEFAULT_MAX_REDIRECT_URIS = 10;
+/**
+ * Validate a single redirect URI according to OIDC security rules.
+ *
+ * Rules:
+ * 1. Must be a parseable URL
+ * 2. HTTPS required in production (except localhost)
+ * 3. No fragment components (#)
+ * 4. No wildcards (* in path or query)
+ * 5. Custom URI schemes allowed for native apps (e.g., com.example.app:/callback)
+ *
+ * @param uri - The redirect URI to validate
+ * @param isProduction - Whether to enforce HTTPS (true in production)
+ * @returns Validation result with optional error message
+ */
+export function validateRedirectUri(uri, isProduction) {
+    // Empty URI check
+    if (!uri || uri.trim().length === 0) {
+        return { isValid: false, error: 'Redirect URI cannot be empty' };
+    }
+    // Try to parse the URI
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        // Could be a custom scheme for native apps (e.g., com.example.app:/callback)
+        // Custom schemes won't parse with URL constructor if they don't use //
+        if (/^[a-z][a-z0-9+.-]*:/.test(uri) && !uri.startsWith('http')) {
+            // Allow custom schemes — they're valid for native apps
+            // Still check for fragments
+            if (uri.includes('#')) {
+                return { isValid: false, error: 'Redirect URI must not contain a fragment (#)' };
+            }
+            return { isValid: true };
+        }
+        return { isValid: false, error: `Invalid URI: ${uri}` };
+    }
+    // No fragments allowed
+    if (parsed.hash) {
+        return { isValid: false, error: 'Redirect URI must not contain a fragment (#)' };
+    }
+    // No wildcards in path or query
+    if (parsed.pathname.includes('*') || parsed.search.includes('*')) {
+        return { isValid: false, error: 'Redirect URI must not contain wildcards (*)' };
+    }
+    // HTTPS required in production (except localhost)
+    if (isProduction) {
+        const isLocalhost = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';
+        if (parsed.protocol !== 'https:' && !isLocalhost) {
+            return {
+                isValid: false,
+                error: 'Redirect URI must use HTTPS in production (except localhost)',
+            };
+        }
+    }
+    return { isValid: true };
+}
+/**
+ * Validate an array of redirect URIs.
+ *
+ * Checks each URI individually and enforces a maximum count.
+ *
+ * @param uris - Array of redirect URIs to validate
+ * @param isProduction - Whether to enforce HTTPS
+ * @param max - Maximum allowed URIs (default: 10)
+ * @returns Validation result with optional array of errors
+ */
+export function validateRedirectUris(uris, isProduction, max = DEFAULT_MAX_REDIRECT_URIS) {
+    if (uris.length === 0) {
+        return { isValid: false, errors: ['At least one redirect URI is required'] };
+    }
+    if (uris.length > max) {
+        return {
+            isValid: false,
+            errors: [`Maximum ${max} redirect URIs allowed, got ${uris.length}`],
+        };
+    }
+    const errors = [];
+    for (const uri of uris) {
+        const result = validateRedirectUri(uri, isProduction);
+        if (!result.isValid) {
+            errors.push(result.error);
+        }
+    }
+    if (errors.length > 0) {
+        return { isValid: false, errors };
+    }
+    return { isValid: true };
+}
+// ===========================================================================
+// Default Grant Types
+// ===========================================================================
+/**
+ * Get default grant types based on client type and application type.
+ *
+ * | ClientType    | AppType | Default Grants                                        |
+ * |--------------|---------|-------------------------------------------------------|
+ * | confidential | web     | authorization_code, refresh_token, client_credentials |
+ * | confidential | native  | authorization_code, refresh_token                     |
+ * | confidential | spa     | authorization_code, refresh_token                     |
+ * | public       | spa     | authorization_code, refresh_token                     |
+ * | public       | native  | authorization_code, refresh_token                     |
+ * | public       | web     | authorization_code, refresh_token                     |
+ *
+ * @param clientType - The client type (confidential or public)
+ * @param applicationType - The application deployment type
+ * @returns Array of default grant type strings
+ */
+export function getDefaultGrantTypes(clientType, applicationType) {
+    // Confidential web clients get client_credentials in addition to auth code
+    if (clientType === 'confidential' && applicationType === 'web') {
+        return ['authorization_code', 'refresh_token', 'client_credentials'];
+    }
+    // All other combinations: authorization_code + refresh_token
+    return ['authorization_code', 'refresh_token'];
+}
+/**
+ * Get default token endpoint authentication method based on client type.
+ *
+ * - confidential → 'client_secret_basic' (sends credentials in Authorization header)
+ * - public → 'none' (public clients cannot authenticate at token endpoint)
+ *
+ * @param clientType - The client type
+ * @returns Token endpoint auth method string
+ */
+export function getDefaultTokenEndpointAuthMethod(clientType) {
+    return clientType === 'confidential' ? 'client_secret_basic' : 'none';
+}
+/**
+ * Get default response types.
+ * All clients default to ['code'] (authorization code flow).
+ *
+ * @returns Array of default response type strings
+ */
+export function getDefaultResponseTypes() {
+    return ['code'];
+}
+/**
+ * Get default scope.
+ * All clients default to 'openid profile email'.
+ *
+ * @returns Default scope string
+ */
+export function getDefaultScope() {
+    return 'openid profile email';
+}
+//# sourceMappingURL=validators.js.map

package/dist/clients/validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../src/clients/validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,+CAA+C;AAC/C,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,YAAqB;IAErB,kBAAkB;IAClB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACnE,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,uEAAuE;QACvE,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,uDAAuD;YACvD,4BAA4B;YAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;YACnF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,GAAG,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;IACnF,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;IAClF,CAAC;IAED,kDAAkD;IAClD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,WAAW,GACf,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;QACrE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,8DAA8D;aACtE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAc,EACd,YAAqB,EACrB,GAAG,GAAW,yBAAyB;IAEvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,uCAAuC,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,CAAC,WAAW,GAAG,+BAA+B,IAAI,CAAC,MAAM,EAAE,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAsB,EACtB,eAAgC;IAEhC,2EAA2E;IAC3E,IAAI,UAAU,KAAK,cAAc,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC/D,OAAO,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IACvE,CAAC;IAED,6DAA6D;IAC7D,OAAO,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAAC,UAAsB;IACtE,OAAO,UAAU,KAAK,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,sBAAsB,CAAC;AAChC,CAAC"}

package/dist/config/index.d.ts

@@ -0,0 +1,23 @@
+export declare const config: {
+    nodeEnv: "development" | "production" | "test";
+    port: number;
+    host: string;
+    databaseUrl: string;
+    redisUrl: string;
+    issuerBaseUrl: string;
+    cookieKeys: string[];
+    smtp: {
+        host: string;
+        port: number;
+        user?: string | undefined;
+        pass?: string | undefined;
+        from: string;
+    };
+    logLevel: "debug" | "error" | "fatal" | "info" | "warn";
+    trustProxy: boolean;
+    twoFactorEncryptionKey?: string | undefined;
+    signingKeyEncryptionKey: string;
+    adminCorsOrigins: string[];
+    metricsEnabled: boolean;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AA6DA,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;CAAe,CAAC"}

package/dist/config/index.js

@@ -0,0 +1,52 @@
+import dotenv from 'dotenv';
+import { logger } from '../lib/logger.js';
+import { configSchema } from './schema.js';
+dotenv.config();
+function loadConfig() {
+    // Log a loud warning when the production safety escape hatch is active.
+    // This runs before parsing so the message always appears, even if config
+    // is otherwise invalid. The escape hatch exists for incident response only.
+    if (process.env.NODE_ENV === 'production' &&
+        process.env.PORTA_SKIP_PROD_SAFETY === 'true') {
+        logger.error({ event: 'config.safety_skipped' }, 'PORTA_SKIP_PROD_SAFETY=true — production safety checks bypassed');
+    }
+    const result = configSchema.safeParse({
+        nodeEnv: process.env.NODE_ENV,
+        port: process.env.PORT,
+        host: process.env.HOST,
+        databaseUrl: process.env.DATABASE_URL,
+        redisUrl: process.env.REDIS_URL,
+        issuerBaseUrl: process.env.ISSUER_BASE_URL,
+        // COOKIE_KEYS is a comma-separated list of secrets for OIDC cookie signing.
+        // Supports key rotation: first key signs, subsequent keys verify old cookies.
+        cookieKeys: process.env.COOKIE_KEYS?.split(',') ?? [],
+        smtp: {
+            host: process.env.SMTP_HOST,
+            port: process.env.SMTP_PORT,
+            user: process.env.SMTP_USER,
+            pass: process.env.SMTP_PASS,
+            from: process.env.SMTP_FROM,
+        },
+        logLevel: process.env.LOG_LEVEL,
+        trustProxy: process.env.TRUST_PROXY,
+        twoFactorEncryptionKey: process.env.TWO_FACTOR_ENCRYPTION_KEY,
+        signingKeyEncryptionKey: process.env.SIGNING_KEY_ENCRYPTION_KEY,
+        // ADMIN_CORS_ORIGINS is a comma-separated list of allowed origins for the admin API.
+        // Empty or unset = deny all cross-origin requests (secure default).
+        adminCorsOrigins: process.env.ADMIN_CORS_ORIGINS
+            ? process.env.ADMIN_CORS_ORIGINS.split(',').map((s) => s.trim()).filter(Boolean)
+            : [],
+        metricsEnabled: process.env.METRICS_ENABLED,
+    });
+    if (!result.success) {
+        // Log each validation issue on its own line for clear operator diagnosis.
+        logger.fatal({ event: 'config.invalid' }, '❌ Invalid configuration — refusing to start');
+        for (const issue of result.error.issues) {
+            logger.fatal(`   ${issue.path.join('.')}: ${issue.message}`);
+        }
+        process.exit(1);
+    }
+    return result.data;
+}
+export const config = loadConfig();
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAkB,MAAM,aAAa,CAAC;AAE3D,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,UAAU;IACjB,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,IACE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,EAC7C,CAAC;QACD,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAClC,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;QAC7B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;QACrC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;QAC/B,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QAC1C,4EAA4E;QAC5E,8EAA8E;QAC9E,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;QACrD,IAAI,EAAE;YACJ,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;SAC5B;QACD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;QAC/B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACnC,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC7D,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;QAC/D,qFAAqF;QACrF,oEAAoE;QACpE,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;YAC9C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAChF,CAAC,CAAC,EAAE;QACN,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,0EAA0E;QAC1E,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,6CAA6C,CAAC,CAAC;QACzF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC"}