@portaidentity/server 1.7.0

package/dist/two-factor/service.js

@@ -0,0 +1,599 @@
+/**
+ * Two-factor authentication service — business logic orchestrator.
+ *
+ * Composes the repository, cache, crypto utilities, and audit log
+ * to provide the complete 2FA management API. Functions are grouped by:
+ *
+ *   - **Setup**: Initialize email OTP or TOTP, confirm TOTP enrollment
+ *   - **Verification**: Verify OTP codes, TOTP codes, recovery codes
+ *   - **Sending**: Generate and send OTP codes via email
+ *   - **Management**: Get status, disable 2FA, regenerate recovery codes
+ *   - **Policy**: Check org policy requirements, determine required method
+ *
+ * All write operations follow the pattern:
+ *   1. Validate preconditions (user state, existing 2FA, etc.)
+ *   2. Perform DB operations (via repository)
+ *   3. Update user 2FA state (via user repository)
+ *   4. Invalidate cache
+ *   5. Write audit log (fire-and-forget)
+ */
+import { config } from '../config/index.js';
+import { getPool } from '../lib/database.js';
+import { writeAuditLog } from '../lib/audit-log.js';
+import { logger } from '../lib/logger.js';
+import { TwoFactorAlreadyEnabledError, TwoFactorNotEnabledError, TotpNotConfiguredError, OtpExpiredError, OtpInvalidError, RecoveryCodeInvalidError, RecoveryCodesExhaustedError, } from './errors.js';
+import { encryptTotpSecret, decryptTotpSecret } from './crypto.js';
+import { generateOtpCode, hashOtpCode, verifyOtpCode } from './otp.js';
+import { generateTotpSecret, generateTotpUri, generateQrCodeDataUri, verifyTotpCode } from './totp.js';
+import { generateRecoveryCodes, hashRecoveryCode, verifyRecoveryCode as verifyRecoveryCodeHash } from './recovery.js';
+import { insertTotp, findTotpByUserId, markTotpVerified, deleteTotp, insertOtpCode, findActiveOtpCodes, markOtpCodeUsed, deleteExpiredOtpCodes, countActiveOtpCodes, findUnusedRecoveryCodes, markRecoveryCodeUsed, insertRecoveryCodes, deleteAllRecoveryCodes, countUnusedRecoveryCodes, } from './repository.js';
+import { getCachedTwoFactorStatus, cacheTwoFactorStatus, invalidateTwoFactorCache, } from './cache.js';
+import { findUserById, updateUser as repoUpdateUser } from '../users/repository.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** OTP code expiration time in minutes */
+const OTP_EXPIRY_MINUTES = 10;
+/** Maximum active OTP codes per user (rate limiting) */
+const MAX_ACTIVE_OTP_CODES = 5;
+/** Default dev/test encryption key — only used when config key is not set */
+const DEV_ENCRYPTION_KEY = 'a'.repeat(64);
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Get the 2FA encryption key from config, falling back to a dev key
+ * in non-production environments. Production requires a real key.
+ *
+ * @returns 64-character hex encryption key
+ */
+function getEncryptionKey() {
+    if (config.twoFactorEncryptionKey) {
+        return config.twoFactorEncryptionKey;
+    }
+    // In development/test, use a predictable default — this is safe because
+    // dev/test TOTP secrets are throwaway data, not real user secrets
+    return DEV_ENCRYPTION_KEY;
+}
+/**
+ * Generate and hash recovery codes, returning both plaintext and hashes.
+ *
+ * @returns Object with plaintext codes (for display) and hashes (for storage)
+ */
+async function generateAndHashRecoveryCodes() {
+    const plaintextCodes = generateRecoveryCodes();
+    const codeHashes = await Promise.all(plaintextCodes.map((code) => hashRecoveryCode(code)));
+    return { plaintextCodes, codeHashes };
+}
+// ===========================================================================
+// Setup functions
+// ===========================================================================
+/**
+ * Set up email OTP as the 2FA method for a user.
+ *
+ * Enables 2FA with the 'email' method, generates recovery codes, and
+ * marks the user as 2FA-enabled in the users table. No TOTP config
+ * is created — email OTP codes are generated on-demand during login.
+ *
+ * @param userId - User UUID
+ * @param orgId - Organization UUID (for audit logging)
+ * @returns Setup result with recovery codes
+ * @throws TwoFactorAlreadyEnabledError if 2FA is already enabled
+ */
+export async function setupEmailOtp(userId, orgId) {
+    // Check preconditions — user must not already have 2FA enabled
+    const user = await findUserById(userId);
+    if (!user) {
+        throw new TwoFactorNotEnabledError(userId);
+    }
+    // Check if 2FA is already enabled by reading the DB columns directly
+    if (user.twoFactorEnabled) {
+        throw new TwoFactorAlreadyEnabledError(userId);
+    }
+    // Generate recovery codes
+    const { plaintextCodes, codeHashes } = await generateAndHashRecoveryCodes();
+    // Store recovery codes in the database
+    await insertRecoveryCodes(userId, codeHashes);
+    // Enable 2FA on the user record
+    await repoUpdateUser(userId, {
+        twoFactorEnabled: true,
+        twoFactorMethod: 'email',
+    });
+    // Invalidate cache since 2FA state changed
+    await invalidateTwoFactorCache(userId);
+    // Audit log (fire-and-forget)
+    await writeAuditLog({
+        organizationId: orgId,
+        userId,
+        eventType: '2fa.setup.email',
+        eventCategory: 'auth',
+        metadata: { method: 'email' },
+    });
+    logger.info({ userId, method: 'email' }, '2FA setup complete (email OTP)');
+    return {
+        method: 'email',
+        recoveryCodes: plaintextCodes,
+    };
+}
+/**
+ * Start TOTP setup for a user.
+ *
+ * Generates a TOTP secret, encrypts it, stores it as unverified,
+ * and returns the otpauth:// URI and QR code for the user to scan.
+ * The setup is not complete until the user confirms with a valid
+ * TOTP code via `confirmTotpSetup()`.
+ *
+ * @param userId - User UUID
+ * @param email - User email (for TOTP URI display)
+ * @param orgSlug - Organization slug (used as TOTP issuer)
+ * @returns Setup result with TOTP URI, QR code, and recovery codes
+ * @throws TwoFactorAlreadyEnabledError if 2FA is already enabled
+ */
+export async function setupTotp(userId, email, orgSlug) {
+    // Check preconditions — user must not already have 2FA enabled
+    const user = await findUserById(userId);
+    if (!user) {
+        throw new TwoFactorNotEnabledError(userId);
+    }
+    if (user.twoFactorEnabled) {
+        throw new TwoFactorAlreadyEnabledError(userId);
+    }
+    // Delete any existing unverified TOTP config (from previous incomplete setup)
+    await deleteTotp(userId);
+    // Generate a new TOTP secret and encrypt it for storage
+    const secret = generateTotpSecret();
+    const encryptionKey = getEncryptionKey();
+    const { encrypted, iv, tag } = encryptTotpSecret(secret, encryptionKey);
+    // Store the encrypted TOTP config (unverified — verified becomes true after confirm)
+    await insertTotp({
+        userId,
+        encryptedSecret: encrypted,
+        encryptionIv: iv,
+        encryptionTag: tag,
+    });
+    // Generate the otpauth URI and QR code for the user
+    const issuer = `Porta (${orgSlug})`;
+    const totpUri = generateTotpUri(secret, email, issuer);
+    const qrCodeDataUri = await generateQrCodeDataUri(totpUri);
+    // Generate recovery codes (stored but 2FA not yet enabled — that happens on confirm)
+    const { plaintextCodes, codeHashes } = await generateAndHashRecoveryCodes();
+    await deleteAllRecoveryCodes(userId); // Clear any old ones
+    await insertRecoveryCodes(userId, codeHashes);
+    // Invalidate cache since TOTP config changed
+    await invalidateTwoFactorCache(userId);
+    logger.info({ userId, method: 'totp' }, 'TOTP setup initiated (pending confirmation)');
+    return {
+        method: 'totp',
+        recoveryCodes: plaintextCodes,
+        totpUri,
+        qrCodeDataUri,
+    };
+}
+/**
+ * Retrieve existing pending (unverified) TOTP setup info.
+ *
+ * If a user has a pending TOTP setup (unverified record in DB), this
+ * decrypts the secret and regenerates the QR code for display.
+ * Does NOT regenerate the secret — preserves the existing one.
+ *
+ * Returns null if no pending setup exists.
+ *
+ * @param userId - User UUID
+ * @param email - User email (for TOTP URI display)
+ * @param orgSlug - Organization slug (used as TOTP issuer)
+ * @returns Setup info with QR code and secret, or null if no pending setup
+ */
+export async function getPendingTotpSetupInfo(userId, email, orgSlug) {
+    const totp = await findTotpByUserId(userId);
+    if (!totp || totp.verified) {
+        return null;
+    }
+    // Decrypt the existing secret
+    const encryptionKey = getEncryptionKey();
+    const secret = decryptTotpSecret(totp.encryptedSecret, totp.encryptionIv, totp.encryptionTag, encryptionKey);
+    // Regenerate the URI and QR code from the existing secret
+    const issuer = `Porta (${orgSlug})`;
+    const totpUri = generateTotpUri(secret, email, issuer);
+    const qrCodeDataUri = await generateQrCodeDataUri(totpUri);
+    return { totpUri, qrCodeDataUri, totpSecret: secret };
+}
+/**
+ * Confirm TOTP setup by verifying the user's first TOTP code.
+ *
+ * Called after the user scans the QR code and enters a TOTP code
+ * from their authenticator app. This confirms the setup is correct
+ * and enables 2FA on the user record.
+ *
+ * @param userId - User UUID
+ * @param code - 6-digit TOTP code from the authenticator app
+ * @returns true if the code is valid and setup is confirmed
+ * @throws TotpNotConfiguredError if no pending TOTP setup exists
+ */
+export async function confirmTotpSetup(userId, code) {
+    // Find the unverified TOTP config
+    const totp = await findTotpByUserId(userId);
+    if (!totp || totp.verified) {
+        throw new TotpNotConfiguredError(userId);
+    }
+    // Decrypt the secret to verify the code
+    const encryptionKey = getEncryptionKey();
+    const secret = decryptTotpSecret(totp.encryptedSecret, totp.encryptionIv, totp.encryptionTag, encryptionKey);
+    // Verify the TOTP code
+    const isValid = verifyTotpCode(code, secret);
+    if (!isValid) {
+        return false;
+    }
+    // Mark the TOTP config as verified
+    await markTotpVerified(userId);
+    // Enable 2FA on the user record
+    await repoUpdateUser(userId, {
+        twoFactorEnabled: true,
+        twoFactorMethod: 'totp',
+    });
+    // Invalidate cache since 2FA state changed
+    await invalidateTwoFactorCache(userId);
+    // Audit log (fire-and-forget)
+    const user = await findUserById(userId);
+    await writeAuditLog({
+        organizationId: user?.organizationId,
+        userId,
+        eventType: '2fa.setup.totp',
+        eventCategory: 'auth',
+        metadata: { method: 'totp' },
+    });
+    logger.info({ userId, method: 'totp' }, '2FA setup confirmed (TOTP)');
+    return true;
+}
+// ===========================================================================
+// OTP email sending
+// ===========================================================================
+/**
+ * Generate and send an OTP code via email.
+ *
+ * Creates a 6-digit code, hashes it, stores the hash in the database
+ * with a 10-minute expiry, and sends the plaintext code via email.
+ * Rate-limited to MAX_ACTIVE_OTP_CODES active codes per user.
+ *
+ * Note: This function generates the code and stores it. The actual email
+ * sending is handled by the auth email service (Phase 8). For now, this
+ * function prepares the code — the route layer will call the email service.
+ *
+ * @param userId - User UUID
+ * @param email - User email to send the code to
+ * @param orgId - Organization UUID (for audit logging)
+ * @returns The plaintext OTP code (caller sends via email service)
+ * @throws Error if too many active codes exist (rate limiting)
+ */
+export async function sendOtpCode(userId, email, orgId) {
+    // Rate limiting — prevent generating too many codes
+    const activeCount = await countActiveOtpCodes(userId);
+    if (activeCount >= MAX_ACTIVE_OTP_CODES) {
+        // Clean up expired codes first, then re-check
+        await deleteExpiredOtpCodes(userId);
+        const newCount = await countActiveOtpCodes(userId);
+        if (newCount >= MAX_ACTIVE_OTP_CODES) {
+            throw new Error('Too many active OTP codes. Please wait before requesting a new one.');
+        }
+    }
+    // Generate a new OTP code
+    const plaintext = generateOtpCode();
+    const codeHash = hashOtpCode(plaintext);
+    // Calculate expiration (10 minutes from now)
+    const expiresAt = new Date(Date.now() + OTP_EXPIRY_MINUTES * 60 * 1000);
+    // Store the hashed code in the database
+    await insertOtpCode(userId, codeHash, expiresAt);
+    // Audit log (fire-and-forget)
+    await writeAuditLog({
+        organizationId: orgId,
+        userId,
+        eventType: '2fa.otp.sent',
+        eventCategory: 'auth',
+        metadata: { email },
+    });
+    logger.debug({ userId, email }, 'OTP code generated for email sending');
+    // Return the plaintext code — the caller sends it via email
+    return plaintext;
+}
+// ===========================================================================
+// Verification functions
+// ===========================================================================
+/**
+ * Verify an email OTP code.
+ *
+ * Checks all active (unused, not expired) OTP codes for the user,
+ * verifying the provided code against each hash. If a match is found,
+ * the code is marked as used.
+ *
+ * @param userId - User UUID
+ * @param code - 6-digit OTP code to verify
+ * @returns true if the code is valid
+ * @throws OtpInvalidError if no matching code is found
+ */
+export async function verifyOtp(userId, code) {
+    // Find all active (unused, unexpired) OTP codes for this user
+    const activeCodes = await findActiveOtpCodes(userId);
+    if (activeCodes.length === 0) {
+        throw new OtpExpiredError();
+    }
+    // Try to match the code against each active hash
+    for (const otpRecord of activeCodes) {
+        if (verifyOtpCode(code, otpRecord.codeHash)) {
+            // Mark the matching code as used
+            await markOtpCodeUsed(otpRecord.id);
+            // Clean up expired codes in the background
+            deleteExpiredOtpCodes(userId).catch((err) => {
+                logger.warn({ err, userId }, 'Failed to clean up expired OTP codes');
+            });
+            return true;
+        }
+    }
+    // No match found
+    throw new OtpInvalidError();
+}
+/**
+ * Verify a TOTP code from an authenticator app.
+ *
+ * Decrypts the user's TOTP secret from the database and verifies
+ * the code with a ±1 step time window.
+ *
+ * @param userId - User UUID
+ * @param code - 6-digit TOTP code to verify
+ * @returns true if the code is valid
+ * @throws TotpNotConfiguredError if no verified TOTP config exists
+ */
+export async function verifyTotp(userId, code) {
+    // Find the verified TOTP config
+    const totp = await findTotpByUserId(userId);
+    if (!totp || !totp.verified) {
+        throw new TotpNotConfiguredError(userId);
+    }
+    // Decrypt the secret
+    const encryptionKey = getEncryptionKey();
+    const secret = decryptTotpSecret(totp.encryptedSecret, totp.encryptionIv, totp.encryptionTag, encryptionKey);
+    // Verify the code with ±1 step window
+    return verifyTotpCode(code, secret);
+}
+/**
+ * Verify a recovery code.
+ *
+ * Recovery codes use Argon2id hashing with random salt, so we must
+ * iterate all unused codes and verify against each hash. If a match
+ * is found, the code is marked as used (single-use).
+ *
+ * @param userId - User UUID
+ * @param code - Recovery code in XXXX-XXXX format (case-insensitive)
+ * @returns true if the code is valid
+ * @throws RecoveryCodesExhaustedError if no unused codes remain
+ * @throws RecoveryCodeInvalidError if the code doesn't match any hash
+ */
+export async function verifyRecoveryCode(userId, code) {
+    // Find all unused recovery codes
+    const unusedCodes = await findUnusedRecoveryCodes(userId);
+    if (unusedCodes.length === 0) {
+        throw new RecoveryCodesExhaustedError(userId);
+    }
+    // Try to match against each unused code hash (Argon2id — must iterate)
+    for (const recoveryRecord of unusedCodes) {
+        const isMatch = await verifyRecoveryCodeHash(code, recoveryRecord.codeHash);
+        if (isMatch) {
+            // Mark the matching code as used
+            await markRecoveryCodeUsed(recoveryRecord.id);
+            // Invalidate cache since recovery code count changed
+            await invalidateTwoFactorCache(userId);
+            // Audit log
+            const remaining = unusedCodes.length - 1;
+            await writeAuditLog({
+                userId,
+                eventType: '2fa.recovery.used',
+                eventCategory: 'auth',
+                metadata: { remainingCodes: remaining },
+            });
+            logger.info({ userId, remainingCodes: remaining }, 'Recovery code used');
+            return true;
+        }
+    }
+    // No match found
+    throw new RecoveryCodeInvalidError();
+}
+// ===========================================================================
+// Management functions
+// ===========================================================================
+/**
+ * Get the current 2FA status for a user.
+ *
+ * Checks Redis cache first, falls back to building the status from
+ * the database. The status includes whether 2FA is enabled, the method,
+ * whether TOTP is configured (and verified), and remaining recovery codes.
+ *
+ * @param userId - User UUID
+ * @returns Current 2FA status
+ */
+export async function getTwoFactorStatus(userId) {
+    // Try cache first
+    const cached = await getCachedTwoFactorStatus(userId);
+    if (cached)
+        return cached;
+    // Build status from database
+    const user = await findUserById(userId);
+    // Default status for unknown users — not enabled
+    if (!user) {
+        return {
+            enabled: false,
+            method: null,
+            totpConfigured: false,
+            recoveryCodesRemaining: 0,
+        };
+    }
+    // Check TOTP config existence and verification status
+    const totp = await findTotpByUserId(userId);
+    const recoveryCount = await countUnusedRecoveryCodes(userId);
+    const status = {
+        enabled: user.twoFactorEnabled,
+        method: user.twoFactorMethod ?? null,
+        totpConfigured: totp !== null && totp.verified,
+        recoveryCodesRemaining: recoveryCount,
+    };
+    // Cache the result
+    await cacheTwoFactorStatus(userId, status);
+    return status;
+}
+/**
+ * Disable 2FA for a user.
+ *
+ * Removes all 2FA data: TOTP config, active OTP codes, and recovery codes.
+ * Resets the user's 2FA flags in the users table.
+ *
+ * @param userId - User UUID
+ * @throws TwoFactorNotEnabledError if 2FA is not enabled
+ */
+export async function disableTwoFactor(userId) {
+    const user = await findUserById(userId);
+    if (!user || !user.twoFactorEnabled) {
+        throw new TwoFactorNotEnabledError(userId);
+    }
+    // Delete all 2FA data
+    await deleteTotp(userId);
+    await deleteAllRecoveryCodes(userId);
+    await deleteExpiredOtpCodes(userId);
+    // Reset 2FA flags on the user record
+    await repoUpdateUser(userId, {
+        twoFactorEnabled: false,
+        twoFactorMethod: null,
+    });
+    // Invalidate cache
+    await invalidateTwoFactorCache(userId);
+    // Audit log
+    await writeAuditLog({
+        organizationId: user.organizationId,
+        userId,
+        eventType: '2fa.disabled',
+        eventCategory: 'auth',
+        metadata: { previousMethod: user.twoFactorMethod },
+    });
+    logger.info({ userId }, '2FA disabled');
+}
+/**
+ * Regenerate recovery codes for a user.
+ *
+ * Deletes all existing recovery codes and generates a fresh set of 10.
+ * The user must have 2FA enabled to regenerate codes.
+ *
+ * @param userId - User UUID
+ * @returns Array of new plaintext recovery codes (shown once to the user)
+ * @throws TwoFactorNotEnabledError if 2FA is not enabled
+ */
+export async function regenerateRecoveryCodes(userId) {
+    const user = await findUserById(userId);
+    if (!user || !user.twoFactorEnabled) {
+        throw new TwoFactorNotEnabledError(userId);
+    }
+    // Delete old recovery codes
+    await deleteAllRecoveryCodes(userId);
+    // Generate new recovery codes
+    const { plaintextCodes, codeHashes } = await generateAndHashRecoveryCodes();
+    await insertRecoveryCodes(userId, codeHashes);
+    // Invalidate cache since recovery code count changed
+    await invalidateTwoFactorCache(userId);
+    // Audit log
+    await writeAuditLog({
+        organizationId: user.organizationId,
+        userId,
+        eventType: '2fa.recovery.regenerated',
+        eventCategory: 'auth',
+    });
+    logger.info({ userId }, 'Recovery codes regenerated');
+    return plaintextCodes;
+}
+/**
+ * Check if the organization's 2FA policy requires 2FA for a user.
+ *
+ * Returns true if the org policy is anything other than 'optional'
+ * AND the user has not yet enabled 2FA.
+ *
+ * @param org - Organization with twoFactorPolicy field
+ * @param user - User with 2FA state fields
+ * @returns true if 2FA is required but not yet set up
+ */
+export function requiresTwoFactor(org, user) {
+    // If policy is optional, 2FA is never required
+    if (org.twoFactorPolicy === 'optional') {
+        return false;
+    }
+    // If user already has 2FA enabled, requirement is met
+    if (user.twoFactorEnabled) {
+        return false;
+    }
+    // Policy requires 2FA but user hasn't set it up yet
+    return true;
+}
+/**
+ * Determine which 2FA method the user should use based on org policy.
+ *
+ * If the user has 2FA enabled, returns their configured method.
+ * If the org requires a specific method, returns that method.
+ * If the org requires 'any', returns null (user chooses).
+ * If the policy is optional, returns null.
+ *
+ * @param org - Organization with twoFactorPolicy field
+ * @param user - User with 2FA state fields
+ * @returns The 2FA method to use, or null if no method is required/configured
+ */
+export function determineTwoFactorMethod(org, user) {
+    // If user already has 2FA enabled, use their method
+    if (user.twoFactorEnabled && user.twoFactorMethod) {
+        return user.twoFactorMethod;
+    }
+    // Map org policy to required method
+    switch (org.twoFactorPolicy) {
+        case 'required_email':
+            return 'email';
+        case 'required_totp':
+            return 'totp';
+        case 'required_any':
+            // User gets to choose — return null to indicate "choose any"
+            return null;
+        case 'optional':
+        default:
+            return null;
+    }
+}
+/**
+ * Get an aggregate 2FA enrollment summary for an organization.
+ *
+ * Runs a single SQL query with conditional aggregation to count
+ * users by 2FA status, method, and calculate compliance rate.
+ *
+ * @param orgId - Organization UUID
+ * @returns Aggregate summary with counts and compliance rate
+ */
+export async function getTwoFactorSummary(orgId) {
+    const pool = getPool();
+    const result = await pool.query(`SELECT
+       COUNT(*)::text                                         AS total_users,
+       COUNT(*) FILTER (WHERE two_factor_enabled = TRUE)::text  AS enabled_count,
+       COUNT(*) FILTER (WHERE two_factor_enabled = FALSE)::text AS disabled_count,
+       COUNT(*) FILTER (WHERE two_factor_method = 'totp')::text AS totp_count,
+       COUNT(*) FILTER (WHERE two_factor_method = 'email')::text AS email_count
+     FROM users
+     WHERE organization_id = $1
+       AND status != 'archived'`, [orgId]);
+    const row = result.rows[0];
+    const totalUsers = parseInt(row.total_users, 10);
+    const enabledCount = parseInt(row.enabled_count, 10);
+    const disabledCount = parseInt(row.disabled_count, 10);
+    const totpCount = parseInt(row.totp_count, 10);
+    const emailCount = parseInt(row.email_count, 10);
+    // Compliance rate: percentage of non-archived users with 2FA enabled (AR #92)
+    const complianceRate = totalUsers > 0
+        ? Math.round((enabledCount / totalUsers) * 10000) / 10000
+        : 0;
+    return {
+        totalUsers,
+        enabledCount,
+        disabledCount,
+        totpCount,
+        emailCount,
+        complianceRate,
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/two-factor/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/two-factor/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kBAAkB,IAAI,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACtH,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAEpF,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,0CAA0C;AAC1C,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,wDAAwD;AACxD,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE1C,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,gBAAgB;IACvB,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,sBAAsB,CAAC;IACvC,CAAC;IACD,wEAAwE;IACxE,kEAAkE;IAClE,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,4BAA4B;IAIzC,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CACrD,CAAC;IACF,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,KAAa;IAEb,+DAA+D;IAC/D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,MAAM,IAAI,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,0BAA0B;IAC1B,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,MAAM,4BAA4B,EAAE,CAAC;IAE5E,uCAAuC;IACvC,MAAM,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE9C,gCAAgC;IAChC,MAAM,cAAc,CAAC,MAAM,EAAE;QAC3B,gBAAgB,EAAE,IAAI;QACtB,eAAe,EAAE,OAAO;KACzB,CAAC,CAAC;IAEH,2CAA2C;IAC3C,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEvC,8BAA8B;IAC9B,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,KAAK;QACrB,MAAM;QACN,SAAS,EAAE,iBAAiB;QAC5B,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;KAC9B,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,gCAAgC,CAAC,CAAC;IAE3E,OAAO;QACL,MAAM,EAAE,OAAO;QACf,aAAa,EAAE,cAAc;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,KAAa,EACb,OAAe;IAEf,+DAA+D;IAC/D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,MAAM,IAAI,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IAEzB,wDAAwD;IACxD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAExE,qFAAqF;IACrF,MAAM,UAAU,CAAC;QACf,MAAM;QACN,eAAe,EAAE,SAAS;QAC1B,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,GAAG;KACnB,CAAC,CAAC;IAEH,oDAAoD;IACpD,MAAM,MAAM,GAAG,UAAU,OAAO,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE3D,qFAAqF;IACrF,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,MAAM,4BAA4B,EAAE,CAAC;IAC5E,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB;IAC3D,MAAM,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE9C,6CAA6C;IAC7C,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,6CAA6C,CAAC,CAAC;IAEvF,OAAO;QACL,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,cAAc;QAC7B,OAAO;QACP,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,KAAa,EACb,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8BAA8B;IAC9B,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,iBAAiB,CAC9B,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,aAAa,EAClB,aAAa,CACd,CAAC;IAEF,0DAA0D;IAC1D,MAAM,MAAM,GAAG,UAAU,OAAO,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE3D,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,IAAY;IAEZ,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,wCAAwC;IACxC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,iBAAiB,CAC9B,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,aAAa,EAClB,aAAa,CACd,CAAC;IAEF,uBAAuB;IACvB,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mCAAmC;IACnC,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE/B,gCAAgC;IAChC,MAAM,cAAc,CAAC,MAAM,EAAE;QAC3B,gBAAgB,EAAE,IAAI;QACtB,eAAe,EAAE,MAAM;KACxB,CAAC,CAAC;IAEH,2CAA2C;IAC3C,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEvC,8BAA8B;IAC9B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,IAAI,EAAE,cAAc;QACpC,MAAM;QACN,SAAS,EAAE,gBAAgB;QAC3B,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;KAC7B,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC;IAEtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,KAAa,EACb,KAAa;IAEb,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,WAAW,IAAI,oBAAoB,EAAE,CAAC;QACxC,8CAA8C;QAC9C,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,QAAQ,IAAI,oBAAoB,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAExC,6CAA6C;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAExE,wCAAwC;IACxC,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEjD,8BAA8B;IAC9B,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,KAAK;QACrB,MAAM;QACN,SAAS,EAAE,cAAc;QACzB,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,EAAE,KAAK,EAAE;KACpB,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,sCAAsC,CAAC,CAAC;IAExE,4DAA4D;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,IAAY;IAEZ,8DAA8D;IAC9D,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAErD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,EAAE,CAAC;IAC9B,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,IAAI,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,iCAAiC;YACjC,MAAM,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAEpC,2CAA2C;YAC3C,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,sCAAsC,CAAC,CAAC;YACvE,CAAC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,MAAM,IAAI,eAAe,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,IAAY;IAEZ,gCAAgC;IAChC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,iBAAiB,CAC9B,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,aAAa,EAClB,aAAa,CACd,CAAC;IAEF,sCAAsC;IACtC,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,IAAY;IAEZ,iCAAiC;IACjC,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAE1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,uEAAuE;IACvE,KAAK,MAAM,cAAc,IAAI,WAAW,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,OAAO,EAAE,CAAC;YACZ,iCAAiC;YACjC,MAAM,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAE9C,qDAAqD;YACrD,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAEvC,YAAY;YACZ,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;YACzC,MAAM,aAAa,CAAC;gBAClB,MAAM;gBACN,SAAS,EAAE,mBAAmB;gBAC9B,aAAa,EAAE,MAAM;gBACrB,QAAQ,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE;aACxC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,oBAAoB,CAAC,CAAC;YAEzE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,MAAM,IAAI,wBAAwB,EAAE,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,kBAAkB;IAClB,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,6BAA6B;IAC7B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IAExC,iDAAiD;IACjD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,cAAc,EAAE,KAAK;YACrB,sBAAsB,EAAE,CAAC;SAC1B,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAoB;QAC9B,OAAO,EAAE,IAAI,CAAC,gBAAgB;QAC9B,MAAM,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;QACpC,cAAc,EAAE,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ;QAC9C,sBAAsB,EAAE,aAAa;KACtC,CAAC;IAEF,mBAAmB;IACnB,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAEpC,qCAAqC;IACrC,MAAM,cAAc,CAAC,MAAM,EAAE;QAC3B,gBAAgB,EAAE,KAAK;QACvB,eAAe,EAAE,IAAI;KACtB,CAAC,CAAC;IAEH,mBAAmB;IACnB,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEvC,YAAY;IACZ,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM;QACN,SAAS,EAAE,cAAc;QACzB,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE;KACnD,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAAc;IAC1D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,4BAA4B;IAC5B,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAErC,8BAA8B;IAC9B,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,MAAM,4BAA4B,EAAE,CAAC;IAC5E,MAAM,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE9C,qDAAqD;IACrD,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEvC,YAAY;IACZ,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM;QACN,SAAS,EAAE,0BAA0B;QACrC,aAAa,EAAE,MAAM;KACtB,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC;IAEtD,OAAO,cAAc,CAAC;AACxB,CAAC;AAuBD;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAiB,EAAE,IAAmB;IACtE,+CAA+C;IAC/C,IAAI,GAAG,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sDAAsD;IACtD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oDAAoD;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAiB,EACjB,IAAmB;IAEnB,oDAAoD;IACpD,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,oCAAoC;IACpC,QAAQ,GAAG,CAAC,eAAe,EAAE,CAAC;QAC5B,KAAK,gBAAgB;YACnB,OAAO,OAAO,CAAC;QACjB,KAAK,eAAe;YAClB,OAAO,MAAM,CAAC;QAChB,KAAK,cAAc;YACjB,6DAA6D;YAC7D,OAAO,IAAI,CAAC;QACd,KAAK,UAAU,CAAC;QAChB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAO7B;;;;;;;;gCAQ4B,EAC5B,CAAC,KAAK,CAAC,CACR,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAEjD,8EAA8E;IAC9E,MAAM,cAAc,GAAG,UAAU,GAAG,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK;QACzD,CAAC,CAAC,CAAC,CAAC;IAEN,OAAO;QACL,UAAU;QACV,YAAY;QACZ,aAAa;QACb,SAAS;QACT,UAAU;QACV,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/two-factor/totp.d.ts

@@ -0,0 +1,57 @@
+/**
+ * TOTP (Time-based One-Time Password) utilities.
+ *
+ * Implements RFC 6238 TOTP using the `otpauth` library. Provides secret
+ * generation, otpauth:// URI construction, QR code generation for
+ * authenticator app enrollment, and code verification with a ±1 step
+ * time window to accommodate clock drift.
+ *
+ * QR code generation uses the `qrcode` library to produce data URIs
+ * that can be displayed inline in Handlebars templates.
+ */
+/**
+ * Generate a new TOTP secret.
+ *
+ * Creates a 20-byte (160-bit) random secret, which is the standard
+ * size for SHA-1-based TOTP as recommended by RFC 4226 §4.
+ * The secret is returned as a base32-encoded string suitable for
+ * storage (after encryption) and otpauth:// URI construction.
+ *
+ * @returns Base32-encoded TOTP secret
+ */
+export declare function generateTotpSecret(): string;
+/**
+ * Generate an otpauth:// URI for authenticator app enrollment.
+ *
+ * The URI encodes the secret, issuer, account name, and TOTP parameters
+ * in a format understood by Google Authenticator, Authy, 1Password, etc.
+ *
+ * @param secret - Base32-encoded TOTP secret
+ * @param userEmail - User's email address (displayed as account name)
+ * @param issuer - Service name (e.g., "Porta" or org slug)
+ * @returns otpauth:// URI string
+ */
+export declare function generateTotpUri(secret: string, userEmail: string, issuer: string): string;
+/**
+ * Generate a QR code data URI from an otpauth:// URI.
+ *
+ * The returned data URI can be used directly in an <img src="..."> tag
+ * in Handlebars templates. Uses SVG format for crisp rendering at any size.
+ *
+ * @param uri - otpauth:// URI to encode
+ * @returns Data URI string (data:image/svg+xml;base64,...)
+ */
+export declare function generateQrCodeDataUri(uri: string): Promise<string>;
+/**
+ * Verify a TOTP code against a secret.
+ *
+ * Allows a ±1 step time window (i.e., the current 30-second window
+ * plus one window before and one after) to accommodate minor clock
+ * drift between the server and the user's authenticator app.
+ *
+ * @param code - The 6-digit TOTP code entered by the user
+ * @param secret - Base32-encoded TOTP secret
+ * @returns True if the code is valid within the time window
+ */
+export declare function verifyTotpCode(code: string, secret: string): boolean;
+//# sourceMappingURL=totp.d.ts.map

package/dist/two-factor/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/two-factor/totp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,MAAM,CAWR;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAYpE"}