@portaidentity/server 1.7.0

package/dist/users/password.js

@@ -0,0 +1,138 @@
+/**
+ * Password management utilities.
+ *
+ * Provides password validation (NIST SP 800-63B compliant length checks),
+ * Argon2id hashing, and verification. Follows the same pattern as
+ * `src/clients/crypto.ts` but with password-specific naming and a
+ * validation function.
+ *
+ * Design decisions:
+ * - No complexity rules (uppercase, special chars) per NIST SP 800-63B
+ *   guidance — length is the primary strength factor
+ * - Argon2id with library defaults (OWASP compliant parameters)
+ * - verifyPassword returns false on any error (invalid hash format, etc.)
+ *   to prevent timing side-channels from leaking hash validity info
+ */
+import { randomBytes } from 'node:crypto';
+import * as argon2 from 'argon2';
+// ---------------------------------------------------------------------------
+// Password constraints (NIST SP 800-63B)
+// ---------------------------------------------------------------------------
+/** Minimum password length per NIST SP 800-63B recommendation */
+export const MIN_PASSWORD_LENGTH = 8;
+/** Maximum password length to prevent denial-of-service via huge inputs */
+export const MAX_PASSWORD_LENGTH = 128;
+/** Process-owned dummy hash used when no eligible account password exists. */
+let dummyPasswordHash = null;
+/** Shared initialization promise preventing duplicate concurrent Argon2id work. */
+let dummyPasswordHashInitialization = null;
+// ---------------------------------------------------------------------------
+// Validation
+// ---------------------------------------------------------------------------
+/**
+ * Validate a password against length constraints.
+ *
+ * Checks min/max length per NIST SP 800-63B. No complexity rules
+ * (uppercase, numbers, special chars) are enforced — NIST recommends
+ * against them as they don't meaningfully improve security and
+ * frustrate users.
+ *
+ * @param password - The plaintext password to validate
+ * @returns Validation result with `isValid` flag and optional `error` message
+ */
+export function validatePassword(password) {
+    if (password.length < MIN_PASSWORD_LENGTH) {
+        return {
+            isValid: false,
+            error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters`,
+        };
+    }
+    if (password.length > MAX_PASSWORD_LENGTH) {
+        return {
+            isValid: false,
+            error: `Password must be at most ${MAX_PASSWORD_LENGTH} characters`,
+        };
+    }
+    return { isValid: true };
+}
+// ---------------------------------------------------------------------------
+// Hashing
+// ---------------------------------------------------------------------------
+/**
+ * Hash a password using Argon2id.
+ *
+ * Argon2id combines Argon2d (GPU-resistant) and Argon2i (side-channel
+ * resistant). The argon2 library's default parameters follow OWASP
+ * recommendations for password hashing.
+ *
+ * The returned hash string includes the algorithm, salt, and parameters
+ * in PHC format — everything needed for verification.
+ *
+ * @param plaintext - The password to hash
+ * @returns Argon2id hash string (PHC format)
+ */
+export async function hashPassword(plaintext) {
+    return argon2.hash(plaintext, {
+        type: argon2.argon2id,
+    });
+}
+/**
+ * Initialize the process-owned Argon2id dummy hash.
+ *
+ * Startup awaits this operation so an authentication process never serves requests with a cheap
+ * missing-account branch. Repeated calls are idempotent for the lifetime of the process.
+ */
+export async function initializeDummyPasswordHash() {
+    if (dummyPasswordHash !== null)
+        return;
+    dummyPasswordHashInitialization ??= hashPassword(randomBytes(32).toString('base64url'));
+    dummyPasswordHash = await dummyPasswordHashInitialization;
+}
+/**
+ * Read the initialized process-owned dummy hash.
+ *
+ * @returns Argon2id hash with no authentication authority.
+ * @throws Error when startup did not initialize the dummy hash.
+ */
+export function getDummyPasswordHash() {
+    if (dummyPasswordHash === null) {
+        throw new Error('Dummy password hash has not been initialized');
+    }
+    return dummyPasswordHash;
+}
+/**
+ * Return the process-owned dummy hash, initializing it when an embedded app bypassed the entry
+ * point. Production startup still awaits initialization before listening.
+ *
+ * @returns Initialized non-authoritative Argon2id hash.
+ */
+export async function ensureDummyPasswordHash() {
+    await initializeDummyPasswordHash();
+    return getDummyPasswordHash();
+}
+// ---------------------------------------------------------------------------
+// Verification
+// ---------------------------------------------------------------------------
+/**
+ * Verify a plaintext password against a stored Argon2id hash.
+ *
+ * Returns true if the password matches, false otherwise. Any errors
+ * during verification (e.g., invalid hash format) are caught and
+ * treated as a non-match to prevent timing side-channels from
+ * leaking information about hash validity.
+ *
+ * @param hash - Stored Argon2id hash (PHC format)
+ * @param plaintext - Password to verify
+ * @returns true if the password matches the hash, false otherwise
+ */
+export async function verifyPassword(hash, plaintext) {
+    try {
+        return await argon2.verify(hash, plaintext);
+    }
+    catch {
+        // Return false on any error (invalid hash format, etc.)
+        // to prevent timing side-channels
+        return false;
+    }
+}
+//# sourceMappingURL=password.js.map

package/dist/users/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/users/password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,8EAA8E;AAC9E,IAAI,iBAAiB,GAAkB,IAAI,CAAC;AAE5C,mFAAmF;AACnF,IAAI,+BAA+B,GAA2B,IAAI,CAAC;AAYnE,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC1C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,6BAA6B,mBAAmB,aAAa;SACrE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC1C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,4BAA4B,mBAAmB,aAAa;SACpE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE;QAC5B,IAAI,EAAE,MAAM,CAAC,QAAQ;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,IAAI,iBAAiB,KAAK,IAAI;QAAE,OAAO;IACvC,+BAA+B,KAAK,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACxF,iBAAiB,GAAG,MAAM,+BAA+B,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,MAAM,2BAA2B,EAAE,CAAC;IACpC,OAAO,oBAAoB,EAAE,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,SAAiB;IAClE,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,kCAAkC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/users/repository.d.ts

@@ -0,0 +1,263 @@
+/**
+ * User repository — PostgreSQL data access layer.
+ *
+ * Provides CRUD operations for the `users` table using parameterized
+ * queries. Each function acquires the pool via `getPool()` and returns
+ * mapped User objects (or raw password hashes for auth flows).
+ *
+ * This module is the sole interface to the database for user data.
+ * The service layer composes repository + cache + validation.
+ *
+ * Key patterns:
+ * - Dynamic UPDATE query builder for partial updates (~30 fields)
+ * - Paginated listing with mandatory org scope, optional status/search filters
+ * - Whitelisted sort columns to prevent SQL injection
+ * - All rows mapped through `mapRowToUser()`
+ * - password_hash is never returned in User objects (only via getPasswordHash)
+ */
+import type { UserListOptions, PaginatedResult, User } from './types.js';
+import type { CursorPaginatedResult } from '../lib/cursor.js';
+/**
+ * Input data for inserting a new user row.
+ *
+ * The service layer is responsible for hashing passwords before calling
+ * this function — `passwordHash` is the already-hashed value, not plaintext.
+ */
+export interface InsertUserData {
+    organizationId: string;
+    email: string;
+    passwordHash?: string | null;
+    emailVerified?: boolean;
+    givenName?: string | null;
+    familyName?: string | null;
+    middleName?: string | null;
+    nickname?: string | null;
+    preferredUsername?: string | null;
+    profileUrl?: string | null;
+    pictureUrl?: string | null;
+    websiteUrl?: string | null;
+    gender?: string | null;
+    birthdate?: string | null;
+    zoneinfo?: string | null;
+    locale?: string | null;
+    phoneNumber?: string | null;
+    addressStreet?: string | null;
+    addressLocality?: string | null;
+    addressRegion?: string | null;
+    addressPostalCode?: string | null;
+    addressCountry?: string | null;
+}
+/**
+ * Insert a new user into the database.
+ *
+ * Uses RETURNING * to get the full row back in a single round trip.
+ * The email must be unique within the organization (enforced by the
+ * DB unique constraint on (organization_id, email)).
+ *
+ * @param data - User data to insert (password must already be hashed)
+ * @returns The newly created user
+ * @throws If email already exists in the org (unique constraint violation)
+ */
+export declare function insertUser(data: InsertUserData): Promise<User>;
+/**
+ * Find a user by their UUID.
+ *
+ * @param id - User UUID
+ * @returns User or null if not found
+ */
+export declare function findUserById(id: string): Promise<User | null>;
+/**
+ * Find a user by email within a specific organization.
+ *
+ * Email comparison is case-insensitive because the `email` column
+ * uses the CITEXT extension.
+ *
+ * @param orgId - Organization UUID
+ * @param email - User email address
+ * @returns User or null if not found
+ */
+export declare function findUserByEmail(orgId: string, email: string): Promise<User | null>;
+/**
+ * Get the password hash for a user (active users only).
+ *
+ * Returns the raw Argon2id hash for password verification. Only returns
+ * the hash if the user status is 'active' — inactive, suspended, and
+ * locked users cannot authenticate.
+ *
+ * This is the only function that exposes password_hash; the User
+ * interface replaces it with a `hasPassword` boolean.
+ *
+ * @param userId - User UUID
+ * @returns Password hash string, or null if not found / not active / no password
+ */
+export declare function getPasswordHash(userId: string): Promise<string | null>;
+/**
+ * Fields that can be updated on a user.
+ *
+ * The service layer validates and transforms data before calling this
+ * function. For example, passwords are hashed before being passed as
+ * `passwordHash`.
+ */
+export interface UpdateUserData {
+    email?: string;
+    emailVerified?: boolean;
+    passwordHash?: string | null;
+    passwordChangedAt?: Date | null;
+    givenName?: string | null;
+    familyName?: string | null;
+    middleName?: string | null;
+    nickname?: string | null;
+    preferredUsername?: string | null;
+    profileUrl?: string | null;
+    pictureUrl?: string | null;
+    websiteUrl?: string | null;
+    gender?: string | null;
+    birthdate?: string | null;
+    zoneinfo?: string | null;
+    locale?: string | null;
+    phoneNumber?: string | null;
+    phoneNumberVerified?: boolean;
+    addressStreet?: string | null;
+    addressLocality?: string | null;
+    addressRegion?: string | null;
+    addressPostalCode?: string | null;
+    addressCountry?: string | null;
+    twoFactorEnabled?: boolean;
+    twoFactorMethod?: string | null;
+    status?: string;
+    lockedAt?: Date | null;
+    lockedReason?: string | null;
+}
+/**
+ * Update a user's fields using a dynamic SET clause.
+ *
+ * Only explicitly provided fields (not undefined) are included in the
+ * UPDATE statement. This allows partial updates without overwriting
+ * fields that weren't specified. Setting a field to `null` clears it.
+ *
+ * The `updated_at` column is handled automatically by the DB trigger.
+ *
+ * @param id - User UUID
+ * @param data - Fields to update (only non-undefined fields are applied)
+ * @returns Updated user
+ * @throws Error if user not found or no fields provided
+ */
+export declare function updateUser(id: string, data: UpdateUserData): Promise<User>;
+/**
+ * List users within an organization with pagination, optional filters, and sorting.
+ *
+ * Unlike organization listing, user listing always requires an organization_id
+ * scope — users are never listed across organizations.
+ *
+ * Executes two queries:
+ * 1. COUNT query for total matching rows
+ * 2. Data query with LIMIT/OFFSET for the current page
+ *
+ * Search is case-insensitive (ILIKE) across email, given_name, and family_name.
+ *
+ * @param options - Pagination, filter, and sort options (orgId is required)
+ * @returns Paginated result with users and metadata
+ */
+export declare function listUsers(options: UserListOptions): Promise<PaginatedResult<User>>;
+/** Options for cursor-based user listing */
+export interface ListUsersCursorOptions {
+    organizationId: string;
+    cursor?: string;
+    limit?: number;
+    status?: string;
+    search?: string;
+    sortBy?: string;
+    sortOrder?: 'asc' | 'desc';
+}
+/**
+ * List users with cursor-based keyset pagination (org-scoped).
+ *
+ * @param options - Cursor pagination, filter, and sort options
+ * @returns Cursor-paginated result with users
+ */
+export declare function listUsersCursor(options: ListUsersCursorOptions): Promise<CursorPaginatedResult<User>>;
+/**
+ * Check if an email already exists within an organization.
+ *
+ * Used by the service layer to check for duplicates before create/update.
+ * An optional `excludeId` parameter allows excluding a specific user
+ * (useful when updating a user's email — the existing email for that
+ * user should not count as a duplicate).
+ *
+ * @param orgId - Organization UUID
+ * @param email - Email to check (case-insensitive via CITEXT)
+ * @param excludeId - Optional user ID to exclude from the check
+ * @returns true if the email already exists
+ */
+export declare function emailExists(orgId: string, email: string, excludeId?: string): Promise<boolean>;
+/**
+ * Update login statistics for a user.
+ *
+ * Increments login_count and sets last_login_at to the current timestamp.
+ * Called by the service layer's recordLogin() function after successful
+ * authentication.
+ *
+ * @param id - User UUID
+ */
+export declare function updateLoginStats(id: string): Promise<void>;
+/**
+ * Atomic failed login counter increment with conditional auto-lock.
+ *
+ * Increments `failed_login_count` and sets `last_failed_login_at` in a
+ * single UPDATE. If the new count reaches or exceeds `maxAttempts` and
+ * the user is currently `active`, the status is changed to `locked`
+ * with `locked_reason = 'auto_lockout'`.
+ *
+ * Returns the row's new status and count so the caller knows whether
+ * a lock was triggered (for audit logging and cache invalidation).
+ *
+ * @param id - User UUID
+ * @param maxAttempts - Threshold from system_config `max_failed_logins`
+ * @returns New status and failed_login_count after the update
+ */
+export declare function incrementFailedLoginCount(id: string, maxAttempts: number): Promise<{
+    status: string;
+    failedLoginCount: number;
+}>;
+/**
+ * Apply the fixed-shape failed-login update only when the selected account remains active.
+ *
+ * Callers pass a non-account UUID when no eligible account exists. PostgreSQL still executes the
+ * same statement, while the status predicate prevents mutation of absent or ineligible accounts.
+ *
+ * @param id - Eligible account UUID or the fixed non-account UUID.
+ * @param maxAttempts - Auto-lock threshold.
+ * @returns Updated status/count, or the neutral no-op result.
+ */
+export declare function recordEligiblePasswordFailure(id: string, maxAttempts: number): Promise<{
+    status: string;
+    failedLoginCount: number;
+}>;
+/**
+ * Conditionally clear an elapsed automatic lock using a fixed-shape update.
+ *
+ * @param id - Candidate account UUID or the fixed non-account UUID.
+ * @param lockedBefore - Inclusive cutoff for an elapsed automatic lock.
+ * @returns Whether an account was unlocked.
+ */
+export declare function unlockEligiblePasswordAccount(id: string, lockedBefore: Date): Promise<boolean>;
+/**
+ * Reset the failed login counter and unlock an auto-locked account.
+ *
+ * Used by `checkAutoUnlock` when the lockout cooldown has elapsed.
+ * Only affects rows that are actually auto-locked — the WHERE clause
+ * ensures we don't accidentally unlock manually-locked accounts.
+ *
+ * @param id - User UUID
+ */
+export declare function resetFailedLoginCount(id: string): Promise<void>;
+/**
+ * Count the number of users in an organization.
+ *
+ * Useful for organization statistics, license enforcement, or rate limiting.
+ *
+ * @param orgId - Organization UUID
+ * @returns Number of users in the organization
+ */
+export declare function countByOrganization(orgId: string): Promise<number>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/users/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/users/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAW,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAGlF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAM9D;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;IAGxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAG5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CpE;AAMD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAOnE;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAUxF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAU5E;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAGhC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAG9B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAG/B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAqCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhF;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAmDxF;AAMD,4CAA4C;AAC5C,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAmEtC;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAahE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BvD;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BvD;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,IAAI,GACjB,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAerE;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE"}