@portaidentity/server 1.7.0

package/dist/users/repository.js

@@ -0,0 +1,499 @@
+/**
+ * User repository — PostgreSQL data access layer.
+ *
+ * Provides CRUD operations for the `users` table using parameterized
+ * queries. Each function acquires the pool via `getPool()` and returns
+ * mapped User objects (or raw password hashes for auth flows).
+ *
+ * This module is the sole interface to the database for user data.
+ * The service layer composes repository + cache + validation.
+ *
+ * Key patterns:
+ * - Dynamic UPDATE query builder for partial updates (~30 fields)
+ * - Paginated listing with mandatory org scope, optional status/search filters
+ * - Whitelisted sort columns to prevent SQL injection
+ * - All rows mapped through `mapRowToUser()`
+ * - password_hash is never returned in User objects (only via getPasswordHash)
+ */
+import { getPool } from '../lib/database.js';
+import { mapRowToUser } from './types.js';
+import { decodeCursor, buildCursorResult } from '../lib/cursor.js';
+/**
+ * Insert a new user into the database.
+ *
+ * Uses RETURNING * to get the full row back in a single round trip.
+ * The email must be unique within the organization (enforced by the
+ * DB unique constraint on (organization_id, email)).
+ *
+ * @param data - User data to insert (password must already be hashed)
+ * @returns The newly created user
+ * @throws If email already exists in the org (unique constraint violation)
+ */
+export async function insertUser(data) {
+    const pool = getPool();
+    const result = await pool.query(`INSERT INTO users (
+       organization_id, email, password_hash, email_verified,
+       given_name, family_name, middle_name, nickname,
+       preferred_username, profile_url, picture_url, website_url,
+       gender, birthdate, zoneinfo, locale, phone_number,
+       address_street, address_locality, address_region,
+       address_postal_code, address_country
+     )
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12,
+             $13, $14, $15, $16, $17, $18, $19, $20, $21, $22)
+     RETURNING *`, [
+        data.organizationId,
+        data.email,
+        data.passwordHash ?? null,
+        data.emailVerified ?? false,
+        data.givenName ?? null,
+        data.familyName ?? null,
+        data.middleName ?? null,
+        data.nickname ?? null,
+        data.preferredUsername ?? null,
+        data.profileUrl ?? null,
+        data.pictureUrl ?? null,
+        data.websiteUrl ?? null,
+        data.gender ?? null,
+        data.birthdate ?? null,
+        data.zoneinfo ?? null,
+        data.locale ?? null,
+        data.phoneNumber ?? null,
+        data.addressStreet ?? null,
+        data.addressLocality ?? null,
+        data.addressRegion ?? null,
+        data.addressPostalCode ?? null,
+        data.addressCountry ?? null,
+    ]);
+    return mapRowToUser(result.rows[0]);
+}
+// ---------------------------------------------------------------------------
+// Find
+// ---------------------------------------------------------------------------
+/**
+ * Find a user by their UUID.
+ *
+ * @param id - User UUID
+ * @returns User or null if not found
+ */
+export async function findUserById(id) {
+    const pool = getPool();
+    const result = await pool.query('SELECT * FROM users WHERE id = $1', [id]);
+    if (result.rows.length === 0)
+        return null;
+    return mapRowToUser(result.rows[0]);
+}
+/**
+ * Find a user by email within a specific organization.
+ *
+ * Email comparison is case-insensitive because the `email` column
+ * uses the CITEXT extension.
+ *
+ * @param orgId - Organization UUID
+ * @param email - User email address
+ * @returns User or null if not found
+ */
+export async function findUserByEmail(orgId, email) {
+    const pool = getPool();
+    const result = await pool.query('SELECT * FROM users WHERE organization_id = $1 AND email = $2', [orgId, email]);
+    if (result.rows.length === 0)
+        return null;
+    return mapRowToUser(result.rows[0]);
+}
+/**
+ * Get the password hash for a user (active users only).
+ *
+ * Returns the raw Argon2id hash for password verification. Only returns
+ * the hash if the user status is 'active' — inactive, suspended, and
+ * locked users cannot authenticate.
+ *
+ * This is the only function that exposes password_hash; the User
+ * interface replaces it with a `hasPassword` boolean.
+ *
+ * @param userId - User UUID
+ * @returns Password hash string, or null if not found / not active / no password
+ */
+export async function getPasswordHash(userId) {
+    const pool = getPool();
+    const result = await pool.query("SELECT password_hash FROM users WHERE id = $1 AND status = 'active'", [userId]);
+    if (result.rows.length === 0)
+        return null;
+    return result.rows[0].password_hash;
+}
+/**
+ * Mapping from UpdateUserData keys to database column names.
+ * Used by the dynamic query builder to construct SET clauses.
+ */
+const FIELD_TO_COLUMN = {
+    email: 'email',
+    emailVerified: 'email_verified',
+    passwordHash: 'password_hash',
+    passwordChangedAt: 'password_changed_at',
+    givenName: 'given_name',
+    familyName: 'family_name',
+    middleName: 'middle_name',
+    nickname: 'nickname',
+    preferredUsername: 'preferred_username',
+    profileUrl: 'profile_url',
+    pictureUrl: 'picture_url',
+    websiteUrl: 'website_url',
+    gender: 'gender',
+    birthdate: 'birthdate',
+    zoneinfo: 'zoneinfo',
+    locale: 'locale',
+    phoneNumber: 'phone_number',
+    phoneNumberVerified: 'phone_number_verified',
+    addressStreet: 'address_street',
+    addressLocality: 'address_locality',
+    addressRegion: 'address_region',
+    addressPostalCode: 'address_postal_code',
+    addressCountry: 'address_country',
+    twoFactorEnabled: 'two_factor_enabled',
+    twoFactorMethod: 'two_factor_method',
+    status: 'status',
+    lockedAt: 'locked_at',
+    lockedReason: 'locked_reason',
+};
+/**
+ * Update a user's fields using a dynamic SET clause.
+ *
+ * Only explicitly provided fields (not undefined) are included in the
+ * UPDATE statement. This allows partial updates without overwriting
+ * fields that weren't specified. Setting a field to `null` clears it.
+ *
+ * The `updated_at` column is handled automatically by the DB trigger.
+ *
+ * @param id - User UUID
+ * @param data - Fields to update (only non-undefined fields are applied)
+ * @returns Updated user
+ * @throws Error if user not found or no fields provided
+ */
+export async function updateUser(id, data) {
+    const pool = getPool();
+    // Build dynamic SET clause from provided fields
+    const setClauses = [];
+    const values = [id]; // $1 is always the ID
+    let paramIndex = 2;
+    for (const [field, column] of Object.entries(FIELD_TO_COLUMN)) {
+        const value = data[field];
+        // Include the field if it's explicitly set (including null for clearing)
+        if (value !== undefined) {
+            setClauses.push(`${column} = $${paramIndex}`);
+            values.push(value);
+            paramIndex++;
+        }
+    }
+    if (setClauses.length === 0) {
+        throw new Error('No fields to update');
+    }
+    const sql = `UPDATE users SET ${setClauses.join(', ')} WHERE id = $1 RETURNING *`;
+    const result = await pool.query(sql, values);
+    if (result.rows.length === 0) {
+        throw new Error('User not found');
+    }
+    return mapRowToUser(result.rows[0]);
+}
+// ---------------------------------------------------------------------------
+// List
+// ---------------------------------------------------------------------------
+/**
+ * Allowed sort columns — whitelisted to prevent SQL injection.
+ * These are interpolated directly into the SQL ORDER BY clause.
+ */
+const ALLOWED_SORT_COLUMNS = {
+    email: 'email',
+    given_name: 'given_name',
+    family_name: 'family_name',
+    created_at: 'created_at',
+    last_login_at: 'last_login_at',
+};
+/**
+ * List users within an organization with pagination, optional filters, and sorting.
+ *
+ * Unlike organization listing, user listing always requires an organization_id
+ * scope — users are never listed across organizations.
+ *
+ * Executes two queries:
+ * 1. COUNT query for total matching rows
+ * 2. Data query with LIMIT/OFFSET for the current page
+ *
+ * Search is case-insensitive (ILIKE) across email, given_name, and family_name.
+ *
+ * @param options - Pagination, filter, and sort options (orgId is required)
+ * @returns Paginated result with users and metadata
+ */
+export async function listUsers(options) {
+    const pool = getPool();
+    const { organizationId, page, pageSize, status, search, sortBy, sortOrder } = options;
+    // Build WHERE conditions — org_id is always required
+    const conditions = ['organization_id = $1'];
+    const params = [organizationId];
+    let paramIndex = 2;
+    if (status) {
+        conditions.push(`status = $${paramIndex}`);
+        params.push(status);
+        paramIndex++;
+    }
+    if (search) {
+        // Search across email, given_name, and family_name
+        conditions.push(`(email ILIKE $${paramIndex} OR given_name ILIKE $${paramIndex} OR family_name ILIKE $${paramIndex})`);
+        params.push(`%${search}%`);
+        paramIndex++;
+    }
+    const whereClause = `WHERE ${conditions.join(' AND ')}`;
+    // Whitelist sort column and direction to prevent SQL injection
+    const sortColumn = ALLOWED_SORT_COLUMNS[sortBy ?? 'created_at'] ?? 'created_at';
+    const direction = sortOrder === 'asc' ? 'ASC' : 'DESC';
+    // Count total matching rows
+    const countResult = await pool.query(`SELECT COUNT(*) as count FROM users ${whereClause}`, params);
+    const total = parseInt(countResult.rows[0].count, 10);
+    // Fetch paginated data
+    const offset = (page - 1) * pageSize;
+    const dataResult = await pool.query(`SELECT * FROM users ${whereClause} ORDER BY ${sortColumn} ${direction} LIMIT $${paramIndex} OFFSET $${paramIndex + 1}`, [...params, pageSize, offset]);
+    return {
+        data: dataResult.rows.map(mapRowToUser),
+        total,
+        page,
+        pageSize,
+        totalPages: Math.ceil(total / pageSize),
+    };
+}
+/**
+ * List users with cursor-based keyset pagination (org-scoped).
+ *
+ * @param options - Cursor pagination, filter, and sort options
+ * @returns Cursor-paginated result with users
+ */
+export async function listUsersCursor(options) {
+    const pool = getPool();
+    const limit = Math.min(Math.max(1, options.limit ?? 25), 100);
+    const sortColumn = ALLOWED_SORT_COLUMNS[options.sortBy ?? 'created_at'] ?? 'created_at';
+    const direction = options.sortOrder === 'asc' ? 'ASC' : 'DESC';
+    const comparator = direction === 'ASC' ? '>' : '<';
+    // Organization scope is always required
+    const conditions = ['organization_id = $1'];
+    const params = [options.organizationId];
+    let paramIndex = 2;
+    if (options.cursor) {
+        const decoded = decodeCursor(options.cursor);
+        if (decoded) {
+            if (decoded.s === null) {
+                conditions.push(`(${sortColumn} IS NOT NULL OR (${sortColumn} IS NULL AND id ${comparator} $${paramIndex}))`);
+                params.push(decoded.i);
+                paramIndex++;
+            }
+            else {
+                conditions.push(`(${sortColumn}, id) ${comparator} ($${paramIndex}, $${paramIndex + 1})`);
+                params.push(decoded.s, decoded.i);
+                paramIndex += 2;
+            }
+        }
+    }
+    if (options.status) {
+        conditions.push(`status = $${paramIndex}`);
+        params.push(options.status);
+        paramIndex++;
+    }
+    if (options.search) {
+        conditions.push(`(email ILIKE $${paramIndex} OR given_name ILIKE $${paramIndex} OR family_name ILIKE $${paramIndex})`);
+        params.push(`%${options.search}%`);
+        paramIndex++;
+    }
+    const whereClause = `WHERE ${conditions.join(' AND ')}`;
+    const sql = `SELECT * FROM users ${whereClause} ORDER BY ${sortColumn} ${direction}, id ${direction} LIMIT $${paramIndex}`;
+    params.push(limit + 1);
+    const result = await pool.query(sql, params);
+    const rows = result.rows.map(mapRowToUser);
+    // Resolve sort value getter based on sort column
+    const getSortValue = (u) => {
+        switch (sortColumn) {
+            case 'email':
+                return u.email;
+            case 'given_name':
+                return u.givenName ?? null;
+            case 'family_name':
+                return u.familyName ?? null;
+            case 'last_login_at':
+                return u.lastLoginAt?.toISOString() ?? null;
+            default:
+                return u.createdAt.toISOString();
+        }
+    };
+    return buildCursorResult(rows, limit, getSortValue, (u) => u.id);
+}
+// ---------------------------------------------------------------------------
+// Utility queries
+// ---------------------------------------------------------------------------
+/**
+ * Check if an email already exists within an organization.
+ *
+ * Used by the service layer to check for duplicates before create/update.
+ * An optional `excludeId` parameter allows excluding a specific user
+ * (useful when updating a user's email — the existing email for that
+ * user should not count as a duplicate).
+ *
+ * @param orgId - Organization UUID
+ * @param email - Email to check (case-insensitive via CITEXT)
+ * @param excludeId - Optional user ID to exclude from the check
+ * @returns true if the email already exists
+ */
+export async function emailExists(orgId, email, excludeId) {
+    const pool = getPool();
+    if (excludeId) {
+        const result = await pool.query('SELECT EXISTS(SELECT 1 FROM users WHERE organization_id = $1 AND email = $2 AND id != $3) as exists', [orgId, email, excludeId]);
+        return result.rows[0].exists;
+    }
+    const result = await pool.query('SELECT EXISTS(SELECT 1 FROM users WHERE organization_id = $1 AND email = $2) as exists', [orgId, email]);
+    return result.rows[0].exists;
+}
+/**
+ * Update login statistics for a user.
+ *
+ * Increments login_count and sets last_login_at to the current timestamp.
+ * Called by the service layer's recordLogin() function after successful
+ * authentication.
+ *
+ * @param id - User UUID
+ */
+export async function updateLoginStats(id) {
+    const pool = getPool();
+    // Also reset failed login counter on successful login
+    await pool.query(`UPDATE users
+     SET last_login_at = NOW(),
+         login_count = login_count + 1,
+         failed_login_count = 0,
+         last_failed_login_at = NULL
+     WHERE id = $1`, [id]);
+}
+/**
+ * Atomic failed login counter increment with conditional auto-lock.
+ *
+ * Increments `failed_login_count` and sets `last_failed_login_at` in a
+ * single UPDATE. If the new count reaches or exceeds `maxAttempts` and
+ * the user is currently `active`, the status is changed to `locked`
+ * with `locked_reason = 'auto_lockout'`.
+ *
+ * Returns the row's new status and count so the caller knows whether
+ * a lock was triggered (for audit logging and cache invalidation).
+ *
+ * @param id - User UUID
+ * @param maxAttempts - Threshold from system_config `max_failed_logins`
+ * @returns New status and failed_login_count after the update
+ */
+export async function incrementFailedLoginCount(id, maxAttempts) {
+    const pool = getPool();
+    const result = await pool.query(`UPDATE users
+     SET failed_login_count = failed_login_count + 1,
+         last_failed_login_at = NOW(),
+         status = CASE
+           WHEN failed_login_count + 1 >= $2 AND status = 'active' THEN 'locked'
+           ELSE status
+         END,
+         locked_at = CASE
+           WHEN failed_login_count + 1 >= $2 AND status = 'active' THEN NOW()
+           ELSE locked_at
+         END,
+         locked_reason = CASE
+           WHEN failed_login_count + 1 >= $2 AND status = 'active' THEN 'auto_lockout'
+           ELSE locked_reason
+         END
+     WHERE id = $1
+     RETURNING status, failed_login_count`, [id, maxAttempts]);
+    const row = result.rows[0];
+    return {
+        status: row?.status ?? 'active',
+        failedLoginCount: row?.failed_login_count ?? 0,
+    };
+}
+/**
+ * Apply the fixed-shape failed-login update only when the selected account remains active.
+ *
+ * Callers pass a non-account UUID when no eligible account exists. PostgreSQL still executes the
+ * same statement, while the status predicate prevents mutation of absent or ineligible accounts.
+ *
+ * @param id - Eligible account UUID or the fixed non-account UUID.
+ * @param maxAttempts - Auto-lock threshold.
+ * @returns Updated status/count, or the neutral no-op result.
+ */
+export async function recordEligiblePasswordFailure(id, maxAttempts) {
+    const pool = getPool();
+    const result = await pool.query(`UPDATE users
+     SET failed_login_count = failed_login_count + 1,
+         last_failed_login_at = NOW(),
+         status = CASE
+           WHEN failed_login_count + 1 >= $2 THEN 'locked'
+           ELSE status
+         END,
+         locked_at = CASE
+           WHEN failed_login_count + 1 >= $2 THEN NOW()
+           ELSE locked_at
+         END,
+         locked_reason = CASE
+           WHEN failed_login_count + 1 >= $2 THEN 'auto_lockout'
+           ELSE locked_reason
+         END
+     WHERE id = $1
+       AND status = 'active'
+     RETURNING status, failed_login_count`, [id, maxAttempts]);
+    const row = result.rows[0];
+    return {
+        status: row?.status ?? 'unmodified',
+        failedLoginCount: row?.failed_login_count ?? 0,
+    };
+}
+/**
+ * Conditionally clear an elapsed automatic lock using a fixed-shape update.
+ *
+ * @param id - Candidate account UUID or the fixed non-account UUID.
+ * @param lockedBefore - Inclusive cutoff for an elapsed automatic lock.
+ * @returns Whether an account was unlocked.
+ */
+export async function unlockEligiblePasswordAccount(id, lockedBefore) {
+    const pool = getPool();
+    const result = await pool.query(`UPDATE users
+     SET status = 'active',
+         locked_at = NULL,
+         locked_reason = NULL,
+         failed_login_count = 0,
+         last_failed_login_at = NULL
+     WHERE id = $1
+       AND status = 'locked'
+       AND locked_reason = 'auto_lockout'
+       AND locked_at <= $2`, [id, lockedBefore]);
+    return result.rowCount === 1;
+}
+/**
+ * Reset the failed login counter and unlock an auto-locked account.
+ *
+ * Used by `checkAutoUnlock` when the lockout cooldown has elapsed.
+ * Only affects rows that are actually auto-locked — the WHERE clause
+ * ensures we don't accidentally unlock manually-locked accounts.
+ *
+ * @param id - User UUID
+ */
+export async function resetFailedLoginCount(id) {
+    const pool = getPool();
+    await pool.query(`UPDATE users
+     SET status = 'active',
+         locked_at = NULL,
+         locked_reason = NULL,
+         failed_login_count = 0,
+         last_failed_login_at = NULL
+     WHERE id = $1
+       AND status = 'locked'
+       AND locked_reason = 'auto_lockout'`, [id]);
+}
+/**
+ * Count the number of users in an organization.
+ *
+ * Useful for organization statistics, license enforcement, or rate limiting.
+ *
+ * @param orgId - Organization UUID
+ * @returns Number of users in the organization
+ */
+export async function countByOrganization(orgId) {
+    const pool = getPool();
+    const result = await pool.query('SELECT COUNT(*) as count FROM users WHERE organization_id = $1', [orgId]);
+    return parseInt(result.rows[0].count, 10);
+}
+//# sourceMappingURL=repository.js.map

package/dist/users/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/users/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AA0CnE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAoB;IACnD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;;;;iBAUa,EACb;QACE,IAAI,CAAC,cAAc;QACnB,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,YAAY,IAAI,IAAI;QACzB,IAAI,CAAC,aAAa,IAAI,KAAK;QAC3B,IAAI,CAAC,SAAS,IAAI,IAAI;QACtB,IAAI,CAAC,UAAU,IAAI,IAAI;QACvB,IAAI,CAAC,UAAU,IAAI,IAAI;QACvB,IAAI,CAAC,QAAQ,IAAI,IAAI;QACrB,IAAI,CAAC,iBAAiB,IAAI,IAAI;QAC9B,IAAI,CAAC,UAAU,IAAI,IAAI;QACvB,IAAI,CAAC,UAAU,IAAI,IAAI;QACvB,IAAI,CAAC,UAAU,IAAI,IAAI;QACvB,IAAI,CAAC,MAAM,IAAI,IAAI;QACnB,IAAI,CAAC,SAAS,IAAI,IAAI;QACtB,IAAI,CAAC,QAAQ,IAAI,IAAI;QACrB,IAAI,CAAC,MAAM,IAAI,IAAI;QACnB,IAAI,CAAC,WAAW,IAAI,IAAI;QACxB,IAAI,CAAC,aAAa,IAAI,IAAI;QAC1B,IAAI,CAAC,eAAe,IAAI,IAAI;QAC5B,IAAI,CAAC,aAAa,IAAI,IAAI;QAC1B,IAAI,CAAC,iBAAiB,IAAI,IAAI;QAC9B,IAAI,CAAC,cAAc,IAAI,IAAI;KAC5B,CACF,CAAC;IAEF,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAU,mCAAmC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEpF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,KAAa;IAChE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,+DAA+D,EAC/D,CAAC,KAAK,EAAE,KAAK,CAAC,CACf,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc;IAClD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,qEAAqE,EACrE,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;AACtC,CAAC;AAoDD;;;GAGG;AACH,MAAM,eAAe,GAA2B;IAC9C,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,eAAe;IAC7B,iBAAiB,EAAE,qBAAqB;IACxC,SAAS,EAAE,YAAY;IACvB,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,UAAU;IACpB,iBAAiB,EAAE,oBAAoB;IACvC,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,cAAc;IAC3B,mBAAmB,EAAE,uBAAuB;IAC5C,aAAa,EAAE,gBAAgB;IAC/B,eAAe,EAAE,kBAAkB;IACnC,aAAa,EAAE,gBAAgB;IAC/B,iBAAiB,EAAE,qBAAqB;IACxC,cAAc,EAAE,iBAAiB;IACjC,gBAAgB,EAAE,oBAAoB;IACtC,eAAe,EAAE,mBAAmB;IACpC,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,WAAW;IACrB,YAAY,EAAE,eAAe;CAC9B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,IAAoB;IAC/D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,gDAAgD;IAChD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB;IACtD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAA6B,CAAC,CAAC;QAClD,yEAAyE;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,UAAU,EAAE,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,oBAAoB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAU,GAAG,EAAE,MAAM,CAAC,CAAC;IAEtD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,oBAAoB,GAA2B;IACnD,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,eAAe;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAwB;IACtD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEtF,qDAAqD;IACrD,MAAM,UAAU,GAAa,CAAC,sBAAsB,CAAC,CAAC;IACtD,MAAM,MAAM,GAAc,CAAC,cAAc,CAAC,CAAC;IAC3C,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,IAAI,CAAC,aAAa,UAAU,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,mDAAmD;QACnD,UAAU,CAAC,IAAI,CACb,iBAAiB,UAAU,yBAAyB,UAAU,0BAA0B,UAAU,GAAG,CACtG,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;QAC3B,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAExD,+DAA+D;IAC/D,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC;IAChF,MAAM,SAAS,GAAG,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAEvD,4BAA4B;IAC5B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAClC,uCAAuC,WAAW,EAAE,EACpD,MAAM,CACP,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtD,uBAAuB;IACvB,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CACjC,uBAAuB,WAAW,aAAa,UAAU,IAAI,SAAS,WAAW,UAAU,YAAY,UAAU,GAAG,CAAC,EAAE,EACvH,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAC9B,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;QACvC,KAAK;QACL,IAAI;QACJ,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;KACxC,CAAC;AACJ,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA+B;IAE/B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC;IACxF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,MAAM,UAAU,GAAG,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAEnD,wCAAwC;IACxC,MAAM,UAAU,GAAa,CAAC,sBAAsB,CAAC,CAAC;IACtD,MAAM,MAAM,GAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvB,UAAU,CAAC,IAAI,CACb,IAAI,UAAU,oBAAoB,UAAU,mBAAmB,UAAU,KAAK,UAAU,IAAI,CAC7F,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACvB,UAAU,EAAE,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,SAAS,UAAU,MAAM,UAAU,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC1F,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBAClC,UAAU,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,aAAa,UAAU,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CACb,iBAAiB,UAAU,yBAAyB,UAAU,0BAA0B,UAAU,GAAG,CACtG,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACnC,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,uBAAuB,WAAW,aAAa,UAAU,IAAI,SAAS,QAAQ,SAAS,WAAW,UAAU,EAAE,CAAC;IAC3H,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAU,GAAG,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE3C,iDAAiD;IACjD,MAAM,YAAY,GAAG,CAAC,CAAO,EAA0B,EAAE;QACvD,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,OAAO;gBACV,OAAO,CAAC,CAAC,KAAK,CAAC;YACjB,KAAK,YAAY;gBACf,OAAO,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC;YAC7B,KAAK,aAAa;gBAChB,OAAO,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC;YAC9B,KAAK,eAAe;gBAClB,OAAO,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;YAC9C;gBACE,OAAO,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QACrC,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,KAAa,EACb,SAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,qGAAqG,EACrG,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAC1B,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,wFAAwF,EACxF,CAAC,KAAK,EAAE,KAAK,CAAC,CACf,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAU;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,sDAAsD;IACtD,MAAM,IAAI,CAAC,KAAK,CACd;;;;;mBAKe,EACf,CAAC,EAAE,CAAC,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAU,EACV,WAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;;;;;;;;;;0CAgBsC,EACtC,CAAC,EAAE,EAAE,WAAW,CAAC,CAClB,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO;QACL,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,QAAQ;QAC/B,gBAAgB,EAAE,GAAG,EAAE,kBAAkB,IAAI,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAU,EACV,WAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;;;;;;;;;;;0CAiBsC,EACtC,CAAC,EAAE,EAAE,WAAW,CAAC,CAClB,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO;QACL,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,YAAY;QACnC,gBAAgB,EAAE,GAAG,EAAE,kBAAkB,IAAI,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAU,EACV,YAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;;;2BASuB,EACvB,CAAC,EAAE,EAAE,YAAY,CAAC,CACnB,CAAC;IACF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAU;IACpD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;;;0CAQsC,EACtC,CAAC,EAAE,CAAC,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,gEAAgE,EAChE,CAAC,KAAK,CAAC,CACR,CAAC;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC"}