@portaidentity/server 1.7.0

package/dist/auth/rate-limiter.js

@@ -0,0 +1,220 @@
+/**
+ * Redis-based sliding window rate limiter.
+ *
+ * Uses INCR + EXPIRE for atomic counter management. Each action type
+ * (login, magic link, password reset) has its own key format and
+ * configurable limits loaded from system_config with sensible defaults.
+ *
+ * Graceful degradation: if Redis is unavailable, requests are ALLOWED
+ * with a warning log — we never block legitimate users due to Redis failure.
+ *
+ * Key format: ratelimit:{action}:{org_id}:{identifier_hash}
+ *
+ * @example
+ *   const key = buildLoginRateLimitKey(orgId, ip, email);
+ *   const config = await loadLoginRateLimitConfig();
+ *   const result = await checkRateLimit(key, config);
+ *   if (!result.allowed) {
+ *     ctx.status = 429;
+ *     ctx.set('Retry-After', String(result.retryAfter));
+ *   }
+ */
+import crypto from 'node:crypto';
+import { getRedis } from '../lib/redis.js';
+import { getSystemConfigNumber } from '../lib/system-config.js';
+import { logger } from '../lib/logger.js';
+// ---------------------------------------------------------------------------
+// Rate limit check
+// ---------------------------------------------------------------------------
+/**
+ * Check if a request is within the rate limit for the given key.
+ *
+ * Uses Redis INCR + conditional EXPIRE for atomic counter management:
+ *   1. INCR the key (creates it at 1 if new)
+ *   2. If TTL is -1 (no expiry), set EXPIRE to windowSeconds
+ *   3. Compare count against max — reject if exceeded
+ *
+ * On Redis failure, returns allowed: true with a warning log.
+ *
+ * @param key - Rate limit key (use a build*Key function to construct)
+ * @param config - Rate limit configuration (max requests + window)
+ * @returns Rate limit result with allowed status and metadata
+ */
+export async function checkRateLimit(key, config) {
+    try {
+        return await executeRateLimit(key, config);
+    }
+    catch (error) {
+        // Graceful degradation: allow request on Redis failure
+        logger.warn({ error, key }, 'Rate limiter Redis error — allowing request');
+        return {
+            allowed: true,
+            remaining: config.max,
+            resetAt: new Date(Date.now() + config.windowSeconds * 1000),
+            retryAfter: 0,
+        };
+    }
+}
+/**
+ * Check a security-critical limit without allowing Redis failure to bypass the boundary.
+ *
+ * @param key - Privacy-safe, domain-separated Redis key.
+ * @param config - Maximum attempts and fixed window.
+ * @returns Current limit decision.
+ * @throws When Redis cannot durably increment and expire the attempt counter.
+ */
+export async function checkRateLimitStrict(key, config) {
+    return executeRateLimit(key, config);
+}
+/** Execute the shared Redis counter algorithm without selecting a failure policy. */
+async function executeRateLimit(key, config) {
+    const redis = getRedis();
+    const count = await redis.incr(key);
+    if (count === 1)
+        await redis.expire(key, config.windowSeconds);
+    const ttl = await redis.ttl(key);
+    if (ttl === -1)
+        await redis.expire(key, config.windowSeconds);
+    const effectiveTtl = ttl > 0 ? ttl : config.windowSeconds;
+    const resetAt = new Date(Date.now() + effectiveTtl * 1_000);
+    return count > config.max
+        ? { allowed: false, remaining: 0, resetAt, retryAfter: effectiveTtl }
+        : { allowed: true, remaining: config.max - count, resetAt, retryAfter: 0 };
+}
+// ---------------------------------------------------------------------------
+// Rate limit reset
+// ---------------------------------------------------------------------------
+/**
+ * Reset the rate limit counter for a key.
+ *
+ * Called after successful authentication to clear the counter,
+ * allowing the user to make fresh attempts if they log out and back in.
+ *
+ * @param key - Rate limit key to reset
+ */
+export async function resetRateLimit(key) {
+    try {
+        const redis = getRedis();
+        await redis.del(key);
+    }
+    catch (error) {
+        // Non-critical — log and continue
+        logger.warn({ error, key }, 'Failed to reset rate limit counter');
+    }
+}
+// ---------------------------------------------------------------------------
+// Key builders
+// ---------------------------------------------------------------------------
+/**
+ * Hash an identifier for use in rate limit keys.
+ * Uses SHA-256 to normalize variable-length inputs into fixed-length keys
+ * and prevent PII from appearing in Redis key names.
+ *
+ * @param value - The raw identifier to hash
+ * @returns First 16 hex chars of SHA-256 (64-bit — enough for key uniqueness)
+ */
+function hashIdentifier(value) {
+    return crypto.createHash('sha256').update(value).digest('hex').slice(0, 16);
+}
+/**
+ * Build a rate limit key for login attempts.
+ * Combines IP + email to rate-limit per user per source IP.
+ *
+ * Format: ratelimit:login:{org_id}:{sha256(ip + email)[:16]}
+ *
+ * @param orgId - Organization UUID
+ * @param ip - Client IP address
+ * @param email - Email address being attempted
+ * @returns Rate limit key string
+ */
+export function buildLoginRateLimitKey(orgId, ip, email) {
+    return `ratelimit:login:${orgId}:${hashIdentifier(ip + email)}`;
+}
+/**
+ * Build a rate limit key for magic link requests.
+ * Rate-limits per email to prevent spam.
+ *
+ * Format: ratelimit:magic:{org_id}:{sha256(email)[:16]}
+ *
+ * @param orgId - Organization UUID
+ * @param email - Email address requesting magic link
+ * @returns Rate limit key string
+ */
+export function buildMagicLinkRateLimitKey(orgId, email) {
+    return `ratelimit:magic:${orgId}:${hashIdentifier(email)}`;
+}
+/**
+ * Build the callback-attempt key from tenant, direct socket peer, and protected artifact digest.
+ *
+ * @param orgId - Route organization UUID.
+ * @param socketPeer - Direct TCP peer rather than a caller-controlled forwarding header.
+ * @param artifactDigest - Domain-separated keyed digest of the presented artifact.
+ * @returns Privacy-safe Redis key with isolated tenant, peer, and artifact budgets.
+ */
+export function buildMagicLinkCallbackRateLimitKey(orgId, socketPeer, artifactDigest) {
+    return `ratelimit:magic-callback:${orgId}:${hashIdentifier(socketPeer)}:${artifactDigest}`;
+}
+/**
+ * Build a rate limit key for password reset requests.
+ * Rate-limits per email to prevent abuse.
+ *
+ * Format: ratelimit:reset:{org_id}:{sha256(email)[:16]}
+ *
+ * @param orgId - Organization UUID
+ * @param email - Email address requesting password reset
+ * @returns Rate limit key string
+ */
+/**
+ * Build a generic rate limit key for custom actions (e.g., 2FA verification, OTP resend).
+ *
+ * @param action - Action identifier (e.g., '2fa_verify', '2fa_resend')
+ * @param orgId - Organization UUID
+ * @param identifier - User-specific identifier (e.g., userId)
+ * @returns Redis key string
+ */
+export function buildRateLimitKey(action, orgId, identifier) {
+    return `ratelimit:${action}:${orgId}:${hashIdentifier(identifier)}`;
+}
+export function buildPasswordResetRateLimitKey(orgId, email) {
+    return `ratelimit:reset:${orgId}:${hashIdentifier(email)}`;
+}
+// ---------------------------------------------------------------------------
+// Config loaders
+// ---------------------------------------------------------------------------
+/**
+ * Load login rate limit configuration from system_config.
+ *
+ * @returns Rate limit config with max attempts and window duration
+ */
+export async function loadLoginRateLimitConfig() {
+    const [max, windowSeconds] = await Promise.all([
+        getSystemConfigNumber('rate_limit_login_max', 10),
+        getSystemConfigNumber('rate_limit_login_window', 900),
+    ]);
+    return { max, windowSeconds };
+}
+/**
+ * Load magic link rate limit configuration from system_config.
+ *
+ * @returns Rate limit config with max requests and window duration
+ */
+export async function loadMagicLinkRateLimitConfig() {
+    const [max, windowSeconds] = await Promise.all([
+        getSystemConfigNumber('rate_limit_magic_link_max', 5),
+        getSystemConfigNumber('rate_limit_magic_link_window', 900),
+    ]);
+    return { max, windowSeconds };
+}
+/**
+ * Load password reset rate limit configuration from system_config.
+ *
+ * @returns Rate limit config with max requests and window duration
+ */
+export async function loadPasswordResetRateLimitConfig() {
+    const [max, windowSeconds] = await Promise.all([
+        getSystemConfigNumber('rate_limit_password_reset_max', 5),
+        getSystemConfigNumber('rate_limit_password_reset_window', 900),
+    ]);
+    return { max, windowSeconds };
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/auth/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/auth/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA0B1C,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,MAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uDAAuD;QACvD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,6CAA6C,CAAC,CAAC;QAC3E,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;YAC3D,UAAU,EAAE,CAAC;SACd,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,MAAuB;IAEvB,OAAO,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,MAAuB;IAClE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,CAAC;IAC5D,OAAO,KAAK,GAAG,MAAM,CAAC,GAAG;QACvB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE;QACrE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,GAAG,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kCAAkC;QAClC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,EAAU,EAAE,KAAa;IAC7E,OAAO,mBAAmB,KAAK,IAAI,cAAc,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,KAAa;IACrE,OAAO,mBAAmB,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kCAAkC,CAChD,KAAa,EACb,UAAkB,EAClB,cAAsB;IAEtB,OAAO,4BAA4B,KAAK,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,cAAc,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;;;GASG;AACH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,KAAa,EAAE,UAAkB;IACjF,OAAO,aAAa,MAAM,IAAI,KAAK,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAAa,EAAE,KAAa;IACzE,OAAO,mBAAmB,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,qBAAqB,CAAC,sBAAsB,EAAE,EAAE,CAAC;QACjD,qBAAqB,CAAC,yBAAyB,EAAE,GAAG,CAAC;KACtD,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B;IAChD,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,qBAAqB,CAAC,2BAA2B,EAAE,CAAC,CAAC;QACrD,qBAAqB,CAAC,8BAA8B,EAAE,GAAG,CAAC;KAC3D,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC;IACpD,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,qBAAqB,CAAC,+BAA+B,EAAE,CAAC,CAAC;QACzD,qBAAqB,CAAC,kCAAkC,EAAE,GAAG,CAAC;KAC/D,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;AAChC,CAAC"}

package/dist/auth/recovery-crypto.d.ts

@@ -0,0 +1,34 @@
+/** Cryptographic protection for durable account-recovery work. */
+import type { ProtectedRecoveryAddress, RecoveryJobType } from './recovery-job-repository.js';
+/** Public authority fields used to identify one recovery operation. */
+export interface RecoveryRequestAuthority {
+    /** Resolved tenant UUID. */
+    readonly organizationId: string;
+    /** Closed recovery operation. */
+    readonly jobType: RecoveryJobType;
+    /** OIDC interaction binding for magic links. */
+    readonly interactionUid: string | null;
+}
+/** Durable authority fields authenticated with every protected address. */
+export interface RecoveryAddressAuthority extends RecoveryRequestAuthority {
+    /** Keyed request identity persisted beside the encrypted address. */
+    readonly idempotencyDigest: string;
+}
+/** Normalize and validate a public recovery email address. */
+export declare function normalizeRecoveryAddress(address: string): string;
+/** Encrypt a normalized recovery address with the active rotating cookie key. */
+export declare function protectRecoveryAddress(address: string, authority: RecoveryAddressAuthority): ProtectedRecoveryAddress;
+/** Decrypt and authenticate a protected recovery address using the retained key ring. */
+export declare function revealRecoveryAddress(protectedAddress: ProtectedRecoveryAddress, authority: RecoveryAddressAuthority): string;
+/** Derive a non-reversible idempotency digest for one admitted public action. */
+export declare function recoveryIdempotencyDigest(authority: RecoveryRequestAuthority, actionNonce: string): string;
+/** Derive the stable unpredictable plaintext token owned by one durable job. */
+export declare function recoveryArtifactToken(jobId: string, jobType: RecoveryJobType, addressKeyId: string): string;
+/**
+ * Derive a non-reversible callback identity without retaining the presented bearer artifact.
+ *
+ * @param artifact - Plaintext callback artifact held only for the current request.
+ * @returns A short keyed digest safe for an ephemeral rate-limit key.
+ */
+export declare function magicLinkCallbackArtifactDigest(artifact: string): string;
+//# sourceMappingURL=recovery-crypto.d.ts.map

package/dist/auth/recovery-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-crypto.d.ts","sourceRoot":"","sources":["../../src/auth/recovery-crypto.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAYlE,OAAO,KAAK,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAS9F,uEAAuE;AACvE,MAAM,WAAW,wBAAwB;IACvC,4BAA4B;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,iCAAiC;IACjC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,gDAAgD;IAChD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,2EAA2E;AAC3E,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,8DAA8D;AAC9D,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhE;AAsBD,iFAAiF;AACjF,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,wBAAwB,GAClC,wBAAwB,CAkB1B;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,wBAAwB,EAC1C,SAAS,EAAE,wBAAwB,GAClC,MAAM,CAqBR;AAED,iFAAiF;AACjF,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,wBAAwB,EACnC,WAAW,EAAE,MAAM,GAClB,MAAM,CAOR;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,MAAM,GACnB,MAAM,CAQR;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGxE"}

package/dist/auth/recovery-crypto.js

@@ -0,0 +1,103 @@
+/** Cryptographic protection for durable account-recovery work. */
+import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, } from 'node:crypto';
+import { z } from 'zod';
+import { config } from '../config/index.js';
+const ADDRESS_CONTEXT = 'porta/recovery-address/v1';
+const IDEMPOTENCY_CONTEXT = 'porta/recovery-idempotency/v1';
+const TOKEN_CONTEXT = 'porta/recovery-token/v1';
+const CALLBACK_CONTEXT = 'porta/magic-link-callback/v1';
+const ALGORITHM = 'aes-256-gcm';
+const addressSchema = z.string().trim().toLowerCase().email().max(255);
+/** Normalize and validate a public recovery email address. */
+export function normalizeRecoveryAddress(address) {
+    return addressSchema.parse(address);
+}
+function deriveKey(secret, context) {
+    return Buffer.from(hkdfSync('sha256', Buffer.from(secret), Buffer.alloc(0), context, 32));
+}
+function keyId(key) {
+    return createHash('sha256').update(key).digest('base64url').slice(0, 22);
+}
+function aad(authority) {
+    return Buffer.from(JSON.stringify([
+        ADDRESS_CONTEXT,
+        authority.organizationId,
+        authority.jobType,
+        authority.interactionUid,
+        authority.idempotencyDigest,
+    ]));
+}
+/** Encrypt a normalized recovery address with the active rotating cookie key. */
+export function protectRecoveryAddress(address, authority) {
+    const normalized = normalizeRecoveryAddress(address);
+    const key = deriveKey(config.cookieKeys[0], ADDRESS_CONTEXT);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    cipher.setAAD(aad(authority));
+    const encoded = Buffer.from(normalized, 'utf8');
+    if (encoded.length > 510)
+        throw new Error('Normalized recovery address is too large');
+    const padded = randomBytes(512);
+    padded.writeUInt16BE(encoded.length, 0);
+    encoded.copy(padded, 2);
+    const ciphertext = Buffer.concat([cipher.update(padded), cipher.final()]);
+    return {
+        ciphertext: ciphertext.toString('base64url'),
+        iv: iv.toString('base64url'),
+        tag: cipher.getAuthTag().toString('base64url'),
+        keyId: keyId(key),
+    };
+}
+/** Decrypt and authenticate a protected recovery address using the retained key ring. */
+export function revealRecoveryAddress(protectedAddress, authority) {
+    for (const secret of config.cookieKeys) {
+        const key = deriveKey(secret, ADDRESS_CONTEXT);
+        if (keyId(key) !== protectedAddress.keyId)
+            continue;
+        const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(protectedAddress.iv, 'base64url'));
+        decipher.setAAD(aad(authority));
+        decipher.setAuthTag(Buffer.from(protectedAddress.tag, 'base64url'));
+        const padded = Buffer.concat([
+            decipher.update(Buffer.from(protectedAddress.ciphertext, 'base64url')),
+            decipher.final(),
+        ]);
+        if (padded.length !== 512)
+            throw new Error('Protected recovery address has invalid length');
+        const length = padded.readUInt16BE(0);
+        if (length > 510)
+            throw new Error('Protected recovery address has invalid content');
+        return normalizeRecoveryAddress(padded.subarray(2, 2 + length).toString('utf8'));
+    }
+    throw new Error('Protected recovery address key is unavailable');
+}
+/** Derive a non-reversible idempotency digest for one admitted public action. */
+export function recoveryIdempotencyDigest(authority, actionNonce) {
+    const key = deriveKey(config.cookieKeys[0], IDEMPOTENCY_CONTEXT);
+    return createHmac('sha256', key)
+        .update(JSON.stringify([authority.organizationId, authority.jobType, authority.interactionUid]))
+        .update('\0')
+        .update(actionNonce)
+        .digest('hex');
+}
+/** Derive the stable unpredictable plaintext token owned by one durable job. */
+export function recoveryArtifactToken(jobId, jobType, addressKeyId) {
+    const secret = config.cookieKeys.find((candidate) => {
+        const addressKey = deriveKey(candidate, ADDRESS_CONTEXT);
+        return keyId(addressKey) === addressKeyId;
+    });
+    if (!secret)
+        throw new Error('Recovery artifact key is unavailable');
+    const key = deriveKey(secret, TOKEN_CONTEXT);
+    return createHmac('sha256', key).update(jobType).update('\0').update(jobId).digest('base64url');
+}
+/**
+ * Derive a non-reversible callback identity without retaining the presented bearer artifact.
+ *
+ * @param artifact - Plaintext callback artifact held only for the current request.
+ * @returns A short keyed digest safe for an ephemeral rate-limit key.
+ */
+export function magicLinkCallbackArtifactDigest(artifact) {
+    const key = deriveKey(config.cookieKeys[0], CALLBACK_CONTEXT);
+    return createHmac('sha256', key).update(artifact).digest('base64url').slice(0, 22);
+}
+//# sourceMappingURL=recovery-crypto.js.map

package/dist/auth/recovery-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-crypto.js","sourceRoot":"","sources":["../../src/auth/recovery-crypto.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAElE,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,EACR,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,MAAM,eAAe,GAAG,2BAA2B,CAAC;AACpD,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAC5D,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AACxD,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAkBvE,8DAA8D;AAC9D,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,OAAe;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,GAAG,CAAC,SAAmC;IAC9C,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,CAAC,SAAS,CAAC;QACb,eAAe;QACf,SAAS,CAAC,cAAc;QACxB,SAAS,CAAC,OAAO;QACjB,SAAS,CAAC,cAAc;QACxB,SAAS,CAAC,iBAAiB;KAC5B,CAAC,CACH,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,SAAmC;IAEnC,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1E,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5C,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5B,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC9C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;KAClB,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CACnC,gBAA0C,EAC1C,SAAmC;IAEnC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,gBAAgB,CAAC,KAAK;YAAE,SAAS;QACpD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,SAAS,EACT,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,WAAW,CAAC,CAC9C,CAAC;QACF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAChC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACtE,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpF,OAAO,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AACnE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,yBAAyB,CACvC,SAAmC,EACnC,WAAmB;IAEnB,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACjE,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;SAC/F,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,WAAW,CAAC;SACnB,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,OAAwB,EACxB,YAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QAClD,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,YAAY,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,QAAgB;IAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC9D,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC"}

package/dist/auth/recovery-job-processor.d.ts

@@ -0,0 +1,24 @@
+/** Account-specific processing for durable recovery jobs. */
+import type { ClaimedRecoveryJob } from './recovery-job-repository.js';
+import { type RecoveryJobProcessingResult, type RecoveryJobProcessor } from './recovery-worker.js';
+import type { InteractionAuthorityResolver } from './interaction-authority.js';
+/** Concrete tenant-scoped processor for magic-link and password-reset work. */
+export declare class AccountRecoveryJobProcessor implements RecoveryJobProcessor {
+    protected readonly interactionAuthority?: InteractionAuthorityResolver | undefined;
+    /**
+     * Create a processor with the provider-owned interaction boundary used by magic-link work.
+     *
+     * @param interactionAuthority - Live interaction resolver. Password-reset jobs do not use it.
+     */
+    constructor(interactionAuthority?: InteractionAuthorityResolver | undefined);
+    /** Resolve eligibility, create one artifact, and deliver its stable link. */
+    process(job: ClaimedRecoveryJob): Promise<RecoveryJobProcessingResult>;
+}
+/**
+ * Create the production account-recovery processor.
+ *
+ * @param interactionAuthority - Live provider authority for interaction-bound magic links.
+ * @returns The account-independent processor used by the durable worker.
+ */
+export declare function createAccountRecoveryJobProcessor(interactionAuthority?: InteractionAuthorityResolver): RecoveryJobProcessor;
+//# sourceMappingURL=recovery-job-processor.d.ts.map

package/dist/auth/recovery-job-processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-job-processor.d.ts","sourceRoot":"","sources":["../../src/auth/recovery-job-processor.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAW7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGvE,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAE/E,+EAA+E;AAC/E,qBAAa,2BAA4B,YAAW,oBAAoB;IAMnD,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,4BAA4B;IALzF;;;;OAIG;IACH,YAAsC,oBAAoB,CAAC,EAAE,4BAA4B,YAAA,EAAI;IAE7F,6EAA6E;IAChE,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA4FlF;CACF;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,oBAAoB,CAAC,EAAE,4BAA4B,GAClD,oBAAoB,CAEtB"}

package/dist/auth/recovery-job-processor.js

@@ -0,0 +1,123 @@
+/** Account-specific processing for durable recovery jobs. */
+import { config } from '../config/index.js';
+import { writeAuditLog } from '../lib/audit-log.js';
+import { getSystemConfigNumber } from '../lib/system-config.js';
+import { getOrganizationById } from '../organizations/service.js';
+import { getUserByEmail } from '../users/service.js';
+import { sendRecoveryEmailStrict } from './email-service.js';
+import { recoveryArtifactToken, revealRecoveryAddress } from './recovery-crypto.js';
+import { ensureRecoveryJobToken } from './token-repository.js';
+import { hashToken } from './tokens.js';
+import { RecoveryJobProcessingError, } from './recovery-worker.js';
+/** Concrete tenant-scoped processor for magic-link and password-reset work. */
+export class AccountRecoveryJobProcessor {
+    interactionAuthority;
+    /**
+     * Create a processor with the provider-owned interaction boundary used by magic-link work.
+     *
+     * @param interactionAuthority - Live interaction resolver. Password-reset jobs do not use it.
+     */
+    constructor(interactionAuthority) {
+        this.interactionAuthority = interactionAuthority;
+    }
+    /** Resolve eligibility, create one artifact, and deliver its stable link. */
+    async process(job) {
+        let address;
+        try {
+            address = revealRecoveryAddress(job.protectedAddress, {
+                organizationId: job.organizationId,
+                jobType: job.jobType,
+                interactionUid: job.interactionUid,
+                idempotencyDigest: job.idempotencyDigest,
+            });
+        }
+        catch {
+            throw new RecoveryJobProcessingError('invalid_protected_input', false);
+        }
+        let organization;
+        let user;
+        try {
+            organization = await getOrganizationById(job.organizationId);
+            user = await getUserByEmail(job.organizationId, address);
+        }
+        catch {
+            throw new RecoveryJobProcessingError('database_unavailable', true);
+        }
+        if (!organization || organization.status !== 'active' || !user || user.status !== 'active') {
+            return 'no_op';
+        }
+        let plaintext;
+        try {
+            plaintext = recoveryArtifactToken(job.id, job.jobType, job.protectedAddress.keyId);
+            const ttlSeconds = await getSystemConfigNumber(job.jobType === 'magic_link' ? 'magic_link_ttl' : 'password_reset_ttl', job.jobType === 'magic_link' ? 900 : 3_600);
+            const artifactInput = {
+                recoveryJobId: job.id,
+                userId: user.id,
+                tokenHash: hashToken(plaintext),
+                expiresAt: new Date(Date.now() + ttlSeconds * 1_000),
+            };
+            let artifact;
+            if (job.jobType === 'magic_link') {
+                const liveAuthority = job.interactionUid
+                    ? await this.interactionAuthority?.resolve(job.interactionUid)
+                    : null;
+                if (job.interactionUid && !liveAuthority)
+                    return 'no_op';
+                artifact = await ensureRecoveryJobToken({
+                    ...artifactInput,
+                    table: 'magic_link_tokens',
+                    organizationId: job.organizationId,
+                    interactionUid: job.interactionUid,
+                    clientId: liveAuthority?.clientId ?? null,
+                });
+            }
+            else {
+                artifact = await ensureRecoveryJobToken({
+                    ...artifactInput,
+                    table: 'password_reset_tokens',
+                });
+            }
+            if (artifact === 'superseded')
+                return 'no_op';
+        }
+        catch {
+            throw new RecoveryJobProcessingError('database_unavailable', true);
+        }
+        const base = `${config.issuerBaseUrl}/${organization.slug}/auth`;
+        const recoveryUrl = job.jobType === 'magic_link'
+            ? `${base}/magic-link/${plaintext}${job.interactionUid ? `?interaction=${encodeURIComponent(job.interactionUid)}` : ''}`
+            : `${base}/reset-password/${plaintext}`;
+        try {
+            await sendRecoveryEmailStrict({
+                type: job.jobType,
+                user,
+                organization,
+                recoveryUrl,
+                locale: user.locale ?? organization.defaultLocale,
+                messageId: `<recovery-${job.id}@porta.invalid>`,
+            });
+        }
+        catch {
+            throw new RecoveryJobProcessingError('smtp_outcome_unknown', true);
+        }
+        void writeAuditLog({
+            organizationId: organization.id,
+            userId: user.id,
+            eventType: job.jobType === 'magic_link' ? 'user.magic_link.sent' : 'user.password_reset.requested',
+            eventCategory: 'authentication',
+            description: 'Recovery message accepted for delivery',
+            metadata: { recoveryType: job.jobType },
+        });
+        return 'completed';
+    }
+}
+/**
+ * Create the production account-recovery processor.
+ *
+ * @param interactionAuthority - Live provider authority for interaction-bound magic links.
+ * @returns The account-independent processor used by the durable worker.
+ */
+export function createAccountRecoveryJobProcessor(interactionAuthority) {
+    return new AccountRecoveryJobProcessor(interactionAuthority);
+}
+//# sourceMappingURL=recovery-job-processor.js.map

package/dist/auth/recovery-job-processor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-job-processor.js","sourceRoot":"","sources":["../../src/auth/recovery-job-processor.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAE7D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,0BAA0B,GAG3B,MAAM,sBAAsB,CAAC;AAG9B,+EAA+E;AAC/E,MAAM,OAAO,2BAA2B;IAMA,oBAAoB;IAL1D;;;;OAIG;IACH,YAAsC,oBAAmD;oCAAnD,oBAAoB;IAAkC,CAAC;IAE7F,6EAA6E;IACtE,KAAK,CAAC,OAAO,CAAC,GAAuB;QAC1C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBACpD,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,0BAA0B,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,YAAiC,CAAC;QACtC,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC7D,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC3F,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACnF,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAC5C,GAAG,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,EACtE,GAAG,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAC3C,CAAC;YACF,MAAM,aAAa,GAAG;gBACpB,aAAa,EAAE,GAAG,CAAC,EAAE;gBACrB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC;gBAC/B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC;aACrD,CAAC;YACF,IAAI,QAAQ,CAAC;YACb,IAAI,GAAG,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc;oBACtC,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;oBAC9D,CAAC,CAAC,IAAI,CAAC;gBACT,IAAI,GAAG,CAAC,cAAc,IAAI,CAAC,aAAa;oBAAE,OAAO,OAAO,CAAC;gBACzD,QAAQ,GAAG,MAAM,sBAAsB,CAAC;oBACtC,GAAG,aAAa;oBAChB,KAAK,EAAE,mBAAmB;oBAC1B,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,QAAQ,EAAE,aAAa,EAAE,QAAQ,IAAI,IAAI;iBAC1C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,MAAM,sBAAsB,CAAC;oBACtC,GAAG,aAAa;oBAChB,KAAK,EAAE,uBAAuB;iBAC/B,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,KAAK,YAAY;gBAAE,OAAO,OAAO,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,aAAa,IAAI,YAAY,CAAC,IAAI,OAAO,CAAC;QACjE,MAAM,WAAW,GACf,GAAG,CAAC,OAAO,KAAK,YAAY;YAC1B,CAAC,CAAC,GAAG,IAAI,eAAe,SAAS,GAC7B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAClF,EAAE;YACJ,CAAC,CAAC,GAAG,IAAI,mBAAmB,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC;gBAC5B,IAAI,EAAE,GAAG,CAAC,OAAO;gBACjB,IAAI;gBACJ,YAAY;gBACZ,WAAW;gBACX,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,aAAa;gBACjD,SAAS,EAAE,aAAa,GAAG,CAAC,EAAE,iBAAiB;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;QAED,KAAK,aAAa,CAAC;YACjB,cAAc,EAAE,YAAY,CAAC,EAAE;YAC/B,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EACP,GAAG,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,+BAA+B;YACzF,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,wCAAwC;YACrD,QAAQ,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,EAAE;SACxC,CAAC,CAAC;QACH,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,oBAAmD;IAEnD,OAAO,IAAI,2BAA2B,CAAC,oBAAoB,CAAC,CAAC;AAC/D,CAAC"}