@portaidentity/server 1.7.2 → 1.8.0

package/migrations/030_global_configuration_catalog.sql

@@ -0,0 +1,39 @@
+-- Up Migration
+
+-- Operational policy uses native JSONB scalars. Canonical earlier values are intentionally reset;
+-- bootstrap/internal rows are not part of the administrative catalog and remain untouched.
+INSERT INTO system_config (key, value, value_type, description, is_sensitive) VALUES
+    ('access_token_ttl', '3600'::jsonb, 'duration', 'How long newly issued access tokens remain valid.', FALSE),
+    ('id_token_ttl', '3600'::jsonb, 'duration', 'How long newly issued ID tokens remain valid.', FALSE),
+    ('refresh_token_ttl', '2592000'::jsonb, 'duration', 'How long newly issued refresh tokens remain valid.', FALSE),
+    ('authorization_code_ttl', '600'::jsonb, 'duration', 'How long a newly issued authorization code remains valid.', FALSE),
+    ('session_ttl', '86400'::jsonb, 'duration', 'How long newly created OIDC sessions remain valid.', FALSE),
+    ('magic_link_ttl', '900'::jsonb, 'duration', 'How long a newly created magic-link token remains valid.', FALSE),
+    ('password_reset_ttl', '3600'::jsonb, 'duration', 'How long a newly created password-reset token remains valid.', FALSE),
+    ('invitation_ttl', '604800'::jsonb, 'duration', 'How long a newly created user invitation remains valid.', FALSE),
+    ('rate_limit_login_max', '10'::jsonb, 'number', 'Maximum login attempts allowed in one login window.', FALSE),
+    ('rate_limit_login_window', '900'::jsonb, 'duration', 'Window used to count login attempts.', FALSE),
+    ('rate_limit_magic_link_max', '5'::jsonb, 'number', 'Maximum magic-link requests allowed in one window.', FALSE),
+    ('rate_limit_magic_link_window', '900'::jsonb, 'duration', 'Window used to count magic-link requests.', FALSE),
+    ('rate_limit_password_reset_max', '5'::jsonb, 'number', 'Maximum password-reset requests allowed in one window.', FALSE),
+    ('rate_limit_password_reset_window', '900'::jsonb, 'duration', 'Window used to count password-reset requests.', FALSE),
+    ('max_failed_logins', '5'::jsonb, 'number', 'Failed login count that activates automatic lockout.', FALSE),
+    ('lockout_duration_seconds', '900'::jsonb, 'duration', 'Duration applied when automatic lockout eligibility is checked.', FALSE),
+    ('audit_retention_days', '90'::jsonb, 'number', 'Default number of days retained by audit cleanup.', FALSE),
+    ('default_locale', '"en"'::jsonb, 'string', 'Final locale fallback used by the authentication UI.', FALSE)
+ON CONFLICT (key) DO UPDATE SET
+    value = EXCLUDED.value,
+    value_type = EXCLUDED.value_type,
+    description = EXCLUDED.description,
+    is_sensitive = EXCLUDED.is_sensitive,
+    updated_at = NOW();
+
+DELETE FROM system_config WHERE key IN (
+    'login_rate_limit', 'lockout_duration', 'api_rate_limit', 'cookie_secure',
+    'magic_link_length', 'require_pkce', 'cors_max_age'
+);
+
+-- Down Migration
+
+-- No-op: earlier policy values cannot be reconstructed after the intentional reset.
+-- Development recovery uses yarn admin:env reset rather than reversing these defaults.

package/migrations/031_monotonic_updated_at.sql

@@ -0,0 +1,28 @@
+-- Up Migration
+
+-- Make updated_at strictly advance on every row update.
+--
+-- ETags are derived from updated_at at millisecond precision, while PostgreSQL
+-- stores microseconds and the JavaScript driver truncates the value to
+-- milliseconds. Two updates stamped within the same millisecond therefore
+-- produced an identical ETag even though the row changed, which let a stale
+-- If-Match header match after a concurrent write. Advancing the stored value by
+-- at least one millisecond per update keeps millisecond-precision ETags unique
+-- across consecutive updates.
+CREATE OR REPLACE FUNCTION trigger_set_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+    NEW.updated_at = GREATEST(clock_timestamp(), OLD.updated_at + interval '1 millisecond');
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Down Migration
+
+CREATE OR REPLACE FUNCTION trigger_set_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+    NEW.updated_at = NOW();
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portaidentity/server",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "description": "Multi-tenant OIDC provider built on node-oidc-provider, Koa, and TypeScript",
   "type": "module",
   "license": "MIT",
@@ -57,7 +57,7 @@
     "koa": "3.2.1",
     "koa-bodyparser": "4.4.1",
     "node-pg-migrate": "9.0.0",
-    "nodemailer": "9.0.5",
+    "nodemailer": "9.1.1",
     "oidc-provider": "9.11.2",
     "open": "11.0.0",
     "otpauth": "9.5.1",

package/dist/lib/data-import-plan.d.ts

@@ -1,50 +0,0 @@
-/**
- * Pure import-manifest planning.
- *
- * The planner assigns every admitted entity a stable tenant-qualified natural key and explicit
- * parent references before database mutation begins. Database-backed planning later resolves the
- * returned external references against one consistent transaction snapshot.
- */
-import type { ImportManifest } from './data-import.js';
-import type { PoolClient } from 'pg';
-/** Closed entity catalog accepted by the version 1.0 manifest. */
-export type ImportEntityType = 'organization' | 'application' | 'client' | 'role' | 'permission' | 'claim_definition' | 'role_permission_mapping' | 'application_module' | 'user' | 'user_role_assignment' | 'user_claim_value' | 'config';
-/** Parent reference which must exist in the manifest or the database snapshot. */
-export interface ImportPlanDependency {
-    readonly entityType: ImportEntityType;
-    readonly naturalKey: string;
-    readonly source: 'manifest' | 'database';
-}
-/** One deterministic manifest entry prepared for database-backed action planning. */
-export interface ImportPlanEntry {
-    readonly entityType: ImportEntityType;
-    readonly naturalKey: string;
-    readonly mutableFields: readonly string[];
-    readonly dependencies: readonly ImportPlanDependency[];
-    readonly credentialWillBeGenerated: boolean;
-}
-/** Immutable mutation-free plan produced from a validated manifest. */
-export interface ImportManifestPlan {
-    readonly version: '1.0';
-    readonly entries: readonly ImportPlanEntry[];
-    readonly externalDependencies: readonly ImportPlanDependency[];
-}
-/** Return whether a configuration key can carry authentication material. */
-export declare function isProhibitedImportConfigKey(configKey: string): boolean;
-/**
- * Build a deterministic, mutation-free plan from a schema-validated manifest.
- *
- * @param manifest - Strictly parsed version 1.0 manifest.
- * @returns Ordered entries and the exact parents that must be resolved from the database.
- * @throws Error when a system configuration key could carry authentication material.
- */
-export declare function buildImportManifestPlan(manifest: ImportManifest): ImportManifestPlan;
-/**
- * Resolve every external parent against the current transaction snapshot.
- *
- * @param client - Transaction client used by the later import execution.
- * @param plan - Pure manifest plan built before acquiring the client.
- * @throws Error when a parent is missing or storage contains an ambiguous natural key.
- */
-export declare function requireResolvedImportDependencies(client: PoolClient, plan: ImportManifestPlan): Promise<void>;
-//# sourceMappingURL=data-import-plan.d.ts.map

package/dist/lib/data-import-plan.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"data-import-plan.d.ts","sourceRoot":"","sources":["../../src/lib/data-import-plan.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAErC,kEAAkE;AAClE,MAAM,MAAM,gBAAgB,GACxB,cAAc,GACd,aAAa,GACb,QAAQ,GACR,MAAM,GACN,YAAY,GACZ,kBAAkB,GAClB,yBAAyB,GACzB,oBAAoB,GACpB,MAAM,GACN,sBAAsB,GACtB,kBAAkB,GAClB,QAAQ,CAAC;AAEb,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACvD,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;CAC7C;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,QAAQ,CAAC,oBAAoB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAChE;AA4BD,4EAA4E;AAC5E,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEtE;AAgDD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,cAAc,GAAG,kBAAkB,CAgKpF;AAoDD;;;;;;GAMG;AACH,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/lib/data-import-plan.js

@@ -1,235 +0,0 @@
-/**
- * Pure import-manifest planning.
- *
- * The planner assigns every admitted entity a stable tenant-qualified natural key and explicit
- * parent references before database mutation begins. Database-backed planning later resolves the
- * returned external references against one consistent transaction snapshot.
- */
-const MUTABLE_FIELDS = Object.freeze({
-    organization: [
-        'name',
-        'default_locale',
-        'branding_primary_color',
-        'branding_company_name',
-        'branding_custom_css',
-        'branding_logo_url',
-        'branding_favicon_url',
-    ],
-    application: ['name', 'description'],
-    client: ['client_name'],
-    role: ['name', 'description'],
-    permission: ['name', 'description'],
-    claim_definition: ['name', 'description'],
-    role_permission_mapping: [],
-    application_module: ['name', 'description'],
-    user: ['given_name', 'family_name', 'locale'],
-    user_role_assignment: [],
-    user_claim_value: ['value'],
-    config: ['value'],
-});
-const PROHIBITED_CONFIG_KEY = /(^|_)(password|secret|private_key|signing_key|cookie_key|session_key|recovery_code|totp_secret)(_|$)/i;
-/** Return whether a configuration key can carry authentication material. */
-export function isProhibitedImportConfigKey(configKey) {
-    return PROHIBITED_CONFIG_KEY.test(configKey);
-}
-/** Join natural-key components without ambiguous concatenation. */
-function key(...parts) {
-    return parts.join('\u001f');
-}
-/** Split an internal natural key and reject malformed planner state. */
-function keyParts(naturalKey, expectedParts) {
-    const parts = naturalKey.split('\u001f');
-    if (parts.length !== expectedParts || parts.some((part) => part.length === 0)) {
-        throw new Error('Import plan contains an invalid natural key');
-    }
-    return parts;
-}
-/** Return a manifest/database reference for one required parent. */
-function dependency(entityType, naturalKey, manifestKeys) {
-    return Object.freeze({
-        entityType,
-        naturalKey,
-        source: manifestKeys.has(naturalKey) ? 'manifest' : 'database',
-    });
-}
-/** Add one immutable entry to the ordered plan. */
-function addEntry(entries, entityType, naturalKey, dependencies, credentialWillBeGenerated = false) {
-    entries.push(Object.freeze({
-        entityType,
-        naturalKey,
-        mutableFields: MUTABLE_FIELDS[entityType],
-        dependencies: Object.freeze([...dependencies]),
-        credentialWillBeGenerated,
-    }));
-}
-/**
- * Build a deterministic, mutation-free plan from a schema-validated manifest.
- *
- * @param manifest - Strictly parsed version 1.0 manifest.
- * @returns Ordered entries and the exact parents that must be resolved from the database.
- * @throws Error when a system configuration key could carry authentication material.
- */
-export function buildImportManifestPlan(manifest) {
-    const entries = [];
-    const organizationKeys = new Set(manifest.organizations.map((item) => item.slug));
-    const applicationKeys = new Set(manifest.applications.map((item) => item.slug));
-    const roleKeys = new Set(manifest.roles.map((item) => key(item.application_slug, item.slug)));
-    const permissionKeys = new Set(manifest.permissions.map((item) => key(item.application_slug, item.slug)));
-    const claimKeys = new Set(manifest.claim_definitions.map((item) => key(item.application_slug, item.slug)));
-    const userKeys = new Set(manifest.users.map((item) => key(item.organization_slug, item.email.toLowerCase())));
-    for (const organization of manifest.organizations) {
-        addEntry(entries, 'organization', organization.slug, []);
-    }
-    for (const application of manifest.applications) {
-        addEntry(entries, 'application', application.slug, [
-            dependency('organization', application.organization_slug, organizationKeys),
-        ]);
-    }
-    for (const client of manifest.clients) {
-        addEntry(entries, 'client', key(client.organization_slug, client.application_slug, client.client_name), [
-            dependency('organization', client.organization_slug, organizationKeys),
-            dependency('application', client.application_slug, applicationKeys),
-        ], client.client_type === 'confidential');
-    }
-    for (const role of manifest.roles) {
-        addEntry(entries, 'role', key(role.application_slug, role.slug), [
-            dependency('organization', role.organization_slug, organizationKeys),
-            dependency('application', role.application_slug, applicationKeys),
-        ]);
-    }
-    for (const permission of manifest.permissions) {
-        addEntry(entries, 'permission', key(permission.application_slug, permission.slug), [
-            dependency('organization', permission.organization_slug, organizationKeys),
-            dependency('application', permission.application_slug, applicationKeys),
-        ]);
-    }
-    for (const claim of manifest.claim_definitions) {
-        addEntry(entries, 'claim_definition', key(claim.application_slug, claim.slug), [
-            dependency('organization', claim.organization_slug, organizationKeys),
-            dependency('application', claim.application_slug, applicationKeys),
-        ]);
-    }
-    for (const mapping of manifest.role_permission_mappings) {
-        const dependencies = [
-            dependency('organization', mapping.organization_slug, organizationKeys),
-            dependency('application', mapping.application_slug, applicationKeys),
-            dependency('role', key(mapping.application_slug, mapping.role_slug), roleKeys),
-            ...mapping.permission_slugs.map((slug) => dependency('permission', key(mapping.application_slug, slug), permissionKeys)),
-        ];
-        addEntry(entries, 'role_permission_mapping', key(mapping.application_slug, mapping.role_slug), dependencies);
-    }
-    for (const module of manifest.application_modules) {
-        addEntry(entries, 'application_module', key(module.application_slug, module.slug), [
-            dependency('organization', module.organization_slug, organizationKeys),
-            dependency('application', module.application_slug, applicationKeys),
-        ]);
-    }
-    for (const user of manifest.users) {
-        addEntry(entries, 'user', key(user.organization_slug, user.email.toLowerCase()), [
-            dependency('organization', user.organization_slug, organizationKeys),
-        ]);
-    }
-    for (const assignment of manifest.user_role_assignments) {
-        addEntry(entries, 'user_role_assignment', key(assignment.organization_slug, assignment.application_slug, assignment.email.toLowerCase(), assignment.role_slug), [
-            dependency('organization', assignment.organization_slug, organizationKeys),
-            dependency('application', assignment.application_slug, applicationKeys),
-            dependency('user', key(assignment.organization_slug, assignment.email.toLowerCase()), userKeys),
-            dependency('role', key(assignment.application_slug, assignment.role_slug), roleKeys),
-        ]);
-    }
-    for (const claimValue of manifest.user_claim_values) {
-        addEntry(entries, 'user_claim_value', key(claimValue.organization_slug, claimValue.application_slug, claimValue.email.toLowerCase(), claimValue.claim_slug), [
-            dependency('organization', claimValue.organization_slug, organizationKeys),
-            dependency('application', claimValue.application_slug, applicationKeys),
-            dependency('user', key(claimValue.organization_slug, claimValue.email.toLowerCase()), userKeys),
-            dependency('claim_definition', key(claimValue.application_slug, claimValue.claim_slug), claimKeys),
-        ]);
-    }
-    for (const configKey of Object.keys(manifest.config ?? {}).sort()) {
-        if (isProhibitedImportConfigKey(configKey)) {
-            throw new Error('Import manifest contains prohibited authentication material');
-        }
-        addEntry(entries, 'config', configKey, []);
-    }
-    const externalByKey = new Map();
-    for (const entry of entries) {
-        for (const required of entry.dependencies) {
-            if (required.source === 'database') {
-                externalByKey.set(key(required.entityType, required.naturalKey), required);
-            }
-        }
-    }
-    return Object.freeze({
-        version: '1.0',
-        entries: Object.freeze(entries),
-        externalDependencies: Object.freeze([...externalByKey.values()]),
-    });
-}
-/** Resolve one database-owned parent without exposing its identifier in an error. */
-async function databaseDependencyExists(client, required) {
-    if (required.entityType === 'organization') {
-        const result = await client.query('SELECT 1 FROM organizations WHERE slug = $1', [
-            required.naturalKey,
-        ]);
-        return result.rowCount === 1;
-    }
-    if (required.entityType === 'application') {
-        const result = await client.query('SELECT 1 FROM applications WHERE slug = $1', [
-            required.naturalKey,
-        ]);
-        return result.rowCount === 1;
-    }
-    if (required.entityType === 'role' ||
-        required.entityType === 'permission' ||
-        required.entityType === 'claim_definition') {
-        const [applicationSlug, entitySlug] = keyParts(required.naturalKey, 2);
-        const table = required.entityType === 'role'
-            ? 'roles'
-            : required.entityType === 'permission'
-                ? 'permissions'
-                : 'claim_definitions';
-        const result = await client.query(`SELECT 1 FROM ${table} entity
-       JOIN applications application ON application.id = entity.application_id
-       WHERE application.slug = $1 AND entity.slug = $2`, [applicationSlug, entitySlug]);
-        return result.rowCount === 1;
-    }
-    if (required.entityType === 'user') {
-        const [organizationSlug, email] = keyParts(required.naturalKey, 2);
-        const result = await client.query(`SELECT 1 FROM users user_account
-       JOIN organizations organization ON organization.id = user_account.organization_id
-       WHERE organization.slug = $1 AND user_account.email = $2`, [organizationSlug, email]);
-        return result.rowCount === 1;
-    }
-    throw new Error('Import plan contains an unsupported external dependency');
-}
-/**
- * Resolve every external parent against the current transaction snapshot.
- *
- * @param client - Transaction client used by the later import execution.
- * @param plan - Pure manifest plan built before acquiring the client.
- * @throws Error when a parent is missing or storage contains an ambiguous natural key.
- */
-export async function requireResolvedImportDependencies(client, plan) {
-    for (const required of plan.externalDependencies) {
-        if (!(await databaseDependencyExists(client, required))) {
-            throw new Error('Import manifest contains a missing or unauthorized parent reference');
-        }
-    }
-    for (const entry of plan.entries) {
-        if (entry.entityType !== 'client')
-            continue;
-        const [organizationSlug, applicationSlug, clientName] = keyParts(entry.naturalKey, 3);
-        const result = await client.query(`SELECT COUNT(*)::integer AS count
-       FROM clients client
-       JOIN organizations organization ON organization.id = client.organization_id
-       JOIN applications application ON application.id = client.application_id
-       WHERE organization.slug = $1
-         AND application.slug = $2
-         AND client.client_name = $3`, [organizationSlug, applicationSlug, clientName]);
-        const count = Number(result.rows[0]?.count ?? 0);
-        if (!Number.isSafeInteger(count) || count > 1) {
-            throw new Error('Import manifest natural key collides with ambiguous stored data');
-        }
-    }
-}
-//# sourceMappingURL=data-import-plan.js.map

package/dist/lib/data-import-plan.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"data-import-plan.js","sourceRoot":"","sources":["../../src/lib/data-import-plan.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2CH,MAAM,cAAc,GAA0D,MAAM,CAAC,MAAM,CAAC;IAC1F,YAAY,EAAE;QACZ,MAAM;QACN,gBAAgB;QAChB,wBAAwB;QACxB,uBAAuB;QACvB,qBAAqB;QACrB,mBAAmB;QACnB,sBAAsB;KACvB;IACD,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;IACpC,MAAM,EAAE,CAAC,aAAa,CAAC;IACvB,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;IAC7B,UAAU,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;IACnC,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;IACzC,uBAAuB,EAAE,EAAE;IAC3B,kBAAkB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;IAC3C,IAAI,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,QAAQ,CAAC;IAC7C,oBAAoB,EAAE,EAAE;IACxB,gBAAgB,EAAE,CAAC,OAAO,CAAC;IAC3B,MAAM,EAAE,CAAC,OAAO,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GACzB,uGAAuG,CAAC;AAE1G,4EAA4E;AAC5E,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,mEAAmE;AACnE,SAAS,GAAG,CAAC,GAAG,KAAwB;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,wEAAwE;AACxE,SAAS,QAAQ,CAAC,UAAkB,EAAE,aAAqB;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CACjB,UAA4B,EAC5B,UAAkB,EAClB,YAAiC;IAEjC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU;QACV,UAAU;QACV,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;KAC/D,CAAC,CAAC;AACL,CAAC;AAED,mDAAmD;AACnD,SAAS,QAAQ,CACf,OAA0B,EAC1B,UAA4B,EAC5B,UAAkB,EAClB,YAA6C,EAC7C,yBAAyB,GAAG,KAAK;IAEjC,OAAO,CAAC,IAAI,CACV,MAAM,CAAC,MAAM,CAAC;QACZ,UAAU;QACV,UAAU;QACV,aAAa,EAAE,cAAc,CAAC,UAAU,CAAC;QACzC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC;QAC9C,yBAAyB;KAC1B,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAwB;IAC9D,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAC1E,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAChF,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CACpF,CAAC;IAEF,KAAK,MAAM,YAAY,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QAClD,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,IAAI,EAAE;YACjD,UAAU,CAAC,cAAc,EAAE,WAAW,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,QAAQ,CACN,OAAO,EACP,QAAQ,EACR,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,EAC1E;YACE,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YACtE,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC;SACpE,EACD,MAAM,CAAC,WAAW,KAAK,cAAc,CACtC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YAC/D,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YACpE,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9C,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;YACjF,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YAC1E,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,gBAAgB,EAAE,eAAe,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC/C,QAAQ,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;YAC7E,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YACrE,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,wBAAwB,EAAE,CAAC;QACxD,MAAM,YAAY,GAA2B;YAC3C,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YACvE,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,gBAAgB,EAAE,eAAe,CAAC;YACpE,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;YAC9E,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACvC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,CAC9E;SACF,CAAC;QACF,QAAQ,CACN,OAAO,EACP,yBAAyB,EACzB,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,EAChD,YAAY,CACb,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAClD,QAAQ,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;YACjF,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YACtE,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE;YAC/E,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;SACrE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACxD,QAAQ,CACN,OAAO,EACP,sBAAsB,EACtB,GAAG,CACD,UAAU,CAAC,iBAAiB,EAC5B,UAAU,CAAC,gBAAgB,EAC3B,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAC9B,UAAU,CAAC,SAAS,CACrB,EACD;YACE,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YAC1E,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,gBAAgB,EAAE,eAAe,CAAC;YACvE,UAAU,CACR,MAAM,EACN,GAAG,CAAC,UAAU,CAAC,iBAAiB,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EACjE,QAAQ,CACT;YACD,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;SACrF,CACF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACpD,QAAQ,CACN,OAAO,EACP,kBAAkB,EAClB,GAAG,CACD,UAAU,CAAC,iBAAiB,EAC5B,UAAU,CAAC,gBAAgB,EAC3B,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAC9B,UAAU,CAAC,UAAU,CACtB,EACD;YACE,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YAC1E,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,gBAAgB,EAAE,eAAe,CAAC;YACvE,UAAU,CACR,MAAM,EACN,GAAG,CAAC,UAAU,CAAC,iBAAiB,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EACjE,QAAQ,CACT;YACD,UAAU,CACR,kBAAkB,EAClB,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE,UAAU,CAAC,UAAU,CAAC,EACvD,SAAS,CACV;SACF,CACF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAClE,IAAI,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACnC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,wBAAwB,CACrC,MAAkB,EAClB,QAA8B;IAE9B,IAAI,QAAQ,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;YAC/E,QAAQ,CAAC,UAAU;SACpB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;YAC9E,QAAQ,CAAC,UAAU;SACpB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IACE,QAAQ,CAAC,UAAU,KAAK,MAAM;QAC9B,QAAQ,CAAC,UAAU,KAAK,YAAY;QACpC,QAAQ,CAAC,UAAU,KAAK,kBAAkB,EAC1C,CAAC;QACD,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,KAAK,GACT,QAAQ,CAAC,UAAU,KAAK,MAAM;YAC5B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,QAAQ,CAAC,UAAU,KAAK,YAAY;gBACpC,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,mBAAmB,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,iBAAiB,KAAK;;wDAE4B,EAClD,CAAC,eAAe,EAAE,UAAU,CAAC,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;;gEAE0D,EAC1D,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAC1B,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,MAAkB,EAClB,IAAwB;IAExB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,MAAM,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ;YAAE,SAAS;QAC5C,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;;;;;;qCAM+B,EAC/B,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC,CAChD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}