@portaidentity/server 1.7.3 → 1.9.0

package/dist/lib/super-admin-protection.d.ts

@@ -11,8 +11,6 @@
  *
  * Protected operations (all throw 403 Forbidden):
  *   - Delete
- *   - Suspend
- *   - Lock
  *   - Deactivate
  *   - Remove porta-super-admin role
  *   - Manage 2FA (disable, reset, regenerate recovery codes)
@@ -25,7 +23,8 @@ export declare const SUPER_ADMIN_USER_ID_KEY = "super_admin_user_id";
  * Operations that are forbidden on the super-admin user.
  * Used in error messages to clearly communicate what was attempted.
  */
-export declare const PROTECTED_OPERATIONS: readonly ['delete', 'suspend', 'lock', 'deactivate', 'remove-super-admin-role', 'manage-2fa'];
+export declare const PROTECTED_OPERATIONS: readonly ['delete', 'deactivate', 'remove-super-admin-role', 'manage-2fa'];
+/** Destructive operations that cannot target the bootstrap administrator. */
 export type ProtectedOperation = (typeof PROTECTED_OPERATIONS)[number];
 /**
  * Check if a user is the protected super-admin user.
@@ -47,6 +46,7 @@ export declare class SuperAdminProtectionError extends Error {
     readonly status = 403;
     /** The operation that was attempted */
     readonly operation: ProtectedOperation;
+    /** Create the public rejection for an attempted protected operation. */
     constructor(operation: ProtectedOperation);
 }
 /**
@@ -54,8 +54,8 @@ export declare class SuperAdminProtectionError extends Error {
  *
  * Call this before executing any destructive operation on a user:
  * ```typescript
- * await guardSuperAdmin(userId, 'suspend');
- * // ... proceed with suspend logic
+ * await guardSuperAdmin(userId, 'deactivate');
+ * // ... proceed with deactivation
  * ```
  *
  * If the user is not the super-admin, this function is a no-op.

package/dist/lib/super-admin-protection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"super-admin-protection.d.ts","sourceRoot":"","sources":["../../src/lib/super-admin-protection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,oBAAoB,YAC/B,QAAQ,EACR,SAAS,EACT,MAAM,EACN,YAAY,EACZ,yBAAyB,EACzB,YAAY,CACJ,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAMvE;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQvE;AAMD;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,oCAAoC;IACpC,QAAQ,CAAC,MAAM,OAAO;IACtB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IAEvC,YAAY,SAAS,EAAE,kBAAkB,EAIxC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,kBAAkB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAKf"}
+{"version":3,"file":"super-admin-protection.d.ts","sourceRoot":"","sources":["../../src/lib/super-admin-protection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,oBAAoB,YAC/B,QAAQ,EACR,YAAY,EACZ,yBAAyB,EACzB,YAAY,CACJ,CAAC;AAEX,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAMvE;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQvE;AAMD;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,oCAAoC;IACpC,QAAQ,CAAC,MAAM,OAAO;IACtB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IAEvC,wEAAwE;IACxE,YAAY,SAAS,EAAE,kBAAkB,EAIxC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,kBAAkB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/lib/super-admin-protection.js

@@ -11,15 +11,13 @@
  *
  * Protected operations (all throw 403 Forbidden):
  *   - Delete
- *   - Suspend
- *   - Lock
  *   - Deactivate
  *   - Remove porta-super-admin role
  *   - Manage 2FA (disable, reset, regenerate recovery codes)
  *
  * @module lib/super-admin-protection
  */
-import { getSystemConfigString } from './system-config.js';
+import { getInternalSystemConfigString } from './system-config.js';
 // ============================================================================
 // Constants
 // ============================================================================
@@ -31,8 +29,6 @@ export const SUPER_ADMIN_USER_ID_KEY = 'super_admin_user_id';
  */
 export const PROTECTED_OPERATIONS = [
     'delete',
-    'suspend',
-    'lock',
     'deactivate',
     'remove-super-admin-role',
     'manage-2fa',
@@ -51,9 +47,9 @@ export const PROTECTED_OPERATIONS = [
  * @returns true if the user is the super-admin
  */
 export async function isSuperAdminUser(userId) {
-    // getSystemConfigString returns the fallback when the key doesn't exist.
+    // The internal reader returns the fallback when the key doesn't exist.
     // Empty string fallback means: if no super-admin is configured, nobody matches.
-    const superAdminUserId = await getSystemConfigString(SUPER_ADMIN_USER_ID_KEY, '');
+    const superAdminUserId = await getInternalSystemConfigString(SUPER_ADMIN_USER_ID_KEY, '');
     if (!superAdminUserId) {
         return false;
     }
@@ -71,6 +67,7 @@ export class SuperAdminProtectionError extends Error {
     status = 403;
     /** The operation that was attempted */
     operation;
+    /** Create the public rejection for an attempted protected operation. */
     constructor(operation) {
         super(`Cannot ${operation} the super-admin user`);
         this.name = 'SuperAdminProtectionError';
@@ -82,8 +79,8 @@ export class SuperAdminProtectionError extends Error {
  *
  * Call this before executing any destructive operation on a user:
  * ```typescript
- * await guardSuperAdmin(userId, 'suspend');
- * // ... proceed with suspend logic
+ * await guardSuperAdmin(userId, 'deactivate');
+ * // ... proceed with deactivation
  * ```
  *
  * If the user is not the super-admin, this function is a no-op.

package/dist/lib/super-admin-protection.js.map

@@ -1 +1 @@
-{"version":3,"file":"super-admin-protection.js","sourceRoot":"","sources":["../../src/lib/super-admin-protection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ;IACR,SAAS;IACT,MAAM;IACN,YAAY;IACZ,yBAAyB;IACzB,YAAY;CACJ,CAAC;AAIX,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,yEAAyE;IACzE,gFAAgF;IAChF,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,KAAK,MAAM,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,QAAQ;AACR,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,oCAAoC;IAC3B,MAAM,GAAG,GAAG,CAAC;IACtB,uCAAuC;IAC9B,SAAS,CAAqB;IAEvC,YAAY,SAA6B;QACvC,KAAK,CAAC,UAAU,SAAS,uBAAuB,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,SAA6B;IAE7B,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}
+{"version":3,"file":"super-admin-protection.js","sourceRoot":"","sources":["../../src/lib/super-admin-protection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAEnE,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ;IACR,YAAY;IACZ,yBAAyB;IACzB,YAAY;CACJ,CAAC;AAKX,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,uEAAuE;IACvE,gFAAgF;IAChF,MAAM,gBAAgB,GAAG,MAAM,6BAA6B,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,KAAK,MAAM,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,QAAQ;AACR,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,oCAAoC;IAC3B,MAAM,GAAG,GAAG,CAAC;IACtB,uCAAuC;IAC9B,SAAS,CAAqB;IAEvC,wEAAwE;IACxE,YAAY,SAA6B;QACvC,KAAK,CAAC,UAAU,SAAS,uBAAuB,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,SAA6B;IAE7B,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/lib/system-config-catalog.d.ts

@@ -0,0 +1,268 @@
+/** Closed operational policy. Database rows own values, never these definitions or defaults. */
+/** Locales for which Porta ships every authentication namespace. */
+export declare const SUPPORTED_LOCALES: readonly ["en"];
+/** A completely packaged authentication locale. */
+export type SupportedLocale = (typeof SUPPORTED_LOCALES)[number];
+/** Administrative tab containing a policy field. */
+export type SystemConfigGroup = 'lifetimes' | 'rate-limits' | 'lockout' | 'general';
+/** Whether a saved value is read at runtime or only during provider construction. */
+export type SystemConfigApplicationMode = 'runtime' | 'restart-required';
+/** Native JSON scalar kind accepted by a policy field. */
+export type SystemConfigValueType = 'integer' | 'string';
+/** Unit used to explain a native policy value without changing its representation. */
+export type SystemConfigUnit = 'seconds' | 'attempts' | 'days' | 'locale';
+/** Valid native operational policy; locale strings must be completely packaged. */
+export type SystemConfigValue = number | SupportedLocale;
+/**
+ * Immutable public policy in administrative display order. Bootstrap settings and secrets are
+ * deliberately absent; adding a field requires an explicit application change and migration.
+ *
+ * @example
+ * const defaults = SYSTEM_CONFIG_CATALOG.map(({ key, defaultValue }) => [key, defaultValue]);
+ */
+export declare const SYSTEM_CONFIG_CATALOG: readonly [Readonly<{
+    key: "access_token_ttl";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "id_token_ttl";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "refresh_token_ttl";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "authorization_code_ttl";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "session_ttl";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "magic_link_ttl";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "password_reset_ttl";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "invitation_ttl";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "rate_limit_login_max";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "rate_limit_login_window";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "rate_limit_magic_link_max";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "rate_limit_magic_link_window";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "rate_limit_password_reset_max";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "rate_limit_password_reset_window";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "max_failed_logins";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "lockout_duration_seconds";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    key: "audit_retention_days";
+    group: SystemConfigGroup;
+    label: string;
+    description: string;
+    valueType: 'integer';
+    unit: "attempts" | "days" | "seconds";
+    defaultValue: number;
+    minimum: number;
+    maximum: number;
+    applicationMode: SystemConfigApplicationMode;
+}>, Readonly<{
+    readonly key: 'default_locale';
+    readonly group: 'general';
+    readonly label: 'Default locale';
+    readonly description: 'Final locale fallback used by the authentication UI.';
+    readonly valueType: 'string';
+    readonly unit: 'locale';
+    readonly defaultValue: 'en';
+    readonly allowedValues: readonly ["en"];
+    readonly applicationMode: 'runtime';
+}>];
+/** Exact public keys, derived from the same catalog used by runtime and administrative readers. */
+export type SystemConfigKey = (typeof SYSTEM_CONFIG_CATALOG)[number]['key'];
+/** Public keys whose native values are integers. */
+export type NumericSystemConfigKey = Exclude<SystemConfigKey, 'default_locale'>;
+/** Application-owned metadata for one editable operational-policy field. */
+export interface SystemConfigDefinition {
+    /** Closed identifier used in storage and requests. */
+    readonly key: SystemConfigKey;
+    /** Administrative tab to which this field belongs. */
+    readonly group: SystemConfigGroup;
+    /** Human-readable field caption. */
+    readonly label: string;
+    /** Operational effect explained without infrastructure details. */
+    readonly description: string;
+    /** Accepted native JSON scalar kind. */
+    readonly valueType: SystemConfigValueType;
+    /** Unit of the stored value. */
+    readonly unit: SystemConfigUnit;
+    /** Safe runtime fallback when storage is missing, invalid or unavailable. */
+    readonly defaultValue: SystemConfigValue;
+    /** Inclusive lower bound for integer fields. */
+    readonly minimum?: number;
+    /** Inclusive upper bound for integer fields. */
+    readonly maximum?: number;
+    /** Completely supported values for a locale field. */
+    readonly allowedValues?: readonly SupportedLocale[];
+    /** Whether every provider instance must restart after saving this field. */
+    readonly applicationMode: SystemConfigApplicationMode;
+}
+/**
+ * Resolve an untrusted name without querying whether an internal database row exists.
+ * @param key - Exact, case-sensitive name; no trimming or normalization is performed.
+ * @returns Public definition, or undefined for every non-catalog name.
+ * @example
+ * findSystemConfigDefinition('magic_link_ttl')?.defaultValue; // 900
+ */
+export declare function findSystemConfigDefinition(key: string): SystemConfigDefinition | undefined;
+/**
+ * Validate submitted or stored policy without coercion. Numeric text and unsupported locales fail.
+ * @param definition - Application-owned public metadata.
+ * @param value - Untrusted native value from JSON or PostgreSQL.
+ * @returns The same valid scalar, or undefined when its type or bounds are wrong.
+ * @example
+ * const definition = findSystemConfigDefinition('magic_link_ttl');
+ * if (definition) validateSystemConfigValue(definition, 1200); // 1200
+ */
+export declare function validateSystemConfigValue(definition: SystemConfigDefinition, value: unknown): SystemConfigValue | undefined;
+//# sourceMappingURL=system-config-catalog.d.ts.map

package/dist/lib/system-config-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-config-catalog.d.ts","sourceRoot":"","sources":["../../src/lib/system-config-catalog.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAEhG,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,iBAAiC,CAAC;AAEhE,mDAAmD;AACnD,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpF,qFAAqF;AACrF,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,kBAAkB,CAAC;AAEzE,0DAA0D;AAC1D,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEzD,sFAAsF;AACtF,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE1E,mFAAmF;AACnF,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,eAAe,CAAC;AA4BzD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;eAhBnB,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;;;;;eAAT,SAAS;;;;;;;kBAiMf,gBAAgB;oBACd,SAAS;oBACT,gBAAgB;0BACV,sDAAsD;wBACxD,QAAQ;mBACb,QAAQ;2BACA,IAAI;;8BAED,SAAS;GAEnB,CAAC;AAEZ,mGAAmG;AACnG,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;AAE5E,oDAAoD;AACpD,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;AAEhF,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAC1C,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACpD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,2BAA2B,CAAC;CACvD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS,CAE1F;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,OAAO,GACb,iBAAiB,GAAG,SAAS,CAe/B"}

package/dist/lib/system-config-catalog.js

@@ -0,0 +1,90 @@
+/** Closed operational policy. Database rows own values, never these definitions or defaults. */
+/** Locales for which Porta ships every authentication namespace. */
+export const SUPPORTED_LOCALES = Object.freeze(['en']);
+/** Build a frozen integer definition while preserving its literal key for typed callers. */
+function integerDefinition(key, group, label, description, unit, defaultValue, minimum, maximum, applicationMode = 'runtime') {
+    return Object.freeze({
+        key,
+        group,
+        label,
+        description,
+        valueType: 'integer',
+        unit,
+        defaultValue,
+        minimum,
+        maximum,
+        applicationMode,
+    });
+}
+/**
+ * Immutable public policy in administrative display order. Bootstrap settings and secrets are
+ * deliberately absent; adding a field requires an explicit application change and migration.
+ *
+ * @example
+ * const defaults = SYSTEM_CONFIG_CATALOG.map(({ key, defaultValue }) => [key, defaultValue]);
+ */
+export const SYSTEM_CONFIG_CATALOG = Object.freeze([
+    integerDefinition('access_token_ttl', 'lifetimes', 'Access token lifetime', 'How long newly issued access tokens remain valid.', 'seconds', 3600, 60, 86400, 'restart-required'),
+    integerDefinition('id_token_ttl', 'lifetimes', 'ID token lifetime', 'How long newly issued ID tokens remain valid.', 'seconds', 3600, 60, 86400, 'restart-required'),
+    integerDefinition('refresh_token_ttl', 'lifetimes', 'Refresh token lifetime', 'How long newly issued refresh tokens remain valid.', 'seconds', 2592000, 300, 31536000, 'restart-required'),
+    integerDefinition('authorization_code_ttl', 'lifetimes', 'Authorization code lifetime', 'How long a newly issued authorization code remains valid.', 'seconds', 600, 30, 3600, 'restart-required'),
+    integerDefinition('session_ttl', 'lifetimes', 'Session lifetime', 'How long newly created OIDC sessions remain valid.', 'seconds', 86400, 300, 2592000, 'restart-required'),
+    integerDefinition('magic_link_ttl', 'lifetimes', 'Magic-link lifetime', 'How long a newly created magic-link token remains valid.', 'seconds', 900, 60, 3600),
+    integerDefinition('password_reset_ttl', 'lifetimes', 'Password-reset lifetime', 'How long a newly created password-reset token remains valid.', 'seconds', 3600, 300, 86400),
+    integerDefinition('invitation_ttl', 'lifetimes', 'Invitation lifetime', 'How long a newly created user invitation remains valid.', 'seconds', 604800, 300, 2592000),
+    integerDefinition('rate_limit_login_max', 'rate-limits', 'Login attempt limit', 'Maximum login attempts allowed in one login window.', 'attempts', 10, 1, 100),
+    integerDefinition('rate_limit_login_window', 'rate-limits', 'Login window', 'Window used to count login attempts.', 'seconds', 900, 60, 86400),
+    integerDefinition('rate_limit_magic_link_max', 'rate-limits', 'Magic-link request limit', 'Maximum magic-link requests allowed in one window.', 'attempts', 5, 1, 100),
+    integerDefinition('rate_limit_magic_link_window', 'rate-limits', 'Magic-link request window', 'Window used to count magic-link requests.', 'seconds', 900, 60, 86400),
+    integerDefinition('rate_limit_password_reset_max', 'rate-limits', 'Password-reset request limit', 'Maximum password-reset requests allowed in one window.', 'attempts', 5, 1, 100),
+    integerDefinition('rate_limit_password_reset_window', 'rate-limits', 'Password-reset request window', 'Window used to count password-reset requests.', 'seconds', 900, 60, 86400),
+    integerDefinition('max_failed_logins', 'lockout', 'Failed login limit', 'Failed login count that activates automatic lockout.', 'attempts', 5, 1, 100),
+    integerDefinition('lockout_duration_seconds', 'lockout', 'Lockout duration', 'Duration applied when automatic lockout eligibility is checked.', 'seconds', 900, 60, 604800),
+    integerDefinition('audit_retention_days', 'general', 'Audit retention', 'Default number of days retained by audit cleanup.', 'days', 90, 1, 3650),
+    Object.freeze({
+        key: 'default_locale',
+        group: 'general',
+        label: 'Default locale',
+        description: 'Final locale fallback used by the authentication UI.',
+        valueType: 'string',
+        unit: 'locale',
+        defaultValue: 'en',
+        allowedValues: SUPPORTED_LOCALES,
+        applicationMode: 'runtime',
+    }),
+]);
+/**
+ * Resolve an untrusted name without querying whether an internal database row exists.
+ * @param key - Exact, case-sensitive name; no trimming or normalization is performed.
+ * @returns Public definition, or undefined for every non-catalog name.
+ * @example
+ * findSystemConfigDefinition('magic_link_ttl')?.defaultValue; // 900
+ */
+export function findSystemConfigDefinition(key) {
+    return SYSTEM_CONFIG_CATALOG.find((definition) => definition.key === key);
+}
+/**
+ * Validate submitted or stored policy without coercion. Numeric text and unsupported locales fail.
+ * @param definition - Application-owned public metadata.
+ * @param value - Untrusted native value from JSON or PostgreSQL.
+ * @returns The same valid scalar, or undefined when its type or bounds are wrong.
+ * @example
+ * const definition = findSystemConfigDefinition('magic_link_ttl');
+ * if (definition) validateSystemConfigValue(definition, 1200); // 1200
+ */
+export function validateSystemConfigValue(definition, value) {
+    if (definition.valueType === 'integer') {
+        if (typeof value !== 'number' ||
+            !Number.isInteger(value) ||
+            definition.minimum === undefined ||
+            definition.maximum === undefined ||
+            value < definition.minimum ||
+            value > definition.maximum)
+            return undefined;
+        return value;
+    }
+    if (typeof value !== 'string')
+        return undefined;
+    return definition.allowedValues?.find((locale) => locale === value);
+}
+//# sourceMappingURL=system-config-catalog.js.map

package/dist/lib/system-config-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-config-catalog.js","sourceRoot":"","sources":["../../src/lib/system-config-catalog.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAEhG,oEAAoE;AACpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAU,CAAC,CAAC;AAoBhE,4FAA4F;AAC5F,SAAS,iBAAiB,CACxB,GAAQ,EACR,KAAwB,EACxB,KAAa,EACb,WAAmB,EACnB,IAAqC,EACrC,YAAoB,EACpB,OAAe,EACf,OAAe,EACf,eAAe,GAAgC,SAAS;IAExD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG;QACH,KAAK;QACL,KAAK;QACL,WAAW;QACX,SAAS,EAAE,SAAkB;QAC7B,IAAI;QACJ,YAAY;QACZ,OAAO;QACP,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,iBAAiB,CACf,kBAAkB,EAClB,WAAW,EACX,uBAAuB,EACvB,mDAAmD,EACnD,SAAS,EACT,IAAI,EACJ,EAAE,EACF,KAAK,EACL,kBAAkB,CACnB;IACD,iBAAiB,CACf,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,+CAA+C,EAC/C,SAAS,EACT,IAAI,EACJ,EAAE,EACF,KAAK,EACL,kBAAkB,CACnB;IACD,iBAAiB,CACf,mBAAmB,EACnB,WAAW,EACX,wBAAwB,EACxB,oDAAoD,EACpD,SAAS,EACT,OAAO,EACP,GAAG,EACH,QAAQ,EACR,kBAAkB,CACnB;IACD,iBAAiB,CACf,wBAAwB,EACxB,WAAW,EACX,6BAA6B,EAC7B,2DAA2D,EAC3D,SAAS,EACT,GAAG,EACH,EAAE,EACF,IAAI,EACJ,kBAAkB,CACnB;IACD,iBAAiB,CACf,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,oDAAoD,EACpD,SAAS,EACT,KAAK,EACL,GAAG,EACH,OAAO,EACP,kBAAkB,CACnB;IACD,iBAAiB,CACf,gBAAgB,EAChB,WAAW,EACX,qBAAqB,EACrB,0DAA0D,EAC1D,SAAS,EACT,GAAG,EACH,EAAE,EACF,IAAI,CACL;IACD,iBAAiB,CACf,oBAAoB,EACpB,WAAW,EACX,yBAAyB,EACzB,8DAA8D,EAC9D,SAAS,EACT,IAAI,EACJ,GAAG,EACH,KAAK,CACN;IACD,iBAAiB,CACf,gBAAgB,EAChB,WAAW,EACX,qBAAqB,EACrB,yDAAyD,EACzD,SAAS,EACT,MAAM,EACN,GAAG,EACH,OAAO,CACR;IACD,iBAAiB,CACf,sBAAsB,EACtB,aAAa,EACb,qBAAqB,EACrB,qDAAqD,EACrD,UAAU,EACV,EAAE,EACF,CAAC,EACD,GAAG,CACJ;IACD,iBAAiB,CACf,yBAAyB,EACzB,aAAa,EACb,cAAc,EACd,sCAAsC,EACtC,SAAS,EACT,GAAG,EACH,EAAE,EACF,KAAK,CACN;IACD,iBAAiB,CACf,2BAA2B,EAC3B,aAAa,EACb,0BAA0B,EAC1B,oDAAoD,EACpD,UAAU,EACV,CAAC,EACD,CAAC,EACD,GAAG,CACJ;IACD,iBAAiB,CACf,8BAA8B,EAC9B,aAAa,EACb,2BAA2B,EAC3B,2CAA2C,EAC3C,SAAS,EACT,GAAG,EACH,EAAE,EACF,KAAK,CACN;IACD,iBAAiB,CACf,+BAA+B,EAC/B,aAAa,EACb,8BAA8B,EAC9B,wDAAwD,EACxD,UAAU,EACV,CAAC,EACD,CAAC,EACD,GAAG,CACJ;IACD,iBAAiB,CACf,kCAAkC,EAClC,aAAa,EACb,+BAA+B,EAC/B,+CAA+C,EAC/C,SAAS,EACT,GAAG,EACH,EAAE,EACF,KAAK,CACN;IACD,iBAAiB,CACf,mBAAmB,EACnB,SAAS,EACT,oBAAoB,EACpB,sDAAsD,EACtD,UAAU,EACV,CAAC,EACD,CAAC,EACD,GAAG,CACJ;IACD,iBAAiB,CACf,0BAA0B,EAC1B,SAAS,EACT,kBAAkB,EAClB,iEAAiE,EACjE,SAAS,EACT,GAAG,EACH,EAAE,EACF,MAAM,CACP;IACD,iBAAiB,CACf,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,mDAAmD,EACnD,MAAM,EACN,EAAE,EACF,CAAC,EACD,IAAI,CACL;IACD,MAAM,CAAC,MAAM,CAAC;QACZ,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,sDAAsD;QACnE,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,iBAAiB;QAChC,eAAe,EAAE,SAAS;KAClB,CAAC;CACH,CAAC,CAAC;AAkCZ;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAkC,EAClC,KAAc;IAEd,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACvC,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;YACxB,UAAU,CAAC,OAAO,KAAK,SAAS;YAChC,UAAU,CAAC,OAAO,KAAK,SAAS;YAChC,KAAK,GAAG,UAAU,CAAC,OAAO;YAC1B,KAAK,GAAG,UAAU,CAAC,OAAO;YAE1B,OAAO,SAAS,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;AACtE,CAAC"}

package/dist/lib/system-config.d.ts

@@ -1,18 +1,17 @@
 /**
  * System configuration service — reads runtime settings from the system_config table.
  *
- * Values are cached in-memory with a configurable TTL to minimize database queries.
+ * Found values are cached in-memory for 60 seconds to minimize database queries.
  * The cache is shared across all requests within the process.
  *
- * The system_config table stores values as JSONB. Duration-type values are stored
- * as JSONB strings (e.g., '"3600"'), while booleans and numbers are stored as
- * native JSONB types. The typed getters handle parsing and coercion for each type.
+ * Public values use native JSONB scalars and the immutable catalog's validation and defaults.
+ * No coercion is performed. Missing, invalid or unavailable policy uses a bounded safe warning.
  *
  * @example
- *   const ttl = await getSystemConfigNumber('access_token_ttl', 3600);
- *   const secure = await getSystemConfigBoolean('cookie_secure', true);
+ *   const ttl = await getSystemConfigNumber('access_token_ttl');
  *   const allTtls = await loadOidcTtlConfig();
  */
+import type { NumericSystemConfigKey, SupportedLocale } from './system-config-catalog.js';
 /** OIDC TTL configuration loaded from system_config table */
 export interface OidcTtlConfig {
     /** Access token lifetime in seconds (default: 3600 = 1 hour) */
@@ -31,40 +30,37 @@ export interface OidcTtlConfig {
     grant: number;
 }
 /**
- * Get a string config value from the system_config table.
- *
- * @param key - Config key (e.g., 'magic_link_length')
- * @param fallback - Default value returned if key not found or value is not a string
- * @returns The config value as a string, or the fallback
+ * Read a native, bounded integer or its exact catalog default, without caller-owned fallbacks.
+ * @param key - Public integer policy key.
+ * @returns Valid stored integer or the same catalog's safe default.
+ * @throws Error when JavaScript callers supply a non-numeric or non-catalog key.
+ * @example
+ * await getSystemConfigNumber('magic_link_ttl'); // seconds
  */
-export declare function getSystemConfigString(key: string, fallback: string): Promise<string>;
+export declare function getSystemConfigNumber(key: NumericSystemConfigKey): Promise<number>;
 /**
- * Get a numeric config value from the system_config table.
- *
- * Handles two storage patterns:
- * - Duration-type values stored as JSONB strings (e.g., '"3600"') → parsed to number
- * - Number-type values stored as native JSONB numbers (e.g., 10) → returned directly
- *
- * @param key - Config key (e.g., 'access_token_ttl')
- * @param fallback - Default value returned if key not found or not a valid number
- * @returns The config value as a number, or the fallback
+ * Read the final authentication locale fallback without coercing arbitrary database content.
+ * @param key - The closed public locale key.
+ * @returns Completely supported stored locale or its catalog default.
+ * @throws Error when JavaScript callers supply a non-locale or non-catalog key.
+ * @example
+ * await getSystemConfigString('default_locale'); // 'en'
  */
-export declare function getSystemConfigNumber(key: string, fallback: number): Promise<number>;
+export declare function getSystemConfigString(key: 'default_locale'): Promise<SupportedLocale>;
 /**
- * Get a boolean config value from the system_config table.
- *
- * Handles native JSONB booleans (true/false) and string representations
- * ('true'/'false') for maximum flexibility.
- *
- * @param key - Config key (e.g., 'cookie_secure')
- * @param fallback - Default value returned if key not found or not a valid boolean
- * @returns The config value as a boolean, or the fallback
+ * Read trusted internal string rows independently of public operational policy. Internal rows
+ * never enter administrative projections, and raw exceptions or stored content are not logged.
+ * @param key - Internal name supplied by Porta code, not by an administrative request.
+ * @param fallback - Safe result when storage is absent, unavailable or not a native string.
+ * @returns Native internal string, or the supplied fallback.
+ * @example
+ * await getInternalSystemConfigString('super_admin_user_id', '');
  */
-export declare function getSystemConfigBoolean(key: string, fallback: boolean): Promise<boolean>;
+export declare function getInternalSystemConfigString(key: string, fallback: string): Promise<string>;
 /**
  * Load all TTL config values needed by the OIDC provider.
  *
- * Reads each TTL key from system_config with hardcoded fallback defaults.
+ * Reads each native TTL through the same catalog used by administrative policy.
  * Called once at provider initialization to build the TTL configuration.
  * The interaction TTL is hardcoded (not stored in system_config).
  *
@@ -73,7 +69,8 @@ export declare function getSystemConfigBoolean(key: string, fallback: boolean):
 export declare function loadOidcTtlConfig(): Promise<OidcTtlConfig>;
 /**
  * Clear the in-memory config cache.
- * Useful for testing to ensure fresh reads from the database.
+ * Successful administrative saves call this after commit. Replacing the map also isolates
+ * reads already awaiting PostgreSQL, so their later completion cannot restore stale policy.
  */
 export declare function clearSystemConfigCache(): void;
 //# sourceMappingURL=system-config.d.ts.map

package/dist/lib/system-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-config.d.ts","sourceRoot":"","sources":["../../src/lib/system-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAWH,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;CACf;AA8CD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM1F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB1F;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAe7F;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAoBhE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}
+{"version":3,"file":"system-config.d.ts","sourceRoot":"","sources":["../../src/lib/system-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EACV,sBAAsB,EACtB,eAAe,EAGhB,MAAM,4BAA4B,CAAC;AAUpC,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;CACf;AA+DD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAIxF;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAI3F;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAoBhE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}