@rapidrest/auth 1.0.0-beta.1

package/dist/lib/auth/shared.js

@@ -0,0 +1,431 @@
+import { OTPContactType, } from "./types.js";
+const headerSchemeRegExps = new Map();
+/**
+ * Attempts to decode the request for authentication Basic request data
+ * (e.g. `Authorization: basic base64("<id>:<password>")).
+ *
+ * @param req The request to return auth request data for.
+ * @param headerKey The name of a header to look for request data in. Set to an empty string to skip
+ * the header search entirely — passing `undefined` has no effect, since that just triggers the
+ * default value. Default is 'Authorization'.
+ * @param headerScheme The header scheme to look for. Default is 'basic'.
+ * @returns An object with format `{id: <username>, password: <password> }, otherwise `undefined`.
+ */
+export const getBasicData = function (req, headerKey = "authorization", headerScheme = "basic") {
+    let result = undefined;
+    // Check the headers. It's possible there is more than one header value defined. Loop through each of
+    // them until we have verified auth request data.
+    if (headerKey in req.headers) {
+        const value = req.headers[headerKey];
+        const headers = Array.isArray(value) ? value : typeof value === "string" ? [value] : [];
+        // Loop throught through the headers looking for a value with a matching scheme
+        for (const header in headers) {
+            const parts = headers[header].split(" ");
+            if (parts.length !== 2) {
+                continue;
+            }
+            const regexHeaderScheme = headerSchemeRegExps.get(headerScheme) ?? new RegExp("^" + headerScheme + "$", "i");
+            if (!headerSchemeRegExps.has(headerScheme)) {
+                headerSchemeRegExps.set(headerScheme, regexHeaderScheme);
+            }
+            if (!parts[0].match(regexHeaderScheme)) {
+                continue;
+            }
+            result = Buffer.from(parts[1], "base64").toString("utf-8");
+        }
+    }
+    if (typeof result === "string") {
+        const obj = {};
+        const parts = result.split(":");
+        obj.id = parts[0];
+        obj.password = parts[1];
+        result = obj;
+    }
+    return result;
+};
+/**
+ * Attempts to decode the request for authentication request data. The auth request data may be in a header, a query
+ * parameter or the request body itself. It may either be JSON encoded or form-data encoded. We want to return a
+ * regular object.
+ *
+ * @param req The request to return auth request data for.
+ * @param headerKey The name of a header to look for request data in. Set to an empty string to skip
+ * the header search entirely — passing `undefined` has no effect, since that just triggers the
+ * default value. Default is 'Authorization'.
+ * @param headerScheme The header scheme to look for. Default is 'basic'.
+ * @returns The found request data and its decoded payload object.
+ */
+export const getRequestData = function (req, headerKey = "authorization", headerScheme = "basic") {
+    let data = undefined;
+    let payload = undefined;
+    // The request body may have the form of JSON (`{ id: "...", password: "" }`) or form-data (`id=...&code=...`)
+    if (typeof req.body === "object") {
+        data = payload = req.body;
+    }
+    else if (typeof req.body === "string") {
+        // First try to see if this is actually JSON
+        try {
+            payload = JSON.parse(req.body);
+        }
+        catch (err) {
+            // The body is probably form-data. It'll be processed later
+        }
+        data = req.body;
+    }
+    // Check the headers. It's possible there is more than one header value defined. Loop through each of
+    // them until we have verified auth request data.
+    if (!data && headerKey && headerKey in req.headers) {
+        const value = req.headers[headerKey];
+        const headers = Array.isArray(value) ? value : typeof value === "string" ? [value] : [];
+        // Loop throught through the headers looking for a value with a matching scheme
+        for (const header in headers) {
+            const parts = headers[header].split(" ");
+            if (parts.length !== 2) {
+                continue;
+            }
+            const regexHeaderScheme = headerSchemeRegExps.get(headerScheme) ?? new RegExp("^" + headerScheme + "$", "i");
+            if (!headerSchemeRegExps.has(headerScheme)) {
+                headerSchemeRegExps.set(headerScheme, regexHeaderScheme);
+            }
+            if (!parts[0].match(regexHeaderScheme)) {
+                continue;
+            }
+            data = Buffer.from(parts[1], "base64").toString("utf-8");
+        }
+    }
+    // A string body that already parsed as JSON above has a real payload object — don't clobber it
+    // by re-parsing the same raw string as form-data/colon-delimited below.
+    if (typeof data === "string" && typeof payload !== "object") {
+        const obj = {};
+        // The string value may be ':' delimited (e.g. Basic auth) or form-data encoded.
+        // Detect which one it is and decode accordingly
+        if (data.includes("&")) {
+            const formParts = data.split("&");
+            for (const part of formParts) {
+                const parts = part.split("=");
+                obj[parts[0]] = parts[1] ?? undefined;
+            }
+        }
+        else if (data.includes(":")) {
+            // This is dirty making assumptions like the following. Should really do
+            // something differently probably but I want to reduce the number of times
+            // this gets decoded.
+            const parts = data.split(":");
+            obj.id = parts[0];
+            obj.password = parts[1];
+        }
+        payload = obj;
+    }
+    return { data, payload };
+};
+export const isOTPResponse = function (response) {
+    return response.id && response.token;
+};
+export const isPasskeyResponse = function (response) {
+    if (typeof response.id !== "string" ||
+        typeof response.response?.clientDataJSON !== "string" ||
+        typeof response.response?.authenticatorData !== "string" ||
+        typeof response.response?.signature !== "string") {
+        return false;
+    }
+    return true;
+};
+/**
+ * Determines if the given value has the shape of a WebAuthn `RegistrationResponseJSON`, as produced by
+ * `navigator.credentials.create()` and submitted to finish a passkey registration ceremony.
+ *
+ * @param response The value to check.
+ */
+export const isPasskeyRegistrationResponse = function (response) {
+    if (typeof response?.id !== "string" ||
+        typeof response.response?.clientDataJSON !== "string" ||
+        typeof response.response?.attestationObject !== "string") {
+        return false;
+    }
+    return true;
+};
+/**
+ * Obfuscates the given contact and returns the obfuscated value.
+ * @param contact The contact to obfuscate.
+ */
+export const obfuscateContact = function (contact, type) {
+    let result = contact;
+    switch (type) {
+        case OTPContactType.EMAIL:
+            result = result.replace(/^(.).*(.{2})(@)/, "$1***$2$3");
+            break;
+        case OTPContactType.SMS:
+            result = result.replace(/.(?=.{4})/g, "*");
+            break;
+    }
+    return result;
+};
+///////////////////////////////////////////////////////////////////////////////
+// OTP
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Generates and returns a new OTP token for authentication. This function stores relevant data for
+ * validation of the OTP token in the request's session.
+ * @param req The HTTP request to use for storing session data.
+ * @returns The generated OTP token.
+ */
+export const generateOTP = async function (req, requestData) {
+    if (!req.session) {
+        throw new Error("This function requires session support. Configure the `session` config " +
+            "block so the session middleware is registered.");
+    }
+    requestData = requestData ?? getRequestData(req).payload;
+    const otplib = await importOTPLib();
+    const secret = otplib.generateSecret();
+    const token = await otplib.generate({ secret });
+    // Store the OTP data in the session for later verification
+    req.session.id = requestData.id;
+    req.session.secret = secret;
+    req.session.token = token;
+    return token;
+};
+/**
+ * Validates the provided token against the data stored in the request session.
+ * @param token The OTP token to validate.
+ * @param req The HTTP request with OTP session data.
+ */
+export const verifyOTP = async function (req, payload) {
+    if (!req.session) {
+        throw new Error("This function requires session support. Configure the `session` config " +
+            "block so the session middleware is registered.");
+    }
+    payload = payload ?? getRequestData(req).payload;
+    if (!isOTPResponse(payload)) {
+        throw new Error("Invalid authentication request.");
+    }
+    if (req.session.id !== payload.id) {
+        throw new Error("Invalid authentication request.");
+    }
+    const otplib = await importOTPLib();
+    const result = await otplib.verify({
+        secret: req.session.secret,
+        token: payload.token,
+    });
+    return result.valid;
+};
+///////////////////////////////////////////////////////////////////////////////
+// PASSKEY
+///////////////////////////////////////////////////////////////////////////////
+export const generatePasskeyChallenge = async function (config, req, allowCredentials) {
+    if (!req.session) {
+        throw new Error("This function requires session support. Configure the `session` config " +
+            "block so the session middleware is registered.");
+    }
+    const { generateAuthenticationOptions } = await importSimpleWebAuthn();
+    const result = await generateAuthenticationOptions({
+        rpID: config.rpID,
+        allowCredentials,
+        userVerification: config.userVerification,
+        timeout: config.timeout,
+    });
+    // Store the challenge in the session so it can be verified
+    req.session.challenge = result.challenge;
+    return result;
+};
+export const verifyPasskeyChallenge = async function (credential, config, expectedChallenge, payload) {
+    const { verifyAuthenticationResponse } = await importSimpleWebAuthn();
+    if (!Number.isFinite(credential.counter)) {
+        throw new Error("Stored passkey credential has an invalid counter.");
+    }
+    return await verifyAuthenticationResponse({
+        response: payload,
+        expectedChallenge,
+        expectedOrigin: config.origin,
+        expectedRPID: config.rpID,
+        credential: {
+            id: credential.id,
+            counter: credential.counter,
+            publicKey: credential.publicKey,
+            transports: credential.transports,
+        },
+        requireUserVerification: config.requireUserVerification ?? true,
+    });
+};
+/**
+ * Begins a registration ceremony: generates a set of `PublicKeyCredentialCreationOptions` and stores the
+ * challenge in the session for later verification. The result is meant to be returned directly to the
+ * client for use with `navigator.credentials.create()`.
+ *
+ * @param config The relying party configuration to use for this ceremony.
+ * @param req The source HTTP request. Used to persist the generated challenge in the session.
+ * @param user The user the new credential will be associated with.
+ * @param excludeCredentials The user's already-registered credentials, if any, so that the authenticator
+ * can avoid creating a duplicate credential for one it already holds.
+ */
+export const generatePasskeyRegistrationOptions = async function (config, req, user, excludeCredentials) {
+    if (!req.session) {
+        throw new Error("This function requires session support. Configure the `session` config " +
+            "block so the session middleware is registered.");
+    }
+    const { generateRegistrationOptions } = await importSimpleWebAuthn();
+    const result = await generateRegistrationOptions({
+        rpName: config.rpName,
+        rpID: config.rpID,
+        userName: user.name,
+        userID: new TextEncoder().encode(user.id),
+        userDisplayName: user.displayName,
+        timeout: config.timeout,
+        authenticatorSelection: {
+            userVerification: config.userVerification ?? "preferred",
+            authenticatorAttachment: config.authenticatorAttachment,
+            residentKey: config.residentKey,
+        },
+        excludeCredentials,
+    });
+    // Store the challenge in the session so it can be verified once the ceremony finishes.
+    req.session.challenge = result.challenge;
+    return result;
+};
+/**
+ * Finishes a registration ceremony: verifies the client-submitted attestation response against the
+ * stored challenge and relying party configuration.
+ *
+ * @param config The relying party configuration to verify the response against.
+ * @param expectedChallenge The challenge previously stored in the session by
+ * `generatePasskeyRegistrationOptions()`.
+ * @param payload The client-submitted `RegistrationResponseJSON`.
+ */
+export const verifyPasskeyRegistrationResponse = async function (config, expectedChallenge, payload) {
+    const { verifyRegistrationResponse } = await importSimpleWebAuthn();
+    return await verifyRegistrationResponse({
+        response: payload,
+        expectedChallenge,
+        expectedOrigin: config.origin,
+        expectedRPID: config.rpID,
+        requireUserVerification: config.requireUserVerification ?? true,
+    });
+};
+///////////////////////////////////////////////////////////////////////////////
+// TOTP
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Generates and returns a new OTP token for authentication. This function stores relevant data for
+ * validation of the OTP token in the request's session.
+ * @param req The HTTP request to use for storing session data.
+ * @returns The generated OTP token.
+ */
+export const generateTOTP = async function (req, requestData) {
+    if (!req.session) {
+        throw new Error("This function requires session support. Configure the `session` config " +
+            "block so the session middleware is registered.");
+    }
+    requestData = requestData ?? getRequestData(req).payload;
+    const otplib = await importOTPLib();
+    const secret = otplib.generateSecret();
+    const token = await otplib.generate({ secret });
+    // Store the OTP data in the session for later verification
+    req.session.id = requestData.id;
+    req.session.secret = secret;
+    req.session.token = token;
+    return token;
+};
+/**
+ * Validates the provided token against the specified TOTP secret.
+ * @param token The OTP token to validate.
+ * @param secret The stored TOTP secret to validate the token against.
+ * @returns The otplib verification result if successful, otherwise `undefined`.
+ */
+export const verifyTOTP = async function (token, secret) {
+    const otplib = await importOTPLib();
+    // Check against all provided TOTP secrets. If at least one of the TOTP
+    // secrets is valid then we return success.
+    const secrets = Array.isArray(secret) ? secret : [secret];
+    for (const secret of secrets) {
+        const result = await otplib.verify({
+            ...secret,
+            token,
+        });
+        if (result.valid) {
+            return result;
+        }
+    }
+    return undefined;
+};
+/**
+ * Determines if the given value is usable as a TOTP secret: a Base32-encoded string decoding to at
+ * least 128 bits, the minimum shared secret length mandated by RFC 4226 §4 (R6) (which RFC 6238
+ * TOTP secrets must also satisfy, per RFC 6238 §5.1).
+ *
+ * @param secret The value to check.
+ */
+export const isValidTOTPSecret = async function (secret) {
+    if (typeof secret !== "string" || secret.length === 0) {
+        return false;
+    }
+    try {
+        const { ScureBase32Plugin } = await importOTPLib();
+        const decoded = new ScureBase32Plugin().decode(secret);
+        // RFC 4226 §4 (R6): the shared secret MUST be at least 128 bits (16 bytes).
+        return decoded.length >= 16;
+    }
+    catch (err) {
+        return false;
+    }
+};
+/**
+ * Generates an `otpauth://` provisioning URI for the given TOTP secret — the "Key URI Format"
+ * convention (https://github.com/google/google-authenticator/wiki/Key-Uri-Format) that, while not
+ * itself an RFC, is the de facto standard virtually every TOTP authenticator app (Google
+ * Authenticator, Authy, 1Password, etc.) relies on to enroll a secret via QR code or manual entry.
+ *
+ * @param config The relying party configuration to generate the URI for.
+ * @param label The account label to embed in the URI (typically a username or email).
+ * @param secret The TOTP secret to encode into the URI.
+ */
+export const generateTOTPURI = async function (config, label, secret) {
+    const { generateURI } = await importOTPLib();
+    return generateURI({
+        issuer: config.issuer,
+        label,
+        secret: secret.secret,
+        algorithm: secret.algorithm ?? config.algorithm,
+        digits: secret.digits ?? config.digits,
+        period: secret.period ?? config.period,
+    });
+};
+///////////////////////////////////////////////////////////////////////////////
+// LIBRARY IMPORTS
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Dynamically imports the optional peer dependency `argon2`, throwing a helpful
+ * error if it is not installed.
+ */
+export const importArgon2 = async function () {
+    try {
+        return await import("argon2");
+    }
+    catch (err) {
+        throw new Error("This feature requires the optional peer dependency 'argon2'. Install it with: yarn add argon2");
+    }
+};
+/**
+ * Dynamically imports the optional peer dependency `otplib`, throwing a helpful
+ * error if it is not installed.
+ */
+export const importOTPLib = async function () {
+    try {
+        return await import("otplib");
+    }
+    catch (err) {
+        throw new Error("This feature requires the optional peer dependency 'otplib'. Install it with: yarn add otplib");
+    }
+};
+/**
+ * Dynamically imports the optional peer dependency `@simplewebauthn/server`, throwing a helpful
+ * error if it is not installed.
+ */
+export const importSimpleWebAuthn = async function () {
+    try {
+        return await import("@simplewebauthn/server");
+    }
+    catch (err) {
+        throw new Error("This feature requires the optional peer dependency '@simplewebauthn/server'. Install it with: " +
+            "yarn add @simplewebauthn/server");
+    }
+};
+//# sourceMappingURL=shared.js.map

package/dist/lib/auth/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/auth/shared.ts"],"names":[],"mappings":"AAIA,OAAO,EACH,cAAc,GAMjB,MAAM,YAAY,CAAC;AAEpB,MAAM,mBAAmB,GAAwB,IAAI,GAAG,EAAE,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,UACxB,GAAgB,EAChB,YAAoB,eAAe,EACnC,eAAuB,OAAO;IAE9B,IAAI,MAAM,GAAQ,SAAS,CAAC;IAE5B,qGAAqG;IACrG,iDAAiD;IACjD,IAAI,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAkC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,OAAO,GAAa,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAElG,+EAA+E;QAC/E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAa,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrB,SAAS;YACb,CAAC;YAED,MAAM,iBAAiB,GACnB,mBAAmB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,GAAG,YAAY,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;YACvF,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACzC,mBAAmB,CAAC,GAAG,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;YAC7D,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACrC,SAAS;YACb,CAAC;YAED,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAQ,EAAE,CAAC;QACpB,MAAM,KAAK,GAAa,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,UAC1B,GAAgB,EAChB,YAAgC,eAAe,EAC/C,eAAuB,OAAO;IAE9B,IAAI,IAAI,GAAQ,SAAS,CAAC;IAC1B,IAAI,OAAO,GAAQ,SAAS,CAAC;IAE7B,8GAA8G;IAC9G,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,GAAG,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IAC9B,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,4CAA4C;QAC5C,IAAI,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,2DAA2D;QAC/D,CAAC;QACD,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,qGAAqG;IACrG,iDAAiD;IACjD,IAAI,CAAC,IAAI,IAAI,SAAS,IAAI,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACjD,MAAM,KAAK,GAAkC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,OAAO,GAAa,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAElG,+EAA+E;QAC/E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAa,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrB,SAAS;YACb,CAAC;YAED,MAAM,iBAAiB,GACnB,mBAAmB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,GAAG,YAAY,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;YACvF,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACzC,mBAAmB,CAAC,GAAG,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;YAC7D,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACrC,SAAS;YACb,CAAC;YAED,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;IACL,CAAC;IAED,+FAA+F;IAC/F,wEAAwE;IACxE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAQ,EAAE,CAAC;QAEpB,gFAAgF;QAChF,gDAAgD;QAChD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAa,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAa,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;YAC1C,CAAC;QACL,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,wEAAwE;YACxE,0EAA0E;YAC1E,qBAAqB;YACrB,MAAM,KAAK,GAAa,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAClB,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,QAAa;IAChD,OAAO,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,QAAa;IACpD,IACI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ;QAC/B,OAAO,QAAQ,CAAC,QAAQ,EAAE,cAAc,KAAK,QAAQ;QACrD,OAAO,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,KAAK,QAAQ;QACxD,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,KAAK,QAAQ,EAClD,CAAC;QACC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,UAAU,QAAa;IAChE,IACI,OAAO,QAAQ,EAAE,EAAE,KAAK,QAAQ;QAChC,OAAO,QAAQ,CAAC,QAAQ,EAAE,cAAc,KAAK,QAAQ;QACrD,OAAO,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,KAAK,QAAQ,EAC1D,CAAC;QACC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,OAAe,EAAE,IAAoB;IAC3E,IAAI,MAAM,GAAW,OAAO,CAAC;IAE7B,QAAQ,IAAI,EAAE,CAAC;QACX,KAAK,cAAc,CAAC,KAAK;YACrB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACxD,MAAM;QACV,KAAK,cAAc,CAAC,GAAG;YACnB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAC3C,MAAM;IACd,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM;AACN,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,WAAW,GAAgB,EAAE,WAAiB;IAC1E,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACX,yEAAyE;YACrE,gDAAgD,CACvD,CAAC;IACN,CAAC;IAED,WAAW,GAAG,WAAW,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IAEzD,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;IACvC,MAAM,KAAK,GAAW,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAExD,2DAA2D;IAC3D,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC;IAChC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAC5B,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IAE1B,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,WAAW,GAAgB,EAAE,OAAa;IACpE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACX,yEAAyE;YACrE,gDAAgD,CACvD,CAAC;IACN,CAAC;IAED,OAAO,GAAG,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IAEjD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;KACvB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,KAAK,CAAC;AACxB,CAAC,CAAC;AAEF,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,WACzC,MAAqB,EACrB,GAAgB,EAChB,gBAAsB;IAEtB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACX,yEAAyE;YACrE,gDAAgD,CACvD,CAAC;IACN,CAAC;IAED,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;QAC/C,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,gBAAgB;QAChB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,OAAO,EAAE,MAAM,CAAC,OAAO;KAC1B,CAAC,CAAC;IAEH,2DAA2D;IAC3D,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAEzC,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,WACvC,UAAmC,EACnC,MAAqB,EACrB,iBAAyB,EACzB,OAAY;IAEZ,MAAM,EAAE,4BAA4B,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAEtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,MAAM,4BAA4B,CAAC;QACtC,QAAQ,EAAE,OAAO;QACjB,iBAAiB;QACjB,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,YAAY,EAAE,MAAM,CAAC,IAAI;QACzB,UAAU,EAAE;YACR,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,UAAU,EAAE,UAAU,CAAC,UAAU;SACpC;QACD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,IAAI,IAAI;KAClE,CAAC,CAAC;AACP,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,KAAK,WACnD,MAAqB,EACrB,GAAgB,EAChB,IAAwD,EACxD,kBAAsE;IAEtE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACX,yEAAyE;YACrE,gDAAgD,CACvD,CAAC;IACN,CAAC;IAED,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;QAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,eAAe,EAAE,IAAI,CAAC,WAAW;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,sBAAsB,EAAE;YACpB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,WAAW;YACxD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;YACvD,WAAW,EAAE,MAAM,CAAC,WAAW;SAClC;QACD,kBAAkB;KACrB,CAAC,CAAC;IAEH,uFAAuF;IACvF,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAEzC,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,KAAK,WAClD,MAAqB,EACrB,iBAAyB,EACzB,OAAY;IAEZ,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAEpE,OAAO,MAAM,0BAA0B,CAAC;QACpC,QAAQ,EAAE,OAAO;QACjB,iBAAiB;QACjB,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,YAAY,EAAE,MAAM,CAAC,IAAI;QACzB,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,IAAI,IAAI;KAClE,CAAC,CAAC;AACP,CAAC,CAAC;AAEF,+EAA+E;AAC/E,OAAO;AACP,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,WAAW,GAAgB,EAAE,WAAiB;IAC3E,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACX,yEAAyE;YACrE,gDAAgD,CACvD,CAAC;IACN,CAAC;IAED,WAAW,GAAG,WAAW,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IAEzD,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;IACvC,MAAM,KAAK,GAAW,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAExD,2DAA2D;IAC3D,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC;IAChC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAC5B,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IAE1B,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,WAAW,KAAa,EAAE,MAAiC;IACtF,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IAEpC,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,OAAO,GAAiB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;YAC/B,GAAG,MAAM;YACT,KAAK;SACR,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,MAAM,CAAC;QAClB,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,WAAW,MAAW;IACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QACnD,MAAM,OAAO,GAAe,IAAI,iBAAiB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,4EAA4E;QAC5E,OAAO,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,WAAW,MAAkB,EAAE,KAAa,EAAE,MAAkB;IAChG,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAE7C,OAAO,WAAW,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS;QAC/C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;QACtC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;KACzC,CAAC,CAAC;AACP,CAAC,CAAC;AAEF,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK;IAC7B,IAAI,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACX,+FAA+F,CAClG,CAAC;IACN,CAAC;AACL,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK;IAC7B,IAAI,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACX,+FAA+F,CAClG,CAAC;IACN,CAAC;AACL,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK;IACrC,IAAI,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACX,gGAAgG;YAC5F,iCAAiC,CACxC,CAAC;IACN,CAAC;AACL,CAAC,CAAC"}

package/dist/lib/auth/types.js

@@ -0,0 +1,12 @@
+////////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+////////////////////////////////////////////////////////////////////////////////
+/**
+ * The different types of supported contact methods.
+ */
+export var OTPContactType;
+(function (OTPContactType) {
+    OTPContactType["EMAIL"] = "email";
+    OTPContactType["SMS"] = "sms";
+})(OTPContactType || (OTPContactType = {}));
+//# sourceMappingURL=types.js.map

package/dist/lib/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/types.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,6CAA6C;AAC7C,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAN,IAAY,cAGX;AAHD,WAAY,cAAc;IACtB,iCAAe,CAAA;IACf,6BAAW,CAAA;AACf,CAAC,EAHW,cAAc,KAAd,cAAc,QAGzB"}

package/dist/lib/index.js

@@ -0,0 +1,4 @@
+export * from "./auth/index.js";
+export * from "./models/index.js";
+export * from "./routes/index.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC"}

package/dist/lib/models/index.js

@@ -0,0 +1,2 @@
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/models/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/dist/lib/models/mongo/AliasMongo.js

@@ -0,0 +1,77 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+///////////////////////////////////////////////////////////////////////////////
+import { BaseMongoEntity, DocDecorators, ModelDecorators, PersistenceDecorators } from "@rapidrest/service-core";
+import { AliasType } from "../types.js";
+const { Description } = DocDecorators;
+const { DataStore, Identifier, Protect } = ModelDecorators;
+const { Column, Entity, Index } = PersistenceDecorators;
+/**
+ * Implementation of the `Alias` interface for storage in a MongoDB database. If SQL is desired, please use
+ * `models.sql.AliasSQL` instead.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+let AliasMongo = class AliasMongo extends BaseMongoEntity {
+    constructor(other) {
+        super(other);
+        this.alias = "";
+        this.type = AliasType.NAME;
+        this.userUid = "";
+        this.verified = false;
+        if (other) {
+            this.alias = other.alias !== undefined ? other.alias : this.alias;
+            this.type = other.type !== undefined ? other.type : this.type;
+            this.userUid = other.userUid !== undefined ? other.userUid : this.userUid;
+            this.verified = other.verified !== undefined ? other.verified : this.verified;
+        }
+    }
+};
+__decorate([
+    Column(),
+    Identifier,
+    Index("alias", { unique: true }),
+    __metadata("design:type", String)
+], AliasMongo.prototype, "alias", void 0);
+__decorate([
+    Column(),
+    __metadata("design:type", String)
+], AliasMongo.prototype, "type", void 0);
+__decorate([
+    Column(),
+    __metadata("design:type", String)
+], AliasMongo.prototype, "userUid", void 0);
+__decorate([
+    Column(),
+    __metadata("design:type", Boolean)
+], AliasMongo.prototype, "verified", void 0);
+AliasMongo = __decorate([
+    DataStore("mongo"),
+    Entity(),
+    Description("Defines a record for a single user alias in the system."),
+    Protect({
+        uid: "UserMongo",
+        records: [
+            {
+                userOrRoleId: "anonymous",
+                actions: [],
+            },
+            {
+                userOrRoleId: ".*",
+                actions: [],
+            },
+        ],
+    }),
+    __metadata("design:paramtypes", [Object])
+], AliasMongo);
+export { AliasMongo };
+//# sourceMappingURL=AliasMongo.js.map

package/dist/lib/models/mongo/AliasMongo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AliasMongo.js","sourceRoot":"","sources":["../../../../src/models/mongo/AliasMongo.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,+EAA+E;AAC/E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACjH,OAAO,EAAS,SAAS,EAAE,MAAM,aAAa,CAAC;AAC/C,MAAM,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC;AACtC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC;AAC3D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC;AAExD;;;;;GAKG;AAiBI,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,eAAe;IAe3C,YAAY,KAA2B;QACnC,KAAK,CAAC,KAAK,CAAC,CAAC;QAZV,UAAK,GAAW,EAAE,CAAC;QAGnB,SAAI,GAAc,SAAS,CAAC,IAAI,CAAC;QAGjC,YAAO,GAAW,EAAE,CAAC;QAGrB,aAAQ,GAAY,KAAK,CAAC;QAK7B,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YAClE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9D,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1E,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAClF,CAAC;IACL,CAAC;CACJ,CAAA;AArBU;IAHN,MAAM,EAAE;IACR,UAAU;IACV,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;yCACP;AAGnB;IADN,MAAM,EAAE;;wCAC+B;AAGjC;IADN,MAAM,EAAE;;2CACmB;AAGrB;IADN,MAAM,EAAE;;4CACwB;AAbxB,UAAU;IAhBtB,SAAS,CAAC,OAAO,CAAC;IAClB,MAAM,EAAE;IACR,WAAW,CAAC,yDAAyD,CAAC;IACtE,OAAO,CAAC;QACL,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE;YACL;gBACI,YAAY,EAAE,WAAW;gBACzB,OAAO,EAAE,EAAE;aACd;YACD;gBACI,YAAY,EAAE,IAAI;gBAClB,OAAO,EAAE,EAAE;aACd;SACJ;KACJ,CAAC;;GACW,UAAU,CAyBtB"}