@volcanicminds/backend 2.2.7 → 2.2.9

package/README.md

@@ -41,6 +41,8 @@ And, what you see in [package.json](package.json).
 npm install @volcanicminds/backend
 ```
 
+````
+
 For database interactions, it is highly recommended to also install the companion package:
 
 ```sh
@@ -176,6 +178,9 @@ SWAGGER_HOST=myawesome.backend.com
 SWAGGER_TITLE=API Documentation
 SWAGGER_DESCRIPTION=List of available APIs and schemas to use
 SWAGGER_VERSION=0.1.0
+
+# MFA
+MFA_POLICY=OPTIONAL
 ```
 
 For docker may be useful set HOST as 0.0.0.0 (instead 127.0.0.1).
@@ -205,28 +210,31 @@ Refer to jest for more options.
 
 The framework is configured via `.env` variables. Below is a comprehensive list:
 
-| Variable                 | Description                                                             | Required | Default             |
-| ------------------------ | ----------------------------------------------------------------------- | :------: | ------------------- |
-| `NODE_ENV`               | The application environment.                                            |    No    | `development`       |
-| `HOST`                   | The host address for the server to listen on. Use `0.0.0.0` for Docker. |    No    | `0.0.0.0`           |
-| `PORT`                   | The port for the server to listen on.                                   |    No    | `2230`              |
-| `JWT_SECRET`             | Secret key for signing JWTs.                                            | **Yes**  |                     |
-| `JWT_EXPIRES_IN`         | Expiration time for JWTs (e.g., `5d`, `12h`).                           |    No    | `5d`                |
-| `JWT_REFRESH`            | Enable refresh tokens.                                                  |    No    | `true`              |
-| `JWT_REFRESH_SECRET`     | Secret key for signing refresh tokens.                                  | **Yes**¹ |                     |
-| `JWT_REFRESH_EXPIRES_IN` | Expiration time for refresh tokens.                                     |    No    | `180d`              |
-| `LOG_LEVEL`              | Logging verbosity (`trace`, `debug`, `info`, `warn`, `error`, `fatal`). |    No    | `info`              |
-| `LOG_COLORIZE`           | Enable colorized log output.                                            |    No    | `true`              |
-| `LOG_TIMESTAMP`          | Enable timestamps in logs.                                              |    No    | `true`              |
-| `LOG_TIMESTAMP_READABLE` | Use a human-readable timestamp format.                                  |    No    | `true`              |
-| `LOG_FASTIFY`            | Enable Fastify's built-in logger.                                       |    No    | `false`             |
-| `GRAPHQL`                | Enable the Apollo Server for GraphQL.                                   |    No    | `false`             |
-| `SWAGGER`                | Enable Swagger/OpenAPI documentation.                                   |    No    | `true`              |
-| `SWAGGER_HOST`           | The base URL for the API, used in Swagger docs.                         |    No    | `localhost:2230`    |
-| `SWAGGER_TITLE`          | The title of the API documentation.                                     |    No    | `API Documentation` |
-| `SWAGGER_DESCRIPTION`    | The description for the API documentation.                              |    No    |                     |
-| `SWAGGER_VERSION`        | The version of the API.                                                 |    No    | `0.1.0`             |
-| `SWAGGER_PREFIX_URL`     | The path where Swagger UI is available.                                 |    No    | `/api-docs`         |
+| Variable                       | Description                                                             | Required | Default             |
+| ------------------------------ | ----------------------------------------------------------------------- | :------: | ------------------- |
+| `NODE_ENV`                     | The application environment.                                            |    No    | `development`       |
+| `HOST`                         | The host address for the server to listen on. Use `0.0.0.0` for Docker. |    No    | `0.0.0.0`           |
+| `PORT`                         | The port for the server to listen on.                                   |    No    | `2230`              |
+| `JWT_SECRET`                   | Secret key for signing JWTs.                                            | **Yes**  |                     |
+| `JWT_EXPIRES_IN`               | Expiration time for JWTs (e.g., `5d`, `12h`).                           |    No    | `5d`                |
+| `JWT_REFRESH`                  | Enable refresh tokens.                                                  |    No    | `true`              |
+| `JWT_REFRESH_SECRET`           | Secret key for signing refresh tokens.                                  | **Yes**¹ |                     |
+| `JWT_REFRESH_EXPIRES_IN`       | Expiration time for refresh tokens.                                     |    No    | `180d`              |
+| `LOG_LEVEL`                    | Logging verbosity (`trace`, `debug`, `info`, `warn`, `error`, `fatal`). |    No    | `info`              |
+| `LOG_COLORIZE`                 | Enable colorized log output.                                            |    No    | `true`              |
+| `LOG_TIMESTAMP`                | Enable timestamps in logs.                                              |    No    | `true`              |
+| `LOG_TIMESTAMP_READABLE`       | Use a human-readable timestamp format.                                  |    No    | `true`              |
+| `LOG_FASTIFY`                  | Enable Fastify's built-in logger.                                       |    No    | `false`             |
+| `GRAPHQL`                      | Enable the Apollo Server for GraphQL.                                   |    No    | `false`             |
+| `SWAGGER`                      | Enable Swagger/OpenAPI documentation.                                   |    No    | `true`              |
+| `SWAGGER_HOST`                 | The base URL for the API, used in Swagger docs.                         |    No    | `localhost:2230`    |
+| `SWAGGER_TITLE`                | The title of the API documentation.                                     |    No    | `API Documentation` |
+| `SWAGGER_DESCRIPTION`          | The description for the API documentation.                              |    No    |                     |
+| `SWAGGER_VERSION`              | The version of the API.                                                 |    No    | `0.1.0`             |
+| `SWAGGER_PREFIX_URL`           | The path where Swagger UI is available.                                 |    No    | `/api-docs`         |
+| `MFA_POLICY`                   | MFA Security Policy (`OPTIONAL`, `MANDATORY`, `ONE_WAY`)                |    No    | `OPTIONAL`          |
+| `MFA_ADMIN_FORCED_RESET_EMAIL` | Admin email for emergency MFA reset                                     |    No    |                     |
+| `MFA_ADMIN_FORCED_RESET_UNTIL` | ISO Date string until which the reset is active                         |    No    |                     |
 
 ¹ Required if `JWT_REFRESH` is enabled.
 
@@ -685,6 +693,60 @@ export default {
 }
 ```
 
+## Multi-Factor Authentication (MFA)
+
+The framework provides a robust, built-in Multi-Factor Authentication system based on TOTP (Time-Based One-Time Password). It is designed with a "Gatekeeper" architecture that isolates pending verifications using temporary tokens.
+
+### Configuration
+
+MFA behavior is controlled via Environment Variables or `src/config/general.ts`:
+
+```ts
+// src/config/general.ts
+export default {
+  name: 'general',
+  enable: true,
+  options: {
+    // ...
+    mfa_policy: process.env.MFA_POLICY || 'OPTIONAL' // 'OPTIONAL' | 'MANDATORY' | 'ONE_WAY'
+  }
+}
+```
+
+### MFA Policies
+
+- **OPTIONAL** (Default): Users can choose to enable or disable MFA from their profile.
+- **MANDATORY**: MFA is enforced for all users.
+  - If a user has not set up MFA yet, upon login, they receive a `202 Accepted` response with a temporary token and must complete the setup to proceed.
+  - Users cannot disable MFA.
+- **ONE_WAY**: MFA is optional to start with, but once enabled, the user cannot disable it themselves. Only an admin can reset it.
+
+### Security Architecture
+
+When MFA is required (either because it's enabled for the user or the policy is MANDATORY), the login endpoint does **not** return a standard access token.
+
+1.  **Temporary Token**: Returns a JWT with a specific role: `pre-auth-mfa`.
+2.  **Gatekeeper**: Middleware automatically blocks any request made with a `pre-auth-mfa` token, **except** for specific whitelisted routes:
+    - `/auth/mfa/setup`
+    - `/auth/mfa/enable`
+    - `/auth/mfa/verify`
+    - `/auth/logout`
+3.  **Verification**: Only after successfully calling `/auth/mfa/verify` (or `enable` during setup) does the server issue the final, fully privileged Access Token.
+
+### Emergency Admin Reset
+
+If an administrator loses their MFA device and cannot log in, a filesystem/env-based emergency reset mechanism is available. This configuration is **only** available via Environment Variables to ensure security and easy rotation in production environments.
+
+1.  Set the environment variables in your server configuration (e.g., `.env` or Docker config):
+    ```bash
+    MFA_ADMIN_FORCED_RESET_EMAIL=admin@company.com
+    MFA_ADMIN_FORCED_RESET_UNTIL=2025-12-31T18:30:00.000Z  # A timestamp slightly in the future
+    ```
+2.  Restart the server.
+
+On startup, the server will check these variables. If the email matches an existing user and the current time is before the `UNTIL` timestamp, it will forcibly disable MFA for that specific user, allowing a standard login.
+**Important:** Remove these variables after the reset is complete to avoid security risks.
+
 ## Disable embedded authorization
 
 Out-of-the-box, the framework automatically secures all routes by checking for a valid (Bearer) JWT token if roles are defined for that route. However, if you want to disable this automatic authorization check and handle it manually within your controllers or middleware, you can do so by setting the `embedded_auth` option to `false`.
@@ -948,3 +1010,4 @@ A simple note: in the example below, you can see rawBody enabled on the `/exampl
   }
 }
 ```
+````

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAGjC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAWtD,OAAO,OAA4B,MAAM,SAAS,CAAA;AAqIlD,QAAA,MAAM,KAAK,GAAU,eAAe,6NA+OnC,CAAA;AAED,YAAY,EACV,MAAM,EACN,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,IAAI,EACJ,IAAI,EACJ,KAAK,EACL,KAAK,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAGjC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAWtD,OAAO,OAA4B,MAAM,SAAS,CAAA;AAqIlD,QAAA,MAAM,KAAK,GAAU,eAAe,6NAyRnC,CAAA;AAED,YAAY,EACV,MAAM,EACN,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,IAAI,EACJ,IAAI,EACJ,KAAK,EACL,KAAK,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA"}

package/dist/index.js

@@ -1,6 +1,7 @@
 'use strict';
 import dotenv from 'dotenv';
 dotenv.config();
+import dayjs from 'dayjs';
 import yn from './lib/util/yn.js';
 import logger from './lib/util/logger.js';
 import * as mark from './lib/util/mark.js';
@@ -68,8 +69,9 @@ async function addFastifySwagger(server) {
         try {
             content = fs.readFileSync(logoPath, { encoding: 'base64' });
         }
-        catch (e) {
-            log.w && log.warn('Swagger logo not found at ' + logoPath);
+        catch (_e) {
+            if (log.w)
+                log.warn('Swagger logo not found at ' + logoPath);
         }
         await server.register(swagger, {
             swagger: {
@@ -137,7 +139,6 @@ const start = async (decorators = {}) => {
     const { tracking, trackingConfig } = await loaderTracking.load();
     global.tracking = tracking;
     global.trackingConfig = trackingConfig;
-    const opts = yn(process.env.LOG_FASTIFY, false) ? { logger: { development: logger } } : { logger: true };
     const server = fastify();
     global.server = server;
     const { HOST: host = '0.0.0.0', PORT: port = '2230', GRAPHQL } = process.env;
@@ -145,8 +146,10 @@ const start = async (decorators = {}) => {
     const loadRefreshJWT = yn(JWT_REFRESH, true);
     const loadApollo = yn(GRAPHQL, false);
     const plugins = await loaderPlugins.load();
-    plugins?.rawBody && (await server.register(rawBody, plugins.rawBody || {}));
-    !loadApollo && plugins?.helmet && (await server.register(helmet, plugins.helmet || {}));
+    if (plugins?.rawBody)
+        await server.register(rawBody, plugins.rawBody || {});
+    if (!loadApollo && plugins?.helmet)
+        await server.register(helmet, plugins.helmet || {});
     if (plugins?.rateLimit) {
         await server.register(rateLimit, plugins.rateLimit || {});
         server.setNotFoundHandler({
@@ -154,14 +157,18 @@ const start = async (decorators = {}) => {
                 max: 30,
                 timeWindow: 30000
             })
-        }, function (req, reply) {
+        }, function (_req, reply) {
             reply.code(404).send();
         });
     }
-    plugins?.multipart && (await server.register(multipart, plugins.multipart || {}));
-    plugins?.cors && (await server.register(cors, plugins.cors || {}));
-    plugins?.compress && (await server.register(compress, plugins.compress || {}));
-    log.t && log.trace(`Add JWT - expiresIn: ${JWT_EXPIRES_IN}`);
+    if (plugins?.multipart)
+        await server.register(multipart, plugins.multipart || {});
+    if (plugins?.cors)
+        await server.register(cors, plugins.cors || {});
+    if (plugins?.compress)
+        await server.register(compress, plugins.compress || {});
+    if (log.t)
+        log.trace(`Add JWT - expiresIn: ${JWT_EXPIRES_IN}`);
     await server.register(jwtValidator, {
         secret: JWT_SECRET,
         sign: { expiresIn: JWT_EXPIRES_IN }
@@ -184,79 +191,82 @@ const start = async (decorators = {}) => {
             isImplemented() {
                 return false;
             },
-            isValidUser(data) {
+            isValidUser(_data) {
                 throw new Error('Not implemented.');
             },
-            createUser(data) {
+            createUser(_data) {
                 throw new Error('Not implemented.');
             },
-            deleteUser(data) {
+            deleteUser(_data) {
                 throw new Error('Not implemented.');
             },
-            resetExternalId(data) {
+            resetExternalId(_data) {
                 throw new Error('Not implemented.');
             },
-            updateUserById(id, user) {
+            updateUserById(_id, _user) {
                 throw new Error('Not implemented.');
             },
-            retrieveUserById(id) {
+            retrieveUserById(_id) {
                 throw new Error('Not implemented.');
             },
-            retrieveUserByEmail(email) {
+            retrieveUserByEmail(_email) {
                 throw new Error('Not implemented.');
             },
-            retrieveUserByConfirmationToken(code) {
+            retrieveUserByConfirmationToken(_code) {
                 throw new Error('Not implemented.');
             },
-            retrieveUserByResetPasswordToken(code) {
+            retrieveUserByResetPasswordToken(_code) {
                 throw new Error('Not implemented.');
             },
-            retrieveUserByUsername(username) {
+            retrieveUserByUsername(_username) {
                 throw new Error('Not implemented.');
             },
-            retrieveUserByExternalId(externalId) {
+            retrieveUserByExternalId(_externalId) {
                 throw new Error('Not implemented.');
             },
-            retrieveUserByPassword(email, password) {
+            retrieveUserByPassword(_email, _password) {
                 throw new Error('Not implemented.');
             },
-            changePassword(email, password, oldPassword) {
+            changePassword(_email, _password, _oldPassword) {
                 throw new Error('Not implemented.');
             },
-            forgotPassword(email) {
+            forgotPassword(_email) {
                 throw new Error('Not implemented.');
             },
-            userConfirmation(user) {
+            userConfirmation(_user) {
                 throw new Error('Not implemented.');
             },
-            resetPassword(user, password) {
+            resetPassword(_user, _password) {
                 throw new Error('Not implemented.');
             },
-            blockUserById(id, reason) {
+            blockUserById(_id, _reason) {
                 throw new Error('Not implemented.');
             },
-            unblockUserById(data) {
+            unblockUserById(_data) {
                 throw new Error('Not implemented.');
             },
-            countQuery(data) {
+            countQuery(_data) {
                 throw new Error('Not implemented.');
             },
-            findQuery(data) {
+            findQuery(_data) {
                 throw new Error('Not implemented.');
             },
-            disableUserById(id) {
+            disableUserById(_id) {
                 throw new Error('Not implemented.');
             },
-            saveMfaSecret(userId, secret) {
+            saveMfaSecret(_userId, _secret) {
                 throw new Error('Not implemented.');
             },
-            retrieveMfaSecret(userId) {
+            retrieveMfaSecret(_userId) {
                 throw new Error('Not implemented.');
             },
-            enableMfa(userId) {
+            enableMfa(_userId) {
                 throw new Error('Not implemented.');
             },
-            disableMfa(userId) {
+            disableMfa(_userId) {
+                throw new Error('Not implemented.');
+            },
+            forceDisableMfaForAdmin(_email) {
                 throw new Error('Not implemented.');
             }
         },
@@ -264,37 +274,37 @@ const start = async (decorators = {}) => {
             isImplemented() {
                 return false;
             },
-            isValidToken(data) {
+            isValidToken(_data) {
                 throw new Error('Not implemented.');
             },
-            createToken(data) {
+            createToken(_data) {
                 throw new Error('Not implemented.');
             },
-            resetExternalId(id) {
+            resetExternalId(_id) {
                 throw new Error('Not implemented.');
             },
-            updateTokenById(id, token) {
+            updateTokenById(_id, _token) {
                 throw new Error('Not implemented.');
             },
-            retrieveTokenById(id) {
+            retrieveTokenById(_id) {
                 throw new Error('Not implemented.');
             },
-            retrieveTokenByExternalId(id) {
+            retrieveTokenByExternalId(_id) {
                 throw new Error('Not implemented.');
             },
-            blockTokenById(id, reason) {
+            blockTokenById(_id, _reason) {
                 throw new Error('Not implemented.');
             },
-            unblockTokenById(id) {
+            unblockTokenById(_id) {
                 throw new Error('Not implemented.');
             },
-            countQuery(data) {
+            countQuery(_data) {
                 throw new Error('Not implemented.');
             },
-            findQuery(data) {
+            findQuery(_data) {
                 throw new Error('Not implemented.');
             },
-            removeTokenById(id) {
+            removeTokenById(_id) {
                 throw new Error('Not implemented.');
             }
         },
@@ -305,18 +315,18 @@ const start = async (decorators = {}) => {
             synchronizeSchemas() {
                 throw new Error('Not implemented.');
             },
-            retrieveBy(entityName, entityId) {
+            retrieveBy(_entityName, _entityId) {
                 throw new Error('Not implemented.');
             },
-            addChange(entityName, entityId, status, userId, contents, changeEntity) {
+            addChange(_entityName, _entityId, _status, _userId, _contents, _changeEntity) {
                 throw new Error('Not implemented.');
             }
         },
         mfaManager: {
-            generateSetup(appName, email) {
+            generateSetup(_appName, _email) {
                 throw new Error('Not implemented.');
             },
-            verify(token, secret) {
+            verify(_token, _secret) {
                 throw new Error('Not implemented.');
             }
         },
@@ -325,6 +335,44 @@ const start = async (decorators = {}) => {
     await Promise.all(Object.keys(decorators || {}).map(async (key) => {
         await server.decorate(key, decorators[key]);
     }));
+    const resetEmail = process.env.MFA_ADMIN_FORCED_RESET_EMAIL;
+    const resetUntil = process.env.MFA_ADMIN_FORCED_RESET_UNTIL;
+    if (resetEmail && resetUntil) {
+        const now = dayjs();
+        const untilDate = dayjs(resetUntil);
+        if (untilDate.isValid()) {
+            const diffMinutes = untilDate.diff(now, 'minute');
+            if (diffMinutes < 0) {
+                if (log.i)
+                    log.info('Startup: MFA Admin Reset window expired. Ignoring.');
+            }
+            else if (diffMinutes > 10) {
+                if (log.f)
+                    log.fatal(`Startup Error: MFA_ADMIN_FORCED_RESET_UNTIL is too far in the future (>10 min). Fix configuration.`);
+                process.exit(1);
+            }
+            else {
+                if (log.w)
+                    log.warn(`Startup: executing FORCE MFA RESET for admin ${resetEmail}`);
+                try {
+                    if (server['userManager'] && server['userManager'].isImplemented()) {
+                        await server['userManager'].forceDisableMfaForAdmin(resetEmail);
+                        if (log.w)
+                            log.warn(`Startup: MFA RESET SUCCESSFUL for ${resetEmail}`);
+                    }
+                    else {
+                        if (log.e)
+                            log.error('Startup: userManager not found or not implemented, cannot reset MFA');
+                    }
+                }
+                catch (e) {
+                    const message = e instanceof Error ? e.message : String(e);
+                    if (log.e)
+                        log.error(`Startup: MFA RESET FAILED: ${message}`);
+                }
+            }
+        }
+    }
     await server
         .listen({
         port: Number(port),
@@ -335,7 +383,8 @@ const start = async (decorators = {}) => {
         log.info(`All stuff loaded in ${elapsed} sec`);
         log.info(`Server ready 🚀 at ${address}`);
         const loadSwagger = yn(process.env.SWAGGER, false);
-        loadSwagger && log.info(`Swagger ready ✨ at ${address}${process.env.SWAGGER_PREFIX_URL || '/api-docs'}`);
+        if (loadSwagger)
+            log.info(`Swagger ready ✨ at ${address}${process.env.SWAGGER_PREFIX_URL || '/api-docs'}`);
     });
     await loaderSchedules.start(server, schedules);
     return server;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,MAAM,CAAC,MAAM,EAAE,CAAA;AAEf,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,MAAM,MAAM,sBAAsB,CAAA;AACzC,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,aAAa,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,WAAW,MAAM,uBAAuB,CAAA;AACpD,OAAO,KAAK,YAAY,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,WAAW,MAAM,uBAAuB,CAAA;AACpD,OAAO,KAAK,aAAa,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,cAAc,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,iBAAiB,MAAM,6BAA6B,CAAA;AAChE,OAAO,KAAK,YAAY,MAAM,yBAAyB,CAAA;AACvD,OAAO,KAAK,eAAe,MAAM,2BAA2B,CAAA;AAE5D,OAAO,OAA4B,MAAM,SAAS,CAAA;AAClD,OAAO,YAAY,MAAM,cAAc,CAAA;AACvC,OAAO,OAAO,MAAM,kBAAkB,CAAA;AACtC,OAAO,SAAS,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,IAAI,MAAM,eAAe,CAAA;AAChC,OAAO,MAAM,MAAM,iBAAiB,CAAA;AACpC,OAAO,QAAQ,MAAM,mBAAmB,CAAA;AACxC,OAAO,SAAS,MAAM,qBAAqB,CAAA;AAC3C,OAAO,SAAS,MAAM,oBAAoB,CAAA;AAC1C,OAAO,OAAO,MAAM,kBAAkB,CAAA;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,aAAa,EAAE,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AAClF,OAAO,EAAE,iBAAiB,EAAa,MAAM,yBAAyB,CAAA;AACtE,OAAO,SAAS,MAAM,2BAA2B,CAAA;AACjD,OAAO,QAAQ,MAAM,2BAA2B,CAAA;AAChD,OAAO,OAAO,MAAM,uBAAuB,CAAA;AAI3C,MAAM,CAAC,GAAG,GAAG,MAAM,CAAA;AAEnB,KAAK,UAAU,YAAY,CAAC,MAAuB;IACjD,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAG,IAAI,YAAY,CAAY;QACzC,QAAQ;QACR,SAAS;QACT,OAAO,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;KAC5C,CAAC,CAAA;IAEF,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IAEpB,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAuB,EAAE,MAAsC;IAC7F,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;QAC/B,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE;YAC3C,OAAO,EAAE,iBAAiB;SAC3B,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAuB;IACtD,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;IAE9B,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAuB;IACtD,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,GAAG,CAAA;IAEtH,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACtC,IAAI,WAAW,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;QAE/B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAA;QAE7D,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,4BAA4B,GAAG,QAAQ,CAAC,CAAA;QAC5D,CAAC;QAED,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE;YAC7B,OAAO,EAAE;gBACP,IAAI,EAAE;oBACJ,KAAK,EAAE,aAAa,IAAI,4BAA4B;oBACpD,WAAW,EAAE,mBAAmB,IAAI,2CAA2C;oBAC/E,OAAO,EAAE,eAAe,IAAI,OAAO;iBACpC;gBACD,IAAI,EAAE,YAAY,IAAI,gBAAgB;gBACtC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;gBAC1B,QAAQ,EAAE,CAAC,kBAAkB,CAAC;gBAC9B,QAAQ,EAAE,CAAC,kBAAkB,CAAC;aAC/B;YACD,OAAO,EAAE;gBACP,IAAI,EAAE;oBACJ,KAAK,EAAE,aAAa,IAAI,4BAA4B;oBACpD,WAAW,EAAE,mBAAmB,IAAI,2CAA2C;oBAC/E,OAAO,EAAE,eAAe,IAAI,OAAO;iBACpC;gBACD,OAAO,EAAE;oBACP;wBACE,GAAG,EAAE,YAAY,IAAI,uBAAuB;qBAC7C;iBACF;gBACD,UAAU,EAAE;oBACV,eAAe,EAAE;wBACf,MAAM,EAAE;4BACN,IAAI,EAAE,MAAM;4BACZ,MAAM,EAAE,QAAQ;yBACjB;qBACF;iBACF;aACF;SACF,CAAC,CAAA;QAEF,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC/B,WAAW,EAAE,kBAAkB,IAAI,WAAW;YAC9C,QAAQ,EAAE;gBACR,YAAY,EAAE,MAAM;gBACpB,WAAW,EAAE,IAAI;gBACjB,wBAAwB,EAAE,CAAC;aAC5B;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;aACxC;YACD,KAAK,EAAE;gBACL,KAAK,EAAE,aAAa;aACrB;SACK,CAAC,CAAA;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAuB;IACvD,MAAM,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAA;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAA;QAEjC,MAAM,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;IACxC,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,KAAK,EAAE,UAAU,GAAG,EAAE,EAAE,EAAE;IACtC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAElB,MAAM,CAAC,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAA;IACzC,MAAM,CAAC,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACvC,MAAM,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAA;IAEnC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAA;IAChE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,MAAM,CAAC,cAAc,GAAG,cAAc,CAAA;IAEtC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACxG,MAAM,MAAM,GAAoB,OAAO,EAAE,CAAA;IACzC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;IAEtB,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAA;IAC5E,MAAM,EACJ,UAAU,GAAG,EAAE,EACf,cAAc,GAAG,KAAK,EACtB,WAAW,GAAG,MAAM,EACpB,kBAAkB,GAAG,EAAE,EACvB,sBAAsB,GAAG,MAAM,EAChC,GAAG,OAAO,CAAC,GAAG,CAAA;IAEf,MAAM,cAAc,GAAG,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAA;IAE1C,OAAO,EAAE,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3E,CAAC,UAAU,IAAI,OAAO,EAAE,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAA;IAEvF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,kBAAkB,CACvB;YACE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;gBAC3B,GAAG,EAAE,EAAE;gBACP,UAAU,EAAE,KAAK;aAClB,CAAC;SACH,EACD,UAAU,GAAG,EAAE,KAAK;YAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QACxB,CAAC,CACF,CAAA;IACH,CAAC;IAED,OAAO,EAAE,SAAS,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAA;IACjF,OAAO,EAAE,IAAI,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;IAClE,OAAO,EAAE,QAAQ,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;IAE9E,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,wBAAwB,cAAc,EAAE,CAAC,CAAA;IAC5D,MAAM,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE;QAClC,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE;KACpC,CAAC,CAAA;IAEF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE;YAClC,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,kBAAkB,IAAI,UAAU;YACxC,IAAI,EAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE;SAC5C,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7D,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEhC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,EAAE,CAAA;IAExC,UAAU,GAAG;QACX,WAAW,EAAE;YACX,aAAa;gBACX,OAAO,KAAK,CAAA;YACd,CAAC;YACD,WAAW,CAAC,IAAS;gBACnB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,UAAU,CAAC,IAAS;gBAClB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,UAAU,CAAC,IAAS;gBAClB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,eAAe,CAAC,IAAS;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,IAAS;gBAClC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,gBAAgB,CAAC,EAAU;gBACzB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,mBAAmB,CAAC,KAAa;gBAC/B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,+BAA+B,CAAC,IAAY;gBAC1C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,gCAAgC,CAAC,IAAY;gBAC3C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,sBAAsB,CAAC,QAAgB;gBACrC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,wBAAwB,CAAC,UAAkB;gBACzC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,sBAAsB,CAAC,KAAa,EAAE,QAAgB;gBACpD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,cAAc,CAAC,KAAa,EAAE,QAAgB,EAAE,WAAmB;gBACjE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,cAAc,CAAC,KAAa;gBAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,gBAAgB,CAAC,IAAS;gBACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,aAAa,CAAC,IAAS,EAAE,QAAgB;gBACvC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,aAAa,CAAC,EAAU,EAAE,MAAc;gBACtC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,eAAe,CAAC,IAAS;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,UAAU,CAAC,IAAS;gBAClB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,SAAS,CAAC,IAAS;gBACjB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,eAAe,CAAC,EAAU;gBACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,aAAa,CAAC,MAAc,EAAE,MAAc;gBAC1C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,iBAAiB,CAAC,MAAc;gBAC9B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,SAAS,CAAC,MAAc;gBACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,UAAU,CAAC,MAAc;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;SACgB;QACnB,YAAY,EAAE;YACZ,aAAa;gBACX,OAAO,KAAK,CAAA;YACd,CAAC;YACD,YAAY,CAAC,IAAS;gBACpB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,WAAW,CAAC,IAAS;gBACnB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,eAAe,CAAC,EAAU;gBACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,eAAe,CAAC,EAAU,EAAE,KAAU;gBACpC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,iBAAiB,CAAC,EAAU;gBAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,yBAAyB,CAAC,EAAU;gBAClC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,MAAc;gBACvC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,gBAAgB,CAAC,EAAU;gBACzB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,UAAU,CAAC,IAAS;gBAClB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,SAAS,CAAC,IAAS;gBACjB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,eAAe,CAAC,EAAU;gBACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;SACiB;QACpB,eAAe,EAAE;YACf,aAAa;gBACX,OAAO,KAAK,CAAA;YACd,CAAC;YACD,kBAAkB;gBAChB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,UAAU,CAAC,UAAU,EAAE,QAAQ;gBAC7B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY;gBACpE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;SACoB;QACvB,UAAU,EAAE;YACV,aAAa,CAAC,OAAe,EAAE,KAAa;gBAC1C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,MAAM,CAAC,KAAa,EAAE,MAAc;gBAClC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;SACe;QAClB,GAAG,UAAU;KACd,CAAA;IAED,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CACH,CAAA;IAED,MAAM,MAAM;SACT,MAAM,CAAC;QACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;QAClB,IAAI,EAAE,IAAI;KACX,CAAC;SACD,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChB,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAA;QACpD,GAAG,CAAC,IAAI,CAAC,uBAAuB,OAAO,MAAM,CAAC,CAAA;QAC9C,GAAG,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA;QAEzC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAClD,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,sBAAsB,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,WAAW,EAAE,CAAC,CAAA;IAC1G,CAAC,CAAC,CAAA;IAEJ,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC9C,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAqBD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,MAAM,CAAC,MAAM,EAAE,CAAA;AAEf,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,MAAM,MAAM,sBAAsB,CAAA;AACzC,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,aAAa,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,WAAW,MAAM,uBAAuB,CAAA;AACpD,OAAO,KAAK,YAAY,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,WAAW,MAAM,uBAAuB,CAAA;AACpD,OAAO,KAAK,aAAa,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,cAAc,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,iBAAiB,MAAM,6BAA6B,CAAA;AAChE,OAAO,KAAK,YAAY,MAAM,yBAAyB,CAAA;AACvD,OAAO,KAAK,eAAe,MAAM,2BAA2B,CAAA;AAE5D,OAAO,OAA4B,MAAM,SAAS,CAAA;AAClD,OAAO,YAAY,MAAM,cAAc,CAAA;AACvC,OAAO,OAAO,MAAM,kBAAkB,CAAA;AACtC,OAAO,SAAS,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,IAAI,MAAM,eAAe,CAAA;AAChC,OAAO,MAAM,MAAM,iBAAiB,CAAA;AACpC,OAAO,QAAQ,MAAM,mBAAmB,CAAA;AACxC,OAAO,SAAS,MAAM,qBAAqB,CAAA;AAC3C,OAAO,SAAS,MAAM,oBAAoB,CAAA;AAC1C,OAAO,OAAO,MAAM,kBAAkB,CAAA;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,aAAa,EAAE,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AAClF,OAAO,EAAE,iBAAiB,EAAa,MAAM,yBAAyB,CAAA;AACtE,OAAO,SAAS,MAAM,2BAA2B,CAAA;AACjD,OAAO,QAAQ,MAAM,2BAA2B,CAAA;AAChD,OAAO,OAAO,MAAM,uBAAuB,CAAA;AAI3C,MAAM,CAAC,GAAG,GAAG,MAAM,CAAA;AAEnB,KAAK,UAAU,YAAY,CAAC,MAAuB;IACjD,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAG,IAAI,YAAY,CAAY;QACzC,QAAQ;QACR,SAAS;QACT,OAAO,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;KAC5C,CAAC,CAAA;IAEF,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IAEpB,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAuB,EAAE,MAAsC;IAC7F,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;QAC/B,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE;YAC3C,OAAO,EAAE,iBAAiB;SAC3B,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAuB;IACtD,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;IAE9B,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAuB;IACtD,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,GAAG,CAAA;IAEtH,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACtC,IAAI,WAAW,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;QAE/B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAA;QAE7D,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7D,CAAC;QAAC,OAAO,EAAE,EAAE,CAAC;YACZ,IAAI,GAAG,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,4BAA4B,GAAG,QAAQ,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE;YAC7B,OAAO,EAAE;gBACP,IAAI,EAAE;oBACJ,KAAK,EAAE,aAAa,IAAI,4BAA4B;oBACpD,WAAW,EAAE,mBAAmB,IAAI,2CAA2C;oBAC/E,OAAO,EAAE,eAAe,IAAI,OAAO;iBACpC;gBACD,IAAI,EAAE,YAAY,IAAI,gBAAgB;gBACtC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;gBAC1B,QAAQ,EAAE,CAAC,kBAAkB,CAAC;gBAC9B,QAAQ,EAAE,CAAC,kBAAkB,CAAC;aAC/B;YACD,OAAO,EAAE;gBACP,IAAI,EAAE;oBACJ,KAAK,EAAE,aAAa,IAAI,4BAA4B;oBACpD,WAAW,EAAE,mBAAmB,IAAI,2CAA2C;oBAC/E,OAAO,EAAE,eAAe,IAAI,OAAO;iBACpC;gBACD,OAAO,EAAE;oBACP;wBACE,GAAG,EAAE,YAAY,IAAI,uBAAuB;qBAC7C;iBACF;gBACD,UAAU,EAAE;oBACV,eAAe,EAAE;wBACf,MAAM,EAAE;4BACN,IAAI,EAAE,MAAM;4BACZ,MAAM,EAAE,QAAQ;yBACjB;qBACF;iBACF;aACF;SACF,CAAC,CAAA;QAEF,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC/B,WAAW,EAAE,kBAAkB,IAAI,WAAW;YAC9C,QAAQ,EAAE;gBACR,YAAY,EAAE,MAAM;gBACpB,WAAW,EAAE,IAAI;gBACjB,wBAAwB,EAAE,CAAC;aAC5B;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;aACxC;YACD,KAAK,EAAE;gBACL,KAAK,EAAE,aAAa;aACrB;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAuB;IACvD,MAAM,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAA;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAA;QAEjC,MAAM,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;IACxC,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,KAAK,EAAE,UAAU,GAAG,EAAE,EAAE,EAAE;IACtC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAElB,MAAM,CAAC,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAA;IACzC,MAAM,CAAC,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACvC,MAAM,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAA;IAEnC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAA;IAChE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,MAAM,CAAC,cAAc,GAAG,cAAc,CAAA;IAGtC,MAAM,MAAM,GAAoB,OAAO,EAAE,CAAA;IACzC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;IAEtB,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAA;IAC5E,MAAM,EACJ,UAAU,GAAG,EAAE,EACf,cAAc,GAAG,KAAK,EACtB,WAAW,GAAG,MAAM,EACpB,kBAAkB,GAAG,EAAE,EACvB,sBAAsB,GAAG,MAAM,EAChC,GAAG,OAAO,CAAC,GAAG,CAAA;IAEf,MAAM,cAAc,GAAG,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAA;IAE1C,IAAI,OAAO,EAAE,OAAO;QAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;IAC3E,IAAI,CAAC,UAAU,IAAI,OAAO,EAAE,MAAM;QAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAEvF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,kBAAkB,CACvB;YACE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;gBAC3B,GAAG,EAAE,EAAE;gBACP,UAAU,EAAE,KAAK;aAClB,CAAC;SACH,EACD,UAAU,IAAI,EAAE,KAAK;YACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QACxB,CAAC,CACF,CAAA;IACH,CAAC;IAED,IAAI,OAAO,EAAE,SAAS;QAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IACjF,IAAI,OAAO,EAAE,IAAI;QAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAClE,IAAI,OAAO,EAAE,QAAQ;QAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IAE9E,IAAI,GAAG,CAAC,CAAC;QAAE,GAAG,CAAC,KAAK,CAAC,wBAAwB,cAAc,EAAE,CAAC,CAAA;IAC9D,MAAM,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE;QAClC,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE;KACpC,CAAC,CAAA;IAEF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE;YAClC,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,kBAAkB,IAAI,UAAU;YACxC,IAAI,EAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE;SAC5C,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7D,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEhC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,EAAE,CAAA;IAExC,UAAU,GAAG;QACX,WAAW,EAAE;YACX,aAAa;gBACX,OAAO,KAAK,CAAA;YACd,CAAC;YACD,WAAW,CAAC,KAAc;gBACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,UAAU,CAAC,KAAc;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,UAAU,CAAC,KAAc;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,eAAe,CAAC,KAAc;gBAC5B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,cAAc,CAAC,GAAW,EAAE,KAAc;gBACxC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,gBAAgB,CAAC,GAAW;gBAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,mBAAmB,CAAC,MAAc;gBAChC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,+BAA+B,CAAC,KAAa;gBAC3C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,gCAAgC,CAAC,KAAa;gBAC5C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,sBAAsB,CAAC,SAAiB;gBACtC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,wBAAwB,CAAC,WAAmB;gBAC1C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,sBAAsB,CAAC,MAAc,EAAE,SAAiB;gBACtD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,cAAc,CAAC,MAAc,EAAE,SAAiB,EAAE,YAAoB;gBACpE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,cAAc,CAAC,MAAc;gBAC3B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,gBAAgB,CAAC,KAAc;gBAC7B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,aAAa,CAAC,KAAc,EAAE,SAAiB;gBAC7C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,aAAa,CAAC,GAAW,EAAE,OAAe;gBACxC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,eAAe,CAAC,KAAc;gBAC5B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,UAAU,CAAC,KAAc;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,SAAS,CAAC,KAAc;gBACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,eAAe,CAAC,GAAW;gBACzB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,aAAa,CAAC,OAAe,EAAE,OAAe;gBAC5C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,iBAAiB,CAAC,OAAe;gBAC/B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,SAAS,CAAC,OAAe;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,UAAU,CAAC,OAAe;gBACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,uBAAuB,CAAC,MAAc;gBACpC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;SACgB;QACnB,YAAY,EAAE;YACZ,aAAa;gBACX,OAAO,KAAK,CAAA;YACd,CAAC;YACD,YAAY,CAAC,KAAc;gBACzB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,WAAW,CAAC,KAAc;gBACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,eAAe,CAAC,GAAW;gBACzB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,eAAe,CAAC,GAAW,EAAE,MAAe;gBAC1C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,iBAAiB,CAAC,GAAW;gBAC3B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,yBAAyB,CAAC,GAAW;gBACnC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,cAAc,CAAC,GAAW,EAAE,OAAe;gBACzC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,gBAAgB,CAAC,GAAW;gBAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,UAAU,CAAC,KAAc;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,SAAS,CAAC,KAAc;gBACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,eAAe,CAAC,GAAW;gBACzB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;SACiB;QACpB,eAAe,EAAE;YACf,aAAa;gBACX,OAAO,KAAK,CAAA;YACd,CAAC;YACD,kBAAkB;gBAChB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,UAAU,CAAC,WAAW,EAAE,SAAS;gBAC/B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa;gBAC1E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;SACoB;QACvB,UAAU,EAAE;YACV,aAAa,CAAC,QAAgB,EAAE,MAAc;gBAC5C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;YACD,MAAM,CAAC,MAAc,EAAE,OAAe;gBACpC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrC,CAAC;SACe;QAClB,GAAG,UAAU;KACd,CAAA;IAED,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CACH,CAAA;IAID,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAA;IAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAA;IAE3D,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,EAAE,CAAA;QACnB,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,CAAA;QAEnC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAEjD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,IAAI,GAAG,CAAC,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAA;YAC3E,CAAC;iBAAM,IAAI,WAAW,GAAG,EAAE,EAAE,CAAC;gBAC5B,IAAI,GAAG,CAAC,CAAC;oBACP,GAAG,CAAC,KAAK,CACP,oGAAoG,CACrG,CAAA;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,CAAC,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,gDAAgD,UAAU,EAAE,CAAC,CAAA;gBACjF,IAAI,CAAC;oBAEH,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC;wBACnE,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;wBAC/D,IAAI,GAAG,CAAC,CAAC;4BAAE,GAAG,CAAC,IAAI,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAA;oBACxE,CAAC;yBAAM,CAAC;wBACN,IAAI,GAAG,CAAC,CAAC;4BAAE,GAAG,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAA;oBAC7F,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;oBAC1D,IAAI,GAAG,CAAC,CAAC;wBAAE,GAAG,CAAC,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAA;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAGD,MAAM,MAAM;SACT,MAAM,CAAC;QACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;QAClB,IAAI,EAAE,IAAI;KACX,CAAC;SACD,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChB,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAA;QACpD,GAAG,CAAC,IAAI,CAAC,uBAAuB,OAAO,MAAM,CAAC,CAAA;QAC9C,GAAG,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA;QAEzC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAClD,IAAI,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,sBAAsB,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,WAAW,EAAE,CAAC,CAAA;IAC5G,CAAC,CAAC,CAAA;IAEJ,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC9C,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAqBD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA"}

package/dist/lib/api/auth/controller/auth.d.ts

@@ -35,6 +35,16 @@ export declare function unblock(req: FastifyRequest, reply: FastifyReply): Promi
 export declare function mfaSetup(req: FastifyRequest, reply: FastifyReply): Promise<any>;
 export declare function mfaEnable(req: FastifyRequest, reply: FastifyReply): Promise<{
     ok: boolean;
+    token: string;
+    refreshToken: any;
+    user: {
+        mfaEnabled: boolean;
+        roles: (string | import("../../../../types/global.js").Role)[];
+        getId(): any;
+        username: string;
+        email: string;
+        externalId: string;
+    };
 }>;
 export declare function mfaVerify(req: FastifyRequest, reply: FastifyReply): Promise<any>;
 export declare function mfaDisable(req: FastifyRequest, reply: FastifyReply): Promise<{

package/dist/lib/api/auth/controller/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../lib/api/auth/controller/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAGtD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,gBA4CtE;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAsBxE;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAa9E;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GA6B5E;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAgC5E;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAsB1E;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;;GA6B3E;AAED,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,gBAgEnE;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GA8B1E;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAS9E;AAED,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAenE;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAcrE;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,gBAatE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAqBvE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,gBA8CvE;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAWxE;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAkBtE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../lib/api/auth/controller/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAItD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,gBA6CtE;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAsBxE;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAa9E;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GA6B5E;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAgC5E;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAsB1E;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;;GA6B3E;AAED,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,gBAsEnE;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GA8B1E;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAS9E;AAED,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAenE;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAcrE;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,gBAatE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;;;;;;;;;;;GAuCvE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,gBA8CvE;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAgBxE;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY;;GAkBtE"}

package/dist/lib/api/auth/controller/auth.js

@@ -1,4 +1,5 @@
 import * as regExp from '../../../util/regexp.js';
+import { MfaPolicy } from '../../../../types/global.js';
 export async function register(req, reply) {
     const { password1: password, password2, ...data } = req.data();
     if (!req.server['userManager'].isImplemented()) {
@@ -156,6 +157,7 @@ export async function resetPassword(req, reply) {
 }
 export async function login(req, reply) {
     const { email, password } = req.data();
+    const { mfa_policy = MfaPolicy.OPTIONAL } = global.config.options || {};
     if (!req.server['userManager'].isImplemented()) {
         throw new Error('Not implemented');
     }
@@ -183,10 +185,13 @@ export async function login(req, reply) {
     if (user.blocked) {
         return reply.status(403).send(new Error('User blocked'));
     }
-    if (user.mfaEnabled) {
+    const isMfaEnabled = user.mfaEnabled;
+    const isMandatory = mfa_policy === MfaPolicy.MANDATORY;
+    if (isMfaEnabled || isMandatory) {
         const tempToken = await reply.jwtSign({ sub: user.externalId, role: 'pre-auth-mfa' }, { expiresIn: '5m' });
         return reply.status(202).send({
-            mfaRequired: true,
+            mfaRequired: isMfaEnabled,
+            mfaSetupRequired: isMandatory && !isMfaEnabled,
             tempToken: tempToken
         });
     }
@@ -289,7 +294,20 @@ export async function mfaEnable(req, reply) {
         }
         await req.server['userManager'].saveMfaSecret(user.getId(), secret);
         await req.server['userManager'].enableMfa(user.getId());
-        return { ok: true };
+        const finalToken = await reply.jwtSign({ sub: user.externalId });
+        const refreshToken = reply.server.jwt['refreshToken']
+            ? await reply.server.jwt['refreshToken'].sign({ sub: user.externalId })
+            : undefined;
+        return {
+            ok: true,
+            token: finalToken,
+            refreshToken: refreshToken,
+            user: {
+                ...user,
+                mfaEnabled: true,
+                roles: (user.roles || [global.role?.public?.code || 'public']).map((r) => r?.code || r)
+            }
+        };
     }
     catch (error) {
         req.log.error({ err: error }, 'MFA Enable failed');
@@ -305,7 +323,7 @@ export async function mfaVerify(req, reply) {
     try {
         decoded = req.server.jwt.verify(tokenStr);
     }
-    catch (e) {
+    catch (_e) {
         return reply.status(401).send(new Error('Invalid token'));
     }
     if (decoded.role !== 'pre-auth-mfa' && (!req.user || !req.user.getId())) {
@@ -342,6 +360,10 @@ export async function mfaDisable(req, reply) {
     const user = req.user;
     if (!user)
         return reply.status(401).send(new Error('Unauthorized'));
+    const { mfa_policy = MfaPolicy.OPTIONAL } = global.config.options || {};
+    if (mfa_policy === MfaPolicy.MANDATORY || mfa_policy === MfaPolicy.ONE_WAY) {
+        return reply.status(403).send(new Error('MFA disable is not allowed by security policy'));
+    }
     try {
         await req.server['userManager'].disableMfa(user.getId());
         return { ok: true };