@vorionsys/platform-core 0.1.0

package/dist/security/api-keys/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/security/api-keys/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;GAEG;AACH,eAAO,MAAM,WAAW;IACtB,oCAAoC;;IAEpC,4CAA4C;;IAE5C,gCAAgC;;IAEhC,yBAAyB;;IAEzB,4CAA4C;;CAEpC,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAEzE,eAAO,MAAM,iBAAiB;IAd5B,oCAAoC;;IAEpC,4CAA4C;;IAE5C,gCAAgC;;IAEhC,yBAAyB;;IAEzB,4CAA4C;;EAMY,CAAC;AAE3D,eAAO,MAAM,cAAc,4DAA6B,CAAC;AAMzD;;GAEG;AACH,eAAO,MAAM,YAAY;IACvB,oCAAoC;;IAEpC,wCAAwC;;IAExC,sBAAsB;;CAEd,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE5E,eAAO,MAAM,kBAAkB;IAV7B,oCAAoC;;IAEpC,wCAAwC;;IAExC,sBAAsB;;EAMoC,CAAC;AAM7D;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gCAAgC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;;;;EAIhC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAIxC,CAAC;AAMF;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,+BAA+B;IAC/B,SAAS,EAAE,eAAe,CAAC;IAC3B,iBAAiB;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,kDAAkD;IAClD,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,yBAAyB;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,2BAA2B;IAC3B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,eAAO,MAAM,YAAY;;;;;;;QA7GvB,oCAAoC;;QAEpC,4CAA4C;;QAE5C,gCAAgC;;QAEhC,yBAAyB;;QAEzB,4CAA4C;;;;;;;;;;;;;;;;;QAkB5C,oCAAoC;;QAEpC,wCAAwC;;QAExC,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+FtB,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,mCAAmC;IACnC,SAAS,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrC,qDAAqD;IACrD,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,eAAO,MAAM,uBAAuB;;;;QA3JlC,oCAAoC;;QAEpC,4CAA4C;;QAE5C,gCAAgC;;QAEhC,yBAAyB;;QAEzB,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6J5C,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB,gCAAgC;IAChC,SAAS,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrC,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB;IACvB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB;IACjB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,eAAO,MAAM,uBAAuB;;;QA/LlC,oCAAoC;;QAEpC,4CAA4C;;QAE5C,gCAAgC;;QAEhC,yBAAyB;;QAEzB,4CAA4C;;;;;;;;;;;;;;;;;;;;QAkB5C,oCAAoC;;QAEpC,wCAAwC;;QAExC,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyKtB,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,+BAA+B;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,CAAC,EAAE,yBAAyB,CAAC;CACvC;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB;IACpC,oBAAoB;;IAEpB,2BAA2B;;IAE3B,sBAAsB;;IAEtB,yBAAyB;;IAEzB,wBAAwB;;IAExB,0BAA0B;;IAE1B,yBAAyB;;IAEzB,0BAA0B;;CAElB,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E,eAAO,MAAM,4BAA4B;;;;;;;;;YApPvC,oCAAoC;;YAEpC,4CAA4C;;YAE5C,gCAAgC;;YAEhC,yBAAyB;;YAEzB,4CAA4C;;;;;;;;;;;;;;;;;YAkB5C,oCAAoC;;YAEpC,wCAAwC;;YAExC,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiMtB,oBAAoB;;QAEpB,2BAA2B;;QAE3B,sBAAsB;;QAEtB,yBAAyB;;QAEzB,wBAAwB;;QAExB,0BAA0B;;QAE1B,yBAAyB;;QAEzB,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAY1B,CAAC;AAMH;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa;IACb,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,0BAA0B;IAC1B,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,oCAAoC;IACpC,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,yBAAyB;IACzB,SAAS,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,uBAAuB;IACvB,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,uBAAuB;;;QAvTlC,oCAAoC;;QAEpC,wCAAwC;;QAExC,sBAAsB;;;;QA9BtB,oCAAoC;;QAEpC,4CAA4C;;QAE5C,gCAAgC;;QAEhC,yBAAyB;;QAEzB,4CAA4C;;;;;;;;;;;;;;;;;;;;EAgV5C,CAAC;AAMH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;CASvB,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAC9B,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAC;AAMnE;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,cAAc,EAAE,qBAAqB,CAAC;IACtC,2BAA2B;IAC3B,WAAW,EAAE,IAAI,CAAC;CACnB;AAMD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QAAQ,CAAC;AACpC,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;GAEG;AACH,eAAO,MAAM,eAAe,QAA2C,CAAC"}

package/dist/security/api-keys/types.js

@@ -0,0 +1,162 @@
+/**
+ * API Key Management Type Definitions
+ *
+ * Defines types, interfaces, and Zod schemas for API key management
+ * including creation, validation, scopes, and rate limiting.
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+// =============================================================================
+// API KEY SCOPES
+// =============================================================================
+/**
+ * API key scopes defining access levels
+ */
+export const ApiKeyScope = {
+    /** Read-only access to resources */
+    READ: 'read',
+    /** Write access (create, update, delete) */
+    WRITE: 'write',
+    /** Administrative operations */
+    ADMIN: 'admin',
+    /** Webhook management */
+    WEBHOOK: 'webhook',
+    /** Integration access (external systems) */
+    INTEGRATION: 'integration',
+};
+export const apiKeyScopeSchema = z.nativeEnum(ApiKeyScope);
+export const API_KEY_SCOPES = Object.values(ApiKeyScope);
+// =============================================================================
+// API KEY STATUS
+// =============================================================================
+/**
+ * API key status
+ */
+export const ApiKeyStatus = {
+    /** Key is active and can be used */
+    ACTIVE: 'active',
+    /** Key is revoked and cannot be used */
+    REVOKED: 'revoked',
+    /** Key has expired */
+    EXPIRED: 'expired',
+};
+export const apiKeyStatusSchema = z.nativeEnum(ApiKeyStatus);
+export const apiKeyRateLimitSchema = z.object({
+    requestsPerMinute: z.number().int().positive().default(60),
+    requestsPerHour: z.number().int().positive().default(1000),
+    burstLimit: z.number().int().positive().default(10),
+});
+/**
+ * Default rate limits for API keys
+ */
+export const DEFAULT_API_KEY_RATE_LIMIT = {
+    requestsPerMinute: 60,
+    requestsPerHour: 1000,
+    burstLimit: 10,
+};
+export const apiKeySchema = z.object({
+    id: z.string().uuid(),
+    name: z.string().min(1).max(255),
+    hashedKey: z.string().min(1),
+    prefix: z.string().length(8),
+    tenantId: z.string().min(1),
+    scopes: z.array(apiKeyScopeSchema).min(1),
+    rateLimit: apiKeyRateLimitSchema,
+    status: apiKeyStatusSchema,
+    expiresAt: z.date().nullable(),
+    createdAt: z.date(),
+    lastUsedAt: z.date().nullable(),
+    metadata: z.record(z.unknown()),
+    createdBy: z.string().min(1),
+    description: z.string().max(1000).optional(),
+    allowedIps: z.array(z.string().ip()).optional(),
+});
+export const createApiKeyInputSchema = z.object({
+    name: z.string().min(1).max(255),
+    tenantId: z.string().min(1),
+    scopes: z.array(apiKeyScopeSchema).min(1),
+    rateLimit: apiKeyRateLimitSchema.partial().optional(),
+    expiresInDays: z.number().int().positive().nullable().optional(),
+    metadata: z.record(z.unknown()).optional(),
+    createdBy: z.string().min(1),
+    description: z.string().max(1000).optional(),
+    allowedIps: z.array(z.string().ip()).optional(),
+});
+export const updateApiKeyInputSchema = z.object({
+    name: z.string().min(1).max(255).optional(),
+    scopes: z.array(apiKeyScopeSchema).min(1).optional(),
+    rateLimit: apiKeyRateLimitSchema.partial().optional(),
+    metadata: z.record(z.unknown()).optional(),
+    description: z.string().max(1000).optional(),
+    allowedIps: z.array(z.string().ip()).optional(),
+    status: apiKeyStatusSchema.optional(),
+});
+/**
+ * Validation error codes
+ */
+export const ApiKeyValidationErrorCode = {
+    /** Key not found */
+    NOT_FOUND: 'NOT_FOUND',
+    /** Key has been revoked */
+    REVOKED: 'REVOKED',
+    /** Key has expired */
+    EXPIRED: 'EXPIRED',
+    /** Invalid key format */
+    INVALID_FORMAT: 'INVALID_FORMAT',
+    /** Key hash mismatch */
+    HASH_MISMATCH: 'HASH_MISMATCH',
+    /** IP not in whitelist */
+    IP_NOT_ALLOWED: 'IP_NOT_ALLOWED',
+    /** Insufficient scope */
+    INSUFFICIENT_SCOPE: 'INSUFFICIENT_SCOPE',
+    /** Rate limit exceeded */
+    RATE_LIMITED: 'RATE_LIMITED',
+};
+export const apiKeyValidationResultSchema = z.object({
+    valid: z.boolean(),
+    apiKey: apiKeySchema.optional(),
+    error: z.string().optional(),
+    errorCode: z.nativeEnum(ApiKeyValidationErrorCode).optional(),
+});
+export const apiKeyListFiltersSchema = z.object({
+    tenantId: z.string().min(1),
+    status: apiKeyStatusSchema.optional(),
+    scope: apiKeyScopeSchema.optional(),
+    createdBy: z.string().optional(),
+    limit: z.number().int().min(1).max(100).default(50),
+    offset: z.number().int().min(0).default(0),
+});
+// =============================================================================
+// API KEY AUDIT EVENT TYPES
+// =============================================================================
+/**
+ * Audit event types for API key operations
+ */
+export const ApiKeyAuditEventType = {
+    CREATED: 'api_key.created',
+    UPDATED: 'api_key.updated',
+    REVOKED: 'api_key.revoked',
+    DELETED: 'api_key.deleted',
+    VALIDATED: 'api_key.validated',
+    VALIDATION_FAILED: 'api_key.validation_failed',
+    RATE_LIMITED: 'api_key.rate_limited',
+    ROTATED: 'api_key.rotated',
+};
+// =============================================================================
+// KEY FORMAT
+// =============================================================================
+/**
+ * API key format: vak_${prefix}_${secret}
+ * - vak: Vorion API Key prefix
+ * - prefix: 8 character identifier for lookup
+ * - secret: 43 character base64url encoded random bytes
+ */
+export const API_KEY_PREFIX = 'vak';
+export const API_KEY_PREFIX_LENGTH = 8;
+export const API_KEY_SECRET_LENGTH = 43; // 32 bytes = 43 chars in base64url
+/**
+ * Regex pattern for validating API key format
+ */
+export const API_KEY_PATTERN = /^vak_[a-zA-Z0-9]{8}_[a-zA-Z0-9_-]{43}$/;
+//# sourceMappingURL=types.js.map

package/dist/security/api-keys/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/security/api-keys/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oCAAoC;IACpC,IAAI,EAAE,MAAM;IACZ,4CAA4C;IAC5C,KAAK,EAAE,OAAO;IACd,gCAAgC;IAChC,KAAK,EAAE,OAAO;IACd,yBAAyB;IACzB,OAAO,EAAE,SAAS;IAClB,4CAA4C;IAC5C,WAAW,EAAE,aAAa;CAClB,CAAC;AAIX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAEzD,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,oCAAoC;IACpC,MAAM,EAAE,QAAQ;IAChB,wCAAwC;IACxC,OAAO,EAAE,SAAS;IAClB,sBAAsB;IACtB,OAAO,EAAE,SAAS;CACV,CAAC;AAIX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAkB7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACpD,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAoB;IACzD,iBAAiB,EAAE,EAAE;IACrB,eAAe,EAAE,IAAI;IACrB,UAAU,EAAE,EAAE;CACf,CAAC;AA0CF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,SAAS,EAAE,qBAAqB;IAChC,MAAM,EAAE,kBAAkB;IAC1B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AA8BH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AA0BH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAoBH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,oBAAoB;IACpB,SAAS,EAAE,WAAW;IACtB,2BAA2B;IAC3B,OAAO,EAAE,SAAS;IAClB,sBAAsB;IACtB,OAAO,EAAE,SAAS;IAClB,yBAAyB;IACzB,cAAc,EAAE,gBAAgB;IAChC,wBAAwB;IACxB,aAAa,EAAE,eAAe;IAC9B,0BAA0B;IAC1B,cAAc,EAAE,gBAAgB;IAChC,yBAAyB;IACzB,kBAAkB,EAAE,oBAAoB;IACxC,0BAA0B;IAC1B,YAAY,EAAE,cAAc;CACpB,CAAC;AAKX,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC,CAAC;AAwFH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACrC,KAAK,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC3C,CAAC,CAAC;AAEH,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,iBAAiB;IAC1B,SAAS,EAAE,mBAAmB;IAC9B,iBAAiB,EAAE,2BAA2B;IAC9C,YAAY,EAAE,sBAAsB;IACpC,OAAO,EAAE,iBAAiB;CAClB,CAAC;AAqBX,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC,CAAC,mCAAmC;AAE5E;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,wCAAwC,CAAC"}

package/dist/security/brute-force.d.ts

@@ -0,0 +1,390 @@
+/**
+ * Brute Force Protection System
+ *
+ * Provides comprehensive protection against brute force login attacks.
+ * Features include:
+ * - Redis-backed distributed attempt tracking
+ * - Progressive lockout with configurable escalation
+ * - IP-based rate limiting
+ * - CAPTCHA triggering after threshold attempts
+ * - Automatic cleanup of stale records
+ * - Admin unlock capabilities with audit logging
+ *
+ * @packageDocumentation
+ * @module security/brute-force
+ */
+import type { FastifyRequest, preHandlerHookHandler } from 'fastify';
+import type { Redis } from 'ioredis';
+/**
+ * Configuration options for brute force protection
+ */
+export interface BruteForceConfig {
+    /**
+     * Maximum number of failed login attempts before lockout
+     * @default 5
+     */
+    maxAttempts: number;
+    /**
+     * Time window in minutes to track failed attempts
+     * @default 15
+     */
+    windowMinutes: number;
+    /**
+     * Base lockout duration in minutes
+     * @default 30
+     */
+    lockoutMinutes: number;
+    /**
+     * Whether to double lockout duration for each subsequent lockout
+     * @default true
+     */
+    progressiveLockout: boolean;
+    /**
+     * Maximum lockout duration in minutes (24 hours)
+     * @default 1440
+     */
+    maxLockoutMinutes: number;
+    /**
+     * Whether to emit notification events on lockout
+     * @default true
+     */
+    notifyOnLockout: boolean;
+    /**
+     * Number of failed attempts after which CAPTCHA is required
+     * @default 3
+     */
+    captchaAfterAttempts: number;
+    /**
+     * Whether to enable IP-based rate limiting
+     * @default true
+     */
+    ipRateLimiting: boolean;
+    /**
+     * Maximum attempts per IP address per hour
+     * @default 100
+     */
+    ipMaxAttempts: number;
+    /**
+     * Whether to track attempts by username
+     * @default true
+     */
+    trackByUsername: boolean;
+    /**
+     * Whether to track attempts by IP address
+     * @default true
+     */
+    trackByIP: boolean;
+}
+/**
+ * Represents a single login attempt
+ */
+export interface LoginAttempt {
+    /** User ID if known (for authenticated attempts) */
+    userId?: string;
+    /** Username used in the login attempt */
+    username?: string;
+    /** IP address of the client */
+    ipAddress: string;
+    /** User agent string from the request */
+    userAgent: string;
+    /** Timestamp of the attempt */
+    timestamp: Date;
+    /** Whether the login was successful */
+    success: boolean;
+    /** Reason for failure if unsuccessful */
+    failureReason?: string;
+}
+/**
+ * Current lockout status for an identifier
+ */
+export interface LockoutStatus {
+    /** Whether the account/IP is currently locked out */
+    locked: boolean;
+    /** Number of remaining attempts before lockout */
+    remainingAttempts: number;
+    /** When the lockout will end (if locked) */
+    lockoutEndsAt?: Date;
+    /** Total number of times this identifier has been locked out */
+    lockoutCount: number;
+    /** Whether CAPTCHA verification is required */
+    requiresCaptcha: boolean;
+}
+/**
+ * Lockout notification event
+ */
+export interface LockoutEvent {
+    /** Type of event */
+    type: 'lockout' | 'unlock' | 'ip_blocked';
+    /** Identifier that was locked/unlocked */
+    identifier: string;
+    /** IP address if applicable */
+    ipAddress?: string;
+    /** Username if applicable */
+    username?: string;
+    /** When the lockout started */
+    lockedAt: Date;
+    /** When the lockout ends */
+    lockoutEndsAt?: Date;
+    /** Number of failed attempts that triggered lockout */
+    failedAttempts: number;
+    /** Total lockout count for this identifier */
+    lockoutCount: number;
+    /** Reason for unlock if manually unlocked */
+    unlockReason?: string;
+    /** Admin ID who performed unlock if applicable */
+    adminId?: string;
+}
+/**
+ * Callback for lockout events
+ */
+export type LockoutEventCallback = (event: LockoutEvent) => void | Promise<void>;
+/**
+ * Default brute force protection configuration
+ */
+export declare const DEFAULT_BRUTE_FORCE_CONFIG: BruteForceConfig;
+/**
+ * Brute Force Protection Service
+ *
+ * Provides comprehensive protection against brute force attacks
+ * with Redis-backed distributed tracking.
+ *
+ * @example
+ * ```typescript
+ * const protection = new BruteForceProtection({
+ *   maxAttempts: 5,
+ *   windowMinutes: 15,
+ *   lockoutMinutes: 30,
+ * });
+ *
+ * // Record a failed attempt
+ * await protection.recordAttempt({
+ *   username: 'user@example.com',
+ *   ipAddress: '192.168.1.1',
+ *   userAgent: 'Mozilla/5.0...',
+ *   timestamp: new Date(),
+ *   success: false,
+ *   failureReason: 'invalid_password',
+ * });
+ *
+ * // Check lockout status before login
+ * const status = await protection.isLockedOut('user@example.com');
+ * if (status.locked) {
+ *   console.log('Account locked until:', status.lockoutEndsAt);
+ * }
+ * ```
+ */
+export declare class BruteForceProtection {
+    private readonly config;
+    private readonly redis;
+    private readonly eventCallbacks;
+    /**
+     * Creates a new BruteForceProtection instance
+     *
+     * @param config - Configuration options
+     * @param redis - Optional Redis instance (uses shared instance if not provided)
+     */
+    constructor(config?: Partial<BruteForceConfig>, redis?: Redis);
+    /**
+     * Registers a callback for lockout events
+     *
+     * @param callback - Function to call when lockout events occur
+     */
+    onLockoutEvent(callback: LockoutEventCallback): void;
+    /**
+     * Emits a lockout event to all registered callbacks
+     *
+     * @param event - The lockout event to emit
+     */
+    private emitEvent;
+    /**
+     * Records a login attempt and updates protection state
+     *
+     * @param attempt - The login attempt to record
+     */
+    recordAttempt(attempt: LoginAttempt): Promise<void>;
+    /**
+     * Records an attempt for a specific identifier
+     */
+    private recordAttemptForIdentifier;
+    /**
+     * Records an IP rate limit attempt
+     */
+    private recordIPAttempt;
+    /**
+     * Checks if lockout should be triggered and triggers it if necessary
+     */
+    private checkAndTriggerLockout;
+    /**
+     * Triggers a lockout for an identifier
+     */
+    private triggerLockout;
+    /**
+     * Gets the count of failed attempts for an identifier
+     */
+    private getFailedAttemptCount;
+    /**
+     * Clears attempts for an identifier (e.g., after successful login)
+     */
+    private clearAttempts;
+    /**
+     * Checks the lockout status for an identifier
+     *
+     * @param identifier - Username or IP-prefixed string to check
+     * @returns Current lockout status
+     */
+    isLockedOut(identifier: string): Promise<LockoutStatus>;
+    /**
+     * Checks if an IP address is blocked due to rate limiting
+     *
+     * @param ip - IP address to check
+     * @returns Whether the IP is blocked
+     */
+    isIPBlocked(ip: string): Promise<boolean>;
+    /**
+     * Gets the remaining attempts before lockout for an identifier
+     *
+     * @param identifier - Username or IP to check
+     * @returns Number of remaining attempts
+     */
+    getRemainingAttempts(identifier: string): Promise<number>;
+    /**
+     * Manually unlocks an account (admin action)
+     *
+     * @param identifier - Username or IP to unlock
+     * @param reason - Reason for the unlock
+     * @param adminId - ID of the admin performing the unlock
+     */
+    unlockAccount(identifier: string, reason: string, adminId: string): Promise<void>;
+    /**
+     * Checks if CAPTCHA is required for an identifier
+     *
+     * @param identifier - Username or IP to check
+     * @returns Whether CAPTCHA is required
+     */
+    requiresCaptcha(identifier: string): Promise<boolean>;
+    /**
+     * Gets recent login attempts for an identifier
+     *
+     * @param identifier - Username or IP to get attempts for
+     * @param minutes - Time window in minutes
+     * @returns Array of recent login attempts
+     */
+    getRecentAttempts(identifier: string, minutes: number): Promise<LoginAttempt[]>;
+    /**
+     * Cleans up old records to prevent unbounded storage growth
+     *
+     * This should be called periodically (e.g., via cron job)
+     */
+    cleanup(): Promise<void>;
+    /**
+     * Gets the current configuration
+     *
+     * @returns Current brute force configuration
+     */
+    getConfig(): BruteForceConfig;
+}
+/**
+ * Options for the brute force middleware
+ */
+export interface BruteForceMiddlewareOptions {
+    /** Brute force protection instance */
+    protection?: BruteForceProtection;
+    /** Brute force configuration (if not providing protection instance) */
+    config?: Partial<BruteForceConfig>;
+    /** Paths to skip protection for */
+    skipPaths?: string[];
+    /** Function to extract username from request */
+    extractUsername?: (request: FastifyRequest) => string | undefined;
+    /** Function to extract user ID from request */
+    extractUserId?: (request: FastifyRequest) => string | undefined;
+    /** Whether to check IP blocking */
+    checkIPBlocking?: boolean;
+    /** Whether to check account lockout */
+    checkAccountLockout?: boolean;
+    /** Custom response for locked accounts */
+    lockedResponse?: (status: LockoutStatus) => {
+        statusCode: number;
+        body: Record<string, unknown>;
+    };
+    /** Custom response for blocked IPs */
+    ipBlockedResponse?: () => {
+        statusCode: number;
+        body: Record<string, unknown>;
+    };
+}
+/**
+ * Creates Fastify middleware for brute force protection
+ *
+ * @param options - Middleware options
+ * @returns Fastify preHandler hook
+ *
+ * @example
+ * ```typescript
+ * const bruteForceMiddleware = createBruteForceMiddleware({
+ *   config: {
+ *     maxAttempts: 5,
+ *     lockoutMinutes: 30,
+ *   },
+ *   skipPaths: ['/health', '/metrics'],
+ *   extractUsername: (req) => req.body?.email,
+ * });
+ *
+ * fastify.addHook('preHandler', bruteForceMiddleware);
+ * ```
+ */
+export declare function createBruteForceMiddleware(options?: BruteForceMiddlewareOptions): preHandlerHookHandler;
+/**
+ * Creates a post-authentication hook to record login attempts
+ *
+ * @param protection - BruteForceProtection instance
+ * @param options - Hook options
+ * @returns Function to record attempt
+ *
+ * @example
+ * ```typescript
+ * const recordAttempt = createRecordAttemptHook(protection);
+ *
+ * // In your login handler:
+ * try {
+ *   const user = await authenticate(username, password);
+ *   await recordAttempt(request, true);
+ *   return { success: true, user };
+ * } catch (error) {
+ *   await recordAttempt(request, false, error.message);
+ *   throw error;
+ * }
+ * ```
+ */
+export declare function createRecordAttemptHook(protection: BruteForceProtection, options?: {
+    extractUsername?: (request: FastifyRequest) => string | undefined;
+    extractUserId?: (request: FastifyRequest) => string | undefined;
+}): (request: FastifyRequest, success: boolean, failureReason?: string) => Promise<void>;
+declare module 'fastify' {
+    interface FastifyRequest {
+        bruteForceStatus?: LockoutStatus;
+    }
+}
+/**
+ * Gets or creates the singleton BruteForceProtection instance
+ *
+ * @param config - Optional configuration (only used on first call)
+ * @returns The singleton BruteForceProtection instance
+ *
+ * @example
+ * ```typescript
+ * // Initialize with custom config
+ * const protection = getBruteForceProtection({
+ *   maxAttempts: 3,
+ *   lockoutMinutes: 60,
+ * });
+ *
+ * // Later, get the same instance
+ * const sameProtection = getBruteForceProtection();
+ * ```
+ */
+export declare function getBruteForceProtection(config?: Partial<BruteForceConfig>): BruteForceProtection;
+/**
+ * Resets the singleton instance (primarily for testing)
+ */
+export declare function resetBruteForceProtection(): void;
+//# sourceMappingURL=brute-force.d.ts.map

package/dist/security/brute-force.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brute-force.d.ts","sourceRoot":"","sources":["../../src/security/brute-force.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAEV,cAAc,EAEd,qBAAqB,EACtB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AA6BrC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAE5B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAElB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAElB,+BAA+B;IAC/B,SAAS,EAAE,IAAI,CAAC;IAEhB,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IAEjB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,MAAM,EAAE,OAAO,CAAC;IAEhB,kDAAkD;IAClD,iBAAiB,EAAE,MAAM,CAAC;IAE1B,4CAA4C;IAC5C,aAAa,CAAC,EAAE,IAAI,CAAC;IAErB,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IAErB,+CAA+C;IAC/C,eAAe,EAAE,OAAO,CAAC;CAC1B;AAeD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,YAAY,CAAC;IAE1C,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IAEnB,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,+BAA+B;IAC/B,QAAQ,EAAE,IAAI,CAAC;IAEf,4BAA4B;IAC5B,aAAa,CAAC,EAAE,IAAI,CAAC;IAErB,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAC;IAEvB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IAErB,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAMjF;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE,gBAYxC,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D;;;;;OAKG;gBACS,MAAM,GAAE,OAAO,CAAC,gBAAgB,CAAM,EAAE,KAAK,CAAC,EAAE,KAAK;IAgBjE;;;;OAIG;IACH,cAAc,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI;IAIpD;;;;OAIG;YACW,SAAS;IAgBvB;;;;OAIG;IACG,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IA6DzD;;OAEG;YACW,0BAA0B;IAkBxC;;OAEG;YACW,eAAe;IAa7B;;OAEG;YACW,sBAAsB;IAWpC;;OAEG;YACW,cAAc;IAwE5B;;OAEG;YACW,qBAAqB;IAwBnC;;OAEG;YACW,aAAa;IAK3B;;;;;OAKG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAgD7D;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkC/C;;;;;OAKG;IACG,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/D;;;;;;OAMG;IACG,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAuDhB;;;;;OAKG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK3D;;;;;;OAMG;IACG,iBAAiB,CACrB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,EAAE,CAAC;IA2B1B;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA2D9B;;;;OAIG;IACH,SAAS,IAAI,gBAAgB;CAG9B;AAMD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,sCAAsC;IACtC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAElC,uEAAuE;IACvE,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEnC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB,gDAAgD;IAChD,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,GAAG,SAAS,CAAC;IAElE,+CAA+C;IAC/C,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,GAAG,SAAS,CAAC;IAEhE,mCAAmC;IACnC,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,uCAAuC;IACvC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B,0CAA0C;IAC1C,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK;QAC1C,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/B,CAAC;IAEF,sCAAsC;IACtC,iBAAiB,CAAC,EAAE,MAAM;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/B,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,2BAAgC,GACxC,qBAAqB,CA2FvB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,oBAAoB,EAChC,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,GAAG,SAAS,CAAC;IAClE,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,GAAG,SAAS,CAAC;CAC5D,GACL,CACD,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,OAAO,EAChB,aAAa,CAAC,EAAE,MAAM,KACnB,OAAO,CAAC,IAAI,CAAC,CAuCjB;AAMD,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,gBAAgB,CAAC,EAAE,aAAa,CAAC;KAClC;CACF;AAQD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GACjC,oBAAoB,CAKtB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD"}