@vorionsys/platform-core 0.1.0

package/dist/security/rbac/roles.js

@@ -0,0 +1,363 @@
+/**
+ * Role Definitions for Role-Based Access Control (RBAC)
+ *
+ * Defines hierarchical roles with inherited permissions. Roles form a
+ * hierarchy where higher-privilege roles inherit all permissions from
+ * lower-privilege roles.
+ *
+ * Hierarchy: super_admin > admin > operator > analyst > viewer > guest
+ *
+ * Integration with TrustTier:
+ * - Roles are assigned minimum trust tier requirements
+ * - Higher privilege roles require higher trust tiers
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+// =============================================================================
+// ROLE TYPES
+// =============================================================================
+/**
+ * Built-in role identifiers
+ */
+export const BuiltinRoles = {
+    /** Full system access - T5 required */
+    SUPER_ADMIN: 'super_admin',
+    /** Administrative access - T4 required */
+    ADMIN: 'admin',
+    /** Operational access - T3 required */
+    OPERATOR: 'operator',
+    /** Read and analysis access - T2 required */
+    ANALYST: 'analyst',
+    /** Read-only access - T1 required */
+    VIEWER: 'viewer',
+    /** Minimal access - T0 allowed */
+    GUEST: 'guest',
+};
+/**
+ * Role priority for hierarchy (higher = more privileged)
+ */
+export const ROLE_PRIORITY = {
+    [BuiltinRoles.SUPER_ADMIN]: 100,
+    [BuiltinRoles.ADMIN]: 80,
+    [BuiltinRoles.OPERATOR]: 60,
+    [BuiltinRoles.ANALYST]: 40,
+    [BuiltinRoles.VIEWER]: 20,
+    [BuiltinRoles.GUEST]: 0,
+};
+/**
+ * Minimum trust tier required for each role
+ */
+export const ROLE_MINIMUM_TRUST_TIER = {
+    [BuiltinRoles.SUPER_ADMIN]: 5,
+    [BuiltinRoles.ADMIN]: 4,
+    [BuiltinRoles.OPERATOR]: 3,
+    [BuiltinRoles.ANALYST]: 2,
+    [BuiltinRoles.VIEWER]: 1,
+    [BuiltinRoles.GUEST]: 0,
+};
+// =============================================================================
+// ZOD SCHEMAS
+// =============================================================================
+export const timRestrictionSchema = z.object({
+    startTime: z.string().regex(/^([01]\d|2[0-3]):([0-5]\d)$/),
+    endTime: z.string().regex(/^([01]\d|2[0-3]):([0-5]\d)$/),
+    daysOfWeek: z.array(z.number().int().min(0).max(6)),
+    timezone: z.string(),
+});
+export const roleScopeSchema = z.object({
+    tenantIds: z.array(z.string()).optional(),
+    resourceTypes: z.array(z.string()).optional(),
+    timeRestrictions: z.array(timRestrictionSchema).optional(),
+    ipRestrictions: z.array(z.string()).optional(),
+});
+export const roleDefinitionSchema = z.object({
+    id: z.string().min(1),
+    name: z.string().min(1).max(100),
+    description: z.string().max(500),
+    parentRole: z.string().optional(),
+    priority: z.number().int().min(0).max(1000),
+    minimumTrustTier: z.number().int().min(0).max(7),
+    permissions: z.array(z.string()),
+    scope: roleScopeSchema.optional(),
+    isSystemRole: z.boolean(),
+    enabled: z.boolean(),
+    metadata: z.record(z.unknown()).optional(),
+    createdAt: z.string().datetime(),
+    updatedAt: z.string().datetime(),
+});
+export const assignmentConditionsSchema = z.object({
+    requiredTrustTier: z.number().int().min(0).max(7).optional(),
+    allowedIpRanges: z.array(z.string()).optional(),
+    timeConditions: z.array(timRestrictionSchema).optional(),
+    attributeRequirements: z.record(z.unknown()).optional(),
+});
+export const roleAssignmentSchema = z.object({
+    id: z.string(),
+    subjectId: z.string(),
+    subjectType: z.enum(['user', 'agent', 'service']),
+    roleId: z.string(),
+    tenantId: z.string().optional(),
+    conditions: assignmentConditionsSchema.optional(),
+    expiresAt: z.string().datetime().optional(),
+    assignedBy: z.string(),
+    assignedAt: z.string().datetime(),
+    active: z.boolean(),
+});
+// =============================================================================
+// BUILT-IN ROLE DEFINITIONS
+// =============================================================================
+/**
+ * Get the built-in system roles
+ */
+export function getBuiltinRoles() {
+    const now = new Date().toISOString();
+    return [
+        {
+            id: BuiltinRoles.SUPER_ADMIN,
+            name: 'Super Administrator',
+            description: 'Full system access with all permissions. Can manage other admins and system configuration.',
+            priority: ROLE_PRIORITY[BuiltinRoles.SUPER_ADMIN],
+            minimumTrustTier: ROLE_MINIMUM_TRUST_TIER[BuiltinRoles.SUPER_ADMIN],
+            permissions: ['*'],
+            isSystemRole: true,
+            enabled: true,
+            createdAt: now,
+            updatedAt: now,
+        },
+        {
+            id: BuiltinRoles.ADMIN,
+            name: 'Administrator',
+            description: 'Administrative access for tenant management, user management, and configuration.',
+            parentRole: BuiltinRoles.SUPER_ADMIN,
+            priority: ROLE_PRIORITY[BuiltinRoles.ADMIN],
+            minimumTrustTier: ROLE_MINIMUM_TRUST_TIER[BuiltinRoles.ADMIN],
+            permissions: [
+                'tenant:*',
+                'user:*',
+                'role:*',
+                'policy:*',
+                'intent:*',
+                'proof:*',
+                'audit:read',
+                'config:*',
+            ],
+            isSystemRole: true,
+            enabled: true,
+            createdAt: now,
+            updatedAt: now,
+        },
+        {
+            id: BuiltinRoles.OPERATOR,
+            name: 'Operator',
+            description: 'Operational access for managing intents, approving escalations, and monitoring.',
+            parentRole: BuiltinRoles.ADMIN,
+            priority: ROLE_PRIORITY[BuiltinRoles.OPERATOR],
+            minimumTrustTier: ROLE_MINIMUM_TRUST_TIER[BuiltinRoles.OPERATOR],
+            permissions: [
+                'intent:read',
+                'intent:create',
+                'intent:update',
+                'intent:approve',
+                'intent:reject',
+                'escalation:*',
+                'proof:read',
+                'proof:verify',
+                'audit:read',
+                'monitoring:*',
+            ],
+            isSystemRole: true,
+            enabled: true,
+            createdAt: now,
+            updatedAt: now,
+        },
+        {
+            id: BuiltinRoles.ANALYST,
+            name: 'Analyst',
+            description: 'Read access with analysis capabilities for intents, proofs, and audit logs.',
+            parentRole: BuiltinRoles.OPERATOR,
+            priority: ROLE_PRIORITY[BuiltinRoles.ANALYST],
+            minimumTrustTier: ROLE_MINIMUM_TRUST_TIER[BuiltinRoles.ANALYST],
+            permissions: [
+                'intent:read',
+                'intent:analyze',
+                'proof:read',
+                'proof:verify',
+                'audit:read',
+                'audit:export',
+                'report:*',
+                'dashboard:read',
+            ],
+            isSystemRole: true,
+            enabled: true,
+            createdAt: now,
+            updatedAt: now,
+        },
+        {
+            id: BuiltinRoles.VIEWER,
+            name: 'Viewer',
+            description: 'Read-only access to view intents, proofs, and basic information.',
+            parentRole: BuiltinRoles.ANALYST,
+            priority: ROLE_PRIORITY[BuiltinRoles.VIEWER],
+            minimumTrustTier: ROLE_MINIMUM_TRUST_TIER[BuiltinRoles.VIEWER],
+            permissions: [
+                'intent:read',
+                'proof:read',
+                'dashboard:read',
+                'profile:read',
+            ],
+            isSystemRole: true,
+            enabled: true,
+            createdAt: now,
+            updatedAt: now,
+        },
+        {
+            id: BuiltinRoles.GUEST,
+            name: 'Guest',
+            description: 'Minimal access for unauthenticated or low-trust subjects.',
+            parentRole: BuiltinRoles.VIEWER,
+            priority: ROLE_PRIORITY[BuiltinRoles.GUEST],
+            minimumTrustTier: ROLE_MINIMUM_TRUST_TIER[BuiltinRoles.GUEST],
+            permissions: [
+                'public:read',
+                'health:read',
+            ],
+            isSystemRole: true,
+            enabled: true,
+            createdAt: now,
+            updatedAt: now,
+        },
+    ];
+}
+// =============================================================================
+// ROLE UTILITIES
+// =============================================================================
+/**
+ * Check if a role inherits from another role
+ */
+export function roleInheritsFrom(role, ancestorId, roleRegistry) {
+    if (role.id === ancestorId) {
+        return true;
+    }
+    if (!role.parentRole) {
+        return false;
+    }
+    const parent = roleRegistry.get(role.parentRole);
+    if (!parent) {
+        return false;
+    }
+    return roleInheritsFrom(parent, ancestorId, roleRegistry);
+}
+/**
+ * Get all permissions for a role including inherited permissions
+ */
+export function getEffectivePermissions(role, roleRegistry) {
+    const permissions = new Set(role.permissions);
+    // Add inherited permissions from parent role
+    if (role.parentRole) {
+        const parent = roleRegistry.get(role.parentRole);
+        if (parent) {
+            const parentPermissions = getEffectivePermissions(parent, roleRegistry);
+            for (const perm of parentPermissions) {
+                permissions.add(perm);
+            }
+        }
+    }
+    return permissions;
+}
+/**
+ * Get the effective priority for a role (considering inheritance)
+ */
+export function getEffectivePriority(role, roleRegistry) {
+    // Return the role's own priority
+    return role.priority;
+}
+/**
+ * Compare two roles for hierarchy
+ * Returns positive if roleA > roleB, negative if roleA < roleB, 0 if equal
+ */
+export function compareRoles(roleA, roleB, roleRegistry) {
+    const priorityA = getEffectivePriority(roleA, roleRegistry);
+    const priorityB = getEffectivePriority(roleB, roleRegistry);
+    return priorityA - priorityB;
+}
+/**
+ * Get all ancestor roles in the hierarchy
+ */
+export function getAncestorRoles(role, roleRegistry) {
+    const ancestors = [];
+    let current = role;
+    while (current?.parentRole) {
+        const parent = roleRegistry.get(current.parentRole);
+        if (!parent)
+            break;
+        ancestors.push(parent);
+        current = parent;
+    }
+    return ancestors;
+}
+/**
+ * Validate that a role hierarchy has no cycles
+ */
+export function validateRoleHierarchy(roleRegistry) {
+    const cycles = [];
+    const visited = new Set();
+    const recursionStack = new Set();
+    function detectCycle(roleId, path) {
+        if (recursionStack.has(roleId)) {
+            const cycleStart = path.indexOf(roleId);
+            cycles.push(path.slice(cycleStart));
+            return true;
+        }
+        if (visited.has(roleId)) {
+            return false;
+        }
+        visited.add(roleId);
+        recursionStack.add(roleId);
+        path.push(roleId);
+        const role = roleRegistry.get(roleId);
+        if (role?.parentRole) {
+            detectCycle(role.parentRole, path);
+        }
+        path.pop();
+        recursionStack.delete(roleId);
+        return false;
+    }
+    for (const roleId of roleRegistry.keys()) {
+        detectCycle(roleId, []);
+    }
+    return {
+        valid: cycles.length === 0,
+        cycles,
+    };
+}
+/**
+ * Check if a trust tier meets the minimum requirement for a role
+ */
+export function meetsTrustRequirement(role, trustTier) {
+    return trustTier >= role.minimumTrustTier;
+}
+/**
+ * Create a custom role definition
+ */
+export function createRoleDefinition(partial) {
+    const now = new Date().toISOString();
+    return {
+        ...partial,
+        isSystemRole: partial.isSystemRole ?? false,
+        createdAt: now,
+        updatedAt: now,
+    };
+}
+/**
+ * Create a role assignment
+ */
+export function createRoleAssignment(partial) {
+    return {
+        id: crypto.randomUUID(),
+        ...partial,
+        assignedAt: new Date().toISOString(),
+        active: partial.active ?? true,
+    };
+}
+//# sourceMappingURL=roles.js.map

package/dist/security/rbac/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../src/security/rbac/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,uCAAuC;IACvC,WAAW,EAAE,aAAa;IAC1B,0CAA0C;IAC1C,KAAK,EAAE,OAAO;IACd,uCAAuC;IACvC,QAAQ,EAAE,UAAU;IACpB,6CAA6C;IAC7C,OAAO,EAAE,SAAS;IAClB,qCAAqC;IACrC,MAAM,EAAE,QAAQ;IAChB,kCAAkC;IAClC,KAAK,EAAE,OAAO;CACN,CAAC;AAIX;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAgC;IACxD,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,GAAG;IAC/B,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE;IACxB,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE;IAC3B,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE;IAC1B,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE;IACzB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;CACf,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAoC;IACtE,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;IAC7B,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACvB,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1B,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACzB,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;IACxB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;CACf,CAAC;AAsGX,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6BAA6B,CAAC;IAC1D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6BAA6B,CAAC;IACxD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1D,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAA0B;IACzE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAuC;IACjG,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAEH,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,OAAO;QACL;YACE,EAAE,EAAE,YAAY,CAAC,WAAW;YAC5B,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,4FAA4F;YACzG,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC;YACjD,gBAAgB,EAAE,uBAAuB,CAAC,YAAY,CAAC,WAAW,CAAC;YACnE,WAAW,EAAE,CAAC,GAAG,CAAC;YAClB,YAAY,EAAE,IAAI;YAClB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf;QACD;YACE,EAAE,EAAE,YAAY,CAAC,KAAK;YACtB,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,kFAAkF;YAC/F,UAAU,EAAE,YAAY,CAAC,WAAW;YACpC,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC;YAC3C,gBAAgB,EAAE,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC;YAC7D,WAAW,EAAE;gBACX,UAAU;gBACV,QAAQ;gBACR,QAAQ;gBACR,UAAU;gBACV,UAAU;gBACV,SAAS;gBACT,YAAY;gBACZ,UAAU;aACX;YACD,YAAY,EAAE,IAAI;YAClB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf;QACD;YACE,EAAE,EAAE,YAAY,CAAC,QAAQ;YACzB,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,iFAAiF;YAC9F,UAAU,EAAE,YAAY,CAAC,KAAK;YAC9B,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC;YAC9C,gBAAgB,EAAE,uBAAuB,CAAC,YAAY,CAAC,QAAQ,CAAC;YAChE,WAAW,EAAE;gBACX,aAAa;gBACb,eAAe;gBACf,eAAe;gBACf,gBAAgB;gBAChB,eAAe;gBACf,cAAc;gBACd,YAAY;gBACZ,cAAc;gBACd,YAAY;gBACZ,cAAc;aACf;YACD,YAAY,EAAE,IAAI;YAClB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf;QACD;YACE,EAAE,EAAE,YAAY,CAAC,OAAO;YACxB,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,6EAA6E;YAC1F,UAAU,EAAE,YAAY,CAAC,QAAQ;YACjC,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC;YAC7C,gBAAgB,EAAE,uBAAuB,CAAC,YAAY,CAAC,OAAO,CAAC;YAC/D,WAAW,EAAE;gBACX,aAAa;gBACb,gBAAgB;gBAChB,YAAY;gBACZ,cAAc;gBACd,YAAY;gBACZ,cAAc;gBACd,UAAU;gBACV,gBAAgB;aACjB;YACD,YAAY,EAAE,IAAI;YAClB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf;QACD;YACE,EAAE,EAAE,YAAY,CAAC,MAAM;YACvB,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,kEAAkE;YAC/E,UAAU,EAAE,YAAY,CAAC,OAAO;YAChC,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC;YAC5C,gBAAgB,EAAE,uBAAuB,CAAC,YAAY,CAAC,MAAM,CAAC;YAC9D,WAAW,EAAE;gBACX,aAAa;gBACb,YAAY;gBACZ,gBAAgB;gBAChB,cAAc;aACf;YACD,YAAY,EAAE,IAAI;YAClB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf;QACD;YACE,EAAE,EAAE,YAAY,CAAC,KAAK;YACtB,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,2DAA2D;YACxE,UAAU,EAAE,YAAY,CAAC,MAAM;YAC/B,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC;YAC3C,gBAAgB,EAAE,uBAAuB,CAAC,YAAY,CAAC,KAAK,CAAC;YAC7D,WAAW,EAAE;gBACX,aAAa;gBACb,aAAa;aACd;YACD,YAAY,EAAE,IAAI;YAClB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,UAAkB,EAClB,YAAyC;IAEzC,IAAI,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAoB,EACpB,YAAyC;IAEzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,WAAW,CAAC,CAAC;IAEtD,6CAA6C;IAC7C,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACxE,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;gBACrC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAoB,EACpB,YAAyC;IAEzC,iCAAiC;IACjC,OAAO,IAAI,CAAC,QAAQ,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAqB,EACrB,KAAqB,EACrB,YAAyC;IAEzC,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC5D,OAAO,SAAS,GAAG,SAAS,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,YAAyC;IAEzC,MAAM,SAAS,GAAqB,EAAE,CAAC;IAEvC,IAAI,OAAO,GAA+B,IAAI,CAAC;IAC/C,OAAO,OAAO,EAAE,UAAU,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM;YAAE,MAAM;QACnB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAyC;IAI7E,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,SAAS,WAAW,CAAC,MAAc,EAAE,IAAc;QACjD,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAElB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC;YACrB,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAoB,EACpB,SAAqB;IAErB,OAAO,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAC+C;IAE/C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO;QACL,GAAG,OAAO;QACV,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;QAC3C,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,OACyC;IAEzC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,GAAG,OAAO;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;KAC/B,CAAC;AACJ,CAAC"}

package/dist/security/refresh-token.d.ts

@@ -0,0 +1,305 @@
+/**
+ * Refresh Token Service with Rotation Support
+ *
+ * Implements secure refresh token handling with rotation to prevent token theft:
+ * - Generates secure 32-byte refresh tokens (base64url encoded)
+ * - Stores token hashes (SHA-256) - never stores plaintext
+ * - Tracks token families for rotation and theft detection
+ * - Automatically revokes entire family on reuse detection (theft indicator)
+ * - Redis-backed storage for distributed deployment support
+ *
+ * Security Features:
+ * - Token rotation: each use generates a new token
+ * - Family tracking: detects token reuse attacks
+ * - Device fingerprinting: binds tokens to devices
+ * - Configurable TTL: 24 hours default per CAR spec
+ *
+ * @packageDocumentation
+ */
+import { VorionError } from '../common/errors.js';
+import { SecurityAuditLogger } from '../audit/security-logger.js';
+/**
+ * Refresh token error base class
+ */
+export declare class RefreshTokenError extends VorionError {
+    code: string;
+    statusCode: number;
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Token reuse detected - potential theft
+ */
+export declare class TokenReuseError extends RefreshTokenError {
+    code: string;
+    constructor(familyId: string);
+}
+/**
+ * Token expired error
+ */
+export declare class RefreshTokenExpiredError extends RefreshTokenError {
+    code: string;
+    constructor();
+}
+/**
+ * Token revoked error
+ */
+export declare class RefreshTokenRevokedError extends RefreshTokenError {
+    code: string;
+    constructor(reason: string);
+}
+/**
+ * Invalid token error
+ */
+export declare class RefreshTokenInvalidError extends RefreshTokenError {
+    code: string;
+    constructor();
+}
+/**
+ * Refresh token stored data structure
+ */
+export interface RefreshTokenData {
+    /** SHA-256 hash of the token */
+    tokenHash: string;
+    /** User ID this token belongs to */
+    userId: string;
+    /** Tenant ID for multi-tenant isolation */
+    tenantId: string;
+    /** Device fingerprint for binding */
+    deviceFingerprint: string;
+    /** Token family ID for rotation tracking */
+    familyId: string;
+    /** Rotation count within the family */
+    rotationCount: number;
+    /** When the token was created */
+    createdAt: string;
+    /** When the token expires */
+    expiresAt: string;
+    /** Whether the token has been used (rotated) */
+    used: boolean;
+    /** When the token was used */
+    usedAt?: string;
+    /** IP address at token creation */
+    ipAddress?: string;
+    /** User agent string */
+    userAgent?: string;
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Refresh token payload returned to client
+ */
+export interface RefreshTokenPayload {
+    /** User ID */
+    userId: string;
+    /** Tenant ID */
+    tenantId: string;
+    /** Device fingerprint */
+    deviceFingerprint: string;
+    /** Token family ID */
+    familyId: string;
+    /** Rotation count */
+    rotationCount: number;
+    /** Expiration timestamp */
+    expiresAt: Date;
+}
+/**
+ * Token family data structure
+ */
+export interface TokenFamily {
+    /** Family ID */
+    familyId: string;
+    /** User ID */
+    userId: string;
+    /** Tenant ID */
+    tenantId: string;
+    /** Device fingerprint */
+    deviceFingerprint: string;
+    /** When the family was created */
+    createdAt: string;
+    /** Current rotation count */
+    rotationCount: number;
+    /** Whether the family has been revoked */
+    revoked: boolean;
+    /** Revocation reason */
+    revokedReason?: string;
+    /** When the family was revoked */
+    revokedAt?: string;
+}
+/**
+ * Create token input
+ */
+export interface CreateRefreshTokenInput {
+    /** User ID */
+    userId: string;
+    /** Tenant ID */
+    tenantId: string;
+    /** Device fingerprint */
+    deviceFingerprint: string;
+    /** IP address */
+    ipAddress?: string;
+    /** User agent */
+    userAgent?: string;
+    /** Custom TTL in seconds */
+    ttlSeconds?: number;
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Token rotation result
+ */
+export interface TokenRotationResult {
+    /** New refresh token */
+    newToken: string;
+    /** New access token */
+    accessToken: string;
+    /** Expiration time */
+    expiresAt: Date;
+}
+/**
+ * Access token generator function type
+ */
+export type AccessTokenGenerator = (userId: string, tenantId: string, metadata?: Record<string, unknown>) => Promise<string>;
+/**
+ * Refresh token service configuration
+ */
+export interface RefreshTokenServiceConfig {
+    /** Refresh token TTL in seconds */
+    refreshTokenTTL: number;
+    /** Access token TTL in seconds */
+    accessTokenTTL: number;
+    /** Key prefix for Redis storage */
+    keyPrefix: string;
+    /** Maximum rotation count before forcing re-authentication */
+    maxRotationCount: number;
+    /** Custom access token generator */
+    accessTokenGenerator?: AccessTokenGenerator;
+}
+/**
+ * Refresh Token Service with rotation support
+ *
+ * Implements secure refresh token handling with rotation to detect token theft.
+ * When a token is used (rotated), a new token is issued. If an old token is
+ * reused (indicating theft), the entire token family is revoked.
+ *
+ * @example
+ * ```typescript
+ * const refreshTokenService = new RefreshTokenService({
+ *   refreshTokenTTL: 86400, // 24 hours
+ *   accessTokenGenerator: async (userId, tenantId) => {
+ *     return generateAccessToken(userId, tenantId);
+ *   },
+ * });
+ *
+ * // Create initial token
+ * const { token, payload } = await refreshTokenService.createToken({
+ *   userId: 'user-123',
+ *   tenantId: 'tenant-456',
+ *   deviceFingerprint: 'device-fp-789',
+ * });
+ *
+ * // Rotate token on use
+ * const { newToken, accessToken } = await refreshTokenService.rotateToken(token);
+ *
+ * // Validate token
+ * const payload = await refreshTokenService.validateToken(token);
+ * ```
+ */
+export declare class RefreshTokenService {
+    private config;
+    private redis;
+    private securityLogger;
+    private accessTokenGenerator;
+    constructor(config?: Partial<RefreshTokenServiceConfig>, securityLogger?: SecurityAuditLogger);
+    /**
+     * Get Redis client, initializing if needed
+     */
+    private getRedis;
+    /**
+     * Default access token generator (placeholder)
+     * In production, this should be replaced with actual JWT generation
+     */
+    private defaultAccessTokenGenerator;
+    /**
+     * Generate Redis key for a token hash
+     */
+    private tokenKey;
+    /**
+     * Generate Redis key for a token family
+     */
+    private familyKey;
+    /**
+     * Generate Redis key for user's token families index
+     */
+    private userFamiliesKey;
+    /**
+     * Create a new refresh token
+     */
+    createToken(input: CreateRefreshTokenInput): Promise<{
+        token: string;
+        payload: RefreshTokenPayload;
+    }>;
+    /**
+     * Validate a refresh token without rotating it
+     */
+    validateToken(token: string): Promise<RefreshTokenPayload | null>;
+    /**
+     * Rotate a refresh token
+     *
+     * This is the main method for using a refresh token. It:
+     * 1. Validates the token
+     * 2. Checks for reuse (theft detection)
+     * 3. Issues a new refresh token
+     * 4. Issues a new access token
+     * 5. Invalidates the old refresh token
+     */
+    rotateToken(oldToken: string, ipAddress?: string, userAgent?: string): Promise<TokenRotationResult>;
+    /**
+     * Revoke a token family
+     */
+    revokeFamily(familyId: string, reason: string, revokedBy?: string): Promise<boolean>;
+    /**
+     * Internal method to revoke a token family
+     */
+    private revokeFamilyInternal;
+    /**
+     * Revoke all token families for a user
+     */
+    revokeAllForUser(userId: string, tenantId: string, reason: string, revokedBy?: string): Promise<number>;
+    /**
+     * Get a token family by ID
+     */
+    getFamily(familyId: string): Promise<TokenFamily | null>;
+    /**
+     * Get all active token families for a user
+     */
+    getFamiliesForUser(userId: string): Promise<TokenFamily[]>;
+    /**
+     * Check if Redis is healthy
+     */
+    checkHealth(): Promise<{
+        healthy: boolean;
+        latencyMs?: number;
+        error?: string;
+    }>;
+    /**
+     * Get service statistics
+     */
+    getStats(): {
+        refreshTokenTTL: number;
+        accessTokenTTL: number;
+        maxRotationCount: number;
+    };
+}
+/**
+ * Get the singleton refresh token service
+ */
+export declare function getRefreshTokenService(config?: Partial<RefreshTokenServiceConfig>): RefreshTokenService;
+/**
+ * Create a new refresh token service instance (for testing)
+ */
+export declare function createRefreshTokenService(config?: Partial<RefreshTokenServiceConfig>, securityLogger?: SecurityAuditLogger): RefreshTokenService;
+/**
+ * Reset the singleton (for testing)
+ */
+export declare function resetRefreshTokenService(): void;
+//# sourceMappingURL=refresh-token.d.ts.map

package/dist/security/refresh-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../src/security/refresh-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,EAAE,WAAW,EAAqB,MAAM,qBAAqB,CAAC;AAGrE,OAAO,EACL,mBAAmB,EAEpB,MAAM,6BAA6B,CAAC;AAkIrC;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,WAAW;IACvC,IAAI,SAAyB;IAC7B,UAAU,SAAO;gBAEd,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,iBAAiB;IAC3C,IAAI,SAA0B;gBAE3B,QAAQ,EAAE,MAAM;CAI7B;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,iBAAiB;IACpD,IAAI,SAA2B;;CAMzC;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,iBAAiB;IACpD,IAAI,SAA2B;gBAE5B,MAAM,EAAE,MAAM;CAI3B;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,iBAAiB;IACpD,IAAI,SAA2B;;CAMzC;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,IAAI,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,yBAAyB;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,yBAAyB;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,wBAAwB;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,yBAAyB;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB;IACtB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,mCAAmC;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,gBAAgB,EAAE,MAAM,CAAC;IACzB,oCAAoC;IACpC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAiDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,KAAK,CAAsB;IACnC,OAAO,CAAC,cAAc,CAAsB;IAC5C,OAAO,CAAC,oBAAoB,CAAuB;gBAGjD,MAAM,GAAE,OAAO,CAAC,yBAAyB,CAAM,EAC/C,cAAc,CAAC,EAAE,mBAAmB;IAgBtC;;OAEG;YACW,QAAQ;IAOtB;;;OAGG;YACW,2BAA2B;IAkBzC;;OAEG;IACH,OAAO,CAAC,QAAQ;IAIhB;;OAEG;IACH,OAAO,CAAC,SAAS;IAIjB;;OAEG;IACH,OAAO,CAAC,eAAe;IAIvB;;OAEG;IACG,WAAW,CACf,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,mBAAmB,CAAA;KAAE,CAAC;IAkF3D;;OAEG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAgDvE;;;;;;;;;OASG;IACG,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,CAAC;IAoK/B;;OAEG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAiB,GAC3B,OAAO,CAAC,OAAO,CAAC;IAiBnB;;OAEG;YACW,oBAAoB;IAsDlC;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAiB,GAC3B,OAAO,CAAC,MAAM,CAAC;IAqClB;;OAEG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAS9D;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAgBhE;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IAIF;;OAEG;IACH,QAAQ,IAAI;QACV,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,MAAM,CAAC;KAC1B;CAOF;AAQD;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,GAC1C,mBAAmB,CAKrB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,EAC3C,cAAc,CAAC,EAAE,mBAAmB,GACnC,mBAAmB,CAErB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAG/C"}