@vorionsys/security 1.0.0

package/dist/api/routes/extensions.js

@@ -0,0 +1,434 @@
+/**
+ * CAR Extension API Routes
+ *
+ * Exposes the CAR Extension framework via REST API endpoints.
+ * Provides extension listing, details, invocation, and health monitoring.
+ *
+ * @packageDocumentation
+ * @module @vorion/api/routes/extensions
+ * @license Apache-2.0
+ */
+import { z } from 'zod';
+import { createLogger } from '../../common/logger.js';
+import { ForbiddenError, ValidationError } from '../../common/errors.js';
+import { ZodError } from 'zod';
+import { createExtensionService, } from '../../car-extensions/index.js';
+import { cognigateExtension, monitoringExtension, auditExtension, } from '../../car-extensions/index.js';
+import { sendSuccess, sendNotFound } from '../../intent/response-middleware.js';
+import { HttpStatus } from '../../intent/response.js';
+const logger = createLogger({ component: 'api-extensions' });
+// =============================================================================
+// REQUEST SCHEMAS
+// =============================================================================
+const extensionIdParamsSchema = z.object({
+    id: z.string().min(1),
+});
+const invokeCapabilityBodySchema = z.object({
+    type: z.literal('capability'),
+    agent: z.object({
+        did: z.string().min(1),
+        carId: z.string().min(1),
+        publisher: z.string().min(1),
+        name: z.string().min(1),
+        trustTier: z.number().int().min(0).max(7),
+        trustScore: z.number().min(0).max(1000),
+        domains: z.number().int().min(0),
+        level: z.number().int().min(0).max(5),
+        version: z.string().regex(/^\d+\.\d+\.\d+$/),
+        metadata: z.record(z.unknown()).optional(),
+    }),
+    request: z.object({
+        domains: z.array(z.string().min(1)),
+        level: z.number().int().min(0).max(5),
+        context: z.object({
+            source: z.string().min(1),
+            purpose: z.string().optional(),
+            resource: z.string().optional(),
+            metadata: z.record(z.unknown()).optional(),
+        }),
+        ttl: z.number().int().positive().optional(),
+    }),
+});
+const invokeActionBodySchema = z.object({
+    type: z.literal('action'),
+    agent: z.object({
+        did: z.string().min(1),
+        carId: z.string().min(1),
+        publisher: z.string().min(1),
+        name: z.string().min(1),
+        trustTier: z.number().int().min(0).max(7),
+        trustScore: z.number().min(0).max(1000),
+        domains: z.number().int().min(0),
+        level: z.number().int().min(0).max(5),
+        version: z.string().regex(/^\d+\.\d+\.\d+$/),
+        metadata: z.record(z.unknown()).optional(),
+    }),
+    request: z.object({
+        type: z.string().min(1),
+        target: z.object({
+            type: z.string().min(1),
+            id: z.string().min(1),
+            metadata: z.record(z.unknown()).optional(),
+        }),
+        params: z.record(z.unknown()),
+        context: z.object({
+            source: z.string().min(1),
+            purpose: z.string().optional(),
+            resource: z.string().optional(),
+            metadata: z.record(z.unknown()).optional(),
+        }),
+    }),
+});
+const invokeBehaviorBodySchema = z.object({
+    type: z.literal('behavior'),
+    agent: z.object({
+        did: z.string().min(1),
+        carId: z.string().min(1),
+        publisher: z.string().min(1),
+        name: z.string().min(1),
+        trustTier: z.number().int().min(0).max(7),
+        trustScore: z.number().min(0).max(1000),
+        domains: z.number().int().min(0),
+        level: z.number().int().min(0).max(5),
+        version: z.string().regex(/^\d+\.\d+\.\d+$/),
+        metadata: z.record(z.unknown()).optional(),
+    }),
+});
+const invokeBodySchema = z.discriminatedUnion('type', [
+    invokeCapabilityBodySchema,
+    invokeActionBodySchema,
+    invokeBehaviorBodySchema,
+]);
+// =============================================================================
+// EXTENSION SERVICE SINGLETON
+// =============================================================================
+let extensionService = null;
+/**
+ * Get or create the extension service singleton with built-in extensions
+ */
+async function getExtensionService() {
+    if (!extensionService) {
+        extensionService = createExtensionService({
+            defaultTimeout: 5000,
+            failFast: false,
+            logExecution: true,
+            maxConcurrency: 10,
+        });
+        // Register built-in extensions
+        try {
+            await extensionService.registerExtension(cognigateExtension);
+            logger.info({ extensionId: cognigateExtension.extensionId }, 'Registered governance extension');
+        }
+        catch (error) {
+            logger.warn({ error, extensionId: cognigateExtension.extensionId }, 'Failed to register governance extension');
+        }
+        try {
+            await extensionService.registerExtension(monitoringExtension);
+            logger.info({ extensionId: monitoringExtension.extensionId }, 'Registered monitoring extension');
+        }
+        catch (error) {
+            logger.warn({ error, extensionId: monitoringExtension.extensionId }, 'Failed to register monitoring extension');
+        }
+        try {
+            await extensionService.registerExtension(auditExtension);
+            logger.info({ extensionId: auditExtension.extensionId }, 'Registered audit extension');
+        }
+        catch (error) {
+            logger.warn({ error, extensionId: auditExtension.extensionId }, 'Failed to register audit extension');
+        }
+    }
+    return extensionService;
+}
+/**
+ * Reset the extension service (for testing)
+ */
+export function resetExtensionService() {
+    extensionService = null;
+}
+/**
+ * Set a custom extension service (for testing)
+ */
+export function setExtensionService(service) {
+    extensionService = service;
+}
+// =============================================================================
+// ROUTE HANDLERS
+// =============================================================================
+/**
+ * List all available extensions
+ */
+async function listExtensions(request, reply) {
+    const service = await getExtensionService();
+    // Access the registry through the service's internal state
+    // Since ACIExtensionService doesn't expose registry directly, we list via the service
+    const extensions = await listExtensionsFromService(service);
+    logger.info({ count: extensions.length }, 'Listed extensions');
+    return sendSuccess(reply, { extensions }, HttpStatus.OK, request);
+}
+/**
+ * Helper to list extensions from service
+ * The service doesn't expose registry directly, so we use a workaround
+ */
+async function listExtensionsFromService(service) {
+    // We need to access the registry - since it's private, we'll track registered extensions
+    // This is a workaround since the service doesn't expose a list method
+    const knownExtensions = [];
+    // Check known built-in extensions
+    const builtinExtensions = [cognigateExtension, monitoringExtension, auditExtension];
+    for (const ext of builtinExtensions) {
+        // Try to load the extension to verify it's registered
+        const loaded = service.loadAgentExtensions(`test#${ext.shortcode}`);
+        if (loaded.length > 0) {
+            knownExtensions.push({
+                extensionId: ext.extensionId,
+                name: ext.name,
+                version: ext.version,
+                shortcode: ext.shortcode,
+                publisher: ext.publisher,
+                description: ext.description,
+                registeredAt: new Date(),
+                loaded: true,
+                hooks: getExtensionHooks(ext),
+            });
+        }
+    }
+    return knownExtensions;
+}
+/**
+ * Get hooks available on an extension
+ */
+function getExtensionHooks(ext) {
+    const hooks = [];
+    if (ext.hooks?.onLoad)
+        hooks.push('hooks.onLoad');
+    if (ext.hooks?.onUnload)
+        hooks.push('hooks.onUnload');
+    if (ext.capability?.preCheck)
+        hooks.push('capability.preCheck');
+    if (ext.capability?.postGrant)
+        hooks.push('capability.postGrant');
+    if (ext.capability?.onExpiry)
+        hooks.push('capability.onExpiry');
+    if (ext.action?.preAction)
+        hooks.push('action.preAction');
+    if (ext.action?.postAction)
+        hooks.push('action.postAction');
+    if (ext.action?.onFailure)
+        hooks.push('action.onFailure');
+    if (ext.monitoring?.verifyBehavior)
+        hooks.push('monitoring.verifyBehavior');
+    if (ext.monitoring?.collectMetrics)
+        hooks.push('monitoring.collectMetrics');
+    if (ext.monitoring?.onAnomaly)
+        hooks.push('monitoring.onAnomaly');
+    if (ext.trust?.onRevocation)
+        hooks.push('trust.onRevocation');
+    if (ext.trust?.adjustTrust)
+        hooks.push('trust.adjustTrust');
+    if (ext.trust?.verifyAttestation)
+        hooks.push('trust.verifyAttestation');
+    if (ext.policy?.evaluate)
+        hooks.push('policy.evaluate');
+    if (ext.policy?.loadPolicy)
+        hooks.push('policy.loadPolicy');
+    return hooks;
+}
+/**
+ * Get extension details by ID
+ */
+async function getExtension(request, reply) {
+    const params = extensionIdParamsSchema.parse(request.params);
+    const service = await getExtensionService();
+    // Find extension by ID or shortcode
+    const extensions = await listExtensionsFromService(service);
+    const extension = extensions.find((ext) => ext.extensionId === params.id || ext.shortcode === params.id);
+    if (!extension) {
+        return sendNotFound(reply, 'Extension', request);
+    }
+    logger.info({ extensionId: extension.extensionId }, 'Retrieved extension details');
+    return sendSuccess(reply, extension, HttpStatus.OK, request);
+}
+/**
+ * Invoke an extension
+ */
+async function invokeExtension(request, reply) {
+    const params = extensionIdParamsSchema.parse(request.params);
+    const body = invokeBodySchema.parse(request.body);
+    const service = await getExtensionService();
+    // Find extension by ID or shortcode
+    const extensions = await listExtensionsFromService(service);
+    const extension = extensions.find((ext) => ext.extensionId === params.id || ext.shortcode === params.id);
+    if (!extension) {
+        return sendNotFound(reply, 'Extension', request);
+    }
+    // Prepare agent identity with the extension in CAR ID string
+    const agent = {
+        ...body.agent,
+        trustTier: body.agent.trustTier,
+        carId: body.agent.carId.includes('#')
+            ? body.agent.carId
+            : `${body.agent.carId}#${extension.shortcode}`,
+    };
+    let result;
+    switch (body.type) {
+        case 'capability': {
+            const capabilityResult = await service.processCapabilityRequest(agent, body.request);
+            result = capabilityResult;
+            logger.info({
+                extensionId: extension.extensionId,
+                type: 'capability',
+                granted: capabilityResult.granted,
+            }, 'Invoked capability request');
+            break;
+        }
+        case 'action': {
+            const actionResult = await service.processAction(agent, body.request);
+            result = actionResult;
+            logger.info({
+                extensionId: extension.extensionId,
+                type: 'action',
+                proceeded: actionResult.proceeded,
+            }, 'Invoked action request');
+            break;
+        }
+        case 'behavior': {
+            const behaviorResult = await service.verifyBehavior(agent);
+            result = behaviorResult;
+            logger.info({
+                extensionId: extension.extensionId,
+                type: 'behavior',
+                inBounds: behaviorResult.inBounds,
+            }, 'Invoked behavior verification');
+            break;
+        }
+    }
+    return sendSuccess(reply, { result }, HttpStatus.OK, request);
+}
+/**
+ * Get extension health/status
+ */
+async function getExtensionStatus(request, reply) {
+    const params = extensionIdParamsSchema.parse(request.params);
+    const service = await getExtensionService();
+    // Find extension by ID or shortcode
+    const extensions = await listExtensionsFromService(service);
+    const extension = extensions.find((ext) => ext.extensionId === params.id || ext.shortcode === params.id);
+    if (!extension) {
+        return sendNotFound(reply, 'Extension', request);
+    }
+    // Build status response
+    const status = {
+        extensionId: extension.extensionId,
+        name: extension.name,
+        version: extension.version,
+        status: extension.loaded ? 'healthy' : 'unhealthy',
+        loaded: extension.loaded,
+        registeredAt: extension.registeredAt,
+        hooks: {
+            total: extension.hooks.length,
+            available: extension.hooks,
+        },
+        capabilities: {
+            hasCapabilityHooks: extension.hooks.some((h) => h.startsWith('capability.')),
+            hasActionHooks: extension.hooks.some((h) => h.startsWith('action.')),
+            hasMonitoringHooks: extension.hooks.some((h) => h.startsWith('monitoring.')),
+            hasTrustHooks: extension.hooks.some((h) => h.startsWith('trust.')),
+            hasPolicyEngine: extension.hooks.some((h) => h.startsWith('policy.')),
+        },
+        timestamp: new Date().toISOString(),
+    };
+    logger.info({ extensionId: extension.extensionId, status: status.status }, 'Retrieved extension status');
+    return sendSuccess(reply, status, HttpStatus.OK, request);
+}
+// =============================================================================
+// ROUTE REGISTRATION
+// =============================================================================
+/**
+ * Extension routes roles
+ */
+export const EXTENSION_ROLES = {
+    /** Roles that can list and read extensions */
+    READ: ['admin', 'tenant:admin', 'extension:admin', 'extension_reader', 'agent:operator'],
+    /** Roles that can invoke extensions */
+    INVOKE: ['admin', 'tenant:admin', 'extension:admin', 'agent:operator'],
+};
+/**
+ * Check if user has required role
+ */
+function hasRequiredRole(userRoles, requiredRoles) {
+    const roles = userRoles ?? [];
+    return roles.some((role) => requiredRoles.includes(role));
+}
+/**
+ * Wrap handler with error handling
+ */
+function withErrorHandling(handler) {
+    return async (request, reply) => {
+        try {
+            return await handler(request, reply);
+        }
+        catch (error) {
+            if (error instanceof ZodError) {
+                const errors = error.errors.map((e) => ({
+                    path: e.path.join('.') || '(root)',
+                    message: e.message,
+                    code: e.code,
+                }));
+                throw new ValidationError('Request validation failed', { errors });
+            }
+            throw error;
+        }
+    };
+}
+/**
+ * Register extension routes
+ *
+ * @param server - Fastify server instance
+ * @param options - Route options
+ */
+export async function registerExtensionRoutes(server, options) {
+    const prefix = options?.prefix ?? '/extensions';
+    // GET /extensions - List all extensions
+    server.get(prefix, withErrorHandling(async (request, reply) => {
+        const user = request.user;
+        if (!hasRequiredRole(user?.roles, EXTENSION_ROLES.READ)) {
+            throw new ForbiddenError('Insufficient permissions to list extensions', {
+                requiredRoles: EXTENSION_ROLES.READ,
+            });
+        }
+        return listExtensions(request, reply);
+    }));
+    // GET /extensions/:id - Get extension details
+    server.get(`${prefix}/:id`, withErrorHandling(async (request, reply) => {
+        const user = request.user;
+        if (!hasRequiredRole(user?.roles, EXTENSION_ROLES.READ)) {
+            throw new ForbiddenError('Insufficient permissions to read extension', {
+                requiredRoles: EXTENSION_ROLES.READ,
+            });
+        }
+        return getExtension(request, reply);
+    }));
+    // POST /extensions/:id/invoke - Invoke extension
+    server.post(`${prefix}/:id/invoke`, withErrorHandling(async (request, reply) => {
+        const user = request.user;
+        if (!hasRequiredRole(user?.roles, EXTENSION_ROLES.INVOKE)) {
+            throw new ForbiddenError('Insufficient permissions to invoke extension', {
+                requiredRoles: EXTENSION_ROLES.INVOKE,
+            });
+        }
+        return invokeExtension(request, reply);
+    }));
+    // GET /extensions/:id/status - Get extension health/status
+    server.get(`${prefix}/:id/status`, withErrorHandling(async (request, reply) => {
+        const user = request.user;
+        if (!hasRequiredRole(user?.roles, EXTENSION_ROLES.READ)) {
+            throw new ForbiddenError('Insufficient permissions to read extension status', {
+                requiredRoles: EXTENSION_ROLES.READ,
+            });
+        }
+        return getExtensionStatus(request, reply);
+    }));
+    logger.info({ prefix }, 'Extension routes registered');
+}
+export default registerExtensionRoutes;
+//# sourceMappingURL=extensions.js.map

package/dist/api/routes/extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../../src/api/routes/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAiB,cAAc,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,EACL,sBAAsB,GAOvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GACf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,WAAW,EAAa,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAE7D,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC;QACF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAC5C,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC;QACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC;KACH,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACpD,0BAA0B;IAC1B,sBAAsB;IACtB,wBAAwB;CACzB,CAAC,CAAC;AAEH,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,IAAI,gBAAgB,GAA+B,IAAI,CAAC;AAExD;;GAEG;AACH,KAAK,UAAU,mBAAmB;IAChC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,gBAAgB,GAAG,sBAAsB,CAAC;YACxC,cAAc,EAAE,IAAI;YACpB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;QAEH,+BAA+B;QAC/B,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,kBAAkB,CAAC,WAAW,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAClG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,kBAAkB,CAAC,WAAW,EAAE,EAAE,yCAAyC,CAAC,CAAC;QACjH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,mBAAmB,CAAC,WAAW,EAAE,EAAE,iCAAiC,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,mBAAmB,CAAC,WAAW,EAAE,EAAE,yCAAyC,CAAC,CAAC;QAClH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,EAAE,EAAE,oCAAoC,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,gBAAgB,GAAG,IAAI,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA4B;IAC9D,gBAAgB,GAAG,OAAO,CAAC;AAC7B,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;GAEG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAuB,EACvB,KAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAE5C,2DAA2D;IAC3D,sFAAsF;IACtF,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAE5D,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAE/D,OAAO,WAAW,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,yBAAyB,CAAC,OAA4B;IACnE,yFAAyF;IACzF,sEAAsE;IACtE,MAAM,eAAe,GAAoB,EAAE,CAAC;IAE5C,kCAAkC;IAClC,MAAM,iBAAiB,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAC;IAEpF,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,sDAAsD;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,QAAQ,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,eAAe,CAAC,IAAI,CAAC;gBACnB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,YAAY,EAAE,IAAI,IAAI,EAAE;gBACxB,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAA8B;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClD,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,GAAG,CAAC,UAAU,EAAE,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAChE,IAAI,GAAG,CAAC,UAAU,EAAE,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,UAAU,EAAE,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAChE,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1D,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,GAAG,CAAC,MAAM,EAAE,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1D,IAAI,GAAG,CAAC,UAAU,EAAE,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,UAAU,EAAE,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,UAAU,EAAE,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,KAAK,EAAE,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,KAAK,EAAE,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,GAAG,CAAC,KAAK,EAAE,iBAAiB;QAAE,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAE5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,YAAY,CACzB,OAAmD,EACnD,KAAmB;IAEnB,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAE5C,oCAAoC;IACpC,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,CACtE,CAAC;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,6BAA6B,CAAC,CAAC;IAEnF,OAAO,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAC5B,OAAmD,EACnD,KAAmB;IAEnB,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAE5C,oCAAoC;IACpC,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,CACtE,CAAC;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,6DAA6D;IAC7D,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,CAAC,KAAK;QACb,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAsB;QAC5C,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK;YAClB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,SAAS,CAAC,SAAS,EAAE;KAChC,CAAC;IAEnB,IAAI,MAAe,CAAC;IAEpB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,wBAAwB,CAC7D,KAAK,EACL,IAAI,CAAC,OAA4B,CAClC,CAAC;YACF,MAAM,GAAG,gBAAgB,CAAC;YAC1B,MAAM,CAAC,IAAI,CACT;gBACE,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,gBAAgB,CAAC,OAAO;aAClC,EACD,4BAA4B,CAC7B,CAAC;YACF,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,aAAa,CAC9C,KAAK,EACL,IAAI,CAAC,OAAwB,CAC9B,CAAC;YACF,MAAM,GAAG,YAAY,CAAC;YACtB,MAAM,CAAC,IAAI,CACT;gBACE,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,YAAY,CAAC,SAAS;aAClC,EACD,wBAAwB,CACzB,CAAC;YACF,MAAM;QACR,CAAC;QAED,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC3D,MAAM,GAAG,cAAc,CAAC;YACxB,MAAM,CAAC,IAAI,CACT;gBACE,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,cAAc,CAAC,QAAQ;aAClC,EACD,+BAA+B,CAChC,CAAC;YACF,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAC/B,OAAmD,EACnD,KAAmB;IAEnB,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAE5C,oCAAoC;IACpC,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,CACtE,CAAC;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,wBAAwB;IACxB,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;QAClD,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,KAAK,EAAE;YACL,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;YAC7B,SAAS,EAAE,SAAS,CAAC,KAAK;SAC3B;QACD,YAAY,EAAE;YACZ,kBAAkB,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAC5E,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpE,kBAAkB,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAC5E,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAClE,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SACtE;QACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAC7D,4BAA4B,CAC7B,CAAC;IAEF,OAAO,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,8CAA8C;IAC9C,IAAI,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;IACxF,uCAAuC;IACvC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,CAAC;CAC9D,CAAC;AAEX;;GAEG;AACH,SAAS,eAAe,CACtB,SAA+B,EAC/B,aAAgC;IAEhC,MAAM,KAAK,GAAG,SAAS,IAAI,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,OAAqE;IAErE,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAqB,EAAE;QAC/E,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACtC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ;oBAClC,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC,CAAC;gBACJ,MAAM,IAAI,eAAe,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAuB,EACvB,OAA6B;IAE7B,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,aAAa,CAAC;IAEhD,wCAAwC;IACxC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAwC,CAAC;QAE9D,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,cAAc,CAAC,6CAA6C,EAAE;gBACtE,aAAa,EAAE,eAAe,CAAC,IAAI;aACpC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC,CAAC;IAEJ,8CAA8C;IAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,EAAE,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAwC,CAAC;QAE9D,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,cAAc,CAAC,4CAA4C,EAAE;gBACrE,aAAa,EAAE,eAAe,CAAC,IAAI;aACpC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,YAAY,CACjB,OAAqD,EACrD,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC,CAAC;IAEJ,iDAAiD;IACjD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,aAAa,EAAE,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAwC,CAAC;QAE9D,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,cAAc,CAAC,8CAA8C,EAAE;gBACvE,aAAa,EAAE,eAAe,CAAC,MAAM;aACtC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,eAAe,CACpB,OAAqD,EACrD,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC,CAAC;IAEJ,2DAA2D;IAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,EAAE,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAwC,CAAC;QAE9D,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,cAAc,CAAC,mDAAmD,EAAE;gBAC5E,aAAa,EAAE,eAAe,CAAC,IAAI;aACpC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,kBAAkB,CACvB,OAAqD,EACrD,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC;AACzD,CAAC;AAED,eAAe,uBAAuB,CAAC"}

package/dist/api/routes/mfa.d.ts

@@ -0,0 +1,44 @@
+/**
+ * MFA API Routes
+ *
+ * REST API endpoints for Multi-Factor Authentication operations including:
+ * - MFA enrollment and verification
+ * - Challenge creation and verification
+ * - Backup code management
+ * - MFA status and disabling
+ *
+ * @packageDocumentation
+ * @module api/routes/mfa
+ */
+import type { FastifyInstance } from 'fastify';
+declare module 'fastify' {
+    interface FastifyRequest {
+        jwtVerify<T = Record<string, unknown>>(): Promise<T>;
+    }
+}
+/**
+ * MFA routes roles
+ */
+export declare const MFA_ROLES: {
+    /** Roles that can manage their own MFA */
+    readonly SELF: readonly ["admin", "tenant:admin", "user"];
+    /** Roles that can view MFA status */
+    readonly READ: readonly ["admin", "tenant:admin", "user", "mfa:reader"];
+};
+/**
+ * Register MFA routes
+ *
+ * @param server - Fastify server instance
+ * @param options - Route options
+ */
+export declare function registerMfaRoutes(server: FastifyInstance, options?: {
+    prefix?: string;
+}): Promise<void>;
+/**
+ * Register MFA routes under v1 API prefix
+ *
+ * @param fastify - Fastify instance
+ */
+export declare function registerMfaRoutesV1(fastify: FastifyInstance): Promise<void>;
+export default registerMfaRoutes;
+//# sourceMappingURL=mfa.d.ts.map

package/dist/api/routes/mfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../../../src/api/routes/mfa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAI7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;KACtD;CACF;AA4WD;;GAEG;AACH,eAAO,MAAM,SAAS;IACpB,0CAA0C;;IAE1C,qCAAqC;;CAE7B,CAAC;AAEX;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,eAAe,EACvB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAqEf;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjF;AAED,eAAe,iBAAiB,CAAC"}