@vorionsys/security 1.0.0

package/dist/auth/mfa/webauthn.js

@@ -0,0 +1,409 @@
+/**
+ * WebAuthn/FIDO2 MFA Implementation for Vorion Platform
+ *
+ * Provides secure passwordless authentication using WebAuthn standard.
+ * Supports multiple authenticators per user including YubiKey, Touch ID,
+ * Windows Hello, and other FIDO2-compliant devices.
+ *
+ * @module auth/mfa/webauthn
+ */
+import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse, } from '@simplewebauthn/server';
+import { createLogger } from '../../common/logger.js';
+const logger = createLogger({ component: 'webauthn' });
+/**
+ * Default WebAuthn configuration
+ */
+const DEFAULT_CONFIG = {
+    rpName: 'Vorion',
+    rpId: 'vorion.ai',
+    origin: 'https://vorion.ai',
+    attestation: 'none',
+    userVerification: 'preferred',
+    timeout: 60000,
+};
+/**
+ * In-memory challenge store with TTL support
+ * In production, this should be replaced with Redis or similar
+ */
+class ChallengeStore {
+    challenges = new Map();
+    defaultTTL = 300000; // 5 minutes
+    /**
+     * Store a challenge with automatic expiration
+     * @param userId - User identifier
+     * @param challenge - The challenge string
+     * @param ttl - Time to live in milliseconds
+     */
+    set(userId, challenge, ttl = this.defaultTTL) {
+        const entry = {
+            challenge,
+            userId,
+            expiresAt: Date.now() + ttl,
+        };
+        this.challenges.set(userId, entry);
+        this.cleanup();
+    }
+    /**
+     * Retrieve and delete a challenge (one-time use)
+     * @param userId - User identifier
+     * @returns The challenge if valid and not expired, undefined otherwise
+     */
+    get(userId) {
+        const entry = this.challenges.get(userId);
+        if (!entry) {
+            return undefined;
+        }
+        // Delete after retrieval (one-time use)
+        this.challenges.delete(userId);
+        // Check expiration
+        if (Date.now() > entry.expiresAt) {
+            logger.warn('Challenge expired', { userId });
+            return undefined;
+        }
+        return entry.challenge;
+    }
+    /**
+     * Remove expired challenges
+     */
+    cleanup() {
+        const now = Date.now();
+        for (const [key, entry] of this.challenges.entries()) {
+            if (now > entry.expiresAt) {
+                this.challenges.delete(key);
+            }
+        }
+    }
+}
+/**
+ * WebAuthn service for handling FIDO2 registration and authentication
+ *
+ * @example
+ * ```typescript
+ * const webauthn = getWebAuthnService({
+ *   rpName: 'Vorion',
+ *   rpId: 'vorion.ai',
+ *   origin: 'https://vorion.ai'
+ * });
+ *
+ * // Generate registration options
+ * const options = await webauthn.generateRegistrationOpts(
+ *   'user-123',
+ *   'john@vorion.ai'
+ * );
+ *
+ * // After user completes registration on client
+ * const credential = await webauthn.verifyRegistration(
+ *   'user-123',
+ *   clientResponse,
+ *   expectedChallenge
+ * );
+ * ```
+ */
+export class WebAuthnService {
+    config;
+    challengeStore;
+    /**
+     * Create a new WebAuthn service instance
+     * @param config - Partial configuration (merged with defaults)
+     */
+    constructor(config = {}) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+        this.challengeStore = new ChallengeStore();
+        logger.info('WebAuthn service initialized', {
+            rpId: this.config.rpId,
+            rpName: this.config.rpName,
+        });
+    }
+    /**
+     * Generate registration options for a new WebAuthn credential
+     *
+     * Creates the necessary options for the WebAuthn navigator.credentials.create() call.
+     * Excludes any existing credentials to prevent duplicate registration.
+     *
+     * @param userId - Unique user identifier
+     * @param userName - Human-readable user name (usually email)
+     * @param existingCredentials - User's existing credentials to exclude
+     * @returns PublicKeyCredentialCreationOptionsJSON for client-side registration
+     *
+     * @example
+     * ```typescript
+     * const options = await service.generateRegistrationOpts(
+     *   'user-123',
+     *   'john@vorion.ai',
+     *   existingCredentials
+     * );
+     * // Send options to client for navigator.credentials.create()
+     * ```
+     */
+    async generateRegistrationOpts(userId, userName, existingCredentials = []) {
+        logger.debug('Generating registration options', { userId, userName });
+        // Convert existing credentials to exclude format
+        const excludeCredentials = existingCredentials.map((cred) => ({
+            id: cred.credentialId,
+            transports: cred.transports,
+        }));
+        const options = await generateRegistrationOptions({
+            rpName: this.config.rpName,
+            rpID: this.config.rpId,
+            userName,
+            userDisplayName: userName,
+            timeout: this.config.timeout,
+            attestationType: this.config.attestation,
+            excludeCredentials,
+            authenticatorSelection: {
+                residentKey: 'preferred',
+                userVerification: this.config.userVerification,
+            },
+            supportedAlgorithmIDs: [-7, -257], // ES256 and RS256
+        });
+        // Store challenge for verification
+        this.challengeStore.set(userId, options.challenge, this.config.timeout);
+        logger.info('Registration options generated', {
+            userId,
+            challenge: options.challenge.substring(0, 10) + '...',
+        });
+        return options;
+    }
+    /**
+     * Verify a registration response from the client
+     *
+     * Validates the attestation and creates a new credential record.
+     *
+     * @param userId - User identifier (must match the one used in generateRegistrationOpts)
+     * @param response - Registration response from navigator.credentials.create()
+     * @param expectedChallenge - The challenge that was sent to the client
+     * @returns The verified WebAuthn credential to store
+     * @throws Error if verification fails
+     *
+     * @example
+     * ```typescript
+     * try {
+     *   const credential = await service.verifyRegistration(
+     *     'user-123',
+     *     clientResponse,
+     *     storedChallenge
+     *   );
+     *   // Save credential to database
+     * } catch (error) {
+     *   console.error('Registration failed:', error.message);
+     * }
+     * ```
+     */
+    async verifyRegistration(userId, response, expectedChallenge) {
+        logger.debug('Verifying registration', { userId });
+        let verification;
+        try {
+            verification = await verifyRegistrationResponse({
+                response,
+                expectedChallenge,
+                expectedOrigin: this.config.origin,
+                expectedRPID: this.config.rpId,
+                requireUserVerification: this.config.userVerification === 'required',
+            });
+        }
+        catch (error) {
+            logger.error('Registration verification failed', {
+                userId,
+                error: error instanceof Error ? error.message : 'Unknown error',
+            });
+            throw new Error(`Registration verification failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+        if (!verification.verified || !verification.registrationInfo) {
+            logger.warn('Registration not verified', { userId });
+            throw new Error('Registration verification failed');
+        }
+        const { registrationInfo } = verification;
+        // Create credential record - v10 API uses flat structure
+        const credential = {
+            id: this.generateCredentialId(),
+            credentialId: registrationInfo.credentialID,
+            publicKey: this.uint8ArrayToBase64Url(registrationInfo.credentialPublicKey),
+            counter: registrationInfo.counter,
+            deviceType: registrationInfo.credentialDeviceType,
+            backedUp: registrationInfo.credentialBackedUp,
+            transports: registrationInfo.transports,
+            createdAt: new Date(),
+        };
+        logger.info('Registration verified successfully', {
+            userId,
+            credentialId: credential.id,
+            deviceType: credential.deviceType,
+            backedUp: credential.backedUp,
+        });
+        return credential;
+    }
+    /**
+     * Generate authentication options for WebAuthn login
+     *
+     * Creates options for navigator.credentials.get() call.
+     *
+     * @param existingCredentials - User's registered credentials
+     * @returns PublicKeyCredentialRequestOptionsJSON for client-side authentication
+     *
+     * @example
+     * ```typescript
+     * const options = await service.generateAuthenticationOpts(userCredentials);
+     * // Send options to client for navigator.credentials.get()
+     * ```
+     */
+    async generateAuthenticationOpts(existingCredentials) {
+        logger.debug('Generating authentication options', {
+            credentialCount: existingCredentials.length,
+        });
+        if (existingCredentials.length === 0) {
+            throw new Error('No credentials available for authentication');
+        }
+        // Convert credentials to allowCredentials format
+        const allowCredentials = existingCredentials.map((cred) => ({
+            id: cred.credentialId,
+            transports: cred.transports,
+        }));
+        const options = await generateAuthenticationOptions({
+            rpID: this.config.rpId,
+            timeout: this.config.timeout,
+            allowCredentials,
+            userVerification: this.config.userVerification,
+        });
+        // Store challenge - use first credential's ID as key for lookup
+        // In practice, you'd use a session ID or similar
+        const sessionKey = `auth:${existingCredentials[0].id}`;
+        this.challengeStore.set(sessionKey, options.challenge, this.config.timeout);
+        logger.info('Authentication options generated', {
+            allowedCredentials: existingCredentials.length,
+            challenge: options.challenge.substring(0, 10) + '...',
+        });
+        return options;
+    }
+    /**
+     * Verify an authentication response from the client
+     *
+     * Validates the assertion and checks the signature counter to prevent replay attacks.
+     *
+     * @param credential - The stored credential being used
+     * @param response - Authentication response from navigator.credentials.get()
+     * @param expectedChallenge - The challenge that was sent to the client
+     * @returns Object containing verification status and new counter value
+     * @throws Error if verification fails
+     *
+     * @example
+     * ```typescript
+     * const result = await service.verifyAuthentication(
+     *   storedCredential,
+     *   clientResponse,
+     *   storedChallenge
+     * );
+     *
+     * if (result.verified) {
+     *   // Update credential counter in database
+     *   credential.counter = result.newCounter;
+     *   credential.lastUsedAt = new Date();
+     * }
+     * ```
+     */
+    async verifyAuthentication(credential, response, expectedChallenge) {
+        logger.debug('Verifying authentication', { credentialId: credential.id });
+        let verification;
+        try {
+            verification = await verifyAuthenticationResponse({
+                response,
+                expectedChallenge,
+                expectedOrigin: this.config.origin,
+                expectedRPID: this.config.rpId,
+                authenticator: {
+                    credentialID: credential.credentialId,
+                    credentialPublicKey: this.base64UrlToUint8Array(credential.publicKey),
+                    counter: credential.counter,
+                    transports: credential.transports,
+                },
+                requireUserVerification: this.config.userVerification === 'required',
+            });
+        }
+        catch (error) {
+            logger.error('Authentication verification failed', {
+                credentialId: credential.id,
+                error: error instanceof Error ? error.message : 'Unknown error',
+            });
+            throw new Error(`Authentication verification failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+        if (!verification.verified) {
+            logger.warn('Authentication not verified', { credentialId: credential.id });
+            return { verified: false, newCounter: credential.counter };
+        }
+        const { authenticationInfo } = verification;
+        const newCounter = authenticationInfo.newCounter;
+        // Check for counter rollback (potential cloned authenticator)
+        if (newCounter <= credential.counter && credential.counter !== 0) {
+            logger.error('Counter rollback detected - possible cloned authenticator', {
+                credentialId: credential.id,
+                storedCounter: credential.counter,
+                receivedCounter: newCounter,
+            });
+            throw new Error('Counter rollback detected - authentication rejected');
+        }
+        logger.info('Authentication verified successfully', {
+            credentialId: credential.id,
+            oldCounter: credential.counter,
+            newCounter,
+        });
+        return {
+            verified: true,
+            newCounter,
+        };
+    }
+    /**
+     * Get a stored challenge for a user (consumes the challenge)
+     * @param userId - User identifier
+     * @returns The stored challenge or undefined if not found/expired
+     */
+    getStoredChallenge(userId) {
+        return this.challengeStore.get(userId);
+    }
+    /**
+     * Generate a unique credential ID
+     */
+    generateCredentialId() {
+        const bytes = new Uint8Array(16);
+        crypto.getRandomValues(bytes);
+        return this.uint8ArrayToBase64Url(bytes);
+    }
+    /**
+     * Convert Uint8Array to base64url string
+     */
+    uint8ArrayToBase64Url(array) {
+        const base64 = Buffer.from(array).toString('base64');
+        return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+    }
+    /**
+     * Convert base64url string to Uint8Array
+     */
+    base64UrlToUint8Array(base64url) {
+        const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
+        const paddedBase64 = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+        return new Uint8Array(Buffer.from(paddedBase64, 'base64'));
+    }
+}
+/**
+ * Factory function to create a WebAuthn service instance
+ *
+ * @param config - Partial WebAuthn configuration (merged with defaults)
+ * @returns Configured WebAuthnService instance
+ *
+ * @example
+ * ```typescript
+ * // Basic usage with defaults
+ * const webauthn = getWebAuthnService();
+ *
+ * // Custom configuration
+ * const webauthn = getWebAuthnService({
+ *   rpName: 'My App',
+ *   rpId: 'myapp.com',
+ *   origin: 'https://myapp.com',
+ *   userVerification: 'required',
+ * });
+ * ```
+ */
+export function getWebAuthnService(config = {}) {
+    return new WebAuthnService(config);
+}
+export default WebAuthnService;
+//# sourceMappingURL=webauthn.js.map

package/dist/auth/mfa/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../../src/auth/mfa/webauthn.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;AAyBvD;;GAEG;AACH,MAAM,cAAc,GAAmB;IACrC,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,mBAAmB;IAC3B,WAAW,EAAE,MAAM;IACnB,gBAAgB,EAAE,WAAW;IAC7B,OAAO,EAAE,KAAK;CACf,CAAC;AAqCF;;;GAGG;AACH,MAAM,cAAc;IACV,UAAU,GAAgC,IAAI,GAAG,EAAE,CAAC;IAC3C,UAAU,GAAW,MAAM,CAAC,CAAC,YAAY;IAE1D;;;;;OAKG;IACH,GAAG,CAAC,MAAc,EAAE,SAAiB,EAAE,MAAc,IAAI,CAAC,UAAU;QAClE,MAAM,KAAK,GAAmB;YAC5B,SAAS;YACT,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;SAC5B,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,MAAc;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE/B,mBAAmB;QACnB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,CAAC,SAAS,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,eAAe;IACT,MAAM,CAAiB;IACvB,cAAc,CAAiB;IAEhD;;;OAGG;IACH,YAAY,SAAkC,EAAE;QAC9C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;QAC/C,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC1C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC3B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,wBAAwB,CAC5B,MAAc,EACd,QAAgB,EAChB,sBAA4C,EAAE;QAE9C,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEtE,iDAAiD;QACjD,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5D,EAAE,EAAE,IAAI,CAAC,YAAY;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC,CAAC;QAEJ,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,QAAQ;YACR,eAAe,EAAE,QAAQ;YACzB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACxC,kBAAkB;YAClB,sBAAsB,EAAE;gBACtB,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;aAC/C;YACD,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,kBAAkB;SACtD,CAAC,CAAC;QAEH,mCAAmC;QACnC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAExE,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YAC5C,MAAM;YACN,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;SACtD,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,kBAAkB,CACtB,MAAc,EACd,QAAkC,EAClC,iBAAyB;QAEzB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnD,IAAI,YAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,0BAA0B,CAAC;gBAC9C,QAAQ;gBACR,iBAAiB;gBACjB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAClC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBAC9B,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,KAAK,UAAU;aACrE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;gBAC/C,MAAM;gBACN,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAChE,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QACnH,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC;QAE1C,yDAAyD;QACzD,MAAM,UAAU,GAAuB;YACrC,EAAE,EAAE,IAAI,CAAC,oBAAoB,EAAE;YAC/B,YAAY,EAAE,gBAAgB,CAAC,YAAY;YAC3C,SAAS,EAAE,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;YAC3E,OAAO,EAAE,gBAAgB,CAAC,OAAO;YACjC,UAAU,EAAE,gBAAgB,CAAC,oBAAoB;YACjD,QAAQ,EAAE,gBAAgB,CAAC,kBAAkB;YAC7C,UAAU,EAAG,gBAAwB,CAAC,UAAU;YAChD,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;YAChD,MAAM;YACN,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,0BAA0B,CAC9B,mBAAyC;QAEzC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;YAChD,eAAe,EAAE,mBAAmB,CAAC,MAAM;SAC5C,CAAC,CAAC;QAEH,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,iDAAiD;QACjD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1D,EAAE,EAAE,IAAI,CAAC,YAAY;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC,CAAC;QAEJ,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,gBAAgB;YAChB,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SAC/C,CAAC,CAAC;QAEH,gEAAgE;QAChE,iDAAiD;QACjD,MAAM,UAAU,GAAG,QAAQ,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE5E,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC9C,kBAAkB,EAAE,mBAAmB,CAAC,MAAM;YAC9C,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;SACtD,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,oBAAoB,CACxB,UAA8B,EAC9B,QAAoC,EACpC,iBAAyB;QAEzB,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAE1E,IAAI,YAA4C,CAAC;QACjD,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,4BAA4B,CAAC;gBAChD,QAAQ;gBACR,iBAAiB;gBACjB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAClC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBAC9B,aAAa,EAAE;oBACb,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,mBAAmB,EAAE,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,SAAS,CAAC;oBACrE,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;iBAClC;gBACD,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,KAAK,UAAU;aACrE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;gBACjD,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAChE,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QACrH,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC;QAC5C,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC;QAEjD,8DAA8D;QAC9D,IAAI,UAAU,IAAI,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;gBACxE,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,aAAa,EAAE,UAAU,CAAC,OAAO;gBACjC,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;YAClD,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,UAAU,EAAE,UAAU,CAAC,OAAO;YAC9B,UAAU;SACX,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,MAAc;QAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACK,oBAAoB;QAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,KAAiB;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,SAAiB;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAkC,EAAE;IACrE,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,eAAe,eAAe,CAAC"}

package/dist/auth/sso/index.d.ts

@@ -0,0 +1,247 @@
+/**
+ * SSO/OIDC Module for Vorion Platform
+ *
+ * Provides enterprise SSO capabilities with support for multiple OIDC providers
+ * including Okta, Azure AD, Google, and generic OIDC implementations.
+ *
+ * Uses dynamic imports to work with ESM-only openid-client v6.
+ *
+ * @module auth/sso
+ */
+import { type OIDCProvider, OIDCError } from './oidc-provider.js';
+import { type OIDCProviderConfig, type AuthorizationState, type AuthorizationUrlResult, type TokenExchangeRequest, type TokenExchangeResult, type TokenRefreshResult, type OIDCTokenSet, type IDTokenClaims, type OIDCUserInfo, type SSOSession, type SSOErrorCode, type SSOManagerConfig } from './types.js';
+export { OIDCError } from './oidc-provider.js';
+/**
+ * SSO Manager Error
+ */
+export declare class SSOError extends OIDCError {
+    constructor(message: string, code: SSOErrorCode, options?: {
+        providerId?: string;
+        originalError?: Error;
+        details?: Record<string, unknown>;
+    });
+}
+/**
+ * SSOManager - Manages multiple OIDC providers and SSO flows
+ *
+ * Provides a unified interface for SSO authentication across multiple identity providers.
+ * Supports PKCE-enhanced authorization code flow, token management, user provisioning,
+ * and tenant mapping.
+ *
+ * @example
+ * ```typescript
+ * const manager = getSSOManager({
+ *   onProvisionUser: async (user) => {
+ *     const userId = await userService.createUser(user);
+ *     return userId;
+ *   },
+ *   onLookupUser: async (providerId, externalId) => {
+ *     return userService.findByExternalId(providerId, externalId);
+ *   }
+ * });
+ *
+ * // Register a provider
+ * await manager.registerProvider({
+ *   id: 'okta-prod',
+ *   name: 'Okta Production',
+ *   type: 'okta',
+ *   enabled: true,
+ *   issuer: 'https://company.okta.com',
+ *   clientId: 'xxx',
+ *   clientSecret: 'xxx',
+ *   redirectUri: 'https://app.example.com/auth/callback',
+ *   scopes: ['openid', 'profile', 'email'],
+ *   pkceEnabled: true,
+ *   tenantMapping: 'domain',
+ *   domainTenantMap: { 'company.com': 'tenant-1' },
+ *   jitProvisioningEnabled: true,
+ *   requestRefreshToken: true,
+ * });
+ *
+ * // Start login
+ * const { url, state } = await manager.startLogin('okta-prod', {
+ *   returnUrl: '/dashboard'
+ * });
+ *
+ * // Complete login after callback
+ * const result = await manager.completeLogin({
+ *   code: callbackCode,
+ *   state: callbackState,
+ *   storedState: savedState
+ * });
+ * ```
+ */
+export declare class SSOManager {
+    private readonly config;
+    private readonly providers;
+    private readonly providerConfigs;
+    private readonly sessions;
+    private readonly stateStore;
+    constructor(config?: Partial<SSOManagerConfig>);
+    /**
+     * Register an OIDC provider
+     */
+    registerProvider(config: OIDCProviderConfig): Promise<void>;
+    /**
+     * Unregister an OIDC provider
+     */
+    unregisterProvider(providerId: string): boolean;
+    /**
+     * Get a provider by ID
+     */
+    getProvider(providerId: string): OIDCProvider | undefined;
+    /**
+     * Get provider configuration by ID
+     */
+    getProviderConfig(providerId: string): OIDCProviderConfig | undefined;
+    /**
+     * List all registered providers
+     */
+    listProviders(): Array<{
+        id: string;
+        name: string;
+        type: string;
+        enabled: boolean;
+    }>;
+    /**
+     * List enabled providers only
+     */
+    listEnabledProviders(): Array<{
+        id: string;
+        name: string;
+        type: string;
+    }>;
+    /**
+     * Enable a provider
+     */
+    enableProvider(providerId: string): Promise<void>;
+    /**
+     * Disable a provider
+     */
+    disableProvider(providerId: string): void;
+    /**
+     * Start login flow - generate authorization URL
+     */
+    startLogin(providerId: string, options?: {
+        returnUrl?: string;
+        tenantId?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<AuthorizationUrlResult>;
+    /**
+     * Complete login flow - exchange code for tokens
+     */
+    completeLogin(request: TokenExchangeRequest, options?: {
+        fetchUserInfo?: boolean;
+    }): Promise<TokenExchangeResult>;
+    /**
+     * Validate and retrieve stored state
+     */
+    getStoredState(stateParam: string): AuthorizationState | undefined;
+    /**
+     * Clean up expired states
+     */
+    cleanupExpiredStates(): number;
+    /**
+     * Refresh tokens for a session
+     */
+    refreshTokens(providerId: string, refreshToken: string): Promise<TokenRefreshResult>;
+    /**
+     * Revoke a token
+     */
+    revokeToken(providerId: string, token: string, tokenTypeHint?: 'access_token' | 'refresh_token'): Promise<void>;
+    /**
+     * Fetch user info with access token
+     */
+    fetchUserInfo(providerId: string, accessToken: string): Promise<OIDCUserInfo>;
+    /**
+     * Create an SSO session
+     */
+    createSession(userId: string, providerId: string, externalSubjectId: string, tenantId: string, tokens: OIDCTokenSet, claims: IDTokenClaims, metadata?: Record<string, unknown>): SSOSession;
+    /**
+     * Get an SSO session
+     */
+    getSession(sessionId: string): SSOSession | undefined;
+    /**
+     * Update session tokens (after refresh)
+     */
+    updateSessionTokens(sessionId: string, tokens: OIDCTokenSet, claims?: IDTokenClaims): boolean;
+    /**
+     * Terminate an SSO session
+     */
+    terminateSession(sessionId: string): Promise<boolean>;
+    /**
+     * Get sessions for a user
+     */
+    getSessionsForUser(userId: string): SSOSession[];
+    /**
+     * Terminate all sessions for a user
+     */
+    terminateSessionsForUser(userId: string): Promise<number>;
+    /**
+     * Generate logout URL for a provider
+     */
+    generateLogoutUrl(providerId: string, options?: {
+        idToken?: string;
+        postLogoutRedirectUri?: string;
+        state?: string;
+    }): string | null;
+    /**
+     * Perform full logout (terminate session and generate logout URL)
+     */
+    logout(sessionId: string, options?: {
+        postLogoutRedirectUri?: string;
+    }): Promise<{
+        logoutUrl: string | null;
+    }>;
+    /**
+     * Resolve tenant ID from claims and configuration
+     */
+    private resolveTenant;
+    /**
+     * Resolve user - look up existing or provision new user
+     */
+    private resolveUser;
+    /**
+     * Provision a new user via JIT
+     */
+    private provisionUser;
+    /**
+     * Get an initialized provider or throw
+     */
+    private getInitializedProvider;
+    /**
+     * Generate a unique session ID
+     */
+    private generateSessionId;
+    /**
+     * Emit an audit event
+     */
+    private emitAuditEvent;
+    /**
+     * Clear all caches
+     */
+    clearAllCaches(): void;
+    /**
+     * Get manager statistics
+     */
+    getStats(): {
+        providers: number;
+        enabledProviders: number;
+        activeSessions: number;
+        pendingStates: number;
+    };
+}
+/**
+ * Get the singleton SSOManager instance
+ *
+ * @param config - Configuration (only used on first call)
+ * @returns The SSOManager singleton
+ */
+export declare function getSSOManager(config?: Partial<SSOManagerConfig>): SSOManager;
+/**
+ * Reset the singleton instance (primarily for testing)
+ */
+export declare function resetSSOManager(): void;
+export { type OIDCProviderConfig, type OIDCProviderType, type TenantMappingStrategy, type JITClaimMappings, type AuthorizationState, type AuthorizationUrlResult, type TokenExchangeRequest, type TokenExchangeResult, type TokenRefreshResult, type OIDCTokenSet, type IDTokenClaims, type OIDCUserInfo, type JITProvisionedUser, type SSOSession, type SSOAuditEvent, type SSOEventType, type SSOManagerConfig, type SSOErrorCode, type SSOErrorDetails, OIDCProviderConfigSchema, AuthorizationCallbackSchema, DEFAULT_SSO_MANAGER_CONFIG, } from './types.js';
+export { OIDCProvider, createOIDCProvider, clearAllDiscoveryCaches, } from './oidc-provider.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/sso/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/sso/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,KAAK,YAAY,EACjB,SAAS,EAGV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,EAGf,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAGtB,MAAM,YAAY,CAAC;AAQpB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C;;GAEG;AACH,qBAAa,QAAS,SAAQ,SAAS;gBAEnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAClB,OAAO,CAAC,EAAE;QACR,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,KAAK,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC;CAKJ;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAC7D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyC;IACzE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyC;gBAExD,MAAM,GAAE,OAAO,CAAC,gBAAgB,CAAM;IAalD;;OAEG;IACG,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CjE;;OAEG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAe/C;;OAEG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAIzD;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIrE;;OAEG;IACH,aAAa,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IASpF;;OAEG;IACH,oBAAoB,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAUzE;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBvD;;OAEG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAwBzC;;OAEG;IACG,UAAU,CACd,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GACA,OAAO,CAAC,sBAAsB,CAAC;IA8BlC;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,GACA,OAAO,CAAC,mBAAmB,CAAC;IAoF/B;;OAEG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAgBlE;;OAEG;IACH,oBAAoB,IAAI,MAAM;IAwB9B;;OAEG;IACG,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAgB9B;;OAEG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAC/C,OAAO,CAAC,IAAI,CAAC;IAchB;;OAEG;IACG,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC;IASxB;;OAEG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,aAAa,EACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,UAAU;IAuCb;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIrD;;OAEG;IACH,mBAAmB,CACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,EACpB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO;IAeV;;OAEG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0C3D;;OAEG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE;IAMhD;;OAEG;IACG,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB/D;;OAEG;IACH,iBAAiB,CACf,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GACA,MAAM,GAAG,IAAI;IAKhB;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QACR,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,GACA,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IA0BxC;;OAEG;IACH,OAAO,CAAC,aAAa;IAsErB;;OAEG;YACW,WAAW;IAqCzB;;OAEG;YACW,aAAa;IA2G3B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA8B9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAQzB;;OAEG;YACW,cAAc;IAU5B;;OAEG;IACH,cAAc,IAAI,IAAI;IAMtB;;OAEG;IACH,QAAQ,IAAI;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;KACvB;CAQF;AAQD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,UAAU,CAK5E;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAMtC;AAOD,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,wBAAwB,EACxB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC"}