@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.d.ts

@@ -0,0 +1,366 @@
+import 'reflect-metadata';
+import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
+import { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service.js';
+import type { ServicesRegistryHandlerBackendService } from '../../../base-classes/services/services/services-registry-handler.backend.service.js';
+import { ExecutionContext } from '../../../runtime/models/execution-context.backend.schemas.js';
+import { AuthIdentificationRequest, PasswordAuthRequest } from '@wildo-ai/saas-models';
+import { AuthMethod, AuthIdentificationResponse, AuthenticationRequest, AuthenticationResponse, AuthenticationSession } from '@wildo-ai/saas-models';
+import { AuthSessionPurpose } from '@wildo-ai/saas-models';
+import type { EmailOTPAuthRequest, TOTPAuthRequest, PasskeyAuthRequest, SMSOTPAuthRequest, MagicLinkSendRequest, MagicLinkVerifyRequest } from '@wildo-ai/saas-models';
+import { AppConfigurationService } from '../../../config/services/app-configuration.backend.service.js';
+import { AuditLogsBackendService } from '../../../compliance/audit-trails/services/audit-logs.backend.service.js';
+import { AuthSessionStoreBackendService } from '../../../security/authentications/services/auth-session-store.backend.service.js';
+import { AuthCredentialVerifierBackendService } from '../../../security/authentications/services/auth-credential-verifier.backend.service.js';
+import { AuthTokenIssuerBackendService, type AuthTokens } from '../../../security/authentications/services/auth-token-issuer.backend.service.js';
+import { WebAuthnBackendService } from '../../../security/authentications/services/auth-methods/webauthn.backend.service.js';
+import { ConsumableTokenBackendService } from '../../../security/consumable-tokens/services/consumable-token.backend.service.js';
+import { RedisService } from '../../../databases/services/redis.service.js';
+import { RateLimitBackendService } from '../../../errors/services/rate-limit.backend.service.js';
+import { DomainToOrgLookupBackendService } from '../../../security/authentications/services/admin-config/domain-to-org-lookup.backend.service.js';
+import { AuthOrganizationConfigurationService } from '../../../security/authentications/services/admin-config/auth-organization-configuration.service.js';
+import { OAuth2ConnectionResolverBackendService } from '../../../security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.js';
+import { AuthUserLookupBackendService } from '../../../security/authentications/services/utils/auth-user-lookup.backend.service.js';
+import { AuthCredentialOpsBackendService } from '../../../security/authentications/services/utils/auth-credential-ops.backend.service.js';
+/**
+ * AuthenticationOrchestratorBackendService
+ *
+ * Orchestrates the authentication flow: identify → authenticate → tokens.
+ *
+ * Decomposed from the original AuthenticationBackendService (1900 lines → ~400 lines).
+ * Session storage, credential verification, and token issuance are delegated to
+ * focused sub-services (AuthSessionStore, AuthCredentialVerifier, AuthTokenIssuer).
+ *
+ * Public API preserved:
+ * - identify(request) → AuthIdentificationResponse
+ * - authenticate(request) → AuthenticationResponse
+ * - authenticatePassword(request) → AuthenticationResponse
+ * - getAuthenticationSessionState(sessionId) → AuthenticationSession | null
+ *
+ * TRAP 2: The controller calls exactly these methods. Signatures accept EC as the first parameter.
+ * TRAP 9: Dependency arrows flow one way: Orchestrator → Services → Infrastructure.
+ * TRAP 13: Audit logging stays here (not in sub-services).
+ */
+export declare class AuthenticationOrchestratorBackendService {
+    private readonly logger;
+    private readonly appConfigService;
+    private readonly errorBuilder;
+    private readonly servicesRegistryHandler;
+    private readonly auditLogsService;
+    private readonly sessionStore;
+    private readonly credentialVerifier;
+    private readonly tokenIssuer;
+    private readonly consumableTokenService;
+    private readonly redisService;
+    private readonly rateLimitService;
+    private readonly domainToOrgLookup;
+    private readonly orgConfigService;
+    private readonly webAuthnService;
+    private readonly oauth2Resolver;
+    private readonly userLookup;
+    private readonly credentialOps;
+    /** L11: Default session duration in minutes (absolute TTL). Overridden by userTypes[t].auth.sessionDurationMinutes. */
+    private static readonly DEFAULT_SESSION_DURATION_MINUTES;
+    /** Idle timeout in minutes — session is deleted if lastActivity exceeds this. Must be < SESSION_DURATION_MINUTES. */
+    private static readonly AUTH_SESSION_IDLE_TIMEOUT_MINUTES;
+    /** Default number of MFA methods required (for future MFA support). */
+    private static readonly DEFAULT_MFA_METHODS_REQUIRED;
+    private readonly logDebug;
+    constructor(logger: LoggerService, appConfigService: AppConfigurationService, errorBuilder: ErrorBuilderBackendService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, auditLogsService: AuditLogsBackendService, sessionStore: AuthSessionStoreBackendService, credentialVerifier: AuthCredentialVerifierBackendService, tokenIssuer: AuthTokenIssuerBackendService, consumableTokenService: ConsumableTokenBackendService, redisService: RedisService, rateLimitService: RateLimitBackendService, domainToOrgLookup: DomainToOrgLookupBackendService, orgConfigService: AuthOrganizationConfigurationService, webAuthnService: WebAuthnBackendService, oauth2Resolver: OAuth2ConnectionResolverBackendService, userLookup: AuthUserLookupBackendService, credentialOps: AuthCredentialOpsBackendService);
+    /**
+     * Global lockout policy for email-scoped rate limiting (pre-authentication, user type unknown).
+     * Computed as the most-restrictive lockout across all configured user types:
+     * lowest maxLoginAttempts, longest lockoutDuration, progressive if any type uses it.
+     */
+    private get lockoutPolicy();
+    private get otpConfig();
+    private get magicLinkConfig();
+    private get totpConfig();
+    /**
+     * Resolve the effective auth policy for a given user type.
+     * If the user type exists in config.userTypes, returns its auth policy.
+     * Falls back to FALLBACK_AUTH_POLICY when no user type is configured.
+     */
+    private _resolveAuthPolicy;
+    /**
+     * W6.8: Safe default auth policy when no user type is resolved.
+     * All values are restrictive-safe. Applications MUST configure userTypes for full control.
+     */
+    private static readonly FALLBACK_AUTH_POLICY;
+    /**
+     * AUTH-14: Resolve auth policy with org override merging for a known user.
+     * Use this instead of _resolveAuthPolicy when userId is available.
+     * Falls back to raw user-type policy if org resolution fails.
+     */
+    private _resolveAuthPolicyWithOrgOverrides;
+    /**
+     * W6.8: Check if an auth method is enabled in ANY configured user type.
+     * Used for pre-identification guards (sendMagicLink, sendSMSOTP) where
+     * the user type is not yet known.
+     */
+    private _isMethodEnabledGlobally;
+    /**
+     * Resolve auth policy from a session's activeUserType. Convenience wrapper.
+     */
+    private _resolveAuthPolicyFromSession;
+    private _assertFrontendServiceAuthAllowed;
+    private _getSessionTtlSeconds;
+    /**
+     * Create a new authentication session in the store.
+     */
+    /** W4: Registration sessions get longer TTL (24h) to match email verification token expiry. */
+    private static readonly REGISTRATION_SESSION_TTL_SECONDS;
+    private createSession;
+    /**
+     * Get and validate a session. Returns null if not found, expired, or idle-timed-out.
+     */
+    private getSession;
+    /** Maximum retries for atomic session updates before falling back to non-atomic write. */
+    private static readonly ATOMIC_UPDATE_MAX_RETRIES;
+    /**
+     * Update a session in the store using atomic compare-and-swap (M1 fix).
+     *
+     * Uses the session `version` field for optimistic concurrency control.
+     * On version mismatch (concurrent writer), re-reads and retries up to MAX_RETRIES.
+     * Falls back to a non-atomic write only if all retries are exhausted.
+     */
+    private updateSession;
+    /**
+     * Remove a session from the store.
+     */
+    private removeSession;
+    /**
+     * Increment session attempts and check for lockout.
+     * W3.1: Uses per-user-type lockout policy from session's activeUserType.
+     */
+    private incrementSessionAttempts;
+    /**
+     * Get the current global attempt count for an email address.
+     */
+    private _getGlobalAttempts;
+    /**
+     * Increment the global attempt counter for an email.
+     * Returns the new count and whether the account is locked.
+     * The key auto-expires after the lockout duration.
+     */
+    private _incrementGlobalAttempts;
+    /**
+     * Reset the global attempt counter on successful authentication.
+     */
+    private _resetGlobalAttempts;
+    /**
+     * Check if an email is globally locked out. If so, throw an error.
+     */
+    private _checkGlobalLockout;
+    /**
+     * Resolve user for authentication by email.
+     */
+    private _resolveUserForAuthentication;
+    private _enforceUserStatus;
+    /**
+     * Update session after successful method authentication.
+     * Sets the correct session state based on whether this is a first or second factor completion.
+     */
+    private _updateSessionAfterSuccessfulAuth;
+    identify(ec: ExecutionContext<any>, identificationRequest: AuthIdentificationRequest, activeUserType?: string, frontendServiceName?: string): Promise<AuthIdentificationResponse>;
+    private _getAvailableFirstFactorMethods;
+    private _getAvailableSecondFactorMethods;
+    /**
+     * Intersects available methods with enrolled methods, applying requireStrongMFA filtering.
+     * Returns { availableMethods, usableMethods, requireStrongMFA } for session population.
+     */
+    private _resolveUsableMfaMethods;
+    authenticatePassword(ec: ExecutionContext<any>, passwordAuthRequest: PasswordAuthRequest): Promise<AuthenticationResponse>;
+    /**
+     * Handle a native SDK token exchange as a completed first factor.
+     * Creates a session, checks MFA requirement, and either issues tokens or returns MFA-required.
+     * User status is enforced before any token issuance.
+     */
+    handleNativeSDKFirstFactor(ec: ExecutionContext<any>, userId: string, email: string, deviceInfo?: {
+        ipAddress?: string;
+        userAgent?: string;
+    }, activeUserType?: string, frontendServiceName?: string): Promise<{
+        mfaRequired: false;
+        tokens: AuthTokens;
+    } | {
+        mfaRequired: true;
+        sessionId: string;
+        enrolledMethods: AuthMethod[];
+    }>;
+    /**
+     * W4.1: Create a registration session after user account creation.
+     * Called by `registerUser()` instead of returning a generic success message.
+     * The session tracks the registration pipeline state (email verify → MFA enrollment → complete).
+     */
+    createRegistrationSession(userId: string, email: string, options?: {
+        activeUserType?: string;
+        purpose?: AuthSessionPurpose;
+        deviceInfo?: {
+            userAgent?: string;
+            ipAddress?: string;
+        };
+        pendingOrgType?: string;
+    }): Promise<AuthenticationSession>;
+    /**
+     * W4.1: Process email verification through the registration pipeline.
+     * Instead of issuing tokens directly, transitions the session through:
+     * EMAIL_VERIFIED → check MFA → MFA_ENROLLMENT_REQUIRED / MFA_ENROLLMENT_GRACE / COMPLETED.
+     *
+     * Returns the updated session with `nextStep` indicating what the frontend should do.
+     */
+    processEmailVerification(ec: ExecutionContext<any>, userId: string, email: string, activeUserType?: string, deviceInfo?: {
+        userAgent?: string;
+        ipAddress?: string;
+    }, purpose?: AuthSessionPurpose): Promise<AuthenticationSession>;
+    /**
+     * W4: Advance a registration session through the pipeline after a state transition.
+     * Checks MFA requirements, grace period, and onboarding to determine next state.
+     */
+    private _advanceRegistrationPipeline;
+    /**
+     * W4: Complete a registration session — transition to COMPLETED or ONBOARDING_PENDING state.
+     * W5.7: When pendingOrgType is set, route to ONBOARDING_PENDING instead of COMPLETED.
+     */
+    private _completeRegistrationSession;
+    /**
+     * W4.3: Complete MFA enrollment during registration pipeline.
+     * Called after the user successfully enrolls an MFA method during registration.
+     * Transitions from MFA_ENROLLMENT_REQUIRED → COMPLETED and issues tokens.
+     */
+    completeRegistrationMfaEnrollment(ec: ExecutionContext<any>, sessionId: string): Promise<AuthenticationSession>;
+    /**
+     * W5.7: Complete org onboarding — create the deferred organization and transition to COMPLETED.
+     * Called by the guidance/onboarding flow after collecting the org name from the user.
+     */
+    completeOrgOnboarding(ec: ExecutionContext<any>, sessionId: string, organizationName: string): Promise<AuthenticationSession>;
+    authenticate(ec: ExecutionContext<any>, request: AuthenticationRequest): Promise<AuthenticationResponse>;
+    /**
+     * Get the current state of an authentication session.
+     *
+     * TRAP 2 (async change): This method is now async because Redis lookups are Promise-based.
+     * The controller must add `await` to this call — this is the one allowed controller modification.
+     */
+    getAuthenticationSessionState(ec: ExecutionContext<any>, sessionId: string): Promise<AuthenticationSession | null>;
+    /**
+     * Send an Email OTP to the user's email address.
+     *
+     * Called from the auth controller (POST /auth/mfa/email-otp/send).
+     * Generates a 6-digit OTP, stores it as a consumable token, and returns
+     * the session state. The actual email sending is done by the controller.
+     *
+     * Rate limiting: Redis INCR with TTL. Values from config.auth.otpOperational.
+     */
+    sendEmailOTP(ec: ExecutionContext<any>, sessionId: string): Promise<{
+        otpToken: string;
+        email: string;
+        expiryMinutes: number;
+    }>;
+    /**
+     * Verify an Email OTP code submitted by the user.
+     *
+     * Called from authenticate() dispatch when method=EMAIL_OTP,
+     * or directly from the auth controller (POST /auth/mfa/email-otp/verify).
+     */
+    authenticateEmailOTP(ec: ExecutionContext<any>, request: EmailOTPAuthRequest): Promise<AuthenticationResponse>;
+    /**
+     * Verify the OTP code against stored consumable tokens for this user and session.
+     * Attempts to consume the token atomically to prevent replay.
+     */
+    private _verifyEmailOTP;
+    /**
+     * Verify a TOTP code submitted by the user.
+     *
+     * Called from authenticate() dispatch when method=TOTP.
+     * Reads the user's verified TOTP secret from their credential record,
+     * validates the code using the otpauth library.
+     */
+    authenticateTOTP(ec: ExecutionContext<any>, request: TOTPAuthRequest): Promise<AuthenticationResponse>;
+    /**
+     * Verify a WebAuthn/Passkey authentication response.
+     *
+     * Called from authenticate() dispatch when method=PASSKEY.
+     * Supports both first factor (passwordless) and second factor (MFA) usage.
+     * Delegates to WebAuthnBackendService for cryptographic verification.
+     */
+    authenticatePasskey(ec: ExecutionContext<any>, request: PasskeyAuthRequest): Promise<AuthenticationResponse>;
+    /**
+     * Determine if MFA is required for this user/session after first-factor success.
+     *
+     * M12+M13 fix: Now checks org-level auth policy in addition to app-level.
+     * Effective policy = max(app_policy, org_policy) — org can only tighten, never weaken.
+     *
+     * Returns true if:
+     * - The effective policy requires MFA for all users, OR
+      * - The effective policy requires MFA for admins, OR
+     * - The org's minimumAuthLevel is 'mfa' or 'sso', OR
+     * - The user has enrolled a verified TOTP secret (user opted in to MFA)
+     */
+    private _shouldRequireMFA;
+    /** Redis key prefix for SSO grace login counters — scope-aware format: sso_grace_logins:{scopeType}:{scopeId}:{userId} */
+    /**
+     * M14: Check if password login is allowed under SSO grace policy.
+     * If the scope requires SSO and grace logins are exhausted, throws AUTHENTICATION error.
+     */
+    private _checkSSOGraceLoginAllowed;
+    /** 1 year in seconds — effectively permanent for grace counter, but avoids orphaned keys */
+    private static readonly SSO_GRACE_TTL_SECONDS;
+    /**
+     * M14: Atomically increment SSO grace login counter after successful password auth.
+     * Uses Redis INCR (via incrementRateLimit) for atomic increment — no TOCTOU race.
+     * TTL is 1 year (effectively permanent but avoids orphaned keys if scope config changes).
+     */
+    private _incrementSSOGraceLogin;
+    /**
+     * Send a magic link email to the user.
+     * Anti-enumeration: always returns success regardless of whether the user exists.
+     * Rate limited per email.
+     */
+    sendMagicLink(ec: ExecutionContext<any>, request: MagicLinkSendRequest, deviceInfo?: {
+        ipAddress?: string;
+        userAgent?: string;
+    }): Promise<{
+        success: true;
+        token?: string;
+        email?: string;
+        userId?: string;
+        expiresInMinutes?: number;
+    }>;
+    /**
+     * Verify a magic link token.
+     * Returns an auth response with tokens on success.
+     */
+    verifyMagicLink(ec: ExecutionContext<any>, request: MagicLinkVerifyRequest, deviceInfo?: {
+        ipAddress?: string;
+        userAgent?: string;
+    }, activeUserType?: string): Promise<AuthenticationResponse>;
+    /**
+     * Send an SMS OTP code to the user's verified phone number.
+     * Can be used as first factor or second factor depending on config.
+     * Rate limited with dual-window (burst + hourly).
+     */
+    sendSMSOTP(ec: ExecutionContext<any>, sessionId: string, phoneNumber?: string): Promise<{
+        sent: true;
+        otpCode: string;
+        targetPhone: string;
+    }>;
+    /**
+     * Verify an SMS OTP code. Supports both first and second factor.
+     * Called from authenticate() dispatch — does NOT issue tokens (authenticate() handles completion).
+     * Uses constant-time comparison for the OTP code.
+     */
+    authenticateSMSOTP(ec: ExecutionContext<any>, request: SMSOTPAuthRequest): Promise<AuthenticationResponse>;
+    /**
+     * Verify an SMS OTP code using constant-time comparison.
+     * Mirrors the _verifyEmailOTP pattern.
+     */
+    private _verifySMSOTP;
+    /**
+     * Generate a cryptographically random N-digit numeric OTP.
+     */
+    private _generateOTP;
+    private _isAuthenticationComplete;
+    private _buildIdentificationErrorResponse;
+    private _buildAuthenticationSuccessMethod;
+    private __buildAuthenticationErrorMethod;
+    private _buildAvailableMethodObject;
+}
+//# sourceMappingURL=authentication-orchestrator.backend.service.d.ts.map

package/dist/esm/security/authentications/services/authentication-orchestrator.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-orchestrator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/authentication-orchestrator.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EACL,yBAAyB,EAOzB,mBAAmB,EAGpB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAGL,UAAU,EAGV,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EAKtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAsB,MAAM,uBAAuB,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAmB,oBAAoB,EAAE,sBAAsB,EAAuC,MAAM,uBAAuB,CAAC;AAG7N,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAKzH,OAAO,EAAE,8BAA8B,EAAE,MAAM,yFAAyF,CAAC;AACzI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAE,KAAK,UAAU,EAAE,MAAM,wFAAwF,CAAC;AACxJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAGpI,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AAEzJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAEjK,OAAO,EAAE,sCAAsC,EAAE,MAAM,8GAA8G,CAAC;AACtK,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AAEjJ;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,wCAAwC;IAWd,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAErB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEtB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEtD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAEzC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAlCrF,uHAAuH;IACvH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAM;IAC9D,qHAAqH;IACrH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iCAAiC,CAAK;IAC9D,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAK;IAEzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EAC5E,gBAAgB,EAAE,uBAAuB,EAEzC,YAAY,EAAE,8BAA8B,EACtC,kBAAkB,EAAE,oCAAoC,EAC/D,WAAW,EAAE,6BAA6B,EAEnC,sBAAsB,EAAE,6BAA6B,EAC/D,YAAY,EAAE,YAAY,EACf,gBAAgB,EAAE,uBAAuB,EAExC,iBAAiB,EAAE,+BAA+B,EAEtC,gBAAgB,EAAE,oCAAoC,EAE3E,eAAe,EAAE,sBAAsB,EAEvB,cAAc,EAAE,sCAAsC,EAEhE,UAAU,EAAE,4BAA4B,EAErC,aAAa,EAAE,+BAA+B;IAMtH;;;;OAIG;IACH,OAAO,KAAK,aAAa,GAYxB;IAED,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,KAAK,eAAe,GAE1B;IAED,OAAO,KAAK,UAAU,GAErB;IAMD;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAoC1C;IAEF;;;;OAIG;YACW,kCAAkC;IAUhD;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAQhC;;OAEG;IACH,OAAO,CAAC,6BAA6B;IAIrC,OAAO,CAAC,iCAAiC;IAsBzC,OAAO,CAAC,qBAAqB;IAM7B;;OAEG;IACH,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAgB;YAE1D,aAAa;IAqD3B;;OAEG;YACW,UAAU;IA+BxB,0FAA0F;IAC1F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAK;IAEtD;;;;;;OAMG;YACW,aAAa;IA4C3B;;OAEG;YACW,aAAa;IAK3B;;;OAGG;YACW,wBAAwB;IA4DtC;;OAEG;YACW,kBAAkB;IAKhC;;;;OAIG;YACW,wBAAwB;IAMtC;;OAEG;YACW,oBAAoB;IAKlC;;OAEG;YACW,mBAAmB;IAkBjC;;OAEG;YACW,6BAA6B;IAuB3C,OAAO,CAAC,kBAAkB;IAS1B;;;OAGG;YACW,iCAAiC;IAgGlC,QAAQ,CACnB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,qBAAqB,EAAE,yBAAyB,EAChD,cAAc,CAAC,EAAE,MAAM,EACvB,mBAAmB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC,0BAA0B,CAAC;YA+JxB,+BAA+B;YAY/B,gCAAgC;IAiB9C;;;OAGG;YACW,wBAAwB;IAsBzB,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,mBAAmB,EAAE,mBAAmB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA0JvI;;;;OAIG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EACvD,cAAc,CAAC,EAAE,MAAM,EACvB,mBAAmB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC;QAAE,WAAW,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,GAAG;QAAE,WAAW,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IA2EhI;;;;OAIG;IACU,yBAAyB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACP,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;QAC7B,UAAU,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACxD,cAAc,CAAC,EAAE,MAAM,CAAC;KACpB,GACL,OAAO,CAAC,qBAAqB,CAAC;IAajC;;;;;;OAMG;IACU,wBAAwB,CACnC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,cAAc,CAAC,EAAE,MAAM,EACvB,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EACvD,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,qBAAqB,CAAC;IAiBjC;;;OAGG;YACW,4BAA4B;IAsE1C;;;OAGG;YACW,4BAA4B;IAgB1C;;;;OAIG;IACU,iCAAiC,CAC5C,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAwCjC;;;OAGG;IACU,qBAAqB,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,qBAAqB,CAAC;IAuEpB,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAyKrH;;;;;OAKG;IACU,6BAA6B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAa/H;;;;;;;;OAQG;IACU,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IA6E5I;;;;;OAKG;IACU,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA2E3H;;;OAGG;YACW,eAAe;IAkD7B;;;;;;OAMG;IACU,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAiInH;;;;;;OAMG;IACU,mBAAmB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA0GzH;;;;;;;;;;;OAWG;YACW,iBAAiB;IA2E/B,0HAA0H;IAE1H;;;OAGG;YACW,0BAA0B;IAgDxC,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAsB;IAEnE;;;;OAIG;YACW,uBAAuB;IA2BrC;;;;OAIG;IACU,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA8DrP;;;OAGG;IACU,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAmT3M;;;;OAIG;IACU,UAAU,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IA2G1J;;;;OAIG;IACU,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+FvH;;;OAGG;YACW,aAAa;IA0C3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,yBAAyB;IA6BjC,OAAO,CAAC,iCAAiC;IAmBzC,OAAO,CAAC,iCAAiC;IAqDzC,OAAO,CAAC,gCAAgC;YAqC1B,2BAA2B;CAkH1C"}