@actsecurity/iam-lens 0.1.156

package/dist/cjs/whoCan/whoCan.js

@@ -0,0 +1,574 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.whoCan = whoCan;
+exports.uniqueAccountsToCheck = uniqueAccountsToCheck;
+exports.accountsToCheckBasedOnResourcePolicy = accountsToCheckBasedOnResourcePolicy;
+exports.actionsForWhoCan = actionsForWhoCan;
+exports.lookupActionsForResourceArn = lookupActionsForResourceArn;
+exports.findResourceTypeForArn = findResourceTypeForArn;
+exports.sortWhoCanResults = sortWhoCanResults;
+const iam_data_1 = require("@actsecurity/iam-data");
+const iam_policy_1 = require("@actsecurity/iam-policy");
+const iam_utils_1 = require("@actsecurity/iam-utils");
+const arn_js_1 = require("../utils/arn.js");
+const sts_js_1 = require("../utils/sts.js");
+const WhoCanProcessor_js_1 = require("./WhoCanProcessor.js");
+/**
+ * Processes a single whoCan request by creating a temporary WhoCanProcessor,
+ * enqueuing the request, waiting for it to settle, and shutting down. This
+ * preserves the original one-shot behavior where workers and cache are created
+ * and destroyed per call.
+ *
+ * For better performance when running multiple requests, use WhoCanProcessor
+ * directly to keep workers and cache alive across calls.
+ *
+ * @param collectConfigs the collect configurations for loading IAM data
+ * @param partition the AWS partition (e.g. 'aws', 'aws-cn')
+ * @param request the whoCan request parameters
+ * @returns the whoCan response with allowed principals and optional deny details
+ */
+async function whoCan(collectConfigs, partition, request) {
+    let settledEvent;
+    const processor = await WhoCanProcessor_js_1.WhoCanProcessor.create({
+        collectConfigs,
+        partition,
+        tuning: {
+            workerThreads: request.workerThreads
+        },
+        ignorePrincipalIndex: request.ignorePrincipalIndex,
+        clientFactoryPlugin: request.clientFactoryPlugin,
+        workerBootstrapPlugin: request.workerBootstrapPlugin,
+        s3AbacOverride: request.s3AbacOverride,
+        collectGrantDetails: !!request.collectGrantDetails,
+        onRequestSettled: async (event) => {
+            settledEvent = event;
+        }
+    });
+    try {
+        processor.enqueueWhoCan({
+            resource: request.resource,
+            resourceAccount: request.resourceAccount,
+            actions: request.actions,
+            sort: request.sort,
+            denyDetailsCallback: request.denyDetailsCallback,
+            principalScope: request.principalScope,
+            strictContextKeys: request.strictContextKeys
+        });
+        await processor.waitForIdle();
+        if (!settledEvent) {
+            throw new Error('whoCan request did not settle');
+        }
+        if (settledEvent.status === 'rejected') {
+            throw settledEvent.error;
+        }
+        return settledEvent.result;
+    }
+    finally {
+        await processor.shutdown();
+    }
+}
+async function uniqueAccountsToCheck(collectClient, accountsToCheck) {
+    const returnValue = {
+        accountsNotFound: [],
+        organizationsNotFound: [],
+        organizationalUnitsNotFound: [],
+        accounts: []
+    };
+    if (accountsToCheck.allAccounts) {
+        returnValue.accounts = await collectClient.allAccounts();
+        return returnValue;
+    }
+    const uniqueAccounts = new Set();
+    for (const account of accountsToCheck.specificAccounts || []) {
+        const accountExists = await collectClient.accountExists(account);
+        if (accountExists) {
+            uniqueAccounts.add(account);
+        }
+        else {
+            returnValue.accountsNotFound.push(account);
+        }
+    }
+    for (const ouPath of accountsToCheck.specificOrganizationalUnits || []) {
+        const parts = ouPath.split('/');
+        const orgId = parts[0];
+        const pathParts = parts.slice(1);
+        const [found, accounts] = await collectClient.getAccountsForOrgPath(orgId, pathParts);
+        for (const account of accounts) {
+            uniqueAccounts.add(account);
+        }
+        if (!found) {
+            returnValue.organizationalUnitsNotFound.push(ouPath);
+        }
+    }
+    for (const orgId of accountsToCheck.specificOrganizations || []) {
+        const [found, accounts] = await collectClient.getAccountsForOrganization(orgId);
+        for (const account of accounts) {
+            uniqueAccounts.add(account);
+        }
+        if (!found) {
+            returnValue.organizationsNotFound.push(orgId);
+        }
+    }
+    returnValue.accounts = Array.from(uniqueAccounts);
+    return returnValue;
+}
+/**
+ * Splits an ARN-like string on `:` while treating `${...}` blocks as opaque.
+ * Colons inside `${...}` dynamic variable references are not used as split points.
+ *
+ * For example, `arn:${aws:Partition}:iam::999999999999:role/*` splits into
+ * `['arn', '${aws:Partition}', 'iam', '', '999999999999', 'role/*']`.
+ *
+ * @param value - The raw ARN string, possibly containing `${...}` references.
+ * @returns An array of colon-delimited segments.
+ */
+function splitArnIgnoringDynamicVars(value) {
+    const segments = [];
+    let current = '';
+    let depth = 0;
+    for (let i = 0; i < value.length; i++) {
+        const ch = value[i];
+        if (ch === '$' && i + 1 < value.length && value[i + 1] === '{') {
+            depth++;
+            current += '${';
+            i++; // skip the '{'
+        }
+        else if (ch === '}' && depth > 0) {
+            depth--;
+            current += '}';
+        }
+        else if (ch === ':' && depth === 0) {
+            segments.push(current);
+            current = '';
+        }
+        else {
+            current += ch;
+        }
+    }
+    segments.push(current);
+    return segments;
+}
+const PRINCIPAL_ARN_PATTERN_OPERATORS = new Set(['stringlike', 'arnequals', 'arnlike']);
+/**
+ * Checks whether a string contains any wildcard or dynamic variable characters
+ * (`*`, `?`, or `$`).
+ *
+ * @param value - The string to check.
+ * @returns `true` if the string contains `*`, `?`, or `$`.
+ */
+function hasWildcardOrDynamic(value) {
+    return value.includes('*') || value.includes('?') || value.includes('$');
+}
+/** The 3 scalar condition keys that are only populated for service principal requests. */
+const UNNAMED_SERVICE_SCALAR_KEYS = new Set([
+    'aws:sourceaccount',
+    'aws:sourceowner',
+    'aws:sourceorgid'
+]);
+/**
+ * Checks whether a positive operator is used on a scalar service-principal-only key.
+ * Accepts `StringEquals` family and `StringLike`.
+ *
+ * @param op - The condition operation to check.
+ * @returns `true` if the operator is a positive match for a scalar key.
+ */
+function isPositiveScalarOperator(op) {
+    return (op.value().toLowerCase().startsWith('stringequals') ||
+        op.baseOperator().toLowerCase() === 'stringlike');
+}
+/**
+ * Checks whether a positive operator is used on the `aws:SourceOrgPaths` array key.
+ * Only `ForAnyValue:StringEquals*` and `ForAnyValue:StringLike` qualify.
+ * `ForAllValues` and plain operators without a set operator do not.
+ *
+ * @param op - The condition operation to check.
+ * @returns `true` if the operator is a valid positive match for the array key.
+ */
+function isPositiveOrgPathsOperator(op) {
+    if (op.setOperator() !== 'ForAnyValue')
+        return false;
+    const base = op.baseOperator().toLowerCase();
+    return base.startsWith('stringequals') || base === 'stringlike';
+}
+/**
+ * Inspects a statement's conditions to determine if the statement effectively
+ * requires an AWS service principal. Used for wildcard-principal Allow statements
+ * to avoid unnecessarily widening the whoCan search scope.
+ *
+ * @param conditions - The conditions from the statement to inspect.
+ * @returns A classification indicating whether the statement is not service-only,
+ *   requires an unnamed service principal (skip entirely), or names specific
+ *   service principals (extract for simulation).
+ */
+function checkForServicePrincipalConditions(conditions) {
+    let hasUnnamedServiceKey = false;
+    const namedServicePrincipals = [];
+    for (const cond of conditions) {
+        const key = cond.conditionKey().toLowerCase();
+        const op = cond.operation();
+        if (op.isIfExists())
+            continue;
+        // Category 1a: Scalar unnamed keys (aws:SourceAccount, aws:SourceOwner, aws:SourceOrgID)
+        if (UNNAMED_SERVICE_SCALAR_KEYS.has(key) && isPositiveScalarOperator(op)) {
+            hasUnnamedServiceKey = true;
+        }
+        // Category 1b: Array unnamed key (aws:SourceOrgPaths) — requires ForAnyValue
+        if (key === 'aws:sourceorgpaths' && isPositiveOrgPathsOperator(op)) {
+            hasUnnamedServiceKey = true;
+        }
+        // Category 1c: aws:PrincipalIsAWSService with Bool or StringEquals and value 'true'
+        // Multiple condition values are ORed, so mixed ['true', 'false'] is NOT service-only.
+        // All values must be 'true' for the condition to exclusively require a service principal.
+        if (key === 'aws:principalisawsservice') {
+            const baseOp = op.baseOperator().toLowerCase();
+            const opVal = op.value().toLowerCase();
+            const isBoolOrStringEquals = baseOp === 'bool' || opVal.startsWith('stringequals');
+            const values = cond.conditionValues();
+            if (isBoolOrStringEquals &&
+                values.length > 0 &&
+                values.every((v) => v.toLowerCase() === 'true')) {
+                hasUnnamedServiceKey = true;
+            }
+        }
+        // Category 2: aws:PrincipalServiceName — extract named service principals
+        if (key === 'aws:principalservicename' &&
+            op.value().toLowerCase().startsWith('stringequals') &&
+            !cond.conditionValues().some((v) => v.includes('$'))) {
+            namedServicePrincipals.push(...cond.conditionValues());
+        }
+    }
+    // Named takes priority — the simulator fills aws:SourceAccount etc. for service principals
+    if (namedServicePrincipals.length > 0) {
+        return { type: 'named-service-only', principals: namedServicePrincipals };
+    }
+    if (hasUnnamedServiceKey) {
+        return { type: 'unnamed-service-only' };
+    }
+    return { type: 'not-service-only' };
+}
+/**
+ * Derives the accounts and specific principals that should be considered from a resource policy.
+ *
+ * Specific STS session principals are resolved through collect data so account-enumeration
+ * paths can de-duplicate path-qualified roles that resolve from pathless session ARNs.
+ *
+ * @param resourcePolicy The resource policy document to inspect.
+ * @param resourceAccount The account ID that owns the resource, when known.
+ * @param collectClient The collect client used to resolve canonical principal ARNs.
+ * @returns The accounts, principals, organizations, and related flags to consider for whoCan.
+ */
+async function accountsToCheckBasedOnResourcePolicy(resourcePolicy, resourceAccount, collectClient) {
+    const accountsToCheck = {
+        allAccounts: false,
+        specificAccounts: [],
+        specificPrincipals: [],
+        specificOrganizations: [],
+        specificOrganizationalUnits: [],
+        checkAnonymous: false,
+        checkAllFromResourceAccount: false,
+        resourceAccountTrustedByPolicy: false
+    };
+    if (!resourcePolicy) {
+        return accountsToCheck;
+    }
+    const policy = (0, iam_policy_1.loadPolicy)(resourcePolicy);
+    for (const statement of policy.statements()) {
+        if (statement.isAllow() && statement.isNotPrincipalStatement()) {
+            accountsToCheck.allAccounts = true;
+            accountsToCheck.checkAllFromResourceAccount = true;
+            accountsToCheck.resourceAccountTrustedByPolicy = true;
+        }
+        if (statement.isAllow() && statement.isPrincipalStatement()) {
+            const principals = statement.principals();
+            let hasWildcardPrincipal = false;
+            for (const principal of principals) {
+                if (principal.isWildcardPrincipal()) {
+                    hasWildcardPrincipal = true;
+                }
+                else if (principal.isAccountPrincipal()) {
+                    accountsToCheck.specificAccounts.push(principal.accountId());
+                    if (principal.accountId() === resourceAccount) {
+                        accountsToCheck.resourceAccountTrustedByPolicy = true;
+                    }
+                }
+                else {
+                    accountsToCheck.specificPrincipals.push(await resolveResourcePolicyPrincipalArn(principal.value(), collectClient));
+                }
+            }
+            if (hasWildcardPrincipal) {
+                const serviceCheck = checkForServicePrincipalConditions(statement.conditions());
+                if (serviceCheck.type === 'unnamed-service-only') {
+                    continue;
+                }
+                if (serviceCheck.type === 'named-service-only') {
+                    accountsToCheck.specificPrincipals.push(...serviceCheck.principals);
+                    continue;
+                }
+                const specificOrgs = [];
+                const specificOus = [];
+                const specificAccounts = [];
+                const specificPrincipals = [];
+                let principalArnRequiresAllAccounts = false;
+                let hasNonPrincipalArnAccountNarrowing = false;
+                const conditions = statement.conditions();
+                for (const cond of conditions) {
+                    const condKey = cond.conditionKey().toLowerCase();
+                    if (condKey === 'aws:principalorgid' &&
+                        cond.operation().value().toLowerCase().startsWith('stringequals') &&
+                        !cond.conditionValues().some((v) => v.includes('$'))) {
+                        specificOrgs.push(...cond.conditionValues());
+                    }
+                    if (condKey === 'aws:principalorgpaths' &&
+                        cond.operation().baseOperator().toLowerCase().startsWith('stringequals') &&
+                        !cond.conditionValues().some((v) => v.includes('$'))) {
+                        specificOus.push(...cond.conditionValues());
+                    }
+                    if (condKey === 'aws:principalaccount' || condKey === 'kms:calleraccount') {
+                        const opVal = cond.operation().value().toLowerCase();
+                        const baseOp = cond.operation().baseOperator().toLowerCase();
+                        const values = cond.conditionValues();
+                        const hasDynamic = values.some((v) => v.includes('$'));
+                        if (opVal.startsWith('stringequals') && !hasDynamic) {
+                            // StringEquals family — all values are literal account IDs
+                            specificAccounts.push(...values);
+                            hasNonPrincipalArnAccountNarrowing = true;
+                        }
+                        else if (baseOp === 'stringlike' &&
+                            !hasDynamic &&
+                            values.every((v) => !v.includes('*') && !v.includes('?'))) {
+                            // StringLike where ALL values are literal (no wildcards or dynamic vars)
+                            specificAccounts.push(...values);
+                            hasNonPrincipalArnAccountNarrowing = true;
+                        }
+                    }
+                    if (condKey === 'aws:principalarn') {
+                        const opValue = cond.operation().value().toLowerCase();
+                        const baseOp = cond.operation().baseOperator().toLowerCase();
+                        const isExactOperator = opValue.startsWith('stringequals');
+                        const isPatternOperator = PRINCIPAL_ARN_PATTERN_OPERATORS.has(baseOp);
+                        if (!isExactOperator && !isPatternOperator) {
+                            continue;
+                        }
+                        if (cond.operation().isIfExists()) {
+                            accountsToCheck.checkAnonymous = true;
+                        }
+                        for (const value of cond.conditionValues()) {
+                            let extractedPrincipalArnScope = false;
+                            if (!hasWildcardOrDynamic(value)) {
+                                // Exact literal — push as a specific principal
+                                specificPrincipals.push(await resolveResourcePolicyPrincipalArn(value, collectClient));
+                                extractedPrincipalArnScope = true;
+                            }
+                            else if (isExactOperator && !value.includes('*') && !value.includes('?')) {
+                                // Exact operator with a dynamic variable but no wildcards — try account extraction
+                                const segments = splitArnIgnoringDynamicVars(value);
+                                if (segments.length >= 6 && segments[0].toLowerCase() === 'arn') {
+                                    const account = segments[4];
+                                    if (account && !hasWildcardOrDynamic(account)) {
+                                        specificAccounts.push(account);
+                                        extractedPrincipalArnScope = true;
+                                    }
+                                }
+                            }
+                            else {
+                                // Pattern operator or value with wildcards — try account extraction
+                                const segments = splitArnIgnoringDynamicVars(value);
+                                if (segments.length >= 6 && segments[0].toLowerCase() === 'arn') {
+                                    const account = segments[4];
+                                    if (account && !hasWildcardOrDynamic(account)) {
+                                        specificAccounts.push(account);
+                                        extractedPrincipalArnScope = true;
+                                    }
+                                }
+                            }
+                            if (!extractedPrincipalArnScope) {
+                                // Wildcard-account or otherwise non-extractable PrincipalArn patterns can match any account.
+                                principalArnRequiresAllAccounts = true;
+                            }
+                        }
+                    }
+                }
+                if (specificPrincipals.length > 0) {
+                    accountsToCheck.specificPrincipals.push(...specificPrincipals);
+                }
+                if (principalArnRequiresAllAccounts &&
+                    specificOus.length === 0 &&
+                    specificOrgs.length === 0 &&
+                    !hasNonPrincipalArnAccountNarrowing) {
+                    accountsToCheck.allAccounts = true;
+                    accountsToCheck.resourceAccountTrustedByPolicy = true;
+                    accountsToCheck.checkAllFromResourceAccount = true;
+                    if (specificAccounts.length > 0) {
+                        accountsToCheck.specificAccounts.push(...specificAccounts);
+                    }
+                }
+                else if (specificAccounts.length > 0) {
+                    accountsToCheck.specificAccounts.push(...specificAccounts);
+                    if (resourceAccount && specificAccounts.includes(resourceAccount)) {
+                        accountsToCheck.resourceAccountTrustedByPolicy = true;
+                        accountsToCheck.checkAllFromResourceAccount = true;
+                    }
+                }
+                else if (specificOus.length > 0) {
+                    accountsToCheck.specificOrganizationalUnits.push(...specificOus);
+                    // The resource account may be in these OUs; conservatively assume trusted
+                    accountsToCheck.resourceAccountTrustedByPolicy = true;
+                    accountsToCheck.checkAllFromResourceAccount = true;
+                }
+                else if (specificOrgs.length > 0) {
+                    accountsToCheck.specificOrganizations.push(...specificOrgs);
+                    // The resource account may be in these orgs; conservatively assume trusted
+                    accountsToCheck.resourceAccountTrustedByPolicy = true;
+                    accountsToCheck.checkAllFromResourceAccount = true;
+                }
+                else if (specificPrincipals.length === 0) {
+                    accountsToCheck.allAccounts = true;
+                    accountsToCheck.resourceAccountTrustedByPolicy = true;
+                    accountsToCheck.checkAllFromResourceAccount = true;
+                }
+            }
+        }
+    }
+    return accountsToCheck;
+}
+/**
+ * Resolves a resource-policy principal to the canonical collected principal ARN.
+ *
+ * Resource policies can name STS assumed-role sessions, including pathless session
+ * ARNs for path-qualified IAM roles. Resolve through collect data first so
+ * whoCan can de-duplicate those principals before simulation, then preserve the
+ * previous session-to-role conversion behavior when the principal is not found.
+ *
+ * @param principalArn The resource-policy principal ARN or service principal to resolve.
+ * @param collectClient The collect client used to resolve canonical principal ARNs.
+ * @returns The canonical collected ARN when found, otherwise the original principal ARN.
+ */
+async function resolveResourcePolicyPrincipalArn(principalArn, collectClient) {
+    if (!principalArn.startsWith('arn:')) {
+        return principalArn;
+    }
+    return (await collectClient.resolvePrincipalArn(principalArn)) ?? principalArn;
+}
+async function actionsForWhoCan(request) {
+    const { actions } = request;
+    if (actions && actions.length > 0) {
+        const validActions = [];
+        for (const action of actions) {
+            const parts = action.split(':');
+            if (parts.length !== 2) {
+                continue;
+            }
+            const [service, actionName] = parts;
+            const serviceExists = await (0, iam_data_1.iamServiceExists)(service);
+            if (!serviceExists) {
+                continue;
+            }
+            const actionExists = await (0, iam_data_1.iamActionExists)(service, actionName);
+            if (!actionExists) {
+                continue;
+            }
+            validActions.push(action);
+        }
+        return validActions;
+    }
+    if (!request.resource) {
+        return [];
+    }
+    return lookupActionsForResourceArn(request.resource);
+}
+/**
+ * Get the the possible resource types for an action and resource
+ *
+ * @param service the service the action belongs to
+ * @param action the action to get the resource type for
+ * @param resourceArn the resource type matching the action, if any
+ * @throws an error if the service or action does not exist, or if the action is a wildcard only action
+ */
+async function lookupActionsForResourceArn(resourceArn) {
+    const [service, resourceType] = await findResourceTypeForArn(resourceArn);
+    const resourceTypeKey = resourceType.key;
+    const selectedActions = [];
+    const serviceActions = await (0, iam_data_1.iamActionsForService)(service);
+    for (const action of serviceActions) {
+        const actionDetails = await (0, iam_data_1.iamActionDetails)(service, action);
+        for (const rt of actionDetails.resourceTypes) {
+            if (rt.name == resourceTypeKey) {
+                selectedActions.push(`${service}:${action}`);
+                break; // No need to check other resource types for this action
+            }
+        }
+    }
+    const isRole = new arn_js_1.Arn(resourceArn).matches({ service: 'iam', resourceType: 'role' });
+    if (isRole) {
+        selectedActions.push(...sts_js_1.AssumeRoleActions.values());
+    }
+    return selectedActions;
+}
+async function findResourceTypeForArn(resourceArn) {
+    const arnParts = (0, iam_utils_1.splitArnParts)(resourceArn);
+    const service = arnParts.service.toLowerCase();
+    const serviceExists = await (0, iam_data_1.iamServiceExists)(service);
+    if (!serviceExists) {
+        throw new Error(`Unable to find service ${service} for resource ${resourceArn}`);
+    }
+    const sortedResourceTypes = await allResourceTypesByArnLength(service);
+    const matchingPatterns = (0, iam_utils_1.mostSpecificMatchingResourceTypePatterns)(resourceArn, sortedResourceTypes.map((resourceType) => resourceType.arn));
+    const resourceType = sortedResourceTypes.find((rt) => matchingPatterns.includes(rt.arn));
+    if (resourceType) {
+        return [service, resourceType];
+    }
+    throw new Error(`Unable to find resource type for service ${service} and resource ${resourceArn}.`);
+}
+async function allResourceTypesByArnLength(service) {
+    const resourceTypeKeys = await (0, iam_data_1.iamResourceTypesForService)(service);
+    const sortedResourceTypes = [];
+    for (const key of resourceTypeKeys) {
+        const details = await (0, iam_data_1.iamResourceTypeDetails)(service, key);
+        sortedResourceTypes.push(details);
+    }
+    return sortedResourceTypes.sort((a, b) => {
+        return b.arn.length - a.arn.length;
+    });
+}
+/**
+ * Sort the results in a WhoCanResponse in place for consistent output
+ *
+ * @param whoCanResponse the WhoCanResponse to sort
+ */
+function sortWhoCanResults(whoCanResponse) {
+    whoCanResponse.allowed.sort((a, b) => {
+        if (a.principal < b.principal)
+            return -1;
+        if (a.principal > b.principal)
+            return 1;
+        if (a.service < b.service)
+            return -1;
+        if (a.service > b.service)
+            return 1;
+        if (a.action < b.action)
+            return -1;
+        if (a.action > b.action)
+            return 1;
+        return 0;
+    });
+    whoCanResponse.denyDetails?.sort((a, b) => {
+        if (a.principal < b.principal)
+            return -1;
+        if (a.principal > b.principal)
+            return 1;
+        if (a.service < b.service)
+            return -1;
+        if (a.service > b.service)
+            return 1;
+        if (a.action < b.action)
+            return -1;
+        if (a.action > b.action)
+            return 1;
+        return 0;
+    });
+    whoCanResponse.accountsNotFound.sort();
+    whoCanResponse.organizationsNotFound.sort();
+    whoCanResponse.organizationalUnitsNotFound.sort();
+    whoCanResponse.principalsNotFound.sort();
+}
+//# sourceMappingURL=whoCan.js.map

package/dist/cjs/whoCan/whoCan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoCan.js","sourceRoot":"","sources":["../../../src/whoCan/whoCan.ts"],"names":[],"mappings":";;AAySA,wBAgDC;AAED,sDAyDC;AAoMD,oFAkMC;AAyBD,4CA8BC;AAUD,kEAsBC;AAED,wDAsBC;AAmBD,8CAyBC;AAl7BD,oDAQ8B;AAC9B,wDAA6F;AAO7F,sDAAgG;AAChG,4CAAqC;AAErC,4CAAmD;AAEnD,6DAI6B;AA+P7B;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,MAAM,CAC1B,cAAgC,EAChC,SAAiB,EACjB,OAA8B;IAE9B,IAAI,YAA4C,CAAA;IAEhD,MAAM,SAAS,GAAG,MAAM,oCAAe,CAAC,MAAM,CAAC;QAC7C,cAAc;QACd,SAAS;QACT,MAAM,EAAE;YACN,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC;QACD,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB;QAClD,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,YAAY,GAAG,KAAK,CAAA;QACtB,CAAC;KACF,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,SAAS,CAAC,aAAa,CAAC;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;SAC7C,CAAC,CAAA;QAEF,MAAM,SAAS,CAAC,WAAW,EAAE,CAAA;QAE7B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QAClD,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,YAAY,CAAC,KAAK,CAAA;QAC1B,CAAC;QAED,OAAO,YAAY,CAAC,MAAM,CAAA;IAC5B,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAA;IAC5B,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,qBAAqB,CACzC,aAA+B,EAC/B,eAAgC;IAOhC,MAAM,WAAW,GAAG;QAClB,gBAAgB,EAAE,EAAc;QAChC,qBAAqB,EAAE,EAAc;QACrC,2BAA2B,EAAE,EAAc;QAC3C,QAAQ,EAAE,EAAc;KACzB,CAAA;IAED,IAAI,eAAe,CAAC,WAAW,EAAE,CAAC;QAChC,WAAW,CAAC,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAA;QACxD,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IACxC,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAC7D,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QAChE,IAAI,aAAa,EAAE,CAAC;YAClB,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,eAAe,CAAC,2BAA2B,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAEhC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QACrF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,WAAW,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAA;QAC/E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,WAAW,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACjD,OAAO,WAAW,CAAA;AACpB,CAAC;AAuBD;;;;;;;;;GASG;AACH,SAAS,2BAA2B,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/D,KAAK,EAAE,CAAA;YACP,OAAO,IAAI,IAAI,CAAA;YACf,CAAC,EAAE,CAAA,CAAC,eAAe;QACrB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACnC,KAAK,EAAE,CAAA;YACP,OAAO,IAAI,GAAG,CAAA;QAChB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACtB,OAAO,GAAG,EAAE,CAAA;QACd,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACtB,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAA;AAEvF;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAC1E,CAAC;AAcD,0FAA0F;AAC1F,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,mBAAmB;IACnB,iBAAiB;IACjB,iBAAiB;CAClB,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,EAAsB;IACtD,OAAO,CACL,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;QACnD,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,KAAK,YAAY,CACjD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,0BAA0B,CAAC,EAAsB;IACxD,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IACpD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAA;IAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,IAAI,KAAK,YAAY,CAAA;AACjE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kCAAkC,CAAC,UAAuB;IACjE,IAAI,oBAAoB,GAAG,KAAK,CAAA;IAChC,MAAM,sBAAsB,GAAa,EAAE,CAAA;IAE3C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAA;QAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;QAE3B,IAAI,EAAE,CAAC,UAAU,EAAE;YAAE,SAAQ;QAE7B,yFAAyF;QACzF,IAAI,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,wBAAwB,CAAC,EAAE,CAAC,EAAE,CAAC;YACzE,oBAAoB,GAAG,IAAI,CAAA;QAC7B,CAAC;QAED,6EAA6E;QAC7E,IAAI,GAAG,KAAK,oBAAoB,IAAI,0BAA0B,CAAC,EAAE,CAAC,EAAE,CAAC;YACnE,oBAAoB,GAAG,IAAI,CAAA;QAC7B,CAAC;QAED,oFAAoF;QACpF,sFAAsF;QACtF,0FAA0F;QAC1F,IAAI,GAAG,KAAK,2BAA2B,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAA;YAC9C,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAA;YACtC,MAAM,oBAAoB,GAAG,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;YAClF,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAA;YACrC,IACE,oBAAoB;gBACpB,MAAM,CAAC,MAAM,GAAG,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EAC/C,CAAC;gBACD,oBAAoB,GAAG,IAAI,CAAA;YAC7B,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,IACE,GAAG,KAAK,0BAA0B;YAClC,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;YACnD,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC5D,CAAC;YACD,sBAAsB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAA;IAC3E,CAAC;IACD,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAA;IACzC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;AACrC,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,oCAAoC,CACxD,cAAmB,EACnB,eAAmC,EACnC,aAA+B;IAE/B,MAAM,eAAe,GAAoB;QACvC,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,EAAE;QACpB,kBAAkB,EAAE,EAAE;QACtB,qBAAqB,EAAE,EAAE;QACzB,2BAA2B,EAAE,EAAE;QAC/B,cAAc,EAAE,KAAK;QACrB,2BAA2B,EAAE,KAAK;QAClC,8BAA8B,EAAE,KAAK;KACtC,CAAA;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,uBAAU,EAAC,cAAc,CAAC,CAAA;IACzC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAC5C,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC;YAC/D,eAAe,CAAC,WAAW,GAAG,IAAI,CAAA;YAClC,eAAe,CAAC,2BAA2B,GAAG,IAAI,CAAA;YAClD,eAAe,CAAC,8BAA8B,GAAG,IAAI,CAAA;QACvD,CAAC;QACD,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC5D,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,CAAA;YACzC,IAAI,oBAAoB,GAAG,KAAK,CAAA;YAChC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;oBACpC,oBAAoB,GAAG,IAAI,CAAA;gBAC7B,CAAC;qBAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,EAAE,CAAC;oBAC1C,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAA;oBAC5D,IAAI,SAAS,CAAC,SAAS,EAAE,KAAK,eAAe,EAAE,CAAC;wBAC9C,eAAe,CAAC,8BAA8B,GAAG,IAAI,CAAA;oBACvD,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,eAAe,CAAC,kBAAkB,CAAC,IAAI,CACrC,MAAM,iCAAiC,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,aAAa,CAAC,CAC1E,CAAA;gBACH,CAAC;YACH,CAAC;YAED,IAAI,oBAAoB,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,kCAAkC,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,CAAA;gBAE/E,IAAI,YAAY,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;oBACjD,SAAQ;gBACV,CAAC;gBAED,IAAI,YAAY,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;oBAC/C,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;oBACnE,SAAQ;gBACV,CAAC;gBAED,MAAM,YAAY,GAAa,EAAE,CAAA;gBACjC,MAAM,WAAW,GAAa,EAAE,CAAA;gBAChC,MAAM,gBAAgB,GAAa,EAAE,CAAA;gBACrC,MAAM,kBAAkB,GAAa,EAAE,CAAA;gBACvC,IAAI,+BAA+B,GAAG,KAAK,CAAA;gBAC3C,IAAI,kCAAkC,GAAG,KAAK,CAAA;gBAE9C,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,CAAA;gBACzC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;oBAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAA;oBACjD,IACE,OAAO,KAAK,oBAAoB;wBAChC,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;wBACjE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC5D,CAAC;wBACD,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;oBAC9C,CAAC;oBACD,IACE,OAAO,KAAK,uBAAuB;wBACnC,IAAI,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;wBACxE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC5D,CAAC;wBACD,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;oBAC7C,CAAC;oBACD,IAAI,OAAO,KAAK,sBAAsB,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;wBAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAA;wBACpD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAA;wBAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAA;wBACrC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;wBAE9D,IAAI,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;4BACpD,2DAA2D;4BAC3D,gBAAgB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;4BAChC,kCAAkC,GAAG,IAAI,CAAA;wBAC3C,CAAC;6BAAM,IACL,MAAM,KAAK,YAAY;4BACvB,CAAC,UAAU;4BACX,MAAM,CAAC,KAAK,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACjE,CAAC;4BACD,yEAAyE;4BACzE,gBAAgB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;4BAChC,kCAAkC,GAAG,IAAI,CAAA;wBAC3C,CAAC;oBACH,CAAC;oBAED,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;wBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAA;wBACtD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAA;wBAC5D,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;wBAC1D,MAAM,iBAAiB,GAAG,+BAA+B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;wBAErE,IAAI,CAAC,eAAe,IAAI,CAAC,iBAAiB,EAAE,CAAC;4BAC3C,SAAQ;wBACV,CAAC;wBAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC;4BAClC,eAAe,CAAC,cAAc,GAAG,IAAI,CAAA;wBACvC,CAAC;wBAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;4BAC3C,IAAI,0BAA0B,GAAG,KAAK,CAAA;4BACtC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;gCACjC,+CAA+C;gCAC/C,kBAAkB,CAAC,IAAI,CACrB,MAAM,iCAAiC,CAAC,KAAK,EAAE,aAAa,CAAC,CAC9D,CAAA;gCACD,0BAA0B,GAAG,IAAI,CAAA;4BACnC,CAAC;iCAAM,IAAI,eAAe,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gCAC3E,mFAAmF;gCACnF,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAA;gCACnD,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;oCAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;oCAC3B,IAAI,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;wCAC9C,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;wCAC9B,0BAA0B,GAAG,IAAI,CAAA;oCACnC,CAAC;gCACH,CAAC;4BACH,CAAC;iCAAM,CAAC;gCACN,oEAAoE;gCACpE,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAA;gCACnD,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;oCAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;oCAC3B,IAAI,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;wCAC9C,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;wCAC9B,0BAA0B,GAAG,IAAI,CAAA;oCACnC,CAAC;gCACH,CAAC;4BACH,CAAC;4BAED,IAAI,CAAC,0BAA0B,EAAE,CAAC;gCAChC,6FAA6F;gCAC7F,+BAA+B,GAAG,IAAI,CAAA;4BACxC,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAA;gBAChE,CAAC;gBACD,IACE,+BAA+B;oBAC/B,WAAW,CAAC,MAAM,KAAK,CAAC;oBACxB,YAAY,CAAC,MAAM,KAAK,CAAC;oBACzB,CAAC,kCAAkC,EACnC,CAAC;oBACD,eAAe,CAAC,WAAW,GAAG,IAAI,CAAA;oBAClC,eAAe,CAAC,8BAA8B,GAAG,IAAI,CAAA;oBACrD,eAAe,CAAC,2BAA2B,GAAG,IAAI,CAAA;oBAClD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAChC,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAA;oBAC5D,CAAC;gBACH,CAAC;qBAAM,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvC,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAA;oBAC1D,IAAI,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;wBAClE,eAAe,CAAC,8BAA8B,GAAG,IAAI,CAAA;wBACrD,eAAe,CAAC,2BAA2B,GAAG,IAAI,CAAA;oBACpD,CAAC;gBACH,CAAC;qBAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,eAAe,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAA;oBAChE,0EAA0E;oBAC1E,eAAe,CAAC,8BAA8B,GAAG,IAAI,CAAA;oBACrD,eAAe,CAAC,2BAA2B,GAAG,IAAI,CAAA;gBACpD,CAAC;qBAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACnC,eAAe,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAA;oBAC3D,2EAA2E;oBAC3E,eAAe,CAAC,8BAA8B,GAAG,IAAI,CAAA;oBACrD,eAAe,CAAC,2BAA2B,GAAG,IAAI,CAAA;gBACpD,CAAC;qBAAM,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC3C,eAAe,CAAC,WAAW,GAAG,IAAI,CAAA;oBAClC,eAAe,CAAC,8BAA8B,GAAG,IAAI,CAAA;oBACrD,eAAe,CAAC,2BAA2B,GAAG,IAAI,CAAA;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,iCAAiC,CAC9C,YAAoB,EACpB,aAA+B;IAE/B,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,OAAO,CAAC,MAAM,aAAa,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,IAAI,YAAY,CAAA;AAChF,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,OAA4D;IAE5D,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAA;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,SAAQ;YACV,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,KAAK,CAAA;YACnC,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,CAAC,CAAA;YACrD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,SAAQ;YACV,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,IAAA,0BAAe,EAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YAC/D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,SAAQ;YACV,CAAC;YAED,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3B,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,2BAA2B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,2BAA2B,CAAC,WAAmB;IACnE,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAA;IACzE,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,CAAA;IAExC,MAAM,eAAe,GAAa,EAAE,CAAA;IACpC,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7D,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,aAAa,EAAE,CAAC;YAC7C,IAAI,EAAE,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;gBAC/B,eAAe,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC,CAAA;gBAC5C,MAAK,CAAC,wDAAwD;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,YAAG,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;IACrF,IAAI,MAAM,EAAE,CAAC;QACX,eAAe,CAAC,IAAI,CAAC,GAAG,0BAAiB,CAAC,MAAM,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IAC9D,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAQ,CAAC,WAAW,EAAE,CAAA;IAE/C,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAgB,EAAC,OAAO,CAAC,CAAA;IACrD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,iBAAiB,WAAW,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAA;IACtE,MAAM,gBAAgB,GAAG,IAAA,oDAAwC,EAC/D,WAAW,EACX,mBAAmB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAC5D,CAAA;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;IACxF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,iBAAiB,WAAW,GAAG,CACnF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,OAAe;IACxD,MAAM,gBAAgB,GAAG,MAAM,IAAA,qCAA0B,EAAC,OAAO,CAAC,CAAA;IAClE,MAAM,mBAAmB,GAAmB,EAAE,CAAA;IAC9C,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAsB,EAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,cAA8B;IAC9D,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,CAAA;QACxC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS;YAAE,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,CAAA;QACpC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAA;QACnC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,CAAA;QAClC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAA;QACjC,OAAO,CAAC,CAAA;IACV,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,CAAA;QACxC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS;YAAE,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,CAAA;QACpC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAA;QACnC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,CAAA;QAClC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAA;QACjC,OAAO,CAAC,CAAA;IACV,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAA;IACtC,cAAc,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAA;IAC3C,cAAc,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAA;IACjD,cAAc,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAA;AAC1C,CAAC"}

package/dist/cjs/whoCan/workerBootstrapPlugin.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Configuration for a consumer-provided module that runs once per worker thread
+ * at startup, before any work is processed. Intended for loading instrumentation
+ * (e.g. dd-trace), initializing logging context, or similar worker-lifetime setup.
+ *
+ * The referenced export must be a function matching
+ * `(context: { data: unknown; threadId: number; isMainThread: false }) => void | Promise<void>`.
+ */
+export interface WorkerBootstrapPlugin {
+    /** Package name (e.g. '@my-app/worker-bootstrap') or absolute path — resolved via dynamic import. */
+    module: string;
+    /** Name of the exported bootstrap function. */
+    factoryExport: string;
+    /** JSON-serializable data passed to the bootstrap function. */
+    data: unknown;
+}
+//# sourceMappingURL=workerBootstrapPlugin.d.ts.map

package/dist/cjs/whoCan/workerBootstrapPlugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workerBootstrapPlugin.d.ts","sourceRoot":"","sources":["../../../src/whoCan/workerBootstrapPlugin.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,qGAAqG;IACrG,MAAM,EAAE,MAAM,CAAA;IACd,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAA;IACrB,+DAA+D;IAC/D,IAAI,EAAE,OAAO,CAAA;CACd"}

package/dist/cjs/whoCan/workerBootstrapPlugin.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=workerBootstrapPlugin.js.map

package/dist/cjs/whoCan/workerBootstrapPlugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workerBootstrapPlugin.js","sourceRoot":"","sources":["../../../src/whoCan/workerBootstrapPlugin.ts"],"names":[],"mappings":""}

package/dist/cjs/workers/ArrayStreamingWorkQueue.d.ts

@@ -0,0 +1,15 @@
+export interface ArrayStreamingWorkQueueOptions {
+    ringCapacity?: number;
+}
+export declare class ArrayStreamingWorkQueue<T> {
+    private onWorkAvailable?;
+    private notifyScheduled;
+    private work;
+    constructor(options?: ArrayStreamingWorkQueueOptions);
+    setWorkAvailableCallback(callback: () => void): void;
+    enqueue(item: T): void;
+    dequeue(): T | undefined;
+    length(): number;
+    private scheduleNotify;
+}
+//# sourceMappingURL=ArrayStreamingWorkQueue.d.ts.map

package/dist/cjs/workers/ArrayStreamingWorkQueue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ArrayStreamingWorkQueue.d.ts","sourceRoot":"","sources":["../../../src/workers/ArrayStreamingWorkQueue.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,8BAA8B;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,qBAAa,uBAAuB,CAAC,CAAC;IACpC,OAAO,CAAC,eAAe,CAAC,CAAY;IACpC,OAAO,CAAC,eAAe,CAAQ;IAC/B,OAAO,CAAC,IAAI,CAAY;gBAEZ,OAAO,GAAE,8BAAmC;IAEjD,wBAAwB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI;IAIpD,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI;IAKtB,OAAO,IAAI,CAAC,GAAG,SAAS;IAIxB,MAAM,IAAI,MAAM;IAIvB,OAAO,CAAC,cAAc;CAavB"}