@astram/guard 0.19.0 → 0.20.0

package/dist/enforcement/global-enforcement.guard.js

@@ -23,6 +23,8 @@ const request_principal_js_1 = require("../request-auth/request-principal.js");
 const tokens_js_2 = require("../auth/tokens.js");
 const session_facts_als_js_1 = require("../request-auth/session-facts-als.js");
 const reenroll_allowlist_js_1 = require("./reenroll-allowlist.js");
+const session_restriction_js_1 = require("../session/session-restriction.js");
+const mfa_requirement_service_js_1 = require("../session/mfa-requirement-service.js");
 /** A subtree re-derive that was due but could not be done (resolver error / empty / junk). */
 const SUBTREE_REDERIVE_FAILED = Symbol('subtree-rederive-failed');
 /**
@@ -69,12 +71,14 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
     tokenBinder;
     serviceAuth;
     scopeSubtreeResolver;
-    constructor(reflector, decisionAuthority, tokenBinder, serviceAuth, scopeSubtreeResolver) {
+    mfaRequirement;
+    constructor(reflector, decisionAuthority, tokenBinder, serviceAuth, scopeSubtreeResolver, mfaRequirement) {
         this.reflector = reflector;
         this.decisionAuthority = decisionAuthority;
         this.tokenBinder = tokenBinder;
         this.serviceAuth = serviceAuth;
         this.scopeSubtreeResolver = scopeSubtreeResolver;
+        this.mfaRequirement = mfaRequirement;
     }
     async canActivate(context) {
         // Only HTTP requests are classified here. Non-HTTP contexts (if ever added)
@@ -130,13 +134,11 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
         // NOT on the allowlist (the allowlist is @Public), so a marked session is always
         // denied — the isReenrollAllowed check below is defense-in-depth for a future
         // classified allowlisted route.
-        if (claims.mustReenroll === true) {
-            const method = req?.method;
-            const url = req?.originalUrl ?? req?.url;
-            if (!(0, reenroll_allowlist_js_1.isReenrollAllowed)(method, url)) {
-                throw new common_1.ForbiddenException({ error: 'reenrollment_required' });
-            }
-        }
+        //
+        // D-2 (auth capabilities R2.3): the same gate serves the mandatory-2FA reason
+        // (`mfa_enrollment`, also once a grace deadline has passed — compared here, no DB read), with
+        // its own 403 code and the same allowlist.
+        this.enforceRestriction(claims, req);
         // Attach the resolved principal so downstream handlers can act as this user.
         req.principal = principal;
         // ── ADR-0011 SESSION-FACTS HOT PATH ──────────────────────────────────────────
@@ -184,7 +186,26 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
         // list scope, shares, the engine's record checks all read `req.principal.roleIds`), and the
         // binding is rewritten with the reloaded facts + roles together, so the next requests are
         // served from the cache (GAPS #6) with the same live roles.
-        if (reloaded !== undefined) {
+        // MANDATORY 2FA (auth capabilities R2.5, AC-9): re-evaluate when the permission version moved
+        // past the session's requirement stamp — gate 5 just told us the version (its reload, or the
+        // fresh cached facts it served). Unchanged version ⇒ no DB query. A failed evaluation denies
+        // this request (503) and caches nothing, so the next request reloads and retries.
+        let enforced = claims;
+        let mfaFailed = false;
+        const mfa = this.mfaRequirement;
+        if (mfa !== undefined && mfa !== null) {
+            const token = (0, request_principal_js_1.extractBearerToken)(authHeader);
+            try {
+                enforced = await mfa.refresh(token ?? '', claims, {
+                    version: reloaded?.permissionsVersion ?? usableFacts?.permissionsVersion,
+                    grants: reloaded ?? usableFacts ?? undefined,
+                });
+            }
+            catch {
+                mfaFailed = true;
+            }
+        }
+        if (reloaded !== undefined && !mfaFailed) {
             const liveRoles = (0, session_token_binder_js_1.liveRoleIds)(reloaded);
             const current = liveRoles !== undefined ? { ...claims, roleIds: liveRoles } : claims;
             const rederived = await this.rederiveSubtreeOnVersionMove(authHeader, current, reloaded.permissionsVersion);
@@ -202,12 +223,31 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
                     req.principal = withRoles;
             }
         }
+        if (mfaFailed)
+            throw new mfa_requirement_service_js_1.MfaRequirementUnavailableError();
+        // The requirement may have just changed: enforce it on THIS request (gated routes are never on
+        // the allowlist, so a restricted session is denied here).
+        if (enforced !== claims)
+            this.enforceRestriction(enforced, req);
         if (decision.effect === 'allow') {
             return true;
         }
         // Deny (or any non-allow) → 403. Do NOT leak the reason detail to the caller.
         throw new common_1.ForbiddenException(`Shield enforcement: access denied for ${classification.action} on ${classification.typeKey}.`);
     }
+    /**
+     * The restricted-session gate (spec §4.2, D-2): a restricted session reaches only
+     * `REENROLL_ALLOWED`; anything else is 403 with the reason's code (`reenrollment_required` or
+     * `mfa_enrollment_required`). Fail closed: an allowlist, so an unknown route is denied too.
+     */
+    enforceRestriction(claims, req) {
+        const reason = (0, session_restriction_js_1.restrictionOf)(claims, Date.now());
+        if (reason === null)
+            return;
+        if (!(0, reenroll_allowlist_js_1.isReenrollAllowed)(req?.method, req?.originalUrl ?? req?.url)) {
+            throw new common_1.ForbiddenException({ error: (0, session_restriction_js_1.restrictionErrorCode)(reason) });
+        }
+    }
     /**
      * Write gate 5's reloaded grants and the live roles onto the session binding (ADR-0035). Session
      * bindings only: a service-account key has no binding (its roles and scope are read live per
@@ -297,5 +337,7 @@ exports.GlobalEnforcementGuard = GlobalEnforcementGuard = __decorate([
     __param(3, (0, common_1.Inject)(tokens_js_1.SHIELD_SERVICE_AUTHENTICATOR)),
     __param(4, (0, common_1.Optional)()),
     __param(4, (0, common_1.Inject)(tokens_js_2.SHIELD_SCOPE_SUBTREE_RESOLVER)),
-    __metadata("design:paramtypes", [core_1.Reflector, Object, Function, Object, Object])
+    __param(5, (0, common_1.Optional)()),
+    __param(5, (0, common_1.Inject)(tokens_js_2.SHIELD_MFA_REQUIREMENT)),
+    __metadata("design:paramtypes", [core_1.Reflector, Object, Function, Object, Object, Object])
 ], GlobalEnforcementGuard);

package/dist/enforcement/reenroll-allowlist.d.ts

@@ -9,6 +9,11 @@
  * the restricted state (`/auth/me`, list devices) or leave it (`/auth/logout`). EVERY
  * other authenticated route returns 403 `{ error: 'reenrollment_required' }`.
  *
+ * Auth capabilities D-2: the SAME allowlist serves the mandatory-2FA restriction (`restriction:
+ * 'mfa_enrollment'`, or a passed grace deadline), which answers 403 `{ error:
+ * 'mfa_enrollment_required' }` instead (`session/session-restriction.ts`); confirming a device
+ * lifts either reason.
+ *
  * FAIL-CLOSED: this is an allowlist, not a denylist — a route NOT listed here (incl. an
  * unclassified/unknown route) is DENIED for a `mustReenroll` session. Adding a route
  * that a re-enrolling user must reach means adding it HERE, deliberately.

package/dist/enforcement/reenroll-allowlist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reenroll-allowlist.d.ts","sourceRoot":"","sources":["../../src/enforcement/reenroll-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAO1D,CAAC;AAEH;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAO5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAU3E"}
+{"version":3,"file":"reenroll-allowlist.d.ts","sourceRoot":"","sources":["../../src/enforcement/reenroll-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAO1D,CAAC;AAEH;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAO5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAU3E"}

package/dist/enforcement/reenroll-allowlist.js

@@ -10,6 +10,11 @@
  * the restricted state (`/auth/me`, list devices) or leave it (`/auth/logout`). EVERY
  * other authenticated route returns 403 `{ error: 'reenrollment_required' }`.
  *
+ * Auth capabilities D-2: the SAME allowlist serves the mandatory-2FA restriction (`restriction:
+ * 'mfa_enrollment'`, or a passed grace deadline), which answers 403 `{ error:
+ * 'mfa_enrollment_required' }` instead (`session/session-restriction.ts`); confirming a device
+ * lifts either reason.
+ *
  * FAIL-CLOSED: this is an allowlist, not a denylist — a route NOT listed here (incl. an
  * unclassified/unknown route) is DENIED for a `mustReenroll` session. Adding a route
  * that a re-enrolling user must reach means adding it HERE, deliberately.

package/dist/identity/auth-facts.controller.d.ts

@@ -6,19 +6,46 @@
  * store outage → 503 (never swallowed into an empty projection / fabricated version — that would
  * fail-OPEN by letting a stale/empty view read as authoritative).
  *
+ * Both carry the same freshness token, `authFactsVersion(tenantVersion, isRoot)` (KI #139): a
+ * plain integer the SDK compares for equality, so a root grant or removal makes a cached
+ * projection stale even though the tenant's permission version did not move.
+ *
  * FRAMEWORK-OWNED: mounted by the auth surface when `auth: true`; the consumer implements nothing.
  */
 import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import type { MfaRequirementService } from '../session/mfa-requirement-service.js';
+import { type SessionRestrictionReason } from '../session/session-restriction.js';
 import { type AuthFactProjection, type MariaDbPermissionFactsAdapter } from './permission-facts.adapter.js';
+/** The `/identity/auth-facts` answer for a restricted session (R15.2): no grants, the flag. */
+export interface RestrictedAuthFactProjection extends AuthFactProjection {
+    readonly facts: readonly [];
+    /** The restriction reason (D-2): re-enrol, or mandatory 2FA not yet enrolled. */
+    readonly restricted: SessionRestrictionReason;
+}
 export declare class AuthFactsController {
     private readonly tokenBinder;
     private readonly facts;
-    constructor(tokenBinder: SessionTokenBinder | undefined, facts: MariaDbPermissionFactsAdapter | undefined);
-    getAuthFacts(authorization?: string): Promise<AuthFactProjection>;
+    private readonly mfaRequirement?;
+    constructor(tokenBinder: SessionTokenBinder | undefined, facts: MariaDbPermissionFactsAdapter | undefined, mfaRequirement?: (MfaRequirementService | null) | undefined);
+    /**
+     * R15.2 (F9): a restricted session (re-enrol after a recovery-code login, or mandatory 2FA not
+     * yet enrolled, D-2) gets the same shape with NO grants, `restricted: <reason>` and no
+     * `permissionsVersion` (so the SDK treats it as stale and refetches once the restriction is
+     * lifted). Unrestricted sessions are unchanged.
+     */
+    getAuthFacts(authorization?: string): Promise<AuthFactProjection | RestrictedAuthFactProjection>;
+    /**
+     * The freshness token. Review round 1, item H: resolved like `/identity/auth-facts` (the
+     * mandatory-2FA recompute runs on a version move), and a restricted session gets no version,
+     * only `{ restricted: <reason> }` (a transport reads the missing version as stale and refetches
+     * the restricted projection). Unrestricted sessions are unchanged.
+     */
     getPermissionsVersion(authorization?: string): Promise<{
         version: number;
+    } | {
+        restricted: SessionRestrictionReason;
     }>;
-    /** Resolve the bearer token → the caller's own Principal, or throw a generic 401. */
-    private authenticate;
+    /** Resolve the bearer token → the caller's Principal and bound claims (the restriction), or 401. */
+    private authenticateWithClaims;
 }
 //# sourceMappingURL=auth-facts.controller.d.ts.map

package/dist/identity/auth-facts.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-facts.controller.d.ts","sourceRoot":"","sources":["../../src/identity/auth-facts.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAaH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAGlF,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EACnC,MAAM,+BAA+B,CAAC;AAEvC,qBACa,mBAAmB;IAI5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAG5B,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAHL,WAAW,EAAE,kBAAkB,GAAG,SAAS,EAG3C,KAAK,EAAE,6BAA6B,GAAG,SAAS;IAK7D,YAAY,CACU,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC,kBAAkB,CAAC;IAuBxB,qBAAqB,CACC,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAsB/B,qFAAqF;YACvE,YAAY;CAU3B"}
+{"version":3,"file":"auth-facts.controller.d.ts","sourceRoot":"","sources":["../../src/identity/auth-facts.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAaH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAGlF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAiB,KAAK,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AACjG,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EACnC,MAAM,+BAA+B,CAAC;AAEvC,+FAA+F;AAC/F,MAAM,WAAW,4BAA6B,SAAQ,kBAAkB;IACtE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;CAC/C;AAED,qBACa,mBAAmB;IAI5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAG5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAItB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAPf,WAAW,EAAE,kBAAkB,GAAG,SAAS,EAG3C,KAAK,EAAE,6BAA6B,GAAG,SAAS,EAIhD,cAAc,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA;IAGhE;;;;;OAKG;IAGG,YAAY,CACU,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC,kBAAkB,GAAG,4BAA4B,CAAC;IA8B7D;;;;;OAKG;IAGG,qBAAqB,CACC,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,wBAAwB,CAAA;KAAE,CAAC;IA0B1E,oGAAoG;YACtF,sBAAsB;CAerC"}

package/dist/identity/auth-facts.controller.js

@@ -7,6 +7,10 @@
  * store outage → 503 (never swallowed into an empty projection / fabricated version — that would
  * fail-OPEN by letting a stale/empty view read as authoritative).
  *
+ * Both carry the same freshness token, `authFactsVersion(tenantVersion, isRoot)` (KI #139): a
+ * plain integer the SDK compares for equality, so a root grant or removal makes a cached
+ * projection stale even though the tenant's permission version did not move.
+ *
  * FRAMEWORK-OWNED: mounted by the auth surface when `auth: true`; the consumer implements nothing.
  */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
@@ -28,16 +32,34 @@ const classification_decorator_js_1 = require("../enforcement/classification.dec
 const tokens_js_1 = require("../request-auth/tokens.js");
 const request_principal_js_1 = require("../request-auth/request-principal.js");
 const tokens_js_2 = require("../auth/tokens.js");
+const session_restriction_js_1 = require("../session/session-restriction.js");
 const permission_facts_adapter_js_1 = require("./permission-facts.adapter.js");
 let AuthFactsController = class AuthFactsController {
     tokenBinder;
     facts;
-    constructor(tokenBinder, facts) {
+    mfaRequirement;
+    constructor(tokenBinder, facts, mfaRequirement) {
         this.tokenBinder = tokenBinder;
         this.facts = facts;
+        this.mfaRequirement = mfaRequirement;
     }
+    /**
+     * R15.2 (F9): a restricted session (re-enrol after a recovery-code login, or mandatory 2FA not
+     * yet enrolled, D-2) gets the same shape with NO grants, `restricted: <reason>` and no
+     * `permissionsVersion` (so the SDK treats it as stale and refetches once the restriction is
+     * lifted). Unrestricted sessions are unchanged.
+     */
     async getAuthFacts(authorization) {
-        const principal = await this.authenticate(authorization);
+        const { principal, claims } = await this.authenticateWithClaims(authorization);
+        const restricted = (0, session_restriction_js_1.restrictionOf)(claims, Date.now());
+        if (restricted !== null) {
+            return {
+                principalId: principal.id,
+                facts: [],
+                projectedAt: Date.now(),
+                restricted,
+            };
+        }
         if (this.facts === undefined || this.facts === null) {
             throw new common_1.HttpException({ error: 'authorization_unavailable' }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
         }
@@ -51,14 +73,25 @@ let AuthFactsController = class AuthFactsController {
             throw err;
         }
     }
+    /**
+     * The freshness token. Review round 1, item H: resolved like `/identity/auth-facts` (the
+     * mandatory-2FA recompute runs on a version move), and a restricted session gets no version,
+     * only `{ restricted: <reason> }` (a transport reads the missing version as stale and refetches
+     * the restricted projection). Unrestricted sessions are unchanged.
+     */
     async getPermissionsVersion(authorization) {
-        const principal = await this.authenticate(authorization);
+        const { principal, claims } = await this.authenticateWithClaims(authorization);
+        const restricted = (0, session_restriction_js_1.restrictionOf)(claims, Date.now());
+        if (restricted !== null)
+            return { restricted };
         if (this.facts === undefined || this.facts === null) {
             throw new common_1.HttpException({ error: 'authorization_unavailable' }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
         }
         try {
-            const version = await this.facts.currentVersionFor(principal.id, principal.tenantId);
-            return { version };
+            // The same freshness token the projection carries: tenant version + root bit (KI #139),
+            // so a root grant or removal makes a cached projection stale. See `authFactsVersion`.
+            const tenantVersion = await this.facts.currentVersionFor(principal.id, principal.tenantId);
+            return { version: (0, permission_facts_adapter_js_1.authFactsVersion)(tenantVersion, principal.isRoot === true) };
         }
         catch (err) {
             if (err instanceof permission_facts_adapter_js_1.AuthorizationUnavailableError) {
@@ -67,16 +100,16 @@ let AuthFactsController = class AuthFactsController {
             throw err;
         }
     }
-    /** Resolve the bearer token → the caller's own Principal, or throw a generic 401. */
-    async authenticate(authorization) {
+    /** Resolve the bearer token → the caller's Principal and bound claims (the restriction), or 401. */
+    async authenticateWithClaims(authorization) {
         if (this.tokenBinder === undefined || this.tokenBinder === null) {
             throw new common_1.HttpException({ error: 'unauthorized' }, common_1.HttpStatus.UNAUTHORIZED);
         }
-        const principal = await (0, request_principal_js_1.resolveRequestPrincipal)(authorization, this.tokenBinder);
-        if (principal === null) {
+        const resolved = await (0, request_principal_js_1.resolveRequestAuth)(authorization, this.tokenBinder, undefined, this.mfaRequirement);
+        if (resolved === null) {
             throw new common_1.HttpException({ error: 'unauthorized' }, common_1.HttpStatus.UNAUTHORIZED);
         }
-        return principal;
+        return resolved;
     }
 };
 exports.AuthFactsController = AuthFactsController;
@@ -102,5 +135,7 @@ exports.AuthFactsController = AuthFactsController = __decorate([
     __param(0, (0, common_1.Inject)(tokens_js_1.SHIELD_SESSION_TOKEN_BINDER)),
     __param(1, (0, common_1.Optional)()),
     __param(1, (0, common_1.Inject)(tokens_js_2.SHIELD_PERMISSION_FACTS)),
-    __metadata("design:paramtypes", [Object, Object])
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(tokens_js_2.SHIELD_MFA_REQUIREMENT)),
+    __metadata("design:paramtypes", [Object, Object, Object])
 ], AuthFactsController);

package/dist/identity/identity-actions.d.ts

@@ -4,7 +4,7 @@
  * ObjectType (`actions` / `crudActions`, ADR-0038) and read through {@link actionsOf}; the
  * constants below stay exported as the single literal each identity object declares.
  */
-import type { ObjectType } from '@astram/engine';
+import type { ActionDeclaration } from '@astram/engine';
 export declare const MODULE_KEY = "identity";
 export declare const IDENTITY_ACTIONS: readonly ["read", "create", "update", "delete"];
 export type IdentityAction = (typeof IDENTITY_ACTIONS)[number];
@@ -38,7 +38,7 @@ export type ServiceAccountAction = (typeof SERVICE_ACCOUNT_ACTIONS)[number];
  * extras, or exactly the declared list when `crudActions === false`. Delegates to engine
  * `effectiveActions`, so an invalid declaration throws the same `RegistrationError`.
  */
-export declare function actionsOf(reg: Pick<ObjectType, 'actions' | 'crudActions'>): readonly string[];
+export declare function actionsOf(reg: ActionDeclaration): readonly string[];
 /**
  * @deprecated Use {@link actionsOf} with the type's registration. The vocabulary now lives on
  * the object type (ADR-0038), so a typeKey alone cannot name it: this returns the CRUD verbs

package/dist/identity/identity-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,gBAAgB,iDAAkD,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wCAAyC,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,4BAA6B,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,gEAM1B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,aAAa,CAAC,GAAG,SAAS,MAAM,EAAE,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE9D"}
+{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,gBAAgB,iDAAkD,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wCAAyC,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,4BAA6B,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,gEAM1B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,iBAAiB,GAAG,SAAS,MAAM,EAAE,CAEnE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE9D"}

package/dist/identity/module-registry.bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-registry.bridge.d.ts","sourceRoot":"","sources":["../../src/identity/module-registry.bridge.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQlE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,cAAc,CA4B9F"}
+{"version":3,"file":"module-registry.bridge.d.ts","sourceRoot":"","sources":["../../src/identity/module-registry.bridge.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,gBAAgB,CAAC;AASlE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,cAAc,CAwB9F"}

package/dist/identity/module-registry.bridge.js

@@ -13,18 +13,15 @@ exports.buildIdentityModuleRegistry = buildIdentityModuleRegistry;
 const core_1 = require("@astram/core");
 const engine_1 = require("@astram/engine");
 const identity_actions_js_1 = require("./identity-actions.js");
+const core_access_js_1 = require("../authz/core-access.js");
 function toObjectType(input) {
     return typeof input === 'function' ? (0, engine_1.reflectObjectType)(input) : input;
 }
 function buildIdentityModuleRegistry(inputs) {
     const regs = inputs.map(toObjectType);
     const objectTypes = regs.map((r) => {
-        const a = r.access ?? {};
-        const access = {
-            ...(a.owned !== undefined ? { owned: a.owned } : {}),
-            ...(a.tenantScoped !== undefined ? { tenantScoped: a.tenantScoped } : {}),
-            ...(a.system !== undefined ? { system: a.system } : {}),
-        };
+        // A global type reaches core as `system` (G-022, ADR-0046).
+        const access = (0, core_access_js_1.coreAccessOf)(r.access);
         return {
             typeKey: r.typeKey,
             label: r.typeKey,

package/dist/identity/permission-facts.adapter.d.ts

@@ -21,6 +21,27 @@ export interface AuthFactProjection {
     readonly projectedAt: number;
     readonly permissionsVersion?: number;
 }
+/**
+ * The freshness token `GET /identity/auth-facts` (`permissionsVersion`) and
+ * `GET /identity/permissions-version` (`version`) carry: the per-tenant
+ * `authz_permission_version` with the caller's root status folded into the low bit,
+ * `tenantVersion * 2 + (isRoot ? 1 : 0)` (KI #139).
+ *
+ * Why: root adds the control-plane keys to the projection, but root membership comes from
+ * the server's root allowlist (`SHIELD_ROOT_IDS`), not from the tenant's grants, so nothing
+ * bumps the tenant version when it changes. With the bare tenant version, a projection cached
+ * before the caller became root (or stopped being root) stayed "fresh" in the SDK. Folding the
+ * bit in makes the two projections carry different versions at the same tenant version.
+ *
+ * Shape stays a plain non-negative integer (backward compatible). It is an opaque token:
+ * `@astram/sdk` >= 0.2.1 compares it for equality, so both directions refetch. An older SDK
+ * compares `cached >= current`, so it catches a root grant (version goes up) but not a root
+ * removal; the template also resets its client at every sign-in, which covers both.
+ * No DB read is added: both routes already read the tenant version, and `isRoot` comes from
+ * the bound session claims. `currentVersionFor` keeps returning the raw tenant version (the
+ * session's subtree stamp compares it with gate 5's reloaded version).
+ */
+export declare function authFactsVersion(tenantVersion: number, isRoot: boolean): number;
 /** A store/dependency outage while computing facts — the controller maps this to 503. */
 export declare class AuthorizationUnavailableError extends Error {
     constructor(message?: string);
@@ -37,6 +58,7 @@ export declare class MariaDbPermissionFactsAdapter {
     /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
     schemas?: FrameworkSchemaNames);
     projectFor(principalId: string, tenantId: string, isRoot: boolean): Promise<AuthFactProjection>;
+    /** The raw per-tenant permission version (not the {@link authFactsVersion} token). */
     currentVersionFor(_principalId: string, tenantId: string): Promise<number>;
     private readRoleIdsForTenant;
     private readGrantKeys;

package/dist/identity/permission-facts.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../src/identity/permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,yFAAyF;AACzF,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,SAA8B;CAIlD;AAYD,qBAAa,6BAA6B;IAMtC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;IARtB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAO1B,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,kBAAkB,CAAC;IAmBxB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YASlE,oBAAoB;YAepB,aAAa;YASb,WAAW;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAaxB"}
+{"version":3,"file":"permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../src/identity/permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAE/E;AAED,yFAAyF;AACzF,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,SAA8B;CAIlD;AAYD,qBAAa,6BAA6B;IAMtC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;IARtB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAO1B,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,kBAAkB,CAAC;IAmB9B,sFAAsF;IAChF,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YASlE,oBAAoB;YAepB,aAAa;YASb,WAAW;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAaxB"}

package/dist/identity/permission-facts.adapter.js

@@ -10,7 +10,31 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbPermissionFactsAdapter = exports.AuthorizationUnavailableError = void 0;
+exports.authFactsVersion = authFactsVersion;
 const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
+/**
+ * The freshness token `GET /identity/auth-facts` (`permissionsVersion`) and
+ * `GET /identity/permissions-version` (`version`) carry: the per-tenant
+ * `authz_permission_version` with the caller's root status folded into the low bit,
+ * `tenantVersion * 2 + (isRoot ? 1 : 0)` (KI #139).
+ *
+ * Why: root adds the control-plane keys to the projection, but root membership comes from
+ * the server's root allowlist (`SHIELD_ROOT_IDS`), not from the tenant's grants, so nothing
+ * bumps the tenant version when it changes. With the bare tenant version, a projection cached
+ * before the caller became root (or stopped being root) stayed "fresh" in the SDK. Folding the
+ * bit in makes the two projections carry different versions at the same tenant version.
+ *
+ * Shape stays a plain non-negative integer (backward compatible). It is an opaque token:
+ * `@astram/sdk` >= 0.2.1 compares it for equality, so both directions refetch. An older SDK
+ * compares `cached >= current`, so it catches a root grant (version goes up) but not a root
+ * removal; the template also resets its client at every sign-in, which covers both.
+ * No DB read is added: both routes already read the tenant version, and `isRoot` comes from
+ * the bound session claims. `currentVersionFor` keeps returning the raw tenant version (the
+ * session's subtree stamp compares it with gate 5's reloaded version).
+ */
+function authFactsVersion(tenantVersion, isRoot) {
+    return tenantVersion * 2 + (isRoot ? 1 : 0);
+}
 /** A store/dependency outage while computing facts — the controller maps this to 503. */
 class AuthorizationUnavailableError extends Error {
     constructor(message = 'authorization_unavailable') {
@@ -44,7 +68,7 @@ class MariaDbPermissionFactsAdapter {
             const granted = roleIds.length > 0 ? await this.readGrantKeys(roleIds) : [];
             const expanded = this.expandGrantKeys(granted);
             const keys = isRoot ? [...new Set([...expanded, ...this.controlPlaneKeys])] : expanded;
-            const permissionsVersion = await this.readVersion(tenantId);
+            const permissionsVersion = authFactsVersion(await this.readVersion(tenantId), isRoot);
             return {
                 principalId,
                 facts: keys.map((action) => ({ action, allowed: true })),
@@ -58,6 +82,7 @@ class MariaDbPermissionFactsAdapter {
             throw new AuthorizationUnavailableError(err.message);
         }
     }
+    /** The raw per-tenant permission version (not the {@link authFactsVersion} token). */
     async currentVersionFor(_principalId, tenantId) {
         try {
             return await this.readVersion(tenantId);

package/dist/index.d.ts

@@ -72,11 +72,18 @@ export { FRAMEWORK_SCHEMAS } from './config/config.module.js';
 export type { FrameworkSchemaNames } from './config/framework-schema-names.js';
 export { frameworkSchemasOf, loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, loadDbConfig, loadRedisConfig, loadSessionLifetimes, loadRefreshHmacKey, assertRefreshHmacKey, DEFAULT_DB_CONFIG, DEFAULT_REDIS_URL, type DbConfig, type RedisConfig, type SessionLifetimeOverrides, loadLoginIpLimit, loadRefreshReplayWindowMs, DEFAULT_LOGIN_IP_LIMIT, isDevOrTestNodeEnv, type LoginIpLimitConfig, loadDbTlsConfig, type DbTlsConfig, } from './config/app-config.js';
 export { rootIdsFromEnv } from './config/root-ids-from-env.js';
-export { ORG_BOOTSTRAP_PRINCIPAL_ID, assertNoReservedRootId, } from './config/reserved-principal-ids.js';
+export { ORG_BOOTSTRAP_PRINCIPAL_ID, assertNoReservedRootId, RESERVED_OPERATION_PRINCIPALS, reservedOperationPrincipal, type ReservedOperationPrincipal, } from './config/reserved-principal-ids.js';
 export { mariadbSslOption } from './auth/connections.js';
 export { SHIELD_REDIS, SHIELD_CREDENTIAL_RESOLVER, SHIELD_PROFILE_RESOLVER, SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY, SHIELD_CREDENTIAL_WRITER, SHIELD_RESET_TOKEN_STORE, SHIELD_EMAIL_CHANGE_TOKEN_STORE, SHIELD_EMAIL_SENDER, SHIELD_MESSAGE_DISPATCHER, SHIELD_RECOVERY_CODE_STORE, SHIELD_PROFILE_WRITER, SHIELD_SESSION_SWEEPER, SHIELD_AUDIT_SINK, SHIELD_MFA_DEVICE_STORE, SHIELD_TOTP_VERIFIER_OVERRIDE, } from './auth/tokens.js';
 export { MariaDbCredentialResolver } from './authentication/mariadb-credential-resolver.js';
-export type { SessionView, SessionTokensView, SessionSuccess, LoginRequest, MfaChallengeResponse, LoginResponse, MfaRequest, MfaResponse, RefreshRequest, RefreshResponse, LogoutRequest, LogoutAck, } from './auth/dto.js';
+export { resolveSignInWith, DEFAULT_SIGN_IN_WITH, type SignInMethod, } from './authentication/sign-in-with.js';
+export { SHIELD_SIGN_IN_WITH } from './auth/tokens.js';
+export type { SessionView, SessionTokensView, SessionSuccess, LoginRequest, MfaChallengeResponse, LoginResponse, MfaRequest, MfaResponse, RefreshRequest, RefreshResponse, LogoutRequest, LogoutAck, LoginOptionsView, } from './auth/dto.js';
+export type { ShieldCaptchaOption } from './captcha/captcha.providers.js';
+export { loadCaptchaConfig, CAPTCHA_ENDPOINTS, CAPTCHA_MODES, CAPTCHA_FAIL_MODES, DEFAULT_CAPTCHA_THRESHOLD, DEFAULT_CAPTCHA_MIN_SCORE, DEFAULT_CAPTCHA_TIMEOUT_MS, MAX_CAPTCHA_TIMEOUT_MS, type CaptchaConfig, type CaptchaEndpoint, type CaptchaMode, type CaptchaFailMode, type LoadCaptchaConfigOptions, } from './config/captcha-config.js';
+export { TurnstileVerifier, TURNSTILE_SITEVERIFY_URL, type TurnstileVerifierOptions, } from './captcha/turnstile-verifier.js';
+export { RecaptchaVerifier, RECAPTCHA_SITEVERIFY_URL, type RecaptchaVerifierOptions, } from './captcha/recaptcha-verifier.js';
+export { SHIELD_CAPTCHA_GATE } from './auth/tokens.js';
 export { AuthModule, type AuthModuleOptions } from './auth/auth.module.js';
 export { makeDefaultTotpVerifier, resolveTotpVerifier, hmacSha1 } from './auth/auth.module.js';
 export type { CredentialResolver, ResolvedCredential, RequiredFactor } from '@astram/core';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,UAAU,EACV,SAAS,GACV,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,YAAY,EACZ,yBAAyB,EAGzB,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAKpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EACV,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,QAAQ,GACT,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAS/E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAKlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAInF,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EACL,UAAU,EACV,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EAExB,wBAAwB,EACxB,KAAK,+BAA+B,EACpC,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EAEZ,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAEzB,wBAAwB,EACxB,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EACL,0BAA0B,EAC1B,KAAK,+BAA+B,GACrC,MAAM,sCAAsC,CAAC;AAM9C,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,kCAAkC,GACxC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,8BAA8B,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGpG,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,uBAAuB,GAC7B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAG7B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,kBAAkB,EAEvB,eAAe,EACf,KAAK,WAAW,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAezD,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EAExB,+BAA+B,EAC/B,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAOvB,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQ3F,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG9E,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,+BAA+B,EAC/B,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAQ5E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,UAAU,EACV,SAAS,GACV,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,YAAY,EACZ,yBAAyB,EAGzB,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAKpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EACV,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,QAAQ,GACT,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAS/E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAKlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAInF,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EACL,UAAU,EACV,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EAExB,wBAAwB,EACxB,KAAK,+BAA+B,EACpC,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EAEZ,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAEzB,wBAAwB,EACxB,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EACL,0BAA0B,EAC1B,KAAK,+BAA+B,GACrC,MAAM,sCAAsC,CAAC;AAM9C,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,kCAAkC,GACxC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,8BAA8B,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGpG,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,uBAAuB,GAC7B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAG7B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,kBAAkB,EAEvB,eAAe,EACf,KAAK,WAAW,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EAEtB,6BAA6B,EAC7B,0BAA0B,EAC1B,KAAK,0BAA0B,GAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAezD,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EAExB,+BAA+B,EAC/B,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAIvD,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,EACT,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAIvB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAOvD,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQ3F,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG9E,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,+BAA+B,EAC/B,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAQ5E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}