@astram/identity 0.13.0 → 0.14.0

package/dist/features/org-bootstrap/org-bootstrap-error.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgBootstrapError = void 0;
+/**
+ * A refusal or failure of the org bootstrap run. The message is fixed text plus names from the
+ * operator's own file; it never carries a password, a link or token, or a driver message.
+ */
+class OrgBootstrapError extends Error {
+    code;
+    /** `step_failed` only: the manifest step key that failed. */
+    step;
+    /** `step_failed` only: what the run had written before it stopped. */
+    written;
+    constructor(code, message, extra = {}) {
+        super(message);
+        this.name = 'OrgBootstrapError';
+        this.code = code;
+        if (extra.step !== undefined)
+            this.step = extra.step;
+        if (extra.written !== undefined)
+            this.written = extra.written;
+    }
+}
+exports.OrgBootstrapError = OrgBootstrapError;

package/dist/features/org-bootstrap/org-bootstrap-file.d.ts

@@ -0,0 +1,58 @@
+export interface OrgBootstrapRoot {
+    username: string;
+    email: string;
+    /** Tenant path: `A` or `A/B` (tenant name, then child names). */
+    homeCompany: string;
+}
+export interface OrgBootstrapRole {
+    name: string;
+    permissions: string[];
+}
+export interface OrgBootstrapPosting {
+    role: string;
+    department?: string;
+    branch?: string;
+}
+export interface OrgBootstrapUser {
+    username: string;
+    email: string;
+    /** Path of child names relative to the tenant (`A/B` means tenant > A > B). */
+    company?: string;
+    postings?: OrgBootstrapPosting[];
+}
+export interface OrgBootstrapCompany {
+    name: string;
+    departments?: string[];
+    branches?: string[];
+    roles?: OrgBootstrapRole[];
+    users?: OrgBootstrapUser[];
+    children?: OrgBootstrapCompany[];
+}
+export interface OrgBootstrapFile {
+    version: 1;
+    roots: OrgBootstrapRoot[];
+    tenants: OrgBootstrapCompany[];
+}
+export interface OrgBootstrapFileIssue {
+    path: string;
+    message: string;
+}
+export interface OrgBootstrapFileOptions {
+    /** `GrantAdminService.listCatalog()` keys: catalog keys plus computed wildcards. */
+    grantableKeys: ReadonlySet<string>;
+}
+/** The closed key sets, exported so the schema parity test compares against the parser's own. */
+export declare const ORG_FILE_KEYS: {
+    readonly file: readonly ["version", "roots", "tenants"];
+    readonly root: readonly ["username", "email", "homeCompany"];
+    readonly company: readonly ["name", "departments", "branches", "roles", "users", "children"];
+    readonly role: readonly ["name", "permissions"];
+    readonly user: readonly ["username", "email", "company", "postings"];
+    readonly posting: readonly ["role", "department", "branch"];
+};
+export declare class OrgBootstrapFileError extends Error {
+    readonly issues: OrgBootstrapFileIssue[];
+    constructor(issues: OrgBootstrapFileIssue[]);
+}
+export declare function parseOrgBootstrapFile(input: unknown, options: OrgBootstrapFileOptions): OrgBootstrapFile;
+//# sourceMappingURL=org-bootstrap-file.d.ts.map

package/dist/features/org-bootstrap/org-bootstrap-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-bootstrap-file.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap-file.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,OAAO,EAAE,mBAAmB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,oFAAoF;IACpF,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACpC;AAED,iGAAiG;AACjG,eAAO,MAAM,aAAa;;;;;;;CAOhB,CAAC;AAEX,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC;gBAC7B,MAAM,EAAE,qBAAqB,EAAE;CAO5C;AAmBD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,uBAAuB,GAC/B,gBAAgB,CAqRlB"}

package/dist/features/org-bootstrap/org-bootstrap-file.js

@@ -0,0 +1,323 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgBootstrapFileError = exports.ORG_FILE_KEYS = void 0;
+exports.parseOrgBootstrapFile = parseOrgBootstrapFile;
+/**
+ * G-009 T8: strict, pure parser for the org bootstrap file (version 1).
+ *
+ * Hand-written (the repo carries no validator library) with closed key sets at every level;
+ * `org-bootstrap.schema.json` documents the same shape and a parity test keeps them in step.
+ * No I/O. Every problem is collected as `{ path, message }`; messages never echo input values, so a
+ * stray `password` field is reported by name only.
+ */
+const guard_1 = require("@astram/guard");
+const org_names_js_1 = require("./org-names.js");
+/** The closed key sets, exported so the schema parity test compares against the parser's own. */
+exports.ORG_FILE_KEYS = {
+    file: ['version', 'roots', 'tenants'],
+    root: ['username', 'email', 'homeCompany'],
+    company: ['name', 'departments', 'branches', 'roles', 'users', 'children'],
+    role: ['name', 'permissions'],
+    user: ['username', 'email', 'company', 'postings'],
+    posting: ['role', 'department', 'branch'],
+};
+class OrgBootstrapFileError extends Error {
+    issues;
+    constructor(issues) {
+        super(`Org bootstrap file is invalid (${issues.length} issue${issues.length === 1 ? '' : 's'}).`);
+        this.name = 'OrgBootstrapFileError';
+        this.issues = issues;
+    }
+}
+exports.OrgBootstrapFileError = OrgBootstrapFileError;
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const join = (base, key) => (base === '' ? key : `${base}.${key}`);
+function parseOrgBootstrapFile(input, options) {
+    const issues = [];
+    const add = (path, message) => issues.push({ path, message });
+    /** A record with only the allowed keys; unknown keys are reported by name, never by value. */
+    const closed = (v, path, allowed) => {
+        if (!isRecord(v)) {
+            add(path === '' ? '(file)' : path, 'must be an object');
+            return undefined;
+        }
+        for (const k of Object.keys(v)) {
+            if (!allowed.includes(k))
+                add(join(path, k), 'unknown field');
+        }
+        return v;
+    };
+    const text = (v, path) => {
+        if (typeof v !== 'string' || v.trim() === '') {
+            add(path, 'must be a non-empty string');
+            return undefined;
+        }
+        return v.trim();
+    };
+    const optionalArray = (v, path) => {
+        if (v === undefined)
+            return undefined;
+        if (!Array.isArray(v)) {
+            add(path, 'must be an array');
+            return undefined;
+        }
+        return v;
+    };
+    const nameList = (v, path) => {
+        const out = [];
+        const seen = new Set();
+        (optionalArray(v, path) ?? []).forEach((item, i) => {
+            const p = `${path}[${i}]`;
+            const s = text(item, p);
+            if (s === undefined)
+                return;
+            // R3-1: duplicates compare like the DB collation (case, accents, trailing space).
+            if (seen.has((0, org_names_js_1.nameKey)(s)))
+                add(p, 'duplicate within this company');
+            seen.add((0, org_names_js_1.nameKey)(s));
+            out.push(s);
+        });
+        return out;
+    };
+    const f = closed(input, '', exports.ORG_FILE_KEYS.file);
+    if (!f)
+        throw new OrgBootstrapFileError(issues);
+    if (f.version !== 1)
+        add('version', 'must be the number 1');
+    // ---- pass 1: companies (structure, roles, name uniqueness), building the lookup tree ----
+    const globalRoles = new Set();
+    const tenantNodes = new Map();
+    const nodes = []; // depth-first, parent before children
+    const walkCompany = (raw, path, parent, siblings) => {
+        const c = closed(raw, path, exports.ORG_FILE_KEYS.company);
+        if (!c)
+            return undefined;
+        const name = text(c.name, `${path}.name`);
+        if (name !== undefined && name.includes('/'))
+            add(`${path}.name`, 'must not contain "/"');
+        const departments = nameList(c.departments, `${path}.departments`);
+        const branches = nameList(c.branches, `${path}.branches`);
+        const roles = [];
+        const roleNames = new Set();
+        (optionalArray(c.roles, `${path}.roles`) ?? []).forEach((rr, i) => {
+            const rp = `${path}.roles[${i}]`;
+            const r = closed(rr, rp, exports.ORG_FILE_KEYS.role);
+            if (!r)
+                return;
+            const rname = text(r.name, `${rp}.name`);
+            const perms = [];
+            if (!Array.isArray(r.permissions)) {
+                add(`${rp}.permissions`, 'must be an array of permission keys');
+            }
+            else {
+                r.permissions.forEach((k, j) => {
+                    const kp = `${rp}.permissions[${j}]`;
+                    if (typeof k !== 'string')
+                        add(kp, 'must be a string');
+                    else if (!options.grantableKeys.has(k))
+                        add(kp, 'not a grantable permission key');
+                    else
+                        perms.push(k);
+                });
+            }
+            if (rname !== undefined) {
+                if (globalRoles.has((0, org_names_js_1.nameKey)(rname)))
+                    add(`${rp}.name`, 'duplicate role name (roles are global by name)');
+                globalRoles.add((0, org_names_js_1.nameKey)(rname));
+                roleNames.add(rname);
+                roles.push({ name: rname, permissions: perms });
+            }
+        });
+        const node = {
+            name: name ?? '',
+            path,
+            parent,
+            departments: new Set(departments),
+            branches: new Set(branches),
+            roles: roleNames,
+            children: new Map(),
+            rawUsers: c.users,
+            usersPath: `${path}.users`,
+        };
+        if (name !== undefined) {
+            const clash = [...siblings.keys()].some((k) => (0, org_names_js_1.nameKey)(k) === (0, org_names_js_1.nameKey)(name));
+            if (clash)
+                add(`${path}.name`, 'duplicate company name among siblings');
+            else
+                siblings.set(name, node);
+        }
+        nodes.push(node);
+        const children = [];
+        (optionalArray(c.children, `${path}.children`) ?? []).forEach((cc, i) => {
+            const parsed = walkCompany(cc, `${path}.children[${i}]`, node, node.children);
+            if (parsed)
+                children.push(parsed);
+        });
+        const out = { name: name ?? '' };
+        if (c.departments !== undefined)
+            out.departments = departments;
+        if (c.branches !== undefined)
+            out.branches = branches;
+        if (c.roles !== undefined)
+            out.roles = roles;
+        if (children.length > 0 || c.children !== undefined)
+            out.children = children;
+        return out;
+    };
+    const tenants = [];
+    const tenantsRaw = f.tenants;
+    if (!Array.isArray(tenantsRaw))
+        add('tenants', 'must be an array');
+    else if (tenantsRaw.length === 0)
+        add('tenants', 'must declare at least one tenant');
+    else
+        tenantsRaw.forEach((t, i) => {
+            const parsed = walkCompany(t, `tenants[${i}]`, undefined, tenantNodes);
+            if (parsed)
+                tenants.push(parsed);
+        });
+    const resolvePath = (start, raw) => {
+        let level = start;
+        let node;
+        for (const seg of raw.split('/')) {
+            node = level.get(seg.trim());
+            if (!node)
+                return undefined;
+            level = node.children;
+        }
+        return node;
+    };
+    // ---- pass 2: roots, then users in depth-first order (first occurrence wins on duplicates) ----
+    const usernames = new Set();
+    const emails = new Set();
+    const claim = (username, email, path) => {
+        if (username !== undefined) {
+            const k = (0, org_names_js_1.nameKey)(username);
+            if (usernames.has(k))
+                add(`${path}.username`, 'duplicate username (case-insensitive)');
+            usernames.add(k);
+        }
+        if (email !== undefined) {
+            const k = (0, org_names_js_1.nameKey)(email);
+            if (emails.has(k))
+                add(`${path}.email`, 'duplicate email (case-insensitive)');
+            emails.add(k);
+        }
+    };
+    const emailOf = (v, path) => {
+        if (typeof v !== 'string' || !(0, guard_1.isEmailShaped)(v.trim())) {
+            add(path, 'must be a valid email address');
+            return undefined;
+        }
+        return (0, guard_1.canonicalEmail)(v);
+    };
+    const roots = [];
+    (optionalArray(f.roots, 'roots') ?? []).forEach((rr, i) => {
+        const p = `roots[${i}]`;
+        const r = closed(rr, p, exports.ORG_FILE_KEYS.root);
+        if (!r)
+            return;
+        const username = text(r.username, `${p}.username`);
+        const email = emailOf(r.email, `${p}.email`);
+        const home = text(r.homeCompany, `${p}.homeCompany`);
+        if (home !== undefined && !resolvePath(tenantNodes, home)) {
+            add(`${p}.homeCompany`, 'does not name a company declared in this file');
+        }
+        claim(username, email, p);
+        if (username !== undefined && email !== undefined && home !== undefined) {
+            roots.push({ username, email, homeCompany: home });
+        }
+    });
+    const inScope = (start, pick, value) => {
+        for (let n = start; n; n = n.parent)
+            if (pick(n).has(value))
+                return true;
+        return false;
+    };
+    const usersByNode = new Map();
+    for (const node of nodes) {
+        const users = [];
+        usersByNode.set(node, users);
+        (optionalArray(node.rawUsers, node.usersPath) ?? []).forEach((uu, i) => {
+            const p = `${node.usersPath}[${i}]`;
+            const u = closed(uu, p, exports.ORG_FILE_KEYS.user);
+            if (!u)
+                return;
+            const username = text(u.username, `${p}.username`);
+            const email = emailOf(u.email, `${p}.email`);
+            claim(username, email, p);
+            let home = node;
+            let companyRaw;
+            if (u.company !== undefined) {
+                companyRaw = text(u.company, `${p}.company`);
+                if (companyRaw !== undefined) {
+                    let top = node;
+                    while (top.parent)
+                        top = top.parent;
+                    const found = resolvePath(new Map([[top.name, top]]), `${top.name}/${companyRaw}`);
+                    if (found)
+                        home = found;
+                    else
+                        add(`${p}.company`, 'does not exist under this tenant');
+                }
+            }
+            const postings = [];
+            const tuples = new Set();
+            (optionalArray(u.postings, `${p}.postings`) ?? []).forEach((pp, j) => {
+                const q = `${p}.postings[${j}]`;
+                const po = closed(pp, q, exports.ORG_FILE_KEYS.posting);
+                if (!po)
+                    return;
+                const role = text(po.role, `${q}.role`);
+                if (role !== undefined && !inScope(home, (n) => n.roles, role)) {
+                    add(`${q}.role`, 'not declared on this company or an ancestor');
+                }
+                const posting = { role: role ?? '' };
+                for (const [key, pick] of [
+                    ['department', (n) => n.departments],
+                    ['branch', (n) => n.branches],
+                ]) {
+                    if (po[key] === undefined)
+                        continue;
+                    const v = text(po[key], `${q}.${key}`);
+                    if (v === undefined)
+                        continue;
+                    if (!inScope(home, pick, v))
+                        add(`${q}.${key}`, 'not declared on this company or an ancestor');
+                    posting[key] = v;
+                }
+                const tuple = JSON.stringify([role, posting.department ?? null, posting.branch ?? null]);
+                if (tuples.has(tuple))
+                    add(q, 'duplicate posting');
+                tuples.add(tuple);
+                if (role !== undefined)
+                    postings.push(posting);
+            });
+            if (username !== undefined && email !== undefined) {
+                const user = { username, email };
+                if (companyRaw !== undefined)
+                    user.company = companyRaw;
+                if (u.postings !== undefined)
+                    user.postings = postings;
+                users.push(user);
+            }
+        });
+    }
+    if (issues.length > 0)
+        throw new OrgBootstrapFileError(issues);
+    // Attach parsed users to the parsed companies (same depth-first order as `nodes`).
+    const attach = (list, map) => {
+        list.forEach((c, i) => {
+            const n = map[i];
+            if (!n)
+                return;
+            const users = usersByNode.get(n) ?? [];
+            if (users.length > 0)
+                c.users = users;
+            if (c.children)
+                attach(c.children, [...n.children.values()]);
+        });
+    };
+    attach(tenants, [...tenantNodes.values()]);
+    return { version: 1, roots, tenants };
+}

package/dist/features/org-bootstrap/org-bootstrap-plan.d.ts

@@ -0,0 +1,79 @@
+/**
+ * G-009 T9: the pure org bootstrap planner (SPEC R4, R8, R10, R13).
+ *
+ * `(file, state) -> { entries, conflicts }`. No I/O, no mutation of its inputs. Additive only: an
+ * entry that is in the state but not in the file is reported (`not-in-file`), a differing field is
+ * reported (`drift`), nothing is ever planned as a delete or an overwrite. Only the file's tenants'
+ * subtrees are looked at, so onboarding tenant B never reports tenant A.
+ */
+import type { OrgBootstrapFile } from './org-bootstrap-file.js';
+export type CredentialState = 'none' | 'locked' | 'usable';
+export declare const PLAN_KIND_ORDER: readonly ["company", "department", "branch", "company_department", "company_branch", "role", "role_claim", "grant", "user", "membership", "posting", "credential", "root_flag"];
+export type PlanKind = (typeof PLAN_KIND_ORDER)[number];
+export type PlanStatus = 'create' | 'unchanged' | 'drift' | 'not-in-file' | 'conflict';
+export interface PlanEntry {
+    kind: PlanKind;
+    path: string;
+    status: PlanStatus;
+    detail?: string;
+}
+export interface OrgPlan {
+    entries: PlanEntry[];
+    /** The entries with status `conflict`; non-empty means the run refuses before any write. */
+    conflicts: PlanEntry[];
+}
+export interface OrgStatePosting {
+    role: string;
+    department?: string;
+    branch?: string;
+}
+export interface OrgStateMembership {
+    /** `Tenant/Child/...`, names as stored. */
+    companyPath: string;
+    active: boolean;
+    postings: OrgStatePosting[];
+}
+export interface OrgStateUser {
+    username: string;
+    email: string;
+    credential: CredentialState;
+    isPlatformSuperuser: boolean;
+    /** Memberships INSIDE the file's tenants' subtrees only. */
+    memberships: OrgStateMembership[];
+    /** Holds a membership OUTSIDE the file's tenants' subtrees (another tenant's user). */
+    membershipsOutside: boolean;
+}
+export interface OrgStateRole {
+    name: string;
+    /** Name of the owner's top-level tenant; null = no owner. */
+    ownerTenant: string | null;
+    /** Held by a posting outside the file's tenants' subtrees. */
+    heldOutside: boolean;
+    permissions: string[];
+}
+export interface OrgStateCompany {
+    path: string;
+    departments: string[];
+    branches: string[];
+}
+export interface OrgState {
+    companies: OrgStateCompany[];
+    departments: string[];
+    branches: string[];
+    roles: OrgStateRole[];
+    users: OrgStateUser[];
+    emailHolders: {
+        email: string;
+        username: string;
+    }[];
+    /**
+     * File company paths whose name matches more than one stored company (several top-level companies
+     * of the tenant's name, or several children of one parent with the child's name): never guessed.
+     */
+    ambiguousCompanies: string[];
+}
+export interface PlanOptions {
+    claimUnownedRoles: boolean;
+}
+export declare function planOrgBootstrap(file: OrgBootstrapFile, state: OrgState, options: PlanOptions): OrgPlan;
+//# sourceMappingURL=org-bootstrap-plan.d.ts.map

package/dist/features/org-bootstrap/org-bootstrap-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-bootstrap-plan.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAEV,gBAAgB,EAEjB,MAAM,yBAAyB,CAAC;AAGjC,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,eAAO,MAAM,eAAe,iLAclB,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,GAAG,aAAa,GAAG,UAAU,CAAC;AAEvF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,4FAA4F;IAC5F,SAAS,EAAE,SAAS,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,eAAe,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,uFAAuF;IACvF,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,8DAA8D;IAC9D,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpD;;;OAGG;IACH,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAQD,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,WAAW,GACnB,OAAO,CA+WT"}