@astram/identity 0.13.0 → 0.14.0

package/dist/features/org-bootstrap/org-bootstrap-plan.js

@@ -0,0 +1,288 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLAN_KIND_ORDER = void 0;
+exports.planOrgBootstrap = planOrgBootstrap;
+const org_names_js_1 = require("./org-names.js");
+exports.PLAN_KIND_ORDER = [
+    'company',
+    'department',
+    'branch',
+    'company_department',
+    'company_branch',
+    'role',
+    'role_claim',
+    'grant',
+    'user',
+    'membership',
+    'posting',
+    'credential',
+    'root_flag',
+];
+function planOrgBootstrap(file, state, options) {
+    const out = [];
+    const add = (kind, path, status, detail) => {
+        out.push(detail === undefined ? { kind, path, status } : { kind, path, status, detail });
+    };
+    // ---- flatten the file (depth first, parent before children) ----
+    const companies = [];
+    const walk = (c, parent, tenant) => {
+        const path = parent === undefined ? c.name : `${parent}/${c.name}`;
+        companies.push({ path, tenant, node: c });
+        for (const child of c.children ?? [])
+            walk(child, path, tenant);
+    };
+    for (const t of file.tenants)
+        walk(t, undefined, t.name);
+    const tenantKeys = new Set(file.tenants.map((t) => (0, org_names_js_1.nameKey)(t.name)));
+    const inFileTenant = (path) => tenantKeys.has((0, org_names_js_1.nameKey)(path.split('/')[0] ?? ''));
+    // ---- companies, org units ----
+    const stateCompany = new Map(state.companies.map((c) => [(0, org_names_js_1.pathKey)(c.path), c]));
+    const stateDepts = new Set(state.departments.map(org_names_js_1.nameKey));
+    const stateBranches = new Set(state.branches.map(org_names_js_1.nameKey));
+    const declaredCompanyKeys = new Set(companies.map((c) => (0, org_names_js_1.pathKey)(c.path)));
+    const ambiguous = new Set(state.ambiguousCompanies.map(org_names_js_1.pathKey));
+    for (const c of companies) {
+        if (ambiguous.has((0, org_names_js_1.pathKey)(c.path))) {
+            add('company', c.path, 'conflict', `company "${c.path}" matches more than one existing company; the bootstrap never guesses`);
+            continue;
+        }
+        add('company', c.path, stateCompany.has((0, org_names_js_1.pathKey)(c.path)) ? 'unchanged' : 'create');
+    }
+    for (const c of state.companies) {
+        if (inFileTenant(c.path) && !declaredCompanyKeys.has((0, org_names_js_1.pathKey)(c.path))) {
+            add('company', c.path, 'not-in-file');
+        }
+    }
+    const seenDept = new Set();
+    const seenBranch = new Set();
+    for (const c of companies) {
+        for (const d of c.node.departments ?? []) {
+            if (seenDept.has((0, org_names_js_1.nameKey)(d)))
+                continue;
+            seenDept.add((0, org_names_js_1.nameKey)(d));
+            add('department', `dept:${d}`, stateDepts.has((0, org_names_js_1.nameKey)(d)) ? 'unchanged' : 'create');
+        }
+        for (const b of c.node.branches ?? []) {
+            if (seenBranch.has((0, org_names_js_1.nameKey)(b)))
+                continue;
+            seenBranch.add((0, org_names_js_1.nameKey)(b));
+            add('branch', `branch:${b}`, stateBranches.has((0, org_names_js_1.nameKey)(b)) ? 'unchanged' : 'create');
+        }
+    }
+    for (const c of companies) {
+        const sc = stateCompany.get((0, org_names_js_1.pathKey)(c.path));
+        const haveD = new Set((sc?.departments ?? []).map(org_names_js_1.nameKey));
+        const haveB = new Set((sc?.branches ?? []).map(org_names_js_1.nameKey));
+        for (const d of c.node.departments ?? []) {
+            add('company_department', `${c.path}#dept:${d}`, haveD.has((0, org_names_js_1.nameKey)(d)) ? 'unchanged' : 'create');
+        }
+        for (const b of c.node.branches ?? []) {
+            add('company_branch', `${c.path}#branch:${b}`, haveB.has((0, org_names_js_1.nameKey)(b)) ? 'unchanged' : 'create');
+        }
+    }
+    // ---- roles and grants ----
+    const stateRole = new Map(state.roles.map((r) => [(0, org_names_js_1.nameKey)(r.name), r]));
+    const declaredRoles = new Set();
+    for (const c of companies) {
+        for (const r of c.node.roles ?? []) {
+            const key = (0, org_names_js_1.nameKey)(r.name);
+            declaredRoles.add(key);
+            const path = `role:${r.name}`;
+            const existing = stateRole.get(key);
+            if (!existing) {
+                add('role', path, 'create');
+                for (const k of r.permissions)
+                    add('grant', `${path}#${k}`, 'create');
+                continue;
+            }
+            if (existing.ownerTenant !== null && !tenantKeys.has((0, org_names_js_1.nameKey)(existing.ownerTenant))) {
+                add('role', path, 'conflict', `role "${r.name}" is owned by another tenant`);
+                continue;
+            }
+            if (existing.ownerTenant !== null && (0, org_names_js_1.nameKey)(existing.ownerTenant) !== (0, org_names_js_1.nameKey)(c.tenant)) {
+                add('role', path, 'conflict', `role "${r.name}" is owned by tenant "${existing.ownerTenant}", not by "${c.tenant}" which declares it`);
+                continue;
+            }
+            if (existing.ownerTenant === null) {
+                if (existing.heldOutside) {
+                    add('role', path, 'conflict', `role "${r.name}" has no owner and is held outside the file's tenants`);
+                    continue;
+                }
+                if (!options.claimUnownedRoles) {
+                    add('role', path, 'conflict', `role "${r.name}" has no owner; pass --claim-unowned-roles to claim it`);
+                    continue;
+                }
+                add('role', path, 'unchanged');
+                add('role_claim', path, 'create', `claim "${r.name}" for tenant ${c.tenant}`);
+            }
+            else {
+                add('role', path, 'unchanged');
+            }
+            const have = new Set(existing.permissions);
+            for (const k of r.permissions)
+                add('grant', `${path}#${k}`, have.has(k) ? 'unchanged' : 'create');
+            const want = new Set(r.permissions);
+            for (const k of existing.permissions)
+                if (!want.has(k))
+                    add('grant', `${path}#${k}`, 'not-in-file');
+        }
+    }
+    for (const r of state.roles) {
+        if (r.ownerTenant !== null &&
+            tenantKeys.has((0, org_names_js_1.nameKey)(r.ownerTenant)) &&
+            !declaredRoles.has((0, org_names_js_1.nameKey)(r.name))) {
+            add('role', `role:${r.name}`, 'not-in-file');
+        }
+    }
+    // ---- users, memberships, postings, credentials ----
+    const stateUser = new Map(state.users.map((u) => [(0, org_names_js_1.nameKey)(u.username), u]));
+    const emailHolder = new Map(state.emailHolders.map((h) => [(0, org_names_js_1.nameKey)(h.email), h.username]));
+    const declaredUsers = new Set();
+    const postingKey = (p) => [(0, org_names_js_1.nameKey)(p.role), (0, org_names_js_1.nameKey)(p.department ?? ''), (0, org_names_js_1.nameKey)(p.branch ?? '')].join('|');
+    const postingPath = (user, company, p) => `user:${user}@${company} role:${p.role}${p.department ? ` dept:${p.department}` : ''}${p.branch ? ` branch:${p.branch}` : ''}`;
+    const planUser = (username, email, company, postings, isRoot) => {
+        declaredUsers.add((0, org_names_js_1.nameKey)(username));
+        const path = `user:${username}`;
+        const existing = stateUser.get((0, org_names_js_1.nameKey)(username));
+        if (!existing) {
+            const holder = emailHolder.get((0, org_names_js_1.nameKey)(email));
+            if (holder !== undefined && (0, org_names_js_1.nameKey)(holder) !== (0, org_names_js_1.nameKey)(username)) {
+                add('user', path, 'conflict', `email of "${username}" is already held by another user`);
+                return;
+            }
+            add('user', path, 'create');
+            if (isRoot)
+                add('credential', path, 'create', 'password credential from the operator-supplied root password');
+            for (const p of postings)
+                add('posting', postingPath(username, company, p), 'create');
+            if (isRoot)
+                add('root_flag', path, 'create');
+            return;
+        }
+        // R1-1: usernames are global, so a user the file names must provably be this file's user before
+        // anything is written for it. A non-root that holds a membership inside the file's tenants is; its
+        // differing email is only reported (OD-5). A root (which holds no membership) or a user with no
+        // membership in the file's tenants is tied to the file by its email alone, so a differing email
+        // means another account and the run refuses. A root holding any membership, or a non-root that
+        // belongs only to other tenants, is refused too.
+        const emailDiffers = (0, org_names_js_1.nameKey)(existing.email) !== (0, org_names_js_1.nameKey)(email);
+        const memberHere = existing.memberships.length > 0;
+        if (emailDiffers && (isRoot || !memberHere)) {
+            add('user', path, 'conflict', `user "${username}" already exists with a different email; the bootstrap never adopts or changes it`);
+            return;
+        }
+        const holdsAny = memberHere || existing.membershipsOutside;
+        if (isRoot && holdsAny) {
+            add('user', path, 'conflict', `user "${username}" already exists and holds memberships; a root holds none, so it cannot be made a root`);
+            return;
+        }
+        if (!isRoot && existing.memberships.length === 0 && existing.membershipsOutside) {
+            add('user', path, 'conflict', `user "${username}" already exists as a member of another tenant only; the bootstrap never adopts it`);
+            return;
+        }
+        if (!isRoot && !holdsAny) {
+            // N3: an account with no membership anywhere cannot be read by the anchored people principal
+            // (the user read wall), so adding it would fail mid-apply. Report it and plan nothing for it.
+            add('user', path, 'drift', 'user exists with no membership; add it from the admin console, the bootstrap plans nothing for it');
+            return;
+        }
+        add('user', path, emailDiffers ? 'drift' : 'unchanged', emailDiffers ? 'email differs from the file; not overwritten' : undefined);
+        // A root holds no membership: root is barred from the data plane, and its home company only
+        // anchors the credential (`ic_tenant_id`). Planning one would be denied and never converge.
+        const declaredKey = (0, org_names_js_1.pathKey)(company);
+        const membership = existing.memberships.find((m) => (0, org_names_js_1.pathKey)(m.companyPath) === declaredKey);
+        const mpath = `${path}@${company}`;
+        if (isRoot) {
+            // nothing to plan for memberships or postings
+        }
+        else if (!membership) {
+            add('membership', mpath, 'create');
+            for (const p of postings)
+                add('posting', postingPath(username, company, p), 'create');
+        }
+        else if (!membership.active) {
+            add('membership', mpath, 'drift', 'inactive membership; the bootstrap never activates it');
+            const have = new Set(membership.postings.map(postingKey));
+            for (const p of postings) {
+                add('posting', postingPath(username, company, p), have.has(postingKey(p)) ? 'unchanged' : 'drift', have.has(postingKey(p)) ? undefined : 'inactive membership; posting not added');
+            }
+        }
+        else {
+            add('membership', mpath, 'unchanged');
+            const have = new Set(membership.postings.map(postingKey));
+            for (const p of postings) {
+                add('posting', postingPath(username, company, p), have.has(postingKey(p)) ? 'unchanged' : 'create');
+            }
+        }
+        if (isRoot) {
+            if (existing.credential === 'none') {
+                add('credential', path, 'create', 'password credential from the operator-supplied root password');
+            }
+            else if (existing.credential === 'locked') {
+                add('credential', path, 'drift', 'credential is locked, not a password; the bootstrap does not replace it. Reissue a set-password link');
+            }
+            else {
+                add('credential', path, 'unchanged');
+            }
+            add('root_flag', path, existing.isPlatformSuperuser ? 'unchanged' : 'create');
+        }
+        else if (existing.credential === 'none' && existing.membershipsOutside) {
+            // N1: the account also reaches another tenant; this file's operator must not get its link.
+            add('credential', path, 'drift', 'no credential and the user also belongs to another tenant; none created (no link issued)');
+        }
+        else if (existing.credential === 'none' && emailDiffers) {
+            // The login hint would be the file's email, which the bootstrap does not adopt (R1-6).
+            add('credential', path, 'drift', 'no credential and the email differs from the file; none created (set the email first)');
+        }
+        else if (existing.credential === 'none') {
+            add('credential', path, 'create', 'locked credential; a set-password link is issued on apply');
+        }
+        // Memberships and postings in the file's companies that the file does not declare.
+        const declaredPostings = new Set(postings.map(postingKey));
+        for (const m of existing.memberships) {
+            if (!inFileTenant(m.companyPath))
+                continue;
+            if ((0, org_names_js_1.pathKey)(m.companyPath) === declaredKey) {
+                for (const p of m.postings) {
+                    if (!declaredPostings.has(postingKey(p))) {
+                        add('posting', postingPath(username, company, p), 'not-in-file');
+                    }
+                }
+            }
+            else {
+                add('membership', `${path}@${m.companyPath}`, 'not-in-file');
+                for (const p of m.postings)
+                    add('posting', postingPath(username, m.companyPath, p), 'not-in-file');
+            }
+        }
+    };
+    const tenantPath = (tenantName, rel) => rel === undefined ? tenantName : `${tenantName}/${rel}`;
+    for (const r of file.roots)
+        planUser(r.username, r.email, r.homeCompany, [], true);
+    for (const c of companies) {
+        for (const u of c.node.users ?? []) {
+            const company = u.company === undefined ? c.path : tenantPath(c.tenant, u.company);
+            planUser(u.username, u.email, company, u.postings ?? [], false);
+        }
+    }
+    for (const u of state.users) {
+        if (declaredUsers.has((0, org_names_js_1.nameKey)(u.username)))
+            continue;
+        const inside = u.memberships.filter((m) => inFileTenant(m.companyPath));
+        if (inside.length === 0)
+            continue;
+        const path = `user:${u.username}`;
+        add('user', path, 'not-in-file');
+        for (const m of inside) {
+            for (const p of m.postings) {
+                add('posting', postingPath(u.username, m.companyPath, p), 'not-in-file');
+            }
+        }
+    }
+    // R10 order: stable by kind.
+    const entries = out
+        .map((e, i) => ({ e, i }))
+        .sort((a, b) => exports.PLAN_KIND_ORDER.indexOf(a.e.kind) - exports.PLAN_KIND_ORDER.indexOf(b.e.kind) || a.i - b.i)
+        .map((x) => x.e);
+    return { entries, conflicts: entries.filter((e) => e.status === 'conflict') };
+}

package/dist/features/org-bootstrap/org-bootstrap-runner.harness.d.ts

@@ -0,0 +1,259 @@
+import type { Principal } from '@astram/core';
+import { current } from './org-bootstrap-runner.mocks.js';
+import type { OrgState } from './org-bootstrap-plan.js';
+export declare const SCHEMAS: {
+    readonly namespace: "zzns";
+    readonly app: "zzns_app";
+    readonly identity: "zzns_identity";
+    readonly authz: "zzns_authz";
+    readonly audit: "zzns_audit";
+    readonly isDefault: false;
+};
+export declare const PW = "Zq-root-pass-1";
+export declare const OPERATOR = "op.person@example.test";
+export declare const BASE = "https://app.example.test/reset-password";
+export declare const DEFAULT_DEV_BASE = "http://localhost:5173/reset-password";
+export declare const LOCK_NAME = "astram_org_bootstrap:zzns_app";
+export declare const ROOT_PW_VAR = "ASTRAM_BOOTSTRAP_ROOT_PASSWORD_ZROOT";
+/** Env of a development/test run that would pass every refusal. */
+export declare const TEST_ENV: Record<string, string>;
+/** Env of a production run; the root password must be secret-ref resolved (the spec adds ROOT_PW_VAR to its hoisted secretRefs set). */
+export declare const PROD_ENV: Record<string, string>;
+/** Fresh-database file: 1 root, 2 companies, 1 dept, 1 branch, 3 roles, 3 non-root users. */
+export declare const FILE_MAIN: {
+    version: number;
+    roots: {
+        username: string;
+        email: string;
+        homeCompany: string;
+    }[];
+    tenants: {
+        name: string;
+        departments: string[];
+        branches: string[];
+        roles: {
+            name: string;
+            permissions: string[];
+        }[];
+        users: ({
+            username: string;
+            email: string;
+            postings: {
+                role: string;
+                department: string;
+                branch: string;
+            }[];
+        } | {
+            username: string;
+            email: string;
+            postings?: never;
+        })[];
+        children: {
+            name: string;
+            roles: {
+                name: string;
+                permissions: never[];
+            }[];
+            users: {
+                username: string;
+                email: string;
+                postings: {
+                    role: string;
+                }[];
+            }[];
+        }[];
+    }[];
+};
+/** Two tenants: used to prove `operationRoleIds` never reach across tenants. */
+export declare const FILE_TWO_TENANTS: {
+    version: number;
+    roots: {
+        username: string;
+        email: string;
+        homeCompany: string;
+    }[];
+    tenants: {
+        name: string;
+        roles: {
+            name: string;
+            permissions: never[];
+        }[];
+        users: {
+            username: string;
+            email: string;
+            postings: {
+                role: string;
+            }[];
+        }[];
+    }[];
+};
+/** One tenant already holding everything: the state below makes every entry `unchanged`. */
+export declare const FILE_MINI: {
+    version: number;
+    roots: {
+        username: string;
+        email: string;
+        homeCompany: string;
+    }[];
+    tenants: {
+        name: string;
+        roles: {
+            name: string;
+            permissions: string[];
+        }[];
+        users: {
+            username: string;
+            email: string;
+            postings: {
+                role: string;
+            }[];
+        }[];
+    }[];
+};
+/** A tenant with one user whose membership does not exist yet (for the "existing user" cases). */
+export declare const FILE_DAVE: {
+    version: number;
+    roots: {
+        username: string;
+        email: string;
+        homeCompany: string;
+    }[];
+    tenants: {
+        name: string;
+        roles: {
+            name: string;
+            permissions: never[];
+        }[];
+        users: {
+            username: string;
+            email: string;
+            postings: {
+                role: string;
+            }[];
+        }[];
+    }[];
+};
+export declare const emptyState: () => OrgState;
+type Cred = 'none' | 'locked' | 'usable';
+/** The state that makes FILE_MINI entirely `unchanged`, alice's credential as given. */
+export declare function stateMini(aliceCredential?: Cred): OrgState;
+export interface Call {
+    seq: number;
+    service: string;
+    method: string;
+    args: unknown[];
+    /** The principal registered on the resolve context (request-scoped services), if any. */
+    principal: Principal | undefined;
+    /** The bootstrap principal passed as an explicit argument, if any. */
+    actor: Principal | undefined;
+}
+export interface Query {
+    conn: string;
+    sql: string;
+    params: unknown[];
+}
+export type Row = Record<string, unknown>;
+export interface World {
+    app: FakeApp;
+    state: OrgState;
+    out: string[];
+    outFn: (line: string) => void;
+    events: string[];
+    calls: Call[];
+    queries: Query[];
+    transitions: unknown[][];
+    issued: {
+        principalId: string;
+        hash: string;
+        expiresAtMs: number;
+    }[];
+    invalidated: string[];
+    provisionedLocked: {
+        principalId: string;
+        hint: string;
+        tenantId: string;
+    }[];
+    provisionedPassword: {
+        principalId: string;
+        hint: string;
+        tenantId: string;
+        password: string;
+    }[];
+    conns: FakeConn[];
+    readerCalls: number;
+    lockMode: 'acquired' | 'busy';
+    failOn: ((service: string, method: string, args: unknown[]) => Error | undefined) | undefined;
+    failTransition: Error | undefined;
+    /** Throws for a matching statement (e.g. the audit INSERT), on whichever connection runs it. */
+    failQuery: ((connId: string, sql: string, params: unknown[]) => Error | undefined) | undefined;
+    /** Whether a posting outside the file's tenants holds the role being claimed (R1-8 re-check). */
+    roleHeldOutside: boolean;
+    id: (kind: string, name: string) => string;
+    tables: Record<string, Row[]>;
+}
+export interface FakeConn {
+    id: string;
+    released: boolean;
+    log: string[];
+    query: (sql: string, params?: unknown[]) => Promise<unknown>;
+    beginTransaction: () => Promise<void>;
+    commit: () => Promise<void>;
+    rollback: () => Promise<void>;
+    release: () => Promise<void>;
+    end: () => Promise<void>;
+}
+export { current };
+export declare class FakeApp {
+    private readonly singletons;
+    private readonly scoped;
+    initCalls: number;
+    readonly requests: Map<object, {
+        principal?: Principal;
+    }>;
+    readonly resolved: {
+        token: unknown;
+        principal: Principal | undefined;
+    }[];
+    constructor(singletons: Map<unknown, unknown>, scoped: Map<unknown, (principal: Principal | undefined) => object>);
+    init(): Promise<this>;
+    get(token: unknown, _options?: unknown): unknown;
+    registerRequestByContextId(request: {
+        principal?: Principal;
+    }, contextId: object): void;
+    resolve(token: unknown, contextId: object, _options?: unknown): Promise<unknown>;
+}
+export interface WorldOptions {
+    /** `IDENTITY_AUTHZ_POOL`, imported from `./org-bootstrap.tokens.js` by the spec. */
+    poolToken: unknown;
+    /** false = IdentityFeatureModule is not wired: `app.get` / `app.resolve` find nothing. */
+    wired?: boolean;
+    state?: OrgState;
+    tables?: Record<string, Row[]>;
+    lockMode?: 'acquired' | 'busy';
+    memberships?: {
+        id: string;
+        userUuid: string;
+        companyUuid: string;
+    }[];
+    failOn?: World['failOn'];
+}
+export declare function makeWorld(options: WorldOptions): World;
+export declare const sha256: (s: string) => string;
+export declare const isWriteCall: (c: Call) => boolean;
+export declare const writeCalls: (w: World) => Call[];
+export declare const callsOf: (w: World, service: string, method: string) => Call[];
+/** Every non-audit write the runner could make is absent. Lock and SELECT traffic is allowed. */
+export declare function noWritesAtAll(w: World): string[];
+/** Lock discipline: every GET_LOCK ran on a dedicated connection and was released on that one. */
+export declare function lockProblems(w: World): string[];
+/** Everything the run said or stored that must never carry a secret. Provisioner args excluded. */
+export declare function visibleText(w: World, extra?: unknown[]): string;
+/** The raw token of the link printed for `username` (a line with the name and `<base>?token=<hex>`). */
+export declare function linkFor(w: World, username: string): {
+    raw: string;
+    line: string;
+} | undefined;
+export declare const linkLines: (w: World) => string[];
+/** The audit rows (INSERTs into audit_log) naming `action`, from any connection. */
+export declare const auditRowsFor: (w: World, action: string) => Query[];
+//# sourceMappingURL=org-bootstrap-runner.harness.d.ts.map

package/dist/features/org-bootstrap/org-bootstrap-runner.harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-bootstrap-runner.harness.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap-runner.harness.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAY9C,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAE1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAIxD,eAAO,MAAM,OAAO;;;;;;;CAOV,CAAC;AAEX,eAAO,MAAM,EAAE,mBAAmB,CAAC;AACnC,eAAO,MAAM,QAAQ,2BAA2B,CAAC;AACjD,eAAO,MAAM,IAAI,4CAA4C,CAAC;AAC9D,eAAO,MAAM,gBAAgB,yCAAyC,CAAC;AACvE,eAAO,MAAM,SAAS,kCAAkC,CAAC;AACzD,eAAO,MAAM,WAAW,yCAAyC,CAAC;AAElE,mEAAmE;AACnE,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK3C,CAAC;AAEF,wIAAwI;AACxI,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK3C,CAAC;AAIF,6FAA6F;AAC7F,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCrB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;CAiB5B,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;CAYrB,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;CAYrB,CAAC;AAEF,eAAO,MAAM,UAAU,QAAO,QAQ5B,CAAC;AAEH,KAAK,IAAI,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEzC,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,eAAe,GAAE,IAAe,GAAG,QAAQ,CAqCpE;AAID,MAAM,WAAW,IAAI;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,yFAAyF;IACzF,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IACjC,sEAAsE;IACtE,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAED,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,OAAO,EAAE,KAAK,EAAE,CAAC;IACjB,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;IACzB,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACrE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7E,mBAAmB,EAAE;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,EAAE,CAAC;IACJ,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,KAAK,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAC9F,cAAc,EAAE,KAAK,GAAG,SAAS,CAAC;IAClC,gGAAgG;IAChG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,KAAK,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAC/F,iGAAiG;IACjG,eAAe,EAAE,OAAO,CAAC;IACzB,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAOD,OAAO,EAAE,OAAO,EAAE,CAAC;AAEnB,qBAAa,OAAO;IAKhB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,SAAS,SAAK;IACd,QAAQ,CAAC,QAAQ;oBAAiC,SAAS;OAAM;IACjE,QAAQ,CAAC,QAAQ,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAAA;KAAE,EAAE,CAAM;gBAE5D,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,KAAK,MAAM,CAAC;IAG/E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAK3B,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO;IAShD,0BAA0B,CAAC,OAAO,EAAE;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAIjF,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;CAYvF;AAED,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,SAAS,EAAE,OAAO,CAAC;IACnB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAC/B,WAAW,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtE,MAAM,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;CAC1B;AAID,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,KAAK,CAgUtD;AAID,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AAE1F,eAAO,MAAM,WAAW,GAAI,GAAG,IAAI,KAAG,OAAsC,CAAC;AAE7E,eAAO,MAAM,UAAU,GAAI,GAAG,KAAK,KAAG,IAAI,EAAiC,CAAC;AAE5E,eAAO,MAAM,OAAO,GAAI,GAAG,KAAK,EAAE,SAAS,MAAM,EAAE,QAAQ,MAAM,KAAG,IAAI,EACH,CAAC;AAEtE,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAgBhD;AAED,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAa/C;AAED,mGAAmG;AACnG,wBAAgB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,GAAE,OAAO,EAAO,GAAG,MAAM,CASnE;AAED,wGAAwG;AACxG,wBAAgB,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAO7F;AAED,eAAO,MAAM,SAAS,GAAI,GAAG,KAAK,KAAG,MAAM,EAA6C,CAAC;AAEzF,oFAAoF;AACpF,eAAO,MAAM,YAAY,GAAI,GAAG,KAAK,EAAE,QAAQ,MAAM,KAAG,KAAK,EAC4B,CAAC"}