@astram/identity 0.13.0 → 0.15.0

package/dist/features/org-bootstrap/org-bootstrap-plan.js

@@ -0,0 +1,288 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLAN_KIND_ORDER = void 0;
+exports.planOrgBootstrap = planOrgBootstrap;
+const org_names_js_1 = require("./org-names.js");
+exports.PLAN_KIND_ORDER = [
+    'company',
+    'department',
+    'branch',
+    'company_department',
+    'company_branch',
+    'role',
+    'role_claim',
+    'grant',
+    'user',
+    'membership',
+    'posting',
+    'credential',
+    'root_flag',
+];
+function planOrgBootstrap(file, state, options) {
+    const out = [];
+    const add = (kind, path, status, detail) => {
+        out.push(detail === undefined ? { kind, path, status } : { kind, path, status, detail });
+    };
+    // ---- flatten the file (depth first, parent before children) ----
+    const companies = [];
+    const walk = (c, parent, tenant) => {
+        const path = parent === undefined ? c.name : `${parent}/${c.name}`;
+        companies.push({ path, tenant, node: c });
+        for (const child of c.children ?? [])
+            walk(child, path, tenant);
+    };
+    for (const t of file.tenants)
+        walk(t, undefined, t.name);
+    const tenantKeys = new Set(file.tenants.map((t) => (0, org_names_js_1.nameKey)(t.name)));
+    const inFileTenant = (path) => tenantKeys.has((0, org_names_js_1.nameKey)(path.split('/')[0] ?? ''));
+    // ---- companies, org units ----
+    const stateCompany = new Map(state.companies.map((c) => [(0, org_names_js_1.pathKey)(c.path), c]));
+    const stateDepts = new Set(state.departments.map(org_names_js_1.nameKey));
+    const stateBranches = new Set(state.branches.map(org_names_js_1.nameKey));
+    const declaredCompanyKeys = new Set(companies.map((c) => (0, org_names_js_1.pathKey)(c.path)));
+    const ambiguous = new Set(state.ambiguousCompanies.map(org_names_js_1.pathKey));
+    for (const c of companies) {
+        if (ambiguous.has((0, org_names_js_1.pathKey)(c.path))) {
+            add('company', c.path, 'conflict', `company "${c.path}" matches more than one existing company; the bootstrap never guesses`);
+            continue;
+        }
+        add('company', c.path, stateCompany.has((0, org_names_js_1.pathKey)(c.path)) ? 'unchanged' : 'create');
+    }
+    for (const c of state.companies) {
+        if (inFileTenant(c.path) && !declaredCompanyKeys.has((0, org_names_js_1.pathKey)(c.path))) {
+            add('company', c.path, 'not-in-file');
+        }
+    }
+    const seenDept = new Set();
+    const seenBranch = new Set();
+    for (const c of companies) {
+        for (const d of c.node.departments ?? []) {
+            if (seenDept.has((0, org_names_js_1.nameKey)(d)))
+                continue;
+            seenDept.add((0, org_names_js_1.nameKey)(d));
+            add('department', `dept:${d}`, stateDepts.has((0, org_names_js_1.nameKey)(d)) ? 'unchanged' : 'create');
+        }
+        for (const b of c.node.branches ?? []) {
+            if (seenBranch.has((0, org_names_js_1.nameKey)(b)))
+                continue;
+            seenBranch.add((0, org_names_js_1.nameKey)(b));
+            add('branch', `branch:${b}`, stateBranches.has((0, org_names_js_1.nameKey)(b)) ? 'unchanged' : 'create');
+        }
+    }
+    for (const c of companies) {
+        const sc = stateCompany.get((0, org_names_js_1.pathKey)(c.path));
+        const haveD = new Set((sc?.departments ?? []).map(org_names_js_1.nameKey));
+        const haveB = new Set((sc?.branches ?? []).map(org_names_js_1.nameKey));
+        for (const d of c.node.departments ?? []) {
+            add('company_department', `${c.path}#dept:${d}`, haveD.has((0, org_names_js_1.nameKey)(d)) ? 'unchanged' : 'create');
+        }
+        for (const b of c.node.branches ?? []) {
+            add('company_branch', `${c.path}#branch:${b}`, haveB.has((0, org_names_js_1.nameKey)(b)) ? 'unchanged' : 'create');
+        }
+    }
+    // ---- roles and grants ----
+    const stateRole = new Map(state.roles.map((r) => [(0, org_names_js_1.nameKey)(r.name), r]));
+    const declaredRoles = new Set();
+    for (const c of companies) {
+        for (const r of c.node.roles ?? []) {
+            const key = (0, org_names_js_1.nameKey)(r.name);
+            declaredRoles.add(key);
+            const path = `role:${r.name}`;
+            const existing = stateRole.get(key);
+            if (!existing) {
+                add('role', path, 'create');
+                for (const k of r.permissions)
+                    add('grant', `${path}#${k}`, 'create');
+                continue;
+            }
+            if (existing.ownerTenant !== null && !tenantKeys.has((0, org_names_js_1.nameKey)(existing.ownerTenant))) {
+                add('role', path, 'conflict', `role "${r.name}" is owned by another tenant`);
+                continue;
+            }
+            if (existing.ownerTenant !== null && (0, org_names_js_1.nameKey)(existing.ownerTenant) !== (0, org_names_js_1.nameKey)(c.tenant)) {
+                add('role', path, 'conflict', `role "${r.name}" is owned by tenant "${existing.ownerTenant}", not by "${c.tenant}" which declares it`);
+                continue;
+            }
+            if (existing.ownerTenant === null) {
+                if (existing.heldOutside) {
+                    add('role', path, 'conflict', `role "${r.name}" has no owner and is held outside the file's tenants`);
+                    continue;
+                }
+                if (!options.claimUnownedRoles) {
+                    add('role', path, 'conflict', `role "${r.name}" has no owner; pass --claim-unowned-roles to claim it`);
+                    continue;
+                }
+                add('role', path, 'unchanged');
+                add('role_claim', path, 'create', `claim "${r.name}" for tenant ${c.tenant}`);
+            }
+            else {
+                add('role', path, 'unchanged');
+            }
+            const have = new Set(existing.permissions);
+            for (const k of r.permissions)
+                add('grant', `${path}#${k}`, have.has(k) ? 'unchanged' : 'create');
+            const want = new Set(r.permissions);
+            for (const k of existing.permissions)
+                if (!want.has(k))
+                    add('grant', `${path}#${k}`, 'not-in-file');
+        }
+    }
+    for (const r of state.roles) {
+        if (r.ownerTenant !== null &&
+            tenantKeys.has((0, org_names_js_1.nameKey)(r.ownerTenant)) &&
+            !declaredRoles.has((0, org_names_js_1.nameKey)(r.name))) {
+            add('role', `role:${r.name}`, 'not-in-file');
+        }
+    }
+    // ---- users, memberships, postings, credentials ----
+    const stateUser = new Map(state.users.map((u) => [(0, org_names_js_1.nameKey)(u.username), u]));
+    const emailHolder = new Map(state.emailHolders.map((h) => [(0, org_names_js_1.nameKey)(h.email), h.username]));
+    const declaredUsers = new Set();
+    const postingKey = (p) => [(0, org_names_js_1.nameKey)(p.role), (0, org_names_js_1.nameKey)(p.department ?? ''), (0, org_names_js_1.nameKey)(p.branch ?? '')].join('|');
+    const postingPath = (user, company, p) => `user:${user}@${company} role:${p.role}${p.department ? ` dept:${p.department}` : ''}${p.branch ? ` branch:${p.branch}` : ''}`;
+    const planUser = (username, email, company, postings, isRoot) => {
+        declaredUsers.add((0, org_names_js_1.nameKey)(username));
+        const path = `user:${username}`;
+        const existing = stateUser.get((0, org_names_js_1.nameKey)(username));
+        if (!existing) {
+            const holder = emailHolder.get((0, org_names_js_1.nameKey)(email));
+            if (holder !== undefined && (0, org_names_js_1.nameKey)(holder) !== (0, org_names_js_1.nameKey)(username)) {
+                add('user', path, 'conflict', `email of "${username}" is already held by another user`);
+                return;
+            }
+            add('user', path, 'create');
+            if (isRoot)
+                add('credential', path, 'create', 'password credential from the operator-supplied root password');
+            for (const p of postings)
+                add('posting', postingPath(username, company, p), 'create');
+            if (isRoot)
+                add('root_flag', path, 'create');
+            return;
+        }
+        // R1-1: usernames are global, so a user the file names must provably be this file's user before
+        // anything is written for it. A non-root that holds a membership inside the file's tenants is; its
+        // differing email is only reported (OD-5). A root (which holds no membership) or a user with no
+        // membership in the file's tenants is tied to the file by its email alone, so a differing email
+        // means another account and the run refuses. A root holding any membership, or a non-root that
+        // belongs only to other tenants, is refused too.
+        const emailDiffers = (0, org_names_js_1.nameKey)(existing.email) !== (0, org_names_js_1.nameKey)(email);
+        const memberHere = existing.memberships.length > 0;
+        if (emailDiffers && (isRoot || !memberHere)) {
+            add('user', path, 'conflict', `user "${username}" already exists with a different email; the bootstrap never adopts or changes it`);
+            return;
+        }
+        const holdsAny = memberHere || existing.membershipsOutside;
+        if (isRoot && holdsAny) {
+            add('user', path, 'conflict', `user "${username}" already exists and holds memberships; a root holds none, so it cannot be made a root`);
+            return;
+        }
+        if (!isRoot && existing.memberships.length === 0 && existing.membershipsOutside) {
+            add('user', path, 'conflict', `user "${username}" already exists as a member of another tenant only; the bootstrap never adopts it`);
+            return;
+        }
+        if (!isRoot && !holdsAny) {
+            // N3: an account with no membership anywhere cannot be read by the anchored people principal
+            // (the user read wall), so adding it would fail mid-apply. Report it and plan nothing for it.
+            add('user', path, 'drift', 'user exists with no membership; add it from the admin console, the bootstrap plans nothing for it');
+            return;
+        }
+        add('user', path, emailDiffers ? 'drift' : 'unchanged', emailDiffers ? 'email differs from the file; not overwritten' : undefined);
+        // A root holds no membership: root is barred from the data plane, and its home company only
+        // anchors the credential (`ic_tenant_id`). Planning one would be denied and never converge.
+        const declaredKey = (0, org_names_js_1.pathKey)(company);
+        const membership = existing.memberships.find((m) => (0, org_names_js_1.pathKey)(m.companyPath) === declaredKey);
+        const mpath = `${path}@${company}`;
+        if (isRoot) {
+            // nothing to plan for memberships or postings
+        }
+        else if (!membership) {
+            add('membership', mpath, 'create');
+            for (const p of postings)
+                add('posting', postingPath(username, company, p), 'create');
+        }
+        else if (!membership.active) {
+            add('membership', mpath, 'drift', 'inactive membership; the bootstrap never activates it');
+            const have = new Set(membership.postings.map(postingKey));
+            for (const p of postings) {
+                add('posting', postingPath(username, company, p), have.has(postingKey(p)) ? 'unchanged' : 'drift', have.has(postingKey(p)) ? undefined : 'inactive membership; posting not added');
+            }
+        }
+        else {
+            add('membership', mpath, 'unchanged');
+            const have = new Set(membership.postings.map(postingKey));
+            for (const p of postings) {
+                add('posting', postingPath(username, company, p), have.has(postingKey(p)) ? 'unchanged' : 'create');
+            }
+        }
+        if (isRoot) {
+            if (existing.credential === 'none') {
+                add('credential', path, 'create', 'password credential from the operator-supplied root password');
+            }
+            else if (existing.credential === 'locked') {
+                add('credential', path, 'drift', 'credential is locked, not a password; the bootstrap does not replace it. Reissue a set-password link');
+            }
+            else {
+                add('credential', path, 'unchanged');
+            }
+            add('root_flag', path, existing.isPlatformSuperuser ? 'unchanged' : 'create');
+        }
+        else if (existing.credential === 'none' && existing.membershipsOutside) {
+            // N1: the account also reaches another tenant; this file's operator must not get its link.
+            add('credential', path, 'drift', 'no credential and the user also belongs to another tenant; none created (no link issued)');
+        }
+        else if (existing.credential === 'none' && emailDiffers) {
+            // The login hint would be the file's email, which the bootstrap does not adopt (R1-6).
+            add('credential', path, 'drift', 'no credential and the email differs from the file; none created (set the email first)');
+        }
+        else if (existing.credential === 'none') {
+            add('credential', path, 'create', 'locked credential; a set-password link is issued on apply');
+        }
+        // Memberships and postings in the file's companies that the file does not declare.
+        const declaredPostings = new Set(postings.map(postingKey));
+        for (const m of existing.memberships) {
+            if (!inFileTenant(m.companyPath))
+                continue;
+            if ((0, org_names_js_1.pathKey)(m.companyPath) === declaredKey) {
+                for (const p of m.postings) {
+                    if (!declaredPostings.has(postingKey(p))) {
+                        add('posting', postingPath(username, company, p), 'not-in-file');
+                    }
+                }
+            }
+            else {
+                add('membership', `${path}@${m.companyPath}`, 'not-in-file');
+                for (const p of m.postings)
+                    add('posting', postingPath(username, m.companyPath, p), 'not-in-file');
+            }
+        }
+    };
+    const tenantPath = (tenantName, rel) => rel === undefined ? tenantName : `${tenantName}/${rel}`;
+    for (const r of file.roots)
+        planUser(r.username, r.email, r.homeCompany, [], true);
+    for (const c of companies) {
+        for (const u of c.node.users ?? []) {
+            const company = u.company === undefined ? c.path : tenantPath(c.tenant, u.company);
+            planUser(u.username, u.email, company, u.postings ?? [], false);
+        }
+    }
+    for (const u of state.users) {
+        if (declaredUsers.has((0, org_names_js_1.nameKey)(u.username)))
+            continue;
+        const inside = u.memberships.filter((m) => inFileTenant(m.companyPath));
+        if (inside.length === 0)
+            continue;
+        const path = `user:${u.username}`;
+        add('user', path, 'not-in-file');
+        for (const m of inside) {
+            for (const p of m.postings) {
+                add('posting', postingPath(u.username, m.companyPath, p), 'not-in-file');
+            }
+        }
+    }
+    // R10 order: stable by kind.
+    const entries = out
+        .map((e, i) => ({ e, i }))
+        .sort((a, b) => exports.PLAN_KIND_ORDER.indexOf(a.e.kind) - exports.PLAN_KIND_ORDER.indexOf(b.e.kind) || a.i - b.i)
+        .map((x) => x.e);
+    return { entries, conflicts: entries.filter((e) => e.status === 'conflict') };
+}

package/dist/features/org-bootstrap/org-bootstrap.manifest.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The gate-7 operation manifest of `shield:org-bootstrap` (G-009 R6, AC-7; Shield #9).
+ *
+ * Each bootstrap step runs as its own operation-bound principal (`operationOf(actor)`, the engine's
+ * WeakMap binding) and is capped by the entry below, root-flagged or not: gate 7 denies any type or
+ * action outside the step's sets. Sets are explicit, never a wildcard. Core's `DelegatedAuthority` is
+ * a type SET times an action SET (not pairs), so a step can also do a listed action on a sibling listed
+ * type (e.g. `postings` can create a `company_membership` in its own anchored company).
+ */
+import { ORG_BOOTSTRAP_PRINCIPAL_ID, type OperationManifestEntry } from '@astram/guard';
+export declare const ORG_BOOTSTRAP_OPERATION = "shield:org-bootstrap";
+/**
+ * The reserved id every step principal carries. It has NO credential and must NEVER be placed in
+ * `SHIELD_ROOT_IDS`: no login can mint this principal, so its authority exists only through the
+ * runner's operation binding.
+ */
+export { ORG_BOOTSTRAP_PRINCIPAL_ID };
+export declare const ORG_BOOTSTRAP_MANIFEST: readonly OperationManifestEntry[];
+//# sourceMappingURL=org-bootstrap.manifest.d.ts.map

package/dist/features/org-bootstrap/org-bootstrap.manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-bootstrap.manifest.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap.manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,0BAA0B,EAAE,KAAK,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAExF,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAE9D;;;;GAIG;AACH,OAAO,EAAE,0BAA0B,EAAE,CAAC;AActC,eAAO,MAAM,sBAAsB,EAAE,SAAS,sBAAsB,EAQnE,CAAC"}

package/dist/features/org-bootstrap/org-bootstrap.manifest.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_BOOTSTRAP_MANIFEST = exports.ORG_BOOTSTRAP_PRINCIPAL_ID = exports.ORG_BOOTSTRAP_OPERATION = void 0;
+/**
+ * The gate-7 operation manifest of `shield:org-bootstrap` (G-009 R6, AC-7; Shield #9).
+ *
+ * Each bootstrap step runs as its own operation-bound principal (`operationOf(actor)`, the engine's
+ * WeakMap binding) and is capped by the entry below, root-flagged or not: gate 7 denies any type or
+ * action outside the step's sets. Sets are explicit, never a wildcard. Core's `DelegatedAuthority` is
+ * a type SET times an action SET (not pairs), so a step can also do a listed action on a sibling listed
+ * type (e.g. `postings` can create a `company_membership` in its own anchored company).
+ */
+const guard_1 = require("@astram/guard");
+Object.defineProperty(exports, "ORG_BOOTSTRAP_PRINCIPAL_ID", { enumerable: true, get: function () { return guard_1.ORG_BOOTSTRAP_PRINCIPAL_ID; } });
+exports.ORG_BOOTSTRAP_OPERATION = 'shield:org-bootstrap';
+const step = (stepKey, objectTypeKeys, allowedActions) => ({
+    operationKey: exports.ORG_BOOTSTRAP_OPERATION,
+    stepKey,
+    authority: { objectTypeKeys, allowedActions },
+});
+const CREATE_READ = ['create', 'read'];
+exports.ORG_BOOTSTRAP_MANIFEST = [
+    step('tenants', ['company'], CREATE_READ),
+    step('companies', ['company'], CREATE_READ),
+    step('org-units', ['department', 'branch', 'company_department', 'company_branch'], CREATE_READ),
+    step('roles', ['role'], CREATE_READ),
+    step('roles-claim', ['role'], ['read']),
+    step('users', ['user', 'company_membership'], CREATE_READ),
+    step('postings', ['company_membership', 'membership_posting'], CREATE_READ),
+];

package/dist/features/org-bootstrap/org-bootstrap.tokens.d.ts

@@ -0,0 +1,8 @@
+/**
+ * DI token for the ONE shared authz pool `IdentityFeatureModule.forRoot()` builds (G-009 T10). The org
+ * bootstrap runner reads it with `app.get(IDENTITY_AUTHZ_POOL, { strict: false })` for its named lock,
+ * its read-only state reader and the few raw writes the spec allows (role-owner claim, root flag).
+ * It is the existing pool, not a new one; it is not exported from the module or the package entry.
+ */
+export declare const IDENTITY_AUTHZ_POOL: unique symbol;
+//# sourceMappingURL=org-bootstrap.tokens.d.ts.map

package/dist/features/org-bootstrap/org-bootstrap.tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-bootstrap.tokens.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap.tokens.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC"}

package/dist/features/org-bootstrap/org-bootstrap.tokens.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_AUTHZ_POOL = void 0;
+/**
+ * DI token for the ONE shared authz pool `IdentityFeatureModule.forRoot()` builds (G-009 T10). The org
+ * bootstrap runner reads it with `app.get(IDENTITY_AUTHZ_POOL, { strict: false })` for its named lock,
+ * its read-only state reader and the few raw writes the spec allows (role-owner claim, root flag).
+ * It is the existing pool, not a new one; it is not exported from the module or the package entry.
+ */
+exports.IDENTITY_AUTHZ_POOL = Symbol('IDENTITY_AUTHZ_POOL');

package/dist/features/org-bootstrap/org-names.d.ts

@@ -0,0 +1,12 @@
+/**
+ * G-009 T9: the one name-comparison helper for the org bootstrap.
+ *
+ * The identity name columns are `utf8mb4_unicode_ci`, so their unique indexes treat names that differ
+ * only by case or accents as equal. `nameKey` mirrors that closely (lower-case, NFD, combining marks
+ * stripped, trailing pad ignored) and is applied to BOTH sides of every comparison, so a clash is a
+ * plan-time `conflict`, not an insert-time failure.
+ */
+export declare function nameKey(value: string): string;
+/** The key of a `/`-joined company path, segment by segment. */
+export declare function pathKey(path: string): string;
+//# sourceMappingURL=org-names.d.ts.map

package/dist/features/org-bootstrap/org-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-names.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-names.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM7C;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK5C"}

package/dist/features/org-bootstrap/org-names.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nameKey = nameKey;
+exports.pathKey = pathKey;
+/**
+ * G-009 T9: the one name-comparison helper for the org bootstrap.
+ *
+ * The identity name columns are `utf8mb4_unicode_ci`, so their unique indexes treat names that differ
+ * only by case or accents as equal. `nameKey` mirrors that closely (lower-case, NFD, combining marks
+ * stripped, trailing pad ignored) and is applied to BOTH sides of every comparison, so a clash is a
+ * plan-time `conflict`, not an insert-time failure.
+ */
+function nameKey(value) {
+    return value
+        .normalize('NFD')
+        .replace(/\p{M}+/gu, '')
+        .toLowerCase()
+        .replace(/ +$/u, '');
+}
+/** The key of a `/`-joined company path, segment by segment. */
+function pathKey(path) {
+    return path
+        .split('/')
+        .map((seg) => nameKey(seg.trim()))
+        .join('/');
+}

package/dist/features/org-bootstrap/org-state.reader.d.ts

@@ -0,0 +1,15 @@
+import type { FrameworkSchemas } from '@astram/core';
+import type { OrgBootstrapFile } from './org-bootstrap-file.js';
+import type { OrgState } from './org-bootstrap-plan.js';
+type Row = Record<string, unknown>;
+export interface OrgStateReaderOptions {
+    query: (sql: string, params?: unknown[]) => Promise<Row[]>;
+    schemas: Pick<FrameworkSchemas, 'app' | 'identity' | 'authz'>;
+}
+export declare class OrgStateReader {
+    private readonly opts;
+    constructor(opts: OrgStateReaderOptions);
+    read(file: OrgBootstrapFile): Promise<OrgState>;
+}
+export {};
+//# sourceMappingURL=org-state.reader.d.ts.map

package/dist/features/org-bootstrap/org-state.reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-state.reader.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-state.reader.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAuB,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAErF,OAAO,KAAK,EAEV,QAAQ,EAMT,MAAM,yBAAyB,CAAC;AAEjC,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,UAAU,GAAG,OAAO,CAAC,CAAC;CAC/D;AA6CD,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,qBAAqB;IAElD,IAAI,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;CA6NtD"}