@astram/identity 0.14.0 → 0.16.0

package/dist/user.object.js

@@ -54,6 +54,9 @@ exports.User = User = __decorate([
         // capped root, the identity administrator, may list/read AND create/update/delete users). Uniform
         // across all actions (read reclassified control 2026-07-16), so plane is per-type.
         access: { plane: 'control', system: true },
+        // G-010 R11 (ADR-0038): `invite` (`identity:user:invite`, POST /identity/users/:uuid/invite) next
+        // to CRUD. Roles holding `identity:*` or `identity:user:*` gain it on upgrade; exact keys do not.
+        actions: ['invite'],
         // Read-scope wall (ADR-0027, Task 4.1): a user has no company column (they belong to many
         // companies via `company_membership`) — a user is in-scope iff they have a membership in
         // the caller's reachable subtree. A multi-tenant user correctly appears for each subtree

package/migrations/1710000000102-CreateAuditChain.cjs

@@ -0,0 +1,71 @@
+/**
+ * Framework audit migration — the durable hash chain over `audit_log` (audit-chain-store SPEC §4.A,
+ * §4.B; Layer 9 reopened, STATUS G3). Both tables live in the audit database (`<ns>_audit`, default
+ * `shield_audit`), created by 1710000000010; this migration owns only the two tables.
+ * `audit_log` is NOT altered.
+ *
+ * `audit_chain` — one row per sealed `audit_log` row: per-tenant dense `ac_sequence` from 0, the
+ * row's content hash, the previous entry hash (`GENESIS` or the prior `ac_entry_hash`) and its own
+ * entry hash. `ac_occurred_at_ms` is an unhashed copy of `al_occurred_at_ms` (sealer window, prune
+ * prefix; `audit:verify` checks it); `ac_sealed_at_ms` is the sealer clock. PK (tenant, sequence) is
+ * the Layer-9 unique key; UNIQUE `ac_al_uuid` seals a row at most once; `idx_ac_occurred` serves the
+ * sealer's window start.
+ *
+ * `audit_chain_checkpoint` — one row per pruned batch (written only by `prune_audit`): the last
+ * pruned sequence and its entry hash, so verification can anchor after a prune.
+ *
+ * Collation: every tenant and uuid column is `utf8mb4_nopad_bin` (binary AND no pad), so `T1`, `t1`
+ * and `T1 ` are three tenants, exactly as in Node and `verifyChain`. Never `utf8mb4_bin` (PAD SPACE).
+ * Hash and run-id columns are `ascii_bin`. The table default collation is also `utf8mb4_nopad_bin`,
+ * so a character column added later without an explicit COLLATE keeps exact-byte semantics instead
+ * of silently folding case or trailing spaces. Comparisons against `audit_log`
+ * (`utf8mb4_unicode_ci`) must write `COLLATE utf8mb4_nopad_bin` on the `audit_log` side.
+ *
+ * Append-only: no code path UPDATEs or DELETEs these tables except `prune_audit` (definer).
+ * Idempotent (CREATE TABLE IF NOT EXISTS); `down` drops both (DROP TABLE IF EXISTS). No FK to
+ * `audit_log` (prune deletes rows in both under its own rules; a chain row whose `audit_log` row is
+ * gone is evidence for `audit:verify`). No seed, no hard-coded ids.
+ */
+
+const { frameworkSchemasForMigration } = require('@astram/core');
+
+// Database names come from `ctx.schemas` (SHIELD_DB_NAMESPACE, ADR-0037); under an older
+// @astram/migrate without it, the default names apply only while the namespace is unset.
+
+async function up(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).audit;
+
+  await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`audit_chain\` (
+    ac_tenant_id      VARCHAR(64)     COLLATE utf8mb4_nopad_bin NOT NULL,
+    ac_sequence       BIGINT UNSIGNED NOT NULL,
+    ac_al_uuid        VARCHAR(36)     COLLATE utf8mb4_nopad_bin NOT NULL,
+    ac_content_hash   CHAR(64)        CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    ac_prev_hash      VARCHAR(64)     CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    ac_entry_hash     CHAR(64)        CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    ac_occurred_at_ms BIGINT          NOT NULL,
+    ac_sealed_at_ms   BIGINT          NOT NULL,
+    PRIMARY KEY (ac_tenant_id, ac_sequence),
+    UNIQUE KEY uq_ac_al_uuid (ac_al_uuid),
+    INDEX idx_ac_occurred (ac_occurred_at_ms)
+  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_nopad_bin`);
+
+  await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`audit_chain_checkpoint\` (
+    acc_tenant_id             VARCHAR(64)     COLLATE utf8mb4_nopad_bin NOT NULL,
+    acc_sequence              BIGINT UNSIGNED NOT NULL,
+    acc_entry_hash            CHAR(64)        CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    acc_pruned_at_ms          BIGINT          NOT NULL,
+    acc_run_id                VARCHAR(36)     CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    acc_acknowledged_sequence BIGINT UNSIGNED NULL,
+    PRIMARY KEY (acc_tenant_id, acc_sequence)
+  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_nopad_bin`);
+}
+
+async function down(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).audit;
+  await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`audit_chain_checkpoint\``);
+  await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`audit_chain\``);
+}
+
+module.exports = { up, down };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -36,9 +36,9 @@
   },
   "dependencies": {
     "mariadb": "^3.5.4",
-    "@astram/core": "1.8.0",
-    "@astram/engine": "0.10.0",
-    "@astram/guard": "0.17.0"
+    "@astram/core": "1.10.0",
+    "@astram/engine": "0.10.2",
+    "@astram/guard": "0.19.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",
@@ -61,6 +61,11 @@
     "unplugin-swc": "^1.5.1",
     "vitest": "^2.1.8"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ASTRAM-2-0/astram-framework.git",
+    "directory": "packages/identity"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",

package/dist/features/org-bootstrap/org-bootstrap-runner.harness.d.ts

@@ -1,259 +0,0 @@
-import type { Principal } from '@astram/core';
-import { current } from './org-bootstrap-runner.mocks.js';
-import type { OrgState } from './org-bootstrap-plan.js';
-export declare const SCHEMAS: {
-    readonly namespace: "zzns";
-    readonly app: "zzns_app";
-    readonly identity: "zzns_identity";
-    readonly authz: "zzns_authz";
-    readonly audit: "zzns_audit";
-    readonly isDefault: false;
-};
-export declare const PW = "Zq-root-pass-1";
-export declare const OPERATOR = "op.person@example.test";
-export declare const BASE = "https://app.example.test/reset-password";
-export declare const DEFAULT_DEV_BASE = "http://localhost:5173/reset-password";
-export declare const LOCK_NAME = "astram_org_bootstrap:zzns_app";
-export declare const ROOT_PW_VAR = "ASTRAM_BOOTSTRAP_ROOT_PASSWORD_ZROOT";
-/** Env of a development/test run that would pass every refusal. */
-export declare const TEST_ENV: Record<string, string>;
-/** Env of a production run; the root password must be secret-ref resolved (the spec adds ROOT_PW_VAR to its hoisted secretRefs set). */
-export declare const PROD_ENV: Record<string, string>;
-/** Fresh-database file: 1 root, 2 companies, 1 dept, 1 branch, 3 roles, 3 non-root users. */
-export declare const FILE_MAIN: {
-    version: number;
-    roots: {
-        username: string;
-        email: string;
-        homeCompany: string;
-    }[];
-    tenants: {
-        name: string;
-        departments: string[];
-        branches: string[];
-        roles: {
-            name: string;
-            permissions: string[];
-        }[];
-        users: ({
-            username: string;
-            email: string;
-            postings: {
-                role: string;
-                department: string;
-                branch: string;
-            }[];
-        } | {
-            username: string;
-            email: string;
-            postings?: never;
-        })[];
-        children: {
-            name: string;
-            roles: {
-                name: string;
-                permissions: never[];
-            }[];
-            users: {
-                username: string;
-                email: string;
-                postings: {
-                    role: string;
-                }[];
-            }[];
-        }[];
-    }[];
-};
-/** Two tenants: used to prove `operationRoleIds` never reach across tenants. */
-export declare const FILE_TWO_TENANTS: {
-    version: number;
-    roots: {
-        username: string;
-        email: string;
-        homeCompany: string;
-    }[];
-    tenants: {
-        name: string;
-        roles: {
-            name: string;
-            permissions: never[];
-        }[];
-        users: {
-            username: string;
-            email: string;
-            postings: {
-                role: string;
-            }[];
-        }[];
-    }[];
-};
-/** One tenant already holding everything: the state below makes every entry `unchanged`. */
-export declare const FILE_MINI: {
-    version: number;
-    roots: {
-        username: string;
-        email: string;
-        homeCompany: string;
-    }[];
-    tenants: {
-        name: string;
-        roles: {
-            name: string;
-            permissions: string[];
-        }[];
-        users: {
-            username: string;
-            email: string;
-            postings: {
-                role: string;
-            }[];
-        }[];
-    }[];
-};
-/** A tenant with one user whose membership does not exist yet (for the "existing user" cases). */
-export declare const FILE_DAVE: {
-    version: number;
-    roots: {
-        username: string;
-        email: string;
-        homeCompany: string;
-    }[];
-    tenants: {
-        name: string;
-        roles: {
-            name: string;
-            permissions: never[];
-        }[];
-        users: {
-            username: string;
-            email: string;
-            postings: {
-                role: string;
-            }[];
-        }[];
-    }[];
-};
-export declare const emptyState: () => OrgState;
-type Cred = 'none' | 'locked' | 'usable';
-/** The state that makes FILE_MINI entirely `unchanged`, alice's credential as given. */
-export declare function stateMini(aliceCredential?: Cred): OrgState;
-export interface Call {
-    seq: number;
-    service: string;
-    method: string;
-    args: unknown[];
-    /** The principal registered on the resolve context (request-scoped services), if any. */
-    principal: Principal | undefined;
-    /** The bootstrap principal passed as an explicit argument, if any. */
-    actor: Principal | undefined;
-}
-export interface Query {
-    conn: string;
-    sql: string;
-    params: unknown[];
-}
-export type Row = Record<string, unknown>;
-export interface World {
-    app: FakeApp;
-    state: OrgState;
-    out: string[];
-    outFn: (line: string) => void;
-    events: string[];
-    calls: Call[];
-    queries: Query[];
-    transitions: unknown[][];
-    issued: {
-        principalId: string;
-        hash: string;
-        expiresAtMs: number;
-    }[];
-    invalidated: string[];
-    provisionedLocked: {
-        principalId: string;
-        hint: string;
-        tenantId: string;
-    }[];
-    provisionedPassword: {
-        principalId: string;
-        hint: string;
-        tenantId: string;
-        password: string;
-    }[];
-    conns: FakeConn[];
-    readerCalls: number;
-    lockMode: 'acquired' | 'busy';
-    failOn: ((service: string, method: string, args: unknown[]) => Error | undefined) | undefined;
-    failTransition: Error | undefined;
-    /** Throws for a matching statement (e.g. the audit INSERT), on whichever connection runs it. */
-    failQuery: ((connId: string, sql: string, params: unknown[]) => Error | undefined) | undefined;
-    /** Whether a posting outside the file's tenants holds the role being claimed (R1-8 re-check). */
-    roleHeldOutside: boolean;
-    id: (kind: string, name: string) => string;
-    tables: Record<string, Row[]>;
-}
-export interface FakeConn {
-    id: string;
-    released: boolean;
-    log: string[];
-    query: (sql: string, params?: unknown[]) => Promise<unknown>;
-    beginTransaction: () => Promise<void>;
-    commit: () => Promise<void>;
-    rollback: () => Promise<void>;
-    release: () => Promise<void>;
-    end: () => Promise<void>;
-}
-export { current };
-export declare class FakeApp {
-    private readonly singletons;
-    private readonly scoped;
-    initCalls: number;
-    readonly requests: Map<object, {
-        principal?: Principal;
-    }>;
-    readonly resolved: {
-        token: unknown;
-        principal: Principal | undefined;
-    }[];
-    constructor(singletons: Map<unknown, unknown>, scoped: Map<unknown, (principal: Principal | undefined) => object>);
-    init(): Promise<this>;
-    get(token: unknown, _options?: unknown): unknown;
-    registerRequestByContextId(request: {
-        principal?: Principal;
-    }, contextId: object): void;
-    resolve(token: unknown, contextId: object, _options?: unknown): Promise<unknown>;
-}
-export interface WorldOptions {
-    /** `IDENTITY_AUTHZ_POOL`, imported from `./org-bootstrap.tokens.js` by the spec. */
-    poolToken: unknown;
-    /** false = IdentityFeatureModule is not wired: `app.get` / `app.resolve` find nothing. */
-    wired?: boolean;
-    state?: OrgState;
-    tables?: Record<string, Row[]>;
-    lockMode?: 'acquired' | 'busy';
-    memberships?: {
-        id: string;
-        userUuid: string;
-        companyUuid: string;
-    }[];
-    failOn?: World['failOn'];
-}
-export declare function makeWorld(options: WorldOptions): World;
-export declare const sha256: (s: string) => string;
-export declare const isWriteCall: (c: Call) => boolean;
-export declare const writeCalls: (w: World) => Call[];
-export declare const callsOf: (w: World, service: string, method: string) => Call[];
-/** Every non-audit write the runner could make is absent. Lock and SELECT traffic is allowed. */
-export declare function noWritesAtAll(w: World): string[];
-/** Lock discipline: every GET_LOCK ran on a dedicated connection and was released on that one. */
-export declare function lockProblems(w: World): string[];
-/** Everything the run said or stored that must never carry a secret. Provisioner args excluded. */
-export declare function visibleText(w: World, extra?: unknown[]): string;
-/** The raw token of the link printed for `username` (a line with the name and `<base>?token=<hex>`). */
-export declare function linkFor(w: World, username: string): {
-    raw: string;
-    line: string;
-} | undefined;
-export declare const linkLines: (w: World) => string[];
-/** The audit rows (INSERTs into audit_log) naming `action`, from any connection. */
-export declare const auditRowsFor: (w: World, action: string) => Query[];
-//# sourceMappingURL=org-bootstrap-runner.harness.d.ts.map

package/dist/features/org-bootstrap/org-bootstrap-runner.harness.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-bootstrap-runner.harness.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap-runner.harness.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAY9C,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAE1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAIxD,eAAO,MAAM,OAAO;;;;;;;CAOV,CAAC;AAEX,eAAO,MAAM,EAAE,mBAAmB,CAAC;AACnC,eAAO,MAAM,QAAQ,2BAA2B,CAAC;AACjD,eAAO,MAAM,IAAI,4CAA4C,CAAC;AAC9D,eAAO,MAAM,gBAAgB,yCAAyC,CAAC;AACvE,eAAO,MAAM,SAAS,kCAAkC,CAAC;AACzD,eAAO,MAAM,WAAW,yCAAyC,CAAC;AAElE,mEAAmE;AACnE,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK3C,CAAC;AAEF,wIAAwI;AACxI,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK3C,CAAC;AAIF,6FAA6F;AAC7F,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCrB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;CAiB5B,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;CAYrB,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;CAYrB,CAAC;AAEF,eAAO,MAAM,UAAU,QAAO,QAQ5B,CAAC;AAEH,KAAK,IAAI,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEzC,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,eAAe,GAAE,IAAe,GAAG,QAAQ,CAqCpE;AAID,MAAM,WAAW,IAAI;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,yFAAyF;IACzF,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IACjC,sEAAsE;IACtE,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAED,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,OAAO,EAAE,KAAK,EAAE,CAAC;IACjB,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;IACzB,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACrE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7E,mBAAmB,EAAE;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,EAAE,CAAC;IACJ,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,KAAK,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAC9F,cAAc,EAAE,KAAK,GAAG,SAAS,CAAC;IAClC,gGAAgG;IAChG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,KAAK,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAC/F,iGAAiG;IACjG,eAAe,EAAE,OAAO,CAAC;IACzB,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAOD,OAAO,EAAE,OAAO,EAAE,CAAC;AAEnB,qBAAa,OAAO;IAKhB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,SAAS,SAAK;IACd,QAAQ,CAAC,QAAQ;oBAAiC,SAAS;OAAM;IACjE,QAAQ,CAAC,QAAQ,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAAA;KAAE,EAAE,CAAM;gBAE5D,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,KAAK,MAAM,CAAC;IAG/E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAK3B,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO;IAShD,0BAA0B,CAAC,OAAO,EAAE;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAIjF,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;CAYvF;AAED,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,SAAS,EAAE,OAAO,CAAC;IACnB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAC/B,WAAW,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtE,MAAM,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;CAC1B;AAID,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,KAAK,CAgUtD;AAID,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AAE1F,eAAO,MAAM,WAAW,GAAI,GAAG,IAAI,KAAG,OAAsC,CAAC;AAE7E,eAAO,MAAM,UAAU,GAAI,GAAG,KAAK,KAAG,IAAI,EAAiC,CAAC;AAE5E,eAAO,MAAM,OAAO,GAAI,GAAG,KAAK,EAAE,SAAS,MAAM,EAAE,QAAQ,MAAM,KAAG,IAAI,EACH,CAAC;AAEtE,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAgBhD;AAED,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAa/C;AAED,mGAAmG;AACnG,wBAAgB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,GAAE,OAAO,EAAO,GAAG,MAAM,CASnE;AAED,wGAAwG;AACxG,wBAAgB,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAO7F;AAED,eAAO,MAAM,SAAS,GAAI,GAAG,KAAK,KAAG,MAAM,EAA6C,CAAC;AAEzF,oFAAoF;AACpF,eAAO,MAAM,YAAY,GAAI,GAAG,KAAK,EAAE,QAAQ,MAAM,KAAG,KAAK,EAC4B,CAAC"}