@astram/identity 0.3.0 → 0.4.0

package/dist/features/service-account/service-account.controller.js

@@ -0,0 +1,281 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAccountController = void 0;
+/**
+ * ServiceAccountController — the Service Accounts admin API (ADR-0033). Seven routes over
+ * {@link ServiceAccountService}, all `@Classified({ typeKey: 'service_account', … })` so the ONE
+ * `decide()` gates them (no handler-level root check): list/get need `read`, create needs `create`,
+ * edit needs `update`, and the three key routes (issue/rotate/revoke) need `manage_keys` — the more-
+ * sensitive credential capability, grantable separately from editing the account.
+ *
+ * ⛔ The actor + tenant are ALWAYS `req.principal` (the enforcement guard attached it) — the account
+ * is created in the ADMIN's own tenant, never a body-supplied one. ⛔ Own-tenant wall + ADR-0029
+ * ceiling live in the service; a cross-tenant id is 404 (no existence leak), an over-reach is 403.
+ * ⛔ Responses carry LABELS + names (never a raw secret; the id is a route handle only). The raw
+ * `ask_…` key is returned EXACTLY ONCE by issue/rotate.
+ */
+const common_1 = require("@nestjs/common");
+const guard_1 = require("@astram/guard");
+const service_account_service_js_1 = require("./service-account.service.js");
+/** Project the resolved Principal to the AdminPrincipal the service consumes. */
+function adminOf(req) {
+    const p = req.principal;
+    return {
+        id: p.id,
+        tenantId: p.tenantId,
+        scopeSubtreeNodeIds: p.scopeSubtreeNodeIds ?? [],
+        // No roleIds: the principal's are a login-time credential snapshot. The service resolves the
+        // admin's in-effect roles itself (HeldRoleResolver → readRoleIdsForTenant).
+        isRoot: p.isRoot === true,
+    };
+}
+/** Map a service error to the right HTTP status (404 / 403 / 400); rethrow the rest (→ 503). */
+function mapError(e) {
+    if (e instanceof service_account_service_js_1.ServiceAccountNotFoundError)
+        throw new common_1.NotFoundException(e.message);
+    if (e instanceof service_account_service_js_1.ServiceAccountCeilingError)
+        throw new common_1.ForbiddenException(e.message);
+    if (e instanceof service_account_service_js_1.ServiceAccountInputError)
+        throw new common_1.BadRequestException(e.message);
+    if (e instanceof service_account_service_js_1.ServiceAccountConflictError)
+        throw new common_1.ConflictException(e.message);
+    throw e;
+}
+/** Narrow the OPTIONAL string[] fields of a body (scope/roles) — reject a non-string-array. */
+function optStringArray(v, field) {
+    if (v === undefined)
+        return undefined;
+    if (!Array.isArray(v) || v.some((x) => typeof x !== 'string')) {
+        throw new common_1.BadRequestException(`${field} must be an array of strings`);
+    }
+    return v;
+}
+/** Narrow an OPTIONAL positive-integer expiry (epoch-ms) from a key-issue body. */
+function optExpiry(v) {
+    if (v === undefined || v === null)
+        return undefined;
+    if (typeof v !== 'number' || !Number.isFinite(v) || v <= 0) {
+        throw new common_1.BadRequestException('expiresAtMs must be a positive epoch-ms number');
+    }
+    return v;
+}
+let ServiceAccountController = class ServiceAccountController {
+    svc;
+    constructor(svc) {
+        this.svc = svc;
+    }
+    /** List the caller's own-tenant service accounts (by label). Gated `service_account:read`. */
+    async list(req) {
+        try {
+            return { accounts: await this.svc.list(adminOf(req)) };
+        }
+        catch (e) {
+            mapError(e);
+        }
+    }
+    /**
+     * What the caller may grant an agent — the create/edit picker source (Phase 4). Gated
+     * `service_account:create` (only someone who can create agents needs the list). Computed from the
+     * SAME ceiling the create/update write check enforces: `{ roles: [{id,name}], scopeNodes:
+     * [{id,name,parentId|null}] }`. ⚠ Declared BEFORE `service-accounts/:id` so the static path wins.
+     */
+    async assignable(req) {
+        try {
+            return await this.svc.assignable(adminOf(req));
+        }
+        catch (e) {
+            mapError(e);
+        }
+    }
+    /** Fetch one own-tenant account. Gated `service_account:read`. Cross-tenant/unknown → 404. */
+    async get(req, id) {
+        try {
+            return { account: await this.svc.get(adminOf(req), id) };
+        }
+        catch (e) {
+            mapError(e);
+        }
+    }
+    /**
+     * Create an account in the caller's own tenant. Gated `service_account:create`.
+     * Body: `{ label, scopeSubtreeNodeIds?, roleIds? }`. Scope/roles must pass the ADR-0029 ceiling.
+     */
+    async create(req, body) {
+        const b = (body ?? {});
+        if (typeof b.label !== 'string')
+            throw new common_1.BadRequestException('label is required');
+        const scope = optStringArray(b.scopeSubtreeNodeIds, 'scopeSubtreeNodeIds');
+        const roles = optStringArray(b.roleIds, 'roleIds');
+        try {
+            const account = await this.svc.create(adminOf(req), {
+                label: b.label,
+                ...(scope !== undefined ? { scopeSubtreeNodeIds: scope } : {}),
+                ...(roles !== undefined ? { roleIds: roles } : {}),
+            });
+            return { account };
+        }
+        catch (e) {
+            mapError(e);
+        }
+    }
+    /**
+     * Edit an account (label/scope/roles/status). Gated `service_account:update`. Own-tenant only;
+     * scope/roles re-checked against the ceiling (an edit cannot escalate).
+     */
+    async update(req, id, body) {
+        const b = (body ?? {});
+        if (b.label !== undefined && typeof b.label !== 'string') {
+            throw new common_1.BadRequestException('label must be a string');
+        }
+        if (b.status !== undefined && b.status !== 'active' && b.status !== 'disabled') {
+            throw new common_1.BadRequestException("status must be 'active' or 'disabled'");
+        }
+        const scope = optStringArray(b.scopeSubtreeNodeIds, 'scopeSubtreeNodeIds');
+        const roles = optStringArray(b.roleIds, 'roleIds');
+        try {
+            const account = await this.svc.update(adminOf(req), id, {
+                ...(b.label !== undefined ? { label: b.label } : {}),
+                ...(scope !== undefined ? { scopeSubtreeNodeIds: scope } : {}),
+                ...(roles !== undefined ? { roleIds: roles } : {}),
+                ...(b.status !== undefined ? { status: b.status } : {}),
+            });
+            return { account };
+        }
+        catch (e) {
+            mapError(e);
+        }
+    }
+    /**
+     * Issue a NEW key for an account. Gated `service_account:manage_keys`. Body: `{ expiresAtMs? }`.
+     * Returns the raw `ask_…` key EXACTLY ONCE — copy it now, it is never retrievable again.
+     */
+    async issueKey(req, id, body) {
+        const b = (body ?? {});
+        const expiresAtMs = optExpiry(b.expiresAtMs);
+        try {
+            const key = await this.svc.issueKey(adminOf(req), id, expiresAtMs !== undefined ? { expiresAtMs } : {});
+            return { key };
+        }
+        catch (e) {
+            mapError(e);
+        }
+    }
+    /**
+     * Rotate an account's key. Gated `service_account:manage_keys`. The previous key stops
+     * authenticating; the new raw key is returned EXACTLY ONCE.
+     */
+    async rotateKey(req, id, body) {
+        const b = (body ?? {});
+        const expiresAtMs = optExpiry(b.expiresAtMs);
+        try {
+            const key = await this.svc.rotateKey(adminOf(req), id, expiresAtMs !== undefined ? { expiresAtMs } : {});
+            return { key };
+        }
+        catch (e) {
+            mapError(e);
+        }
+    }
+    /**
+     * Revoke ALL of an account's keys. Gated `service_account:manage_keys`. Fail-closed on the next
+     * request; idempotent.
+     */
+    async revokeKeys(req, id) {
+        try {
+            await this.svc.revokeKeys(adminOf(req), id);
+            return { success: true };
+        }
+        catch (e) {
+            mapError(e);
+        }
+    }
+};
+exports.ServiceAccountController = ServiceAccountController;
+__decorate([
+    (0, common_1.Get)('service-accounts'),
+    (0, guard_1.Classified)({ typeKey: 'service_account', action: 'read' }),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ServiceAccountController.prototype, "list", null);
+__decorate([
+    (0, common_1.Get)('service-accounts/assignable'),
+    (0, guard_1.Classified)({ typeKey: 'service_account', action: 'create' }),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ServiceAccountController.prototype, "assignable", null);
+__decorate([
+    (0, common_1.Get)('service-accounts/:id'),
+    (0, guard_1.Classified)({ typeKey: 'service_account', action: 'read' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], ServiceAccountController.prototype, "get", null);
+__decorate([
+    (0, common_1.Post)('service-accounts'),
+    (0, guard_1.Classified)({ typeKey: 'service_account', action: 'create' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], ServiceAccountController.prototype, "create", null);
+__decorate([
+    (0, common_1.Patch)('service-accounts/:id'),
+    (0, guard_1.Classified)({ typeKey: 'service_account', action: 'update' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('id')),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], ServiceAccountController.prototype, "update", null);
+__decorate([
+    (0, common_1.Post)('service-accounts/:id/keys'),
+    (0, guard_1.Classified)({ typeKey: 'service_account', action: 'manage_keys' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('id')),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], ServiceAccountController.prototype, "issueKey", null);
+__decorate([
+    (0, common_1.Post)('service-accounts/:id/keys/rotate'),
+    (0, guard_1.Classified)({ typeKey: 'service_account', action: 'manage_keys' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('id')),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], ServiceAccountController.prototype, "rotateKey", null);
+__decorate([
+    (0, common_1.Post)('service-accounts/:id/keys/revoke'),
+    (0, guard_1.Classified)({ typeKey: 'service_account', action: 'manage_keys' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], ServiceAccountController.prototype, "revokeKeys", null);
+exports.ServiceAccountController = ServiceAccountController = __decorate([
+    (0, common_1.Controller)('identity'),
+    __metadata("design:paramtypes", [service_account_service_js_1.ServiceAccountService])
+], ServiceAccountController);

package/dist/features/service-account/service-account.service.d.ts

@@ -0,0 +1,202 @@
+import type { PasswordHasher, ApiKeyStore } from '@astram/core';
+import type { ServiceAccountStore, RoleOption, ScopeNodeOption } from './service-account.store.js';
+/** The account id was not in the caller's subtree (unknown or cross-tenant) → 404 (no leak). */
+export declare class ServiceAccountNotFoundError extends Error {
+    constructor();
+}
+/** The requested scope/roles exceed the caller's own authority (ADR-0029) → 403. */
+export declare class ServiceAccountCeilingError extends Error {
+    constructor(message: string);
+}
+/** The account changed between this edit's read and its write (a concurrent edit) → 409. */
+export declare class ServiceAccountConflictError extends Error {
+    constructor();
+}
+/** A malformed request (empty label, no fields to update, etc.) → 400. */
+export declare class ServiceAccountInputError extends Error {
+    constructor(message: string);
+}
+/** An account view for the API (never carries a raw secret; `id` is a handle, shown by label). */
+export interface ServiceAccountView {
+    readonly id: string;
+    readonly label: string;
+    readonly scopeSubtreeNodeIds: readonly string[];
+    /** Resolved company names, same order as `scopeSubtreeNodeIds` (ADR-0012 — show these). */
+    readonly scopeLabels: readonly string[];
+    readonly roleIds: readonly string[];
+    /** Resolved role names, same order as `roleIds` (ADR-0012 — show these). */
+    readonly roleLabels: readonly string[];
+    readonly status: string;
+    readonly createdByName: string | null;
+    readonly createdAtMs: number;
+    readonly updatedAtMs: number | null;
+}
+/** The ONE-TIME key reveal returned by issue/rotate — the only time the raw key exists. */
+export interface IssuedKey {
+    readonly apiKey: string;
+    readonly accountLabel: string;
+    readonly version: number;
+    readonly expiresAtMs: number | null;
+}
+/** A minimal audit sink (best-effort). The module adapts it to the shield_audit sink. */
+export interface ServiceAccountAudit {
+    record(event: {
+        action: string;
+        actorId: string;
+        tenantId: string;
+        occurredAtMs: number;
+        attributes: Readonly<Record<string, unknown>>;
+    }): Promise<void>;
+}
+/** Resolve a principal id → display name (no raw uuid in the view). Returns null when unknown. */
+export type NameResolver = (id: string) => Promise<string | null>;
+/** The caller (an admin) as the service needs it — the enforcement guard's resolved principal. */
+export interface AdminPrincipal {
+    readonly id: string;
+    readonly tenantId: string;
+    readonly scopeSubtreeNodeIds: readonly string[];
+    readonly isRoot: boolean;
+}
+/**
+ * The roles an admin is IN EFFECT holding in a tenant — the ceiling's role source. Wired to
+ * `readRoleIdsForTenant` (the single source shared with gate 5 and `GrantCeiling`). Deliberately
+ * NOT the request principal's `roleIds`: that is the credential's login-time snapshot, which goes
+ * stale when postings change (a demoted admin could otherwise mint an agent with the role they lost).
+ */
+export type HeldRoleResolver = (principalId: string, tenantId: string) => Promise<readonly string[]>;
+/**
+ * "What may I grant" — the ADR-0029 ceiling of ONE admin, computed in ONE place. Both the write
+ * check ({@link ServiceAccountService} create/update) and the picker source
+ * ({@link ServiceAccountService.assignable}) read it, so the picker can never offer what the write
+ * would reject. Root (strict `isRoot === true`) spans everything; a non-root admin may grant only
+ * nodes in their reachable subtree (their tenant when the subtree is empty) and roles they hold.
+ */
+export interface ServiceAccountCeiling {
+    readonly isRoot: boolean;
+    readonly nodeIds: ReadonlySet<string>;
+    readonly roleIds: ReadonlySet<string>;
+}
+export declare function ceilingOf(admin: AdminPrincipal, heldRoleIds: readonly string[]): ServiceAccountCeiling;
+export declare function ceilingAllowsNode(c: ServiceAccountCeiling, nodeId: string): boolean;
+export declare function ceilingAllowsRole(c: ServiceAccountCeiling, roleId: string): boolean;
+/** What the caller may grant an agent (the picker source) — names, never shown as ids. */
+export interface AssignableAccess {
+    readonly roles: readonly RoleOption[];
+    readonly scopeNodes: readonly ScopeNodeOption[];
+}
+export declare class ServiceAccountService {
+    private readonly accounts;
+    private readonly keys;
+    private readonly hasher;
+    private readonly audit;
+    private readonly resolveName;
+    private readonly heldRoles;
+    private readonly now;
+    constructor(accounts: ServiceAccountStore, keys: ApiKeyStore & {
+        putVersion(input: {
+            accountId: string;
+            tenantId: string;
+            scopeSubtreeNodeIds: readonly string[];
+            roleIds: readonly string[];
+            secretHash: string;
+            version: number;
+            expiresAtMs?: number;
+            createdAtMs: number;
+        }): Promise<void>;
+        currentVersion(accountId: string): Promise<number>;
+        revoke(accountId: string, atMs: number): Promise<void>;
+    }, hasher: PasswordHasher, audit: ServiceAccountAudit, resolveName: NameResolver, heldRoles: HeldRoleResolver, now?: () => number);
+    /**
+     * Rows → views, resolving role + company NAMES in two batched reads (no N+1). Labels follow the
+     * id order; an id that no longer resolves gets a fallback label, never the id (ADR-0012).
+     */
+    private toViews;
+    /**
+     * The caller's ceiling with roles resolved LIVE ({@link HeldRoleResolver}). Root needs no role
+     * read. A resolver failure propagates (→ 503): fail closed, never an empty-or-stale ceiling.
+     */
+    private ceilingFor;
+    /**
+     * Enforce the ADR-0029 ceiling ({@link ceilingOf}): every requested node must be within the
+     * ceiling's subtree and every requested role one the admin holds. Root bypasses. On violation
+     * throws a 403 — never with an id (ADR-0012), and NAMING an offender only when it is already on
+     * the agent being edited (`onAgent`, whose labels the caller sees anyway). Any other offender is
+     * described generically: the role/company catalog reads are not caller-scoped, so resolving a
+     * name for an arbitrary id would turn the 403 into a cross-tenant name/existence oracle.
+     */
+    private assertWithinCeiling;
+    /**
+     * "the role ‘A’", "‘A’ and 2 other roles", "a role" … — names only offenders already on the agent.
+     */
+    private describeOffenders;
+    /**
+     * Resolve names for audit (ids already authorised for this caller: within ceiling, or on the
+     * agent). Best-effort like the audit itself: it runs AFTER the write, so a lookup failure falls
+     * back to placeholder names instead of failing a write that already happened.
+     */
+    private auditNames;
+    /**
+     * What the caller may grant (the picker source for create/edit), computed from the SAME
+     * {@link ceilingOf} the write check enforces. Root → every role + every company; non-root → the
+     * roles they hold + the nodes of their reachable subtree. Nodes come back tree-ordered with a
+     * `parentId` only when the parent is also assignable.
+     */
+    assignable(admin: AdminPrincipal): Promise<AssignableAccess>;
+    /** List the admin's own-tenant accounts (by label; ids are handles). */
+    list(admin: AdminPrincipal): Promise<ServiceAccountView[]>;
+    /** Fetch one own-tenant account; cross-tenant/unknown → 404. */
+    get(admin: AdminPrincipal, id: string): Promise<ServiceAccountView>;
+    /**
+     * Create an account. `tenantId` is the admin's (server-stamped) — an account is created in the
+     * admin's OWN tenant only (a non-root admin cannot pick another tenant). Scope defaults to the
+     * admin's whole subtree when omitted; whatever is requested must pass the ceiling.
+     */
+    create(admin: AdminPrincipal, input: {
+        label: string;
+        scopeSubtreeNodeIds?: readonly string[];
+        roleIds?: readonly string[];
+    }): Promise<ServiceAccountView>;
+    /**
+     * Edit an account's label/scope/roles/status (own-tenant; ceiling re-checked).
+     *
+     * Scope/roles semantics (Phase 4, confirmed 2026-10-08):
+     *  - `scopeSubtreeNodeIds: []` → 400 (an agent needs at least one scope node).
+     *  - What is REQUESTED must be ⊆ the editor's ceiling, else 403 — whatever the request shape
+     *    (duplicates, mixed lists, or re-sending an item the agent already has but the editor can't
+     *    grant). Nothing is written on a 403.
+     *  - NON-ROOT: the agent's EXISTING items outside the editor's ceiling are PRESERVED —
+     *    stored = requested ∪ (existing \ ceiling). A lower-ceiling admin can't strip access they could
+     *    never grant back; the preserved items come from the stored row, never the request, so the
+     *    merge can't add anything new. ROOT replaces with exactly what it sends.
+     */
+    update(admin: AdminPrincipal, id: string, patch: {
+        label?: string;
+        scopeSubtreeNodeIds?: readonly string[];
+        roleIds?: readonly string[];
+        status?: 'active' | 'disabled';
+    }): Promise<ServiceAccountView>;
+    /**
+     * Issue a NEW key for an account (own-tenant). Mints `ask_<id>_<secret>`, hashes the secret, and
+     * persists the hash as the next version — carrying the ACCOUNT's current scope/roles onto the key
+     * (so the key's Principal reflects the account as it stands). Returns the raw key ONCE.
+     * `expiresAtMs` is optional (a non-expiring key is discouraged; the caller opts in to no expiry).
+     */
+    issueKey(admin: AdminPrincipal, id: string, opts?: {
+        expiresAtMs?: number;
+    }): Promise<IssuedKey>;
+    /**
+     * Rotate an account's key: mint a new version (the old version stops being the current one —
+     * `getByAccountId` returns the highest, so the previous key no longer authenticates). Returns the
+     * new raw key ONCE.
+     */
+    rotateKey(admin: AdminPrincipal, id: string, opts?: {
+        expiresAtMs?: number;
+    }): Promise<IssuedKey>;
+    /** Revoke ALL of an account's keys (own-tenant) — fail-closed on the next request. Idempotent. */
+    revokeKeys(admin: AdminPrincipal, id: string): Promise<void>;
+    /** Shared mint path for issue + rotate: version bump, hash, putVersion, audit, one-time reveal. */
+    private mintFor;
+    /** Best-effort audit — a sink throw must never fail a legitimate operation. */
+    private safeAudit;
+}
+//# sourceMappingURL=service-account.service.d.ts.map

package/dist/features/service-account/service-account.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAerG;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,qBAAqB,CAMtG;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAgDD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAwBrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAuBjC;;OAEG;YACW,iBAAiB;IAiB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAelE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IAyF9B;;;;;OAKG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,SAAS,CAAC;IAMrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,SAAS,CAAC;IAMrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAYxB"}