@astram/identity 0.4.0 → 0.5.0

package/dist/features/policy/policy.controller.js

@@ -33,6 +33,7 @@ exports.PolicyController = void 0;
  */
 const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 const policy_service_js_1 = require("./policy.service.js");
 let PolicyController = class PolicyController {
     policies;
@@ -146,5 +147,6 @@ __decorate([
 ], PolicyController.prototype, "delete", null);
 exports.PolicyController = PolicyController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [policy_service_js_1.PolicyService])
 ], PolicyController);

package/dist/features/role/role.controller.d.ts

@@ -1,5 +1,6 @@
 import { RoleService } from './role.service.js';
 import { type ListQueryDto } from '../shared/list-query.js';
+import type { AuthedRequest } from '../shared/http.js';
 export declare class RoleController {
     private readonly roles;
     constructor(roles: RoleService);
@@ -24,13 +25,13 @@ export declare class RoleController {
      *  administrator, may read roles). */
     getRole(uuid: string): Promise<import("packages/engine/dist/types.js").RecordView | null>;
     /** Update a role — gated on `identity:role:update`. */
-    updateRole(uuid: string, body: {
+    updateRole(req: AuthedRequest, uuid: string, body: {
         name?: string;
     }): Promise<{
         success: boolean;
     }>;
     /** Delete a role — gated on `identity:role:delete`. */
-    deleteRole(uuid: string): Promise<{
+    deleteRole(req: AuthedRequest, uuid: string): Promise<{
         success: boolean;
     }>;
 }

package/dist/features/role/role.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.controller.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAK5E,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C,uDAAuD;IAGjD,UAAU,CAAS,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKhD;0CACsC;IAGtC,OAAO,CAAgB,IAAI,EAAE,MAAM;IAInC,uDAAuD;IAGjD,UAAU,CAAgB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAK7E,uDAAuD;IAGjD,UAAU,CAAgB,IAAI,EAAE,MAAM;;;CAI7C"}
+{"version":3,"file":"role.controller.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C,uDAAuD;IAGjD,UAAU,CAAS,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKhD;0CACsC;IAGtC,OAAO,CAAgB,IAAI,EAAE,MAAM;IAInC,uDAAuD;IAGjD,UAAU,CACP,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMjC,uDAAuD;IAGjD,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAIxE"}

package/dist/features/role/role.controller.js

@@ -17,9 +17,11 @@ const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const role_service_js_1 = require("./role.service.js");
 const list_query_js_1 = require("../shared/list-query.js");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 // Role management is gated on `identity:role:<action>` grants. `role` is CONTROL-plane
 // for ALL actions — including read: the capped root is the identity administrator (the
-// identity-administrator model), so it may list/read roles AND manage them.
+// identity-administrator model), so it may list/read roles AND manage them. Update/delete
+// also pass the role-binding rule (a role used outside the caller's subtree is root-only).
 let RoleController = class RoleController {
     roles;
     constructor(roles) {
@@ -46,13 +48,13 @@ let RoleController = class RoleController {
         return this.roles.getRole(uuid);
     }
     /** Update a role — gated on `identity:role:update`. */
-    async updateRole(uuid, body) {
-        await this.roles.updateRole(uuid, body ?? {});
+    async updateRole(req, uuid, body) {
+        await this.roles.updateRole(req.principal, uuid, { name: body?.name });
         return { success: true };
     }
     /** Delete a role — gated on `identity:role:delete`. */
-    async deleteRole(uuid) {
-        await this.roles.deleteRole(uuid);
+    async deleteRole(req, uuid) {
+        await this.roles.deleteRole(req.principal, uuid);
         return { success: true };
     }
 };
@@ -84,21 +86,24 @@ __decorate([
 __decorate([
     (0, common_1.Put)('roles/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
-    __param(0, (0, common_1.Param)('uuid')),
-    __param(1, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
+    __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], RoleController.prototype, "updateRole", null);
 __decorate([
     (0, common_1.Delete)('roles/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'delete' }),
-    __param(0, (0, common_1.Param)('uuid')),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
 ], RoleController.prototype, "deleteRole", null);
 exports.RoleController = RoleController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [role_service_js_1.RoleService])
 ], RoleController);

package/dist/features/role/role.service.d.ts

@@ -1,24 +1,32 @@
 import { RecordsService, type RecordId } from '@astram/engine';
+import type { Principal } from '@astram/core';
 import { type ListParams } from '../shared/list-query.js';
+import { GrantCeiling } from '../authz/grant-ceiling.js';
 /**
  * RoleService — role CRUD on the paved road, via the framework's RecordsService
- * facade. The facade supplies the acting identity (the request principal) —
- * this service never threads a Principal. No raw SQL, no RECORD_ENGINE.
+ * facade. The facade supplies the acting identity (the request principal) for the pipe;
+ * no raw SQL, no RECORD_ENGINE.
+ *
+ * Roles are a GLOBAL catalog, so renaming or deleting one changes every tenant that uses it (a
+ * delete cascades its postings). Security hardening #1 (D1 interim rule): update/delete first pass
+ * `GrantCeiling.assertRoleAdministrable` — the role must be bound inside the actor's subtree and
+ * nowhere outside it (a shared role is root-only). The engine's write wall still applies after.
  */
 export declare class RoleService {
     private readonly records;
-    constructor(records: RecordsService);
+    private readonly ceiling;
+    constructor(records: RecordsService, ceiling: GrantCeiling);
     /** Create a role. */
     createRole(name: string): Promise<RecordId>;
     /** List roles (tenant-scoped by the pipe), with paging/search/sort. */
     listRoles(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
     /** Read a single role. */
     getRole(uuid: string): Promise<import("@astram/engine").RecordView | null>;
-    /** Update a role. */
-    updateRole(uuid: string, patch: {
-        name?: string;
+    /** Rename a role — only a role the actor may administer (binding rule). Patch whitelisted. */
+    updateRole(actor: Principal, uuid: string, patch: {
+        name?: unknown;
     }): Promise<void>;
-    /** Delete a role. */
-    deleteRole(uuid: string): Promise<void>;
+    /** Delete a role — only a role the actor may administer (binding rule). */
+    deleteRole(actor: Principal, uuid: string): Promise<void>;
 }
 //# sourceMappingURL=role.service.d.ts.map

package/dist/features/role/role.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.service.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAK1E;;;;GAIG;AACH,qBACa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAEpD,qBAAqB;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI3C,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,qBAAqB;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE,qBAAqB;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGxC"}
+{"version":3,"file":"role.service.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD;;;;;;;;;GASG;AACH,qBACa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY;IAGxC,qBAAqB;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI3C,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,8FAA8F;IACxF,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1F,2EAA2E;IACrE,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAIhE"}

package/dist/features/role/role.service.js

@@ -13,17 +13,25 @@ exports.RoleService = void 0;
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
 const list_query_js_1 = require("../shared/list-query.js");
+const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 const ROLE_SEARCH_FIELDS = ['name'];
 const ROLE_SORT_FIELDS = ['name', 'createdAt'];
 /**
  * RoleService — role CRUD on the paved road, via the framework's RecordsService
- * facade. The facade supplies the acting identity (the request principal) —
- * this service never threads a Principal. No raw SQL, no RECORD_ENGINE.
+ * facade. The facade supplies the acting identity (the request principal) for the pipe;
+ * no raw SQL, no RECORD_ENGINE.
+ *
+ * Roles are a GLOBAL catalog, so renaming or deleting one changes every tenant that uses it (a
+ * delete cascades its postings). Security hardening #1 (D1 interim rule): update/delete first pass
+ * `GrantCeiling.assertRoleAdministrable` — the role must be bound inside the actor's subtree and
+ * nowhere outside it (a shared role is root-only). The engine's write wall still applies after.
  */
 let RoleService = class RoleService {
     records;
-    constructor(records) {
+    ceiling;
+    constructor(records, ceiling) {
         this.records = records;
+        this.ceiling = ceiling;
     }
     /** Create a role. */
     createRole(name) {
@@ -37,17 +45,23 @@ let RoleService = class RoleService {
     getRole(uuid) {
         return this.records.get('role', uuid);
     }
-    /** Update a role. */
-    updateRole(uuid, patch) {
-        return this.records.update('role', uuid, { fields: patch });
+    /** Rename a role — only a role the actor may administer (binding rule). Patch whitelisted. */
+    async updateRole(actor, uuid, patch) {
+        await this.ceiling.assertRoleAdministrable(actor, uuid);
+        const fields = {};
+        if (typeof patch?.name === 'string')
+            fields.name = patch.name;
+        await this.records.update('role', uuid, { fields });
     }
-    /** Delete a role. */
-    deleteRole(uuid) {
-        return this.records.delete('role', uuid);
+    /** Delete a role — only a role the actor may administer (binding rule). */
+    async deleteRole(actor, uuid) {
+        await this.ceiling.assertRoleAdministrable(actor, uuid);
+        await this.records.delete('role', uuid);
     }
 };
 exports.RoleService = RoleService;
 exports.RoleService = RoleService = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [engine_1.RecordsService])
+    __metadata("design:paramtypes", [engine_1.RecordsService,
+        grant_ceiling_js_1.GrantCeiling])
 ], RoleService);

package/dist/features/scope/scope-closure.service.d.ts

@@ -1,3 +1,4 @@
+import { type ScopeEdge } from '@astram/guard';
 /**
  * The minimal query surface a transaction connection must expose. A `mariadb`
  * `PoolConnection` satisfies it structurally; kept framework-agnostic (mirrors `Queryable`
@@ -14,11 +15,17 @@ export interface ScopePool {
         commit(): Promise<void>;
         rollback(): Promise<void>;
         release(): Promise<void>;
+        /** Drop the session instead of pooling it (used if a named lock could not be released). */
+        destroy?(): void;
     }>;
 }
 /** The version-bump surface moveNode needs — satisfied by `PermissionVersionBumper`. */
 export interface ScopeVersionBumper {
     bumpForTenant(tenantUuid: string, conn: ScopeConn): Promise<void>;
+    /** ADR-0035: publish this transaction's bumped versions to Redis — called after `commit()`. */
+    publishCommitted?(conn: ScopeConn): Promise<void>;
+    /** ADR-0035: drop this transaction's bumped versions — called after `rollback()`. */
+    discardPending?(conn: ScopeConn): void;
 }
 export declare class ScopeClosureService {
     private readonly pool;
@@ -27,13 +34,32 @@ export declare class ScopeClosureService {
     /**
      * Rebuild `scope_closure` from the current `companies.c_parent_uuid` edges. Idempotent
      * (delete-then-insert in a tx → a second run over the same tree writes the identical set).
-     * FAIL-LOUD: an orphaned/cyclic/too-deep edge makes `buildClosureRows` throw and that
-     * propagates (the tx rolls back — never a partial closure). Returns a small summary + logs.
+     * A CYCLIC component is quarantined (no rows for it; logged loudly) so the rest of the forest
+     * still reconciles. FAIL-LOUD for the rest: an orphaned/too-deep edge makes `buildClosureRows`
+     * throw and that propagates (the tx rolls back — never a partial closure). Returns a summary.
      */
     reconcileClosure(): Promise<{
         nodes: number;
         rows: number;
+        quarantined: number;
     }>;
+    /**
+     * A node was just CREATED (security hardening D5): rebuild the closure so it has rows at once
+     * (not at the next hourly reconcile), and bump every ANCESTOR's permission version — their
+     * reachable subtree just grew — so their sessions pick the new node up at the next refresh.
+     * One transaction; fail-loud like `moveNode` (a corrupt tree aborts the rebuild). A node inside
+     * a quarantined cycle gets no rows and bumps nothing.
+     */
+    attachNode(nodeUuid: string): Promise<void>;
+    /**
+     * Run `fn` in ONE transaction while holding the tree's named lock (security review F3). Every
+     * hierarchy writer (move, delete, attach, reconcile) takes the SAME `GET_LOCK` on its own
+     * connection BEFORE `BEGIN`, so they run one at a time and each transaction's first read sees
+     * every move committed before it. Without it, two concurrent moves each pass the cycle check
+     * against the other's pre-move tree and together form a cycle. A lock that cannot be taken in
+     * time fails closed (503, nothing written). The lock is released after commit/rollback.
+     */
+    private inTreeLock;
     /**
      * Re-parent `nodeUuid` under `newParentUuid` (or null for a root). Cycle-checked FIRST via the
      * closure: if `newParentUuid` is already a descendant of `nodeUuid`, throw `ScopeCycleError`
@@ -51,7 +77,9 @@ export declare class ScopeClosureService {
      * HIGH stale-subtree-after-move leak: a parent admin kept reaching a moved-away tenant.
      * Nodes on neither side keep their exact set and are not bumped.
      */
-    moveNode(nodeUuid: string, newParentUuid: string | null): Promise<void>;
+    moveNode(nodeUuid: string, newParentUuid: string | null, 
+    /** Runs on the move's transaction after the bump (e.g. the audit row) — a throw rolls back. */
+    inTransaction?: (conn: ScopeConn) => Promise<void>): Promise<void>;
     /**
      * Delete `nodeUuid`, FAIL-CLOSED. Refuses (throws) if the node has ANY child company — never
      * silently orphans/promotes a sub-org (the `...016` FK RESTRICT enforces this at the DB too; the
@@ -65,7 +93,9 @@ export declare class ScopeClosureService {
      * the many tenant-scoped app tables that reference the deleted node) is out of scope for v1 and
      * is tracked as a follow-up; deleteNode v1 only guarantees the HIERARCHY stays consistent.
      */
-    deleteNode(nodeUuid: string): Promise<void>;
+    deleteNode(nodeUuid: string, 
+    /** Runs on the delete's transaction after the bump (e.g. the audit row) — a throw rolls back. */
+    inTransaction?: (conn: ScopeConn) => Promise<void>): Promise<void>;
     /** Read the node forest's parent edges (`c_uuid` → `c_parent_uuid`) as `ScopeEdge[]`. */
     private readEdges;
     /**
@@ -75,6 +105,16 @@ export declare class ScopeClosureService {
      */
     private rewriteClosure;
 }
+/**
+ * Split the edge set into the CLEAN part and the nodes QUARANTINED because their parent chain
+ * reaches a cycle (the cycle's members and everything below them). PURE. Orphans and depth are
+ * left to `buildClosureRows` (still fail-loud): only a cycle is quarantined, because a cycle is
+ * the corruption a tenant admin could once create through the generic company patch (#2).
+ */
+export declare function quarantineCycles(edges: readonly ScopeEdge[]): {
+    clean: ScopeEdge[];
+    quarantined: string[];
+};
 /** deleteNode fail-closed guard: the node still has child companies (re-parent/cascade first). */
 export declare class NodeHasChildrenError extends Error {
     constructor(nodeUuid: string);

package/dist/features/scope/scope-closure.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-closure.service.d.ts","sourceRoot":"","sources":["../../../src/features/scope/scope-closure.service.ts"],"names":[],"mappings":"AAqCA;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,aAAa,IAAI,OAAO,CACtB,SAAS,GAAG;QACV,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KAC1B,CACF,CAAC;CACH;AAED,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,kBAAkB;IAG7C;;;;;OAKG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAoBlE;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IA2E7E;;;;;;;;;;;;OAYG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCjD,yFAAyF;YAC3E,SAAS;IAOvB;;;;OAIG;YACW,cAAc;CAiB7B;AAED,kGAAkG;AAClG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAQ7B"}
+{"version":3,"file":"scope-closure.service.d.ts","sourceRoot":"","sources":["../../../src/features/scope/scope-closure.service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAOlF;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,aAAa,IAAI,OAAO,CACtB,SAAS,GAAG;QACV,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,2FAA2F;QAC3F,OAAO,CAAC,IAAI,IAAI,CAAC;KAClB,CACF,CAAC;CACH;AAOD,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,+FAA+F;IAC/F,gBAAgB,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,qFAAqF;IACrF,cAAc,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,kBAAkB;IAG7C;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAsBvF;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjD;;;;;;;OAOG;YACW,UAAU;IAwCxB;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GAAG,IAAI;IAC5B,+FAA+F;IAC/F,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAiFhB;;;;;;;;;;;;OAYG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM;IAChB,iGAAiG;IACjG,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAoChB,yFAAyF;YAC3E,SAAS;IAOvB;;;;OAIG;YACW,cAAc;CAiB7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG;IAC7D,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CA8BA;AAED,kGAAkG;AAClG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAQ7B"}