@endora-commerce/mod-admin-roles 0.100.0

package/dist/backend/permission-inventory.js

@@ -0,0 +1,585 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join, relative, resolve } from 'node:path';
+/**
+ * Static inventory of the permission codes the backend actually enforces.
+ *
+ * It exists so `/admin-roles` can never advertise less than the server checks:
+ * a code enforced at a gate but absent from the assignable catalogue is a screen
+ * only a `'*'` role can open, and nothing else in the tree notices.
+ *
+ * The scanner therefore has to read the gate call in **every shape the tree
+ * writes it**, not the one shape it was first written against. It previously
+ * required an optional-call dot before the argument list, so a plain
+ * `requireAdmin('code')` — nearly the whole tree — was invisible to it, and it
+ * read clean while modules gated screens on codes no role could hold. The shapes are
+ * enumerated on `collectFromSource` and each is covered by a fixture in
+ * `test/unit/admin_roles/permission-inventory-scanner.test.ts`; an argument the
+ * scanner cannot resolve is reported as `unresolved` rather than dropped,
+ * because a silently dropped gate is exactly the failure this file guards.
+ */
+/**
+ * `packages/contracts/src` — permission maps shared across modules live here.
+ *
+ * Resolved through the package's own `package.json`, never by climbing out of
+ * this file's directory (D-100). The climb worked while this module lived at
+ * `backend/src/modules/admin_roles/` and answered a *different* directory the
+ * day it became a package — silently, because every path it produced still
+ * existed. `createRequire` asks the resolver the question the manifest already
+ * answers, and this module declares `@endora-commerce/contracts` as a peer.
+ */
+const CONTRACTS_SRC = (() => {
+    // Its entry point, then up to the directory that owns the manifest. Asking
+    // for `./package.json` directly is not available: that package's `exports`
+    // map answers a wildcard and resolves the request to `dist/package.json.js`.
+    let dir = dirname(createRequire(import.meta.url).resolve('@endora-commerce/contracts'));
+    for (;;) {
+        if (existsSync(join(dir, 'package.json')))
+            return join(dir, 'src');
+        const parent = dirname(dir);
+        if (parent === dir)
+            return '';
+        dir = parent;
+    }
+})();
+/**
+ * The roots a bare-core build enforces gates in, plus the active deployment's
+ * overlay modules (feature 057 — an overlay module is an ordinary lifecycle
+ * participant, so its gates count for that deployment and for no other).
+ *
+ * `src/apps` is skipped during the walk rather than excluded by name: a
+ * deployment that is not the selected one is not part of this build, and its
+ * permissions are not assignable here.
+ *
+ * **A module that is a workspace package is not here, and is the caller's to
+ * supply.** This scanner has no runtime caller — its two callers are
+ * `test/contract/admin_users/permission-inventory.test.ts` and the scanner's own
+ * unit test — and the module layout is derived by `scripts/lib/module-roots.ts`,
+ * which a module may not import (`check:module-boundary`, and it is right to
+ * refuse: this file belongs to `admin_roles`). So the root list is an input, and
+ * the caller that already resolves the layout passes it. Leaving a packaged
+ * module out silently reports its codes as *"grantable but enforced by no
+ * gate"* — a checkbox `/admin-roles` says grants nothing while the gate is
+ * there — which is what the contract test caught the day `blog` moved.
+ *
+ * **The overlay root is an input for the same reason** (feature 080, T051). It
+ * used to be computed here, from `overlay/overlay-roots.js` — a file
+ * `contracts/host-package.md` §1.4l classifies **A**, because `overlay/*` is
+ * how the platform *discovers* overlays and a module reading it as an installed
+ * package would be an artefact enumerating its own siblings (O3's cycle). The
+ * answer is the same one this paragraph already gives for a packaged module:
+ * the caller resolves the layout, and there is no runtime caller to inconvenience.
+ * `null` means a bare-core build, which is what a deployment-less environment
+ * has always produced.
+ */
+export function defaultScanRoots(applicationSourceRoot, overlayModulesRoot) {
+    return overlayModulesRoot === null
+        ? [applicationSourceRoot]
+        : [applicationSourceRoot, overlayModulesRoot];
+}
+/**
+ * Distinct permission codes referenced by an enforcement site under the scan
+ * roots. Kept for callers that only need the set (SC-001).
+ */
+export function scanEnforcedPermissionCodes(roots) {
+    return scanEnforcedPermissionGates(roots).codes;
+}
+/**
+ * Every enforcement site under `roots`, classified.
+ *
+ * `roots` is required. It used to default to `defaultScanRoots()`, which
+ * resolved the active deployment for itself; that resolution is the caller's
+ * now (see {@link defaultScanRoots}), and a default of "bare core" would be a
+ * scan that silently covered less than it was asked for.
+ *
+ * Each site's `file` is reported relative to the **first bare-string root**,
+ * which is the application's own source root by construction of
+ * {@link defaultScanRoots} — a module package is passed as an object carrying
+ * its `moduleId`. It used to be relative to a `backend/src` this file computed
+ * by climbing out of its own directory, which answered a different directory
+ * the day `admin_roles` became a package (feature 080, T040b).
+ */
+export function scanEnforcedPermissionGates(roots) {
+    const sites = [];
+    const seen = new Set();
+    const resolver = new ConstantResolver();
+    const base = roots.find((entry) => typeof entry === 'string') ?? '';
+    for (const entry of roots) {
+        const root = typeof entry === 'string' ? { dir: entry } : entry;
+        for (const file of walkSources(root.dir, seen)) {
+            collectFromFile(file, root, base, resolver, sites);
+        }
+    }
+    const codes = new Set();
+    for (const site of sites)
+        for (const code of site.codes)
+            codes.add(code);
+    return {
+        codes,
+        sites,
+        unresolved: sites.filter((s) => s.resolution === 'unresolved'),
+        runtimeValue: sites.filter((s) => s.resolution === 'runtime-value'),
+        authenticatedAdminOnly: sites.filter((s) => s.resolution === 'authenticated-admin'),
+    };
+}
+function* walkSources(dir, seen) {
+    if (!existsSync(dir))
+        return;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const path = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            // `apps` is reached through `defaultScanRoots`, and only for the selected
+            // deployment; `node_modules` is never ours. `dist` is a module package's
+            // build output — the same gates a second time, compiled, which would
+            // double every site and attribute half of them to a path nobody edits.
+            if (entry.name === 'node_modules' || entry.name === 'apps' || entry.name === 'dist') {
+                continue;
+            }
+            yield* walkSources(path, seen);
+            continue;
+        }
+        if (!entry.isFile() || !/\.(ts|js)$/.test(entry.name))
+            continue;
+        // **A test is not an enforcement site, and this exclusion had no subject
+        // until feature 106.** Every test used to live under `backend/test`, which
+        // no scan root reaches, so the walk could not meet one; 106 moved the
+        // co-located tests *into* `packages/modules/<id>/src/`, and this scanner's
+        // own unit test — whose fixtures are deliberately fake codes and
+        // deliberately unreadable gate arguments — moved with them. Its fixtures
+        // were then read as real gates: 18 codes reported *"enforced but not
+        // grantable"* and 2 as unresolvable, red on `master`. A gate written in a
+        // test guards nothing an operator can reach, so the population is source
+        // and never a test, whichever directory the test now sits in. The predicate
+        // is the suffix and not the substring: a module legitimately named for test
+        // infrastructure keeps its gates.
+        if (/\.(test|spec)\.(ts|js)$/.test(entry.name))
+            continue;
+        if (seen.has(path))
+            continue;
+        seen.add(path);
+        yield path;
+    }
+}
+/** The module directory owning `file`, for attribution in failure messages. */
+function moduleIdFor(file, root) {
+    // A root that names its module **is** that module's directory, whatever it
+    // keeps inside it.
+    if (root.moduleId !== undefined)
+        return root.moduleId;
+    const rel = relative(root.dir, file);
+    const segments = rel.split(/[\\/]/);
+    if (segments[0] === 'modules')
+        return segments[1] ?? null;
+    // An overlay root IS the modules root, so the first segment is the module id.
+    return segments.length > 1 ? (segments[0] ?? null) : null;
+}
+function collectFromFile(file, root, base, resolver, out) {
+    const source = resolver.sourceOf(file);
+    if (source === null)
+        return;
+    if (!/requireAdmin|hasPermission/.test(source))
+        return;
+    const moduleId = moduleIdFor(file, root);
+    const relFile = relative(base, file);
+    for (const site of collectFromSource(source, file, resolver)) {
+        out.push({ ...site, file: relFile, moduleId });
+    }
+}
+/**
+ * The enforcement shapes this recognises, all of them present in the tree:
+ *
+ * - `requireAdmin('code')`, and the same call reached through a dependency bag
+ *   or a container cradle (`deps.requireAdmin(…)`, `cradle().requireAdmin(…)`);
+ * - the optional-call form `requireAdmin?.('code')`;
+ * - `requireAdminAny(['a', 'b'])` in either of the above positions;
+ * - a constant argument, resolved module-locally, through a relative import, or
+ *   through `@endora-commerce/contracts`, including a member read of a permission map;
+ * - `permissionService.hasPermission(actor, 'code')` — the capability check a
+ *   service uses where there is no route to hang a `preHandler` on.
+ *
+ * Comments and regular-expression literals are blanked first: a doc comment
+ * quoting a gate is not a gate, several files quote one, and this file's own
+ * matcher would otherwise read itself as a call site.
+ */
+function* collectFromSource(source, file, resolver) {
+    const bound = collectRuntimeBindings(source);
+    const callRe = /(?:[\w$]+\s*\??\.\s*)*(requireAdmin(?:Any)?|hasPermission)\s*(?:\?\.)?\s*\(/g;
+    let m;
+    while ((m = callRe.exec(source)) !== null) {
+        const callee = m[1] ?? '';
+        const open = source.indexOf('(', m.index + m[0].length - 1);
+        if (open === -1)
+            continue;
+        const args = readBalanced(source, open);
+        // A parameter list, not an argument list: the guard's own signature in an
+        // interface or an implementation. Nothing is enforced by a declaration.
+        if (PARAMETER_LIST_RE.test(args))
+            continue;
+        // `hasPermission(actor, 'code')` puts the code second; the guards put it first.
+        const argument = (callee === 'hasPermission' ? lastArgument(args) : firstArgument(args)).trim();
+        const expression = argument.replace(/\s+/g, ' ');
+        if (argument === '') {
+            if (callee === 'hasPermission')
+                continue;
+            yield { expression: '', resolution: 'authenticated-admin', codes: [] };
+            continue;
+        }
+        // `permission ?? ''` is the same runtime value with a default.
+        const normalised = argument.replace(/\s*\?\?\s*(['"]).*?\1\s*$/, '').trim();
+        if (/^['"[]/.test(normalised)) {
+            const codes = [...normalised.matchAll(/(['"])([^'"]*)\1/g)]
+                .map((lit) => lit[2] ?? '')
+                .filter((code) => code.length > 0);
+            yield codes.length > 0
+                ? { expression, resolution: 'code', codes }
+                : { expression, resolution: 'unresolved', codes: [] };
+            continue;
+        }
+        // Resolve before classifying: a constant that happens to share a name with
+        // a parameter somewhere in the file is still a constant.
+        const identifier = /^[A-Za-z_$][\w$]*$/.test(normalised) ? normalised : null;
+        const member = /^([A-Za-z_$][\w$]*)\.([A-Za-z_$][\w$]*)$/.exec(normalised);
+        const value = identifier
+            ? resolver.lookup(file, identifier, null)
+            : member?.[1] && member[2]
+                ? resolver.lookup(file, member[1], member[2])
+                : null;
+        if (value !== null) {
+            yield { expression, resolution: 'code', codes: [value] };
+            continue;
+        }
+        const rootName = identifier ?? member?.[1] ?? null;
+        yield rootName !== null && bound.has(rootName)
+            ? { expression, resolution: 'runtime-value', codes: [] }
+            : { expression, resolution: 'unresolved', codes: [] };
+    }
+}
+/** A leading `name:` or `name?:` marks a parameter list rather than arguments. */
+const PARAMETER_LIST_RE = /^\s*(?:readonly\s+)?[A-Za-z_$][\w$]*\s*\??\s*:/;
+/**
+ * Identifiers the file binds to a value only known at runtime: function and
+ * arrow parameters, `for (const x of …)` loop variables, and a `const` whose
+ * initialiser is not a string literal (a registry lookup, say). An argument
+ * rooted in one of these carries no literal to check; the literal — if there is
+ * one — is written at the caller or the contributor, a site this scan reads
+ * separately. Resolution is attempted first, so a genuine constant that shares
+ * a name with a binding is still read as a constant.
+ */
+function collectRuntimeBindings(source) {
+    const bound = new Set();
+    let m;
+    const computedBindingRe = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::\s*[^=;]+)?=\s*(?!['"])/g;
+    while ((m = computedBindingRe.exec(source)) !== null) {
+        if (m[1])
+            bound.add(m[1]);
+    }
+    const typedParamRe = /[(,]\s*(?:readonly\s+)?([A-Za-z_$][\w$]*)\s*\??\s*:/g;
+    while ((m = typedParamRe.exec(source)) !== null) {
+        if (m[1])
+            bound.add(m[1]);
+    }
+    const arrowHeadRe = /\(([^()]*)\)\s*=>/g;
+    while ((m = arrowHeadRe.exec(source)) !== null) {
+        for (const part of (m[1] ?? '').split(',')) {
+            const name = /^\s*([A-Za-z_$][\w$]*)\s*$/.exec(part);
+            if (name?.[1])
+                bound.add(name[1]);
+        }
+    }
+    const loopBindingRe = /for\s*\(\s*(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s+(?:of|in)\b/g;
+    while ((m = loopBindingRe.exec(source)) !== null) {
+        if (m[1])
+            bound.add(m[1]);
+    }
+    return bound;
+}
+/** Text between `openIndex`'s bracket and its match, quotes respected. */
+function readBalanced(source, openIndex) {
+    let depth = 0;
+    let i = openIndex;
+    for (; i < source.length; i += 1) {
+        const c = source[i];
+        if (c === '(' || c === '[' || c === '{')
+            depth += 1;
+        else if (c === ')' || c === ']' || c === '}') {
+            depth -= 1;
+            if (depth === 0)
+                break;
+        }
+        else if (c === "'" || c === '"' || c === '`') {
+            i = skipString(source, i);
+        }
+    }
+    return source.slice(openIndex + 1, i);
+}
+/** Split on top-level commas only — an array or object argument keeps its own. */
+function splitArguments(args) {
+    const parts = [];
+    let depth = 0;
+    let start = 0;
+    for (let i = 0; i < args.length; i += 1) {
+        const c = args[i];
+        if (c === '(' || c === '[' || c === '{')
+            depth += 1;
+        else if (c === ')' || c === ']' || c === '}')
+            depth -= 1;
+        else if (c === "'" || c === '"' || c === '`')
+            i = skipString(args, i);
+        else if (c === ',' && depth === 0) {
+            parts.push(args.slice(start, i));
+            start = i + 1;
+        }
+    }
+    parts.push(args.slice(start));
+    return parts;
+}
+function firstArgument(args) {
+    return splitArguments(args)[0] ?? '';
+}
+function lastArgument(args) {
+    const parts = splitArguments(args);
+    return parts[parts.length - 1] ?? '';
+}
+/** Index of the closing quote of the string starting at `i`. */
+function skipString(source, i) {
+    const quote = source[i];
+    let j = i + 1;
+    while (j < source.length) {
+        if (source[j] === '\\') {
+            j += 2;
+            continue;
+        }
+        if (source[j] === quote)
+            return j;
+        j += 1;
+    }
+    return j;
+}
+/**
+ * Resolves a constant argument to its literal, following at most a few hops:
+ * module-local, a relative import, or `@endora-commerce/contracts`. Deeper indirection has
+ * never appeared, and pretending to resolve it would hide the same gate the
+ * `unresolved` bucket is there to surface.
+ *
+ * Exported for `scripts/check-action-route-permissions.ts` (issue #232), which
+ * asks the third direction — is an action's `requiredPermission` the code
+ * enforced on **its own** target route — and needs the same argument shapes read
+ * the same way. A second resolver would answer the same question differently the
+ * first time either of them learned a shape.
+ */
+export class ConstantResolver {
+    #facts = new Map();
+    #contractsFiles = null;
+    sourceOf(file) {
+        return this.#factsFor(file)?.source ?? null;
+    }
+    lookup(file, name, property, depth = 0) {
+        if (depth > 4)
+            return null;
+        const facts = this.#factsFor(file);
+        if (!facts)
+            return null;
+        if (property === null) {
+            const scalar = facts.scalars.get(name);
+            if (scalar !== undefined)
+                return scalar;
+        }
+        else {
+            const value = facts.objects.get(name)?.get(property);
+            if (value !== undefined)
+                return value;
+        }
+        const imported = facts.imports.get(name);
+        if (!imported)
+            return null;
+        for (const target of this.#resolveSpecifier(file, imported.specifier)) {
+            const value = this.lookup(target, imported.exportedAs, property, depth + 1);
+            if (value !== null)
+                return value;
+        }
+        return null;
+    }
+    #factsFor(file) {
+        if (this.#facts.has(file))
+            return this.#facts.get(file) ?? null;
+        let raw;
+        try {
+            raw = readFileSync(file, 'utf8');
+        }
+        catch {
+            this.#facts.set(file, null);
+            return null;
+        }
+        const source = blankComments(raw);
+        const facts = {
+            source,
+            scalars: collectScalars(source),
+            objects: collectObjects(source),
+            imports: collectImports(source),
+        };
+        this.#facts.set(file, facts);
+        return facts;
+    }
+    /** Candidate files a specifier may resolve to, in preference order. */
+    #resolveSpecifier(from, specifier) {
+        if (specifier === '@endora-commerce/contracts')
+            return this.#contractsSources();
+        if (!specifier.startsWith('.'))
+            return [];
+        const base = resolve(dirname(from), specifier);
+        const candidates = [base.replace(/\.js$/, '.ts'), `${base}.ts`, join(base, 'index.ts'), base];
+        return candidates.filter((c) => existsSync(c) && statSync(c).isFile());
+    }
+    /**
+     * `@endora-commerce/contracts` re-exports everything from its barrel, so following the
+     * barrel would mean parsing every `export *`. Scanning the package's own
+     * sources for the constant reaches the same answer in one hop.
+     */
+    #contractsSources() {
+        if (this.#contractsFiles !== null)
+            return this.#contractsFiles;
+        const files = [];
+        if (existsSync(CONTRACTS_SRC)) {
+            for (const entry of readdirSync(CONTRACTS_SRC, { withFileTypes: true })) {
+                if (entry.isFile() && entry.name.endsWith('.ts'))
+                    files.push(join(CONTRACTS_SRC, entry.name));
+            }
+        }
+        this.#contractsFiles = files;
+        return files;
+    }
+}
+/**
+ * Replace comment and regular-expression bodies with spaces, preserving offsets
+ * and string literals.
+ *
+ * A regex literal is a `/` in a position where an expression may start (after an
+ * operator, a bracket or a keyword), which is what distinguishes it from
+ * division — division follows a value. Blanking them keeps a matcher written as
+ * a pattern, this file's included, from reading as the thing it matches.
+ */
+function blankComments(source) {
+    let out = '';
+    let i = 0;
+    while (i < source.length) {
+        const c = source[i];
+        const next = source[i + 1];
+        if (c === '/' && next !== '/' && next !== '*' && startsExpression(out)) {
+            const end = skipRegex(source, i);
+            out += '/';
+            for (let k = i + 1; k < end; k += 1)
+                out += source[k] === '\n' ? '\n' : ' ';
+            out += end < source.length ? '/' : '';
+            i = end + 1;
+            continue;
+        }
+        if (c === '/' && next === '/') {
+            while (i < source.length && source[i] !== '\n') {
+                out += ' ';
+                i += 1;
+            }
+            continue;
+        }
+        if (c === '/' && next === '*') {
+            while (i < source.length && !(source[i] === '*' && source[i + 1] === '/')) {
+                out += source[i] === '\n' ? '\n' : ' ';
+                i += 1;
+            }
+            out += '  ';
+            i += 2;
+            continue;
+        }
+        if (c === "'" || c === '"' || c === '`') {
+            const end = skipString(source, i);
+            out += source.slice(i, end + 1);
+            i = end + 1;
+            continue;
+        }
+        out += c;
+        i += 1;
+    }
+    return out;
+}
+/** True when the last significant character allows an expression to start. */
+function startsExpression(emitted) {
+    const trimmed = emitted.replace(/\s+$/, '');
+    if (trimmed.length === 0)
+        return true;
+    const last = trimmed[trimmed.length - 1] ?? '';
+    if ('([{,;:=!&|?+-*%~^<>'.includes(last))
+        return true;
+    return /\b(?:return|typeof|case|in|of|new|delete|void|do|else)$/.test(trimmed);
+}
+/** Index of the closing `/` of the regex literal starting at `i`. */
+function skipRegex(source, i) {
+    let j = i + 1;
+    let inClass = false;
+    while (j < source.length) {
+        const c = source[j];
+        if (c === '\\') {
+            j += 2;
+            continue;
+        }
+        if (c === '\n')
+            return j - 1;
+        if (c === '[')
+            inClass = true;
+        else if (c === ']')
+            inClass = false;
+        else if (c === '/' && !inClass)
+            return j;
+        j += 1;
+    }
+    return j;
+}
+function collectScalars(source) {
+    const scalars = new Map();
+    const re = /(?:export\s+)?(?:const|let)\s+([A-Za-z_$][\w$]*)\s*(?::\s*[^=;]+)?=\s*(['"])([^'"]*)\2/g;
+    let m;
+    while ((m = re.exec(source)) !== null) {
+        if (m[1] && m[3] !== undefined)
+            scalars.set(m[1], m[3]);
+    }
+    return scalars;
+}
+/** Flat `{ KEY: 'code' }` permission maps; nothing in the tree nests one. */
+function collectObjects(source) {
+    const objects = new Map();
+    const re = /(?:export\s+)?const\s+([A-Za-z_$][\w$]*)\s*(?::\s*[^={;]+)?=\s*\{([^{}]*)\}/g;
+    let m;
+    while ((m = re.exec(source)) !== null) {
+        const name = m[1];
+        const body = m[2];
+        if (!name || body === undefined)
+            continue;
+        const entries = new Map();
+        const propRe = /([A-Za-z_$][\w$]*)\s*:\s*(['"])([^'"]*)\2/g;
+        let p;
+        while ((p = propRe.exec(body)) !== null) {
+            if (p[1] && p[3] !== undefined)
+                entries.set(p[1], p[3]);
+        }
+        if (entries.size > 0)
+            objects.set(name, entries);
+    }
+    return objects;
+}
+function collectImports(source) {
+    const imports = new Map();
+    const re = /import\s*(?:type\s+)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g;
+    let m;
+    while ((m = re.exec(source)) !== null) {
+        const clause = m[1];
+        const specifier = m[2];
+        if (!clause || !specifier)
+            continue;
+        for (const part of clause.split(',')) {
+            const named = /^(?:type\s+)?([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?$/.exec(part.trim());
+            if (!named?.[1])
+                continue;
+            imports.set(named[2] ?? named[1], { exportedAs: named[1], specifier });
+        }
+    }
+    return imports;
+}
+//# sourceMappingURL=permission-inventory.js.map

package/dist/backend/permission-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-inventory.js","sourceRoot":"","sources":["../../src/backend/permission-inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7D;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE;IAClC,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACxF,SAAS,CAAC;QACR,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;QAC9B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAqDL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,gBAAgB,CAC9B,qBAA6B,EAC7B,kBAAiC;IAEjC,OAAO,kBAAkB,KAAK,IAAI;QAChC,CAAC,CAAC,CAAC,qBAAqB,CAAC;QACzB,CAAC,CAAC,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAA+C;IAE/C,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAA+C;IAE/C,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrF,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAChE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/C,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzE,OAAO;QACL,KAAK;QACL,KAAK;QACL,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,YAAY,CAAC;QAC9D,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC;QACnE,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,qBAAqB,CAAC;KACpF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,CAAC,WAAW,CAAC,GAAW,EAAE,IAAiB;IAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,0EAA0E;YAC1E,yEAAyE;YACzE,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpF,SAAS;YACX,CAAC;YACD,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAChE,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,iEAAiE;QACjE,yEAAyE;QACzE,qEAAqE;QACrE,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACzD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,IAAI,CAAC;IACb,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,IAAY,EAAE,IAAwB;IACzD,2EAA2E;IAC3E,mBAAmB;IACnB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC1D,8EAA8E;IAC9E,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,IAAwB,EACxB,IAAY,EACZ,QAA0B,EAC1B,GAAuB;IAEvB,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO;IAC5B,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO;IACvD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAID;;;;;;;;;;;;;;;GAeG;AACH,QAAQ,CAAC,CAAC,iBAAiB,CACzB,MAAc,EACd,IAAY,EACZ,QAA0B;IAE1B,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,8EAA8E,CAAC;IAC9F,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,IAAI,KAAK,CAAC,CAAC;YAAE,SAAS;QAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3C,gFAAgF;QAChF,MAAM,QAAQ,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChG,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAEjD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,IAAI,MAAM,KAAK,eAAe;gBAAE,SAAS;YACzC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACvE,SAAS;QACX,CAAC;QAED,+DAA+D;QAC/D,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE5E,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;iBACxD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC;gBACpB,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE;gBAC3C,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACxD,SAAS;QACX,CAAC;QAED,2EAA2E;QAC3E,yDAAyD;QACzD,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,MAAM,MAAM,GAAG,0CAA0C,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,UAAU;YACtB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC;YACzC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;gBACxB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC7C,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QACnD,MAAM,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC5C,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,EAAE;YACxD,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,gDAAgD,CAAC;AAE3E;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,MAAc;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,CAAyB,CAAC;IAE9B,MAAM,iBAAiB,GAAG,uEAAuE,CAAC;IAClG,OAAO,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,YAAY,GAAG,sDAAsD,CAAC;IAC5E,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,WAAW,GAAG,oBAAoB,CAAC;IACzC,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,kEAAkE,CAAC;IACzF,OAAO,CAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,MAAc,EAAE,SAAiB;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC,GAAG,SAAS,CAAC;IAClB,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7C,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;QACzB,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/C,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aACpD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;aACjE,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACjC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,gEAAgE;AAChE,SAAS,UAAU,CAAC,MAAc,EAAE,CAAS;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACvB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK;YAAE,OAAO,CAAC,CAAC;QAClC,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AASD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAClB,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,eAAe,GAAoB,IAAI,CAAC;IAExC,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,IAAY,EAAE,QAAuB,EAAE,KAAK,GAAG,CAAC;QACnE,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;QACxC,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5E,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAChE,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAc;YACvB,MAAM;YACN,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;YAC/B,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;YAC/B,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;SAChC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uEAAuE;IACvE,iBAAiB,CAAC,IAAY,EAAE,SAAiB;QAC/C,IAAI,SAAS,KAAK,4BAA4B;YAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9F,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,iBAAiB;QACf,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QAC/D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACxE,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACjC,GAAG,IAAI,GAAG,CAAC;YACX,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;gBAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5E,GAAG,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/C,GAAG,IAAI,GAAG,CAAC;gBACX,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC1E,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBACvC,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAClC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;YAChC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,yDAAyD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACjF,CAAC;AAED,qEAAqE;AACrE,SAAS,SAAS,CAAC,MAAc,EAAE,CAAS;IAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,GAAG,IAAI,CAAC;aACzB,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,GAAG,KAAK,CAAC;aAC/B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC;QACzC,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,EAAE,GAAG,yFAAyF,CAAC;IACrG,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;IACvD,MAAM,EAAE,GAAG,8EAA8E,CAAC;IAC1F,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC1C,MAAM,MAAM,GAAG,4CAA4C,CAAC;QAC5D,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqD,CAAC;IAC7E,MAAM,EAAE,GAAG,6DAA6D,CAAC;IACzE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,SAAS;QACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,iEAAiE,CAAC,IAAI,CAClF,IAAI,CAAC,IAAI,EAAE,CACZ,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/backend/services/admin-role-ports.d.ts

@@ -0,0 +1,39 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { AdminRolePort, AdminRoleRecord, SystemRoleCodePort } from '@endora-commerce/contracts';
+import { AdminRole } from '../entities/admin-role.entity.js';
+import { type AdminRoleService } from './admin-role-service.js';
+/**
+ * The published face of `admin_roles` (feature 075, Phase P).
+ *
+ * Fourteen inbound sites: `admin_users` reads a role beside its user and
+ * enforces `requiresTwoFactor` at login, `admin_actions` filters the command
+ * palette by a user's permissions, `blog` protects the role it seeds, and the
+ * dev seed creates one.
+ *
+ * `findByCode` is the method with no direct predecessor. `admin_users`'
+ * service and the dev seed both look a role up by code with
+ * `em.findOne(AdminRole, { code })`, which is the read it replaces.
+ */
+export declare class AdminRoleReadService {
+    private readonly emFactory;
+    constructor(emFactory: () => EntityManager);
+    findByCode(code: string): Promise<AdminRoleRecord | null>;
+}
+/**
+ * The full role port, adapting `AdminRoleService` and adding the by-code
+ * lookup. The service arrives as a getter so the adapter resolves it per call
+ * rather than capturing it.
+ */
+export declare function createAdminRolePort(emFactory: () => EntityManager, getService: () => AdminRoleService): AdminRolePort;
+/**
+ * The contribution seam for deletion-protected role codes.
+ *
+ * Deliberately a plain object over the module-level set rather than anything
+ * gated: `blog` registers its seeded code from a boot hook, and a gate would
+ * both throw during composition and — worse — let an operator delete a
+ * protected role by switching its owner off for a moment. See the port's
+ * contract for the full reasoning.
+ */
+export declare function createSystemRoleCodePort(): SystemRoleCodePort;
+export declare function toAdminRoleRecord(role: AdminRole): AdminRoleRecord;
+//# sourceMappingURL=admin-role-ports.d.ts.map

package/dist/backend/services/admin-role-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-role-ports.d.ts","sourceRoot":"","sources":["../../../src/backend/services/admin-role-ports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,aAAa;IAErD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAIhE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,aAAa,EAC9B,UAAU,EAAE,MAAM,gBAAgB,GACjC,aAAa,CAef;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,IAAI,kBAAkB,CAK7D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,GAAG,eAAe,CAUlE"}