@inf-monkeys-tech/monkeys-cli 0.12.13 → 0.12.14

package/dist/identity-governance/group-mutation.js

@@ -0,0 +1,160 @@
+import { z } from 'zod';
+import { CliError, EXIT_CODES } from '../errors/cli-error.js';
+import { assertConfirmation } from '../policy/risk.js';
+import { requireComplete } from './client.js';
+import { fail, groupCreateSchema, groupSchema, groupUpdateSchema, idSchema, parse, permissionSetSchema, requireCustomGroup, } from './contracts.js';
+import { digest, writeArtifact } from './files.js';
+import { identityMeta } from './runtime.js';
+export async function executeGroupMutation(input) {
+    const { client, action } = input;
+    if (input.dryRun && input.yes)
+        fail('IDENTITY_FLAG_CONFLICT', '--dry-run and --yes are mutually exclusive.');
+    if (!input.dryRun)
+        assertConfirmation({ interactive: false, risk: 'privileged', yes: input.yes });
+    const id = action === 'create' ? undefined : parse(idSchema, input.id);
+    if (action === 'create' && input.id !== undefined)
+        fail('IDENTITY_INPUT_INVALID', 'Create does not accept a target group ID.');
+    const body = action === 'create'
+        ? parse(groupCreateSchema, input.body)
+        : action === 'update'
+            ? parse(groupUpdateSchema, input.body)
+            : action === 'setPermissions'
+                ? parse(permissionSetSchema, input.body)
+                : undefined;
+    if (action === 'delete' && input.body !== undefined)
+        fail('IDENTITY_INPUT_INVALID', 'Delete does not accept a request body.');
+    client.validateRequest(action, id, body);
+    const before = id ? await client.group(id) : undefined;
+    if (before)
+        requireCustomGroup(before);
+    const { pageToken: _pageToken, ...pageBounds } = input.pagination;
+    const completePages = { ...pageBounds, pageAll: true };
+    const metadata = body && 'code' in body ? body : undefined;
+    if (metadata?.code !== undefined) {
+        if (['member', 'platform_admin', 'super_admin'].includes(metadata.code))
+            fail('IDENTITY_GROUP_PROTECTED', 'This group code is reserved.', EXIT_CODES.authorization);
+        const groups = requireComplete(await client.groups(completePages));
+        if (groups.some((group) => group.id !== id && group.code.toLowerCase() === metadata.code))
+            fail('IDENTITY_GROUP_CODE_EXISTS', 'An active group already uses this code.');
+    }
+    if (action === 'delete') {
+        const members = await client.members(id, { pageAll: false, pageSize: 1, pageLimit: 1, pageDelay: 0 });
+        if (members.items.length || members.pageInfo.hasMore)
+            fail('IDENTITY_GROUP_IN_USE', 'Remove direct members explicitly before deleting a custom group.');
+    }
+    if (action === 'setPermissions') {
+        const desired = body.permissionIds;
+        if (new Set(desired).size !== desired.length)
+            fail('IDENTITY_DUPLICATE_TARGET', 'Repeated permission IDs are not allowed.');
+        const known = new Set(requireComplete(await client.permissions(completePages)).map((permission) => permission.id));
+        if (desired.some((permissionId) => !known.has(permissionId)))
+            fail('IDENTITY_PERMISSION_NOT_FOUND', 'Every permission ID must exist in the complete permission catalog.');
+        const own = await client.userGroups(client.runtime.principalId);
+        if ([...own.direct, ...own.mapped].some((group) => group.id === id) &&
+            ![...own.direct, ...own.mapped].some((group) => group.code === 'super_admin' && group.protected))
+            fail('IDENTITY_SELF_LOCKOUT_RISK', 'Changing your own permission group requires proven independent super-administrator authority.', EXIT_CODES.authorization);
+    }
+    const warnings = action === 'setPermissions'
+        ? [
+            'This replaces the complete permission set. An explicit [] clears it.',
+            'The server uses last-writer-wins; client preflight is not atomic compare-and-swap.',
+        ]
+        : action === 'delete'
+            ? ['Deletion has no restore endpoint. Recreating a group will not preserve its original ID.']
+            : [];
+    const preview = { ...identityMeta(client.runtime), action, groupId: id, before, after: body, warnings };
+    if (input.dryRun)
+        return { ...preview, dryRun: true, writeRequestSent: false, serverValidated: false };
+    if (before && digest(await client.group(id)) !== digest(before))
+        fail('IDENTITY_PLAN_STALE', 'The group changed during preflight. Nothing was written; repeat the preview.');
+    const snapshot = await writeArtifact(preview, input.snapshot, 'group-before');
+    let resultId = id;
+    let requestId;
+    try {
+        if (action === 'delete') {
+            const result = await client.call('delete', z.undefined(), { id: id });
+            requestId = result.requestId;
+            try {
+                await client.group(id);
+            }
+            catch (cause) {
+                if (cause instanceof CliError && cause.code === 'HTTP_404')
+                    return saveResult({ ...preview, dryRun: false, writeRequestSent: true, snapshot, requestId, verification: { absent: true } });
+                throw cause;
+            }
+            fail('IDENTITY_READBACK_MISMATCH', 'The group still exists after deletion.', EXIT_CODES.partial);
+        }
+        const result = await client.call(action, groupSchema, { ...(id === undefined ? {} : { id }), body });
+        requestId = result.requestId;
+        resultId = result.data.id;
+        if (id && resultId !== id)
+            fail('IDENTITY_READBACK_MISMATCH', 'The write returned a different group ID.', EXIT_CODES.partial);
+        const after = await client.group(resultId);
+        verifyGroupMutation(action, body, after);
+        return saveResult({
+            ...preview,
+            dryRun: false,
+            writeRequestSent: true,
+            snapshot,
+            requestId,
+            groupId: resultId,
+            after,
+            verification: { matches: true },
+        });
+    }
+    catch (cause) {
+        const evidence = {
+            groupId: resultId,
+            snapshot,
+            requestId,
+            originalCode: cause instanceof CliError ? cause.code : 'INTERNAL_ERROR',
+            requestState: 'sent',
+            recovery: 'Reconcile the exact target before any retry or separately authorized restoration.',
+        };
+        let failureReport;
+        try {
+            failureReport = await writeArtifact(evidence, undefined, 'group-stopped');
+        }
+        catch (reportError) {
+            throw new CliError('The group operation stopped and its final report could not be saved. Inspect the snapshot; do not replay.', {
+                cause: reportError,
+                code: 'IDENTITY_REPORT_WRITE_FAILED',
+                exitCode: EXIT_CODES.partial,
+                safeDetails: evidence,
+            });
+        }
+        throw new CliError('Group mutation did not complete verified execution. Inspect the exact target and snapshot before retrying; no write was replayed.', { cause, code: 'IDENTITY_GROUP_MUTATION_INCOMPLETE', exitCode: EXIT_CODES.partial, safeDetails: { ...evidence, failureReport } });
+    }
+}
+async function saveResult(result) {
+    try {
+        return { ...result, finalReport: await writeArtifact(result, undefined, 'group-complete') };
+    }
+    catch (cause) {
+        throw new CliError('The group write was verified but its final report could not be saved. Do not replay the write.', {
+            cause,
+            code: 'IDENTITY_REPORT_WRITE_FAILED',
+            exitCode: EXIT_CODES.partial,
+            safeDetails: result,
+        });
+    }
+}
+function verifyGroupMutation(action, body, after) {
+    const values = body;
+    if (action === 'setPermissions') {
+        if (digest([...values.permissionIds].sort()) !== digest(after.permissions.map((permission) => permission.id).sort()))
+            fail('IDENTITY_READBACK_MISMATCH', 'Group permission readback differs from the requested complete set.', EXIT_CODES.partial);
+    }
+    else {
+        for (const [key, expected] of Object.entries(values)) {
+            const actual = after[key];
+            if ((key === 'description' ? (actual ?? '') : actual) !== expected)
+                fail('IDENTITY_READBACK_MISMATCH', 'Group metadata readback differs from the requested fields.', EXIT_CODES.partial, {
+                    field: key,
+                });
+        }
+        if (action === 'create' && (after.isSystem || after.permissions.length))
+            fail('IDENTITY_READBACK_MISMATCH', 'A newly created custom group unexpectedly has system status or permissions.', EXIT_CODES.partial);
+    }
+}
+//# sourceMappingURL=group-mutation.js.map

package/dist/identity-governance/group-mutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-mutation.js","sourceRoot":"","sources":["../../src/identity-governance/group-mutation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAkB,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,IAAI,EACJ,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAa5C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAyB;IAClE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG;QAAE,IAAI,CAAC,wBAAwB,EAAE,6CAA6C,CAAC,CAAC;IAC7G,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,kBAAkB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAClG,MAAM,EAAE,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;QAAE,IAAI,CAAC,wBAAwB,EAAE,2CAA2C,CAAC,CAAC;IAC/H,MAAM,IAAI,GACR,MAAM,KAAK,QAAQ;QACjB,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC;QACtC,CAAC,CAAC,MAAM,KAAK,QAAQ;YACnB,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC;YACtC,CAAC,CAAC,MAAM,KAAK,gBAAgB;gBAC3B,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,IAAI,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAC;IACpB,IAAI,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,wBAAwB,EAAE,wCAAwC,CAAC,CAAC;IAC9H,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,IAAI,MAAM;QAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC;IAClE,MAAM,aAAa,GAAG,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,IAAI,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,QAAQ,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrE,IAAI,CAAC,0BAA0B,EAAE,8BAA8B,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC;YACvF,IAAI,CAAC,4BAA4B,EAAE,yCAAyC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QACvG,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO;YAClD,IAAI,CAAC,uBAAuB,EAAE,kEAAkE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,MAAM,OAAO,GAAI,IAAoC,CAAC,aAAa,CAAC;QACpE,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;YAAE,IAAI,CAAC,2BAA2B,EAAE,0CAA0C,CAAC,CAAC;QAC5H,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACnH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,+BAA+B,EAAE,oEAAoE,CAAC,CAAC;QAC9G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAChE,IACE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/D,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC;YAEhG,IAAI,CACF,4BAA4B,EAC5B,+FAA+F,EAC/F,UAAU,CAAC,aAAa,CACzB,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GACZ,MAAM,KAAK,gBAAgB;QACzB,CAAC,CAAC;YACE,sEAAsE;YACtE,oFAAoF;SACrF;QACH,CAAC,CAAC,MAAM,KAAK,QAAQ;YACnB,CAAC,CAAC,CAAC,yFAAyF,CAAC;YAC7F,CAAC,CAAC,EAAE,CAAC;IACX,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACxG,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACvG,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAG,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC;QAC9D,IAAI,CAAC,qBAAqB,EAAE,8EAA8E,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9E,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,EAAG,EAAE,CAAC,CAAC;YACvE,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,EAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;oBACxD,OAAO,UAAU,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;gBAChI,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,4BAA4B,EAAE,wCAAwC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrG,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC7B,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,IAAI,EAAE,IAAI,QAAQ,KAAK,EAAE;YAAE,IAAI,CAAC,4BAA4B,EAAE,0CAA0C,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9H,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3C,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,OAAO,UAAU,CAAC;YAChB,GAAG,OAAO;YACV,MAAM,EAAE,KAAK;YACb,gBAAgB,EAAE,IAAI;YACtB,QAAQ;YACR,SAAS;YACT,OAAO,EAAE,QAAQ;YACjB,KAAK;YACL,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG;YACf,OAAO,EAAE,QAAQ;YACjB,QAAQ;YACR,SAAS;YACT,YAAY,EAAE,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB;YACvE,YAAY,EAAE,MAAM;YACpB,QAAQ,EAAE,mFAAmF;SAC9F,CAAC;QACF,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,2GAA2G,EAAE;gBAC9H,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,UAAU,CAAC,OAAO;gBAC5B,WAAW,EAAE,QAAQ;aACtB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,mIAAmI,EACnI,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,EAAE,CACjI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAmB,MAAS;IACnD,IAAI,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,EAAE,CAAC;IAC9F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,gGAAgG,EAAE;YACnH,KAAK;YACL,IAAI,EAAE,8BAA8B;YACpC,QAAQ,EAAE,UAAU,CAAC,OAAO;YAC5B,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAoC,EAAE,IAAa,EAAE,KAAY;IAC5F,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,CAAC,GAAI,MAAM,CAAC,aAA0B,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChI,IAAI,CAAC,4BAA4B,EAAE,oEAAoE,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACjI,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAkB,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;gBAChE,IAAI,CAAC,4BAA4B,EAAE,4DAA4D,EAAE,UAAU,CAAC,OAAO,EAAE;oBACnH,KAAK,EAAE,GAAG;iBACX,CAAC,CAAC;QACP,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC;YACrE,IAAI,CAAC,4BAA4B,EAAE,6EAA6E,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC1I,CAAC;AACH,CAAC"}

package/dist/identity-governance/membership.d.ts

@@ -0,0 +1,145 @@
+import { z } from 'zod';
+import type { PaginationInput } from '../pagination/index.js';
+import { IdentityClient } from './client.js';
+import { type MembershipChange, type MembershipScope } from './contracts.js';
+export declare const membershipPlanSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"direct-group-membership">;
+    contextFingerprint: z.ZodString;
+    principalId: z.ZodString;
+    subscription: z.ZodString;
+    deployment: z.ZodString;
+    tenant: z.ZodString;
+    schemaDigest: z.ZodString;
+    scope: z.ZodObject<{
+        kind: z.ZodEnum<{
+            group: "group";
+            user: "user";
+        }>;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    action: z.ZodEnum<{
+        add: "add";
+        remove: "remove";
+    }>;
+    groups: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        code: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strict>>;
+    entries: z.ZodArray<z.ZodObject<{
+        userId: z.ZodString;
+        groupId: z.ZodString;
+        action: z.ZodEnum<{
+            add: "add";
+            remove: "remove";
+        }>;
+        before: z.ZodBoolean;
+        mapped: z.ZodBoolean;
+    }, z.core.$strict>>;
+    sha256: z.ZodString;
+}, z.core.$strict>;
+export type MembershipPlan = z.infer<typeof membershipPlanSchema>;
+type State = 'completed' | 'skipped' | 'failed' | 'unknown' | 'pending';
+type Outcome = MembershipChange & {
+    state: State;
+    before: boolean;
+    mapped: boolean;
+};
+export declare function parseTargetIds(value: unknown): string[];
+export declare function validateMembershipPlan(value: unknown, client: IdentityClient, scope: MembershipScope, action: 'add' | 'remove'): MembershipPlan;
+export interface MembershipInput {
+    client: IdentityClient;
+    scope: MembershipScope;
+    action: 'add' | 'remove';
+    ids?: string[] | undefined;
+    idsFile?: string | undefined;
+    allMembers?: boolean | undefined;
+    planFile?: string | undefined;
+    planOut?: string | undefined;
+    report?: string | undefined;
+    dryRun: boolean;
+    yes: boolean;
+    pagination: PaginationInput;
+}
+export declare function executeMembership(input: MembershipInput): Promise<{
+    authSurface: string;
+    teamMode: string;
+    subscription: string;
+    deployment: string;
+    tenant: string;
+    principalId: string;
+    contextFingerprint: string;
+    schemaDigest: string | undefined;
+    scope: {
+        kind: "group" | "user";
+        id: string;
+    };
+    action: "add" | "remove";
+    targetCount: number;
+    planSha256: string;
+    warnings: string[];
+    dryRun: boolean;
+    writeRequestSent: boolean;
+    serverValidated: boolean;
+    planPath: string | undefined;
+    plan: {
+        version: 1;
+        kind: "direct-group-membership";
+        contextFingerprint: string;
+        principalId: string;
+        subscription: string;
+        deployment: string;
+        tenant: string;
+        schemaDigest: string;
+        scope: {
+            kind: "group" | "user";
+            id: string;
+        };
+        action: "add" | "remove";
+        groups: {
+            id: string;
+            code: string;
+            name: string;
+        }[];
+        entries: {
+            userId: string;
+            groupId: string;
+            action: "add" | "remove";
+            before: boolean;
+            mapped: boolean;
+        }[];
+        sha256: string;
+    };
+} | {
+    authSurface: string;
+    teamMode: string;
+    subscription: string;
+    deployment: string;
+    tenant: string;
+    principalId: string;
+    contextFingerprint: string;
+    schemaDigest: string | undefined;
+    scope: {
+        kind: "group" | "user";
+        id: string;
+    };
+    action: "add" | "remove";
+    targetCount: number;
+    planSha256: string;
+    warnings: string[];
+    dryRun: boolean;
+    writeRequestSent: boolean;
+    snapshot: string;
+    report: string;
+    reports: string[];
+    outcomes: Outcome[];
+    inverse: {
+        userId: string;
+        groupId: string;
+        action: "add" | "remove";
+    }[];
+    finalReport: string;
+}>;
+export {};
+//# sourceMappingURL=membership.d.ts.map

package/dist/identity-governance/membership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../../src/identity-governance/membership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAmB,MAAM,aAAa,CAAC;AAC9D,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAqBxB,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiF,CAAC;AACnH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,KAAK,KAAK,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AACxE,KAAK,OAAO,GAAG,gBAAgB,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAErF,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAIvD;AA0ED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,KAAK,GAAG,QAAQ,GACvB,cAAc,CAoBhB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,KAAK,GAAG,QAAQ,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0J7D"}

package/dist/identity-governance/membership.js

@@ -0,0 +1,264 @@
+import { z } from 'zod';
+import { CliError, EXIT_CODES } from '../errors/cli-error.js';
+import { assertConfirmation } from '../policy/risk.js';
+import { requireComplete } from './client.js';
+import { changeSchema, fail, groupRefSchema, idSchema, MAX_MEMBERSHIP_TARGETS, parse, scopeSchema, } from './contracts.js';
+import { digest, readJson, writeArtifact } from './files.js';
+import { identityMeta } from './runtime.js';
+const entrySchema = changeSchema.extend({ before: z.boolean(), mapped: z.boolean() }).strict();
+const planBodySchema = z
+    .object({
+    version: z.literal(1),
+    kind: z.literal('direct-group-membership'),
+    contextFingerprint: z.string().min(1),
+    principalId: idSchema,
+    subscription: z.string().min(1),
+    deployment: z.string().min(1),
+    tenant: z.string().min(1),
+    schemaDigest: z.string().regex(/^[a-f0-9]{64}$/),
+    scope: scopeSchema,
+    action: z.enum(['add', 'remove']),
+    groups: z.array(groupRefSchema.strict()).max(MAX_MEMBERSHIP_TARGETS),
+    entries: z.array(entrySchema).max(MAX_MEMBERSHIP_TARGETS),
+})
+    .strict();
+export const membershipPlanSchema = planBodySchema.extend({ sha256: z.string().regex(/^[a-f0-9]{64}$/) }).strict();
+export function parseTargetIds(value) {
+    const ids = parse(z.array(idSchema).min(1).max(MAX_MEMBERSHIP_TARGETS), value);
+    if (new Set(ids).size !== ids.length)
+        fail('IDENTITY_DUPLICATE_TARGET', 'Repeated target IDs are not allowed.');
+    return ids.sort();
+}
+async function observe(client, scope, action, ids) {
+    client.binding('change');
+    const changes = ids.map((id) => ({
+        userId: scope.kind === 'user' ? scope.id : id,
+        groupId: scope.kind === 'group' ? scope.id : id,
+        action,
+    }));
+    const groupIds = [...new Set(changes.map((entry) => entry.groupId))].sort();
+    // Still validate an empty group's identity/protection when preparing an all-members no-op.
+    if (scope.kind === 'group' && !groupIds.length)
+        groupIds.push(scope.id);
+    const groups = [];
+    for (const id of groupIds) {
+        const group = await client.group(id);
+        if (!group.membershipEditable || group.code === 'super_admin')
+            fail('IDENTITY_MEMBERSHIP_PROTECTED', 'This group membership is protected.', EXIT_CODES.authorization, { groupId: id });
+        groups.push(parse(groupRefSchema, group));
+    }
+    const byUser = new Map();
+    for (const userId of [...new Set(changes.map((entry) => entry.userId))])
+        byUser.set(userId, await client.userGroups(userId));
+    if (scope.kind === 'user' && !byUser.has(scope.id))
+        byUser.set(scope.id, await client.userGroups(scope.id));
+    const memberships = new Map([...byUser].map(([userId, state]) => [
+        userId,
+        {
+            direct: new Set(state.direct.map((group) => group.id)),
+            mapped: new Set(state.mapped.map((group) => group.id)),
+        },
+    ]));
+    const entries = changes
+        .map((change) => {
+        const state = memberships.get(change.userId);
+        return {
+            ...change,
+            before: state.direct.has(change.groupId),
+            mapped: state.mapped.has(change.groupId),
+        };
+    })
+        .sort((a, b) => (a.userId < b.userId ? -1 : a.userId > b.userId ? 1 : a.groupId < b.groupId ? -1 : a.groupId > b.groupId ? 1 : 0));
+    const selfRemoval = entries.some((entry) => entry.userId === client.runtime.principalId && entry.action === 'remove' && entry.before);
+    if (selfRemoval) {
+        const own = byUser.get(client.runtime.principalId);
+        const retainedSuperAdmin = [...own.direct, ...own.mapped].some((group) => group.code === 'super_admin' && group.protected);
+        if (!retainedSuperAdmin)
+            fail('IDENTITY_SELF_LOCKOUT_RISK', 'This operation removes your own membership without proven retained super-administrator authority. Use an already authorized operator with independent access; no target was omitted.', EXIT_CODES.authorization);
+    }
+    const meta = identityMeta(client.runtime);
+    const body = parse(planBodySchema, {
+        version: 1,
+        kind: 'direct-group-membership',
+        contextFingerprint: meta.contextFingerprint,
+        principalId: meta.principalId,
+        subscription: meta.subscription,
+        deployment: meta.deployment,
+        tenant: meta.tenant,
+        schemaDigest: meta.schemaDigest,
+        scope,
+        action,
+        groups,
+        entries,
+    });
+    return { ...body, sha256: digest(body) };
+}
+function targetIds(plan) {
+    return plan.entries.map((entry) => (plan.scope.kind === 'user' ? entry.groupId : entry.userId));
+}
+export function validateMembershipPlan(value, client, scope, action) {
+    const plan = parse(membershipPlanSchema, value);
+    const { sha256, ...body } = plan;
+    if (digest(body) !== sha256)
+        fail('IDENTITY_PLAN_INVALID', 'The plan digest does not match its content. Prepare a new dry-run.');
+    if (plan.contextFingerprint !== client.runtime.context.fingerprint ||
+        plan.principalId !== client.runtime.principalId ||
+        plan.subscription !== client.runtime.context.subscription ||
+        plan.deployment !== client.runtime.context.deployment ||
+        plan.tenant !== client.runtime.context.tenant ||
+        plan.schemaDigest !== client.runtime.digest ||
+        plan.action !== action ||
+        plan.scope.kind !== scope.kind ||
+        plan.scope.id !== scope.id)
+        fail('IDENTITY_PLAN_CONTEXT_MISMATCH', 'The plan does not match this command, principal, subscription, target, or API contract.');
+    if (plan.entries.length)
+        parseTargetIds(targetIds(plan));
+    if (plan.entries.some((entry) => entry.action !== action || (scope.kind === 'user' ? entry.userId : entry.groupId) !== scope.id))
+        fail('IDENTITY_PLAN_SCOPE_MISMATCH', 'Every plan change must belong to the exact editor scope.');
+    return plan;
+}
+export async function executeMembership(input) {
+    const { client, action } = input;
+    const scope = parse(scopeSchema, input.scope);
+    if (input.dryRun && input.yes)
+        fail('IDENTITY_FLAG_CONFLICT', '--dry-run and --yes are mutually exclusive.');
+    if (input.planOut && !input.dryRun)
+        fail('IDENTITY_FLAG_CONFLICT', '--plan-out is only allowed during dry-run.');
+    const selectors = [input.ids !== undefined, input.idsFile !== undefined, Boolean(input.allMembers), input.planFile !== undefined].filter(Boolean).length;
+    if (selectors !== 1)
+        fail('IDENTITY_TARGET_REQUIRED', 'Choose exactly one of explicit IDs, --ids-file, --all-members, or --plan-file.');
+    if (input.allMembers && (scope.kind !== 'group' || action !== 'remove' || !input.dryRun || !input.planOut || input.pagination.pageToken))
+        fail('IDENTITY_ALL_MEMBERS_PREVIEW_REQUIRED', '--all-members requires group member remove --dry-run --plan-out, starting from the first page.');
+    if (!input.dryRun)
+        assertConfirmation({ interactive: false, risk: 'privileged', yes: input.yes });
+    client.binding('change');
+    let plan;
+    if (input.planFile) {
+        plan = validateMembershipPlan(await readJson(input.planFile), client, scope, action);
+        const current = await observe(client, scope, action, targetIds(plan));
+        if (current.sha256 !== plan.sha256)
+            fail('IDENTITY_PLAN_STALE', 'Membership or group state changed since preview. Prepare a new plan; nothing was written.');
+    }
+    else {
+        let ids;
+        if (input.allMembers) {
+            ids = requireComplete(await client.members(scope.id, { ...input.pagination, pageAll: true })).map((member) => member.id);
+            if (ids.length)
+                ids = parseTargetIds(ids);
+        }
+        else
+            ids = parseTargetIds(input.idsFile ? await readJson(input.idsFile) : input.ids);
+        if (!input.dryRun && ids.length > 1)
+            fail('IDENTITY_BULK_PLAN_REQUIRED', 'Bulk writes require a reviewed --plan-file. Run --dry-run --plan-out first.');
+        plan = await observe(client, scope, action, ids);
+    }
+    for (let offset = 0; offset < Math.max(1, plan.entries.length); offset += 200) {
+        client.validateRequest('change', undefined, {
+            scope,
+            changes: plan.entries.slice(offset, offset + 200).map(({ userId, groupId, action }) => ({ userId, groupId, action })),
+        });
+    }
+    const warnings = [
+        'Only direct membership changes. Mapped access is not revoked.',
+        'Removing access groups may remove backend access.',
+        'Batches are individually atomic; the whole job is not a transaction.',
+    ];
+    const common = { ...identityMeta(client.runtime), scope, action, targetCount: plan.entries.length, planSha256: plan.sha256, warnings };
+    if (input.dryRun) {
+        const planPath = input.planOut ? await writeArtifact(plan, input.planOut, 'plan') : undefined;
+        return { ...common, dryRun: true, writeRequestSent: false, serverValidated: false, planPath, plan };
+    }
+    const snapshot = await writeArtifact(plan, undefined, 'before');
+    const outcomes = plan.entries.map((entry) => ({
+        ...entry,
+        state: entry.before === (action === 'add') ? 'skipped' : 'pending',
+    }));
+    const reports = [];
+    // Reserve the requested report path before sending anything. Later batch files are immutable receipts.
+    const report = await writeArtifact({ ...common, snapshot, outcomes }, input.report, 'report');
+    const pending = outcomes.filter((entry) => entry.state === 'pending');
+    const plannedGroups = new Map(plan.groups.map((group) => [group.id, group]));
+    let writeRequestSent = false;
+    for (let offset = 0; offset < pending.length; offset += 200) {
+        const batch = pending.slice(offset, offset + 200);
+        let requestId;
+        let sent = false;
+        let accepted = false;
+        try {
+            const current = await observe(client, scope, action, batch.map((entry) => (scope.kind === 'user' ? entry.groupId : entry.userId)));
+            const expectedEntries = batch.map(({ state: _state, ...entry }) => entry);
+            if (digest(current.entries) !== digest(expectedEntries) ||
+                current.groups.some((group) => {
+                    const before = plannedGroups.get(group.id);
+                    return !before || before.code !== group.code || before.name !== group.name;
+                }))
+                fail('IDENTITY_PLAN_STALE', 'Pending target state changed. Stop and prepare a new plan.');
+            const changes = batch.map(({ userId, groupId, action }) => ({ userId, groupId, action }));
+            client.validateRequest('change', undefined, { scope, changes });
+            reports.push(await writeArtifact({ ...common, snapshot, batchIndex: offset / 200, requestState: 'prepared', changes, outcomes }, undefined, 'batch-before'));
+            sent = true;
+            writeRequestSent = true;
+            const result = await client.change({ scope, changes });
+            accepted = true;
+            requestId = result.requestId;
+            if (result.data.changed !== batch.length || digest(result.data.scope) !== digest(scope))
+                fail('IDENTITY_WRITE_COUNT_MISMATCH', 'The server did not confirm the exact planned batch. Reconcile before further changes.', EXIT_CODES.partial);
+            const readbacks = new Map();
+            for (const entry of batch) {
+                let actual = readbacks.get(entry.userId);
+                if (!actual) {
+                    actual = await client.userGroups(entry.userId);
+                    readbacks.set(entry.userId, actual);
+                }
+                if (actual.direct.some((group) => group.id === entry.groupId) !== (action === 'add'))
+                    fail('IDENTITY_READBACK_MISMATCH', 'The exact membership readback differs from the requested state.', EXIT_CODES.partial);
+            }
+            for (const entry of batch)
+                entry.state = 'completed';
+            reports.push(await writeArtifact({ ...common, snapshot, requestId, outcomes, inverse: inverseChanges(outcomes) }, undefined, 'batch'));
+        }
+        catch (cause) {
+            const knownRejection = !accepted && cause instanceof CliError && /^HTTP_4\d\d$/.test(cause.code);
+            for (const entry of batch)
+                if (entry.state === 'pending')
+                    entry.state = sent && !knownRejection ? 'unknown' : 'failed';
+            const result = {
+                ...common,
+                snapshot,
+                report,
+                reports,
+                requestId,
+                writeRequestSent,
+                outcomes,
+                inverse: inverseChanges(outcomes),
+                failureCode: cause instanceof CliError ? cause.code : 'INTERNAL_ERROR',
+            };
+            let failureReport;
+            try {
+                failureReport = await writeArtifact(result, undefined, 'stopped');
+            }
+            catch (reportError) {
+                throw new CliError('Membership execution stopped and the final report could not be saved. Use the snapshot and returned outcomes; do not replay writes.', { cause: reportError, code: 'IDENTITY_REPORT_WRITE_FAILED', exitCode: EXIT_CODES.partial, safeDetails: result });
+            }
+            throw new CliError('Membership execution stopped. Inspect completed, failed, unknown, and pending targets before recovery; no batch was replayed.', { cause, code: 'IDENTITY_BATCH_INCOMPLETE', exitCode: EXIT_CODES.partial, safeDetails: { ...result, failureReport } });
+        }
+    }
+    const result = { ...common, dryRun: false, writeRequestSent, snapshot, report, reports, outcomes, inverse: inverseChanges(outcomes) };
+    try {
+        return { ...result, finalReport: await writeArtifact(result, undefined, 'complete') };
+    }
+    catch (cause) {
+        throw new CliError('Membership results were verified but the final report could not be saved. Do not repeat the write.', {
+            cause,
+            code: 'IDENTITY_REPORT_WRITE_FAILED',
+            exitCode: EXIT_CODES.partial,
+            safeDetails: result,
+        });
+    }
+}
+function inverseChanges(outcomes) {
+    return outcomes
+        .filter((entry) => entry.state === 'completed')
+        .map(({ userId, groupId, action }) => ({ userId, groupId, action: action === 'add' ? 'remove' : 'add' }));
+}
+//# sourceMappingURL=membership.js.map

package/dist/identity-governance/membership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership.js","sourceRoot":"","sources":["../../src/identity-governance/membership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAkB,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,YAAY,EACZ,IAAI,EACJ,cAAc,EACd,QAAQ,EACR,sBAAsB,EACtB,KAAK,EACL,WAAW,GAGZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC/F,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,WAAW,EAAE,QAAQ;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAChD,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAMnH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/E,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM;QAAE,IAAI,CAAC,2BAA2B,EAAE,sCAAsC,CAAC,CAAC;IAChH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAsB,EAAE,KAAsB,EAAE,MAAwB,EAAE,GAAa;IAC5G,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAoB,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QAC7C,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QAC/C,MAAM;KACP,CAAC,CAAC,CAAC;IACJ,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,2FAA2F;IAC3F,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAqC,EAAE,CAAC;IACpD,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;YAC3D,IAAI,CAAC,+BAA+B,EAAE,qCAAqC,EAAE,UAAU,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1H,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6D,CAAC;IACpF,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7H,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5G,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM;QACN;YACE,MAAM,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtD,MAAM,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACvD;KACF,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,OAAO;SACpB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAE,CAAC;QAC9C,OAAO;YACL,GAAG,MAAM;YACT,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;YACxC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;SACzC,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrI,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IACtI,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAE,CAAC;QACpD,MAAM,kBAAkB,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3H,IAAI,CAAC,kBAAkB;YACrB,IAAI,CACF,4BAA4B,EAC5B,sLAAsL,EACtL,UAAU,CAAC,aAAa,CACzB,CAAC;IACN,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,EAAE;QACjC,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,yBAAyB;QAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK;QACL,MAAM;QACN,MAAM;QACN,OAAO;KACR,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,IAAoB;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,MAAsB,EACtB,KAAsB,EACtB,MAAwB;IAExB,MAAM,IAAI,GAAG,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM;QAAE,IAAI,CAAC,uBAAuB,EAAE,oEAAoE,CAAC,CAAC;IACjI,IACE,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW;QAC9D,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,OAAO,CAAC,WAAW;QAC/C,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY;QACzD,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU;QACrD,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM;QAC7C,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM;QAC3C,IAAI,CAAC,MAAM,KAAK,MAAM;QACtB,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAC9B,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE;QAE1B,IAAI,CAAC,gCAAgC,EAAE,yFAAyF,CAAC,CAAC;IACpI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QAC9H,IAAI,CAAC,8BAA8B,EAAE,0DAA0D,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAsB;IAC5D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG;QAAE,IAAI,CAAC,wBAAwB,EAAE,6CAA6C,CAAC,CAAC;IAC7G,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,wBAAwB,EAAE,4CAA4C,CAAC,CAAC;IACjH,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CACtI,OAAO,CACR,CAAC,MAAM,CAAC;IACT,IAAI,SAAS,KAAK,CAAC;QAAE,IAAI,CAAC,0BAA0B,EAAE,gFAAgF,CAAC,CAAC;IACxI,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QACtI,IAAI,CACF,uCAAuC,EACvC,gGAAgG,CACjG,CAAC;IACJ,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,kBAAkB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAClG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,IAAoB,CAAC;IACzB,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,IAAI,GAAG,sBAAsB,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAChC,IAAI,CAAC,qBAAqB,EAAE,2FAA2F,CAAC,CAAC;IAC7H,CAAC;SAAM,CAAC;QACN,IAAI,GAAa,CAAC;QAClB,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,GAAG,GAAG,eAAe,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzH,IAAI,GAAG,CAAC,MAAM;gBAAE,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;;YAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvF,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YACjC,IAAI,CAAC,6BAA6B,EAAE,6EAA6E,CAAC,CAAC;QACrH,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;QAC9E,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE;YAC1C,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;SACtH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,+DAA+D;QAC/D,mDAAmD;QACnD,sEAAsE;KACvE,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtG,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAc,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,GAAG,KAAK;QACR,KAAK,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACnE,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,uGAAuG;IACvG,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;QAClD,IAAI,SAA6B,CAAC;QAClC,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,MAAM,EACN,KAAK,EACL,MAAM,EACN,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAC7E,CAAC;YACF,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YAC1E,IACE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,eAAe,CAAC;gBACnD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;oBAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC3C,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC;gBAC7E,CAAC,CAAC;gBAEF,IAAI,CAAC,qBAAqB,EAAE,4DAA4D,CAAC,CAAC;YAC5F,MAAM,OAAO,GAAuB,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAC9G,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CACV,MAAM,aAAa,CACjB,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,EAC9F,SAAS,EACT,cAAc,CACf,CACF,CAAC;YACF,IAAI,GAAG,IAAI,CAAC;YACZ,gBAAgB,GAAG,IAAI,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACvD,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC;gBACrF,IAAI,CACF,+BAA+B,EAC/B,uFAAuF,EACvF,UAAU,CAAC,OAAO,CACnB,CAAC;YACJ,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6D,CAAC;YACvF,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC/C,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC;oBAClF,IAAI,CAAC,4BAA4B,EAAE,iEAAiE,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9H,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,KAAK;gBAAE,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC;YACrD,OAAO,CAAC,IAAI,CACV,MAAM,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CACzH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,cAAc,GAAG,CAAC,QAAQ,IAAI,KAAK,YAAY,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjG,KAAK,MAAM,KAAK,IAAI,KAAK;gBAAE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;oBAAE,KAAK,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;YACvH,MAAM,MAAM,GAAG;gBACb,GAAG,MAAM;gBACT,QAAQ;gBACR,MAAM;gBACN,OAAO;gBACP,SAAS;gBACT,gBAAgB;gBAChB,QAAQ;gBACR,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC;gBACjC,WAAW,EAAE,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB;aACvE,CAAC;YACF,IAAI,aAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,MAAM,IAAI,QAAQ,CAChB,qIAAqI,EACrI,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,8BAA8B,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAChH,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,+HAA+H,EAC/H,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,EAAE,CACtH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtI,IAAI,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,oGAAoG,EAAE;YACvH,KAAK;YACL,IAAI,EAAE,8BAA8B;YACpC,QAAQ,EAAE,UAAU,CAAC,OAAO;YAC5B,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAmB;IACzC,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC;SAC9C,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAC9G,CAAC"}

package/dist/identity-governance/runtime.d.ts

@@ -0,0 +1,16 @@
+import { type SemanticRuntime } from '../semantic/runtime.js';
+export interface IdentityRuntime extends SemanticRuntime {
+    principalId: string;
+}
+export declare function loadIdentityRuntime(subscription: string, refresh: boolean): Promise<IdentityRuntime>;
+export declare function identityMeta(runtime: IdentityRuntime): {
+    authSurface: string;
+    teamMode: string;
+    subscription: string;
+    deployment: string;
+    tenant: string;
+    principalId: string;
+    contextFingerprint: string;
+    schemaDigest: string | undefined;
+};
+//# sourceMappingURL=runtime.d.ts.map

package/dist/identity-governance/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/identity-governance/runtime.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGnF,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAe1G;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,eAAe;IAEjD,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,MAAM;IACN,WAAW;IACX,kBAAkB;IAClB,YAAY;EAEf"}