@jantstack/adonis-authz 1.0.0

package/build/src/drivers/openfga_driver.js

@@ -0,0 +1,450 @@
+import { Exception } from '@adonisjs/core/exceptions';
+import db from '@adonisjs/lucid/services/db';
+import { OpenFgaClient, ClientWriteRequestOnDuplicateWrites, ClientWriteRequestOnMissingDeletes, } from '@openfga/sdk';
+import { APP_SCOPE, APP_SCOPE_TYPE } from '../types.js';
+import { APP_SCOPE_DB_UUID } from './database_driver.js';
+/** `:` no es válido en ids de FGA — se encodea (`audit:read` → `audit~read`). */
+function encodeSlug(slug) {
+    return slug.replaceAll(':', '~');
+}
+function decodeSlug(encoded) {
+    return encoded.replaceAll('~', ':');
+}
+/**
+ * Caracteres admitidos en un tipo de scope y en un uuid al construir la clave
+ * del binding. `|` es el separador y `~` el escape de los slugs: si alguno
+ * apareciera dentro de un componente, dos scopes DISTINTOS podrían producir
+ * la misma clave —p. ej. `{org, 'anization|X'}` y `{'org|anization', 'X'}`—
+ * y un grant en uno autorizaría en el otro (confusión de privilegios).
+ *
+ * El driver `database` es inmune por construcción (guarda tipo y uuid en
+ * columnas separadas, sin codificar); esta validación protege la única ruta
+ * que serializa el scope a un string.
+ */
+const SCOPE_COMPONENT_FORMAT = /^[a-zA-Z0-9_.:-]+$/;
+function assertScopeComponent(kind, value) {
+    if (!SCOPE_COMPONENT_FORMAT.test(value)) {
+        throw new Exception(`${kind} inválido para el driver openfga: '${value}'. ` +
+            `Solo se admiten letras, dígitos y . _ - : (ni '|' ni '~').`, { status: 500 });
+    }
+}
+/**
+ * Clave de scope dentro del id del binding: `app` para la raíz,
+ * `<tipo>|<uuid>` para el resto. Genérico: sirve para cualquier nivel que
+ * defina el consumidor sin tocar el driver.
+ */
+function scopeKey(scope) {
+    assertScopeComponent('Tipo de scope', scope.type);
+    if (scope.type === APP_SCOPE_TYPE)
+        return APP_SCOPE_TYPE;
+    assertScopeComponent('UUID de scope', String(scope.uuid ?? ''));
+    return `${scope.type}|${scope.uuid}`;
+}
+function parseBindingId(id) {
+    const parts = id.split('|');
+    if (parts.length === 2 && parts[0] === APP_SCOPE_TYPE) {
+        return { scope: { type: APP_SCOPE_TYPE, uuid: null }, slug: decodeSlug(parts[1]) };
+    }
+    if (parts.length === 3) {
+        return { scope: { type: parts[0], uuid: parts[1] }, slug: decodeSlug(parts[2]) };
+    }
+    return null;
+}
+/** `<tipoFga>:<uuid>` a partir del morph name del holder. */
+function fgaSubjectWith(subject, holderTypes) {
+    const fgaType = holderTypes[subject.type];
+    if (!fgaType) {
+        throw new Exception(`Holder type '${subject.type}' no está en el modelo FGA ` +
+            `(declarados: ${Object.keys(holderTypes).join(', ') || 'ninguno'}). ` +
+            `Añádelo a holderTypes y regenera el authorization model.`, { status: 500 });
+    }
+    return `${fgaType}:${subject.uuid}`;
+}
+function checkContext() {
+    return { current_time: new Date().toISOString() };
+}
+/**
+ * El authorization model en formato JSON del API de FGA, generado a partir
+ * de los holders del consumidor. El mismo mapa debe usarse al construir el
+ * driver: si difieren, los checks no encuentran las tuplas.
+ */
+export function openFgaAuthorizationModel(holderTypeMap) {
+    const holderTypes = [...new Set(Object.values(holderTypeMap))];
+    const direct = holderTypes.map((type) => ({ type }));
+    const directWithExpiry = [
+        ...direct,
+        ...holderTypes.map((type) => ({ type, condition: 'not_expired' })),
+    ];
+    return {
+        schema_version: '1.1',
+        type_definitions: [
+            ...holderTypes.map((type) => ({ type, relations: {}, metadata: null })),
+            {
+                type: 'role_binding',
+                relations: { assignee: { this: {} } },
+                metadata: {
+                    relations: { assignee: { directly_related_user_types: directWithExpiry } },
+                },
+            },
+            {
+                type: 'deny_binding',
+                relations: { denied: { this: {} } },
+                metadata: {
+                    relations: { denied: { directly_related_user_types: direct } },
+                },
+            },
+        ],
+        conditions: {
+            not_expired: {
+                name: 'not_expired',
+                expression: 'current_time < valid_until',
+                parameters: {
+                    current_time: { type_name: 'TYPE_NAME_TIMESTAMP' },
+                    valid_until: { type_name: 'TYPE_NAME_TIMESTAMP' },
+                },
+            },
+        },
+    };
+}
+/**
+ * Crea un store nuevo + escribe el authorization model derivado de los
+ * holders del consumidor. Para bootstrap de un appliance o del harness de
+ * tests. El `name` lo decide el caller (el comando openfga:provision
+ * resuelve APP_NAME del entorno — el motor no lee env).
+ */
+export async function provisionOpenFgaStore(apiUrl, name, holderTypeMap) {
+    const client = new OpenFgaClient({ apiUrl });
+    const store = await client.createStore({ name });
+    const scoped = new OpenFgaClient({ apiUrl, storeId: store.id });
+    const model = await scoped.writeAuthorizationModel(openFgaAuthorizationModel(holderTypeMap));
+    return { storeId: store.id, modelId: model.authorization_model_id };
+}
+/**
+ * Migración de hechos database → openfga: copia las asignaciones vigentes y
+ * los denies de las tablas `authz_*` como tuples del store FGA.
+ *
+ * - COPIA, no mueve: las tablas locales quedan intactas → el rollback es
+ *   volver a AUTHZ_DRIVER=database (solo se pierde lo escrito mientras se
+ *   operó con openfga). El catálogo y la jerarquía nunca migran: son
+ *   metadata local para ambos drivers.
+ * - Idempotente: re-ejecutar no duplica (onDuplicateWrites: Ignore).
+ * - Las asignaciones ya expiradas se saltan (no tiene sentido copiarlas);
+ *   las de expiración futura viajan con la condition `not_expired`.
+ */
+export async function importAuthzFactsToOpenFga(options) {
+    const client = new OpenFgaClient({
+        apiUrl: options.apiUrl,
+        storeId: options.storeId,
+        authorizationModelId: options.modelId,
+    });
+    const now = new Date();
+    const result = {
+        assignments: 0,
+        denies: 0,
+        skippedExpired: 0,
+        dryRun: options.dryRun ?? false,
+    };
+    const tuples = [];
+    const assignments = await db
+        .from('authz_assignments as a')
+        .join('authz_roles as r', 'r.uuid', 'a.role_uuid')
+        .select('a.holder_type', 'a.holder_uuid', 'a.scope_type', 'a.scope_uuid', 'a.expires_at')
+        .select('r.slug as role_slug');
+    const rowScope = (row) => ({
+        type: row.scope_type,
+        uuid: row.scope_uuid === APP_SCOPE_DB_UUID ? null : row.scope_uuid,
+    });
+    for (const row of assignments) {
+        const expiresAt = row.expires_at ? new Date(row.expires_at) : null;
+        if (expiresAt && expiresAt <= now) {
+            result.skippedExpired++;
+            continue;
+        }
+        const scope = rowScope(row);
+        const key = {
+            user: fgaSubjectWith({ type: row.holder_type, uuid: row.holder_uuid }, options.holderTypes),
+            relation: 'assignee',
+            object: `role_binding:${scopeKey(scope)}|${encodeSlug(row.role_slug)}`,
+        };
+        tuples.push(expiresAt
+            ? {
+                ...key,
+                condition: { name: 'not_expired', context: { valid_until: expiresAt.toISOString() } },
+            }
+            : key);
+        result.assignments++;
+    }
+    const denies = await db
+        .from('authz_denies as d')
+        .join('authz_permissions as p', 'p.uuid', 'd.permission_uuid')
+        .select('d.holder_type', 'd.holder_uuid', 'd.scope_type', 'd.scope_uuid')
+        .select('p.slug as permission_slug');
+    for (const row of denies) {
+        const scope = rowScope(row);
+        tuples.push({
+            user: fgaSubjectWith({ type: row.holder_type, uuid: row.holder_uuid }, options.holderTypes),
+            relation: 'denied',
+            object: `deny_binding:${scopeKey(scope)}|${encodeSlug(row.permission_slug)}`,
+        });
+        result.denies++;
+    }
+    if (!result.dryRun && tuples.length > 0) {
+        // Chunks: el write transaccional de FGA tiene límite de tuples por request.
+        for (let i = 0; i < tuples.length; i += 50) {
+            await client.writeTuples(tuples.slice(i, i + 50), {
+                conflict: { onDuplicateWrites: ClientWriteRequestOnDuplicateWrites.Ignore },
+            });
+        }
+    }
+    return result;
+}
+export class OpenFgaAuthorizationDriver {
+    client;
+    resolveAncestors;
+    holderTypes;
+    constructor(options) {
+        this.client = new OpenFgaClient({
+            apiUrl: options.apiUrl,
+            storeId: options.storeId,
+            authorizationModelId: options.modelId,
+        });
+        this.resolveAncestors =
+            options.resolveAncestors ??
+                (async (scope) => (scope.type === APP_SCOPE_TYPE ? [] : [APP_SCOPE]));
+        this.holderTypes = options.holderTypes;
+    }
+    async chain(scope) {
+        return [scope, ...(await this.resolveAncestors(scope))];
+    }
+    fgaSubject(subject) {
+        return fgaSubjectWith(subject, this.holderTypes);
+    }
+    /**
+     * batchCheck troceado al límite del servidor FGA (50 checks/request) y con
+     * verificación de completitud: TODOS los checks deben volver respondidos.
+     */
+    async batchCheckAll(checks) {
+        const results = [];
+        for (let i = 0; i < checks.length; i += 50) {
+            const slice = checks.slice(i, i + 50);
+            const response = await this.client.batchCheck({ checks: slice });
+            results.push(...response.result);
+        }
+        if (results.length !== checks.length) {
+            throw new Exception('OpenFGA batchCheck devolvió menos resultados que checks', {
+                status: 500,
+            });
+        }
+        return results;
+    }
+    // ── Catálogo local (compartido entre drivers) ─────────────────────────
+    async findPermission(slug) {
+        return db.from('authz_permissions').where('slug', slug).select('uuid').first();
+    }
+    async findRoleOrFail(slug, scopeType) {
+        const role = await db
+            .from('authz_roles')
+            .where('slug', slug)
+            .where('scope_type', scopeType)
+            .select('uuid')
+            .first();
+        if (!role) {
+            throw new Exception(`Rol '${slug}' no existe en el catálogo para el nivel '${scopeType}'`, {
+                status: 422,
+            });
+        }
+    }
+    /** Roles del catálogo que conceden el permiso, agrupados por scope_type. */
+    async rolesGranting(permissionUuid) {
+        const rows = await db
+            .from('authz_role_permissions as rp')
+            .join('authz_roles as r', 'r.uuid', 'rp.role_uuid')
+            .where('rp.permission_uuid', permissionUuid)
+            .select('r.slug', 'r.scope_type');
+        const byScopeType = new Map();
+        for (const row of rows) {
+            const list = byScopeType.get(row.scope_type) ?? [];
+            list.push(row.slug);
+            byScopeType.set(row.scope_type, list);
+        }
+        return byScopeType;
+    }
+    // ── Contrato ──────────────────────────────────────────────────────────
+    async authorize(subject, permission, scope) {
+        const perm = await this.findPermission(permission);
+        if (!perm)
+            return false;
+        const user = this.fgaSubject(subject);
+        const chain = await this.chain(scope);
+        // 1. Denies en la cadena. FAIL-CLOSED: un check de deny con error se
+        //    trata como denegado (jamás se ignora un deny por un fallo puntual).
+        const denyChecks = chain.map((s) => ({
+            user,
+            relation: 'denied',
+            object: `deny_binding:${scopeKey(s)}|${encodeSlug(permission)}`,
+        }));
+        const denyResults = await this.batchCheckAll(denyChecks);
+        if (denyResults.some((r) => r.allowed || r.error))
+            return false;
+        // 2. Alguna asignación vigente en la cadena cuyo rol concede el permiso.
+        //    Aquí un error individual falla cerrado por sí solo (no concede).
+        const granting = await this.rolesGranting(perm.uuid);
+        const checks = chain.flatMap((s) => (granting.get(s.type) ?? []).map((roleSlug) => ({
+            user,
+            relation: 'assignee',
+            object: `role_binding:${scopeKey(s)}|${encodeSlug(roleSlug)}`,
+            context: checkContext(),
+        })));
+        if (checks.length === 0)
+            return false;
+        const results = await this.batchCheckAll(checks);
+        return results.some((r) => r.allowed && !r.error);
+    }
+    async grant(subject, role, scope, options = {}) {
+        await this.findRoleOrFail(role, scope.type);
+        const key = {
+            user: this.fgaSubject(subject),
+            relation: 'assignee',
+            object: `role_binding:${scopeKey(scope)}|${encodeSlug(role)}`,
+        };
+        const write = options.expiresAt
+            ? {
+                ...key,
+                condition: {
+                    name: 'not_expired',
+                    context: { valid_until: options.expiresAt.toISOString() },
+                },
+            }
+            : key;
+        // Re-grant refresca la expiración. FGA no admite delete+write de la
+        // misma tuple key en una transacción → dos llamadas tolerantes.
+        await this.client.deleteTuples([key], {
+            conflict: { onMissingDeletes: ClientWriteRequestOnMissingDeletes.Ignore },
+        });
+        await this.client.writeTuples([write], {
+            conflict: { onDuplicateWrites: ClientWriteRequestOnDuplicateWrites.Ignore },
+        });
+    }
+    async revoke(subject, role, scope) {
+        await this.client.deleteTuples([
+            {
+                user: this.fgaSubject(subject),
+                relation: 'assignee',
+                object: `role_binding:${scopeKey(scope)}|${encodeSlug(role)}`,
+            },
+        ], { conflict: { onMissingDeletes: ClientWriteRequestOnMissingDeletes.Ignore } });
+    }
+    async hasRole(subject, role, scope) {
+        const user = this.fgaSubject(subject);
+        const chain = await this.chain(scope);
+        const results = await this.batchCheckAll(chain.map((s) => ({
+            user,
+            relation: 'assignee',
+            object: `role_binding:${scopeKey(s)}|${encodeSlug(role)}`,
+            context: checkContext(),
+        })));
+        return results.some((r) => r.allowed && !r.error);
+    }
+    async deny(subject, permission, scope) {
+        const perm = await this.findPermission(permission);
+        if (!perm) {
+            throw new Exception(`Permiso '${permission}' no existe en el catálogo`, { status: 422 });
+        }
+        await this.client.writeTuples([
+            {
+                user: this.fgaSubject(subject),
+                relation: 'denied',
+                object: `deny_binding:${scopeKey(scope)}|${encodeSlug(permission)}`,
+            },
+        ], { conflict: { onDuplicateWrites: ClientWriteRequestOnDuplicateWrites.Ignore } });
+    }
+    async removeDeny(subject, permission, scope) {
+        await this.client.deleteTuples([
+            {
+                user: this.fgaSubject(subject),
+                relation: 'denied',
+                object: `deny_binding:${scopeKey(scope)}|${encodeSlug(permission)}`,
+            },
+        ], { conflict: { onMissingDeletes: ClientWriteRequestOnMissingDeletes.Ignore } });
+    }
+    async listSubjects(role, scope) {
+        // ListUsers exige EXACTAMENTE un user_filter → una consulta por tipo.
+        const results = [];
+        const fgaToMorph = Object.fromEntries(Object.entries(this.holderTypes).map(([morph, fga]) => [fga, morph]));
+        for (const fgaType of [...new Set(Object.values(this.holderTypes))]) {
+            const response = await this.client.listUsers({
+                object: { type: 'role_binding', id: `${scopeKey(scope)}|${encodeSlug(role)}` },
+                relation: 'assignee',
+                user_filters: [{ type: fgaType }],
+                context: checkContext(),
+            });
+            for (const u of response.users ?? []) {
+                if (u.object) {
+                    results.push({ type: fgaToMorph[u.object.type] ?? u.object.type, uuid: u.object.id });
+                }
+            }
+        }
+        return results;
+    }
+    /** role_binding ids del subject (asignaciones directas vigentes). */
+    async listBindings(subject) {
+        const response = await this.client.listObjects({
+            user: this.fgaSubject(subject),
+            relation: 'assignee',
+            type: 'role_binding',
+            context: checkContext(),
+        });
+        return (response.objects ?? []).map((obj) => obj.replace(/^role_binding:/, ''));
+    }
+    async listRoles(subject, scope) {
+        const prefix = scopeKey(scope);
+        const roles = new Set();
+        for (const id of await this.listBindings(subject)) {
+            const parsed = parseBindingId(id);
+            if (parsed && scopeKey(parsed.scope) === prefix)
+                roles.add(parsed.slug);
+        }
+        return [...roles];
+    }
+    async listRoleScopes(subject, scopeType) {
+        const seen = new Map();
+        for (const id of await this.listBindings(subject)) {
+            const parsed = parseBindingId(id);
+            if (parsed && parsed.scope.type === scopeType) {
+                seen.set(scopeKey(parsed.scope), parsed.scope);
+            }
+        }
+        return [...seen.values()];
+    }
+    async listScopes(subject, permission) {
+        const perm = await this.findPermission(permission);
+        if (!perm)
+            return [];
+        const granting = await this.rolesGranting(perm.uuid);
+        // Denies del subject para este permiso (una sola consulta).
+        const denyResponse = await this.client.listObjects({
+            user: this.fgaSubject(subject),
+            relation: 'denied',
+            type: 'deny_binding',
+        });
+        const deniedKeys = new Set((denyResponse.objects ?? [])
+            .map((obj) => obj.replace(/^deny_binding:/, ''))
+            .map((id) => parseBindingId(id))
+            .filter((p) => Boolean(p && p.slug === permission))
+            .map((p) => scopeKey(p.scope)));
+        const result = new Map();
+        for (const id of await this.listBindings(subject)) {
+            const parsed = parseBindingId(id);
+            if (!parsed)
+                continue;
+            if (!(granting.get(parsed.scope.type) ?? []).includes(parsed.slug))
+                continue;
+            const chain = await this.chain(parsed.scope);
+            const blocked = chain.some((s) => deniedKeys.has(scopeKey(s)));
+            if (!blocked)
+                result.set(scopeKey(parsed.scope), parsed.scope);
+        }
+        return [...result.values()];
+    }
+}
+//# sourceMappingURL=openfga_driver.js.map

package/build/src/drivers/openfga_driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga_driver.js","sourceRoot":"","sources":["../../../src/drivers/openfga_driver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC5C,OAAO,EACL,aAAa,EACb,mCAAmC,EACnC,kCAAkC,GACnC,MAAM,cAAc,CAAA;AASrB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AA8BxD,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAClC,CAAC;AACD,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,sBAAsB,GAAG,oBAAoB,CAAA;AAEnD,SAAS,oBAAoB,CAAC,IAAY,EAAE,KAAa;IACvD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CACjB,GAAG,IAAI,sCAAsC,KAAK,KAAK;YACrD,4DAA4D,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,KAAe;IAC/B,oBAAoB,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,cAAc,CAAA;IACxD,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/D,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,cAAc,CAAC,EAAU;IAChC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,6DAA6D;AAC7D,SAAS,cAAc,CAAC,OAAmB,EAAE,WAA0B;IACrE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,gBAAgB,OAAO,CAAC,IAAI,6BAA6B;YACvD,gBAAgB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,KAAK;YACrE,0DAA0D,EAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;IACD,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAA;AACrC,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,aAA4B;IACpE,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACpD,MAAM,gBAAgB,GAAG;QACvB,GAAG,MAAM;QACT,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;KACnE,CAAA;IACD,OAAO;QACL,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE;YAChB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE;gBACE,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;gBACrC,QAAQ,EAAE;oBACR,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,EAAE;iBAC3E;aACF;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;gBACnC,QAAQ,EAAE;oBACR,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,EAAE,EAAE;iBAC/D;aACF;SACF;QACD,UAAU,EAAE;YACV,WAAW,EAAE;gBACX,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,4BAA4B;gBACxC,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE;oBAClD,WAAW,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE;iBAClD;aACF;SACF;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,IAAY,EACZ,aAA4B;IAE5B,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAC,CAAA;IAC5F,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAG,EAAE,OAAO,EAAE,KAAK,CAAC,sBAAuB,EAAE,CAAA;AACvE,CAAC;AAuBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAoD;IAEpD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC;QAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,oBAAoB,EAAE,OAAO,CAAC,OAAO;KACtC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,MAAM,GAAsB;QAChC,WAAW,EAAE,CAAC;QACd,MAAM,EAAE,CAAC;QACT,cAAc,EAAE,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;KAChC,CAAA;IACD,MAAM,MAAM,GAAU,EAAE,CAAA;IAExB,MAAM,WAAW,GAAG,MAAM,EAAE;SACzB,IAAI,CAAC,wBAAwB,CAAC;SAC9B,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,aAAa,CAAC;SACjD,MAAM,CAAC,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,CAAC;SACxF,MAAM,CAAC,qBAAqB,CAAC,CAAA;IAEhC,MAAM,QAAQ,GAAG,CAAC,GAAQ,EAAY,EAAE,CAAC,CAAC;QACxC,IAAI,EAAE,GAAG,CAAC,UAAU;QACpB,IAAI,EAAE,GAAG,CAAC,UAAU,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU;KACnE,CAAC,CAAA;IAEF,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAClE,IAAI,SAAS,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YAClC,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG;YACV,IAAI,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC;YAC3F,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,gBAAgB,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;SACvE,CAAA;QACD,MAAM,CAAC,IAAI,CACT,SAAS;YACP,CAAC,CAAC;gBACE,GAAG,GAAG;gBACN,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE;aACtF;YACH,CAAC,CAAC,GAAG,CACR,CAAA;QACD,MAAM,CAAC,WAAW,EAAE,CAAA;IACtB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,IAAI,CAAC,mBAAmB,CAAC;SACzB,IAAI,CAAC,wBAAwB,EAAE,QAAQ,EAAE,mBAAmB,CAAC;SAC7D,MAAM,CAAC,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,CAAC;SACxE,MAAM,CAAC,2BAA2B,CAAC,CAAA;IAEtC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC;YAC3F,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE;SAC7E,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,EAAE,CAAA;IACjB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,4EAA4E;QAC5E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE;gBAChD,QAAQ,EAAE,EAAE,iBAAiB,EAAE,mCAAmC,CAAC,MAAM,EAAE;aAC5E,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,OAAO,0BAA0B;IAC7B,MAAM,CAAe;IACrB,gBAAgB,CAAwB;IACxC,WAAW,CAAe;IAElC,YAAY,OAA6B;QACvC,IAAI,CAAC,MAAM,GAAG,IAAI,aAAa,CAAC;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,oBAAoB,EAAE,OAAO,CAAC,OAAO;SACtC,CAAC,CAAA;QACF,IAAI,CAAC,gBAAgB;YACnB,OAAO,CAAC,gBAAgB;gBACxB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QACvE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;IACxC,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,KAAe;QACjC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC;IAEO,UAAU,CAAC,OAAmB;QACpC,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;IAClD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CAAC,MAAa;QACvC,MAAM,OAAO,GAAU,EAAE,CAAA;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;YAChE,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,SAAS,CAAC,yDAAyD,EAAE;gBAC7E,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,yEAAyE;IAEjE,KAAK,CAAC,cAAc,CAAC,IAAY;QACvC,OAAO,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;IAChF,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,SAAiB;QAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;aACnB,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC;aAC9B,MAAM,CAAC,MAAM,CAAC;aACd,KAAK,EAAE,CAAA;QACV,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,SAAS,CAAC,QAAQ,IAAI,6CAA6C,SAAS,GAAG,EAAE;gBACzF,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,aAAa,CAAC,cAAsB;QAChD,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,IAAI,CAAC,8BAA8B,CAAC;aACpC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,cAAc,CAAC;aAClD,KAAK,CAAC,oBAAoB,EAAE,cAAc,CAAC;aAC3C,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;QACnC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAA;QAC/C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;YAClD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACnB,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QACvC,CAAC;QACD,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,yEAAyE;IAEzE,KAAK,CAAC,SAAS,CAAC,OAAmB,EAAE,UAAkB,EAAE,KAAe;QACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;QAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAErC,qEAAqE;QACrE,yEAAyE;QACzE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI;YACJ,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE;SAChE,CAAC,CAAC,CAAA;QACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QACxD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAE/D,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACjC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI;YACJ,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,gBAAgB,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE;YAC7D,OAAO,EAAE,YAAY,EAAE;SACxB,CAAC,CAAC,CACJ,CAAA;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAErC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QAChD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,KAAK,CACT,OAAmB,EACnB,IAAY,EACZ,KAAe,EACf,UAAwB,EAAE;QAE1B,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAE3C,MAAM,GAAG,GAAG;YACV,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAC9B,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,gBAAgB,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE;SAC9D,CAAA;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS;YAC7B,CAAC,CAAC;gBACE,GAAG,GAAG;gBACN,SAAS,EAAE;oBACT,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE;iBAC1D;aACF;YACH,CAAC,CAAC,GAAG,CAAA;QAEP,oEAAoE;QACpE,gEAAgE;QAChE,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE;YACpC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,kCAAkC,CAAC,MAAM,EAAE;SAC1E,CAAC,CAAA;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE;YACrC,QAAQ,EAAE,EAAE,iBAAiB,EAAE,mCAAmC,CAAC,MAAM,EAAE;SAC5E,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,IAAY,EAAE,KAAe;QAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAC5B;YACE;gBACE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC9B,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,gBAAgB,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE;aAC9D;SACF,EACD,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,kCAAkC,CAAC,MAAM,EAAE,EAAE,CAC9E,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAmB,EAAE,IAAY,EAAE,KAAe;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CACtC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,IAAI;YACJ,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,gBAAgB,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE;YACzD,OAAO,EAAE,YAAY,EAAE;SACxB,CAAC,CAAC,CACJ,CAAA;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAmB,EAAE,UAAkB,EAAE,KAAe;QACjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,SAAS,CAAC,YAAY,UAAU,4BAA4B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1F,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAC3B;YACE;gBACE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC9B,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,gBAAgB,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE;aACpE;SACF,EACD,EAAE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,mCAAmC,CAAC,MAAM,EAAE,EAAE,CAChF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAmB,EAAE,UAAkB,EAAE,KAAe;QACvE,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAC5B;YACE;gBACE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC9B,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,gBAAgB,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE;aACpE;SACF,EACD,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,kCAAkC,CAAC,MAAM,EAAE,EAAE,CAC9E,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,KAAe;QAC9C,sEAAsE;QACtE,MAAM,OAAO,GAAiB,EAAE,CAAA;QAChC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CACnC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACrE,CAAA;QACD,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC3C,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBAC9E,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBACjC,OAAO,EAAE,YAAY,EAAE;aACxB,CAAC,CAAA;YACF,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACrC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;gBACvF,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,qEAAqE;IAC7D,KAAK,CAAC,YAAY,CAAC,OAAmB;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7C,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAC9B,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,YAAY,EAAE;SACxB,CAAC,CAAA;QACF,OAAO,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAA;IACjF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAmB,EAAE,KAAe;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;QAC/B,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;YACjC,IAAI,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM;gBAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACzE,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAmB,EAAE,SAAoB;QAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAA;QACxC,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;YACjC,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAmB,EAAE,UAAkB;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAA;QAEpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEpD,4DAA4D;QAC5D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACjD,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAC9B,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,cAAc;SACrB,CAAC,CAAA;QACF,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC;aACzB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;aAC/B,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;aAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACjC,CAAA;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAA;QAC1C,KAAK,MAAM,EAAE,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;YACjC,IAAI,CAAC,MAAM;gBAAE,SAAQ;YACrB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAE5E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9D,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7B,CAAC;CACF"}

package/build/src/manager.d.ts

@@ -0,0 +1,29 @@
+import type { AuthorizationConfig } from './define_config.js';
+import type { AuthorizationDriver, GrantOptions, ScopeRef, ScopeType, SubjectRef } from './types.js';
+/**
+ * Manager de autorización — la fachada que usan middleware, services y
+ * seeders. Resuelve el driver activo del config y notifica cada escritura
+ * al hook `onWrite` del consumidor (el chasis lo usa para auditar + SSE).
+ *
+ * Pieza del "paquete" de autorización: NO conoce config files, modelos ni
+ * módulos del consumidor — recibe todo por constructor. El singleton de la
+ * app vive en `main.ts` (el único archivo de wiring, fuera del paquete).
+ */
+export declare class AuthorizationManager {
+    #private;
+    constructor(config: AuthorizationConfig);
+    driver(): Promise<AuthorizationDriver>;
+    /** Solo tests: fuerza re-resolución del driver. */
+    clearCachedDriver(): void;
+    authorize(subject: SubjectRef, permission: string, scope: ScopeRef): Promise<boolean>;
+    hasRole(subject: SubjectRef, role: string, scope: ScopeRef): Promise<boolean>;
+    listSubjects(role: string, scope: ScopeRef): Promise<SubjectRef[]>;
+    listScopes(subject: SubjectRef, permission: string): Promise<ScopeRef[]>;
+    listRoles(subject: SubjectRef, scope: ScopeRef): Promise<string[]>;
+    listRoleScopes(subject: SubjectRef, scopeType: ScopeType): Promise<ScopeRef[]>;
+    grant(subject: SubjectRef, role: string, scope: ScopeRef, options?: GrantOptions): Promise<void>;
+    revoke(subject: SubjectRef, role: string, scope: ScopeRef): Promise<void>;
+    deny(subject: SubjectRef, permission: string, scope: ScopeRef): Promise<void>;
+    removeDeny(subject: SubjectRef, permission: string, scope: ScopeRef): Promise<void>;
+}
+//# sourceMappingURL=manager.d.ts.map

package/build/src/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,KAAK,EACV,mBAAmB,EAGnB,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,UAAU,EACX,MAAM,YAAY,CAAA;AAEnB;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;;gBAInB,MAAM,EAAE,mBAAmB;IAIjC,MAAM,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAgB5C,mDAAmD;IACnD,iBAAiB,IAAI,IAAI;IAInB,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrF,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7E,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAIlE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAIxE,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIlE,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAI9E,KAAK,CACT,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,QAAQ,EACf,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,IAAI,CAAC;IAWV,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7E,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAS1F"}

package/build/src/manager.js

@@ -0,0 +1,79 @@
+import { Exception } from '@adonisjs/core/exceptions';
+/**
+ * Manager de autorización — la fachada que usan middleware, services y
+ * seeders. Resuelve el driver activo del config y notifica cada escritura
+ * al hook `onWrite` del consumidor (el chasis lo usa para auditar + SSE).
+ *
+ * Pieza del "paquete" de autorización: NO conoce config files, modelos ni
+ * módulos del consumidor — recibe todo por constructor. El singleton de la
+ * app vive en `main.ts` (el único archivo de wiring, fuera del paquete).
+ */
+export class AuthorizationManager {
+    #config;
+    #driver = null;
+    constructor(config) {
+        this.#config = config;
+    }
+    async driver() {
+        if (this.#driver)
+            return this.#driver;
+        const registry = this.#config.drivers;
+        const factory = registry[this.#config.default];
+        if (!factory) {
+            throw new Exception(`Driver de autorización '${this.#config.default}' no registrado. ` +
+                `Registrados: ${Object.keys(this.#config.drivers).join(', ')}`, { status: 500 });
+        }
+        const driver = await factory();
+        this.#driver = driver;
+        return driver;
+    }
+    /** Solo tests: fuerza re-resolución del driver. */
+    clearCachedDriver() {
+        this.#driver = null;
+    }
+    async authorize(subject, permission, scope) {
+        return (await this.driver()).authorize(subject, permission, scope);
+    }
+    async hasRole(subject, role, scope) {
+        return (await this.driver()).hasRole(subject, role, scope);
+    }
+    async listSubjects(role, scope) {
+        return (await this.driver()).listSubjects(role, scope);
+    }
+    async listScopes(subject, permission) {
+        return (await this.driver()).listScopes(subject, permission);
+    }
+    async listRoles(subject, scope) {
+        return (await this.driver()).listRoles(subject, scope);
+    }
+    async listRoleScopes(subject, scopeType) {
+        return (await this.driver()).listRoleScopes(subject, scopeType);
+    }
+    async grant(subject, role, scope, options) {
+        await (await this.driver()).grant(subject, role, scope, options);
+        await this.#notify({
+            action: 'granted',
+            subject,
+            scope,
+            role,
+            expiresAt: options?.expiresAt ?? null,
+        });
+    }
+    async revoke(subject, role, scope) {
+        await (await this.driver()).revoke(subject, role, scope);
+        await this.#notify({ action: 'revoked', subject, scope, role });
+    }
+    async deny(subject, permission, scope) {
+        await (await this.driver()).deny(subject, permission, scope);
+        await this.#notify({ action: 'denied', subject, scope, permission });
+    }
+    async removeDeny(subject, permission, scope) {
+        await (await this.driver()).removeDeny(subject, permission, scope);
+        await this.#notify({ action: 'deny_removed', subject, scope, permission });
+    }
+    /** El hook es responsabilidad del consumidor; no debe lanzar. */
+    async #notify(event) {
+        await this.#config.hooks?.onWrite?.(event);
+    }
+}
+//# sourceMappingURL=manager.js.map

package/build/src/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAYrD;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IAC/B,OAAO,CAAqB;IAC5B,OAAO,GAA+B,IAAI,CAAA;IAE1C,YAAY,MAA2B;QACrC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAA;QACrC,MAAM,QAAQ,GAA+C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAA;QACjF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACjB,2BAA2B,IAAI,CAAC,OAAO,CAAC,OAAO,mBAAmB;gBAChE,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAChE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAA;QAC9B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;QACrB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,mDAAmD;IACnD,iBAAiB;QACf,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAmB,EAAE,UAAkB,EAAE,KAAe;QACtE,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAmB,EAAE,IAAY,EAAE,KAAe;QAC9D,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,KAAe;QAC9C,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAmB,EAAE,UAAkB;QACtD,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAmB,EAAE,KAAe;QAClD,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACxD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAmB,EAAE,SAAoB;QAC5D,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,KAAK,CACT,OAAmB,EACnB,IAAY,EACZ,KAAe,EACf,OAAsB;QAEtB,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;QAChE,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,MAAM,EAAE,SAAS;YACjB,OAAO;YACP,KAAK;YACL,IAAI;YACJ,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;SACtC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,IAAY,EAAE,KAAe;QAC7D,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QACxD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAmB,EAAE,UAAkB,EAAE,KAAe;QACjE,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;QAC5D,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAmB,EAAE,UAAkB,EAAE,KAAe;QACvE,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;QAClE,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,OAAO,CAAC,KAAsB;QAClC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAA;IAC5C,CAAC;CACF"}

package/build/src/middleware/app_access_middleware.d.ts

@@ -0,0 +1,23 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { NextFn } from '@adonisjs/core/types/http';
+/**
+ * Enforcement del ACL de NIVEL APP (gemelo de orgAccess para el scope
+ * global). Debe ir DESPUÉS de `middleware.auth(...)` — típicamente con el
+ * guard `admins`, aunque funciona con cualquier holder con morph name.
+ *
+ * Reglas:
+ *  - No autenticado → 401.
+ *  - Holder sin el rol/permiso requerido a nivel app → 403.
+ *  - El ACL decide por IDENTIDAD; el scope del token lo acota
+ *    middleware.ability() aparte (el token nunca amplía, solo restringe).
+ *
+ * Uso: middleware.appAccess({ permission: 'audit:read' })
+ *      middleware.appAccess({ role: 'superadmin' })
+ */
+export default class AppAccessMiddleware {
+    handle(ctx: HttpContext, next: NextFn, options?: {
+        permission?: string;
+        role?: string;
+    }): Promise<any>;
+}
+//# sourceMappingURL=app_access_middleware.d.ts.map

package/build/src/middleware/app_access_middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app_access_middleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/app_access_middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAKvD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,OAAO,OAAO,mBAAmB;IAChC,MAAM,CACV,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO;CA0CvD"}