@jantstack/adonis-authz 2.5.0-alpha.1 → 2.5.0-alpha.3

package/build/src/define_config.js

@@ -1,3 +1,4 @@
+import { AuthorizationConfigError } from './errors.js';
 /**
  * **La clave del driver de RELACIONES activo** (2.4.0-alpha.10): `relations.default`
  * y, si falta, el `default` de roles — las relaciones cambian de driver con él.
@@ -9,7 +10,115 @@
 export function activeRelationsDriverKey(config) {
     return config.relations?.default ?? config.default;
 }
+/**
+ * **Listas blancas por nivel de `AuthorizationConfig`** (plan 2.5 · lote B · B2,
+ * gemelo en roles de la propiedad universal del linaje L5: «ninguna clave de
+ * una spec de config se descarta»). Hasta `2.5.0-alpha.1` `defineConfig` era la
+ * identidad: `requireWithing: true` (typo) no exigía nada y nadie lo decía. Una
+ * clave nueva del paquete entra AQUÍ en el mismo commit que su efecto.
+ */
+export const AUTHORIZATION_CONFIG_KEYS = Object.freeze({
+    root: Object.freeze([
+        'default',
+        'drivers',
+        'holderTypes',
+        'openfga',
+        'scopes',
+        'catalogs',
+        'clock',
+        'freezeTimeoutMs',
+        'requireActor',
+        'requireTransactionalWrites',
+        'requireWithin',
+        'warnOnOptInSecurity',
+        'delegablePermissions',
+        'relations',
+        'hooks',
+    ]),
+    openfga: Object.freeze(['url', 'storeId', 'modelId', 'storeName']),
+    scopes: Object.freeze([
+        'resolveChain',
+        'descendantsOf',
+        'enumerateEdges',
+        'maxScopes',
+        'maxDescendants',
+        'maxDepth',
+        'outbox',
+        'acceptScopeDriftRisk',
+    ]),
+    relations: Object.freeze([
+        'config',
+        'default',
+        'drivers',
+        'requireTransactionalWrites',
+        'assertWrite',
+        'onRelationWrite',
+        'requireActor',
+    ]),
+    hooks: Object.freeze(['onWrite', 'onCatalogWrite']),
+});
+const _exhaustiveRoot = {};
+const _exhaustiveOpenFga = {};
+const _exhaustiveScopes = {};
+const _exhaustiveRelations = {};
+const _exhaustiveHooks = {};
+void _exhaustiveRoot, _exhaustiveOpenFga, _exhaustiveScopes, _exhaustiveRelations, _exhaustiveHooks;
+AUTHORIZATION_CONFIG_KEYS.root;
+AUTHORIZATION_CONFIG_KEYS.openfga;
+AUTHORIZATION_CONFIG_KEYS.scopes;
+AUTHORIZATION_CONFIG_KEYS.relations;
+AUTHORIZATION_CONFIG_KEYS.hooks;
+/** ⚪ 13 (gemelo roles): un BLOQUE conocido con un valor que no es un objeto plano (`scopes: true`) es 500, no silencio. */
+function assertConfigBlock(value, path) {
+    if (value === undefined)
+        return;
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new AuthorizationConfigError(`defineConfig: '${path}' tiene que ser un objeto (llegó ${JSON.stringify(value)}). Un valor que no es objeto en ` +
+            `una clave conocida no es «nada»: se ignoraría en silencio (plan 2.5 · B2).`);
+    }
+}
+function assertKnownConfigKeys(value, known, path) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return;
+    for (const key of Object.keys(value)) {
+        if (known.includes(key))
+            continue;
+        const where = path === '' ? `'${key}' en la raíz` : `'${path}.${key}'`;
+        throw new AuthorizationConfigError(`defineConfig: la clave ${where} no existe (claves válidas en ${path === '' ? 'la raíz' : path}: ${known.join(', ')}). ` +
+            `Ninguna clave del config se descarta en silencio (plan 2.5 · B2): un typo ('requireWithing') sería una ` +
+            `política que crees activa y no lo está. Quítala o corrige el nombre.`);
+    }
+}
+/**
+ * Valida la FORMA del config (claves conocidas por nivel: la raíz y los
+ * bloques `openfga`/`scopes`/`relations`/`hooks`) y lo devuelve tal cual
+ * (misma referencia). Lo demás —drivers, catálogos, políticas— lo valida el
+ * manager al resolver.
+ */
 export function defineConfig(config) {
+    assertAuthorizationConfigShape(config);
     return config;
 }
+/**
+ * **El punto de paso ÚNICO de la forma del config de roles** (cierre 1 del lote
+ * B · 🟡 6, auditor: «en roles el punto de paso NO es único»). Hasta el cierre
+ * solo `defineConfig` validaba las claves: un `config/authorization.ts` que
+ * exportara el objeto a pelo (`{ … } satisfies AuthorizationConfig`) o un
+ * `new AuthorizationManager({ requireWithing: true })` se tragaba el typo. La
+ * llaman `defineConfig`, el constructor de `AuthorizationManager` (que cubre el
+ * provider: `new AuthorizationManager(config)`) y `buildRelationsManager` (el
+ * servicio de relaciones, que no construye el manager de roles). Idempotente y
+ * barata (claves, no valores).
+ */
+export function assertAuthorizationConfigShape(config) {
+    if (!config || typeof config !== 'object') {
+        throw new AuthorizationConfigError(`defineConfig: se esperaba un objeto y llegó ${typeof config}.`);
+    }
+    const c = config;
+    assertKnownConfigKeys(c, AUTHORIZATION_CONFIG_KEYS.root, '');
+    for (const block of ['openfga', 'scopes', 'relations', 'hooks']) {
+        assertConfigBlock(c[block], block);
+        assertKnownConfigKeys(c[block], AUTHORIZATION_CONFIG_KEYS[block], block);
+    }
+}
 //# sourceMappingURL=define_config.js.map

package/build/src/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../src/define_config.ts"],"names":[],"mappings":"AAgXA;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA0D;IACjG,OAAO,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,MAAM,CAAC,OAAO,CAAA;AACpD,CAAC;AAED,MAAM,UAAU,YAAY,CAAgC,MAAS;IACnE,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../src/define_config.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAmWtD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA0D;IACjG,OAAO,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,MAAM,CAAC,OAAO,CAAA;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QAClB,SAAS;QACT,SAAS;QACT,aAAa;QACb,SAAS;QACT,QAAQ;QACR,UAAU;QACV,OAAO;QACP,iBAAiB;QACjB,cAAc;QACd,4BAA4B;QAC5B,eAAe;QACf,qBAAqB;QACrB,sBAAsB;QACtB,WAAW;QACX,OAAO;KACC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAU,CAAC;IAC3E,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,cAAc;QACd,eAAe;QACf,gBAAgB;QAChB,WAAW;QACX,gBAAgB;QAChB,UAAU;QACV,QAAQ;QACR,sBAAsB;KACd,CAAC;IACX,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,QAAQ;QACR,SAAS;QACT,SAAS;QACT,4BAA4B;QAC5B,aAAa;QACb,iBAAiB;QACjB,cAAc;KACN,CAAC;IACX,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,gBAAgB,CAAU,CAAC;CAC7D,CAAC,CAAA;AAoBF,MAAM,eAAe,GAAoE,EAAE,CAAA;AAC3F,MAAM,kBAAkB,GAAgE,EAAE,CAAA;AAC1F,MAAM,iBAAiB,GAA8D,EAAE,CAAA;AACvF,MAAM,oBAAoB,GAAoE,EAAE,CAAA;AAChG,MAAM,gBAAgB,GAA4D,EAAE,CAAA;AACpF,KAAK,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,gBAAgB,CAAA;AACnG,yBAAyB,CAAC,IAAqD,CAAA;AAC/E,yBAAyB,CAAC,OAAiD,CAAA;AAC3E,yBAAyB,CAAC,MAA+C,CAAA;AACzE,yBAAyB,CAAC,SAAqD,CAAA;AAC/E,yBAAyB,CAAC,KAA6C,CAAA;AAEvE,2HAA2H;AAC3H,SAAS,iBAAiB,CAAC,KAAc,EAAE,IAAY;IACrD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAM;IAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,wBAAwB,CAChC,kBAAkB,IAAI,oCAAoC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,kCAAkC;YAC/G,4EAA4E,CAC/E,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAwB,EAAE,IAAY;IACnF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAM;IACvE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,EAAE,CAAC;QAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAQ;QACjC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,GAAG,GAAG,CAAA;QACtE,MAAM,IAAI,wBAAwB,CAChC,0BAA0B,KAAK,iCAAiC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACtH,yGAAyG;YACzG,sEAAsE,CACzE,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAgC,MAAS;IACnE,8BAA8B,CAAC,MAAM,CAAC,CAAA;IACtC,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,wBAAwB,CAAC,+CAA+C,OAAO,MAAM,GAAG,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,CAAC,GAAG,MAA6B,CAAA;IACvC,qBAAqB,CAAC,CAAC,EAAE,yBAAyB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC5D,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAU,EAAE,CAAC;QACzE,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;QAClC,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,yBAAyB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC"}

package/build/src/drivers/database_relations_driver.d.ts

@@ -1,7 +1,13 @@
 import { relationPartitionTrigger, relationPartitionTriggerDrops } from '../relation_partition_trigger.js';
 import type { Clock } from '../clock.js';
-import type { RelObject, RelSubject, RelationObjectsPage, RelationSubjectsPage, RelationPage, RelationTuplePage, RelationsDriver, RelationsDriverCapabilities, RelationTransactionOptions, RelationWriteOptions, ScopeRef } from '../types.js';
+import type { RelObject, RelSubject, RelationObjectsPage, RelationSubjectsPage, RelationPage, RelationTuplePage, RelationsDriver, RelationsDriverCapabilities, RelationTransactionOptions, RelationWriteOptions, RelationDenyOptions, RelationDecision, ScopeRef } from '../types.js';
 import type { RelationsConfig } from '../relations/define_relations_config.js';
+/**
+ * **Cota de candidatos de `membersOf` cuando el objeto tiene un deny vigente** (lote D · cierre 1 de D1, 🟡 4): con deny
+ * cada candidato se juzga con un `check` (una CTE por candidato). Pasada ⇒ 500 `E_AUTHZ_MEMBERS_DENY_LIMIT`, nunca una
+ * lista parcial. En «Limits» del README, atada a esta constante (`scope_depth.spec`).
+ */
+export declare const RELATIONS_MEMBERS_DENY_CHECK_MAX = 1000;
 export { relationPartitionTrigger, relationPartitionTriggerDrops };
 export interface DatabaseRelationsDriverOptions {
     /** Nombre de la conexión Lucid (default: la primaria). */
@@ -73,6 +79,15 @@ export declare class DatabaseRelationsDriver implements RelationsDriver {
      */
     withClock(now: Clock): RelationsDriver;
     relate(subject: RelSubject, relation: string, object: RelObject, partition: ScopeRef, options?: RelationWriteOptions): Promise<void>;
+    /**
+     * **`deny` = la tupla `denied_<rel>`, por el MISMO camino idempotente que `relate`** (lote D · D1): F-05 sobre el
+     * nombre PÚBLICO, la puerta de escritura del opt-in (fase `'write'`, D10), ni `group` ni `*`, y SIN caducidad (D3:
+     * `expiresAt` ⇒ 422; un deny escrito a mano con caducidad se rehace permanente). Por la transacción del llamante si
+     * llega (L-4, como `relate`).
+     */
+    deny(subject: RelSubject, relation: string, object: RelObject, partition: ScopeRef, options?: RelationDenyOptions): Promise<void>;
+    /** `removeDeny`: borra la tupla `denied_<rel>`. Sobre CUALQUIER tipo declarado (D8/R2-4 b). No-op si no está. */
+    removeDeny(subject: RelSubject, relation: string, object: RelObject, partition: ScopeRef, options?: RelationDenyOptions): Promise<void>;
     unrelate(subject: RelSubject, relation: string, object: RelObject, partition: ScopeRef, options?: RelationWriteOptions): Promise<void>;
     /**
      * **F-05 en las LECTURAS y las PURGAS del driver** (2.4.0-alpha.3, cierre
@@ -96,8 +111,28 @@ export declare class DatabaseRelationsDriver implements RelationsDriver {
      * de la consulta (defensa en profundidad: el manager ya lo hizo).
      */
     checkMany(subject: RelSubject, relation: string, objects: RelObject[], partition: ScopeRef): Promise<boolean[]>;
+    /**
+     * **`decideMany` = la consulta de `checkMany`** (lote D · D9): los grants de `down*(R)` y los denies de
+     * `up*(down*(R))` de cada objeto distinto, con UN `now` y en UNA consulta, y la regla AMPLIA de `decideFrom` (la
+     * misma función que el doble y `openfga` cuando alinea su `batchCheck`). Tope, `[]` y F-05 por ítem como `checkMany`.
+     */
+    decideMany(subject: RelSubject, relation: string, objects: RelObject[], partition: ScopeRef): Promise<RelationDecision[]>;
     listObjects(subject: RelSubject, relation: string, objectType: string, partition: ScopeRef, _page?: RelationPage): Promise<RelationObjectsPage>;
     listSubjects(relation: string, object: RelObject, partition: ScopeRef, _page?: RelationPage): Promise<RelationSubjectsPage>;
+    /**
+     * **`listDenies`** (lote D · D1): los sujetos con deny DIRECTO de `relation` sobre `object` —hechos, como
+     * `listSubjects` sobre la relación almacenada `denied_<rel>`; no resta ni deriva—. Sobre CUALQUIER tipo declarado
+     * (D8/R2-4 b: con el opt-in retirado, los denies vivos se siguen pudiendo listar y borrar).
+     */
+    listDenies(relation: string, object: RelObject, partition: ScopeRef, page?: RelationPage): Promise<RelationSubjectsPage>;
+    /**
+     * **`denyPhase` — ¿admite este driver escrituras de deny en el tipo?** (lote D · D2, R2-5): la fase del opt-in EN
+     * LA CONFIG DE ESTE DRIVER (`'write'`, `'read'` o `null`). F-05 estricto del par (422), cero sentencias: es
+     * configuración. La llama `reconcileRelations` en la fase de plan cuando el origen trae denies.
+     */
+    denyPhase(object: {
+        type: string;
+    }, relation: string): Promise<'read' | 'write' | null>;
     /**
      * Membresía TRANSITIVA de un objeto-grupo: todos los HOLDERS que son `member`
      * directa o a través de grupos anidados (usersets `group#member`). CTE

package/build/src/drivers/database_relations_driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database_relations_driver.d.ts","sourceRoot":"","sources":["../../../src/drivers/database_relations_driver.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAA;AAE1G,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAOxC,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EAEZ,iBAAiB,EACjB,eAAe,EACf,2BAA2B,EAC3B,0BAA0B,EAC1B,oBAAoB,EACpB,QAAQ,EAET,MAAM,aAAa,CAAA;AAGpB,OAAO,KAAK,EAAE,eAAe,EAA0B,MAAM,yCAAyC,CAAA;AAmDtG,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,CAAA;AAElE,MAAM,WAAW,8BAA8B;IAC7C,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAA;IACX;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AAuBD;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,eAAe;;IAC7D;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAA;gBAiB1D,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,8BAAmC,EAC5C,QAAQ,GAAE;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;KAAO;IAoBnF;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,KAAK,GAAG,eAAe;IA2NhC,MAAM,CACV,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,IAAI,CAAC;IAkFV,QAAQ,CACZ,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,IAAI,CAAC;IA8BhB;;;;;;;;;OASG;IACG,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAyB5G;;;;;;;;;OASG;IACG,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAgD/G,WAAW,CACf,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,QAAQ,EACnB,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,mBAAmB,CAAC;IA4BzB,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,QAAQ,EACnB,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,oBAAoB,CAAC;IAwBhC;;;;;;OAMG;IACG,SAAS,CACb,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,QAAQ,EACnB,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,oBAAoB,CAAC;IA6D1B,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBxG,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBjH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,kBAAkB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAO9F;;;;;;;;;;;;;;;OAeG;IACG,sBAAsB,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAuGtG"}
+{"version":3,"file":"database_relations_driver.d.ts","sourceRoot":"","sources":["../../../src/drivers/database_relations_driver.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAA;AAE1G,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAOxC,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EAEZ,iBAAiB,EACjB,eAAe,EACf,2BAA2B,EAC3B,0BAA0B,EAC1B,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,QAAQ,EAET,MAAM,aAAa,CAAA;AAkBpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAA;AAG9E;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,OAAQ,CAAA;AAiDrD,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,CAAA;AAElE,MAAM,WAAW,8BAA8B;IAC7C,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAA;IACX;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AAuBD;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,eAAe;;IAC7D;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAA;gBAiB1D,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,8BAAmC,EAC5C,QAAQ,GAAE;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;KAAO;IA0BnF;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,KAAK,GAAG,eAAe;IAqOhC,MAAM,CACV,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,IAAI,CAAC;IAchB;;;;;OAKG;IACG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvI,iHAAiH;IAC3G,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwFvI,QAAQ,CACZ,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,IAAI,CAAC;IA0ChB;;;;;;;;;OASG;IACG,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IA6B5G;;;;;;;;;OASG;IACG,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IASrH;;;;OAIG;IACG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IA4EzH,WAAW,CACf,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,QAAQ,EACnB,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,mBAAmB,CAAC;IAyCzB,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,QAAQ,EACnB,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,oBAAoB,CAAC;IAmChC;;;;OAIG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAO9H;;;;OAIG;IACG,SAAS,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAK7F;;;;;;OAMG;IACG,SAAS,CACb,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,QAAQ,EACnB,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,oBAAoB,CAAC;IAuG1B,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBxG,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBjH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,kBAAkB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAO9F;;;;;;;;;;;;;;;OAeG;IACG,sBAAsB,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAyGtG"}