@jini-ai/cms 0.1.0

package/dist/identity/admin-crud-service.js

@@ -0,0 +1,437 @@
+import { resolveEffectivePermissions } from "./authorize.js";
+import { assertCallerHasAnyPermission, assertGrantClamp, authorizeDepsFrom } from "./grant-service.js";
+import { validatePasswordPolicy } from "./password-policy.js";
+import { isKnownPermission } from "./permissions.js";
+import { IdentityConflictError, IdentityNotFoundError, IdentityValidationError, OwnerRequiredError, PermissionUnknownError, } from "./types.js";
+/**
+ * @file An amendment that completes the users/roles/policies admin CRUD surface
+ * (feature.spec.md REQ-11/REQ-15..19).
+ *
+ * Purpose:
+ * Two of these nine transitions (`disablePrincipal`, `writePolicyPermission`) were fully specified
+ * since v0.5.0/v0.5.3 but never implemented — this file is their first implementation, not a
+ * re-specification (AC-32). The other seven (`enablePrincipal`, `updateUser`,
+ * `resetUserPassword`, `updateRole`, `updatePolicy`, `deleteRole`, `deletePolicy`) are new
+ * transitions this amendment adds. Grouped in one file, separate from `grant-service.ts`'s
+ * "human grant-writing transitions" (`CREATE_*`/`ASSIGN_ROLE`/`ATTACH_POLICY`) because most of
+ * these are plain CRUD, not grant-writing — `writePolicyPermission` is the one exception (it IS
+ * INV-07-clamped) and reuses `grant-service.ts`'s exported `assertGrantClamp` rather than
+ * duplicating it.
+ *
+ * Architectural role:
+ * Ordinary core functions — same shape as `grant-service.ts`: one exported async
+ * function per transition, plain `Error` subclasses for control flow, the caller-permission gate
+ * enforced here (not pushed to the route layer).
+ */
+/**
+ * `DISABLE_PRINCIPAL` (feature.spec.md REQ-11, state.spec §3, AC-08/AC-21/AC-27). Gated by
+ * `user.manage`. Refuses the seeded owner unconditionally (REQ-13's CLI/core resolution target —
+ * disabling it would strand the CLI-only management plane) and refuses any disable that would drop
+ * the workspace's active owner-`*` count to zero (INV-08) — both checked, and the status update
+ * performed, inside this one function body with no `await` yielded to another caller in between
+ * (this codebase's established "atomic by construction" reasoning for a single-connection,
+ * single-event-loop composition — same as `features/workspace/delete.ts`'s INV-03 guard).
+ *
+ * `input.seededOwnerPrincipalId` is the caller's job to resolve (`await deps.ownerPrincipalId` at
+ * the route layer, mirroring `identityReady`'s existing await-before-use convention) — this
+ * function takes the already-resolved id so it stays a plain, directly-testable function.
+ *
+ * @complexity O(n) in the workspace's principal count (one `list()` call to count active owner-`*`
+ * holders) — bounded by the same operator-managed-roster assumption `identity/INFO.md` already
+ * makes for `PrincipalRepoPort.list()`.
+ * @overallScore 100
+ */
+export async function disablePrincipal(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["user.manage"],
+    });
+    const target = await deps.repos.principals.findById({ workspaceId: input.workspaceId, id: input.principalId });
+    if (!target)
+        throw new IdentityNotFoundError(`principal '${input.principalId}' was not found`);
+    if (target.id === input.seededOwnerPrincipalId) {
+        throw new OwnerRequiredError("the seeded owner principal can never be disabled (REQ-11/REQ-13)");
+    }
+    if (target.status === "disabled") {
+        // Idempotent — matches LOGOUT's "already revoked is a no-op" discipline (state.spec §3).
+        return { principal: target };
+    }
+    const holdsOwnerWildcard = await principalHoldsOwnerWildcard({
+        deps,
+        workspaceId: input.workspaceId,
+        principalId: target.id,
+    });
+    if (holdsOwnerWildcard) {
+        const activeOwnerCount = await countActiveOwnerWildcardPrincipals({ deps, workspaceId: input.workspaceId });
+        if (activeOwnerCount <= 1) {
+            throw new OwnerRequiredError("the workspace must keep at least one active owner-`*` principal (INV-08)");
+        }
+    }
+    const disabled = { ...target, status: "disabled", disabledAt: deps.clock.nowIso() };
+    await deps.repos.principals.save(disabled);
+    return { principal: disabled };
+}
+/**
+ * `ENABLE_PRINCIPAL` (feature.spec.md REQ-15, AC-27, EC-14). Gated by `user.manage`. Target must be
+ * `kind='user'` — a `system`/`api_key` target is rejected `VALIDATION_ERROR` (mirrors AC-25b's
+ * human-only scoping; re-activating the disabled legacy `user-local` stub or an api_key principal
+ * outside `ISSUE_API_KEY`'s own lifecycle is never a valid call). Already-active is idempotent
+ * (mirrors `disablePrincipal`'s own already-disabled no-op above).
+ *
+ * @complexity O(1) — one lookup, one save.
+ * @overallScore 100
+ */
+export async function enablePrincipal(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["user.manage"],
+    });
+    const target = await deps.repos.principals.findById({ workspaceId: input.workspaceId, id: input.principalId });
+    if (!target)
+        throw new IdentityNotFoundError(`principal '${input.principalId}' was not found`);
+    if (target.kind !== "user") {
+        throw new IdentityValidationError(`ENABLE_PRINCIPAL target must be a human (kind='user') principal, got kind='${target.kind}'`);
+    }
+    if (target.status === "active") {
+        return { principal: target };
+    }
+    const enabled = { ...target, status: "active", disabledAt: undefined };
+    await deps.repos.principals.save(enabled);
+    return { principal: enabled };
+}
+/**
+ * `UPDATE_USER` (feature.spec.md REQ-16, AC-28). Gated by `user.manage` **or** `member.manage`
+ * (mirrors `CREATE_USER`'s admin-onboarding gate) — `email` only; `username`/`password` are not
+ * this transition's concern (OQ-09 / REQ-17 respectively). An absent or empty-string `email`
+ * clears the stored value to `undefined` (EC-17 — no distinct "blank but present" state).
+ *
+ * @complexity O(1) — one lookup, one save.
+ * @overallScore 100
+ */
+export async function updateUser(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["user.manage", "member.manage"],
+    });
+    const target = await deps.repos.users.findByPrincipalId({
+        workspaceId: input.workspaceId,
+        principalId: input.principalId,
+    });
+    if (!target)
+        throw new IdentityNotFoundError(`user '${input.principalId}' was not found`);
+    const updated = { ...target, email: input.email ? input.email : undefined };
+    await deps.repos.users.save(updated);
+    return { user: updated };
+}
+/**
+ * `RESET_USER_PASSWORD` (feature.spec.md REQ-17, AC-29, EC-16). Gated by **`user.manage`** only
+ * (stricter than `updateUser` — resetting a credential is at least as sensitive as disabling the
+ * account, REQ-17's own reasoning). Hashes the new password identically to `CREATE_USER` (argon2id,
+ * INV-05), then revokes every one of the target's active sessions (idempotent no-op if it has none,
+ * EC-16) — a reset that left old sessions alive would not actually contain a compromised account.
+ *
+ * @complexity O(s) in the target's session count, s = active session rows to revoke — bounded by
+ * the same operator-managed-roster scale assumption every other identity list call here makes.
+ * @overallScore 100
+ */
+export async function resetUserPassword(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["user.manage"],
+    });
+    const target = await deps.repos.users.findByPrincipalId({
+        workspaceId: input.workspaceId,
+        principalId: input.principalId,
+    });
+    if (!target)
+        throw new IdentityNotFoundError(`user '${input.principalId}' was not found`);
+    if (!input.password) {
+        throw new IdentityValidationError("password is required");
+    }
+    // Same NIST SP 800-63B length-only policy `createUser` applies. Both write paths must enforce
+    // it or neither does: a reset that accepted a 1-character password would be a strictly easier
+    // way to reach the state the create-side check exists to prevent. Never reaches `seed.ts`'s
+    // owner password or the login path — see `password-policy.ts`'s header for why.
+    const passwordError = validatePasswordPolicy(input.password);
+    if (passwordError) {
+        throw new IdentityValidationError(passwordError);
+    }
+    const passwordHash = await deps.hasher.hash(input.password);
+    const updated = { ...target, passwordHash };
+    await deps.repos.users.save(updated);
+    const sessions = await deps.repos.sessions.listByPrincipalId({
+        workspaceId: input.workspaceId,
+        principalId: input.principalId,
+    });
+    const nowIso = deps.clock.nowIso();
+    await Promise.all(sessions
+        .filter((session) => !session.revokedAt)
+        .map((session) => deps.repos.sessions.revoke({ workspaceId: input.workspaceId, id: session.id, revokedAt: nowIso })));
+    return { user: updated };
+}
+/**
+ * `UPDATE_ROLE` (feature.spec.md REQ-18, AC-30). Gated by `role.manage`. A built-in target is
+ * refused `VALIDATION_ERROR` — extends INV-06's existing undeletable/immutable/un-attachable-to
+ * rule to also cover un-renameable (same escalation shape: relabeling `viewer` to read as trusted
+ * is a social-engineering variant of what INV-06 already blocks structurally).
+ *
+ * @complexity O(1) — one lookup, one save.
+ * @overallScore 100
+ */
+export async function updateRole(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["role.manage"],
+    });
+    const target = await deps.repos.roles.findById({ workspaceId: input.workspaceId, id: input.roleId });
+    if (!target)
+        throw new IdentityNotFoundError(`role '${input.roleId}' was not found`);
+    if (target.isBuiltin) {
+        throw new IdentityValidationError("a built-in role cannot be renamed (INV-06)");
+    }
+    const name = (input.name ?? "").trim();
+    if (!name)
+        throw new IdentityValidationError("role name is required");
+    const updated = { ...target, name };
+    await deps.repos.roles.save(updated);
+    return { role: updated };
+}
+/**
+ * `UPDATE_POLICY` (feature.spec.md REQ-18, AC-30). Gated by `role.manage`. A built-in or
+ * `is_frozen` target is refused `VALIDATION_ERROR` — the frozen-policy half mirrors
+ * `WRITE_POLICY_PERMISSION`'s existing refusal (AC-26): an issuance snapshot's identity is as
+ * immutable as its permission set. At least one of `name`/`description` must be present.
+ *
+ * @complexity O(1) — one lookup, one save.
+ * @overallScore 100
+ */
+export async function updatePolicy(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["role.manage"],
+    });
+    const target = await deps.repos.policies.findById({ workspaceId: input.workspaceId, id: input.policyId });
+    if (!target)
+        throw new IdentityNotFoundError(`policy '${input.policyId}' was not found`);
+    if (target.isBuiltin || target.isFrozen) {
+        throw new IdentityValidationError("a built-in or frozen policy cannot be renamed/re-described (INV-06/AC-26)");
+    }
+    if (input.name === undefined && input.description === undefined) {
+        throw new IdentityValidationError("at least one of name or description is required");
+    }
+    const name = input.name !== undefined ? input.name.trim() : target.name;
+    if (!name)
+        throw new IdentityValidationError("policy name is required");
+    const updated = {
+        ...target,
+        name,
+        description: input.description !== undefined ? input.description : target.description,
+    };
+    await deps.repos.policies.save(updated);
+    return { policy: updated };
+}
+/**
+ * `DELETE_ROLE` (feature.spec.md REQ-19/INV-09, AC-31, EC-15). Gated by `role.manage`. A built-in
+ * target is refused `VALIDATION_ERROR` (checked before the reference count, matching AC-31's
+ * stated precedence). A still-referenced target (≥1 `principal_roles` row) is refused
+ * `IdentityConflictError` (409 `RESOURCE_CONFLICT`) — the reference check and the delete happen in
+ * this one function body with no yielded `await` in between (INV-09's atomicity, same reasoning as
+ * `disablePrincipal`'s owner-count guard above).
+ *
+ * @complexity O(a) in the role's assignment count (`principalRoles.listByRoleId`) — bounded by the
+ * same operator-managed-roster assumption every other identity list call makes.
+ * @overallScore 100
+ */
+export async function deleteRole(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["role.manage"],
+    });
+    const target = await deps.repos.roles.findById({ workspaceId: input.workspaceId, id: input.roleId });
+    if (!target)
+        throw new IdentityNotFoundError(`role '${input.roleId}' was not found`);
+    if (target.isBuiltin) {
+        throw new IdentityValidationError("a built-in role cannot be deleted (INV-06)");
+    }
+    const assignments = await deps.repos.principalRoles.listByRoleId({
+        workspaceId: input.workspaceId,
+        roleId: input.roleId,
+    });
+    if (assignments.length > 0) {
+        throw new IdentityConflictError(`role '${input.roleId}' is still assigned to ${assignments.length} principal(s) (INV-09)`);
+    }
+    await deps.repos.roles.delete({ workspaceId: input.workspaceId, id: input.roleId });
+}
+/**
+ * `DELETE_POLICY` (feature.spec.md REQ-19/INV-09, AC-31, EC-15). Gated by `role.manage`. A
+ * built-in or `is_frozen` target is refused `VALIDATION_ERROR` (checked before the reference
+ * count). A still-referenced target (≥1 `role_policies` or `principal_policies` row) is refused
+ * `IdentityConflictError`. On success, cascades to the policy's OWN `policy_permissions` rows only
+ * (never a different policy's) before deleting the policy row itself.
+ *
+ * @complexity O(r + p) — role-reference count + principal-reference count, both bounded by the same
+ * operator-managed-roster assumption every other identity list call makes.
+ * @overallScore 100
+ */
+export async function deletePolicy(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["role.manage"],
+    });
+    const target = await deps.repos.policies.findById({ workspaceId: input.workspaceId, id: input.policyId });
+    if (!target)
+        throw new IdentityNotFoundError(`policy '${input.policyId}' was not found`);
+    if (target.isBuiltin || target.isFrozen) {
+        throw new IdentityValidationError("a built-in or frozen policy cannot be deleted (INV-06/AC-26)");
+    }
+    const [roleRefs, principalRefs] = await Promise.all([
+        deps.repos.rolePolicies.listByPolicyId({ workspaceId: input.workspaceId, policyId: input.policyId }),
+        deps.repos.principalPolicies.listByPolicyId({ workspaceId: input.workspaceId, policyId: input.policyId }),
+    ]);
+    const referenceCount = roleRefs.length + principalRefs.length;
+    if (referenceCount > 0) {
+        throw new IdentityConflictError(`policy '${input.policyId}' is still referenced by ${referenceCount} row(s) (INV-09)`);
+    }
+    await deps.repos.policyPermissions.deleteByPolicyId({ workspaceId: input.workspaceId, policyId: input.policyId });
+    await deps.repos.policies.delete({ workspaceId: input.workspaceId, id: input.policyId });
+}
+/**
+ * `WRITE_POLICY_PERMISSION` (feature.spec.md INV-07, state.spec §3, AC-10/AC-24/AC-26). First HTTP
+ * implementation of a transition specified since v0.5.3 (AC-32 — this is a route, not a
+ * re-specification). Gated by `role.manage`. Refuses an unregistered permission
+ * (`PermissionUnknownError`, REQ-03), a built-in or `is_frozen` parent policy (INV-06/AC-26), and
+ * (via the shared `assertGrantClamp`) a permission the caller does not itself hold unconstrained
+ * (INV-07, `GrantExceedsIssuerError`).
+ *
+ * @complexity O(assertGrantClamp) — see that function's own doc (resolveEffectivePermissions +
+ * O(1) local filtering, one permission).
+ * @overallScore 100
+ */
+export async function writePolicyPermission(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["role.manage"],
+    });
+    if (!isKnownPermission(input.permission)) {
+        throw new PermissionUnknownError(`permission '${input.permission}' is not in the registered catalog`);
+    }
+    const policy = await deps.repos.policies.findById({ workspaceId: input.workspaceId, id: input.policyId });
+    if (!policy)
+        throw new IdentityNotFoundError(`policy '${input.policyId}' was not found`);
+    if (policy.isBuiltin || policy.isFrozen) {
+        throw new IdentityValidationError("cannot write a permission onto a built-in or frozen policy (INV-06/AC-26)");
+    }
+    await assertGrantClamp({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        conferredPermissions: [input.permission],
+    });
+    const policyPermission = {
+        id: deps.idGen.newId(),
+        workspaceId: input.workspaceId,
+        policyId: input.policyId,
+        permission: input.permission,
+        resourceType: input.resourceType ?? null,
+        constraintJson: input.constraintJson ?? null,
+    };
+    await deps.repos.policyPermissions.save(policyPermission);
+    return { policyPermission };
+}
+/**
+ * `REMOVE_POLICY_PERMISSION` (OQ-10) — the inverse of {@link writePolicyPermission}, and the
+ * transition whose absence made a policy's permission set append-only: the only way to shrink one
+ * was `deletePolicy` + recreate, which INV-09 blocks outright the moment anything references the
+ * policy.
+ *
+ * Gated by `role.manage`, the same permission `writePolicyPermission` and `deletePolicy` require.
+ * Deliberately NOT clamped by `assertGrantClamp` (INV-07): the clamp exists to stop a caller
+ * conferring authority it does not itself hold, and removal confers nothing — it is a strict
+ * de-escalation. Requiring the clamp here would mean an admin who cannot grant `content.write`
+ * also cannot take it back, which is the wrong direction for a safety rule. This is strictly less
+ * powerful than the already-unclamped `deletePolicy`, which drops EVERY permission row the policy
+ * has.
+ *
+ * Refuses a built-in or `is_frozen` parent policy (INV-06/AC-26), checked BEFORE the row lookup so
+ * a frozen policy reports why it is frozen rather than leaking whether the row exists. A row that
+ * is absent — or that exists but belongs to a DIFFERENT policy — is one and the same
+ * `IdentityNotFoundError`: membership is proven from `listByPolicyId`'s result, so a caller can
+ * never delete across a policy boundary by guessing an id.
+ *
+ * @complexity O(n) in the policy's own permission-row count (one `listByPolicyId`) — bounded by the
+ * same operator-managed-roster assumption every other identity list call makes.
+ */
+export async function removePolicyPermission(required) {
+    const { deps, input } = required;
+    await assertCallerHasAnyPermission({
+        deps,
+        workspaceId: input.workspaceId,
+        callerPrincipalId: input.callerPrincipalId,
+        permissions: ["role.manage"],
+    });
+    const policy = await deps.repos.policies.findById({ workspaceId: input.workspaceId, id: input.policyId });
+    if (!policy)
+        throw new IdentityNotFoundError(`policy '${input.policyId}' was not found`);
+    if (policy.isBuiltin || policy.isFrozen) {
+        throw new IdentityValidationError("cannot remove a permission from a built-in or frozen policy (INV-06/AC-26)");
+    }
+    const rows = await deps.repos.policyPermissions.listByPolicyId({
+        workspaceId: input.workspaceId,
+        policyId: input.policyId,
+    });
+    const target = rows.find((row) => row.id === input.policyPermissionId);
+    if (!target) {
+        throw new IdentityNotFoundError(`policy permission '${input.policyPermissionId}' was not found on policy '${input.policyId}'`);
+    }
+    await deps.repos.policyPermissions.delete({ workspaceId: input.workspaceId, id: target.id });
+}
+/** True iff `principalId` holds the owner wildcard `*` (unconstrained) in its effective set. */
+async function principalHoldsOwnerWildcard(required) {
+    const { deps, workspaceId, principalId } = required;
+    const effectiveRows = await resolveEffectivePermissions({
+        deps: authorizeDepsFrom(deps.repos),
+        principalId,
+        workspaceId,
+    });
+    return effectiveRows.some((row) => row.permission === "*" && row.resourceType == null && row.constraintJson == null);
+}
+/**
+ * Count `active` principals in `workspaceId` that hold the owner wildcard `*` (INV-08's own
+ * definition of "owner-`*` principal"). O(n) in the workspace's principal count, n bounded by the
+ * same operator-managed-roster assumption `identity/INFO.md` documents.
+ */
+async function countActiveOwnerWildcardPrincipals(required) {
+    const { deps, workspaceId } = required;
+    const principals = await deps.repos.principals.list({ workspaceId });
+    const activePrincipals = principals.filter((principal) => principal.status === "active");
+    const flags = await Promise.all(activePrincipals.map((principal) => principalHoldsOwnerWildcard({ deps, workspaceId, principalId: principal.id })));
+    return flags.filter(Boolean).length;
+}
+//# sourceMappingURL=admin-crud-service.js.map

package/dist/identity/admin-crud-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-crud-service.js","sourceRoot":"","sources":["../../src/identity/admin-crud-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,GAMvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAGtC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,cAAc,KAAK,CAAC,WAAW,iBAAiB,CAAC,CAAC;IAE/F,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,sBAAsB,EAAE,CAAC;QAC/C,MAAM,IAAI,kBAAkB,CAAC,kEAAkE,CAAC,CAAC;IACnG,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,yFAAyF;QACzF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,2BAA2B,CAAC;QAC3D,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,MAAM,CAAC,EAAE;KACvB,CAAC,CAAC;IACH,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5G,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAC1B,0EAA0E,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAoB,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;IACrG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAGrC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,cAAc,KAAK,CAAC,WAAW,iBAAiB,CAAC,CAAC;IAE/F,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAC/B,8EAA8E,MAAM,CAAC,IAAI,GAAG,CAC7F,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,OAAO,GAAoB,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACxF,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAGhC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;KAC9C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACtD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,KAAK,CAAC,WAAW,iBAAiB,CAAC,CAAC;IAE1F,MAAM,OAAO,GAAe,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACxF,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAGvC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACtD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,KAAK,CAAC,WAAW,iBAAiB,CAAC,CAAC;IAE1F,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;IAC5D,CAAC;IACD,8FAA8F;IAC9F,8FAA8F;IAC9F,4FAA4F;IAC5F,gFAAgF;IAChF,MAAM,aAAa,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAe,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACxD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAErC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ;SACL,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CACvH,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAGhC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;IAEtE,MAAM,OAAO,GAAe,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAGlC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,WAAW,KAAK,CAAC,QAAQ,iBAAiB,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAAC,2EAA2E,CAAC,CAAC;IACjH,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,uBAAuB,CAAC,iDAAiD,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IACxE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;IAExE,MAAM,OAAO,GAAiB;QAC5B,GAAG,MAAM;QACT,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW;KACtF,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAGhC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC;QAC/D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,qBAAqB,CAC7B,SAAS,KAAK,CAAC,MAAM,0BAA0B,WAAW,CAAC,MAAM,wBAAwB,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAGlC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,WAAW,KAAK,CAAC,QAAQ,iBAAiB,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAAC,8DAA8D,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;KAC1G,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;IAC9D,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,qBAAqB,CAC7B,WAAW,KAAK,CAAC,QAAQ,4BAA4B,cAAc,kBAAkB,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClH,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAU3C;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,sBAAsB,CAAC,eAAe,KAAK,CAAC,UAAU,oCAAoC,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,WAAW,KAAK,CAAC,QAAQ,iBAAiB,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,CAAC;QACrB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,oBAAoB,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;KACzC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAA2B;QAC/C,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;KAC7C,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1D,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAG5C;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,4BAA4B,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,WAAW,KAAK,CAAC,QAAQ,iBAAiB,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC;QAC7D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,qBAAqB,CAC7B,sBAAsB,KAAK,CAAC,kBAAkB,8BAA8B,KAAK,CAAC,QAAQ,GAAG,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,2BAA2B,CAAC,QAI1C;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;IACpD,MAAM,aAAa,GAAG,MAAM,2BAA2B,CAAC;QACtD,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QACnC,WAAW;QACX,WAAW;KACZ,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;AACvH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kCAAkC,CAAC,QAGjD;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;IACvC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,gBAAgB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACjC,2BAA2B,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAC9E,CACF,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC"}

package/dist/identity/agent-tool-input.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @file The enforcing boundary parser for identity agent-tool input — the identity domain's
+ * analogue of `features/content-types/field-defs.ts`.
+ *
+ * Deliberate divergence from content-types, disclosed:
+ * content-types hand-authors its published `inputSchema` and hand-authors `field-defs.ts`
+ * separately, then pins the two together with a fixture corpus
+ * (`agent-tools.schema-agreement.unit.test.ts`) because deriving one from the other would have
+ * needed either a JSON Schema library this project does not depend on or a code generator. That
+ * reasoning does not carry over here: identity's schemas use five keywords and describe flat
+ * objects of strings, so INTERPRETING the published schema is ~40 lines. This file does that
+ * instead, which makes the published contract and the enforced contract the same artifact — the
+ * drift content-types has to test for cannot exist here by construction.
+ *
+ * What remains genuinely testable, and is tested in
+ * `__tests__/agent-tools.schema-agreement.test.ts`: that this interpreter actually implements
+ * every keyword the catalog uses (an unknown keyword fails loudly rather than being ignored, which
+ * is the one way a schema could still promise something unenforced), and that the wired handlers
+ * really route their input through here rather than reading `ctx.input` directly.
+ *
+ * Architectural role:
+ * `identity` library, pure. No I/O, no enforcement of permissions — this is shape validation only.
+ * Returns a `Result` rather than throwing so the caller decides how a rejection is surfaced.
+ */
+export type IdentityToolInputResult = {
+    ok: true;
+    value: Readonly<Record<string, string>>;
+} | {
+    ok: false;
+    error: Error;
+};
+/**
+ * Validates `input` against a tool's own published `inputSchema` and returns the extracted string
+ * values.
+ *
+ * Every identity tool's input is a closed, flat object whose properties are all strings, so the
+ * return type is narrowed to `Record<string, string>` — a caller reads `value.principalId` without
+ * re-checking the type, which is what keeps the handlers in `tool-registrations.ts` free of ad hoc
+ * `typeof` guards that could disagree with the schema.
+ *
+ * Rejection messages name the offending KEY and the rule it broke, and never echo the offending
+ * VALUE: a tool input carries operator content (a username, an email) and these messages travel
+ * back to the model and into the tool-attempt audit trail.
+ *
+ * @param required.schema - The tool's published `inputSchema`, used as the contract itself.
+ * @param required.input - The raw `ctx.input`, of any shape.
+ * @returns `{ok:true, value}` with each declared property present in `input` extracted, or
+ * `{ok:false, error}` naming the first violation found.
+ * @throws {Error} Only if the schema itself is uninterpretable — a developer error, distinct from
+ * a bad input, and therefore not folded into the `Result`.
+ * @complexity O(p) in the declared property count plus O(k) in the input's own key count.
+ * @overallScore 100
+ */
+export declare function parseIdentityToolInput(required: {
+    schema: Readonly<Record<string, unknown>>;
+    input: unknown;
+}): IdentityToolInputResult;
+//# sourceMappingURL=agent-tool-input.d.ts.map

package/dist/identity/agent-tool-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-tool-input.d.ts","sourceRoot":"","sources":["../../src/identity/agent-tool-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAgChC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE;IAC/C,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,uBAAuB,CAgD1B"}

package/dist/identity/agent-tool-input.js

@@ -0,0 +1,126 @@
+/**
+ * @file The enforcing boundary parser for identity agent-tool input — the identity domain's
+ * analogue of `features/content-types/field-defs.ts`.
+ *
+ * Deliberate divergence from content-types, disclosed:
+ * content-types hand-authors its published `inputSchema` and hand-authors `field-defs.ts`
+ * separately, then pins the two together with a fixture corpus
+ * (`agent-tools.schema-agreement.unit.test.ts`) because deriving one from the other would have
+ * needed either a JSON Schema library this project does not depend on or a code generator. That
+ * reasoning does not carry over here: identity's schemas use five keywords and describe flat
+ * objects of strings, so INTERPRETING the published schema is ~40 lines. This file does that
+ * instead, which makes the published contract and the enforced contract the same artifact — the
+ * drift content-types has to test for cannot exist here by construction.
+ *
+ * What remains genuinely testable, and is tested in
+ * `__tests__/agent-tools.schema-agreement.test.ts`: that this interpreter actually implements
+ * every keyword the catalog uses (an unknown keyword fails loudly rather than being ignored, which
+ * is the one way a schema could still promise something unenforced), and that the wired handlers
+ * really route their input through here rather than reading `ctx.input` directly.
+ *
+ * Architectural role:
+ * `identity` library, pure. No I/O, no enforcement of permissions — this is shape validation only.
+ * Returns a `Result` rather than throwing so the caller decides how a rejection is surfaced.
+ */
+/** The keywords this interpreter implements. Anything else in a schema is a hard error, never ignored. */
+const SUPPORTED_KEYWORDS = new Set(["type", "properties", "required", "additionalProperties", "minLength", "description"]);
+/**
+ * Asserts a schema uses only keywords {@link parseIdentityToolInput} implements.
+ *
+ * Separated from the parse loop and run over the WHOLE schema before any value is inspected, so an
+ * unimplemented keyword is reported even for an input that happens not to exercise it. Without
+ * that ordering a schema could publish, say, a `pattern` the parser silently ignores, and every
+ * test using a conforming fixture would still pass.
+ *
+ * @param schema - A tool's published `inputSchema`.
+ * @throws {Error} If the schema, or any property sub-schema, uses an unimplemented keyword.
+ * @complexity O(k) in the total keyword count across the schema and its property sub-schemas.
+ * @overallScore 100
+ */
+function assertSchemaIsInterpretable(schema) {
+    for (const keyword of Object.keys(schema)) {
+        if (!SUPPORTED_KEYWORDS.has(keyword)) {
+            throw new Error(`identity agent-tool schema uses unimplemented keyword '${keyword}' — extend agent-tool-input.ts rather than publishing a contract it cannot enforce`);
+        }
+    }
+    for (const sub of Object.values((schema.properties ?? {}))) {
+        for (const keyword of Object.keys(sub)) {
+            if (!SUPPORTED_KEYWORDS.has(keyword)) {
+                throw new Error(`identity agent-tool schema uses unimplemented keyword '${keyword}' — extend agent-tool-input.ts rather than publishing a contract it cannot enforce`);
+            }
+        }
+    }
+}
+/**
+ * Validates `input` against a tool's own published `inputSchema` and returns the extracted string
+ * values.
+ *
+ * Every identity tool's input is a closed, flat object whose properties are all strings, so the
+ * return type is narrowed to `Record<string, string>` — a caller reads `value.principalId` without
+ * re-checking the type, which is what keeps the handlers in `tool-registrations.ts` free of ad hoc
+ * `typeof` guards that could disagree with the schema.
+ *
+ * Rejection messages name the offending KEY and the rule it broke, and never echo the offending
+ * VALUE: a tool input carries operator content (a username, an email) and these messages travel
+ * back to the model and into the tool-attempt audit trail.
+ *
+ * @param required.schema - The tool's published `inputSchema`, used as the contract itself.
+ * @param required.input - The raw `ctx.input`, of any shape.
+ * @returns `{ok:true, value}` with each declared property present in `input` extracted, or
+ * `{ok:false, error}` naming the first violation found.
+ * @throws {Error} Only if the schema itself is uninterpretable — a developer error, distinct from
+ * a bad input, and therefore not folded into the `Result`.
+ * @complexity O(p) in the declared property count plus O(k) in the input's own key count.
+ * @overallScore 100
+ */
+export function parseIdentityToolInput(required) {
+    const schema = required.schema;
+    assertSchemaIsInterpretable(schema);
+    if (schema.type !== "object") {
+        throw new Error(`identity agent-tool schema must be an object schema, got type '${String(schema.type)}'`);
+    }
+    const { input } = required;
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        return { ok: false, error: new Error("input must be an object") };
+    }
+    const record = input;
+    const properties = (schema.properties ?? {});
+    if (schema.additionalProperties === false) {
+        for (const key of Object.keys(record)) {
+            if (!(key in properties)) {
+                return { ok: false, error: new Error(`'${key}' is not a recognized input key`) };
+            }
+        }
+    }
+    for (const key of schema.required ?? []) {
+        if (!(key in record) || record[key] === undefined) {
+            return { ok: false, error: new Error(`'${key}' is required`) };
+        }
+    }
+    const value = {};
+    for (const [key, sub] of Object.entries(properties)) {
+        if (!(key in record) || record[key] === undefined)
+            continue;
+        const candidate = record[key];
+        if (sub.type !== "string") {
+            throw new Error(`identity agent-tool schema declares non-string property '${key}' — this parser only implements string properties`);
+        }
+        if (typeof candidate !== "string") {
+            return { ok: false, error: new Error(`'${key}' must be a string, received ${describeType(candidate)}`) };
+        }
+        if (typeof sub.minLength === "number" && candidate.trim().length < sub.minLength) {
+            return { ok: false, error: new Error(`'${key}' must not be blank`) };
+        }
+        value[key] = candidate;
+    }
+    return { ok: true, value };
+}
+/** Names a value's type for a rejection message WITHOUT echoing the value itself. */
+function describeType(value) {
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "an array";
+    return `a ${typeof value}`;
+}
+//# sourceMappingURL=agent-tool-input.js.map

package/dist/identity/agent-tool-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-tool-input.js","sourceRoot":"","sources":["../../src/identity/agent-tool-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,0GAA0G;AAC1G,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAQ3H;;;;;;;;;;;;GAYG;AACH,SAAS,2BAA2B,CAAC,MAAc;IACjD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,0DAA0D,OAAO,oFAAoF,CAAC,CAAC;QACzK,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAA2B,CAAC,EAAE,CAAC;QACrF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,0DAA0D,OAAO,oFAAoF,CAAC,CAAC;YACzK,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAGtC;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAgB,CAAC;IACzC,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAEpC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kEAAkE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAA2B,CAAC;IAEvE,IAAI,MAAM,CAAC,oBAAoB,KAAK,KAAK,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC;gBACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,iCAAiC,CAAC,EAAE,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAK,MAAM,CAAC,QAAiC,IAAI,EAAE,EAAE,CAAC;QAClE,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,eAAe,CAAC,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,SAAS;QAE5D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,4DAA4D,GAAG,mDAAmD,CAAC,CAAC;QACtI,CAAC;QACD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,gCAAgC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3G,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;YACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,qBAAqB,CAAC,EAAE,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5C,OAAO,KAAK,OAAO,KAAK,EAAE,CAAC;AAC7B,CAAC"}