@jini-ai/cms 0.1.0

package/dist/identity/tool-registrations.js

@@ -0,0 +1,419 @@
+/**
+ * @file Identity's half of the agent-tool authorization wiring: maps `agent-tools.ts`'s fifteen catalog
+ * entries onto the users/roles/policies transitions `grant-service.ts`/`admin-crud-service.ts`
+ * export, plus the three repo-backed reads, as `ToolRegistration`s.
+ *
+ * `ToolPolicy.authorize` is a pass-through for all fifteen (see `buildDomainRegistrations`) for the
+ * "one evaluator" reason: the gate is the domain layer's, reached identically by every
+ * tool kind — mutations through their own service function, which opens with the check, and reads
+ * through {@link assertIdentityReadAllowed}, which calls the domain's own exported
+ * `assertCallerHasAnyPermission` rather than re-deriving an OR gate. A second check here would be a
+ * duplicate evaluator, and one any non-tool caller of the same service function would bypass. See
+ * `assistant/__tests__/tool-registrations.identity-authorization.test.ts`.
+ */
+import { buildDomainRegistrations, indexCatalogById, } from "../core/tools/registration-kit.js";
+import { parseIdentityToolInput } from "./agent-tool-input.js";
+import { identityAgentToolCatalog } from "./agent-tools.js";
+import { assertCallerHasAnyPermission, assignRole, attachPolicy, createPolicy, createRole, createUser } from "./grant-service.js";
+import { deletePolicy, deleteRole, disablePrincipal, enablePrincipal, updatePolicy, updateRole, updateUser } from "./admin-crud-service.js";
+const CATALOG_BY_ID = indexCatalogById(identityAgentToolCatalog);
+/**
+ * Assembles `auth-service.ts`'s `IdentityRepos` bag from {@link IdentityToolDeps}'s flat fields — a
+ * local duplicate of `server/routes/admin/users/deps.ts`'s `identityReposFrom` rather than an import
+ * of it, for the same reason `features/settings/tool-registrations.ts`'s header gives for
+ * duplicating `toWriteServiceDeps`: importing from the HTTP admin layer would invert this codebase's
+ * ports/adapters direction. It is a field mapping, not logic, so the two copies carry no behavioral
+ * drift risk.
+ */
+function identityReposFrom(deps) {
+    return {
+        principals: deps.principalRepo,
+        users: deps.userRepo,
+        sessions: deps.sessionRepo,
+        roles: deps.roleRepo,
+        policies: deps.policyRepo,
+        policyPermissions: deps.policyPermissionRepo,
+        rolePolicies: deps.rolePolicyRepo,
+        principalRoles: deps.principalRoleRepo,
+        principalPolicies: deps.principalPolicyRepo,
+    };
+}
+/** Assembles `grant-service.ts`'s/`admin-crud-service.ts`'s `AuthServiceDeps` bag from
+ * {@link IdentityToolDeps} — the local twin of `identityReposFrom` just above. */
+function identityServiceDepsFrom(deps) {
+    return {
+        repos: identityReposFrom(deps),
+        hasher: deps.passwordHasher,
+        clock: deps.clock,
+        idGen: deps.idGen,
+    };
+}
+/**
+ * This wiring layer's OWN risk classification, authored from what each handler below actually
+ * calls. See `DerivedRiskByToolId` in the kit for why it is independent of the catalog's own
+ * `sideEffects` declaration.
+ */
+export const identityDerivedRisk = new Map([
+    // -> authorize() + repo reads only; no save on any path.
+    ["identity_user_list", "none"],
+    ["identity_role_list", "none"],
+    ["identity_policy_list", "none"],
+    // -> createUser (grant-service.ts): saves a principal row AND a users row (credential).
+    ["identity_user_create", "mutates-durable-state"],
+    // -> updateUser (admin-crud-service.ts): users.save, email field only.
+    ["identity_user_update_email", "mutates-durable-state"],
+    // -> disablePrincipal (admin-crud-service.ts): status flip, guarded by the INV-08 owner floor.
+    ["identity_user_disable", "mutates-durable-state"],
+    // -> enablePrincipal (admin-crud-service.ts): status flip back to active.
+    ["identity_user_enable", "mutates-durable-state"],
+    // -> createRole (grant-service.ts): roles.save, always isBuiltin=false.
+    ["identity_role_create", "mutates-durable-state"],
+    // -> assignRole (grant-service.ts): principalRoles.save behind the INV-07 grant clamp. The one
+    //    identity tool that confers permissions, hence the heaviest of these.
+    ["identity_role_assign", "mutates-durable-state"],
+    // -> updateRole (admin-crud-service.ts): roles.save, refuses built-ins.
+    ["identity_role_rename", "mutates-durable-state"],
+    // -> deleteRole (admin-crud-service.ts): roles.delete, refuses built-ins and referenced roles.
+    ["identity_role_delete", "mutates-durable-state"],
+    // -> createPolicy (grant-service.ts): policies.save, always isBuiltin=false/isFrozen=false.
+    ["identity_policy_create", "mutates-durable-state"],
+    // -> updatePolicy (admin-crud-service.ts): policies.save, refuses built-in/frozen.
+    ["identity_policy_update", "mutates-durable-state"],
+    // -> deletePolicy (admin-crud-service.ts): policyPermissions.deleteByPolicyId + policies.delete,
+    //    refuses built-in/frozen and still-referenced policies.
+    ["identity_policy_delete", "mutates-durable-state"],
+    // -> attachPolicy (grant-service.ts): principalPolicies.save behind the INV-07 grant clamp — the
+    //    direct-grant counterpart to identity_role_assign, same weight.
+    ["identity_policy_attach", "mutates-durable-state"],
+]);
+/**
+ * Upper bound on the roster `identity_user_list` will fan out over.
+ *
+ * `routes/admin/users/list.ts` does the same O(n) per-user fan-out uncapped, on the documented
+ * "operator-managed roster, not member/content scale" assumption. That assumption is fine for a
+ * human screen and NOT fine here for a different reason than scale: this result is spent as model
+ * context, so an unexpectedly large roster would silently consume the run's context window. The
+ * cap truncates and SAYS SO in the payload rather than failing, so a caller that hits it can still
+ * work with what it got and knows not to treat the list as complete.
+ */
+const IDENTITY_USER_LIST_MAX = 200;
+function requireIdentityCatalogEntry(toolId) {
+    const entry = CATALOG_BY_ID.get(toolId);
+    if (!entry)
+        throw new Error(`identity/tool-registrations.ts: catalog has no entry named '${toolId}' — identity/agent-tools.ts drifted`);
+    return entry;
+}
+function identityInput(toolId, input) {
+    const entry = requireIdentityCatalogEntry(toolId);
+    const parsed = parseIdentityToolInput({ schema: entry.inputSchema, input });
+    if (!parsed.ok) {
+        const recovery = "Fix the input and retry — this will not resolve on retry without an input change.";
+        throw new Error(`${parsed.error.message}. ${recovery} Schema for '${toolId}': ${JSON.stringify(entry.inputSchema)}`);
+    }
+    const value = parsed.value;
+    return {
+        req(field) {
+            const found = value[field];
+            if (found === undefined) {
+                throw new Error(`identity tool '${toolId}': the handler reads '${field}' as required, but the published inputSchema does not mark it required — add it to that schema's 'required' list, or read it with opt() and handle its absence`);
+            }
+            return found;
+        },
+        opt(field) {
+            return value[field];
+        },
+    };
+}
+/** The permission set a tool's catalog entry declares — both halves when the gate is an OR. */
+function identityPermissionsFor(toolId) {
+    const { authorization } = requireIdentityCatalogEntry(toolId);
+    return authorization.orPermission ? [authorization.permission, authorization.orPermission] : [authorization.permission];
+}
+/**
+ * The gate for the two READ tools.
+ *
+ * The mutating tools need no equivalent: their domain function opens with this same
+ * `assertCallerHasAnyPermission` call itself. Reads have no service-layer function to inherit it
+ * from — `identity` exports grant-writing transitions, not read wrappers, which is why
+ * `routes/admin/users/list.ts` also gates in the route and then reads the repo ports directly.
+ * This calls the domain's own exported helper rather than re-deriving an OR gate (and rather than
+ * the kit's generic `requireToolPermission`, which cannot express an OR), so the single
+ * evaluator is reached by an identical path from both tool kinds.
+ */
+async function assertIdentityReadAllowed(routeDeps, toolId, callerPrincipalId) {
+    await assertCallerHasAnyPermission({
+        deps: identityServiceDepsFrom(routeDeps),
+        workspaceId: routeDeps.workspaceId,
+        callerPrincipalId,
+        permissions: identityPermissionsFor(toolId),
+    });
+}
+/**
+ * Projects a principal + its credential row into the explicit model-facing shape.
+ *
+ * The load-bearing omission is `UserRecord.passwordHash`: INV-05 keeps hashed secrets server-side,
+ * and this view has no field for one, so there is nothing to forward by accident even if a future
+ * `UserRecord` field is added. `workspaceId` is dropped for the same reason content-types'
+ * `toContentTypeView` drops it — the agent is scoped to one workspace it cannot change, so echoing
+ * the id spends model attention on a value that can never inform a decision.
+ *
+ * @param record.roleIds - The principal's role assignments, passed in rather than resolved here so
+ * the projection stays pure and the caller decides whether the extra repo read is worth it.
+ * @returns The model-facing view. `email` is present only when set, so a user without one carries
+ * no always-undefined key.
+ * @complexity O(r) in the role count (the array is copied so the caller cannot alias domain state).
+ * @overallScore 100
+ */
+function toIdentityUserView(record) {
+    const view = {
+        principalId: record.principal.id,
+        username: record.user.username,
+        status: record.principal.status,
+        roleIds: [...record.roleIds],
+    };
+    if (record.user.email)
+        view.email = record.user.email;
+    return view;
+}
+/** What an identity role tool returns to the model. `isBuiltin` is kept because it is what predicts a rename/delete refusal. */
+function toIdentityRoleView(role) {
+    return { id: role.id, name: role.name, isBuiltin: role.isBuiltin };
+}
+/**
+ * What an identity policy tool returns to the model. `isBuiltin`/`isFrozen` are both kept because
+ * together they are what predicts an update/delete/write-permission refusal (mirrors
+ * `toIdentityRoleView`'s `isBuiltin`, extended for the second immutability flag policies carry that
+ * roles do not). `description` is present only when set, matching `toIdentityUserView`'s `email`.
+ */
+function toIdentityPolicyView(policy) {
+    const view = {
+        id: policy.id,
+        name: policy.name,
+        isBuiltin: policy.isBuiltin,
+        isFrozen: policy.isFrozen,
+    };
+    if (policy.description)
+        view.description = policy.description;
+    return view;
+}
+/** Read a principal's role-assignment ids. Shared by every tool that returns a user view. */
+async function roleIdsFor(routeDeps, principalId) {
+    const links = await routeDeps.principalRoleRepo.listByPrincipalId({ workspaceId: routeDeps.workspaceId, principalId });
+    return links.map((link) => link.roleId);
+}
+/**
+ * Load the `UserRecord` paired with a principal the domain just returned.
+ *
+ * Every `kind='user'` principal has one by construction (CREATE_USER's atomicity guarantee), so
+ * the miss is defensive rather than an expected path — the same reasoning `routes/admin/users/
+ * disable.ts` records for its identical second lookup.
+ */
+async function requireUserRecord(routeDeps, principalId) {
+    const user = await routeDeps.userRepo.findByPrincipalId({ workspaceId: routeDeps.workspaceId, principalId });
+    if (!user)
+        throw new Error(`user '${principalId}' was not found`);
+    return user;
+}
+export function buildIdentityRegistrations(routeDeps) {
+    /** Assembled per call, not per handler, because every mutating handler needs the identical bag. */
+    const serviceDeps = () => identityServiceDepsFrom(routeDeps);
+    const handlers = {
+        identity_user_list: async (ctx) => {
+            identityInput("identity_user_list", ctx.input);
+            await assertIdentityReadAllowed(routeDeps, "identity_user_list", ctx.principal.id);
+            const principals = await routeDeps.principalRepo.list({ workspaceId: routeDeps.workspaceId });
+            // Humans only — `system`/`agent`/`api_key` principals (including the disabled `user-local`
+            // seed row) are not what "users" means on this surface, matching `routes/.../list.ts`.
+            const humans = principals.filter((principal) => principal.kind === "user");
+            const page = humans.slice(0, IDENTITY_USER_LIST_MAX);
+            const users = await Promise.all(page.map(async (principal) => {
+                const user = await routeDeps.userRepo.findByPrincipalId({ workspaceId: routeDeps.workspaceId, principalId: principal.id });
+                if (!user)
+                    return null;
+                return toIdentityUserView({ principal, user, roleIds: await roleIdsFor(routeDeps, principal.id) });
+            }));
+            const listed = users.filter((user) => user !== null);
+            return humans.length > page.length
+                ? { users: listed, truncated: true, totalCount: humans.length }
+                : { users: listed };
+        },
+        identity_role_list: async (ctx) => {
+            identityInput("identity_role_list", ctx.input);
+            await assertIdentityReadAllowed(routeDeps, "identity_role_list", ctx.principal.id);
+            const roles = await routeDeps.roleRepo.list({ workspaceId: routeDeps.workspaceId });
+            return { roles: roles.map(toIdentityRoleView) };
+        },
+        identity_policy_list: async (ctx) => {
+            identityInput("identity_policy_list", ctx.input);
+            await assertIdentityReadAllowed(routeDeps, "identity_policy_list", ctx.principal.id);
+            const policies = await routeDeps.policyRepo.list({ workspaceId: routeDeps.workspaceId });
+            return { policies: policies.map(toIdentityPolicyView) };
+        },
+        identity_user_create: async (ctx) => {
+            const input = identityInput("identity_user_create", ctx.input);
+            const { principal, user } = await createUser({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    username: input.req("username"),
+                    email: input.opt("email"),
+                    password: input.req("password"),
+                },
+            });
+            // A brand-new principal has no assignments yet, so this is [] by construction, not a read.
+            return { user: toIdentityUserView({ principal, user, roleIds: [] }) };
+        },
+        identity_user_update_email: async (ctx) => {
+            const input = identityInput("identity_user_update_email", ctx.input);
+            const { user } = await updateUser({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    principalId: input.req("principalId"),
+                    // Absent stays absent: `updateUser` treats a falsy email as "clear", which is exactly
+                    // what this tool's description tells the model omitting it does.
+                    email: input.opt("email"),
+                },
+            });
+            const principal = await routeDeps.principalRepo.findById({ workspaceId: routeDeps.workspaceId, id: input.req("principalId") });
+            if (!principal)
+                throw new Error(`principal '${input.req("principalId")}' was not found`);
+            return { user: toIdentityUserView({ principal, user, roleIds: await roleIdsFor(routeDeps, principal.id) }) };
+        },
+        identity_user_disable: async (ctx) => {
+            const input = identityInput("identity_user_disable", ctx.input);
+            const { principal } = await disablePrincipal({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    principalId: input.req("principalId"),
+                    // Resolved by the caller, per `disablePrincipal`'s own contract — the same
+                    // `await deps.ownerPrincipalId` the human disable route performs.
+                    seededOwnerPrincipalId: await routeDeps.ownerPrincipalId,
+                },
+            });
+            const user = await requireUserRecord(routeDeps, principal.id);
+            return { user: toIdentityUserView({ principal, user, roleIds: await roleIdsFor(routeDeps, principal.id) }) };
+        },
+        identity_user_enable: async (ctx) => {
+            const input = identityInput("identity_user_enable", ctx.input);
+            const { principal } = await enablePrincipal({
+                deps: serviceDeps(),
+                input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, principalId: input.req("principalId") },
+            });
+            const user = await requireUserRecord(routeDeps, principal.id);
+            return { user: toIdentityUserView({ principal, user, roleIds: await roleIdsFor(routeDeps, principal.id) }) };
+        },
+        identity_role_create: async (ctx) => {
+            const input = identityInput("identity_role_create", ctx.input);
+            const { role } = await createRole({
+                deps: serviceDeps(),
+                input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, name: input.req("name") },
+            });
+            return { role: toIdentityRoleView(role) };
+        },
+        identity_role_assign: async (ctx) => {
+            const input = identityInput("identity_role_assign", ctx.input);
+            const { assignment } = await assignRole({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    principalId: input.req("principalId"),
+                    roleId: input.req("roleId"),
+                },
+            });
+            // The join row's own id is not addressable by any other tool, so it is dropped; what the
+            // model needs back is confirmation of WHICH pair is now linked.
+            return { assigned: { principalId: assignment.principalId, roleId: assignment.roleId } };
+        },
+        identity_role_rename: async (ctx) => {
+            const input = identityInput("identity_role_rename", ctx.input);
+            const { role } = await updateRole({
+                deps: serviceDeps(),
+                input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, roleId: input.req("roleId"), name: input.req("name") },
+            });
+            return { role: toIdentityRoleView(role) };
+        },
+        identity_role_delete: async (ctx) => {
+            const input = identityInput("identity_role_delete", ctx.input);
+            await deleteRole({
+                deps: serviceDeps(),
+                input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, roleId: input.req("roleId") },
+            });
+            // `deleteRole` resolves void; an empty tool result would read to the model as "nothing
+            // happened", so the deleted id is echoed as the acknowledgement.
+            return { deleted: { roleId: input.req("roleId") } };
+        },
+        identity_policy_create: async (ctx) => {
+            const input = identityInput("identity_policy_create", ctx.input);
+            const { policy } = await createPolicy({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    name: input.req("name"),
+                    // Absent stays absent: `input.description` is only present when the caller supplied it
+                    // (`parseIdentityToolInput` omits absent optional keys entirely), so this passes through
+                    // unchanged rather than coercing a caller-supplied empty string to "no description".
+                    description: input.opt("description"),
+                },
+            });
+            return { policy: toIdentityPolicyView(policy) };
+        },
+        identity_policy_update: async (ctx) => {
+            const input = identityInput("identity_policy_update", ctx.input);
+            const { policy } = await updatePolicy({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    policyId: input.req("policyId"),
+                    // Same absent-stays-absent reasoning as identity_policy_create — `updatePolicy` itself
+                    // distinguishes undefined ("leave unchanged") from an explicit empty string.
+                    name: input.opt("name"),
+                    description: input.opt("description"),
+                },
+            });
+            return { policy: toIdentityPolicyView(policy) };
+        },
+        identity_policy_delete: async (ctx) => {
+            const input = identityInput("identity_policy_delete", ctx.input);
+            await deletePolicy({
+                deps: serviceDeps(),
+                input: { workspaceId: routeDeps.workspaceId, callerPrincipalId: ctx.principal.id, policyId: input.req("policyId") },
+            });
+            // `deletePolicy` resolves void; an empty tool result would read to the model as "nothing
+            // happened", so the deleted id is echoed as the acknowledgement (mirrors identity_role_delete).
+            return { deleted: { policyId: input.req("policyId") } };
+        },
+        identity_policy_attach: async (ctx) => {
+            const input = identityInput("identity_policy_attach", ctx.input);
+            const { attachment } = await attachPolicy({
+                deps: serviceDeps(),
+                input: {
+                    workspaceId: routeDeps.workspaceId,
+                    callerPrincipalId: ctx.principal.id,
+                    principalId: input.req("principalId"),
+                    policyId: input.req("policyId"),
+                },
+            });
+            // The join row's own id is not addressable by any other tool, so it is dropped; what the
+            // model needs back is confirmation of WHICH pair is now linked (mirrors identity_role_assign).
+            return { attached: { principalId: attachment.principalId, policyId: attachment.policyId } };
+        },
+    };
+    // No `unwiredToolIds`: identity wires its ENTIRE catalog (which is why its own
+    // `AgentToolDefinition` makes `inputSchema` required rather than optional).
+    return buildDomainRegistrations({
+        domain: "identity",
+        catalogModule: "identity/agent-tools.ts",
+        catalog: CATALOG_BY_ID,
+        handlers,
+        derivedRisk: identityDerivedRisk,
+    });
+}
+//# sourceMappingURL=tool-registrations.js.map

package/dist/identity/tool-registrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-registrations.js","sourceRoot":"","sources":["../../src/identity/tool-registrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GAKjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAA2D,MAAM,kBAAkB,CAAC;AAErH,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAClI,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAgB5I,MAAM,aAAa,GAAG,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;AA0BjE;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,IAAsB;IAC/C,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,aAAa;QAC9B,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,QAAQ,EAAE,IAAI,CAAC,WAAW;QAC1B,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,QAAQ,EAAE,IAAI,CAAC,UAAU;QACzB,iBAAiB,EAAE,IAAI,CAAC,oBAAoB;QAC5C,YAAY,EAAE,IAAI,CAAC,cAAc;QACjC,cAAc,EAAE,IAAI,CAAC,iBAAiB;QACtC,iBAAiB,EAAE,IAAI,CAAC,mBAAmB;KAC5C,CAAC;AACJ,CAAC;AAED;kFACkF;AAClF,SAAS,uBAAuB,CAAC,IAAsB;IACrD,OAAO;QACL,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC;QAC9B,MAAM,EAAE,IAAI,CAAC,cAAc;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAA8B;IAC3F,yDAAyD;IACzD,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAC9B,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAC9B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,wFAAwF;IACxF,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACjD,uEAAuE;IACvE,CAAC,4BAA4B,EAAE,uBAAuB,CAAC;IACvD,+FAA+F;IAC/F,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;IAClD,0EAA0E;IAC1E,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACjD,wEAAwE;IACxE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACjD,+FAA+F;IAC/F,0EAA0E;IAC1E,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACjD,wEAAwE;IACxE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACjD,+FAA+F;IAC/F,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACjD,4FAA4F;IAC5F,CAAC,wBAAwB,EAAE,uBAAuB,CAAC;IACnD,mFAAmF;IACnF,CAAC,wBAAwB,EAAE,uBAAuB,CAAC;IACnD,iGAAiG;IACjG,4DAA4D;IAC5D,CAAC,wBAAwB,EAAE,uBAAuB,CAAC;IACnD,iGAAiG;IACjG,oEAAoE;IACpE,CAAC,wBAAwB,EAAE,uBAAuB,CAAC;CACpD,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,SAAS,2BAA2B,CAAC,MAAc;IACjD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,MAAM,qCAAqC,CAAC,CAAC;IACxI,OAAO,KAAK,CAAC;AACf,CAAC;AAiCD,SAAS,aAAa,CAAC,MAAc,EAAE,KAAc;IACnD,MAAM,KAAK,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,sBAAsB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,mFAAmF,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,gBAAgB,MAAM,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,OAAO;QACL,GAAG,CAAC,KAAK;YACP,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,kBAAkB,MAAM,yBAAyB,KAAK,gKAAgK,CACvN,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,GAAG,CAAC,KAAK;YACP,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB,CAAC,MAAc;IAC5C,MAAM,EAAE,aAAa,EAAE,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC9D,OAAO,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;AAC1H,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,yBAAyB,CAAC,SAA2B,EAAE,MAAc,EAAE,iBAAyB;IAC7G,MAAM,4BAA4B,CAAC;QACjC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC;QACxC,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,iBAAiB;QACjB,WAAW,EAAE,sBAAsB,CAAC,MAAM,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAWD;;;;;;;;;;;;;;;GAeG;AACH,SAAS,kBAAkB,CAAC,MAAoF;IAC9G,MAAM,IAAI,GAAyB;QACjC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;QAChC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;QAC9B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAC/B,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;KAC7B,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gIAAgI;AAChI,SAAS,kBAAkB,CAAC,IAAgB;IAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,MAAoB;IAChD,MAAM,IAAI,GAA8F;QACtG,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;IACF,IAAI,MAAM,CAAC,WAAW;QAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,UAAU,CAAC,SAA2B,EAAE,WAAmB;IACxE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IACvH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAAC,SAA2B,EAAE,WAAmB;IAC/E,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7G,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,WAAW,iBAAiB,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,SAA2B;IACpE,mGAAmG;IACnG,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAgC;QAC5C,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAChC,aAAa,CAAC,oBAAoB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,yBAAyB,CAAC,SAAS,EAAE,oBAAoB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAEnF,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9F,2FAA2F;YAC3F,uFAAuF;YACvF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;YAErD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;gBAC3B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3H,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC;gBACvB,OAAO,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACrG,CAAC,CAAC,CACH,CAAC;YAEF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAgC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACnF,OAAO,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;gBAChC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC/D,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACxB,CAAC;QAED,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAChC,aAAa,CAAC,oBAAoB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,yBAAyB,CAAC,SAAS,EAAE,oBAAoB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAEnF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;YACpF,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClD,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClC,aAAa,CAAC,sBAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,yBAAyB,CAAC,SAAS,EAAE,sBAAsB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAErF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;YACzF,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1D,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,aAAa,CAAC,sBAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/D,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC;gBAC3C,IAAI,EAAE,WAAW,EAAE;gBACnB,KAAK,EAAE;oBACL,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;oBACnC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;oBAC/B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;oBACzB,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;iBAChC;aACF,CAAC,CAAC;YACH,2FAA2F;YAC3F,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,aAAa,CAAC,4BAA4B,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACrE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC;gBAChC,IAAI,EAAE,WAAW,EAAE;gBACnB,KAAK,EAAE;oBACL,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;oBACnC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;oBACrC,sFAAsF;oBACtF,iEAAiE;oBACjE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;iBAC1B;aACF,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC/H,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;YACzF,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/G,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,aAAa,CAAC,uBAAuB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAChE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,gBAAgB,CAAC;gBAC3C,IAAI,EAAE,WAAW,EAAE;gBACnB,KAAK,EAAE;oBACL,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;oBACnC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;oBACrC,2EAA2E;oBAC3E,kEAAkE;oBAClE,sBAAsB,EAAE,MAAM,SAAS,CAAC,gBAAgB;iBACzD;aACF,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/G,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,aAAa,CAAC,sBAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC;gBAC1C,IAAI,EAAE,WAAW,EAAE;gBACnB,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE;aAC1H,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/G,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,aAAa,CAAC,sBAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC;gBAChC,IAAI,EAAE,WAAW,EAAE;gBACnB,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;aAC5G,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,aAAa,CAAC,sBAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/D,MAAM,EAAE,UAAU,EAAE,GAAwC,MAAM,UAAU,CAAC;gBAC3E,IAAI,EAAE,WAAW,EAAE;gBACnB,KAAK,EAAE;oBACL,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;oBACnC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;oBACrC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;iBAC5B;aACF,CAAC,CAAC;YACH,yFAAyF;YACzF,gEAAgE;YAChE,OAAO,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1F,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,aAAa,CAAC,sBAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC;gBAChC,IAAI,EAAE,WAAW,EAAE;gBACnB,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;aACzI,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,aAAa,CAAC,sBAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/D,MAAM,UAAU,CAAC;gBACf,IAAI,EAAE,WAAW,EAAE;gBACnB,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;aAChH,CAAC,CAAC;YACH,uFAAuF;YACvF,iEAAiE;YACjE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACtD,CAAC;QAED,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,aAAa,CAAC,wBAAwB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC;gBACpC,IAAI,EAAE,WAAW,EAAE;gBACnB,KAAK,EAAE;oBACL,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;oBACnC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;oBACvB,uFAAuF;oBACvF,yFAAyF;oBACzF,qFAAqF;oBACrF,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;iBACtC;aACF,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,CAAC;QAED,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,aAAa,CAAC,wBAAwB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC;gBACpC,IAAI,EAAE,WAAW,EAAE;gBACnB,KAAK,EAAE;oBACL,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;oBACnC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;oBAC/B,uFAAuF;oBACvF,6EAA6E;oBAC7E,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;oBACvB,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;iBACtC;aACF,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,CAAC;QAED,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,aAAa,CAAC,wBAAwB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,YAAY,CAAC;gBACjB,IAAI,EAAE,WAAW,EAAE;gBACnB,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;aACpH,CAAC,CAAC;YACH,yFAAyF;YACzF,gGAAgG;YAChG,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QAC1D,CAAC;QAED,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,aAAa,CAAC,wBAAwB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,CAAC;gBACxC,IAAI,EAAE,WAAW,EAAE;gBACnB,KAAK,EAAE;oBACL,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;oBACnC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;oBACrC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;iBAChC;aACF,CAAC,CAAC;YACH,yFAAyF;YACzF,+FAA+F;YAC/F,OAAO,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC9F,CAAC;KACF,CAAC;IAEF,+EAA+E;IAC/E,4EAA4E;IAC5E,OAAO,wBAAwB,CAAC;QAC9B,MAAM,EAAE,UAAU;QAClB,aAAa,EAAE,yBAAyB;QACxC,OAAO,EAAE,aAAa;QACtB,QAAQ;QACR,WAAW,EAAE,mBAAmB;KACjC,CAAC,CAAC;AACL,CAAC"}

package/dist/identity/types.d.ts

@@ -0,0 +1,185 @@
+import type { ISODateTime, UUID } from "../core/ports.js";
+/**
+ * @file Core domain types for the `identity` library.
+ *
+ * Purpose:
+ * Type-only definitions for the principal-centric identity & authorization
+ * model: every actor (human user, AI agent, API key, system) is rooted as a
+ * `PrincipalRecord`; humans get RBAC (`roles` -> `policies` -> permissions);
+ * machines get direct policy grants (`principal_policies`). Mirrors the
+ * `features/post` / `members` conventions: records + workspace-scoped ports
+ * live in `ports.ts`, no feature logic here.
+ *
+ * Scope note (core path, this pass):
+ * `agent`/`api_key` principal *lifecycle* transitions (CREATE_PRINCIPAL,
+ * ISSUE_API_KEY, ASSIGN_ROLE, ATTACH_POLICY, WRITE_POLICY_PERMISSION,
+ * DISABLE_PRINCIPAL) are OUT of scope for this pass (deferred — see the
+ * Programmer handoff). The `kind` enum and table shapes are still built to
+ * the full target schema so those transitions are additive later,
+ * not a repaint.
+ */
+/** Every actor is one of these. Only `user`/`system` are populated this pass. */
+export type PrincipalKind = "user" | "agent" | "api_key" | "system";
+/** Disable-only lifecycle (REQ-11/INV-02) — there is no hard-delete state. */
+export type PrincipalStatus = "active" | "disabled";
+/**
+ * Root identity row for every actor (REQ-01). `change_set.actorId` references
+ * a principal by composite `(workspaceId, id)` (REQ-10/INV-01).
+ */
+export interface PrincipalRecord {
+    id: UUID;
+    workspaceId: UUID;
+    kind: PrincipalKind;
+    displayName: string;
+    status: PrincipalStatus;
+    disabledAt?: ISODateTime | undefined;
+    createdAt: ISODateTime;
+}
+/**
+ * Human auth credentials. A `UserRecord` is only ever created together with a
+ * NEW `kind='user'` principal in the same transaction (REQ-01, MF-1) — never
+ * attached to a pre-existing principal. `username` is unique per workspace,
+ * compared case-insensitively and Unicode-NFC-normalized (behavior.spec §5).
+ */
+export interface UserRecord {
+    principalId: UUID;
+    workspaceId: UUID;
+    /** Stored pre-normalized (NFC + lowercase) so lookups are direct equality. */
+    username: string;
+    email?: string | undefined;
+    /** argon2id hash; the raw password is never stored (INV-05). */
+    passwordHash: string;
+    lastLoginAt?: ISODateTime | undefined;
+}
+/**
+ * Revocable server-side session (REQ-06). `tokenHash` is a hash of the opaque
+ * bearer value carried by the `HttpOnly`/`SameSite=Strict` cookie; the raw
+ * token is never persisted (INV-05). Lifetime is an **absolute** expiry fixed
+ * at creation (behavior.spec §4, RT-004) — no sliding renewal in v1.
+ */
+export interface SessionRecord {
+    id: UUID;
+    workspaceId: UUID;
+    principalId: UUID;
+    tokenHash: string;
+    createdAt: ISODateTime;
+    expiresAt: ISODateTime;
+    revokedAt?: ISODateTime;
+    ip?: string | undefined;
+    userAgent?: string | undefined;
+}
+/** Named RBAC role (REQ-02). Built-ins are seeded `isBuiltin=true`, immutable (INV-06). */
+export interface RoleRecord {
+    id: UUID;
+    workspaceId: UUID;
+    name: string;
+    isBuiltin: boolean;
+}
+/**
+ * A permission bundle (REQ-02). `isFrozen` is reserved for the API-key
+ * issuance-snapshot mechanism (REQ-08/F-054-01) — out of scope this pass, so
+ * every policy built here is `isFrozen=false`; the field exists so the schema
+ * is additive-ready, not a later repaint.
+ */
+export interface PolicyRecord {
+    id: UUID;
+    workspaceId: UUID;
+    name: string;
+    description?: string | undefined;
+    isBuiltin: boolean;
+    isFrozen: boolean;
+}
+/**
+ * A single permission carried by a policy (REQ-02/REQ-03). `resourceType`
+ * null = unscoped; non-null = matches only when it equals `context.entityType`
+ * (REQ-04/AC-14). `constraintJson` non-null and uninterpretable => fail-closed
+ * deny (INV-03/AC-09) — the v1 evaluator interprets no constraint shape, so any
+ * non-null value here is treated as "cannot interpret."
+ */
+export interface PolicyPermissionRecord {
+    id: UUID;
+    workspaceId: UUID;
+    policyId: UUID;
+    /** Dotted catalog permission string, or `"*"` (owner built-in policy only). */
+    permission: string;
+    resourceType?: string | null;
+    constraintJson?: string | null;
+}
+/** Role -> policy join (REQ-02/REQ-10). Not user-writable in v1 (F-053-02) — seed-only rows. */
+export interface RolePolicyRecord {
+    id: UUID;
+    workspaceId: UUID;
+    roleId: UUID;
+    policyId: UUID;
+}
+/** Principal -> role join, the human grant path (REQ-02/REQ-10). */
+export interface PrincipalRoleRecord {
+    id: UUID;
+    workspaceId: UUID;
+    principalId: UUID;
+    roleId: UUID;
+}
+/** Principal -> policy direct grant, the machine grant path (REQ-02/REQ-08/REQ-10). */
+export interface PrincipalPolicyRecord {
+    id: UUID;
+    workspaceId: UUID;
+    principalId: UUID;
+    policyId: UUID;
+}
+/** Raised on a malformed identity input (blank username, etc.). */
+export declare class IdentityValidationError extends Error {
+}
+/** Raised when a referenced principal/user/role/policy is not found. */
+export declare class IdentityNotFoundError extends Error {
+}
+/**
+ * Raised on a unique-constraint clash (duplicate `username` in a workspace, AC-19). Also
+ * raised by `deleteRole`/`deletePolicy` (`admin-crud-service.ts`) when the target still has
+ * live references (INV-09, AC-31) — the same 409 `RESOURCE_CONFLICT` shape, a `details.field`
+ * distinguishes the two cases at the route layer (errors.spec.md §3).
+ */
+export declare class IdentityConflictError extends Error {
+}
+/** Raised by `login()` on bad credentials, a disabled principal, or a blank field (AC-02). */
+export declare class AuthInvalidCredentialsError extends Error {
+}
+/**
+ * REQ-11/INV-08 — raised by `disablePrincipal` when the target is the seeded owner
+ * principal, or when disabling would drop the workspace's active owner-`*` count to zero. Maps to
+ * 409 `OWNER_REQUIRED` (errors.spec.md §2) — a pre-existing registered code that had no HTTP
+ * emission site until this amendment gave `DISABLE_PRINCIPAL` a route.
+ */
+export declare class OwnerRequiredError extends Error {
+}
+/**
+ * REQ-03/INV-07 — raised by `writePolicyPermission` when the permission string is
+ * not in the registered catalog. Maps to 400 `PERMISSION_UNKNOWN` (errors.spec.md §2) — kept
+ * distinct from `IdentityValidationError` (plain `VALIDATION_ERROR`) so the route can emit the
+ * correct typed code without string-matching the message.
+ */
+export declare class PermissionUnknownError extends Error {
+}
+/**
+ * Raised when a grant-writing transition's caller-permission gate fails
+ * (e.g. `ASSIGN_ROLE` called by a principal without `role.manage`). Maps to
+ * 403 `FORBIDDEN` (errors.spec.md §2) — distinct from `GrantExceedsIssuerError`,
+ * which is the INV-07 clamp on the *grant's contents*, not the base gate.
+ */
+export declare class IdentityForbiddenError extends Error {
+    readonly permission: string;
+    readonly reason: string;
+    constructor(message: string, permission: string, reason: string);
+}
+/**
+ * Raised when a grant-writing transition (`ASSIGN_ROLE`, `ATTACH_POLICY`, and
+ * future `ISSUE_API_KEY`/`WRITE_POLICY_PERMISSION`) would confer a permission
+ * the caller does not itself hold unconstrained (INV-07 grant-authority
+ * clamp, feature.spec.md). Maps to 403 `GRANT_EXCEEDS_ISSUER`
+ * (errors.spec.md §2/§3) — `offendingPermissions` is the exact `details`
+ * payload shape that error code specifies.
+ */
+export declare class GrantExceedsIssuerError extends Error {
+    readonly offendingPermissions: string[];
+    constructor(message: string, offendingPermissions: string[]);
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/identity/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;GAkBG;AAEH,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,IAAI,CAAC;IAClB,IAAI,EAAE,aAAa,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACrC,SAAS,EAAE,WAAW,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,IAAI,CAAC;IAClB,WAAW,EAAE,IAAI,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACvC;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,IAAI,CAAC;IAClB,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,2FAA2F;AAC3F,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,IAAI,CAAC;IAClB,QAAQ,EAAE,IAAI,CAAC;IACf,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,gGAAgG;AAChG,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,IAAI,CAAC;IAClB,MAAM,EAAE,IAAI,CAAC;IACb,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,oEAAoE;AACpE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,IAAI,CAAC;IAClB,WAAW,EAAE,IAAI,CAAC;IAClB,MAAM,EAAE,IAAI,CAAC;CACd;AAED,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,IAAI,CAAC;IAClB,WAAW,EAAE,IAAI,CAAC;IAClB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,mEAAmE;AACnE,qBAAa,uBAAwB,SAAQ,KAAK;CAAG;AACrD,wEAAwE;AACxE,qBAAa,qBAAsB,SAAQ,KAAK;CAAG;AACnD;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;CAAG;AACnD,8FAA8F;AAC9F,qBAAa,2BAA4B,SAAQ,KAAK;CAAG;AAEzD;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;CAAG;AAEhD;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;CAAG;AAEpD;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAKhE;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAC;gBAE5B,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE;CAI5D"}