@ketvietlab/ketsuite 0.1.25 → 0.1.30

package/dist/modules/user/access-policy.js

@@ -0,0 +1,455 @@
+import { userModalMessages } from './modal-messages.js';
+import { defineFn, deleteFrom, eq, from, permissionDigest } from '@ketvietlab/ketjs';
+import { AUTHORIZATION_EFFECTS, abortAuthorization, authorizationTransaction, authorizationRevisionOf, assertAssignableRoles, bumpRevision, completeOperation, operationReplay, effectiveFunctionKeys, normalizeAssignmentScope, managedRoleHealthIssues, recordAuthorizationAudit, } from './authorization.js';
+import { workplaces } from './user-modal-context.js';
+import { templateTier } from './access-surfaces.js';
+const kinds = ['idpGroup', 'department', 'jobTitle'];
+const fail = (field, code) => abortAuthorization({ ok: false, errors: [{ field, code }] });
+export const ACCESS_POLICY_EFFECTS = [
+    ...AUTHORIZATION_EFFECTS,
+    'read:partner.Partner',
+    'read:user.DirectoryFact',
+    'write:user.DirectoryFact',
+    'read:user.AccessPolicy',
+    'write:user.AccessPolicy',
+    'write:user.PolicyAssignment',
+];
+const reads = ACCESS_POLICY_EFFECTS.filter((effect) => !effect.startsWith('write:'));
+async function authority(ctx, fn) {
+    if (!ctx.actor)
+        fail('actor', 'E_ACTOR_REQUIRED');
+    const held = await effectiveFunctionKeys(ctx, ctx.actor);
+    if (held !== null && !held.includes(fn))
+        fail('actor', 'E_AUTHORIZATION_FORBIDDEN');
+    return held === null;
+}
+async function validatedPolicy(ctx, args) {
+    const id = String(args.id ?? '');
+    const previous = id ? (await ctx.db.select('user.AccessPolicy', { id }))[0] : undefined;
+    const roleIds = Array.isArray(args.roleIds) ? [...new Set(args.roleIds.map(String))].sort() : [];
+    if (!String(args.name ?? '').trim())
+        fail('name', 'user.error.required');
+    if (!kinds.includes(String(args.matchKind)))
+        fail('matchKind', 'user.error.required');
+    if (!roleIds.length)
+        fail('roleIds', 'user.error.required');
+    const roles = await assertAssignableRoles(ctx, roleIds);
+    const superuser = await authority(ctx, 'user.saveAccessPolicy');
+    if (!superuser && roles.some((role) => templateTier(ctx, String(role.templateKey)) === 'security'))
+        fail('roleIds', 'E_SECURITY_ROLE_FORBIDDEN');
+    const facts = await ctx.db.select('user.DirectoryFact', { kind: args.matchKind, value: args.matchValue });
+    if (!facts.length && !(previous?.matchKind === args.matchKind && previous?.matchValue === args.matchValue))
+        fail('matchValue', 'E_DIRECTORY_VALUE_UNKNOWN');
+    const scopeKind = String(args.scopeKind ?? 'company');
+    if (!['tenant', 'company', 'branch'].includes(scopeKind))
+        fail('scopeKind', 'E_ASSIGNMENT_SCOPE_INVALID');
+    const companyId = scopeKind === 'tenant' ? null : args.companyId || null;
+    const branchId = scopeKind === 'branch' ? args.branchId || null : null;
+    if (scopeKind !== 'tenant' &&
+        !(await ctx.db.select('company.Company', { id: companyId, active: true })).length)
+        fail('companyId', 'E_ASSIGNMENT_SCOPE_INVALID');
+    if (scopeKind === 'branch' &&
+        !(await ctx.db.select('company.Branch', { id: branchId, companyId, active: true })).length)
+        fail('branchId', 'E_ASSIGNMENT_SCOPE_INVALID');
+    return {
+        id,
+        name: String(args.name).trim(),
+        description: args.description || null,
+        matchKind: args.matchKind,
+        matchValue: args.matchValue,
+        roleIds,
+        scopeKind,
+        companyId,
+        branchId,
+        active: previous?.active !== false,
+    };
+}
+/** Recompute only this owner's edges; memberships are never silently granted by a rule. */
+async function desiredAssignments(ctx, policy) {
+    if (!policy.active)
+        return [];
+    // An outdated or disabled managed role must stop granting access without blocking directory updates.
+    for (const id of policy.roleIds) {
+        const role = (await ctx.db.select('user.Role', { id }))[0];
+        if (!role ||
+            role.mode !== 'managed' ||
+            managedRoleHealthIssues(ctx.manifest, role, await ctx.db.select('user.Grant', { roleId: id }), await ctx.db.select('user.GrantSource', { roleId: id })).length)
+            return [];
+    }
+    const facts = await ctx.db.select('user.DirectoryFact', {
+        kind: policy.matchKind,
+        value: policy.matchValue,
+    });
+    const rows = [];
+    for (const userId of [...new Set(facts.map((row) => String(row.userId)))].sort()) {
+        const person = (await ctx.db.select('user.User', { id: userId, active: true }))[0];
+        if (!person || person.accessKind !== 'internal')
+            continue;
+        const scope = await normalizeAssignmentScope(ctx, userId, policy);
+        if (!scope.ok)
+            continue;
+        for (const roleId of policy.roleIds)
+            rows.push({
+                id: permissionDigest([policy.id, userId, roleId, scope.scope.scopeKey]),
+                policyId: policy.id,
+                userId,
+                roleId,
+                ...scope.scope,
+            });
+    }
+    return rows;
+}
+async function difference(ctx, policy) {
+    const before = await ctx.db.select('user.PolicyAssignment', { policyId: policy.id });
+    const after = await desiredAssignments(ctx, policy);
+    const beforeIds = new Set(before.map((row) => row.id)), afterIds = new Set(after.map((row) => row.id));
+    return {
+        before,
+        after,
+        added: after.filter((row) => !beforeIds.has(row.id)),
+        removed: before.filter((row) => !afterIds.has(row.id)),
+    };
+}
+async function reconcile(ctx, policy, revision, allowSelf = false) {
+    const diff = await difference(ctx, policy);
+    if (!allowSelf && [...diff.added, ...diff.removed].some((row) => row.userId === ctx.actor))
+        fail('roleIds', 'E_SELF_AUTHORIZATION_FORBIDDEN');
+    for (const row of diff.removed) {
+        const A = ctx.table('user.PolicyAssignment');
+        await ctx.db.del(deleteFrom(A).where(eq(A.id, row.id)));
+    }
+    for (const row of diff.added)
+        await ctx.db.insert('user.PolicyAssignment', row);
+    for (const userId of new Set([...diff.added, ...diff.removed].map((row) => String(row.userId)))) {
+        await recordAuthorizationAudit(ctx, {
+            event: 'authorization.policy.reconciled',
+            targetKind: 'policy',
+            targetId: String(policy.id),
+            userId,
+            source: String(policy.id),
+            reason: '',
+            revision,
+            before: diff.before.filter((row) => row.userId === userId),
+            after: diff.after.filter((row) => row.userId === userId),
+        });
+    }
+    return diff;
+}
+/** Reconcile membership and catalogue changes that originate outside the policy editor. */
+export async function reconcileAccessPolicies(ctx) {
+    return authorizationTransaction(ctx, async (tx) => {
+        const changed = [];
+        for (const policy of await tx.db.select('user.AccessPolicy')) {
+            const diff = await difference(tx, policy);
+            if (diff.added.length || diff.removed.length)
+                changed.push(policy);
+        }
+        if (!changed.length)
+            return { ok: true, changed: 0 };
+        const revision = await bumpRevision(tx, await authorizationRevisionOf(tx));
+        if (revision === null)
+            fail('revision', 'E_AUTHORIZATION_REVISION_CONFLICT');
+        for (const policy of changed)
+            await reconcile(tx, policy, revision, true);
+        return { ok: true, changed: changed.length };
+    });
+}
+async function previewDigest(ctx, policy) {
+    const diff = await difference(ctx, policy);
+    const { id: _id, ...rule } = policy;
+    const identity = (row) => [row.userId, row.roleId, row.scopeKey];
+    return permissionDigest({
+        rule,
+        revision: await authorizationRevisionOf(ctx),
+        added: diff.added.map(identity),
+        removed: diff.removed.map(identity),
+    });
+}
+async function mutate(ctx, args, action, body) {
+    return authorizationTransaction(ctx, async (tx) => {
+        await authority(tx, action === 'save' ? 'user.saveAccessPolicy' : 'user.setAccessPolicyActive');
+        if (!String(args.idempotencyKey ?? '').trim())
+            fail('idempotencyKey', 'user.error.required');
+        const key = `policy:${action}:${ctx.actor}:${args.idempotencyKey}`;
+        const replay = await operationReplay(tx, key, args);
+        if ('conflict' in replay)
+            fail('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT');
+        if ('replay' in replay && replay.replay)
+            return { ...replay.result, replayed: true };
+        const revision = await bumpRevision(tx, Number(args.expectedAuthorizationRevision));
+        if (revision === null)
+            fail('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT');
+        const result = { ok: true, ...(await body(tx, revision)), revision, replayed: false };
+        await completeOperation(tx, key, result);
+        return result;
+    });
+}
+const policyInput = {
+    id: 'id?',
+    name: 'text',
+    description: 'text?',
+    matchKind: 'text',
+    matchValue: 'text',
+    roleIds: 'json',
+    scopeKind: 'text',
+    companyId: 'id?',
+    branchId: 'id?',
+};
+const writeInput = { expectedAuthorizationRevision: 'int', idempotencyKey: 'text' };
+async function previewAccessPolicy(ctx, args) {
+    return authorizationTransaction(ctx, async (tx) => {
+        await authority(tx, 'user.previewAccessPolicy');
+        const policy = await validatedPolicy(tx, args);
+        const diff = await difference(tx, policy);
+        const users = new Map((await tx.db.select('user.User')).map((row) => [String(row.id), row]));
+        const roles = new Map((await tx.db.select('user.Role')).map((row) => [String(row.id), String(row.name)]));
+        const changed = [...new Set([...diff.added, ...diff.removed].map((row) => String(row.userId)))];
+        return {
+            ok: true,
+            previewDigest: await previewDigest(tx, policy),
+            changes: changed.map((userId) => ({
+                userId,
+                name: users.get(userId)?.name ?? userId,
+                added: diff.added.filter((row) => row.userId === userId).map((row) => roles.get(String(row.roleId))),
+                removed: diff.removed
+                    .filter((row) => row.userId === userId)
+                    .map((row) => roles.get(String(row.roleId))),
+            })),
+            unchanged: new Set(diff.after.map((row) => row.userId).filter((id) => !changed.includes(String(id))))
+                .size,
+        };
+    });
+}
+async function saveAccessPolicy(ctx, args) {
+    return mutate(ctx, args, 'save', async (tx, revision) => {
+        if (!args.id)
+            fail('id', 'user.error.required');
+        const policy = await validatedPolicy(tx, args);
+        // Compare against the revision shown in the preview, before this transaction's CAS increment.
+        if (args.previewDigest) {
+            const diff = await difference(tx, policy);
+            const { id: _id, ...rule } = policy;
+            const identity = (row) => [row.userId, row.roleId, row.scopeKey];
+            const expected = permissionDigest({
+                rule,
+                revision: revision - 1,
+                added: diff.added.map(identity),
+                removed: diff.removed.map(identity),
+            });
+            if (expected !== args.previewDigest)
+                fail('previewDigest', 'E_AUTHORIZATION_REVISION_CONFLICT');
+        }
+        const before = (await tx.db.select('user.AccessPolicy', { id: policy.id }))[0] ?? null;
+        if (before)
+            await tx.db.update('user.AccessPolicy', { id: policy.id }, policy);
+        else
+            await tx.db.insert('user.AccessPolicy', policy);
+        await reconcile(tx, policy, revision);
+        await recordAuthorizationAudit(tx, {
+            event: 'authorization.policy.saved',
+            targetKind: 'policy',
+            targetId: String(policy.id),
+            source: String(policy.id),
+            reason: '',
+            before,
+            after: policy,
+            revision,
+        });
+        return { id: policy.id };
+    });
+}
+async function setAccessPolicyActive(ctx, args) {
+    return mutate(ctx, args, 'active', async (tx, revision) => {
+        const before = (await tx.db.select('user.AccessPolicy', { id: args.id }))[0];
+        if (!before)
+            fail('id', 'user.error.required');
+        const superuser = await authority(tx, 'user.setAccessPolicyActive');
+        const roles = args.active
+            ? await assertAssignableRoles(tx, before.roleIds)
+            : (await tx.db.select('user.Role')).filter((role) => before.roleIds.includes(String(role.id)));
+        if (!superuser && roles.some((role) => templateTier(tx, String(role.templateKey)) === 'security'))
+            fail('roleIds', 'E_SECURITY_ROLE_FORBIDDEN');
+        const policy = { ...before, active: args.active };
+        await tx.db.update('user.AccessPolicy', { id: args.id }, { active: args.active });
+        await reconcile(tx, policy, revision);
+        await recordAuthorizationAudit(tx, {
+            event: 'authorization.policy.state',
+            targetKind: 'policy',
+            targetId: String(args.id),
+            source: String(args.id),
+            reason: '',
+            before,
+            after: policy,
+            revision,
+        });
+        return { id: args.id };
+    });
+}
+/** Called only by a tenant-bound, authenticated directory adapter, never by a browser. */
+async function replaceDirectoryFacts(ctx, args) {
+    return authorizationTransaction(ctx, async (tx) => {
+        if (tx.actor !== 'system:user-directory')
+            fail('actor', 'E_AUTHORIZATION_FORBIDDEN');
+        if (!String(args.idempotencyKey ?? '').trim())
+            fail('idempotencyKey', 'user.error.required');
+        if (!Array.isArray(args.facts) || args.facts.length > 1000)
+            fail('facts', 'E_DIRECTORY_VALUE_UNKNOWN');
+        const facts = [];
+        for (const value of args.facts) {
+            if (!value || typeof value !== 'object')
+                fail('facts', 'E_DIRECTORY_VALUE_UNKNOWN');
+            const fact = value;
+            if (!kinds.includes(String(fact.kind)) ||
+                !String(fact.value ?? '').trim() ||
+                !String(fact.label ?? '').trim())
+                fail('facts', 'E_DIRECTORY_VALUE_UNKNOWN');
+            facts.push({
+                id: permissionDigest([args.userId, fact.kind, fact.value]),
+                userId: args.userId,
+                kind: String(fact.kind),
+                value: String(fact.value),
+                label: String(fact.label),
+            });
+        }
+        if (!(await tx.db.select('user.User', { id: args.userId })).length)
+            fail('userId', 'user.error.userMissing');
+        const key = `directory:${args.idempotencyKey}`;
+        const replay = await operationReplay(tx, key, args);
+        if ('conflict' in replay)
+            fail('idempotencyKey', 'E_AUTHORIZATION_REVISION_CONFLICT');
+        if ('replay' in replay && replay.replay)
+            return { ...replay.result, replayed: true };
+        const revision = await bumpRevision(tx, Number(args.expectedAuthorizationRevision));
+        if (revision === null)
+            fail('expectedAuthorizationRevision', 'E_AUTHORIZATION_REVISION_CONFLICT');
+        const F = tx.table('user.DirectoryFact');
+        await tx.db.del(deleteFrom(F).where(eq(F.userId, args.userId)));
+        for (const fact of new Map(facts.map((row) => [row.id, row])).values())
+            await tx.db.insert('user.DirectoryFact', fact);
+        for (const policy of await tx.db.select('user.AccessPolicy'))
+            await reconcile(tx, policy, revision, true);
+        const result = { ok: true, revision };
+        await completeOperation(tx, key, result);
+        return result;
+    });
+}
+export const accessPolicyFunctions = {
+    replaceDirectoryFacts: defineFn({
+        exposure: 'internal',
+        input: { userId: 'id', facts: 'json', ...writeInput },
+        effects: ACCESS_POLICY_EFFECTS,
+        idempotent: true,
+        handler: replaceDirectoryFacts,
+    }),
+    previewAccessPolicy: defineFn({ input: policyInput, effects: reads, handler: previewAccessPolicy }),
+    saveAccessPolicy: defineFn({
+        input: { ...policyInput, ...writeInput, previewDigest: 'text?' },
+        effects: ACCESS_POLICY_EFFECTS,
+        idempotent: true,
+        handler: saveAccessPolicy,
+    }),
+    setAccessPolicyActive: defineFn({
+        input: { id: 'id', active: 'bool', ...writeInput },
+        effects: ACCESS_POLICY_EFFECTS,
+        idempotent: true,
+        handler: setAccessPolicyActive,
+    }),
+    listAccessPolicies: defineFn({
+        input: {},
+        effects: reads,
+        handler: async (ctx) => {
+            await authority(ctx, 'user.listAccessPolicies');
+            const policies = await ctx.db.select('user.AccessPolicy');
+            const places = await workplaces(ctx);
+            const assignments = await ctx.db.select('user.PolicyAssignment');
+            const facts = await ctx.db.select('user.DirectoryFact');
+            return policies.map((policy) => ({
+                ...policy,
+                companyLabel: places.companies.find((row) => row.id === policy.companyId)?.name ?? null,
+                branchLabel: places.branches.find((row) => row.id === policy.branchId)?.name ?? null,
+                matchLabel: facts.find((fact) => fact.kind === policy.matchKind && fact.value === policy.matchValue)?.label ??
+                    policy.matchValue,
+                memberCount: new Set(assignments.filter((row) => row.policyId === policy.id).map((row) => row.userId))
+                    .size,
+            }));
+        },
+    }),
+    accessPolicyModalContext: defineFn({
+        input: { id: 'id?', locale: 'text?' },
+        effects: reads,
+        handler: async (ctx, args) => {
+            await authority(ctx, 'user.accessPolicyModalContext');
+            const record = args.id
+                ? (await ctx.db.select('user.AccessPolicy', { id: args.id }))[0]
+                : {
+                    id: '',
+                    name: '',
+                    description: '',
+                    active: true,
+                    matchKind: 'idpGroup',
+                    matchValue: '',
+                    roleIds: [],
+                    scopeKind: 'company',
+                    companyId: null,
+                    branchId: null,
+                };
+            if (!record)
+                return null;
+            const held = await effectiveFunctionKeys(ctx, ctx.actor);
+            const can = (fn) => held === null || held.includes(fn);
+            const facts = await ctx.db.select('user.DirectoryFact');
+            const roles = [];
+            for (const role of await ctx.db.select('user.Role')) {
+                if (role.mode !== 'managed')
+                    continue;
+                const grants = await ctx.db.select('user.Grant', { roleId: role.id });
+                const sources = await ctx.db.select('user.GrantSource', { roleId: role.id });
+                if (!managedRoleHealthIssues(ctx.manifest, role, grants, sources).length)
+                    roles.push({ id: role.id, name: role.name, tier: templateTier(ctx, String(role.templateKey)) });
+            }
+            const assignments = args.id ? await ctx.db.select('user.PolicyAssignment', { policyId: args.id }) : [];
+            const users = new Map((await ctx.db.select('user.User')).map((row) => [String(row.id), row]));
+            const matching = args.id && record.active
+                ? facts.filter((fact) => fact.kind === record.matchKind && fact.value === record.matchValue)
+                : [];
+            const applied = new Set(assignments.map((row) => String(row.userId)));
+            const memberIds = [...new Set([...applied, ...matching.map((row) => String(row.userId))])];
+            const lang = args.locale === 'en' ? 'en' : 'vi';
+            const places = await workplaces(ctx);
+            return {
+                data: {
+                    record,
+                    roles,
+                    companies: places.companies,
+                    branches: places.branches,
+                    scopeKinds: ['tenant', 'company', 'branch'],
+                    matchKinds: kinds,
+                    matchOptions: Object.fromEntries(kinds.map((kind) => [
+                        kind,
+                        [
+                            ...new Map(facts
+                                .filter((row) => row.kind === kind)
+                                .map((row) => [String(row.value), { value: row.value, label: row.label }])).values(),
+                        ],
+                    ])),
+                    members: memberIds.map((id) => ({
+                        id,
+                        name: users.get(id)?.name ?? id,
+                        login: users.get(id)?.login ?? '',
+                        status: applied.has(id) ? 'applied' : 'blocked',
+                    })),
+                    revision: await authorizationRevisionOf(ctx),
+                    lang,
+                    actor: { superuser: held === null },
+                    permissions: {
+                        create: can('user.saveAccessPolicy'),
+                        save: can('user.saveAccessPolicy'),
+                        pause: can('user.setAccessPolicyActive'),
+                    },
+                },
+                messages: userModalMessages(ctx, lang),
+            };
+        },
+    }),
+};
+//# sourceMappingURL=access-policy.js.map

package/dist/modules/user/access-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-policy.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/user/access-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;AACpD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAY,EAAS,EAAE,CAClD,kBAAkB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,GAAG,qBAAqB;IACxB,sBAAsB;IACtB,yBAAyB;IACzB,0BAA0B;IAC1B,wBAAwB;IACxB,yBAAyB;IACzB,6BAA6B;CAC9B,CAAA;AACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;AAEpF,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,EAAU;IAC3C,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAM,CAAC,CAAA;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,IAAI,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAA;IACnF,OAAO,IAAI,KAAK,IAAI,CAAA;AACtB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAQ,EAAE,IAAS;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACvF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;IACxE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAE,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAA;IACrF,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAA;IAC3D,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACvD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;IAC/D,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,UAAU,CAAC;QAChG,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;IACzG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,KAAK,IAAI,CAAC,SAAS,IAAI,QAAQ,EAAE,UAAU,KAAK,IAAI,CAAC,UAAU,CAAC;QACxG,IAAI,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAA;IACrD,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAA;IACzG,MAAM,SAAS,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAA;IACxE,MAAM,QAAQ,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACtE,IACE,SAAS,KAAK,QAAQ;QACtB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM;QAEjF,IAAI,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAA;IACjD,IACE,SAAS,KAAK,QAAQ;QACtB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM;QAE1F,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAA;IAChD,OAAO;QACL,EAAE;QACF,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;QAC9B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO;QACP,SAAS;QACT,SAAS;QACT,QAAQ;QACR,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,KAAK;KACnC,CAAA;AACH,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,kBAAkB,CAAC,GAAQ,EAAE,MAAW;IACrD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAC7B,qGAAqG;IACrG,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,OAAmB,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1D,IACE,CAAC,IAAI;YACL,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,uBAAuB,CACrB,GAAG,CAAC,QAAQ,EACZ,IAAI,EACJ,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EACjD,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACxD,CAAC,MAAM;YAER,OAAO,EAAE,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE;QACtD,IAAI,EAAE,MAAM,CAAC,SAAS;QACtB,KAAK,EAAE,MAAM,CAAC,UAAU;KACzB,CAAC,CAAA;IACF,MAAM,IAAI,GAAU,EAAE,CAAA;IACtB,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACjF,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAClF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU;YAAE,SAAQ;QACzD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACjE,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,SAAQ;QACvB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAmB;YAC7C,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACvE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,MAAM;gBACN,MAAM;gBACN,GAAG,KAAK,CAAC,KAAK;aACf,CAAC,CAAA;IACN,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAQ,EAAE,MAAW;IAC7C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;IACpF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EACpD,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAChD,OAAO;QACL,MAAM;QACN,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;KACvD,CAAA;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,MAAW,EAAE,QAAgB,EAAE,SAAS,GAAG,KAAK;IACjF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC;QACxF,IAAI,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAA;IACnD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC5C,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAA;IAC/E,KAAK,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,wBAAwB,CAAC,GAAG,EAAE;YAClC,KAAK,EAAE,iCAAiC;YACxC,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,EAAE;YACV,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;YAC1D,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;SACzD,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAQ;IACpD,OAAO,wBAAwB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAChD,MAAM,OAAO,GAAU,EAAE,CAAA;QACzB,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YACzC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;QACpD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAA;QAC1E,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,CAAC,UAAU,EAAE,mCAAmC,CAAC,CAAA;QAC5E,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,QAAS,EAAE,IAAI,CAAC,CAAA;QAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;IAC9C,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAQ,EAAE,MAAW;IAChD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IACnC,MAAM,QAAQ,GAAG,CAAC,GAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IACrE,OAAO,gBAAgB,CAAC;QACtB,IAAI;QACJ,QAAQ,EAAE,MAAM,uBAAuB,CAAC,GAAG,CAAC;QAC5C,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;KACpC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,GAAQ,EACR,IAAS,EACT,MAAc,EACd,IAAiD;IAEjD,OAAO,wBAAwB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAChD,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAA;QAC/F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAA;QAC5F,MAAM,GAAG,GAAG,UAAU,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,cAAc,EAAE,CAAA;QAClE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QACnD,IAAI,UAAU,IAAI,MAAM;YAAE,IAAI,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,CAAA;QACrF,IAAI,QAAQ,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,GAAI,MAAM,CAAC,MAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC7F,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAA;QACnF,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,CAAC,+BAA+B,EAAE,mCAAmC,CAAC,CAAA;QACjG,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,EAAE,QAAS,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QACtF,MAAM,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QACxC,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,OAAO;IACpB,SAAS,EAAE,MAAM;IACjB,UAAU,EAAE,MAAM;IAClB,OAAO,EAAE,MAAM;IACf,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,KAAK;IAChB,QAAQ,EAAE,KAAK;CACP,CAAA;AACV,MAAM,UAAU,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAW,CAAA;AAE5F,KAAK,UAAU,mBAAmB,CAAC,GAAQ,EAAE,IAAS;IACpD,OAAO,wBAAwB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAChD,MAAM,SAAS,CAAC,EAAE,EAAE,0BAA0B,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;QAC5F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACzG,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/F,OAAO;YACL,EAAE,EAAE,IAAI;YACR,aAAa,EAAE,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC;YAC9C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAChC,MAAM;gBACN,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,MAAM;gBACvC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpG,OAAO,EAAE,IAAI,CAAC,OAAO;qBAClB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;qBACtC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;aAC/C,CAAC,CAAC;YACH,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBAClG,IAAI;SACR,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AACD,KAAK,UAAU,gBAAgB,CAAC,GAAQ,EAAE,IAAS;IACjD,OAAO,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;QACtD,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC9C,8FAA8F;QAC9F,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YACzC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;YACnC,MAAM,QAAQ,GAAG,CAAC,GAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;YACrE,MAAM,QAAQ,GAAG,gBAAgB,CAAC;gBAChC,IAAI;gBACJ,QAAQ,EAAE,QAAQ,GAAG,CAAC;gBACtB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;aACpC,CAAC,CAAA;YACF,IAAI,QAAQ,KAAK,IAAI,CAAC,aAAa;gBAAE,IAAI,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAA;QACjG,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QACtF,IAAI,MAAM;YAAE,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;;YACzE,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAA;QACpD,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QACrC,MAAM,wBAAwB,CAAC,EAAE,EAAE;YACjC,KAAK,EAAE,4BAA4B;YACnC,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,EAAE;YACV,MAAM;YACN,KAAK,EAAE,MAAM;YACb,QAAQ;SACT,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAA;IAC1B,CAAC,CAAC,CAAA;AACJ,CAAC;AACD,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,IAAS;IACtD,OAAO,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5E,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,4BAA4B,CAAC,CAAA;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM;YACvB,CAAC,CAAC,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,OAAmB,CAAC;YAC7D,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,MAAM,CAAC,OAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CACvD,CAAA;QACL,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,UAAU,CAAC;YAC/F,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;QACjD,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACjF,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QACrC,MAAM,wBAAwB,CAAC,EAAE,EAAE;YACjC,KAAK,EAAE,4BAA4B;YACnC,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,EAAE;YACV,MAAM;YACN,KAAK,EAAE,MAAM;YACb,QAAQ;SACT,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,IAAS;IACtD,OAAO,wBAAwB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAChD,IAAI,EAAE,CAAC,KAAK,KAAK,uBAAuB;YAAE,IAAI,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAA;QACpF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAA;QAC5F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI;YAAE,IAAI,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAA;QACtG,MAAM,KAAK,GAAU,EAAE,CAAA;QACvB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAkB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,IAAI,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAA;YACnF,MAAM,IAAI,GAAG,KAAY,CAAA;YACzB,IACE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBAChC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBAEhC,IAAI,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAA;YAC5C,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBACvB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;gBACzB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM;YAChE,IAAI,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAA;QAC1C,MAAM,GAAG,GAAG,aAAa,IAAI,CAAC,cAAc,EAAE,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QACnD,IAAI,UAAU,IAAI,MAAM;YAAE,IAAI,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,CAAA;QACrF,IAAI,QAAQ,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,GAAI,MAAM,CAAC,MAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC7F,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAA;QACnF,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,CAAC,+BAA+B,EAAE,mCAAmC,CAAC,CAAA;QACjG,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;QACxC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC/D,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;YACpE,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAA;QAChD,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAAE,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,QAAS,EAAE,IAAI,CAAC,CAAA;QAC1G,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QACrC,MAAM,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QACxC,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAA2B;IAC3D,qBAAqB,EAAE,QAAQ,CAAC;QAC9B,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE;QACrD,OAAO,EAAE,qBAAqB;QAC9B,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,qBAAqB;KAC/B,CAAC;IACF,mBAAmB,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACnG,gBAAgB,EAAE,QAAQ,CAAC;QACzB,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE;QAChE,OAAO,EAAE,qBAAqB;QAC9B,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,gBAAgB;KAC1B,CAAC;IACF,qBAAqB,EAAE,QAAQ,CAAC;QAC9B,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE;QAClD,OAAO,EAAE,qBAAqB;QAC9B,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,qBAAqB;KAC/B,CAAC;IACF,kBAAkB,EAAE,QAAQ,CAAC;QAC3B,KAAK,EAAE,EAAE;QACT,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;YAC/C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;YACzD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;YACpC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAA;YAChE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;YACvD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC/B,GAAG,MAAM;gBACT,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,IAAI,IAAI;gBACvF,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,IAAI;gBACpF,UAAU,EACR,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK;oBAC/F,MAAM,CAAC,UAAU;gBACnB,WAAW,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;qBACnG,IAAI;aACR,CAAC,CAAC,CAAA;QACL,CAAC;KACF,CAAC;IACF,wBAAwB,EAAE,QAAQ,CAAC;QACjC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QACrC,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAA;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;gBACpB,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChE,CAAC,CAAC;oBACE,EAAE,EAAE,EAAE;oBACN,IAAI,EAAE,EAAE;oBACR,WAAW,EAAE,EAAE;oBACf,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE,UAAU;oBACrB,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,EAAE;oBACX,SAAS,EAAE,SAAS;oBACpB,SAAS,EAAE,IAAI;oBACf,QAAQ,EAAE,IAAI;iBACf,CAAA;YACL,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAM,CAAC,CAAA;YACzD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAC9D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;YACvD,MAAM,KAAK,GAAU,EAAE,CAAA;YACvB,KAAK,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;oBAAE,SAAQ;gBACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;gBACrE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;gBAC5E,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM;oBACtE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAA;YACnG,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACtG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YAC7F,MAAM,QAAQ,GACZ,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM;gBACtB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,UAAU,CAAC;gBAC5F,CAAC,CAAC,EAAE,CAAA;YACR,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YACrE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;YAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;YACpC,OAAO;gBACL,IAAI,EAAE;oBACJ,MAAM;oBACN,KAAK;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;oBAC3C,UAAU,EAAE,KAAK;oBACjB,YAAY,EAAE,MAAM,CAAC,WAAW,CAC9B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;wBAClB,IAAI;wBACJ;4BACE,GAAG,IAAI,GAAG,CACR,KAAK;iCACF,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;iCAClC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAC7E,CAAC,MAAM,EAAE;yBACX;qBACF,CAAC,CACH;oBACD,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;wBAC9B,EAAE;wBACF,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,EAAE;wBAC/B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE;wBACjC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;qBAChD,CAAC,CAAC;oBACH,QAAQ,EAAE,MAAM,uBAAuB,CAAC,GAAG,CAAC;oBAC5C,IAAI;oBACJ,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,KAAK,IAAI,EAAE;oBACnC,WAAW,EAAE;wBACX,MAAM,EAAE,GAAG,CAAC,uBAAuB,CAAC;wBACpC,IAAI,EAAE,GAAG,CAAC,uBAAuB,CAAC;wBAClC,KAAK,EAAE,GAAG,CAAC,4BAA4B,CAAC;qBACzC;iBACF;gBACD,QAAQ,EAAE,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC;aACvC,CAAA;QACH,CAAC;KACF,CAAC;CACH,CAAA"}

package/dist/modules/user/access-surfaces.d.ts

@@ -0,0 +1,26 @@
+import type { Ctx, Row } from '@ketvietlab/ketjs';
+type Lang = 'vi' | 'en';
+type CatalogueContext = Pick<Ctx, 'manifest'>;
+/** One message in the reader's language, or null when the catalogue does not have it. */
+export declare const messageOf: (ctx: CatalogueContext, lang: Lang, key: string) => string | null;
+/** What a function is part of, in words: the first bundle that carries it. */
+export declare const functionLabel: (ctx: CatalogueContext, lang: Lang, fn: string) => string;
+/**
+ * Every screen `holds` opens, one row per menu entry.
+ *
+ * A screen opens on its menu's `needs`; required reads are declared separately
+ * in `requires`. Optional work in `for` never implies broken access. A screen that opens without its required reads is the
+ * one that fails in front of someone, so it says what is missing and which role
+ * templates would cover all of it. Screens that do not open are left out.
+ */
+export declare const surfaceRows: (ctx: CatalogueContext, lang: Lang, holds: (fn: string) => boolean, via?: (fn: string) => string[]) => Row[];
+/**
+ * Whether a role template hands out authority over authority.
+ *
+ * A template holding any security-risk function — assigning roles, minting
+ * credentials, changing who may do what — is marked, so a form can say which
+ * roles only a superuser may give.
+ */
+export declare const templateTier: (ctx: CatalogueContext, templateKey: string) => 'security' | 'standard';
+export {};
+//# sourceMappingURL=access-surfaces.d.ts.map

package/dist/modules/user/access-surfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-surfaces.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/user/access-surfaces.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEjD,KAAK,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AACvB,KAAK,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;AAE7C,yFAAyF;AACzF,eAAO,MAAM,SAAS,QAAS,gBAAgB,QAAQ,IAAI,OAAO,MAAM,KAAG,MAAM,GAAG,IAInF,CAAA;AAED,8EAA8E;AAC9E,eAAO,MAAM,aAAa,QAAS,gBAAgB,QAAQ,IAAI,MAAM,MAAM,KAAG,MAM7E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,QACjB,gBAAgB,QACf,IAAI,SACH,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,QACzB,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,EAAE,KAC5B,GAAG,EA6CL,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,QAAS,gBAAgB,eAAe,MAAM,KAAG,UAAU,GAAG,UAKtF,CAAA"}

package/dist/modules/user/access-surfaces.js

@@ -0,0 +1,76 @@
+// What a set of functions opens, screen by screen.
+//
+// Shared by the user and role record-modal contexts: a person is measured by what
+// they effectively hold where they land, a role template by what it grants. Both
+// answer the same question the same way, so the two modals never disagree.
+/** One message in the reader's language, or null when the catalogue does not have it. */
+export const messageOf = (ctx, lang, key) => {
+    const message = ctx.manifest.messages?.[lang]?.[key];
+    if (message == null)
+        return null;
+    return typeof message === 'string' ? message : String(message.other ?? Object.values(message)[0] ?? key);
+};
+/** What a function is part of, in words: the first bundle that carries it. */
+export const functionLabel = (ctx, lang, fn) => {
+    const bundle = ctx.manifest.permissions.functions[fn]?.bundles[0];
+    return ((bundle && ctx.manifest.permissions.bundles[bundle]?.labels[lang]) ||
+        (lang === 'vi' ? 'Chức năng chưa có tên' : 'Unnamed capability'));
+};
+/**
+ * Every screen `holds` opens, one row per menu entry.
+ *
+ * A screen opens on its menu's `needs`; required reads are declared separately
+ * in `requires`. Optional work in `for` never implies broken access. A screen that opens without its required reads is the
+ * one that fails in front of someone, so it says what is missing and which role
+ * templates would cover all of it. Screens that do not open are left out.
+ */
+export const surfaceRows = (ctx, lang, holds, via = () => []) => {
+    const menus = ctx.manifest.menus ?? {};
+    const label = (def) => messageOf(ctx, lang, `${def.by}.${def.label}`) ?? messageOf(ctx, lang, def.label) ?? def.label;
+    const templates = Object.values(ctx.manifest.permissions.roleTemplates);
+    return Object.entries(menus)
+        .filter(([, def]) => def.path && def.needs && ctx.manifest.functions[def.needs] && holds(def.needs))
+        .map(([key, def]) => {
+        const work = [...new Set([String(def.needs), ...(def.requires ?? [])])];
+        const missing = work.filter((fn) => !holds(fn));
+        const parent = def.parent ? menus[def.parent] : undefined;
+        return {
+            key,
+            label: label(def),
+            area: parent ? label(parent) : '',
+            status: missing.length ? 'partial' : 'full',
+            missing: missing.map((fn) => ({
+                key: fn,
+                label: functionLabel(ctx, lang, fn),
+                tier: ctx.manifest.permissions.functions[fn]?.risk === 'read' ? 'read' : 'write',
+            })),
+            via: via(String(def.needs)),
+            fixes: missing.length
+                ? templates
+                    .filter((template) => missing.every((fn) => template.functions.includes(fn)) &&
+                    // A suggestion must not grant unrelated or security authority.
+                    template.functions.every((fn) => (holds(fn) || missing.includes(fn)) &&
+                        ctx.manifest.permissions.functions[fn]?.risk !== 'security'))
+                    .map((template) => template.labels[lang])
+                    .slice(0, 3)
+                : [],
+        };
+    })
+        .sort((a, b) => Number(a.status === 'full') - Number(b.status === 'full') ||
+        String(a.area).localeCompare(String(b.area)) ||
+        String(a.label).localeCompare(String(b.label)));
+};
+/**
+ * Whether a role template hands out authority over authority.
+ *
+ * A template holding any security-risk function — assigning roles, minting
+ * credentials, changing who may do what — is marked, so a form can say which
+ * roles only a superuser may give.
+ */
+export const templateTier = (ctx, templateKey) => {
+    const template = ctx.manifest.permissions.roleTemplates[templateKey];
+    return template?.functions.some((fn) => ctx.manifest.permissions.functions[fn]?.risk === 'security')
+        ? 'security'
+        : 'standard';
+};
+//# sourceMappingURL=access-surfaces.js.map

package/dist/modules/user/access-surfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-surfaces.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/user/access-surfaces.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,2EAA2E;AAO3E,yFAAyF;AACzF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAqB,EAAE,IAAU,EAAE,GAAW,EAAiB,EAAE;IACzF,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAA;IACpD,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;AAC1G,CAAC,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAqB,EAAE,IAAU,EAAE,EAAU,EAAU,EAAE;IACrF,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IACjE,OAAO,CACL,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CACjE,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,GAAqB,EACrB,IAAU,EACV,KAA8B,EAC9B,GAAG,GAA6B,GAAG,EAAE,CAAC,EAAE,EACjC,EAAE;IACT,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,CAAC,GAAkC,EAAU,EAAE,CAC3D,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAA;IAChG,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA;IACvE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SACnG,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAO,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACzD,OAAO;YACL,GAAG;YACH,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;YACjC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YAC3C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC5B,GAAG,EAAE,EAAE;gBACP,KAAK,EAAE,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;aACjF,CAAC,CAAC;YACH,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,KAAK,EAAE,OAAO,CAAC,MAAM;gBACnB,CAAC,CAAC,SAAS;qBACN,MAAM,CACL,CAAC,QAAQ,EAAE,EAAE,CACX,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBACtD,+DAA+D;oBAC/D,QAAQ,CAAC,SAAS,CAAC,KAAK,CACtB,CAAC,EAAE,EAAE,EAAE,CACL,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;wBACnC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,KAAK,UAAU,CAC9D,CACJ;qBACA,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;qBACxC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChB,CAAC,CAAC,EAAE;SACP,CAAA;IACH,CAAC,CAAC;SACD,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACjD,CAAA;AACL,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAqB,EAAE,WAAmB,EAA2B,EAAE;IAClG,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;IACpE,OAAO,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,KAAK,UAAU,CAAC;QAClG,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC,CAAA"}

package/dist/modules/user/authorization.d.ts

@@ -61,6 +61,7 @@ export declare const normalizeAssignmentScope: (ctx: Ctx, userId: string, values
 }>;
 export declare const authorizationRevisionOf: (ctx: Ctx) => Promise<number>;
 export declare const advanceAuthorizationRevision: (ctx: Ctx) => Promise<number>;
+export declare const bumpRevision: (ctx: Ctx, expected: number) => Promise<number | null>;
 export declare const recordAuthorizationAudit: (ctx: Ctx, values: {
     event: string;
     targetKind: string;
@@ -75,6 +76,16 @@ export declare const recordAuthorizationAudit: (ctx: Ctx, values: {
     revision: number;
     outcome?: string;
 }) => Promise<void>;
+export declare const operationReplay: (ctx: Ctx, id: string, input: unknown) => Promise<{
+    replay: true;
+    result: unknown;
+} | {
+    replay: false;
+    digest: string;
+} | {
+    conflict: true;
+}>;
+export declare const completeOperation: (ctx: Ctx, id: string, result: unknown) => Promise<void>;
 /**
  * Validate the persisted union behind a managed role.
  *
@@ -129,7 +140,7 @@ export type InternalUserInput = {
     companyId: string;
     branchId?: string | null;
     roleIds: string[];
-    reason: string;
+    reason?: string;
 };
 /** Caller owns the identity adapter; this primitive owns the atomic local account/access boundary. */
 export declare function createInternalUserWithAccess<T extends Record<string, unknown>>(ctx: Ctx, input: InternalUserInput, afterCreate: (tx: Ctx) => Promise<T>): Promise<{