@numa-tech/numa 1.12.10 → 1.13.0

package/dist/authorization/commands.js

@@ -0,0 +1,296 @@
+import process from "node:process";
+import { setTimeout as delay } from "node:timers/promises";
+import open from "open";
+import { loadAppConfig } from "../app-config.js";
+import { loadConfig } from "../config.js";
+import { AuthorizationClient } from "./client.js";
+import { AuthorizationError, sanitizeAuthorizationOutput } from "./errors.js";
+import { AccessRequestClient } from "./access-request-client.js";
+import { registerAccessRequestCommands } from "./access-request-commands.js";
+const ROLE_PREFIX = "mci-devops-platform-";
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/u;
+const IDEMPOTENCY_KEY = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,199}$/u;
+function addExamples(command, examples, notes = []) {
+    const noteSection = notes.length
+        ? `\n说明:\n${notes.map((item) => `  - ${item}`).join("\n")}\n`
+        : "";
+    return command.addHelpText("after", `${noteSection}\nExamples:\n${examples.map((item) => `  ${item}`).join("\n")}\n`);
+}
+function snakeCase(key) {
+    return key.replace(/([a-z0-9])([A-Z])/gu, "$1_$2").toLowerCase();
+}
+export function stableAuthorizationOutput(value) {
+    const safe = sanitizeAuthorizationOutput(value);
+    if (Array.isArray(safe))
+        return safe.map(stableAuthorizationOutput);
+    if (safe && typeof safe === "object") {
+        return Object.fromEntries(Object.entries(safe).map(([key, item]) => [snakeCase(key), stableAuthorizationOutput(item)]));
+    }
+    return safe;
+}
+async function jsonEnabled(command) {
+    const config = await loadAppConfig();
+    return Boolean(command.optsWithGlobals().json || config.output === "json");
+}
+async function output(command, payload, textValue) {
+    if (await jsonEnabled(command)) {
+        process.stdout.write(`${JSON.stringify(stableAuthorizationOutput(payload), null, 2)}\n`);
+    }
+    else {
+        process.stdout.write(`${String(sanitizeAuthorizationOutput(textValue))}\n`);
+    }
+}
+function boundedText(value, label, maximum) {
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.length > maximum || CONTROL_CHARACTERS.test(trimmed)) {
+        throw new AuthorizationError(`${label} must be non-empty, contain no control characters, and be at most ${maximum} characters.`, "authorization_input_invalid");
+    }
+    return trimmed;
+}
+export function parseAuthorizationRoleId(value) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 1 || String(parsed) !== value.trim()) {
+        throw new AuthorizationError("role-id must be a positive integer.", "authorization_input_invalid");
+    }
+    return parsed;
+}
+export function parseProvisioningRunId(value) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 1 || String(parsed) !== value.trim()) {
+        throw new AuthorizationError("run-id must be a positive integer.", "authorization_input_invalid");
+    }
+    return parsed;
+}
+export function parseBootstrapApplyInput(options) {
+    const expectedPlanDigest = boundedText(options.expectedPlanDigest, "expected-plan-digest", 64);
+    if (!/^[a-f0-9]{64}$/u.test(expectedPlanDigest)) {
+        throw new AuthorizationError("expected-plan-digest must be the 64-character lowercase SHA-256 value returned by bootstrap PLAN.", "authorization_input_invalid");
+    }
+    const idempotencyKey = options.idempotencyKey.trim();
+    if (!IDEMPOTENCY_KEY.test(idempotencyKey)) {
+        throw new AuthorizationError("idempotency-key must be 8-200 characters, start with a letter or number, and use only letters, numbers, . _ : or -.", "authorization_input_invalid");
+    }
+    const confirmRealm = boundedText(options.confirmRealm, "confirm-realm", 256);
+    if (!/^APPLY [A-Za-z0-9._-]+$/u.test(confirmRealm)) {
+        throw new AuthorizationError("confirm-realm must use the exact format 'APPLY <realm>'.", "authorization_input_invalid");
+    }
+    return { mode: "APPLY", expectedPlanDigest, idempotencyKey, confirmRealm };
+}
+export async function waitForKeycloakBootstrap(client, started, sleep = (milliseconds) => delay(milliseconds)) {
+    let deadline = Date.parse(started.expiresAt) + 15_000;
+    for (;;) {
+        const run = await client.getKeycloakBootstrapRun(started.runId);
+        if (["SUCCEEDED", "FAILED", "EXPIRED"].includes(run.status))
+            return run;
+        const serverDeadline = Date.parse(run.expiresAt) + 15_000;
+        if (Number.isFinite(serverDeadline))
+            deadline = Math.max(deadline, serverDeadline);
+        if (!Number.isFinite(deadline) || Date.now() >= deadline) {
+            throw new AuthorizationError(`Remote bootstrap run ${started.runId} did not finish before its authorization session expired.`, "authorization_conflict", 409, undefined, "BOOTSTRAP_SESSION_EXPIRED", started.runId);
+        }
+        await sleep(1_000);
+    }
+}
+export function parseRoleCreateInput(options) {
+    const code = boundedText(options.code, "code", 80);
+    if (!code.startsWith(ROLE_PREFIX)
+        || code.includes("..")
+        || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(code)) {
+        throw new AuthorizationError(`code must start with '${ROLE_PREFIX}', use only letters, numbers, '.', '_' or '-', and must not contain '..'.`, "authorization_input_invalid");
+    }
+    const name = boundedText(options.name, "name", 160);
+    const description = options.description == null
+        ? undefined
+        : boundedText(options.description, "description", 2_000);
+    return { code, name, ...(description ? { description } : {}), status: "ACTIVE" };
+}
+export function parseProvisionOptions(preview, options) {
+    if (!options.apply) {
+        if (options.expectedRemoteDigest != null || options.idempotencyKey != null) {
+            throw new AuthorizationError("--expected-remote-digest and --idempotency-key are only valid together with --apply.", "authorization_input_invalid");
+        }
+        return undefined;
+    }
+    if (!options.expectedRemoteDigest || !options.idempotencyKey) {
+        throw new AuthorizationError("--apply requires both --expected-remote-digest and --idempotency-key.", "authorization_input_invalid");
+    }
+    const expectedRemoteDigest = boundedText(options.expectedRemoteDigest, "expected-remote-digest", 256);
+    if (!/^[a-f0-9]{64}$/u.test(expectedRemoteDigest)) {
+        throw new AuthorizationError("expected-remote-digest must be the 64-character lowercase SHA-256 value returned by preview.", "authorization_input_invalid");
+    }
+    const idempotencyKey = options.idempotencyKey.trim();
+    if (!IDEMPOTENCY_KEY.test(idempotencyKey)) {
+        throw new AuthorizationError("idempotency-key must be 8-200 characters, start with a letter or number, and use only letters, numbers, . _ : or -.", "authorization_input_invalid");
+    }
+    if (!preview) {
+        throw new AuthorizationError("A fresh provisioning preview is required before apply.", "authorization_input_invalid");
+    }
+    if (preview.remoteDigest !== expectedRemoteDigest) {
+        throw new AuthorizationError("expected-remote-digest does not match the fresh preview; review the new plan before applying.", "authorization_conflict", 409);
+    }
+    return {
+        expectedRoleVersion: preview.roleVersion,
+        expectedRemoteDigest,
+        idempotencyKey
+    };
+}
+export async function provisionAuthorizationRole(client, roleId, options) {
+    const preview = await client.previewRole(roleId);
+    const applyInput = parseProvisionOptions(preview, options);
+    if (!applyInput)
+        return { preview };
+    return { preview, run: await client.applyRole(roleId, applyInput) };
+}
+function roleLine(role) {
+    return `${role.id}\t${role.status}\t${role.code}\t${role.name}\tv${role.version}`;
+}
+function previewLine(preview) {
+    return `${preview.roleId}\t${preview.remoteState}\t${preview.action}\t${preview.roleClientId}/${preview.roleName}\t${preview.remoteDigest}`;
+}
+function runLine(run) {
+    return `${run.runId}\t${run.status}\t${run.action}\t${run.roleClientId}/${run.roleName}`;
+}
+function bootstrapRunLine(run) {
+    const digest = run.planDigest ?? "-";
+    return `${run.runId}\t${run.mode}\t${run.status}\t${digest}`;
+}
+export function registerAuthorizationCommands(program, dependencies = {}) {
+    const client = () => dependencies.clientFactory?.()
+        ?? new AuthorizationClient(loadConfig("platform"));
+    const openBrowser = dependencies.openBrowser ?? (async (url) => { await open(url); });
+    const sleep = dependencies.sleep ?? ((milliseconds) => delay(milliseconds));
+    const authorization = program.command("authorization")
+        .description("通过平台授权管理业务角色并制备固定 Keycloak Client Role")
+        .addHelpText("after", `
+安全边界:
+  CLI 只使用当前 Numa PKCE 用户身份访问 DevOps 同源 API。
+  realm、client、Keycloak URL 和 service-account secret 均由服务端固定，不能通过本命令覆盖。
+  创建平台角色不会自动写 Keycloak；provision 默认只预览，写入必须显式 --apply。
+`);
+    registerAccessRequestCommands(authorization, {
+        clientFactory: dependencies.accessRequestClientFactory
+            ?? (() => new AccessRequestClient(loadConfig("platform")))
+    });
+    const role = authorization.command("role")
+        .description("管理平台 auth_role 并执行受控的 Keycloak Client Role 制备");
+    addExamples(role.command("list")
+        .description("列出平台角色及其版本；不直接访问 Keycloak")
+        .action(async (_options, command) => {
+        const roles = await client().listRoles();
+        await output(command, { ok: true, roles }, roles.map(roleLine).join("\n") || "没有找到平台角色");
+    }), ["numa authorization role list", "numa authorization role list --json"]);
+    addExamples(role.command("create")
+        .description("只创建 ACTIVE 平台角色；不会自动制备 Keycloak Client Role")
+        .requiredOption("--code <prefixed-role>", `带固定应用前缀的角色标识（${ROLE_PREFIX}...）`)
+        .requiredOption("--name <display-name>", "角色显示名称")
+        .option("--description <text>", "角色说明")
+        .action(async (options, command) => {
+        const created = await client().createRole(parseRoleCreateInput(options));
+        const nextCommand = `numa authorization role provision ${created.id}`;
+        await output(command, { ok: true, role: created, next_step: { command: nextCommand, mode: "preview" } }, `${roleLine(created)}\n下一步（仅预览）: ${nextCommand}`);
+    }), [
+        "numa authorization role create --code mci-devops-platform-auditor --name '审计员' --json",
+        "numa authorization role provision 42"
+    ], [
+        "请求体由 CLI 构造且 status 固定为 ACTIVE；服务端仍会校验并规范化角色标识。",
+        "创建成功后必须先执行 provision 预览，不会自动写入 Keycloak。"
+    ]);
+    addExamples(role.command("provision <role-id>")
+        .description("默认预览固定 Client Role 的 CREATE/UPDATE/NOOP；显式 --apply 才执行")
+        .option("--apply", "按新鲜预览执行 Keycloak Client Role 制备")
+        .option("--expected-remote-digest <digest>", "必须与本次新鲜预览一致的远端摘要")
+        .option("--idempotency-key <key>", "同一次执行重试必须复用的稳定键")
+        .action(async (roleIdValue, options, command) => {
+        const roleId = parseAuthorizationRoleId(roleIdValue);
+        // Validate flag combinations before authentication, then fetch a fresh preview.
+        if (!options.apply)
+            parseProvisionOptions(undefined, options);
+        else if (!options.expectedRemoteDigest || !options.idempotencyKey)
+            parseProvisionOptions(undefined, options);
+        const result = await provisionAuthorizationRole(client(), roleId, options);
+        await output(command, result.run
+            ? { ok: result.run.status !== "FAILED", preview: result.preview, provisioning_run: result.run }
+            : { ok: true, preview: result.preview, apply_required: result.preview.action !== "NOOP" }, result.run ? runLine(result.run) : previewLine(result.preview));
+        if (result.run?.status === "FAILED")
+            process.exitCode = 1;
+    }), [
+        "numa authorization role provision 42 --json",
+        `numa authorization role provision 42 --apply --expected-remote-digest ${"a".repeat(64)} --idempotency-key role-42-20260820 --json`
+    ], [
+        "每次 apply 都会先重新预览；摘要不一致时本地拒绝执行，服务端仍会再次校验 role version 和远端摘要。",
+        "非交互和 JSON 模式不读取 prompt；缺少显式 apply 参数会稳定失败。"
+    ]);
+    addExamples(role.command("provisioning-run <run-id>")
+        .description("查询角色制备运行记录及安全错误摘要")
+        .action(async (runIdValue, _options, command) => {
+        const run = await client().getProvisioningRun(parseProvisioningRunId(runIdValue));
+        await output(command, { ok: run.status !== "FAILED", provisioning_run: run }, runLine(run));
+        if (run.status === "FAILED")
+            process.exitCode = 1;
+    }), ["numa authorization role provisioning-run 123 --json"]);
+    const bootstrap = authorization.command("bootstrap")
+        .description("通过一次新鲜管理员网页登录，在 DevOps 内存中远程制备 Keycloak 权限")
+        .addHelpText("after", `
+安全边界:
+  CLI 不接收、不保存也不转发 bootstrap 管理员 token。
+  DevOps 回调在单次执行的内存中使用 token，多次调用 Keycloak 后立即丢弃。
+  PLAN 和 APPLY 分别要求一次新鲜登录；正常流程不需要本机 Keycloak 或 kcadm。
+`);
+    const startAndWait = async (command, request, options) => {
+        const api = client();
+        const started = await api.startKeycloakBootstrap(request);
+        if (!started.loginUrl && ["SUCCEEDED", "FAILED", "EXPIRED"].includes(started.status)) {
+            const run = await api.getKeycloakBootstrapRun(started.runId);
+            await output(command, { ok: run.status === "SUCCEEDED", bootstrap_run: run }, bootstrapRunLine(run));
+            if (run.status !== "SUCCEEDED")
+                process.exitCode = 1;
+            return;
+        }
+        if (options.noOpen || !started.loginUrl) {
+            await output(command, { ok: started.status !== "FAILED" && started.status !== "EXPIRED", bootstrap_session: started }, started.loginUrl
+                ? `${started.runId}\t${started.mode}\t${started.status}\n请在浏览器打开: ${started.loginUrl}`
+                : `${started.runId}\t${started.mode}\t${started.status}`);
+            return;
+        }
+        process.stderr.write(`正在打开 Keycloak 管理员登录（run ${started.runId}）…\n`);
+        try {
+            await openBrowser(started.loginUrl);
+        }
+        catch {
+            process.stderr.write(`无法自动打开浏览器，请手动打开:\n${started.loginUrl}\n`);
+        }
+        const run = await waitForKeycloakBootstrap(api, started, sleep);
+        await output(command, { ok: run.status === "SUCCEEDED", bootstrap_run: run }, bootstrapRunLine(run));
+        if (run.status !== "SUCCEEDED")
+            process.exitCode = 1;
+    };
+    addExamples(bootstrap.command("plan")
+        .description("新鲜登录后只读取并生成固定权限调和计划")
+        .option("--no-open", "不打开浏览器；返回短时 login URL 和 run ID")
+        .action(async (options, command) => {
+        await startAndWait(command, { mode: "PLAN" }, options);
+    }), [
+        "numa authorization bootstrap plan --json",
+        "numa authorization bootstrap plan --no-open --json"
+    ]);
+    addExamples(bootstrap.command("apply")
+        .description("新鲜登录后按 PLAN digest 执行固定权限调和和真实 CRUD 验证")
+        .requiredOption("--expected-plan-digest <digest>", "PLAN 返回的精确 SHA-256 摘要")
+        .requiredOption("--confirm-realm <confirmation>", "精确确认文本，例如 'APPLY numa-realm'")
+        .requiredOption("--idempotency-key <key>", "同一次 APPLY 重试必须复用的稳定键")
+        .option("--no-open", "不打开浏览器；返回短时 login URL 和 run ID")
+        .action(async (options, command) => {
+        await startAndWait(command, parseBootstrapApplyInput(options), options);
+    }), [
+        `numa authorization bootstrap apply --expected-plan-digest ${"a".repeat(64)} --confirm-realm 'APPLY numa-realm' --idempotency-key bootstrap-20260820-01 --json`
+    ]);
+    addExamples(bootstrap.command("status <run-id>")
+        .description("使用当前平台身份查询远程 bootstrap 的安全运行记录")
+        .action(async (runIdValue, _options, command) => {
+        const run = await client().getKeycloakBootstrapRun(parseProvisioningRunId(runIdValue));
+        await output(command, { ok: run.status === "SUCCEEDED", bootstrap_run: run }, bootstrapRunLine(run));
+        if (["FAILED", "EXPIRED"].includes(run.status))
+            process.exitCode = 1;
+    }), ["numa authorization bootstrap status 123 --json"]);
+}
+//# sourceMappingURL=commands.js.map

package/dist/authorization/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/authorization/commands.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,mBAAmB,EAKpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAQ9E,OAAO,EAAE,mBAAmB,EAAyB,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AACpD,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAyB/D,SAAS,WAAW,CAAC,OAAgB,EAAE,QAAkB,EAAE,KAAK,GAAa,EAAE;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM;QAC9B,CAAC,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC7D,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,OAAO,CAAC,WAAW,CACxB,OAAO,EACP,GAAG,WAAW,gBAAgB,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACjF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACpE,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAgB;IACzC,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;IACrC,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,EAAsB,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAAgB,EAAE,OAAgB,EAAE,SAAiB;IACzE,IAAI,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa,EAAE,OAAe;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,kBAAkB,CAC1B,GAAG,KAAK,qEAAqE,OAAO,cAAc,EAClG,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACnF,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,EAAE,6BAA6B,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACnF,MAAM,IAAI,kBAAkB,CAAC,oCAAoC,EAAE,6BAA6B,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAA8B;IACrE,MAAM,kBAAkB,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,kBAAkB,CAC1B,mGAAmG,EACnG,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,kBAAkB,CAC1B,qHAAqH,EACrH,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;IAC7E,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,kBAAkB,CAC1B,0DAA0D,EAC1D,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAyD,EACzD,OAA+B,EAC/B,KAAK,GAA4C,CAAC,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;IAEtF,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;IACtD,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC;QACxE,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;QAC1D,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YACzD,MAAM,IAAI,kBAAkB,CAC1B,wBAAwB,OAAO,CAAC,KAAK,2DAA2D,EAChG,wBAAwB,EACxB,GAAG,EACH,SAAS,EACT,2BAA2B,EAC3B,OAAO,CAAC,KAAK,CACd,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAIpC;IACC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACnD,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;WAC1B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;WACnB,CAAC,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9C,CAAC;QACD,MAAM,IAAI,kBAAkB,CAC1B,yBAAyB,WAAW,2EAA2E,EAC/G,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI;QAC7C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAyC,EACzC,OAAyB;IAEzB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,OAAO,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;YAC3E,MAAM,IAAI,kBAAkB,CAC1B,sFAAsF,EACtF,6BAA6B,CAC9B,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC7D,MAAM,IAAI,kBAAkB,CAC1B,uEAAuE,EACvE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,GAAG,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACtG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAC1B,8FAA8F,EAC9F,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,kBAAkB,CAC1B,qHAAqH,EACrH,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAC1B,wDAAwD,EACxD,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAC1B,+FAA+F,EAC/F,wBAAwB,EACxB,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,OAAO,CAAC,WAAW;QACxC,oBAAoB;QACpB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAA2D,EAC3D,MAAc,EACd,OAAyB;IAEzB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB;IACvC,OAAO,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,WAAW,CAAC,OAA6B;IAChD,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;AAC9I,CAAC;AAED,SAAS,OAAO,CAAC,GAAqB;IACpC,OAAO,GAAG,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC3F,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAyB;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC;IACrC,OAAO,GAAG,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAgB,EAChB,YAAY,GAAqC,EAAE;IAEnD,MAAM,MAAM,GAAG,GAAqB,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE;WAChE,IAAI,mBAAmB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,YAAoB,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IACpF,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;SACnD,WAAW,CAAC,wCAAwC,CAAC;SACrD,WAAW,CAAC,OAAO,EAAE;;;;;CAKzB,CAAC,CAAC;IACD,6BAA6B,CAAC,aAAa,EAAE;QAC3C,aAAa,EAAE,YAAY,CAAC,0BAA0B;eACjD,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;KAC7D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;SACvC,WAAW,CAAC,+CAA+C,CAAC,CAAC;IAEhE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;SAC7B,WAAW,CAAC,2BAA2B,CAAC;SACxC,MAAM,CAAC,KAAK,EAAE,QAAiB,EAAE,OAAgB,EAAE,EAAE;QACpD,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC;IAC3F,CAAC,CAAC,EAAE,CAAC,8BAA8B,EAAE,qCAAqC,CAAC,CAAC,CAAC;IAE/E,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC/B,WAAW,CAAC,6CAA6C,CAAC;SAC1D,cAAc,CAAC,wBAAwB,EAAE,gBAAgB,WAAW,MAAM,CAAC;SAC3E,cAAc,CAAC,uBAAuB,EAAE,QAAQ,CAAC;SACjD,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC;SACtC,MAAM,CAAC,KAAK,EAAE,OAA6D,EAAE,OAAgB,EAAE,EAAE;QAChG,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,qCAAqC,OAAO,CAAC,EAAE,EAAE,CAAC;QACtE,MAAM,MAAM,CACV,OAAO,EACP,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EACjF,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,WAAW,EAAE,CACjD,CAAC;IACJ,CAAC,CAAC,EAAE;QACF,uFAAuF;QACvF,sCAAsC;KACvC,EAAE;QACD,iDAAiD;QACjD,0CAA0C;KAC3C,CAAC,CAAC;IAEL,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;SAC5C,WAAW,CAAC,wDAAwD,CAAC;SACrE,MAAM,CAAC,SAAS,EAAE,iCAAiC,CAAC;SACpD,MAAM,CAAC,mCAAmC,EAAE,kBAAkB,CAAC;SAC/D,MAAM,CAAC,yBAAyB,EAAE,iBAAiB,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,OAAyB,EAAE,OAAgB,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;QACrD,gFAAgF;QAChF,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;aACzD,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7G,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3E,MAAM,MAAM,CACV,OAAO,EACP,MAAM,CAAC,GAAG;YACR,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,GAAG,EAAE;YAC/F,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,EAC3F,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAC/D,CAAC;QACF,IAAI,MAAM,CAAC,GAAG,EAAE,MAAM,KAAK,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC5D,CAAC,CAAC,EAAE;QACF,6CAA6C;QAC7C,yEAAyE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,4CAA4C;KACpI,EAAE;QACD,6DAA6D;QAC7D,4CAA4C;KAC7C,CAAC,CAAC;IAEL,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC;SAClD,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,QAAiB,EAAE,OAAgB,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC;QAClF,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC,EAAE,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAE/D,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC;SACjD,WAAW,CAAC,4CAA4C,CAAC;SACzD,WAAW,CAAC,OAAO,EAAE;;;;;CAKzB,CAAC,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,EACxB,OAAgB,EAChB,OAAoC,EACpC,OAAyB,EACV,EAAE;QACjB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACrG,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,MAAM,CACV,OAAO,EACP,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAC/F,OAAO,CAAC,QAAQ;gBACd,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,cAAc,OAAO,CAAC,QAAQ,EAAE;gBACtF,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAC3D,CAAC;YACF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACrG,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvD,CAAC,CAAC;IAEF,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;SAClC,WAAW,CAAC,qBAAqB,CAAC;SAClC,MAAM,CAAC,WAAW,EAAE,gCAAgC,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,OAAgB,EAAE,EAAE;QAC5D,MAAM,YAAY,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC,CAAC,EAAE;QACF,0CAA0C;QAC1C,oDAAoD;KACrD,CAAC,CAAC;IAEL,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;SACnC,WAAW,CAAC,wCAAwC,CAAC;SACrD,cAAc,CAAC,iCAAiC,EAAE,uBAAuB,CAAC;SAC1E,cAAc,CAAC,gCAAgC,EAAE,8BAA8B,CAAC;SAChF,cAAc,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;SACjE,MAAM,CAAC,WAAW,EAAE,gCAAgC,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,OAA8B,EAAE,OAAgB,EAAE,EAAE;QACjE,MAAM,YAAY,CAAC,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC,CAAC,EAAE;QACF,6DAA6D,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,oFAAoF;KAChK,CAAC,CAAC;IAEL,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC;SAC7C,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,QAAiB,EAAE,OAAgB,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvE,CAAC,CAAC,EAAE,CAAC,gDAAgD,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/authorization/errors.d.ts

@@ -0,0 +1,13 @@
+export declare function redactAuthorizationText(value: string): string;
+export declare function sanitizeAuthorizationOutput(value: unknown, key?: string): unknown;
+export type AuthorizationErrorCode = "authorization_authentication_required" | "authorization_forbidden" | "authorization_conflict" | "authorization_precondition_failed" | "authorization_validation_failed" | "authorization_keycloak_unavailable" | "authorization_api_error" | "authorization_invalid_response" | "authorization_input_invalid";
+export declare function authorizationHttpErrorCode(status: number): AuthorizationErrorCode;
+export declare function authorizationExitCode(error: AuthorizationError): number;
+export declare class AuthorizationError extends Error {
+    readonly code: AuthorizationErrorCode;
+    readonly status?: number | undefined;
+    readonly requestId?: string | undefined;
+    readonly serverCode?: string | undefined;
+    readonly runId?: number | undefined;
+    constructor(message: string, code: AuthorizationErrorCode, status?: number | undefined, requestId?: string | undefined, serverCode?: string | undefined, runId?: number | undefined);
+}

package/dist/authorization/errors.js

@@ -0,0 +1,70 @@
+const SENSITIVE_KEY = /(?:authorization|access[_-]?token|refresh[_-]?token|api[_-]?key|client[_-]?secret|password|passwd|credential|secret|token|keycloak.*uuid|client.*uuid|internal.*client.*id)$/iu;
+export function redactAuthorizationText(value) {
+    return value
+        .replace(/\b(Bearer|Basic)\s+[^\s,;]+/giu, "$1 [REDACTED]")
+        .replace(/([?&](?:access_token|refresh_token|token|signature|credential|api[_-]?key)=)[^&#\s]+/giu, "$1[REDACTED]")
+        .replace(/\b((?:password|passwd|token|api[_-]?key|access[_-]?token|refresh[_-]?token|secret|credential)\s*[=:]\s*)[^\s,;]+/giu, "$1[REDACTED]")
+        .replace(/(https?:\/\/)[^\s/@:]+:[^\s/@]+@/giu, "$1[REDACTED]@")
+        .replace(/(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}(?![A-Za-z0-9_-])/gu, "[REDACTED_JWT]");
+}
+export function sanitizeAuthorizationOutput(value, key = "") {
+    if (SENSITIVE_KEY.test(key))
+        return "[REDACTED]";
+    if (typeof value === "string") {
+        const redacted = redactAuthorizationText(value);
+        return /^(?:errorSummary|detail|message)$/iu.test(key)
+            ? redacted
+                .replace(/https?:\/\/[^\s"']+/giu, "[REDACTED_URL]")
+                .replace(/\b[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b/giu, "[REDACTED_UUID]")
+            : redacted;
+    }
+    if (Array.isArray(value))
+        return value.map((item) => sanitizeAuthorizationOutput(item));
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([name]) => !/(?:keycloak.*uuid|client.*uuid|internal.*client.*id)$/iu.test(name))
+            .map(([name, item]) => [name, sanitizeAuthorizationOutput(item, name)]));
+    }
+    return value;
+}
+export function authorizationHttpErrorCode(status) {
+    switch (status) {
+        case 400: return "authorization_input_invalid";
+        case 401: return "authorization_authentication_required";
+        case 403: return "authorization_forbidden";
+        case 409: return "authorization_conflict";
+        case 412: return "authorization_precondition_failed";
+        case 422: return "authorization_validation_failed";
+        case 502: return "authorization_keycloak_unavailable";
+        default: return "authorization_api_error";
+    }
+}
+export function authorizationExitCode(error) {
+    switch (error.status) {
+        case 400: return 2;
+        case 401: return 3;
+        case 403: return 4;
+        case 409:
+        case 412: return 5;
+        case 422: return 2;
+        case 502: return 6;
+        default: return 1;
+    }
+}
+export class AuthorizationError extends Error {
+    code;
+    status;
+    requestId;
+    serverCode;
+    runId;
+    constructor(message, code, status, requestId, serverCode, runId) {
+        super(redactAuthorizationText(message));
+        this.code = code;
+        this.status = status;
+        this.requestId = requestId;
+        this.serverCode = serverCode;
+        this.runId = runId;
+        this.name = "AuthorizationError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/authorization/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/authorization/errors.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAAG,gLAAgL,CAAC;AAEvM,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,KAAK;SACT,OAAO,CAAC,gCAAgC,EAAE,eAAe,CAAC;SAC1D,OAAO,CAAC,yFAAyF,EAAE,cAAc,CAAC;SAClH,OAAO,CAAC,qHAAqH,EAAE,cAAc,CAAC;SAC9I,OAAO,CAAC,qCAAqC,EAAE,eAAe,CAAC;SAC/D,OAAO,CAAC,iGAAiG,EAAE,gBAAgB,CAAC,CAAC;AAClI,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc,EAAE,GAAG,GAAG,EAAE;IAClE,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC;YACpD,CAAC,CAAC,QAAQ;iBACP,OAAO,CAAC,wBAAwB,EAAE,gBAAgB,CAAC;iBACnD,OAAO,CAAC,gFAAgF,EAAE,iBAAiB,CAAC;YAC/G,CAAC,CAAC,QAAQ,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACzF,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,2BAA2B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAaD,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG,EAAE,OAAO,6BAA6B,CAAC;QAC/C,KAAK,GAAG,EAAE,OAAO,uCAAuC,CAAC;QACzD,KAAK,GAAG,EAAE,OAAO,yBAAyB,CAAC;QAC3C,KAAK,GAAG,EAAE,OAAO,wBAAwB,CAAC;QAC1C,KAAK,GAAG,EAAE,OAAO,mCAAmC,CAAC;QACrD,KAAK,GAAG,EAAE,OAAO,iCAAiC,CAAC;QACnD,KAAK,GAAG,EAAE,OAAO,oCAAoC,CAAC;QACtD,SAAS,OAAO,yBAAyB,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAyB;IAC7D,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,GAAG,EAAE,OAAO,CAAC,CAAC;QACnB,KAAK,GAAG,EAAE,OAAO,CAAC,CAAC;QACnB,KAAK,GAAG,EAAE,OAAO,CAAC,CAAC;QACnB,KAAK,GAAG,CAAC;QACT,KAAK,GAAG,EAAE,OAAO,CAAC,CAAC;QACnB,KAAK,GAAG,EAAE,OAAO,CAAC,CAAC;QACnB,KAAK,GAAG,EAAE,OAAO,CAAC,CAAC;QACnB,SAAS,OAAO,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGzB,IAAI;IACJ,MAAM;IACN,SAAS;IACT,UAAU;IACV,KAAK;IANvB,YACE,OAAe,EACC,IAA4B,EAC5B,MAAe,EACf,SAAkB,EAClB,UAAmB,EACnB,KAAc;QAE9B,KAAK,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;oBANxB,IAAI;sBACJ,MAAM;yBACN,SAAS;0BACT,UAAU;qBACV,KAAK;QAGrB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/dist/authorization/schemas.d.ts

@@ -0,0 +1,187 @@
+import { z } from "zod";
+export declare const AuthorizationRoleStatusSchema: z.ZodString;
+export declare const AuthorizationRoleSchema: z.ZodObject<{
+    id: z.ZodNumber;
+    version: z.ZodNumber;
+    code: z.ZodString;
+    name: z.ZodString;
+    keycloakRoleId: z.ZodString;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    status: z.ZodString;
+    createdDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    lastModifiedDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const AuthorizationRoleListSchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodNumber;
+    version: z.ZodNumber;
+    code: z.ZodString;
+    name: z.ZodString;
+    keycloakRoleId: z.ZodString;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    status: z.ZodString;
+    createdDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    lastModifiedDate: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>>;
+export declare const RoleRemoteStateSchema: z.ZodEnum<{
+    DRIFTED: "DRIFTED";
+    MATCHED: "MATCHED";
+    MISSING: "MISSING";
+}>;
+export declare const RoleProvisionActionSchema: z.ZodEnum<{
+    CREATE: "CREATE";
+    NOOP: "NOOP";
+    UPDATE: "UPDATE";
+}>;
+export declare const RoleProvisionRunStatusSchema: z.ZodEnum<{
+    APPLIED: "APPLIED";
+    APPLYING: "APPLYING";
+    FAILED: "FAILED";
+    PREPARED: "PREPARED";
+}>;
+export declare const RoleProvisionPreviewSchema: z.ZodObject<{
+    roleId: z.ZodNumber;
+    roleVersion: z.ZodNumber;
+    roleClientId: z.ZodString;
+    roleName: z.ZodString;
+    remoteState: z.ZodEnum<{
+        DRIFTED: "DRIFTED";
+        MATCHED: "MATCHED";
+        MISSING: "MISSING";
+    }>;
+    action: z.ZodEnum<{
+        CREATE: "CREATE";
+        NOOP: "NOOP";
+        UPDATE: "UPDATE";
+    }>;
+    remoteDigest: z.ZodString;
+    differences: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        field: z.ZodString;
+        remoteValue: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        expectedValue: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export declare const RoleProvisionRunSchema: z.ZodObject<{
+    runId: z.ZodNumber;
+    actor: z.ZodString;
+    roleId: z.ZodNumber;
+    roleVersion: z.ZodNumber;
+    roleClientId: z.ZodString;
+    roleName: z.ZodString;
+    action: z.ZodEnum<{
+        CREATE: "CREATE";
+        NOOP: "NOOP";
+        UPDATE: "UPDATE";
+    }>;
+    status: z.ZodEnum<{
+        APPLIED: "APPLIED";
+        APPLYING: "APPLYING";
+        FAILED: "FAILED";
+        PREPARED: "PREPARED";
+    }>;
+    beforeDigest: z.ZodString;
+    expectedRemoteDigest: z.ZodString;
+    afterDigest: z.ZodNullable<z.ZodString>;
+    errorCode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    errorSummary: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    preparedAt: z.ZodString;
+    completedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const KeycloakBootstrapModeSchema: z.ZodEnum<{
+    APPLY: "APPLY";
+    PLAN: "PLAN";
+}>;
+export declare const KeycloakBootstrapStatusSchema: z.ZodEnum<{
+    AUTHORIZING: "AUTHORIZING";
+    AWAITING_AUTHORIZATION: "AWAITING_AUTHORIZATION";
+    EXPIRED: "EXPIRED";
+    FAILED: "FAILED";
+    RUNNING: "RUNNING";
+    SUCCEEDED: "SUCCEEDED";
+}>;
+export declare const KeycloakBootstrapActionSchema: z.ZodEnum<{
+    ADD: "ADD";
+    CREATE: "CREATE";
+    ENABLE: "ENABLE";
+    NOOP: "NOOP";
+    REMOVE: "REMOVE";
+    UPDATE: "UPDATE";
+    VERIFY: "VERIFY";
+}>;
+export declare const KeycloakBootstrapChangeSchema: z.ZodObject<{
+    action: z.ZodEnum<{
+        ADD: "ADD";
+        CREATE: "CREATE";
+        ENABLE: "ENABLE";
+        NOOP: "NOOP";
+        REMOVE: "REMOVE";
+        UPDATE: "UPDATE";
+        VERIFY: "VERIFY";
+    }>;
+    target: z.ZodString;
+    detail: z.ZodString;
+}, z.core.$strict>;
+export declare const KeycloakBootstrapStartSchema: z.ZodObject<{
+    runId: z.ZodNumber;
+    mode: z.ZodEnum<{
+        APPLY: "APPLY";
+        PLAN: "PLAN";
+    }>;
+    status: z.ZodEnum<{
+        AUTHORIZING: "AUTHORIZING";
+        AWAITING_AUTHORIZATION: "AWAITING_AUTHORIZATION";
+        EXPIRED: "EXPIRED";
+        FAILED: "FAILED";
+        RUNNING: "RUNNING";
+        SUCCEEDED: "SUCCEEDED";
+    }>;
+    loginUrl: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodString;
+}, z.core.$strict>;
+export declare const KeycloakBootstrapRunSchema: z.ZodObject<{
+    runId: z.ZodNumber;
+    platformActor: z.ZodString;
+    mode: z.ZodEnum<{
+        APPLY: "APPLY";
+        PLAN: "PLAN";
+    }>;
+    status: z.ZodEnum<{
+        AUTHORIZING: "AUTHORIZING";
+        AWAITING_AUTHORIZATION: "AWAITING_AUTHORIZATION";
+        EXPIRED: "EXPIRED";
+        FAILED: "FAILED";
+        RUNNING: "RUNNING";
+        SUCCEEDED: "SUCCEEDED";
+    }>;
+    planDigest: z.ZodNullable<z.ZodString>;
+    changes: z.ZodArray<z.ZodObject<{
+        action: z.ZodEnum<{
+            ADD: "ADD";
+            CREATE: "CREATE";
+            ENABLE: "ENABLE";
+            NOOP: "NOOP";
+            REMOVE: "REMOVE";
+            UPDATE: "UPDATE";
+            VERIFY: "VERIFY";
+        }>;
+        target: z.ZodString;
+        detail: z.ZodString;
+    }, z.core.$strict>>;
+    bootstrapSubject: z.ZodNullable<z.ZodString>;
+    bootstrapUsername: z.ZodNullable<z.ZodString>;
+    errorCode: z.ZodNullable<z.ZodString>;
+    errorSummary: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    completedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const AuthorizationApiErrorSchema: z.ZodObject<{
+    code: z.ZodOptional<z.ZodString>;
+    detail: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    runId: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type AuthorizationRole = z.infer<typeof AuthorizationRoleSchema>;
+export type RoleProvisionPreview = z.infer<typeof RoleProvisionPreviewSchema>;
+export type RoleProvisionRun = z.infer<typeof RoleProvisionRunSchema>;
+export type KeycloakBootstrapStart = z.infer<typeof KeycloakBootstrapStartSchema>;
+export type KeycloakBootstrapRun = z.infer<typeof KeycloakBootstrapRunSchema>;