@numa-tech/numa 1.20.0 → 1.20.2

package/dist/authorization/application-schemas.js

@@ -0,0 +1,521 @@
+import { z } from "zod";
+import { AuthorizationError, redactAuthorizationText } from "./errors.js";
+export const uuid = z.string().uuid();
+export const version = z
+    .number()
+    .int()
+    .nonnegative()
+    .max(Number.MAX_SAFE_INTEGER);
+export const positive = version.min(1);
+export const digest = z.string().regex(/^[a-f0-9]{64}$/);
+const text = z
+    .string()
+    .min(1)
+    .max(2000)
+    .regex(/^[^\u0000-\u001f\u007f]+$/);
+export const document = z.record(z.string(), z.unknown());
+export const source = z
+    .object({
+    environmentId: uuid,
+    environmentCode: z.string(),
+    environmentName: z.string(),
+    identityKey: text,
+    issuerUrl: z.string().url(),
+    realm: z.string(),
+    issuerId: uuid.nullable(),
+})
+    .passthrough();
+export const page = z
+    .object({
+    items: z.array(document),
+    total: version,
+    page: positive,
+    size: positive,
+})
+    .passthrough();
+export const directoryPage = page.extend({
+    total: version.optional(),
+    hasMore: z.boolean(),
+});
+export const relationPage = z
+    .object({
+    revision: version,
+    relations: z.array(document),
+    total: version,
+    hasMore: z.boolean(),
+    page: positive,
+    size: positive,
+})
+    .passthrough();
+// Definition is the extensible business document. Only the transport envelope is closed;
+// retaining nested fields is required for functions, PAGE/API and legacy projection metadata.
+export const definitionSave = z
+    .object({
+    expectedDraftVersion: version,
+    defaultRoleClientId: text,
+    definition: document,
+})
+    .strict();
+export const freezeInput = z.object({ expectedDraftVersion: version }).strict();
+export const environmentInput = z
+    .object({
+    code: text,
+    name: text,
+    enforcementMode: z.enum(["GATEWAY", "APPLICATION"]),
+    identitySource: z.enum(["PLATFORM", "REGISTERED"]),
+    issuerId: uuid.nullable().optional(),
+    resourceClientId: text,
+    roleClientId: text,
+    pathRoot: text,
+    objectNamespace: text,
+    definitionVersion: positive,
+    status: z.enum(["ACTIVE", "DISABLED"]),
+    version,
+    gatewayId: uuid.nullable().optional(),
+    gatewayBindingId: uuid.nullable().optional(),
+})
+    .strict();
+const authoring = {
+    mode: z.enum(["CREATE", "IMPORT", "REFERENCE"]),
+    environmentId: uuid,
+    definitionId: uuid.optional(),
+    remoteId: text.optional(),
+    status: z.enum(["ACTIVE", "DISABLED"]),
+    expectedDefinitionVersion: version,
+    expectedReferenceVersion: version,
+    expectedInstanceVersion: version,
+    expectedTargetVersion: version,
+};
+const addresses = z
+    .object({
+    redirectUris: z.array(z.string()).optional(),
+    webOrigins: z.array(z.string()).optional(),
+})
+    .strict();
+const configuration = addresses.extend({
+    enabled: z.boolean().optional(),
+    publicClient: z.boolean().optional(),
+    standardFlowEnabled: z.boolean().optional(),
+    serviceAccountsEnabled: z.boolean().optional(),
+    authorizationServicesEnabled: z.boolean().optional(),
+    defaultGroupEnabled: z.boolean().optional(),
+    defaultGroupDefinitionId: uuid.nullable().optional(),
+});
+export const clientInput = z
+    .object({
+    ...authoring,
+    clientId: text,
+    definition: z
+        .object({
+        code: text,
+        name: text,
+        kind: z.enum(["PROVIDER", "LOGIN", "MACHINE"]),
+        configuration,
+    })
+        .strict()
+        .optional(),
+    demand: z
+        .object({
+        roles: z.array(text).optional(),
+        audience: z.boolean().optional(),
+        machineRoles: z.array(text).optional(),
+    })
+        .strict()
+        .optional(),
+    environment: addresses.optional(),
+    enrollmentTrusted: z.boolean().optional(),
+    expectedEnrollmentTrustVersion: version.optional(),
+})
+    .strict()
+    .refine((v) => (v.enrollmentTrusted === undefined) ===
+    (v.expectedEnrollmentTrustVersion === undefined), "Trust intent requires both observed version and desired trust");
+export const groupInput = z
+    .object({
+    ...authoring,
+    remoteName: text.optional(),
+    definition: z
+        .object({
+        code: text,
+        name: text,
+        description: z.string(),
+        defaultEligible: z.boolean(),
+        status: z.enum(["ACTIVE", "DISABLED"]),
+    })
+        .strict()
+        .optional(),
+    roles: z.array(text),
+})
+    .strict();
+const change = z
+    .object({
+    id: uuid.optional(),
+    kind: z.enum([
+        "ROLE_GRANT",
+        "GROUP_MEMBER",
+        "GROUP_BLOCK",
+        "BLOCK_SOURCE_RELEASE",
+    ]),
+    subjectType: z.enum(["USER", "SERVICE_ACCOUNT", "GROUP"]),
+    subjectId: text.optional(),
+    clientInstanceId: uuid.optional(),
+    groupInstanceId: uuid.optional(),
+    roleName: text.optional(),
+    desired: z.enum(["PRESENT", "ABSENT"]),
+    blockReason: z.string().max(2000).optional(),
+    releaseSource: z.enum(["ADMIN_BLOCK", "LEGACY_REMOVE"]).optional(),
+    expectedBlockVersion: version.optional(),
+    expectedBlockGeneration: uuid.optional(),
+})
+    .strict()
+    .superRefine((v, c) => {
+    const bad = () => c.addIssue({
+        code: "custom",
+        message: "Relation fields do not match kind and subject",
+    });
+    if (v.kind === "BLOCK_SOURCE_RELEASE") {
+        if (v.subjectType !== "USER" ||
+            v.desired !== "ABSENT" ||
+            !v.subjectId ||
+            !v.groupInstanceId ||
+            !v.releaseSource ||
+            v.expectedBlockVersion === undefined ||
+            !v.expectedBlockGeneration ||
+            v.clientInstanceId ||
+            v.roleName ||
+            v.blockReason !== undefined)
+            bad();
+        return;
+    }
+    if (v.releaseSource !== undefined ||
+        v.expectedBlockVersion !== undefined ||
+        v.expectedBlockGeneration !== undefined)
+        bad();
+    if (v.subjectType === "USER" && (!v.subjectId || v.clientInstanceId))
+        bad();
+    if (v.subjectType === "SERVICE_ACCOUNT" &&
+        (!v.clientInstanceId || v.subjectId))
+        bad();
+    if (v.subjectType === "GROUP" &&
+        (v.kind !== "ROLE_GRANT" ||
+            !v.groupInstanceId ||
+            v.subjectId ||
+            v.clientInstanceId))
+        bad();
+    if (v.kind === "ROLE_GRANT" &&
+        (!v.roleName || (v.subjectType !== "GROUP" && v.groupInstanceId)))
+        bad();
+    if (v.kind !== "ROLE_GRANT" && (!v.groupInstanceId || v.roleName))
+        bad();
+    if (v.kind !== "GROUP_BLOCK" && v.blockReason !== undefined)
+        bad();
+});
+export const relationsInput = z
+    .object({ expectedRevision: version, changes: z.array(change).max(500) })
+    .strict();
+export const planInput = z
+    .object({
+    requestId: uuid,
+    definitionVersion: positive,
+    environmentIds: z
+        .array(uuid)
+        .min(1)
+        .max(100)
+        .refine((v) => new Set(v).size === v.length),
+    clientModes: z
+        .record(uuid, z.enum(["CREATE", "ADOPT", "UPDATE", "REPAIR"]))
+        .refine((v) => Object.keys(v).length <= 500)
+        .optional(),
+})
+    .strict();
+export const confirmation = z
+    .object({ expectedVersion: version, expectedDigest: digest })
+    .strict();
+export const stepConfirmation = confirmation.extend({
+    expectedStepDigest: digest,
+});
+export const recheckInput = stepConfirmation.extend({
+    note: z.string().max(2000).optional(),
+});
+export const terminateInput = confirmation.extend({
+    note: z.string().max(2000).optional(),
+});
+export const repreviewInput = planInput.extend(confirmation.shape);
+export const downloadInput = z
+    .object({
+    requestId: uuid,
+    expectedInstanceVersion: version,
+    expectedContextDigest: digest,
+})
+    .strict();
+export const rotateInput = downloadInput.extend({
+    confirmClientId: text,
+    acknowledgeImpact: z.literal(true),
+});
+export const credentialContext = z
+    .object({
+    schemaVersion: z.literal(1),
+    applicationId: positive,
+    environmentId: uuid,
+    referenceId: uuid,
+    definitionId: uuid,
+    instanceId: uuid,
+    identityKey: text,
+    issuerId: uuid.nullable(),
+    issuerUrl: z.string().url(),
+    issuerVersion: version,
+    environmentVersion: version,
+    gatewayId: uuid.nullable(),
+    gatewayVersion: version.nullable(),
+    gatewayBindingId: uuid.nullable(),
+    gatewayBindingVersion: version.nullable(),
+    referenceVersion: version,
+    targetVersion: version,
+    definitionVersion: version,
+    publishedRevision: version.nullable(),
+    appliedRevision: version.nullable(),
+    instanceVersion: version,
+    clientId: text,
+    remoteUuid: z.string().nullable(),
+    credentialState: text,
+    publicClient: z.boolean(),
+    enabled: z.boolean(),
+    verified: z.boolean(),
+    locked: z.boolean(),
+    affectedApplications: z.array(z
+        .object({
+        applicationId: positive,
+        code: text,
+        name: text,
+        referenceId: uuid,
+        referenceVersion: version,
+        targetVersion: version,
+    })
+        .passthrough()),
+})
+    .passthrough();
+const iso = z.string().datetime({ offset: true });
+const step = z
+    .object({
+    ordinal: version,
+    kind: text,
+    targetId: text,
+    status: text,
+    version,
+    stepDigest: digest,
+    childEvidence: document.nullable().optional(),
+})
+    .passthrough();
+const jobBase = {
+    id: uuid,
+    applicationId: positive,
+    status: text,
+    version,
+    planDigest: digest,
+    predecessorId: uuid.nullable(),
+    createdAt: iso,
+    updatedAt: iso,
+    steps: z.array(step),
+    collaboration: z
+        .object({ state: text, allowedActions: z.array(z.string()) })
+        .passthrough(),
+};
+export const publicationJob = z
+    .discriminatedUnion("operation", [
+    z
+        .object({
+        ...jobBase,
+        operation: z.literal("IDENTITY_PUBLICATION"),
+        plan: z
+            .object({
+            applicationId: positive,
+            definitionVersion: positive,
+            definitionDigest: digest,
+            targets: z.array(document),
+            instances: z.record(uuid, document),
+            steps: z.array(document),
+        })
+            .passthrough(),
+    })
+        .passthrough(),
+    z
+        .object({
+        ...jobBase,
+        operation: z.literal("CREDENTIAL_ROTATION"),
+        plan: z
+            .object({
+            operation: z.literal("CREDENTIAL_ROTATION"),
+            schemaVersion: z.literal(1),
+            applicationId: positive,
+            credentialContext,
+            steps: z
+                .array(z
+                .object({
+                kind: z.literal("CREDENTIAL_ROTATE"),
+                targetId: uuid,
+            })
+                .passthrough())
+                .length(1),
+        })
+            .passthrough(),
+        credentialOperation: document,
+    })
+        .passthrough(),
+])
+    .superRefine((v, c) => {
+    if (v.plan.applicationId !== v.applicationId ||
+        (v.operation === "CREDENTIAL_ROTATION" &&
+            (v.steps.length !== 1 ||
+                v.steps[0]?.kind !== "CREDENTIAL_ROTATE" ||
+                v.plan.credentialContext.applicationId !== v.applicationId ||
+                v.steps[0]?.targetId !== v.plan.credentialContext.instanceId)))
+        c.addIssue({
+            code: "custom",
+            message: "Publication scope or operation mismatch",
+        });
+});
+export const credentialTarget = z
+    .object({
+    context: credentialContext,
+    contextDigest: digest,
+    available: z.boolean(),
+    unavailableCode: z.string().nullable(),
+    allowedActions: z.array(z.enum(["download", "rotate"])),
+})
+    .passthrough();
+export const credentialOperation = z
+    .object({
+    requestId: uuid,
+    action: z.enum(["DOWNLOAD", "ROTATE"]),
+    status: z.enum(["RUNNING", "SUCCEEDED", "UNKNOWN", "RECOVERED"]),
+    context: credentialContext,
+    recoveredBy: uuid.nullable(),
+    recoveryBasis: z.string().nullable(),
+    errorCode: z.string().nullable(),
+    createdAt: iso,
+    updatedAt: iso,
+    publicationJob: publicationJob.nullable(),
+})
+    .passthrough();
+export function parse(schema, value) {
+    const result = schema.safeParse(value);
+    if (!result.success)
+        throw new AuthorizationError("Invalid application authorization input or response shape.", "authorization_input_invalid");
+    return result.data;
+}
+// Preserve nonsecret evidence (including credentialContext/UUID/digests). Never echo secret
+// properties or credential-bearing upstream error strings.
+export function safeEvidence(value) {
+    if (typeof value === "string")
+        return redactAuthorizationText(value);
+    if (Array.isArray(value))
+        return value.map(safeEvidence);
+    if (value && typeof value === "object")
+        return Object.fromEntries(Object.entries(value)
+            .filter(([key]) => !/(?:secret|password|passwd|access.?token|refresh.?token|session.?cookie|^token$|^cookie$|authorization$)/i.test(key))
+            .map(([key, v]) => [key, safeEvidence(v)]));
+    return value;
+}
+export const draftDefinition = z
+    .object({
+    applicationId: positive,
+    applicationCode: text,
+    name: text,
+    kind: z.enum(["CATALOG", "DOCUMENT"]),
+    editable: z.boolean(),
+    defaultRoleClientId: text,
+    draftVersion: version,
+    definition: document,
+    versions: z.array(z.object({ version: positive, createdAt: iso, digest }).passthrough()),
+})
+    .passthrough();
+export const immutableDefinition = z
+    .object({
+    applicationId: positive,
+    version: positive,
+    default_role_client_id: text,
+    created_at: iso,
+    definition: document,
+    digest,
+    kind: text,
+})
+    .passthrough();
+export const environmentView = environmentInput
+    .extend({
+    id: uuid,
+    applicationId: positive,
+    issuerUrl: z.string().url(),
+    ready: z.boolean().optional(),
+})
+    .passthrough();
+export const instanceTarget = z
+    .object({
+    instanceId: uuid,
+    identityKey: text,
+    issuerUrl: z.string().url(),
+    instanceVersion: version,
+    targetVersion: version,
+    targetStatus: text,
+    instanceStatus: text,
+    appliedRevision: version.nullable(),
+    mode: text.nullable(),
+})
+    .passthrough();
+export const draftView = z
+    .object({
+    referenceId: uuid,
+    definitionId: uuid,
+    applicationId: positive,
+    definitionVersion: version,
+    referenceVersion: version,
+    status: text,
+    referenceStatus: text,
+    publishedRevision: version.nullable(),
+    ownerApplicationId: positive.nullable(),
+    ownership: text,
+    configurationReadOnly: z.boolean(),
+    draftStatus: text,
+    definition: document,
+    affectedApplications: z.array(document),
+    instances: z.array(instanceTarget),
+})
+    .passthrough();
+export const registeredView = z
+    .object({
+    applicationId: positive,
+    source,
+    definitionId: uuid,
+    definition: z
+        .object({
+        id: uuid,
+        version,
+        status: text,
+        ownerApplicationId: positive.nullable(),
+    })
+        .passthrough(),
+    ownerApplicationId: positive.nullable(),
+    configurationReadOnly: z.boolean(),
+    instance: z
+        .object({
+        id: uuid,
+        definitionId: uuid,
+        identityKey: text,
+        issuerUrl: z.string().url(),
+        version,
+        status: text,
+    })
+        .passthrough()
+        .nullable(),
+    reference: z
+        .object({ referenceId: uuid, referenceVersion: version, status: text })
+        .passthrough()
+        .nullable(),
+    target: instanceTarget.nullable(),
+    association: z.enum([
+        "NO_INSTANCE",
+        "UNREFERENCED",
+        "REFERENCE_WITHOUT_TARGET",
+        "BOUND",
+    ]),
+})
+    .passthrough();
+//# sourceMappingURL=application-schemas.js.map

package/dist/authorization/application-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-schemas.js","sourceRoot":"","sources":["../../src/authorization/application-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC1E,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AACtC,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC;KACrB,MAAM,EAAE;KACR,GAAG,EAAE;KACL,WAAW,EAAE;KACb,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAChC,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACzD,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,IAAI,CAAC;KACT,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,WAAW,EAAE,IAAI;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;CAC1B,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IACxB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,QAAQ;CACf,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,QAAQ,EAAE,OAAO;IACjB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC5B,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,QAAQ;CACf,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,yFAAyF;AACzF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,oBAAoB,EAAE,OAAO;IAC7B,mBAAmB,EAAE,IAAI;IACzB,UAAU,EAAE,QAAQ;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACnD,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAClD,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpC,gBAAgB,EAAE,IAAI;IACtB,YAAY,EAAE,IAAI;IAClB,QAAQ,EAAE,IAAI;IACd,eAAe,EAAE,IAAI;IACrB,iBAAiB,EAAE,QAAQ;IAC3B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtC,OAAO;IACP,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,SAAS,GAAG;IAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC/C,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtC,yBAAyB,EAAE,OAAO;IAClC,wBAAwB,EAAE,OAAO;IACjC,uBAAuB,EAAE,OAAO;IAChC,qBAAqB,EAAE,OAAO;CAC/B,CAAC;AACF,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACpC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9C,4BAA4B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACpD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,wBAAwB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,GAAG,SAAS;IACZ,QAAQ,EAAE,IAAI;IACd,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9C,aAAa;KACd,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KACvC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE;IACjC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,8BAA8B,EAAE,OAAO,CAAC,QAAQ,EAAE;CACnD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,iBAAiB,KAAK,SAAS,CAAC;IACnC,CAAC,CAAC,CAAC,8BAA8B,KAAK,SAAS,CAAC,EAClD,+DAA+D,CAChE,CAAC;AACJ,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,GAAG,SAAS;IACZ,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;QAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;KACvC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,MAAM,GAAG,CAAC;KACb,MAAM,CAAC;IACN,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,YAAY;QACZ,cAAc;QACd,aAAa;QACb,sBAAsB;KACvB,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACzD,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC1B,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE;IACjC,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClE,oBAAoB,EAAE,OAAO,CAAC,QAAQ,EAAE;IACxC,uBAAuB,EAAE,IAAI,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;IACpB,MAAM,GAAG,GAAG,GAAG,EAAE,CACf,CAAC,CAAC,QAAQ,CAAC;QACT,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,+CAA+C;KACzD,CAAC,CAAC;IACL,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACtC,IACE,CAAC,CAAC,WAAW,KAAK,MAAM;YACxB,CAAC,CAAC,OAAO,KAAK,QAAQ;YACtB,CAAC,CAAC,CAAC,SAAS;YACZ,CAAC,CAAC,CAAC,eAAe;YAClB,CAAC,CAAC,CAAC,aAAa;YAChB,CAAC,CAAC,oBAAoB,KAAK,SAAS;YACpC,CAAC,CAAC,CAAC,uBAAuB;YAC1B,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,WAAW,KAAK,SAAS;YAE3B,GAAG,EAAE,CAAC;QACR,OAAO;IACT,CAAC;IACD,IACE,CAAC,CAAC,aAAa,KAAK,SAAS;QAC7B,CAAC,CAAC,oBAAoB,KAAK,SAAS;QACpC,CAAC,CAAC,uBAAuB,KAAK,SAAS;QAEvC,GAAG,EAAE,CAAC;IACR,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,gBAAgB,CAAC;QAAE,GAAG,EAAE,CAAC;IAC5E,IACE,CAAC,CAAC,WAAW,KAAK,iBAAiB;QACnC,CAAC,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,SAAS,CAAC;QAEpC,GAAG,EAAE,CAAC;IACR,IACE,CAAC,CAAC,WAAW,KAAK,OAAO;QACzB,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY;YACtB,CAAC,CAAC,CAAC,eAAe;YAClB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gBAAgB,CAAC;QAErB,GAAG,EAAE,CAAC;IACR,IACE,CAAC,CAAC,IAAI,KAAK,YAAY;QACvB,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC,CAAC,eAAe,CAAC,CAAC;QAEjE,GAAG,EAAE,CAAC;IACR,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,QAAQ,CAAC;QAAE,GAAG,EAAE,CAAC;IACzE,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,EAAE,CAAC;AACrE,CAAC,CAAC,CAAC;AACL,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;KACxE,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,SAAS,EAAE,IAAI;IACf,iBAAiB,EAAE,QAAQ;IAC3B,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC;SACX,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;SAC3C,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;KAC5D,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC;IAClD,kBAAkB,EAAE,MAAM;CAC3B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,SAAS,EAAE,IAAI;IACf,uBAAuB,EAAE,OAAO;IAChC,qBAAqB,EAAE,MAAM;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC;IAC9C,eAAe,EAAE,IAAI;IACrB,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,QAAQ;IACvB,aAAa,EAAE,IAAI;IACnB,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,UAAU,EAAE,IAAI;IAChB,WAAW,EAAE,IAAI;IACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,aAAa,EAAE,OAAO;IACtB,kBAAkB,EAAE,OAAO;IAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC1B,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE;IAClC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE;IACjC,qBAAqB,EAAE,OAAO,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,OAAO;IACzB,aAAa,EAAE,OAAO;IACtB,iBAAiB,EAAE,OAAO;IAC1B,iBAAiB,EAAE,OAAO,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE;IACnC,eAAe,EAAE,OAAO;IACxB,QAAQ,EAAE,IAAI;IACd,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,eAAe,EAAE,IAAI;IACrB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAC3B,CAAC;SACE,MAAM,CAAC;QACN,aAAa,EAAE,QAAQ;QACvB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,OAAO;QACzB,aAAa,EAAE,OAAO;KACvB,CAAC;SACD,WAAW,EAAE,CACjB;CACF,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,CAAC;IACN,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;IACZ,OAAO;IACP,UAAU,EAAE,MAAM;IAClB,aAAa,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,OAAO,GAAG;IACd,EAAE,EAAE,IAAI;IACR,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,IAAI;IACZ,OAAO;IACP,UAAU,EAAE,MAAM;IAClB,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,GAAG;IACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IACpB,aAAa,EAAE,CAAC;SACb,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;SAC5D,WAAW,EAAE;CACjB,CAAC;AACF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,kBAAkB,CAAC,WAAW,EAAE;IAC/B,CAAC;SACE,MAAM,CAAC;QACN,GAAG,OAAO;QACV,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;QAC5C,IAAI,EAAE,CAAC;aACJ,MAAM,CAAC;YACN,aAAa,EAAE,QAAQ;YACvB,iBAAiB,EAAE,QAAQ;YAC3B,gBAAgB,EAAE,MAAM;YACxB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;YACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;SACzB,CAAC;aACD,WAAW,EAAE;KACjB,CAAC;SACD,WAAW,EAAE;IAChB,CAAC;SACE,MAAM,CAAC;QACN,GAAG,OAAO;QACV,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAC3C,IAAI,EAAE,CAAC;aACJ,MAAM,CAAC;YACN,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC3C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3B,aAAa,EAAE,QAAQ;YACvB,iBAAiB;YACjB,KAAK,EAAE,CAAC;iBACL,KAAK,CACJ,CAAC;iBACE,MAAM,CAAC;gBACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;gBACpC,QAAQ,EAAE,IAAI;aACf,CAAC;iBACD,WAAW,EAAE,CACjB;iBACA,MAAM,CAAC,CAAC,CAAC;SACb,CAAC;aACD,WAAW,EAAE;QAChB,mBAAmB,EAAE,QAAQ;KAC9B,CAAC;SACD,WAAW,EAAE;CACjB,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;IACpB,IACE,CAAC,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;QACxC,CAAC,CAAC,CAAC,SAAS,KAAK,qBAAqB;YACpC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBACnB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,mBAAmB;gBACxC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;gBAC1D,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAElE,CAAC,CAAC,QAAQ,CAAC;YACT,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AACL,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO,EAAE,iBAAiB;IAC1B,aAAa,EAAE,MAAM;IACrB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;CACxD,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAChE,OAAO,EAAE,iBAAiB;IAC1B,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,GAAG;IACd,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,UAAU,KAAK,CAAI,MAAoB,EAAE,KAAc;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO;QACjB,MAAM,IAAI,kBAAkB,CAC1B,4DAA4D,EAC5D,6BAA6B,CAC9B,CAAC;IACJ,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AACD,4FAA4F;AAC5F,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAClB,MAAM,CACL,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CACR,CAAC,0GAA0G,CAAC,IAAI,CAC9G,GAAG,CACJ,CACJ;aACA,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAC7C,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,aAAa,EAAE,QAAQ;IACvB,eAAe,EAAE,IAAI;IACrB,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,mBAAmB,EAAE,IAAI;IACzB,YAAY,EAAE,OAAO;IACrB,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,CAAC,CAAC,KAAK,CACf,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CACtE;CACF,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,aAAa,EAAE,QAAQ;IACvB,OAAO,EAAE,QAAQ;IACjB,sBAAsB,EAAE,IAAI;IAC5B,UAAU,EAAE,GAAG;IACf,UAAU,EAAE,QAAQ;IACpB,MAAM;IACN,IAAI,EAAE,IAAI;CACX,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB;KAC5C,MAAM,CAAC;IACN,EAAE,EAAE,IAAI;IACR,aAAa,EAAE,QAAQ;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,UAAU,EAAE,IAAI;IAChB,WAAW,EAAE,IAAI;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,eAAe,EAAE,OAAO;IACxB,aAAa,EAAE,OAAO;IACtB,YAAY,EAAE,IAAI;IAClB,cAAc,EAAE,IAAI;IACpB,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE;IACnC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;CACtB,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,QAAQ;IACvB,iBAAiB,EAAE,OAAO;IAC1B,gBAAgB,EAAE,OAAO;IACzB,MAAM,EAAE,IAAI;IACZ,eAAe,EAAE,IAAI;IACrB,iBAAiB,EAAE,OAAO,CAAC,QAAQ,EAAE;IACrC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,IAAI;IACf,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE;IAClC,WAAW,EAAE,IAAI;IACjB,UAAU,EAAE,QAAQ;IACpB,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;CACnC,CAAC;KACD,WAAW,EAAE,CAAC;AACjB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,aAAa,EAAE,QAAQ;IACvB,MAAM;IACN,YAAY,EAAE,IAAI;IAClB,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,EAAE,EAAE,IAAI;QACR,OAAO;QACP,MAAM,EAAE,IAAI;QACZ,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,EAAE;KACxC,CAAC;SACD,WAAW,EAAE;IAChB,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACvC,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE;IAClC,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,EAAE,EAAE,IAAI;QACR,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QAC3B,OAAO;QACP,MAAM,EAAE,IAAI;KACb,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC;SACT,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SACtE,WAAW,EAAE;SACb,QAAQ,EAAE;IACb,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC;QAClB,aAAa;QACb,cAAc;QACd,0BAA0B;QAC1B,OAAO;KACR,CAAC;CACH,CAAC;KACD,WAAW,EAAE,CAAC"}

package/dist/authorization/{client.d.ts → bootstrap-client.d.ts}

@@ -1,21 +1,10 @@
 import type { AuthConfig } from "../config.js";
 import { type KeycloakTokenProvider } from "../oauth.js";
-import { type AuthorizationRole, type KeycloakBootstrapRun, type KeycloakBootstrapStart, type RoleProvisionPreview, type RoleProvisionRun } from "./schemas.js";
-export interface AuthorizationClientDependencies {
+import { type KeycloakBootstrapRun, type KeycloakBootstrapStart } from "./schemas.js";
+export interface BootstrapClientDependencies {
     fetch?: typeof fetch;
     tokenProvider?: KeycloakTokenProvider;
 }
-export interface CreateAuthorizationRoleInput {
-    code: string;
-    name: string;
-    description?: string;
-    status: "ACTIVE";
-}
-export interface ApplyRoleProvisionInput {
-    expectedRoleVersion: number;
-    expectedRemoteDigest: string;
-    idempotencyKey: string;
-}
 export type StartKeycloakBootstrapInput = {
     mode: "PLAN";
 } | {
@@ -33,29 +22,19 @@ export type StartPrivilegedOperationInput = {
 } | {
     mode: "SECRET_ROTATE";
 };
-export interface AuthorizationApi {
-    listRoles(): Promise<AuthorizationRole[]>;
-    createRole(input: CreateAuthorizationRoleInput): Promise<AuthorizationRole>;
-    previewRole(roleId: number): Promise<RoleProvisionPreview>;
-    applyRole(roleId: number, input: ApplyRoleProvisionInput): Promise<RoleProvisionRun>;
-    getProvisioningRun(runId: number): Promise<RoleProvisionRun>;
+export interface BootstrapApi {
     startKeycloakBootstrap(input: StartKeycloakBootstrapInput): Promise<KeycloakBootstrapStart>;
     getKeycloakBootstrapRun(runId: number): Promise<KeycloakBootstrapRun>;
     startPrivilegedOperation(input: StartPrivilegedOperationInput): Promise<KeycloakBootstrapStart>;
     getPrivilegedOperationRun(runId: number): Promise<KeycloakBootstrapRun>;
 }
-export declare class AuthorizationClient implements AuthorizationApi {
+export declare class BootstrapClient implements BootstrapApi {
     private readonly config;
     private readonly fetchImpl;
     private readonly tokenProvider;
-    constructor(config: AuthConfig, dependencies?: AuthorizationClientDependencies);
+    constructor(config: AuthConfig, dependencies?: BootstrapClientDependencies);
     private authenticatedFetch;
     private json;
-    listRoles(): Promise<AuthorizationRole[]>;
-    createRole(input: CreateAuthorizationRoleInput): Promise<AuthorizationRole>;
-    previewRole(roleId: number): Promise<RoleProvisionPreview>;
-    applyRole(roleId: number, input: ApplyRoleProvisionInput): Promise<RoleProvisionRun>;
-    getProvisioningRun(runId: number): Promise<RoleProvisionRun>;
     startKeycloakBootstrap(input: StartKeycloakBootstrapInput): Promise<KeycloakBootstrapStart>;
     getKeycloakBootstrapRun(runId: number): Promise<KeycloakBootstrapRun>;
     startPrivilegedOperation(input: StartPrivilegedOperationInput): Promise<KeycloakBootstrapStart>;

package/dist/authorization/{client.js → bootstrap-client.js}

@@ -1,10 +1,8 @@
 import { resolveBackendUrl } from "../backend.js";
 import { ensureAccessToken, fetchWithKeycloakIdentity } from "../oauth.js";
 import { AuthorizationError, authorizationHttpErrorCode } from "./errors.js";
-import { AuthorizationApiErrorSchema, AuthorizationRoleListSchema, AuthorizationRoleSchema, KeycloakBootstrapRunSchema, KeycloakBootstrapStartSchema, RoleProvisionPreviewSchema, RoleProvisionRunSchema } from "./schemas.js";
+import { AuthorizationApiErrorSchema, KeycloakBootstrapRunSchema, KeycloakBootstrapStartSchema, } from "./schemas.js";
 const AUTHORIZATION_ROOT = "/api/v1/admin/authorization";
-const ROLE_ROOT = `${AUTHORIZATION_ROOT}/roles`;
-const RUN_ROOT = `${AUTHORIZATION_ROOT}/role-provisioning/runs`;
 const BOOTSTRAP_ROOT = `${AUTHORIZATION_ROOT}/bootstrap`;
 const PRIVILEGED_OPERATIONS_ROOT = `${AUTHORIZATION_ROOT}/privileged-operations`;
 async function responseBody(response) {
@@ -47,7 +45,7 @@ function apiFailure(response, body) {
     };
     return new AuthorizationError(`Authorization API HTTP ${response.status}: ${messages[response.status] ?? "Request failed."}`, code, response.status, requestIdFrom(response, body), parsed.success ? parsed.data.code : undefined, parsed.success ? parsed.data.runId : undefined);
 }
-export class AuthorizationClient {
+export class BootstrapClient {
     config;
     fetchImpl;
     tokenProvider;
@@ -64,7 +62,7 @@ export class AuthorizationClient {
         headers.set("Accept", "application/json");
         if (init.body != null)
             headers.set("Content-Type", "application/json");
-        return fetchWithKeycloakIdentity(this.config, url, () => ({ ...init, headers }), { fetch: this.fetchImpl, tokenProvider: this.tokenProvider });
+        return fetchWithKeycloakIdentity(this.config, url, () => ({ ...init, headers, redirect: "error" }), { fetch: this.fetchImpl, tokenProvider: this.tokenProvider, retryUnauthorized: !init.method || init.method === "GET" });
     }
     async json(path, schema, init = {}, expectedStatuses = [200]) {
         const response = await this.authenticatedFetch(path, init);
@@ -80,27 +78,6 @@ export class AuthorizationClient {
         }
         return parsed.data;
     }
-    listRoles() {
-        return this.json(ROLE_ROOT, AuthorizationRoleListSchema);
-    }
-    createRole(input) {
-        return this.json(ROLE_ROOT, AuthorizationRoleSchema, {
-            method: "POST",
-            body: JSON.stringify(input)
-        }, [201]);
-    }
-    previewRole(roleId) {
-        return this.json(`${ROLE_ROOT}/${roleId}/provisioning/preview`, RoleProvisionPreviewSchema);
-    }
-    applyRole(roleId, input) {
-        return this.json(`${ROLE_ROOT}/${roleId}/provisioning`, RoleProvisionRunSchema, {
-            method: "POST",
-            body: JSON.stringify(input)
-        }, [200, 201]);
-    }
-    getProvisioningRun(runId) {
-        return this.json(`${RUN_ROOT}/${runId}`, RoleProvisionRunSchema);
-    }
     startKeycloakBootstrap(input) {
         return this.json(`${BOOTSTRAP_ROOT}/sessions`, KeycloakBootstrapStartSchema, {
             method: "POST",
@@ -120,4 +97,4 @@ export class AuthorizationClient {
         return this.json(`${PRIVILEGED_OPERATIONS_ROOT}/${runId}`, KeycloakBootstrapRunSchema);
     }
 }
-//# sourceMappingURL=client.js.map
+//# sourceMappingURL=bootstrap-client.js.map

package/dist/authorization/bootstrap-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-client.js","sourceRoot":"","sources":["../../src/authorization/bootstrap-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAA8B,MAAM,aAAa,CAAC;AACvG,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,GAG7B,MAAM,cAAc,CAAC;AAEtB,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACzD,MAAM,cAAc,GAAG,GAAG,kBAAkB,YAAY,CAAC;AACzD,MAAM,0BAA0B,GAAG,GAAG,kBAAkB,wBAAwB,CAAC;AAmCjF,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,KAAK,CAAC,MAAM,IAAI,GAAG;WACnB,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB,EAAE,IAAa;IACtD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IAClC,CAAC;IACD,OAAO,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,QAAkB,EAAE,IAAa;IACnD,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAoC;QAChD,GAAG,EAAE,mDAAmD;QACxD,GAAG,EAAE,uDAAuD;QAC5D,GAAG,EAAE,8DAA8D;QACnE,GAAG,EAAE,kEAAkE;QACvE,GAAG,EAAE,2DAA2D;QAChE,GAAG,EAAE,qEAAqE;QAC1E,GAAG,EAAE,sEAAsE;KAC5E,CAAC;IACF,OAAO,IAAI,kBAAkB,CAC3B,0BAA0B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,iBAAiB,EAAE,EAC9F,IAAI,EACJ,QAAQ,CAAC,MAAM,EACf,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,EAC7B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,eAAe;IAIG,MAAM;IAHlB,SAAS,CAAe;IACxB,aAAa,CAAwB;IAEtD,YAA6B,MAAkB,EAAE,YAAY,GAAgC,EAAE;sBAAlE,MAAM;QACjC,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC,KAAK,IAAI,KAAK,CAAC;QAC7C,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,aAAa,IAAI,iBAAiB,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,IAAY,EAAE,IAAI,GAAgB,EAAE;QACnE,iFAAiF;QACjF,yEAAyE;QACzE,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACvE,OAAO,yBAAyB,CAC9B,IAAI,CAAC,MAAM,EACX,GAAG,EACH,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAC/C,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,iBAAiB,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CACvH,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,IAAY,EACZ,MAAiB,EACjB,IAAI,GAAgB,EAAE,EACtB,gBAAgB,GAAa,CAAC,GAAG,CAAC;QAElC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,kBAAkB,CAC1B,mCAAmC,QAAQ,CAAC,MAAM,cAAc,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAChG,gCAAgC,EAChC,QAAQ,CAAC,MAAM,EACf,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,kBAAkB,CAC1B,kFAAkF,EAClF,gCAAgC,EAChC,QAAQ,CAAC,MAAM,EACf,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,sBAAsB,CAAC,KAAkC;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,WAAW,EAAE,4BAA4B,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,uBAAuB,CAAC,KAAa;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,SAAS,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;IAClF,CAAC;IAED,wBAAwB,CAAC,KAAoC;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,4BAA4B,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,KAAa;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,0BAA0B,IAAI,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACzF,CAAC;CACF"}