@numa-tech/numa 1.20.7 → 1.22.0

package/dist/platform-profile.js

@@ -1,5 +1,5 @@
-import { createHash } from "node:crypto";
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { z } from "zod";
 import { appConfigDirectory, appConfigPath, loadAppConfig, saveAppConfig } from "./app-config.js";
@@ -18,6 +18,8 @@ const ServiceSchema = z.object({
     audience: z.string().min(1),
     roleClientId: z.string().min(1),
     apiVersion: z.string().min(1),
+    applicationCode: z.string().min(1).optional(),
+    issuerAuthorities: z.record(z.string(), z.string().min(1)).optional(),
     capabilityUrl: z.string().url().optional(),
     configuration: z.object({
         defaultNamespaceKey: z.string().min(1).optional(),
@@ -37,13 +39,14 @@ const ServiceSchema = z.object({
 }).passthrough();
 const EmptyServiceSchema = z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length === 0, "Unavailable services must be represented by an empty object");
 const ProfileSchema = z.object({
-    schemaVersion: z.literal(1),
+    schemaVersion: z.union([z.literal(1), z.literal(2)]),
     profileId: z.string().min(1),
     revision: z.number().int().positive(),
     environment: z.string().min(1),
     tenant: z.object({ id: z.string().min(1), headerName: z.string().min(1) }),
     authorities: z.record(z.string(), AuthoritySchema),
     services: z.record(z.string(), z.union([ServiceSchema, EmptyServiceSchema])),
+    defaultLoginService: z.string().min(1).optional(),
     authentication: z.object({
         platformAuthority: z.string().min(1),
         businessDefaultAuthority: z.string().min(1),
@@ -63,11 +66,27 @@ export class ModuleUnavailableError extends Error {
         this.name = "ModuleUnavailableError";
     }
 }
+export class ClientUpgradeRequiredError extends Error {
+    code = "client_upgrade_required";
+    constructor(minimumVersion) {
+        super(`此 profile 要求 Numa ${minimumVersion} 或更高版本`);
+        this.name = "ClientUpgradeRequiredError";
+    }
+}
 let activeProfile;
 export function currentPlatformProfile() {
     return activeProfile;
 }
 export function setPlatformProfileForTests(profile) {
+    if (!profile) {
+        activeProfile = undefined;
+        return;
+    }
+    const legacyLocalOverrides = profile.legacyLocalOverrides || (profile.schemaVersion === 1 && !profile.authentication ? true : undefined);
+    const canonical = resolved(validateProfile(profile), profile.sourceUrl, profile.stale, legacyLocalOverrides);
+    // Test fixtures may intentionally mutate the active object between assertions.
+    Object.assign(profile, canonical);
+    delete profile.authentication;
     activeProfile = profile;
 }
 export class ProfileMismatchError extends Error {
@@ -111,73 +130,117 @@ export async function resolvePlatformProfile(sourceUrl, options = {}) {
     validateProfileUrl(sourceUrl);
     const now = (options.now ?? Date.now)();
     const file = join(options.cacheDirectory ?? appConfigDirectory(), `profile-${createHash("sha256").update(sourceUrl).digest("hex").slice(0, 24)}.json`);
-    const cached = await readCache(file, sourceUrl);
-    const cachedProfile = cached ? ProfileSchema.safeParse(cached.profile) : undefined;
-    if (cached && cachedProfile?.success
-        && now - cached.fetchedAt < cachedProfile.data.cache.maxAgeSeconds * 1_000) {
-        return resolved(cachedProfile.data, sourceUrl, false);
+    let cached = await readCache(file, sourceUrl);
+    let cachedProfile;
+    if (cached) {
+        try {
+            cachedProfile = validateProfile(cached.profile);
+        }
+        catch (error) {
+            if (error instanceof ClientUpgradeRequiredError)
+                throw error;
+            await preserveInvalidCache(file);
+            cached = undefined;
+        }
+    }
+    // Upgrade a validated old cache before either the fresh-cache or offline path.
+    // Keep age and ETag: changing representation does not refresh server evidence.
+    if (cached && cachedProfile && (cached.schemaVersion === 1 || cached.profile.schemaVersion === 1)) {
+        cached = { ...cached, schemaVersion: 2, profile: cachedProfile,
+            ...(cached.migration ? { migration: cached.migration } : legacyMigration(cached.profile)) };
+        await writePrivateJson(file, cached);
     }
+    if (cached && cachedProfile && now >= cached.fetchedAt
+        && now - cached.fetchedAt < cachedProfile.cache.maxAgeSeconds * 1_000) {
+        return resolved(cachedProfile, sourceUrl, false, cached.migration?.legacyLocalOverrides);
+    }
+    let response;
     try {
-        const response = await (options.fetch ?? fetch)(sourceUrl, {
+        response = await (options.fetch ?? fetch)(sourceUrl, {
             headers: { Accept: "application/json", ...(cached?.etag ? { "If-None-Match": cached.etag } : {}) },
             signal: AbortSignal.timeout(5_000)
         });
-        let raw;
-        let etag = cached?.etag;
-        if (response.status === 304 && cached)
-            raw = cached.profile;
-        else {
-            if (!response.ok)
-                throw new Error(`HTTP ${response.status}`);
-            raw = await response.json();
-            etag = response.headers.get("etag") ?? undefined;
-        }
-        const parsed = validateProfile(raw);
-        if (cachedProfile?.success && parsed.profileId === cachedProfile.data.profileId
-            && parsed.revision < cachedProfile.data.revision) {
-            throw new Error("远程 profile revision 低于最后一个有效快照");
-        }
-        await writePrivateJson(file, { schemaVersion: 1, sourceUrl, fetchedAt: now, ...(etag ? { etag } : {}), profile: raw });
-        return resolved(parsed, sourceUrl, false);
+        if (!response.ok && response.status !== 304)
+            throw new Error(`HTTP ${response.status}`);
     }
     catch (error) {
-        if (!cached || !cachedProfile?.success || now - cached.fetchedAt > 24 * 60 * 60_000)
+        if (!cached || !cachedProfile || now < cached.fetchedAt || now - cached.fetchedAt > 24 * 60 * 60_000)
             throw error;
         options.warn?.("远程 profile 暂时不可用，正在使用 24 小时内的缓存快照。请检查网络连接。");
-        return resolved(cachedProfile.data, sourceUrl, true);
+        return resolved(cachedProfile, sourceUrl, true, cached.migration?.legacyLocalOverrides);
+    }
+    // A received invalid/upgrade-required profile must not be masked by an older cache.
+    if (response.status === 304 && !cached)
+        throw new Error("Profile 返回 304，但没有有效缓存。");
+    const raw = response.status === 304 ? cached.profile : await response.json();
+    const parsed = validateProfile(raw);
+    if (cached && cachedProfile && !cached.migration && cachedProfile.profileId === parsed.profileId
+        && raw.schemaVersion === 1)
+        throw new Error("已使用 Profile v2，不能降级为 v1；回滚请发布新的 v2 revision。");
+    if (cachedProfile && parsed.profileId === cachedProfile.profileId && parsed.revision < cachedProfile.revision) {
+        if (!cached || now < cached.fetchedAt || now - cached.fetchedAt > 24 * 60 * 60_000)
+            throw new Error("远程 profile revision 低于最后一个有效快照");
+        options.warn?.("远程 profile revision 低于最后一个有效快照，保留缓存。请检查发布版本。");
+        return resolved(cachedProfile, sourceUrl, true, cached.migration?.legacyLocalOverrides);
     }
+    const migration = response.status === 304 ? cached?.migration : legacyMigration(raw).migration;
+    const etag = response.status === 304 ? cached?.etag : response.headers.get("etag") ?? undefined;
+    await writePrivateJson(file, { schemaVersion: 2, sourceUrl, fetchedAt: now,
+        ...(etag ? { etag } : {}), ...(migration ? { migration } : {}), profile: parsed });
+    return resolved(parsed, sourceUrl, false, migration?.legacyLocalOverrides);
+}
+function legacyMigration(raw) {
+    const value = raw;
+    return value.schemaVersion === 1 ? { migration: { sourceSchemaVersion: 1,
+            ...(!value.authentication ? { legacyLocalOverrides: true } : {}) } } : {};
 }
 function validateProfile(raw) {
-    const profile = ProfileSchema.parse(raw);
-    const minimumVersion = profile.minimumClientVersions?.numa;
+    // Read the upgrade gate before schema parsing so future versions explain recovery.
+    const minimumVersion = raw && typeof raw === "object"
+        ? raw.minimumClientVersions?.numa : undefined;
+    if (typeof minimumVersion === "string" && !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(minimumVersion))
+        throw new Error("Profile minimumClientVersions.numa 必须是有效版本号");
     if (typeof minimumVersion === "string" && compareVersions(PACKAGE_VERSION, minimumVersion) < 0) {
-        throw new Error(`此 profile 要求 Numa ${minimumVersion} 或更高版本`);
+        throw new ClientUpgradeRequiredError(minimumVersion);
     }
+    const profile = ProfileSchema.parse(raw);
     for (const [key, service] of Object.entries(profile.services)) {
         const parsedService = ServiceSchema.safeParse(service);
         if (!parsedService.success)
             continue;
-        if (!profile.authorities[parsedService.data.authority])
+        if (!Object.hasOwn(profile.authorities, parsedService.data.authority))
             throw new Error(`服务 ${key} 引用了未知 authority`);
+        for (const authority of Object.values(parsedService.data.issuerAuthorities ?? {}))
+            if (!Object.hasOwn(profile.authorities, authority))
+                throw new Error(`服务 ${key} 的 issuerAuthorities 引用了未知 authority`);
     }
     const auth = profile.authentication;
-    if (auth) {
+    if (profile.schemaVersion === 1 && auth) {
         const platform = ServiceSchema.parse(profile.services.platform);
-        if (platform.authority !== auth.platformAuthority || !profile.authorities[auth.platformAuthority])
+        if (platform.authority !== auth.platformAuthority || !Object.hasOwn(profile.authorities, auth.platformAuthority))
             throw new Error("Profile platform authority does not match fixed platform authentication");
         if (!Object.values(auth.businessIssuers).includes(auth.businessDefaultAuthority))
             throw new Error("Profile business default issuer is not available");
         for (const key of Object.values(auth.businessIssuers)) {
-            if (!profile.authorities[key])
+            if (!Object.hasOwn(profile.authorities, key))
                 throw new Error("Profile business issuer references unknown authority");
         }
         for (const key of auth.businessServices) {
             const service = ServiceSchema.parse(profile.services[key]);
             if (service.authority !== auth.businessDefaultAuthority)
                 throw new Error("Business service authority must match the business default");
+            profile.services[key] = { ...service, issuerAuthorities: { ...auth.businessIssuers } };
         }
     }
-    return profile;
+    if (profile.schemaVersion === 1 && !auth && !profile.services.oss && profile.services.platform)
+        profile.services.oss = { ...profile.services.platform };
+    const defaultLoginService = profile.defaultLoginService ?? (profile.schemaVersion === 1 && auth ? "oss" : ServiceSchema.safeParse(profile.services.platform).success ? "platform" : undefined);
+    if (defaultLoginService && !ServiceSchema.safeParse(profile.services[defaultLoginService]).success)
+        throw new Error("Profile defaultLoginService 引用了不可用服务");
+    // schema v2 has no platform-special authentication model. Conversion is explicit
+    // and pure; the local cache separately records old override compatibility.
+    const { authentication: _legacy, ...canonical } = profile;
+    return { ...canonical, schemaVersion: 2, defaultLoginService };
 }
 function compareVersions(left, right) {
     const parts = (value) => value.split(".").slice(0, 3).map((item) => Number.parseInt(item, 10) || 0);
@@ -189,28 +252,23 @@ function compareVersions(left, right) {
     }
     return 0;
 }
-function resolved(profile, sourceUrl, stale) {
-    return { ...profile, sourceUrl, stale };
+function resolved(profile, sourceUrl, stale, legacyLocalOverrides) {
+    return { ...profile, sourceUrl, stale, ...(legacyLocalOverrides ? { legacyLocalOverrides } : {}) };
 }
 export function requireProfileService(key, issuer) {
-    if (issuer && key !== "oss")
-        throw new Error("--issuer 仅适用于业务服务；平台管理 issuer 固定。");
     if (!activeProfile) {
         if (issuer)
             throw new Error("--issuer 需要包含业务身份源配置的 Profile。");
         return undefined;
     }
-    const auth = activeProfile.authentication;
-    if (issuer && !auth)
-        throw new Error(`当前 Profile ${activeProfile.profileId}（revision ${activeProfile.revision}，来源 ${activeProfile.sourceUrl}）未下发可选业务 issuer。` +
-            "请确认 Profile 来源；本地构建仍默认读取全局配置。本地 MVP 请使用 scripts/mvp-cli.sh，其他环境需发布包含业务身份源的新 Profile。");
-    const candidate = activeProfile.services[key] ?? (key === "oss" && !auth ? activeProfile.services.platform : undefined);
-    const service = ServiceSchema.safeParse(candidate);
+    const service = ServiceSchema.safeParse(activeProfile.services[key]);
     if (!service.success)
         throw new ModuleUnavailableError(key);
-    const selectedKey = key === "oss" && auth
-        ? issuer ? Object.hasOwn(auth.businessIssuers, issuer) ? auth.businessIssuers[issuer] : undefined : auth.businessDefaultAuthority
-        : service.data.authority;
+    const choices = service.data.issuerAuthorities;
+    if (issuer && !choices)
+        throw new Error(`当前 Profile ${activeProfile.profileId}（revision ${activeProfile.revision}，来源 ${activeProfile.sourceUrl}）未下发该服务可选业务 issuer。` +
+            (key === "platform" ? "平台管理 issuer 固定。" : "请确认 Profile 来源；本地 MVP 请使用 scripts/mvp-cli.sh。"));
+    const selectedKey = issuer ? Object.hasOwn(choices, issuer) ? choices[issuer] : undefined : service.data.authority;
     if (!selectedKey)
         throw new Error("指定的业务 issuer 不在当前 Profile 可选列表中。");
     const authority = activeProfile.authorities[selectedKey];
@@ -219,22 +277,74 @@ export function requireProfileService(key, issuer) {
     return { profile: activeProfile, service: service.data, authority };
 }
 async function readCache(file, sourceUrl) {
+    let original;
     try {
-        const value = JSON.parse(await readFile(file, "utf8"));
-        return value.schemaVersion === 1 && value.sourceUrl === sourceUrl && typeof value.fetchedAt === "number"
-            ? value : undefined;
+        original = await readFile(file);
     }
     catch (error) {
         if (error.code === "ENOENT")
             return undefined;
-        return undefined;
+        throw error;
     }
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(original));
+    }
+    catch { /* Preserve malformed bytes before recovery. */ }
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+        const wireVersion = value.profile?.schemaVersion;
+        if (typeof value.schemaVersion === "number" && ![1, 2].includes(value.schemaVersion)
+            || typeof wireVersion === "number" && ![1, 2].includes(wireVersion))
+            throw new Error("本地 Profile 缓存使用不支持的版本；请升级 CLI，原文件未修改。");
+        if ([1, 2].includes(value.schemaVersion ?? 0) && value.sourceUrl === sourceUrl
+            && typeof value.fetchedAt === "number" && Number.isFinite(value.fetchedAt) && value.fetchedAt >= 0)
+            return value;
+    }
+    await preserveInvalidCache(file, original);
+    return undefined;
+}
+async function preserveInvalidCache(file, original) {
+    const bytes = original ?? await readFile(file);
+    const backup = `${file}.invalid-${createHash("sha256").update(bytes).digest("hex").slice(0, 24)}.backup`;
+    try {
+        if ((await readFile(backup)).equals(bytes))
+            return;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    await writePrivateText(backup, bytes);
 }
 async function writePrivateJson(file, value) {
+    await writePrivateText(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+async function writePrivateText(file, content) {
     await mkdir(dirname(file), { recursive: true, mode: 0o700 });
-    const temporary = `${file}.${process.pid}.tmp`;
-    await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
-    await rename(temporary, file);
+    const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        const handle = await open(temporary, "wx", 0o600);
+        try {
+            await handle.writeFile(content);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(temporary, file);
+        if (process.platform !== "win32") {
+            const directory = await open(dirname(file), "r");
+            try {
+                await directory.sync();
+            }
+            finally {
+                await directory.close();
+            }
+        }
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
 }
 function validateProfileUrl(value) {
     const url = new URL(value);

package/dist/platform-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-profile.js","sourceRoot":"","sources":["../src/platform-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAE3E,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjD,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;QAC/C,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC/C,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC;YAC/B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC5C,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC1C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACrD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC7C,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC,WAAW,EAAE,CAAC;AACjB,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACjE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAC1C,6DAA6D,CAC9D,CAAC;AACF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5E,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC7C,CAAC,CAAC,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;IAC3G,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAiBH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE1B,UAAU;IADtB,IAAI,GAAG,oBAAoB,CAAC;IACrC,YAAqB,UAAkB;QACrC,KAAK,CAAC,kBAAkB,UAAU,MAAM,CAAC,CAAC;0BADvB,UAAU;QAE7B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,IAAI,aAAkD,CAAC;AAEvD,MAAM,UAAU,sBAAsB;IACpC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAA4C;IACrF,aAAa,GAAG,OAAO,CAAC;AAC1B,CAAC;AASD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAGxB,WAAW;IAFvB,IAAI,GAAG,qBAAqB,CAAC;IAC7B,eAAe,CAAS;IACjC,YAAqB,WAA+B;QAClD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;QAC5E,MAAM,QAAQ,GAAG,qBAAqB,KAAK,CAAC,cAAc,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,KAAK,CAAC,aAAa,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QACxJ,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG;YACvH,mBAAmB,QAAQ,4BAA4B,CAAC,CAAC;2BAJxC,WAAW;QAK9B,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;IAClC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAO,GAKnD,EAAE;IACJ,aAAa,GAAG,SAAS,CAAC;IAC1B,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACtF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,aAAa,GAAG,SAAS,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;QACvE,MAAM,WAAW,GAAG,EAAC,UAAU,EAAE,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,EAAC,CAAC;QACjI,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,MAAM,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,aAAa,CAAC,EAAC,GAAG,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAC,CAAC,CAAC;IAC1F,CAAC;IACD,aAAa,GAAG,SAAS,CAAC;IAC1B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB,EAAE,OAAO,GAKnE,EAAE;IACJ,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,kBAAkB,EAAE,EAC9D,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,IAAI,MAAM,IAAI,aAAa,EAAE,OAAO;WAC/B,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,KAAK,EAAE,CAAC;QAC7E,OAAO,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,SAAS,EAAE;YACzD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAClG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,GAAY,CAAC;QACjB,IAAI,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;QACxB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM;YAAE,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;aACvD,CAAC;YACJ,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7D,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QACnD,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,aAAa,EAAE,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,aAAa,CAAC,IAAI,CAAC,SAAS;eAC1E,MAAM,CAAC,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACvH,OAAO,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,OAAO,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM;YAAE,MAAM,KAAK,CAAC;QACjG,OAAO,CAAC,IAAI,EAAE,CAAC,4CAA4C,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC;IAC3D,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,eAAe,CAAC,eAAe,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,qBAAqB,cAAc,QAAQ,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,OAAO;YAAE,SAAS;QACrC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC;IACpC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACzG,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3D,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,wBAAwB;gBACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,KAAK,CAAE,KAAK,CAAC,CAAC,KAAK,CAAE;YAAE,OAAO,CAAC,CAAC,KAAK,CAAE,GAAG,CAAC,CAAC,KAAK,CAAE,CAAC;IAC5D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,OAAoB,EAAE,SAAiB,EAAE,KAAc;IACvE,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAuB,EAAE,MAAe;IAK5E,IAAI,MAAM,IAAI,GAAG,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,cAAc,CAAC;IAC1C,IAAI,MAAM,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAClC,cAAc,aAAa,CAAC,SAAS,aAAa,aAAa,CAAC,QAAQ,OAAO,aAAa,CAAC,SAAS,kBAAkB;YACxH,sFAAsF,CACvF,CAAC;IACF,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxH,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,GAAG,KAAK,KAAK,IAAI,IAAI;QACvC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB;QACjI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;IAC3B,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,SAAiB;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAwB,CAAC;QAC9E,OAAO,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACtG,CAAC,CAAC,KAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAc;IAC1D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC/C,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}
+{"version":3,"file":"platform-profile.js","sourceRoot":"","sources":["../src/platform-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAE3E,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjD,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;QAC/C,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC/C,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC;YAC/B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC5C,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC1C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACrD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC7C,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC,WAAW,EAAE,CAAC;AACjB,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACjE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAC1C,6DAA6D,CAC9D,CAAC;AACF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC7C,CAAC,CAAC,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;IAC3G,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAoBH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE1B,UAAU;IADtB,IAAI,GAAG,oBAAoB,CAAC;IACrC,YAAqB,UAAkB;QACrC,KAAK,CAAC,kBAAkB,UAAU,MAAM,CAAC,CAAC;0BADvB,UAAU;QAE7B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,yBAAyB,CAAC;IAC1C,YAAY,cAAsB;QAChC,KAAK,CAAC,qBAAqB,cAAc,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,IAAI,aAAkD,CAAC;AAEvD,MAAM,UAAU,sBAAsB;IACpC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAA4C;IACrF,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,aAAa,GAAG,SAAS,CAAC;QAAC,OAAO;IAAC,CAAC;IACpD,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzI,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC7G,+EAA+E;IAC/E,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,cAAc,CAAC;IAC9B,aAAa,GAAG,OAAO,CAAC;AAC1B,CAAC;AASD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAGxB,WAAW;IAFvB,IAAI,GAAG,qBAAqB,CAAC;IAC7B,eAAe,CAAS;IACjC,YAAqB,WAA+B;QAClD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC;QAC5E,MAAM,QAAQ,GAAG,qBAAqB,KAAK,CAAC,cAAc,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,KAAK,CAAC,aAAa,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QACxJ,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG;YACvH,mBAAmB,QAAQ,4BAA4B,CAAC,CAAC;2BAJxC,WAAW;QAK9B,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;IAClC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAO,GAKnD,EAAE;IACJ,aAAa,GAAG,SAAS,CAAC;IAC1B,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACtF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,aAAa,GAAG,SAAS,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;QACvE,MAAM,WAAW,GAAG,EAAC,UAAU,EAAE,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,EAAC,CAAC;QACjI,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,MAAM,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,aAAa,CAAC,EAAC,GAAG,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAC,CAAC,CAAC;IAC1F,CAAC;IACD,aAAa,GAAG,SAAS,CAAC;IAC1B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB,EAAE,OAAO,GAKnE,EAAE;IACJ,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,kBAAkB,EAAE,EAC9D,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACvF,IAAI,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,aAAsC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACtE,IAAI,KAAK,YAAY,0BAA0B;gBAAE,MAAM,KAAK,CAAC;YAC7D,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,IAAI,MAAM,IAAI,aAAa,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,CAAC,IAAK,MAAM,CAAC,OAAuB,CAAC,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa;YAC5D,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,MAAM,IAAI,aAAa,IAAI,GAAG,IAAI,MAAM,CAAC,SAAS;WACjD,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,GAAG,KAAK,EAAE,CAAC;QACxE,OAAO,QAAQ,CAAC,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,SAAS,EAAE;YACnD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAClG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM;YAAE,MAAM,KAAK,CAAC;QAClH,OAAO,CAAC,IAAI,EAAE,CAAC,4CAA4C,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC1F,CAAC;IACD,oFAAoF;IACpF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnF,MAAM,GAAG,GAAY,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvF,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,MAAM,IAAI,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,aAAa,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;WAC1F,GAAmB,CAAC,aAAa,KAAK,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,IAAI,aAAa,IAAI,MAAM,CAAC,SAAS,KAAK,aAAa,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC9G,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM;YAChF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,EAAE,CAAC,8CAA8C,CAAC,CAAC;QAC/D,OAAO,QAAQ,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IAC/F,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;IAChG,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG;QACxE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,OAAO,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,KAAK,GAAG,GAAkB,CAAC;IACjC,OAAO,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,mBAAmB,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,mFAAmF;IACnF,MAAM,cAAc,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QACnD,CAAC,CAAE,GAAsD,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,0DAA0D,CAAC,IAAI,CAAC,cAAc,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,eAAe,CAAC,eAAe,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,OAAO;YAAE,SAAS;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC;QACpH,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;YAC/E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,sCAAsC,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC;IACpC,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,iBAAiB,CAAC;YAC9G,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACxH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3D,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,wBAAwB;gBACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,iBAAiB,EAAE,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACzF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ;QAC5F,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC1D,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/L,IAAI,mBAAmB,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO;QAChG,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,CAAC;IAC1D,OAAO,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,KAAK,CAAE,KAAK,CAAC,CAAC,KAAK,CAAE;YAAE,OAAO,CAAC,CAAC,KAAK,CAAE,GAAG,CAAC,CAAC,KAAK,CAAE,CAAC;IAC5D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,OAAoB,EAAE,SAAiB,EAAE,KAAc,EAAE,oBAA2B;IACpG,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAuB,EAAE,MAAe;IAK5E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAC/C,IAAI,MAAM,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CACrC,cAAc,aAAa,CAAC,SAAS,aAAa,aAAa,CAAC,QAAQ,OAAO,aAAa,CAAC,SAAS,qBAAqB;YAC3H,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAC3F,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;IACrH,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,SAAiB;IACtD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACxC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACxG,IAAI,KAAsC,CAAC;IAC3C,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAwB,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,+CAA+C,CAAC,CAAC;IACzL,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,WAAW,GAAI,KAAK,CAAC,OAAmD,EAAE,aAAa,CAAC;QAC9F,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC;eAC/E,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;eACzE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC;YAClG,OAAO,KAAmB,CAAC;IAC/B,CAAC;IACD,MAAM,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,QAAiB;IACjE,MAAM,KAAK,GAAG,QAAQ,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,GAAG,IAAI,YAAY,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC;IACzG,IAAI,CAAC;QAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO;IAAC,CAAC;IAC3D,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;IACtF,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAc;IAC1D,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAA4B;IACxE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;gBACrD,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QACjC,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC;gBAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QACtE,CAAC;IACH,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACrD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/docs/authorization-configuration-publication.md

@@ -0,0 +1,93 @@
+# Application configuration publication from the CLI
+
+The current DevOps API publishes a reviewed complete configuration bundle. Use
+`numa authorization application --app <id> publication preview` for new work.
+The existing `plan`, `prepare`, `review`, `apply` and `recheck` commands remain
+available for historical stage-based jobs; `apply` still executes one stage.
+There is no automatic fallback from the new protocol to the old protocol.
+
+All commands use the profile's `platform` service and require the server's
+`mci-devops-platform-ops-admin` role. Select the exact application and environment
+from read-only catalog/source responses before saving anything. An ordinary
+registered issuer can be the DevOps management issuer. Use `REGISTERED` with its
+issuer UUID for new environment bindings. `PLATFORM` remains a server-compatible
+legacy alias; a registered management issuer may retain the historical
+`identityKey: "platform"`. Do not derive the identity key from the issuer UUID.
+
+## Edit with the correct optimistic versions
+
+Read the current object immediately before editing and preserve its concurrency
+fields. A stale save returns a conflict; inspect the latest value and make a new
+explicit decision. The CLI never silently refreshes a version and retries a write.
+
+| Operation | Concurrency evidence |
+| --- | --- |
+| Definition save/freeze | `expectedDraftVersion` |
+| Role composition change | First `definition preview-compositions --file`, then its `expectedDigest` as `expectedCompositionDigest` on definition save |
+| Client/group draft | `expectedDefinitionVersion`, `expectedReferenceVersion`, `expectedInstanceVersion`, `expectedTargetVersion` |
+| Login trust change | Both `enrollmentTrusted` and `expectedEnrollmentTrustVersion` |
+| Relation changes | `expectedRevision`; source-release changes additionally pin block version/generation |
+| Environment binding | Its `version`, not a Client or publication version |
+| Complete publication | Job `version`, `planDigest` and `plan.configurationBundle.bundleDigest` from the same reviewed response |
+
+Saving a draft does not publish. A frozen permission-definition version is an
+immutable input to publication; it is not the edit-concurrency version of every
+Client, group or environment.
+
+## Preview and execute
+
+Create a JSON file containing the exact request ID, frozen definition version and
+environment UUIDs returned by the platform. Optional `clientModes` is keyed by
+Client instance UUID with CREATE/ADOPT/UPDATE/REPAIR values. The new `preview`
+command sends `protocolVersion: 2` and rejects an explicit protocol 1 value.
+Preview persists a reviewable job but makes no remote configuration changes, so
+it requires `--yes` to confirm creation of that exact job.
+
+```sh
+numa authorization application --app APP_ID publication preview --file preview.json --yes --json
+numa authorization application --app APP_ID publication show JOB_ID --json
+numa authorization application --app APP_ID publication execute JOB_ID \
+  --expected-version JOB_VERSION --expected-digest PLAN_SHA256 \
+  --expected-bundle-digest BUNDLE_SHA256 --yes --json
+```
+
+The capitalized values are placeholders to replace with reviewed API evidence.
+Review all bundle `objects`, `differences` (current/desired/baseline), `blockers`
+and role-removal effects. A BLOCKED preview must be resolved before execution.
+Use `--confirm-javascript-policy-deletion` only when the preview specifically
+requires that deletion and it has been approved. Ordinary `--yes` does not grant
+that additional consent. The backend owns object claims, concurrency checks,
+execution, retry scheduling and remote readback.
+
+The execute response acknowledges asynchronous work. Repeatedly **read** the same
+job with `publication show`; do not create another job to retry it. Full JSON
+retains the bundle and `execution.status`, `errorCode`, `errorDetails`,
+`verifiedAt`, `observedBundleDigest` and original consent. `QUEUED`, `RUNNING` and
+`RETRY_WAIT` are unfinished. `WAITING_MANUAL` needs examination. `SUCCEEDED`
+requires readback evidence, but a successful configuration readback does not prove
+that a real user's KB/OSS request is allowed. Validate the intended business call
+separately with the proper service identity.
+
+## Resume or abandon
+
+After inspecting a waiting job and its readback error, use its current version and
+the original plan/bundle digests:
+
+```sh
+numa authorization application --app APP_ID publication resume JOB_ID \
+  --expected-version JOB_VERSION --expected-digest PLAN_SHA256 \
+  --expected-bundle-digest BUNDLE_SHA256 --yes --json
+numa authorization application --app APP_ID publication abandon JOB_ID \
+  --expected-version JOB_VERSION --expected-digest PLAN_SHA256 \
+  --note 'Keep online state; stop further synchronization' --yes --json
+```
+
+Resume must repeat the original JavaScript deletion consent: supply
+`--confirm-javascript-policy-deletion` only if the original execution's
+`javascriptPolicyDeletionConfirmed` is true. It authorizes continuation of the
+original bundle, not new configuration. Abandon stops future writes and preserves
+online effects and historical evidence; it is not a rollback or a draft reset.
+
+`repreview --file` accepts `protocolVersion: 2` plus the original job confirmation
+and a new request ID. Historical cleanup remains explicit. No command bypasses a
+live job or turns a 401/409/uncertain request into an automatic mutation replay.

package/docs/oss-policy-client-governance.md

@@ -0,0 +1,93 @@
+# OSS 策略与机器 Client 授权
+
+这些命令通过 DevOps Platform 控制面操作；操作者使用平台身份和服务端校验的管理员权限。`--issuer-id` 是被授权机器所在的普通身份源 UUID，不会切换操作者身份。命令不读取 Client Secret，不输出 STS 凭据。
+
+## 先定位现有配置
+
+```sh
+numa oss identity --json
+numa oss clients --issuer-id <issuer-uuid> --query kb --json
+numa oss policy list --account-id <account-id> --query kb --json
+numa oss policy get <policy-id> --json
+numa oss policy bindings <policy-id> --json
+numa oss policy state <policy-id> --json
+```
+
+`clients` 返回的 `id` 是已登记的 **Client 实例 UUID**，是 Grant 的 `subjectKey`。它不等于 Client 编码、Keycloak Client UUID 或 SA subject。返回的 `clientId` 和 `subject` 是下一步输入核验信息。
+
+分页命令显式支持 `--page`；策略列表和绑定列表每页 20 条，Client、模板和发布作业列表每页最多 100 条。修改绑定前 CLI 会遍历该策略的 STS 授权（含停用历史），防止重复创建。
+
+旧的管理身份源 Grant 可能保存 `issuerId: null`。新请求仍填写 `oss identity` 返回的 `managementIssuerId`；CLI 根据实际身份源绑定识别旧记录，后端处理存储兼容，不需要人为将 UUID 改成 `platform` 或空值。
+
+## 修改策略范围或 Actions
+
+策略基于不可变模板 revision ID；不用旧的 `permissionLevel` 名称猜测 Actions。
+
+```sh
+numa oss templates list --query FILE --json
+numa oss templates get <revision-id> --json
+numa oss policy preview --id <policy-id> --file ./policy.json --json
+numa oss policy save --id <policy-id> --file ./policy.json --yes --json
+```
+
+`policy.json` 描述完整可编辑配置，例如：
+
+```json
+{
+  "accountId": 1,
+  "code": "kb-files",
+  "name": "KB files",
+  "region": "cn-shenzhen",
+  "bucketName": "example-kb-bucket",
+  "scopeType": "PREFIX",
+  "objectPrefix": "documents/",
+  "actionTemplateRevisionIds": [7],
+  "platformAccessEnabled": true,
+  "consoleAccessEnabled": false,
+  "cloudPolicyName": "kb-files",
+  "status": "ACTIVE",
+  "version": 4
+}
+```
+
+示例 ID、Bucket 和版本仅为占位；使用读取到的真实值。编辑保留已核对的 `version`，并明确填写 `consoleAccessEnabled`，避免遗漏字段改变原权限；若发生并发修改，命令拒绝写入并要求重新查看。新建时省略 `--id` 和 `version`。不接受凭据、原始 `policyDocument` 或动态 Action 覆盖字段。
+
+保存仅改变草稿。发布前查看完整 draft/published/observed 快照，并核对 Bucket、Prefix、Actions、平台访问开关和 RAM 绑定：
+
+```sh
+numa oss policy state <policy-id> --json
+numa oss policy publish <policy-id> --expected-checksum <reviewed-draftChecksum> --idempotency-key <stable-request-key> --yes --json
+numa oss policy jobs --account-id <account-id> --json
+numa oss policy check <policy-id> --json
+```
+
+发布请求使用已审核 checksum，后端原子拒绝过期配置。同一次发布固定幂等 key；网络超时或结果未知时先读取作业和状态，不更换 key 自动重复提交。`check` 会读取云端并更新核对记录，但不修改云端 Policy。作业返回不代表已完成，应核实发布成功和回读健康状态。
+
+## 绑定或更新机器 Client
+
+针对已启用、已发布的策略，准备以下 `binding.json`：
+
+```json
+{
+  "issuerId": "00000000-0000-4000-8000-000000000001",
+  "subjectKey": "00000000-0000-4000-8000-000000000002",
+  "clientId": "kb-oss",
+  "serviceAccountSubject": "actual-subject-from-directory",
+  "maxSessionSeconds": 1800,
+  "status": "ACTIVE",
+  "accessPriority": "NORMAL",
+  "description": "KB document storage",
+  "version": 4
+}
+```
+
+```sh
+numa oss policy bind-client <policy-id> --id <existing-grant-id> --file ./binding.json --yes --json
+numa oss policy bindings <policy-id> --json
+```
+
+更新使用绑定列表的 `recordId` 和 `version`；只有确认不存在旧授权时才省略 `--id` 和 `version` 创建。CLI 会核对 issuer、Client 实例、Client 编码及 SA subject，并保留原版本交给后端再次校验。更新省略 `accessPriority` 时保留原值。停用已有授权按原绑定核验身份，允许撤销已失效 Client。它不会在冲突后自动获取新版本覆盖别人修改，也不会自动重放治理写请求。
+
+Client Grant 是平台即时生效的授权记录，不属于云端 Policy 发布快照。只修改 Grant 且其引用策略已经有效时，不需重复发布云策略。若策略本身有待发布变化，先完成上面的策略发布。
+
+最后使用应用实际机器身份验证 `oss grants`、STS 签发以及实际 Bucket/Prefix 的读写流程。管理员看到 Grant 存在并不能证明机器 Token 的 issuer、azp、aud、角色及 SA subject 正确；403 应区分平台 API 拒绝、STS 拒绝和 OSS 对象操作拒绝后定位。

package/docs/profile-v2-migration.md

@@ -0,0 +1,34 @@
+# Profile v2 与升级迁移
+
+Numa / cli-auth / tokensrc Codex 从 1.21.0 支持 Profile v1 和 v2。先分发客户端，再发布新的 schemaVersion=2 Profile；已有 CLI 的 `minimumClientVersions` 是版本门槛，不是自动安装器。升级程序替换 npm 包不会删除配置目录，新进程首次使用 Profile 时自动迁移。
+
+## 服务契约
+
+`authorities` 是普通身份源字典，`services.<name>` 通过 `authority` 引用登录身份，并提供 `applicationCode`、`baseUrl`、`resource`、`audience`、`roleClientId`、`apiVersion`。多个模块可以指向同一个应用，彼此独立的应用也可以拥有不同的身份与 Audience。
+
+可选 `issuerAuthorities` 是当前服务允许选择的 `alias -> authority key` 映射。没有明确列表时 `--issuer` 不能切换身份源。平台管理命令继续选 `platform` 服务，不会因为注册了其他身份源就接受其管理登录。可选 `defaultLoginService` 指定无参数登录目标；新服务端通常设为 `platform`。`login/auth status/auth logout/profile --service` 支持 CLI 已有的服务；KB 保留自身配置与凭据约束。
+
+Profile v2 不再使用顶层 `authentication.platformAuthority/business*` 特殊模型。服务配置不授予权限，网关和目标应用仍验证实际 Token。
+
+## 自动迁移边界
+
+- `config.json` 的缺省旧版本和 v1/v2/v3 升级为 v4，保存原文件到 `config.json.before-v4`。保留显式 profile URL/ID、API 地址、语言、更新偏好与未知扩展字段。现有已知的废弃官方 URL 和历史默认 npm 地址迁移规则保留；自定义 URL 不替换。损坏、不支持的未来版本及非法字段拒绝覆盖。
+- `profile-<source URL hash>.json` 的旧缓存包装 v1 升级为包装 v2，Wire Profile v1 明确转换为 v2。原 v1 的业务默认登录目标、OSS 可选身份源和缺省 OSS 回退转换为显式服务配置；新 v2 不再隐式回退到平台服务。
+- 迁移保留服务地址、Issuer、登录 Client、租户、Audience、revision、ETag、fetchedAt。版本变换不刷新 TTL，离线最多使用原取得时间起 24 小时内的有效快照。
+- 无 authentication 的旧 v1 允许环境覆盖，这一行为通过本地缓存 `migration` 元数据保留；远程 v2 提供同名字段不能放宽新 Profile 的治理规则。新 v2 接管后，冲突的身份环境变量或不一致的全局 NUMA_BACKEND_BASE_URL 会明确报错（与服务地址相同的值允许），文件和环境变量不被静默清除。
+- 令牌缓存键仍为 `issuer + clientId + tenantId + audience`。身份源别名改变不改变令牌路径；实际身份/Audience 改变则使用隔离的路径。迁移不读取、重写、复制或删除令牌，也不启动登录。
+- 文件写入使用同目录唯一临时文件、私有权限、文件同步和原子替换。中断遗留临时文件不作为有效缓存读取；重复启动不会再次改写已升级的文件。配置迁移前备份，损坏 Profile 缓存先按原字节哈希保存私有 backup，只有重新获取并通过验证后才可替换；未来缓存或 Wire 版本拒绝覆写。
+- 有效远端响应的最低客户端版本约束不会被旧缓存回退绕过。未来 Wire 版本可先给出可读的最低版本错误；已接收原生 v2 后不会降级为 v1 来重新开启旧覆盖规则；回滚应发布更高 revision 的 v2 快照。
+
+## 验证
+
+`src/profile-migration.test.ts` 覆盖 fresh/offline cache、24 小时边界、ETag/年龄保留、迁移幂等、旧业务登录目标、身份隔离、服务独立路由、非法兼容标记、损坏与中断、用户配置保留、未来配置拒绝、Windows APPDATA 分支，以及带中文/空格配置路径下的真实 CLI 首次启动与再次启动。`packages/codex/src/profile.test.ts` 覆盖独立 Codex 的 v2/缓存兼容及版本门槛。
+
+Windows 路径分支在本机单元测试验证；完整 Windows 运行仍应由 Windows CI 执行。未修改生产 Profile，未发布 npm 包；包检查的 CLI smoke 已使用隔离配置目录。
+
+### 本次验收记录
+
+- 全工作区 `npm run check`：12 个任务通过；Numa 885/885，cli-auth 12/12，Codex 387 通过、10 项既有跳过、0 失败。
+- 全量检查启动后的缓存保留与包检查隔离修正，已对最终源码重新执行 build、TypeScript 检查、69 项变更相关测试及 root pack 检查，全部通过。
+- 最后 69 项测试直接透传 `NUMA_TEST_BUILT_CLI=1`，旧配置首次启动测试实际运行 `dist/cli.js`。Turbo 严格环境过滤不透传该变量，不能仅凭给 `npm run check` 添加变量宣称测试了构建入口。
+- 最终 tarball dry-run 检查通过，迁移说明随 CLI 包分发。本次没有 npm 发布、Git 推送或生产 Profile 写入。