@open-everywhere/core 0.1.0

package/dist/agent/identity/link-store.d.ts

@@ -0,0 +1,400 @@
+import type { LinkTransport } from "./link-flow.js";
+import type { LinkChallengeRow, LinkChallengeStatus, LinkSetRow, LinkSetStatus, LinkedIdRow, LinkedIdStatus } from "../operational/store.js";
+import type { LinkSetPrincipal } from "./link-resolve.js";
+export type { LinkChallengeRow, LinkChallengeStatus, LinkSetRow, LinkSetStatus, LinkedIdRow, LinkedIdStatus };
+/**
+ * WHY the system believes an account belongs to a person. Every confirmation records one, so
+ * invariant 2 has somewhere to land.
+ *
+ * `directory-sync` and `config-import` exist as vocabulary from day one deliberately: P2 writes
+ * `suggested` rows with `directory-sync` evidence and then CONFIRMS them through
+ * {@link confirmLinkedId} with the person's own DM tap recorded as a `challenge` — so the trust
+ * anchor stays uniform and no phase needs to widen this API to get its own back door.
+ */
+export type LinkEvidence = {
+    readonly kind: "challenge";
+    readonly challengeId: string;
+} | {
+    readonly kind: "config-import";
+    readonly note: string;
+} | {
+    readonly kind: "directory-sync";
+    readonly provider: string;
+    readonly grade: string;
+    /** The IdP's own user id for the person this mapping came from (P2). Recorded so the answer to
+     *  "which directory record produced this row" is a column and not an inference; NEVER a join
+     *  key (invariant 4 holds one level up — see identity/directory.ts). */
+    readonly externalId?: string;
+};
+/** What a write attempt did. A refusal is a VALUE, not a throw: every caller here is a tool or a
+ *  hook that must turn "no" into a sentence a person reads, and an exception would make the two
+ *  indistinguishable from a store outage. */
+export type LinkWriteResult = {
+    readonly ok: true;
+    readonly linkSetId: string;
+    readonly note: string;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/** One account, in the shape the read path hands out — the WHOLE triple, never a (platform, id)
+ *  pair (invariant 1). Build `tenant` with identity/link-tenant.ts's `linkTenantOf`, never by hand:
+ *  it is `""` for every vendor-global platform and the real workspace on a tenant-scoped one, and
+ *  getting that backwards is precisely the aliasing this column exists to delete. */
+export interface LinkedAccount {
+    readonly platform: string;
+    readonly tenant: string;
+    readonly nativeId: string;
+}
+/**
+ * The link-set this (platform, nativeId) belongs to, or null. FAIL-CLOSED on every axis that is not
+ * a live, proven link: a `suggested` row (not yet proven), a `revoked` row (terminal), and a set
+ * that is suspended or revoked all read as "no link-set" — so attribution degrades to per-surface
+ * identity, which is exactly the §5 fallback the config map already has.
+ */
+export declare function resolveLinkSet(org: string, platform: string, nativeId: string, tenant?: string | null): Promise<LinkSetRow | null>;
+/**
+ * Every CONFIRMED account in a link-set — the expansion G (person-groups) will call to turn one
+ * human into the platform ids they speak with. `suggested` and `revoked` rows are excluded for the
+ * same reason `resolveLinkSet` excludes them: an unproven or withdrawn account is not this person.
+ * Returns [] for an unknown, suspended or revoked set.
+ */
+export declare function expandLinkSet(org: string, linkSetId: string): Promise<readonly LinkedAccount[]>;
+/**
+ * Every ACTIVE link-set's CONFIRMED accounts, in the flat shape identity/link-resolve.ts unions
+ * with the config map — the ONE edge read the attribution path makes (P1.5). It lives here rather
+ * than in link-resolve.ts so that module stays pure: the resolver is a function of two lists, and
+ * the I/O is the caller's, exactly as `getConfig().loadPrincipals?.()` already is.
+ *
+ * A set whose confirmed accounts collapse to nothing is dropped rather than emitted empty — an
+ * entry with no ids can never join anything and would only be noise in the union.
+ */
+export declare function confirmedLinkSetPrincipals(org: string): Promise<readonly LinkSetPrincipal[]>;
+/** Every link-set in an org with its accounts — the admin list view (P1.4). Includes suspended and
+ *  revoked sets and non-confirmed rows on purpose: this is the view an admin OFFBOARDS from, and a
+ *  view that hid the withdrawn rows would hide the thing they are checking. */
+export declare function listLinkSetsWithIds(org: string): Promise<readonly {
+    readonly set: LinkSetRow;
+    readonly ids: readonly LinkedIdRow[];
+}[]>;
+/** A freshly-issued challenge: the row (for the caller's bookkeeping) plus the RAW code, which
+ *  exists nowhere else and must be shown to the initiator and then forgotten. */
+export interface IssuedChallenge {
+    readonly challenge: LinkChallengeRow;
+    /** The raw code. NEVER logged, NEVER audited, NEVER persisted — see link-challenge.ts. ABSENT on
+     *  the DIRECTORY transport, which mints no claimable code at all: the target is asked in their own
+     *  DM instead, so there is nothing for a person to carry between surfaces. */
+    readonly code?: string;
+}
+/**
+ * Issue a proof-of-control challenge from `initiator`'s DM. Sweeps this org's expired challenges
+ * first (the prune-on-write posture every TTL'd table here uses — a serverless deployment has no
+ * reliable cron to hang a sweep on, so the bound has to live on the path that creates the rows).
+ *
+ * The audit row records the challenge id and the initiator, never the code.
+ */
+export declare function issueLinkChallenge(input: {
+    readonly org: string;
+    readonly platform: string;
+    /** WHICH TRANSPORT this request uses (OPE-617, identity/link-flow.ts). Absent ⇒ `"code"`, the
+     *  bearer-code path, which is what every caller before this ticket meant. */
+    readonly transport?: LinkTransport;
+    /** The account the DIRECTORY transport asks. Recorded at ISSUE time — the consent CAS matches
+     *  against it, so a consent from any other account matches no row. Ignored (and refused, see
+     *  below) on the code transport, where the target is unknown until something claims. */
+    readonly target?: LinkedAccount;
+    /** The initiating DM's own workspace (`binding.workspace`). Optional only because a caller may
+     *  genuinely not have one; `linkTenantOf` then resolves the deployment's sole admitted tenant, or
+     *  throws. It is RECORDED on the row rather than re-derived at ratification: the workspace the DM
+     *  came from is a fact of THIS turn, and the ratifying turn can be days later. */
+    readonly tenant?: string;
+    readonly nativeId: string;
+    readonly surfaceKey: string;
+    readonly now?: Date;
+}): Promise<IssuedChallenge>;
+/**
+ * The DIRECTORY transport's act 2: the TARGET consents, in their own DM.
+ *
+ * The whole decision is the store's one CAS (see the store contract): still pending, inside the TTL,
+ * and the consenting account IS the account this challenge named. A consent from anybody else matches
+ * no row and returns null — which is the property this transport rests on, since the initiator picked
+ * the target out of a directory and any other yes would make that pick meaningless.
+ *
+ * 🔴 `consenter` MUST come from the CONSENTING TURN'S OWN BINDING, never from tool input. It is the
+ * whole evidentiary content of a consent: the DM proves control of the account, and the account is
+ * what the challenge named.
+ *
+ * `backCode` is the raw code-2 when the consent step minted one (identity/link-flow.ts
+ * `codeBackDecision`); only its digest is stored, and the raw value is the caller's to show once and
+ * forget.
+ */
+export declare function consentLinkChallenge(input: {
+    readonly org: string;
+    readonly challengeId: string;
+    readonly consenter: LinkedAccount;
+    readonly backCode?: string;
+    readonly now?: Date;
+}): Promise<LinkChallengeRow | null>;
+/**
+ * A code-back was REQUIRED by transport and could not be delivered (OPE-617) — one audit row, so the
+ * downgrade has a reader.
+ *
+ * The consent still stands and the finalizer degrades to the acknowledged ratification. That is a
+ * deliberate fail-soft (identity/link-flow.ts `codeBackDecision` states why), and a fail-soft nobody
+ * can see is indistinguishable from a bug — so the row records which surface had nowhere to put the
+ * code. It lands in the INITIATOR's partition, like the notice row above, because the initiator is
+ * the person whose finalize just became weaker.
+ */
+export declare function auditLinkCodeBackUndeliverable(input: {
+    readonly org: string;
+    readonly challenge: LinkChallengeRow;
+    readonly claimantPlatform: string;
+}): Promise<void>;
+/**
+ * A well-formed `link <code>` line arrived on an UNADDRESSED wake and was refused (OPE-1788) — one
+ * audit row, so a refusal that is otherwise only a console line has a reader.
+ *
+ * The row lands in the CLAIMANT's own partition, because the claimant is the only account this
+ * refusal knows about: the code was never looked up, so there is no challenge and no initiator to
+ * name. That is the point of where the gate sits — the refusal runs before the claim CAS, so the code
+ * is not spent and a code that never existed is indistinguishable from one that did.
+ *
+ * 🔴 THE ROW CARRIES NEITHER THE CODE NOR ITS DIGEST. A link code is a live bearer secret for its
+ * 10-minute life, and the digest is unsalted over a 39-bit value (identity/link-challenge.ts
+ * `hashLinkCode` says why that is right at rest), so a reader of the audit log could brute-force a
+ * digest back to a code well inside the TTL. What an incident reviewer needs is that somebody posted
+ * a claim-shaped line where it could not count, and from which account — never the value.
+ */
+export declare function auditLinkClaimUnaddressed(input: {
+    readonly org: string;
+    readonly platform: string;
+    readonly tenant: string | undefined;
+    readonly nativeId: string;
+    readonly mode: string | undefined;
+}): Promise<void>;
+/**
+ * Claim a challenge as `claimant`. The single-use + TTL decision is the store's one CAS statement,
+ * so a second claimer, a replayed code and an expired code are all the same answer: null.
+ *
+ * 🔴 `claimant` MUST come from the WAKE'S OWN CAPTURED AUTHOR, never from the message that carried
+ * the code. That is the entire evidentiary content of a claim — the code proves the claimer saw the
+ * DM, the captured author proves WHICH account posted it. A caller that passed a self-declared id
+ * would turn this from proof-of-control into an honour system.
+ */
+export declare function claimLinkChallenge(input: {
+    readonly org: string;
+    readonly code: string;
+    readonly claimant: LinkedAccount;
+    /** The raw CODE-BACK (code-2) this claim mints, when one is required and deliverable (OPE-617,
+     *  identity/link-flow.ts). Only its digest is stored, in the SAME CAS — so a claimed row either
+     *  carries its finalize requirement or was never claimed. */
+    readonly backCode?: string;
+    readonly now?: Date;
+}): Promise<LinkChallengeRow | null>;
+/**
+ * The OPEN challenge this account ANSWERED, or undefined when it has none.
+ *
+ * ONE LIVE CODE PER PROOF-OF-CONTROL LOOP (Tommy, 2026-09-19). An answered challenge is a loop that
+ * is half finished: the account that answered still owes the initiator a step. A second code minted
+ * into that same conversation gives the person two live codes and two contradictory instructions,
+ * which is what the S-LINK-SLACK board leg read back on 2026-09-19 — so `link_identity` reads this
+ * before it starts anything (tools/link_identity.ts).
+ *
+ * 🔴 "ANSWERED" IS BOTH DOORS, WHICH IS WHY THIS IS NOT NAMED FOR THE CLAIM. The `claimed_*` triple
+ * is written by `claimLinkChallenge` (the CODE transport's claim) AND by `consentLinkChallenge` (the
+ * DIRECTORY transport's consent) — one column set, two acts, and the store contract says so. Read
+ * `transport` off the returned row before you put words in front of a person: a consenter never
+ * claimed anything.
+ *
+ * 🔴 THE TTL IS COMPARED HERE, NOT LEFT TO THE SWEEP. `expireLinkChallenges` is prune-on-write and
+ * this is a READ, so a row whose TTL has passed can still carry `status = "claimed"`. An expired
+ * answer blocks nothing: its code-back is already dead, and refusing on it would strand the person
+ * with no way to start again.
+ *
+ * 🔴 `account` MUST be the account of the turn that is asking, resolved from its own binding —
+ * never from tool input. The whole question is "is the person in front of me mid-loop", and an id
+ * the caller supplied would answer it about somebody else.
+ */
+export declare function openChallengeAnsweredBy(input: {
+    readonly org: string;
+    readonly account: LinkedAccount;
+    readonly now?: Date;
+}): Promise<LinkChallengeRow | undefined>;
+/**
+ * One audit row when the claim NOTICE could not be delivered, so a person left waiting on a DM that never came is diagnosable. The claim itself still stands and the flow survives a dead notice.
+ * The row lands in the INITIATOR's partition, on their own surface key, and auditErrorDetail truncates and scrubs the provider's refusal text — untrusted text that can echo a token back.
+ */
+export declare function auditLinkNoticeUndeliverable(input: {
+    readonly org: string;
+    readonly challenge: LinkChallengeRow;
+    readonly error: unknown;
+}): Promise<void>;
+/**
+ * A DENY. Terminal, and it writes NOTHING to the link tables — the point of the ratification step is
+ * that a copied code buys an attacker a question in somebody's DM and nothing else. Returns false
+ * when the challenge was not in one of `from` (already decided, expired, unknown).
+ *
+ * TWO PEOPLE MAY DENY, and `from` is which of them is calling (OPE-617). The INITIATOR denies a
+ * consent that already landed (`claimed`, the default). The TARGET of a directory request denies
+ * BEFORE consenting (`pending`) — "I do not recognise that person" is the answer this whole transport
+ * is built to make easy, and it has to be reachable from the side that was asked. Both write nothing,
+ * so neither needs a TTL conjunct.
+ */
+export declare function denyLinkChallenge(input: {
+    readonly org: string;
+    readonly challengeId: string;
+    readonly from?: readonly LinkChallengeStatus[];
+    readonly now?: Date;
+}): Promise<boolean>;
+/**
+ * The initiator's CONFIRM — the one path that creates a confirmed link from a challenge.
+ *
+ * Order matters and is chosen to fail in the safe direction: the challenge is CAS'd to `ratified`
+ * FIRST, so a double-confirm loses the race and cannot produce two joins; only then is the link
+ * written. A crash between the two leaves a ratified challenge and no link — recoverable by
+ * re-running the flow, and strictly better than a link with no challenge to account for it.
+ *
+ * Both accounts are joined: the initiator's own id is confirmed into the set alongside the
+ * claimant's, because the DM that issued the challenge is itself proof of control of that account.
+ */
+export declare function ratifyLinkChallenge(input: {
+    readonly org: string;
+    readonly challengeId: string;
+    /** Display handle for a set created by this ratification. DISPLAY ONLY (invariant 4). */
+    readonly handle: string;
+    readonly now?: Date;
+}): Promise<LinkWriteResult>;
+/**
+ * Get-or-create the link-set a directory sync will hang a person's suggestions on (P2.3). The ONE
+ * place a set is created outside the challenge flow, and it lives here for the same reason
+ * everything else does: this module is the only writer over these tables.
+ *
+ * 🔴 READ-THEN-CREATE, NEVER UPSERT. `store.putLinkSet` is an upsert on (org, id) that would
+ * overwrite `status` — so calling it unconditionally would RESURRECT a suspended or revoked set
+ * on the next sync, quietly reversing an admin's offboarding. So an existing set is returned
+ * UNTOUCHED, whatever its status, and the caller decides (the planner refuses to widen into a set
+ * that is not `active`; invariant 3 keeps `revoked` terminal).
+ *
+ * CONCURRENCY: `linkSetId` is expected to be DETERMINISTIC in the caller (directory-sync.ts derives
+ * it from the provider + the IdP's user id), so two syncs racing here both compute the same id and
+ * write the same `active` row — the upsert makes the loser's write a no-op in content. A random id
+ * per run would instead produce two half-populated sets for one person, which is precisely the
+ * failure mode this contract exists to remove.
+ */
+export declare function ensureLinkSet(input: {
+    readonly org: string;
+    readonly linkSetId: string;
+    /** Display handle for a set created here. DISPLAY ONLY (invariant 4) — never a lookup key. */
+    readonly handle: string;
+    readonly now?: Date;
+}): Promise<{
+    readonly set: LinkSetRow;
+    readonly created: boolean;
+}>;
+/**
+ * Record a SUGGESTED account — a directory sync's proposal, which is NOT yet a link: `suggested`
+ * rows are invisible to `resolveLinkSet` and `expandLinkSet`, so nothing about attribution changes
+ * until a person confirms. It still takes the (org, platform, nativeId) PK, which is deliberate:
+ * a suggestion that collided with a proven link would be a bad merge waiting to be confirmed, so
+ * the collision is refused at suggestion time rather than at confirmation time.
+ */
+export declare function suggestLinkedId(input: {
+    readonly org: string;
+    readonly linkSetId: string;
+    readonly account: LinkedAccount;
+    readonly evidence: LinkEvidence;
+    readonly now?: Date;
+}): Promise<LinkWriteResult>;
+/**
+ * `suggested` → `confirmed`, and ONLY with evidence (invariant 2) — the entry point P2's one-tap
+ * DM confirmation uses. The evidence a caller passes must be the thing that actually convinced the
+ * system: a DM tap records the `challenge` it degenerately is, an EMU-grade auto-confirm records
+ * the `directory-sync` attestation. There is no evidence-free confirm, on purpose.
+ */
+export declare function confirmLinkedId(input: {
+    readonly org: string;
+    readonly account: LinkedAccount;
+    readonly evidence: LinkEvidence;
+    readonly now?: Date;
+}): Promise<LinkWriteResult>;
+/**
+ * Sever one account from `actor`'s OWN link-set — the person's unilateral off switch.
+ *
+ * THE RULE, stated because it is a choice and not an obvious one: a caller may remove ANY account
+ * from THEIR OWN set, not only the one they are speaking from. It is their set — every id in it is
+ * an account they proved control of — and the narrower rule ("your current account only") has a
+ * nasty failure: someone who loses access to their GitHub account could never remove it, which is
+ * precisely when they most want to. Removing an id from SOMEBODY ELSE'S set is refused; that is an
+ * admin act (`revoke_link_set`).
+ *
+ * A sever DELETES the row rather than tombstoning it, so the account is joinable again — unlink,
+ * then re-link, works. Admin REVOCATION tombstones instead, and that asymmetry is the point:
+ * offboarding must not leave an account quietly re-claimable.
+ *
+ * It also PURGES the severed account's own stored credentials (OPE-300 G3) — see the call site.
+ * Re-linking is unaffected; the person simply re-consents, which is the same thing they would do on
+ * a fresh account.
+ */
+export declare function unlinkOwnId(input: {
+    readonly org: string;
+    readonly actor: LinkedAccount;
+    /** The account to remove; defaults to the actor's own. Must be in the actor's link-set. */
+    readonly target?: LinkedAccount;
+    readonly now?: Date;
+}): Promise<LinkWriteResult>;
+/**
+ * Suspend / reactivate a link-set — the reversible hold (P1.4, and P2's deprovision landing spot).
+ * A suspended set resolves to NOTHING (`resolveLinkSet` requires `active`), so attribution degrades
+ * to per-surface identity while it is held. `revoked` is not reachable from here — that is
+ * {@link revokeLinkSet}, and keeping the terminal act in its own function is what stops it being
+ * reached by passing a different string.
+ */
+export declare function setLinkSetHold(input: {
+    readonly org: string;
+    readonly linkSetId: string;
+    readonly hold: "suspended" | "active";
+    readonly actor: string;
+    readonly now?: Date;
+}): Promise<LinkWriteResult>;
+/**
+ * REVOKE a link-set — TERMINAL, and the offboarding lever. Tombstones every id in the set (they
+ * keep their rows, so those accounts cannot be re-linked by a challenge), closes the set, and then
+ * PURGES the credentials the set's shared vault subject holds. There is deliberately no inverse: a
+ * mistake here is repaired by building a new set through the ordinary challenge flow with fresh
+ * accounts, not by un-revoking, because "this person no longer has standing" is exactly the
+ * statement that must not be quietly reversible.
+ *
+ * ORDER IS LOAD-BEARING: tombstone FIRST, purge SECOND. The tombstone is what severs reachability
+ * and it is the part that must be durable; the purge is best-effort on top (see below). Reversing
+ * them would open a window where the credentials are gone but the set still resolves — a person who
+ * is still standing with a connection that now silently fails.
+ */
+export declare function revokeLinkSet(input: {
+    readonly org: string;
+    readonly linkSetId: string;
+    readonly actor: string;
+    readonly now?: Date;
+}): Promise<LinkWriteResult>;
+/**
+ * The STANDALONE credential purge for a link-set (OPE-287) — the repair lever behind the
+ * `purge_link_set_credentials` control verb, for sets revoked before the purge-on-revoke existed
+ * and for a suspected compromise where an admin wants the token dead without spending the terminal
+ * revoke.
+ *
+ * Deliberately reachable on a set in ANY status, not only `revoked`. A purge is unconditionally
+ * NARROWING — it destroys authority and grants none — and the alternative (revoked-only) would push
+ * an admin who suspects a compromised token into an irreversible offboarding just to kill it. The
+ * one thing it insists on is that the set EXISTS, so a typo'd id is a refusal rather than a
+ * cheerful "0 purged".
+ *
+ * Unlike the on-revoke path this one does NOT swallow a failure into a note: an admin who asked for
+ * a purge and got none must be told, so the write result is `ok: false` when the hook failed.
+ */
+export declare function purgeLinkSetCredentials(input: {
+    readonly org: string;
+    readonly linkSetId: string;
+    readonly actor: string;
+}): Promise<LinkWriteResult & {
+    readonly purged?: number;
+}>;
+//# sourceMappingURL=link-store.d.ts.map

package/dist/agent/identity/link-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-store.d.ts","sourceRoot":"","sources":["../../../agent/identity/link-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC7I,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAE9G;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzD;IACE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;4EAEwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAeN;;6CAE6C;AAC7C,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;qFAGqF;AACrF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAoBD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAWxI;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAMrG;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAkBlG;AAED;;+EAE+E;AAC/E,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS;IAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,WAAW,EAAE,CAAA;CAAE,EAAE,CAAC,CAK7I;AAED;iFACiF;AACjF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC;;kFAE8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;iFAC6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;4FAEwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC;;;sFAGkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuC3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAwBnC;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5K;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC;;iEAE6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAkBnC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAUxC;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhK;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB,GAAG,OAAO,CAAC,OAAO,CAAC,CAYnB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB,GAAG,OAAO,CAAC,eAAe,CAAC,CAsF3B;AAuBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB,GAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CASnE;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwB3B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmB3B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwC3B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB,GAAG,OAAO,CAAC,eAAe,CAAC,CAU3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAwBtK;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,GAAG;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAa1L"}