@rubytech/create-maxy-code 0.1.353 → 0.1.355

package/payload/platform/lib/admins-write/__tests__/index.test.ts

@@ -0,0 +1,182 @@
+import { describe, it, expect } from 'vitest'
+import { mkdtempSync, writeFileSync, readFileSync, existsSync, mkdirSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import {
+  writeAdminEntry,
+  removeAdminFromAccount,
+  computeAdminStoreDivergence,
+  logUsersAudit,
+  formatAuditRowIds,
+} from '../src/index'
+
+interface Fixture {
+  usersFile: string
+  accountDir: string
+  accountsDir: string
+  logFile: string
+}
+
+/** One account under accountsDir/<id>/account.json plus the persistent users.json. */
+function fixture(opts: {
+  users: Array<{ userId: string; pin?: string }>
+  admins: Array<{ userId: string; role: 'owner' | 'admin' }>
+  accountId?: string
+}): Fixture {
+  const root = mkdtempSync(join(tmpdir(), 'admw-'))
+  const accountsDir = join(root, 'accounts')
+  const accountId = opts.accountId ?? 'acct0001'
+  const accountDir = join(accountsDir, accountId)
+  mkdirSync(accountDir, { recursive: true })
+  const usersFile = join(root, 'users.json')
+  writeFileSync(usersFile, JSON.stringify(opts.users.map(u => ({ pin: 'p', ...u })), null, 2) + '\n')
+  writeFileSync(join(accountDir, 'account.json'), JSON.stringify({ accountId, admins: opts.admins }, null, 2) + '\n')
+  return { usersFile, accountDir, accountsDir, logFile: join(root, 'users-audit.log') }
+}
+
+function readAudit(logFile: string): string[] {
+  if (!existsSync(logFile)) return []
+  return readFileSync(logFile, 'utf-8').trim().split('\n').filter(Boolean)
+}
+
+function accountAdmins(accountDir: string): string[] {
+  const cfg = JSON.parse(readFileSync(join(accountDir, 'account.json'), 'utf-8'))
+  return (cfg.admins as Array<{ userId: string }>).map(a => a.userId)
+}
+
+describe('admins-write — users-audit emission', () => {
+  it('writeAdminEntry on a NEW userId emits action=add field=row with the grown row-set', () => {
+    const f = fixture({ users: [{ userId: 'aaaaaaaa-1' }], admins: [{ userId: 'aaaaaaaa-1', role: 'owner' }] })
+    writeAdminEntry({
+      userId: 'bbbbbbbb-2', pin: 'hash', role: 'admin',
+      usersFile: f.usersFile, accountDir: f.accountDir, caller: 'admin-add',
+      audit: { actor: 'aaaaaaaa-1', logFile: f.logFile },
+    })
+    const lines = readAudit(f.logFile)
+    expect(lines).toHaveLength(1)
+    expect(lines[0]).toContain('action=add')
+    expect(lines[0]).toContain('field=row')
+    expect(lines[0]).toContain('actor=aaaaaaaa')
+    expect(lines[0]).toContain('rowsBefore=aaaaaaaa')
+    expect(lines[0]).toContain('rowsAfter=aaaaaaaa,bbbbbbbb')
+  })
+
+  it('writeAdminEntry on an EXISTING userId emits action=set-pin field=pin with an unchanged row-set', () => {
+    const f = fixture({
+      users: [{ userId: 'aaaaaaaa-1' }, { userId: 'bbbbbbbb-2' }],
+      admins: [{ userId: 'aaaaaaaa-1', role: 'owner' }, { userId: 'bbbbbbbb-2', role: 'admin' }],
+    })
+    writeAdminEntry({
+      userId: 'bbbbbbbb-2', pin: 'newhash', role: 'admin',
+      usersFile: f.usersFile, accountDir: f.accountDir, caller: 'admin-update-pin',
+      audit: { actor: 'bbbbbbbb-2', session: 'dddddddd-7', logFile: f.logFile },
+    })
+    const lines = readAudit(f.logFile)
+    expect(lines).toHaveLength(1)
+    expect(lines[0]).toContain('action=set-pin')
+    expect(lines[0]).toContain('field=pin')
+    expect(lines[0]).toContain('session=dddddddd')
+    expect(lines[0]).toContain('rowsBefore=aaaaaaaa,bbbbbbbb')
+    expect(lines[0]).toContain('rowsAfter=aaaaaaaa,bbbbbbbb')
+  })
+
+  it('removeAdminFromAccount on a present admin emits action=remove field=row on the account set', () => {
+    const f = fixture({
+      users: [{ userId: 'aaaaaaaa-1' }, { userId: 'bbbbbbbb-2' }],
+      admins: [{ userId: 'aaaaaaaa-1', role: 'owner' }, { userId: 'bbbbbbbb-2', role: 'admin' }],
+    })
+    removeAdminFromAccount({
+      userId: 'bbbbbbbb-2', accountDir: f.accountDir, caller: 'admin-remove',
+      audit: { actor: 'aaaaaaaa-1', logFile: f.logFile },
+    })
+    const lines = readAudit(f.logFile)
+    expect(lines).toHaveLength(1)
+    expect(lines[0]).toContain('action=remove')
+    expect(lines[0]).toContain('field=row')
+    expect(lines[0]).toContain('rowsBefore=aaaaaaaa,bbbbbbbb')
+    expect(lines[0]).toContain('rowsAfter=aaaaaaaa')
+    expect(accountAdmins(f.accountDir)).toEqual(['aaaaaaaa-1'])
+  })
+
+  it('removeAdminFromAccount on an absent admin is a noop and emits nothing', () => {
+    const f = fixture({ users: [{ userId: 'aaaaaaaa-1' }], admins: [{ userId: 'aaaaaaaa-1', role: 'owner' }] })
+    removeAdminFromAccount({
+      userId: 'zzzzzzzz-9', accountDir: f.accountDir, caller: 'admin-remove',
+      audit: { actor: 'aaaaaaaa-1', logFile: f.logFile },
+    })
+    expect(readAudit(f.logFile)).toHaveLength(0)
+  })
+})
+
+describe('admins-write — public audit helper (for direct users.json writers)', () => {
+  it('formatAuditRowIds joins 8-char short ids', () => {
+    expect(formatAuditRowIds(['aaaaaaaa-1', 'bbbbbbbb-2'])).toBe('aaaaaaaa,bbbbbbbb')
+  })
+
+  it('logUsersAudit writes one canonical set-pin line', () => {
+    const root = mkdtempSync(join(tmpdir(), 'admwlog-'))
+    const logFile = join(root, 'users-audit.log')
+    logUsersAudit(
+      { actor: 'cccccccc-9', session: 'dddddddd-7', logFile },
+      { action: 'set-pin', field: 'pin', rowsBefore: 'aaaaaaaa', rowsAfter: 'aaaaaaaa' },
+    )
+    const lines = readAudit(logFile)
+    expect(lines).toHaveLength(1)
+    expect(lines[0]).toContain('action=set-pin')
+    expect(lines[0]).toContain('field=pin')
+    expect(lines[0]).toContain('actor=cccccccc')
+    expect(lines[0]).toContain('session=dddddddd')
+  })
+})
+
+describe('admins-write — computeAdminStoreDivergence', () => {
+  it('flags an admin in account.json with no users.json row (the incident shape)', () => {
+    const f = fixture({
+      users: [{ userId: 'aaaaaaaa-1' }],
+      admins: [{ userId: 'aaaaaaaa-1', role: 'owner' }, { userId: 'bbbbbbbb-2', role: 'admin' }],
+    })
+    const r = computeAdminStoreDivergence({ usersFile: f.usersFile, accountsDir: f.accountsDir })
+    expect(r.divergences).toBe(1)
+    expect(r.accountWithoutUsers.map(x => x.userId)).toEqual(['bbbbbbbb-2'])
+    expect(r.usersWithoutAccount).toEqual([])
+  })
+
+  it('flags a users.json row no account.json references', () => {
+    const f = fixture({
+      users: [{ userId: 'aaaaaaaa-1' }, { userId: 'cccccccc-3' }],
+      admins: [{ userId: 'aaaaaaaa-1', role: 'owner' }],
+    })
+    const r = computeAdminStoreDivergence({ usersFile: f.usersFile, accountsDir: f.accountsDir })
+    expect(r.divergences).toBe(1)
+    expect(r.usersWithoutAccount.map(x => x.userId)).toEqual(['cccccccc-3'])
+    expect(r.accountWithoutUsers).toEqual([])
+  })
+
+  it('clean parity → zero divergences', () => {
+    const f = fixture({
+      users: [{ userId: 'aaaaaaaa-1' }, { userId: 'bbbbbbbb-2' }],
+      admins: [{ userId: 'aaaaaaaa-1', role: 'owner' }, { userId: 'bbbbbbbb-2', role: 'admin' }],
+    })
+    const r = computeAdminStoreDivergence({ usersFile: f.usersFile, accountsDir: f.accountsDir })
+    expect(r.divergences).toBe(0)
+  })
+
+  it('an audited remove of the diverging row clears the account-side mismatch', () => {
+    const f = fixture({
+      users: [{ userId: 'aaaaaaaa-1' }],
+      admins: [{ userId: 'aaaaaaaa-1', role: 'owner' }, { userId: 'bbbbbbbb-2', role: 'admin' }],
+    })
+    // account-without-users divergence present
+    expect(computeAdminStoreDivergence({ usersFile: f.usersFile, accountsDir: f.accountsDir }).divergences).toBe(1)
+    // audited delete of the orphan account row
+    removeAdminFromAccount({
+      userId: 'bbbbbbbb-2', accountDir: f.accountDir, caller: 'admin-remove',
+      audit: { actor: 'aaaaaaaa-1', logFile: f.logFile },
+    })
+    expect(readAudit(f.logFile)[0]).toContain('action=remove')
+    expect(readAudit(f.logFile)[0]).toContain('actor=aaaaaaaa')
+    // account no longer lists it → parity restored
+    expect(computeAdminStoreDivergence({ usersFile: f.usersFile, accountsDir: f.accountsDir }).divergences).toBe(0)
+    void dirname
+  })
+})

package/payload/platform/lib/admins-write/dist/index.d.ts

@@ -2,6 +2,34 @@ export interface UserEntry {
     userId: string;
     pin: string;
 }
+/**
+ * Identity + destination for one credential-store audit line. The writer is
+ * pure (it only knows the file paths); the caller is the only party that knows
+ * WHO is acting and WHERE the audit log lives, so it is threaded in. `actor` is
+ * an admin userId or a non-user sentinel (`onboarding` | `install` | `boot` |
+ * `unknown` when an MCP caller has no resolvable USER_ID); `session` is the
+ * spawning agent session (SESSION_NODE_ID) when one drove the write. `logFile`
+ * is the absolute path to the append-only users-audit log, distinct from
+ * server.log. Mirrored in platform/lib/admin-access-password.
+ */
+export interface AuditContext {
+    actor: string;
+    session?: string;
+    logFile: string;
+}
+/** Format a userId list as the comma-joined short-id set used in audit lines.
+ *  Exported for direct users.json writers that do not route through
+ *  writeAdminEntry (the MCP admin-update-pin path). */
+export declare function formatAuditRowIds(userIds: string[]): string;
+/** Public wrapper so a direct users.json writer that cannot route through
+ *  writeAdminEntry (the MCP admin-update-pin path) still emits the one
+ *  canonical `[users-audit]` line, keeping every write covered. */
+export declare function logUsersAudit(audit: AuditContext, fields: {
+    action: string;
+    field: string;
+    rowsBefore: string;
+    rowsAfter: string;
+}): void;
 export interface AdminEntry {
     userId: string;
     role: "owner" | "admin";
@@ -13,6 +41,7 @@ export interface AdminWriteInput {
     usersFile: string;
     accountDir: string;
     caller: string;
+    audit: AuditContext;
 }
 export interface AdminWriteResult {
     usersJsonResult: "ok" | "fail" | "noop";
@@ -36,6 +65,7 @@ export interface AdminRemoveInput {
     userId: string;
     accountDir: string;
     caller: string;
+    audit: AuditContext;
 }
 export interface AdminRemoveResult {
     accountJsonResult: "ok" | "fail" | "noop";
@@ -68,19 +98,43 @@ export interface InvariantCheckResult {
         userId: string;
     }>;
 }
+/** Pure divergence computation — read faults collected, never logged. */
+export interface DivergenceResult {
+    divergences: number;
+    /** Userids in account.json admins[] that have no row in users.json. */
+    accountWithoutUsers: Array<{
+        userId: string;
+        source: string;
+    }>;
+    /** Userids in users.json that no account.json admins[] references. */
+    usersWithoutAccount: Array<{
+        userId: string;
+    }>;
+    /** Read faults encountered during the walk (unreadable users/account file). */
+    errors: Array<{
+        source: string;
+        detail: string;
+    }>;
+}
 /**
  * Walk every account.json under accountsDir and compare its admins[] to
- * users.json. Emits one log line per divergence and one summary line.
- *
- * Behaviour: log-only — does NOT throw, does NOT refuse boot or install.
- * Pre-Task-904 installs that already diverged would otherwise brick on the
- * first boot of a Task-904 device. The summary line `divergences=<n>` is
- * always emitted (wired-up assertion); per-divergence lines fire only when
- * divergences > 0. Operators grep `[install-invariant]` or `[admin-invariant]`
- * to detect the regression class without reading every install log.
- *
- * Promotion to refuse-or-degrade is a future sprint; capture as a TODO once
- * the deployed fleet has been audited clean.
+ * users.json. PURE: returns the divergence sets and any read faults; does no
+ * logging and never throws. Shared by `checkAdminAuthInvariant` (the
+ * `[admin-invariant]` boot one-shot) and the `[users-reconcile]` standing tick
+ * so the two never disagree on the predicate. An absent users.json or accounts
+ * dir is a legitimate first-boot state → empty set, not a fault.
+ */
+export declare function computeAdminStoreDivergence(input: {
+    usersFile: string;
+    accountsDir: string;
+}): DivergenceResult;
+/**
+ * `[admin-invariant]` / `[install-invariant]` boot one-shot. Wraps the pure
+ * `computeAdminStoreDivergence` and emits the documented grep lines:
+ * `direction=…`, the per-fault unreadable line, and the always-emitted
+ * `check complete divergences=<n>` summary. Log-only — does NOT throw, does NOT
+ * refuse boot or install. The recurring standing check is the separate
+ * `[users-reconcile]` tick in the admin server boot.
  */
 export declare function checkAdminAuthInvariant(input: InvariantCheckInput): InvariantCheckResult;
 //# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/admins-write/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACxC,iBAAiB,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAmBD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAyDxE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,iBAAiB,CA+BjF;AAED,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,GAAG,EAAE,mBAAmB,GAAG,iBAAiB,CAAC;CAC9C;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,mBAAmB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,sEAAsE;IACtE,mBAAmB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,GAAG,oBAAoB,CAsFxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD;;uDAEuD;AACvD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAE3D;AA6BD;;mEAEmE;AACnE,wBAAgB,aAAa,CAC3B,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/E,IAAI,CAEN;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACxC,iBAAiB,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAmBD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAiExE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,iBAAiB,CAuCjF;AAED,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,GAAG,EAAE,mBAAmB,GAAG,iBAAiB,CAAC;CAC9C;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,mBAAmB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,sEAAsE;IACtE,mBAAmB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,mBAAmB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,sEAAsE;IACtE,mBAAmB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,MAAM,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAoE/G;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,GAAG,oBAAoB,CAiBxF"}

package/payload/platform/lib/admins-write/dist/index.js

@@ -20,11 +20,51 @@
 // returns is_error: true with the [admins-write] line; set-pin returns 500
 // with the same). Same trust model as the [admin-auth-store] pair.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatAuditRowIds = formatAuditRowIds;
+exports.logUsersAudit = logUsersAudit;
 exports.writeAdminEntry = writeAdminEntry;
 exports.removeAdminFromAccount = removeAdminFromAccount;
+exports.computeAdminStoreDivergence = computeAdminStoreDivergence;
 exports.checkAdminAuthInvariant = checkAdminAuthInvariant;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+/** First 8 chars — the short-id convention used across the auth logs. */
+function id8(value) {
+    return value.slice(0, 8);
+}
+/** Format a userId list as the comma-joined short-id set used in audit lines.
+ *  Exported for direct users.json writers that do not route through
+ *  writeAdminEntry (the MCP admin-update-pin path). */
+function formatAuditRowIds(userIds) {
+    return userIds.map(id8).join(",");
+}
+/**
+ * Append one canonical `[users-audit]` line. Append failures never propagate —
+ * an audit-write fault must not break the credential write it records; the
+ * fault is surfaced once on stderr instead.
+ */
+function appendUsersAuditLine(audit, fields) {
+    const sess = audit.session ? ` session=${id8(audit.session)}` : "";
+    // userIds are uuids (shortened to id8); sentinels (boot|install|onboarding|
+    // unknown) carry no dash and are written whole so attribution stays readable.
+    const actor = audit.actor.includes("-") ? id8(audit.actor) : audit.actor;
+    const line = `[users-audit] action=${fields.action} actor=${actor}${sess} ` +
+        `field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ` +
+        `ts=${new Date().toISOString()}\n`;
+    try {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(audit.logFile), { recursive: true, mode: 0o700 });
+        (0, node_fs_1.appendFileSync)(audit.logFile, line, { mode: 0o600 });
+    }
+    catch (err) {
+        console.error(`[users-audit] op=write-failed logFile=${audit.logFile} error=${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/** Public wrapper so a direct users.json writer that cannot route through
+ *  writeAdminEntry (the MCP admin-update-pin path) still emits the one
+ *  canonical `[users-audit]` line, keeping every write covered. */
+function logUsersAudit(audit, fields) {
+    appendUsersAuditLine(audit, fields);
+}
 function logLine(input, result) {
     const userIdShort = input.userId.slice(0, 8);
     console.error(`[admins-write] caller=${input.caller} userId=${userIdShort} ` +
@@ -64,6 +104,7 @@ function writeAdminEntry(input) {
                 users = parsed;
             }
         }
+        const rowsBefore = users.map(u => id8(u.userId)).join(",");
         const existing = users.findIndex(u => u.userId === input.userId);
         if (existing === -1) {
             users.push({ userId: input.userId, pin: input.pin });
@@ -74,6 +115,13 @@ function writeAdminEntry(input) {
         }
         writeFileAtomic(input.usersFile, JSON.stringify(users, null, 2) + "\n", 0o600);
         result.usersJsonResult = "ok";
+        // A new userId is a row add; an existing userId is a pin rotation.
+        appendUsersAuditLine(input.audit, {
+            action: existing === -1 ? "add" : "set-pin",
+            field: existing === -1 ? "row" : "pin",
+            rowsBefore,
+            rowsAfter: users.map(u => id8(u.userId)).join(","),
+        });
     }
     catch (err) {
         result.usersJsonResult = "fail";
@@ -122,6 +170,7 @@ function removeAdminFromAccount(input) {
         }
         const config = JSON.parse((0, node_fs_1.readFileSync)(accountJsonPath, "utf-8"));
         const admins = (config.admins ?? []);
+        const rowsBefore = admins.map(a => id8(a.userId)).join(",");
         const targetIndex = admins.findIndex(a => a.userId === input.userId);
         if (targetIndex === -1) {
             result.accountJsonResult = "noop";
@@ -131,6 +180,13 @@ function removeAdminFromAccount(input) {
             config.admins = admins;
             writeFileAtomic(accountJsonPath, JSON.stringify(config, null, 2) + "\n");
             result.accountJsonResult = "ok";
+            // Removal touches account.json admins[] only; the row-set is that store's.
+            appendUsersAuditLine(input.audit, {
+                action: "remove",
+                field: "row",
+                rowsBefore,
+                rowsAfter: admins.map(a => id8(a.userId)).join(","),
+            });
         }
     }
     catch (err) {
@@ -144,26 +200,15 @@ function removeAdminFromAccount(input) {
 }
 /**
  * Walk every account.json under accountsDir and compare its admins[] to
- * users.json. Emits one log line per divergence and one summary line.
- *
- * Behaviour: log-only — does NOT throw, does NOT refuse boot or install.
- * Pre-Task-904 installs that already diverged would otherwise brick on the
- * first boot of a Task-904 device. The summary line `divergences=<n>` is
- * always emitted (wired-up assertion); per-divergence lines fire only when
- * divergences > 0. Operators grep `[install-invariant]` or `[admin-invariant]`
- * to detect the regression class without reading every install log.
- *
- * Promotion to refuse-or-degrade is a future sprint; capture as a TODO once
- * the deployed fleet has been audited clean.
+ * users.json. PURE: returns the divergence sets and any read faults; does no
+ * logging and never throws. Shared by `checkAdminAuthInvariant` (the
+ * `[admin-invariant]` boot one-shot) and the `[users-reconcile]` standing tick
+ * so the two never disagree on the predicate. An absent users.json or accounts
+ * dir is a legitimate first-boot state → empty set, not a fault.
  */
-function checkAdminAuthInvariant(input) {
-    const result = {
-        divergences: 0,
-        accountWithoutUsers: [],
-        usersWithoutAccount: [],
-    };
-    // Read users.json userIds (persistent file). Absent file == empty set; do
-    // not abort — first-boot before set-pin has run is a legitimate state.
+function computeAdminStoreDivergence(input) {
+    const result = { divergences: 0, accountWithoutUsers: [], usersWithoutAccount: [], errors: [] };
+    // Read users.json userIds (persistent file). Absent file == empty set.
     const usersUserIds = new Set();
     if ((0, node_fs_1.existsSync)(input.usersFile)) {
         try {
@@ -177,8 +222,7 @@ function checkAdminAuthInvariant(input) {
             }
         }
         catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            console.error(`[${input.tag}] users.json unreadable usersFile=${input.usersFile} error=${msg}`);
+            result.errors.push({ source: input.usersFile, detail: err instanceof Error ? err.message : String(err) });
         }
     }
     // Walk account dirs. Skip dotfiles (.trash/) and missing account.json.
@@ -189,9 +233,7 @@ function checkAdminAuthInvariant(input) {
             entries = (0, node_fs_1.readdirSync)(input.accountsDir);
         }
         catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            console.error(`[${input.tag}] accounts-dir unreadable accountsDir=${input.accountsDir} error=${msg}`);
-            console.error(`[${input.tag}] check complete divergences=0 (accounts-dir unreadable)`);
+            result.errors.push({ source: input.accountsDir, detail: err instanceof Error ? err.message : String(err) });
             return result;
         }
         for (const entry of entries) {
@@ -214,8 +256,7 @@ function checkAdminAuthInvariant(input) {
                 admins = (config.admins ?? []);
             }
             catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                console.error(`[${input.tag}] account.json unreadable source=${accountJsonPath} error=${msg}`);
+                result.errors.push({ source: accountJsonPath, detail: err instanceof Error ? err.message : String(err) });
                 continue;
             }
             for (const a of admins) {
@@ -223,8 +264,6 @@ function checkAdminAuthInvariant(input) {
                     continue;
                 accountUserIds.add(a.userId);
                 if (!usersUserIds.has(a.userId)) {
-                    const userIdShort = a.userId.slice(0, 8);
-                    console.error(`[${input.tag}] direction=account-without-users userId=${userIdShort} source=${accountJsonPath}`);
                     result.accountWithoutUsers.push({ userId: a.userId, source: accountJsonPath });
                     result.divergences += 1;
                 }
@@ -233,13 +272,36 @@ function checkAdminAuthInvariant(input) {
     }
     for (const uid of usersUserIds) {
         if (!accountUserIds.has(uid)) {
-            const userIdShort = uid.slice(0, 8);
-            console.error(`[${input.tag}] direction=users-without-account userId=${userIdShort} source=${input.usersFile}`);
             result.usersWithoutAccount.push({ userId: uid });
             result.divergences += 1;
         }
     }
-    console.error(`[${input.tag}] check complete divergences=${result.divergences}`);
     return result;
 }
+/**
+ * `[admin-invariant]` / `[install-invariant]` boot one-shot. Wraps the pure
+ * `computeAdminStoreDivergence` and emits the documented grep lines:
+ * `direction=…`, the per-fault unreadable line, and the always-emitted
+ * `check complete divergences=<n>` summary. Log-only — does NOT throw, does NOT
+ * refuse boot or install. The recurring standing check is the separate
+ * `[users-reconcile]` tick in the admin server boot.
+ */
+function checkAdminAuthInvariant(input) {
+    const d = computeAdminStoreDivergence({ usersFile: input.usersFile, accountsDir: input.accountsDir });
+    for (const e of d.errors) {
+        console.error(`[${input.tag}] unreadable source=${e.source} error=${e.detail}`);
+    }
+    for (const a of d.accountWithoutUsers) {
+        console.error(`[${input.tag}] direction=account-without-users userId=${a.userId.slice(0, 8)} source=${a.source}`);
+    }
+    for (const u of d.usersWithoutAccount) {
+        console.error(`[${input.tag}] direction=users-without-account userId=${u.userId.slice(0, 8)} source=${input.usersFile}`);
+    }
+    console.error(`[${input.tag}] check complete divergences=${d.divergences}`);
+    return {
+        divergences: d.divergences,
+        accountWithoutUsers: d.accountWithoutUsers,
+        usersWithoutAccount: d.usersWithoutAccount,
+    };
+}
 //# sourceMappingURL=index.js.map

package/payload/platform/lib/admins-write/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,iEAAiE;AACjE,wEAAwE;AACxE,EAAE;AACF,oDAAoD;AACpD,+DAA+D;AAC/D,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,qBAAqB;AACrB,EAAE;AACF,kEAAkE;AAClE,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;;AA2DnE,0CAyDC;AAmBD,wDA+BC;AAiCD,0DAsFC;AA3RD,qCAAgH;AAChH,yCAA0C;AA4B1C,SAAS,OAAO,CAAC,KAAsB,EAAE,MAAwB;IAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,KAAK,CACX,yBAAyB,KAAK,CAAC,MAAM,WAAW,WAAW,GAAG;QAC5D,mBAAmB,MAAM,CAAC,eAAe,sBAAsB,MAAM,CAAC,iBAAiB,EAAE;QACzF,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,QAAgB,EAAE,IAAa;IACxE,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAChE,IAAA,uBAAa,EAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAA,oBAAU,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,KAAsB;IACpD,MAAM,MAAM,GAAqB,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAExF,gDAAgD;IAChD,IAAI,CAAC;QACH,IAAI,KAAK,GAAgB,EAAE,CAAC;QAC5B,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAChD,CAAC;gBACD,KAAK,GAAG,MAAqB,CAAC;YAChC,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QAC3D,CAAC;QAED,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/E,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC;QAChC,MAAM,CAAC,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAA,oBAAU,EAAC,eAAe,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,OAAO,CAAC,CAA4B,CAAC;QAC7F,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAClC,MAAM,CAAC,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAaD;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,KAAuB;IAC5D,MAAM,MAAM,GAAsB,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAChE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAA,oBAAU,EAAC,eAAe,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,OAAO,CAAC,CAA4B,CAAC;QAC7F,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;QACrD,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAClC,MAAM,CAAC,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,KAAK,CACX,yBAAyB,KAAK,CAAC,MAAM,WAAW,WAAW,GAAG;QAC5D,0CAA0C,MAAM,CAAC,iBAAiB,EAAE;QACpE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAmBD;;;;;;;;;;;;;GAaG;AACH,SAAgB,uBAAuB,CAAC,KAA0B;IAChE,MAAM,MAAM,GAAyB;QACnC,WAAW,EAAE,CAAC;QACd,mBAAmB,EAAE,EAAE;QACvB,mBAAmB,EAAE,EAAE;KACxB,CAAC;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;gBAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;wBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,qCAAqC,KAAK,CAAC,SAAS,UAAU,GAAG,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,IAAA,qBAAW,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,yCAAyC,KAAK,CAAC,WAAW,UAAU,GAAG,EAAE,CAAC,CAAC;YACtG,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,0DAA0D,CAAC,CAAC;YACvF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC;gBACH,IAAI,CAAC,IAAA,kBAAQ,EAAC,UAAU,CAAC,CAAC,WAAW,EAAE;oBAAE,SAAS;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YACzD,IAAI,CAAC,IAAA,oBAAU,EAAC,eAAe,CAAC;gBAAE,SAAS;YAC3C,IAAI,MAAM,GAAiB,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,OAAO,CAAC,CAA4B,CAAC;gBAC7F,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;YACjD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,oCAAoC,eAAe,UAAU,GAAG,EAAE,CAAC,CAAC;gBAC/F,SAAS;YACX,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;oBAAE,SAAS;gBAC3C,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC7B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,OAAO,CAAC,KAAK,CACX,IAAI,KAAK,CAAC,GAAG,4CAA4C,WAAW,WAAW,eAAe,EAAE,CACjG,CAAC;oBACF,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC/E,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CACX,IAAI,KAAK,CAAC,GAAG,4CAA4C,WAAW,WAAW,KAAK,CAAC,SAAS,EAAE,CACjG,CAAC;YACF,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,gCAAgC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,iEAAiE;AACjE,wEAAwE;AACxE,EAAE;AACF,oDAAoD;AACpD,+DAA+D;AAC/D,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,qBAAqB;AACrB,EAAE;AACF,kEAAkE;AAClE,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;;AAkCnE,8CAEC;AAgCD,sCAKC;AAoDD,0CAiEC;AAoBD,wDAuCC;AAsCD,kEAoEC;AAUD,0DAiBC;AA5XD,qCAAgI;AAChI,yCAA0C;AAuB1C,yEAAyE;AACzE,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;uDAEuD;AACvD,SAAgB,iBAAiB,CAAC,OAAiB;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,KAAmB,EACnB,MAAgF;IAEhF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACzE,MAAM,IAAI,GACR,wBAAwB,MAAM,CAAC,MAAM,UAAU,KAAK,GAAG,IAAI,GAAG;QAC9D,SAAS,MAAM,CAAC,KAAK,eAAe,MAAM,CAAC,UAAU,cAAc,MAAM,CAAC,SAAS,GAAG;QACtF,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAA,wBAAc,EAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,yCAAyC,KAAK,CAAC,OAAO,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;mEAEmE;AACnE,SAAgB,aAAa,CAC3B,KAAmB,EACnB,MAAgF;IAEhF,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAwBD,SAAS,OAAO,CAAC,KAAsB,EAAE,MAAwB;IAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,KAAK,CACX,yBAAyB,KAAK,CAAC,MAAM,WAAW,WAAW,GAAG;QAC5D,mBAAmB,MAAM,CAAC,eAAe,sBAAsB,MAAM,CAAC,iBAAiB,EAAE;QACzF,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,QAAgB,EAAE,IAAa;IACxE,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAChE,IAAA,uBAAa,EAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAA,oBAAU,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,KAAsB;IACpD,MAAM,MAAM,GAAqB,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAExF,gDAAgD;IAChD,IAAI,CAAC;QACH,IAAI,KAAK,GAAgB,EAAE,CAAC;QAC5B,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAChD,CAAC;gBACD,KAAK,GAAG,MAAqB,CAAC;YAChC,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QAC3D,CAAC;QAED,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/E,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,mEAAmE;QACnE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE;YAChC,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAC3C,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;YACtC,UAAU;YACV,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC;QAChC,MAAM,CAAC,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAA,oBAAU,EAAC,eAAe,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,OAAO,CAAC,CAA4B,CAAC;QAC7F,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAClC,MAAM,CAAC,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,KAAuB;IAC5D,MAAM,MAAM,GAAsB,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAChE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAA,oBAAU,EAAC,eAAe,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,OAAO,CAAC,CAA4B,CAAC;QAC7F,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzE,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAChC,2EAA2E;YAC3E,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE;gBAChC,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,KAAK;gBACZ,UAAU;gBACV,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;QAClC,MAAM,CAAC,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,KAAK,CACX,yBAAyB,KAAK,CAAC,MAAM,WAAW,WAAW,GAAG;QAC5D,0CAA0C,MAAM,CAAC,iBAAiB,EAAE;QACpE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AA8BD;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CAAC,KAAiD;IAC3F,MAAM,MAAM,GAAqB,EAAE,WAAW,EAAE,CAAC,EAAE,mBAAmB,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAElH,uEAAuE;IACvE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;gBAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;wBAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,IAAA,qBAAW,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5G,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC;gBACH,IAAI,CAAC,IAAA,kBAAQ,EAAC,UAAU,CAAC,CAAC,WAAW,EAAE;oBAAE,SAAS;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,eAAe,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YACzD,IAAI,CAAC,IAAA,oBAAU,EAAC,eAAe,CAAC;gBAAE,SAAS;YAC3C,IAAI,MAAM,GAAiB,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,OAAO,CAAC,CAA4B,CAAC;gBAC7F,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;YACjD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,SAAS;YACX,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;oBAAE,SAAS;gBAC3C,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC7B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC/E,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CAAC,KAA0B;IAChE,MAAM,CAAC,GAAG,2BAA2B,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACtG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,uBAAuB,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,4CAA4C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,4CAA4C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,gCAAgC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;KAC3C,CAAC;AACJ,CAAC"}