@ryanstark24/sfgraph-core 1.2.0 → 1.6.0

package/dist/analyze/security.js

@@ -1,6 +1,55 @@
 import { METADATA_CATEGORY } from "../domain/metadata-category.js";
 import { REL_TYPES } from "../domain/rel-types.js";
+import { isEffectiveGrant } from "./edge-filters.js";
+export { isEffectiveGrant };
 export const SECURITY_PER_LABEL_CAP = 5000;
+/** Standard system / audit field API names. These are never subject to the
+ *  field-level security a developer cares about — flagging them as "FLS gaps"
+ *  is pure noise (they dominated the gap list on a real org). */
+const SYSTEM_FIELD_NAMES = new Set([
+    "Id",
+    "Name",
+    "OwnerId",
+    "IsDeleted",
+    "CreatedById",
+    "CreatedDate",
+    "LastModifiedById",
+    "LastModifiedDate",
+    "SystemModstamp",
+    "LastViewedDate",
+    "LastReferencedDate",
+    "LastActivityDate",
+    "RecordTypeId",
+    "CurrencyIsoCode",
+    // Custom Metadata Type built-ins
+    "DeveloperName",
+    "MasterLabel",
+    "Language",
+    "NamespacePrefix",
+    "Label",
+    "QualifiedApiName",
+]);
+/**
+ * True when a `CustomField:<Object>.<Field>` qname names a field that real
+ * field-level security applies to. Excludes:
+ *  - Custom Metadata Type fields (`__mdt`) — CMDT has no per-field FLS.
+ *  - Custom Settings-ish / metadata objects and standard system/audit fields.
+ * Custom fields (`__c`) on real objects (standard or custom) stay in.
+ */
+export function isFlsRelevantField(qname) {
+    const tail = (qname.includes(":") ? qname.split(":")[1] : qname) ?? qname;
+    const dot = tail.indexOf(".");
+    if (dot <= 0)
+        return false;
+    const object = tail.slice(0, dot);
+    const field = tail.slice(dot + 1);
+    // CMDT and platform-event/big-object metadata don't use developer FLS.
+    if (/__(mdt|e|b)$/i.test(object))
+        return false;
+    if (SYSTEM_FIELD_NAMES.has(field))
+        return false;
+    return true;
+}
 function matchesFilter(qname, opts) {
     if (!opts)
         return true;
@@ -29,32 +78,67 @@ export function securityAudit(store, orgId, opts) {
             sharingFullAccess.push(n.qualifiedName);
         }
     }
-    // Field access matrix
+    // Field access matrix. FLS is granted via BOTH Profiles AND Permission Sets —
+    // scanning only Permission Sets reported false FLS gaps on every field whose
+    // access comes from a Profile (the most common case in older orgs). Fold both
+    // grantors into the same matrix.
     const fieldAccessMatrix = new Map();
-    const permSets = store.listNodesByLabel(orgId, METADATA_CATEGORY.PERMISSION_SET, SECURITY_PER_LABEL_CAP);
-    if (permSets.length >= SECURITY_PER_LABEL_CAP)
-        truncated = true;
-    for (const n of permSets) {
-        const grants = store.listEdgesFrom(orgId, n.qualifiedName, REL_TYPES.GRANTS_FIELD_ACCESS);
-        for (const e of grants) {
-            let set = fieldAccessMatrix.get(e.dstQualifiedName);
-            if (!set) {
-                set = new Set();
-                fieldAccessMatrix.set(e.dstQualifiedName, set);
+    for (const grantorLabel of [METADATA_CATEGORY.PERMISSION_SET, METADATA_CATEGORY.PROFILE]) {
+        const grantors = store.listNodesByLabel(orgId, grantorLabel, SECURITY_PER_LABEL_CAP);
+        if (grantors.length >= SECURITY_PER_LABEL_CAP)
+            truncated = true;
+        for (const n of grantors) {
+            // An all-false entry (`<readable>false</readable>`) grants nothing.
+            const grants = store
+                .listEdgesFrom(orgId, n.qualifiedName, REL_TYPES.GRANTS_FIELD_ACCESS)
+                .filter(isEffectiveGrant);
+            for (const e of grants) {
+                let set = fieldAccessMatrix.get(e.dstQualifiedName);
+                if (!set) {
+                    set = new Set();
+                    fieldAccessMatrix.set(e.dstQualifiedName, set);
+                }
+                set.add(n.qualifiedName);
             }
-            set.add(n.qualifiedName);
         }
     }
-    // FLS gaps: fields with no grants. Honour the object/field filter.
+    // FLS gaps: fields with no grants. Honour the object/field filter, and skip
+    // not-FLS-relevant fields (CMDT + system/audit) unless explicitly requested
+    // — those dominated the raw list and are never a real FLS finding.
     const flsGaps = [];
-    const fields = store.listNodesByLabel(orgId, METADATA_CATEGORY.FIELD, SECURITY_PER_LABEL_CAP);
-    if (fields.length >= SECURITY_PER_LABEL_CAP)
-        truncated = true;
+    let flsGapsExcluded = 0;
+    // The cap bounds the fields IN SCOPE: with an object/field filter, filter
+    // first and cap after, so narrowing (the advice the cap gives) can reach
+    // fields past the first SECURITY_PER_LABEL_CAP rows of the label.
+    let fields;
+    if (opts?.field) {
+        const one = store.getNode(orgId, opts.field);
+        fields = one && one.label === METADATA_CATEGORY.FIELD ? [one] : [];
+    }
+    else if (opts?.object) {
+        fields = store
+            .listNodesByLabel(orgId, METADATA_CATEGORY.FIELD)
+            .filter((n) => matchesFilter(n.qualifiedName, opts));
+        if (fields.length > SECURITY_PER_LABEL_CAP) {
+            fields = fields.slice(0, SECURITY_PER_LABEL_CAP);
+            truncated = true;
+        }
+    }
+    else {
+        fields = store.listNodesByLabel(orgId, METADATA_CATEGORY.FIELD, SECURITY_PER_LABEL_CAP);
+        if (fields.length >= SECURITY_PER_LABEL_CAP)
+            truncated = true;
+    }
     for (const n of fields) {
         if (!matchesFilter(n.qualifiedName, opts))
             continue;
-        if (!fieldAccessMatrix.has(n.qualifiedName))
-            flsGaps.push(n.qualifiedName);
+        if (fieldAccessMatrix.has(n.qualifiedName))
+            continue;
+        if (!opts?.includeNonFlsFields && !isFlsRelevantField(n.qualifiedName)) {
+            flsGapsExcluded += 1;
+            continue;
+        }
+        flsGaps.push(n.qualifiedName);
     }
     // Filter the matrix too so a narrowed audit returns a narrowed matrix.
     const filteredMatrix = Array.from(fieldAccessMatrix.entries())
@@ -64,6 +148,7 @@ export function securityAudit(store, orgId, opts) {
         sharingFullAccess,
         fieldAccessMatrix: filteredMatrix,
         flsGaps,
+        flsGapsExcluded,
         truncated,
     };
 }

package/dist/analyze/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/analyze/security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAenD,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAS3C,SAAS,aAAa,CAAC,KAAa,EAAE,IAAsC;IAC1E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,qEAAqE;QACrE,iEAAiE;QACjE,gEAAgE;QAChE,MAAM,OAAO,GACX,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;QACvF,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAC1E,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,IAAI,IAAI,KAAK,OAAO,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAiB,EACjB,KAAY,EACZ,IAA2B;IAE3B,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,6BAA6B;IAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,gBAAgB,CACzC,KAAK,EACL,iBAAiB,CAAC,YAAY,EAC9B,sBAAsB,CACvB,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,IAAI,sBAAsB;QAAE,SAAS,GAAG,IAAI,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,UAAqC,CAAC;QAClD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC/E,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAuB,CAAC;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,CACrC,KAAK,EACL,iBAAiB,CAAC,cAAc,EAChC,sBAAsB,CACvB,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,IAAI,sBAAsB;QAAE,SAAS,GAAG,IAAI,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;gBAChB,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YACjD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,MAAM,IAAI,sBAAsB;QAAE,SAAS,GAAG,IAAI,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC;YAAE,SAAS;QACpD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC7E,CAAC;IAED,uEAAuE;IACvE,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;SAC3D,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAElE,OAAO;QACL,iBAAiB;QACjB,iBAAiB,EAAE,cAAc;QACjC,OAAO;QACP,SAAS;KACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/analyze/security.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAkB5B,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAE3C;;iEAEiE;AACjE,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,IAAI;IACJ,MAAM;IACN,SAAS;IACT,WAAW;IACX,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;IAChB,oBAAoB;IACpB,kBAAkB;IAClB,cAAc;IACd,iBAAiB;IACjB,iCAAiC;IACjC,eAAe;IACf,aAAa;IACb,UAAU;IACV,iBAAiB;IACjB,OAAO;IACP,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAClC,uEAAuE;IACvE,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD,SAAS,aAAa,CAAC,KAAa,EAAE,IAAsC;IAC1E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,qEAAqE;QACrE,iEAAiE;QACjE,gEAAgE;QAChE,MAAM,OAAO,GACX,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;QACvF,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAC1E,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,IAAI,IAAI,KAAK,OAAO,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAiB,EACjB,KAAY,EACZ,IAA2B;IAE3B,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,6BAA6B;IAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,gBAAgB,CACzC,KAAK,EACL,iBAAiB,CAAC,YAAY,EAC9B,sBAAsB,CACvB,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,IAAI,sBAAsB;QAAE,SAAS,GAAG,IAAI,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,UAAqC,CAAC;QAClD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC/E,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,iCAAiC;IACjC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAuB,CAAC;IACzD,KAAK,MAAM,YAAY,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzF,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,sBAAsB,CAAC,CAAC;QACrF,IAAI,QAAQ,CAAC,MAAM,IAAI,sBAAsB;YAAE,SAAS,GAAG,IAAI,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,oEAAoE;YACpE,MAAM,MAAM,GAAG,KAAK;iBACjB,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,mBAAmB,CAAC;iBACpE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;gBACpD,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;oBAChB,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;gBACjD,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,0EAA0E;IAC1E,yEAAyE;IACzE,kEAAkE;IAClE,IAAI,MAAkB,CAAC;IACvB,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAsB,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;SAAM,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;QACxB,MAAM,GAAG,KAAK;aACX,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;YAC3C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;YACjD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;QACxF,IAAI,MAAM,CAAC,MAAM,IAAI,sBAAsB;YAAE,SAAS,GAAG,IAAI,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC;YAAE,SAAS;QACpD,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC;YAAE,SAAS;QACrD,IAAI,CAAC,IAAI,EAAE,mBAAmB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YACvE,eAAe,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAChC,CAAC;IAED,uEAAuE;IACvE,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;SAC3D,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAElE,OAAO;QACL,iBAAiB;QACjB,iBAAiB,EAAE,cAAc;QACjC,OAAO;QACP,eAAe;QACf,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/analyze/test-coverage.d.ts

@@ -1,4 +1,52 @@
 import type { OrgId, QualifiedName } from "@ryanstark24/sfgraph-shared";
+import type { NodeFact } from "../domain/index.js";
 import type { GraphStore } from "../storage/interfaces.js";
+/**
+ * Labels a test class can exercise: `IS_TEST_FOR` only ever targets Apex
+ * classes, and an ApexTrigger is exercised through DML from tests. Every
+ * other label (LWC, Aura, Flow, FlowVersion, ...) can never be "covered", so
+ * it is reported as not applicable rather than as a gap.
+ */
+export declare const COVERAGE_LABELS: ReadonlySet<string>;
+/**
+ * True when a test class targets `qname`'s component with IS_TEST_FOR. The
+ * edge only targets classes, so a method is resolved to its owning class
+ * first (containment.ts `componentOf`).
+ */
 export declare function hasTestCoverage(store: GraphStore, orgId: OrgId, qname: QualifiedName): boolean;
+/** Coverage verdict for one qname, decided on its component (`unit`). */
+export interface CoverageVerdict {
+    /** The component coverage is decided on (a method's class, a FlowVersion's Flow). */
+    unit: string;
+    /** Label of `unit` (node label, else the qname prefix). */
+    label: string;
+    /** `label` is in COVERAGE_LABELS. */
+    applicable: boolean;
+    /** `unit` is test code: an `@isTest` class, a class with a test member
+     *  (TestMethod / `isTest`), or a class with IS_TEST_FOR out-edges. A test
+     *  method's own node carries no IS_TEST_FOR, so the class decides, and a
+     *  class and its members always get the same verdict. */
+    isTest: boolean;
+    /** A test class targets `unit` with IS_TEST_FOR. */
+    covered: boolean;
+}
+/**
+ * Facts from a local (not yet ingested) parse, consulted before the graph:
+ * wip tools see added classes, methods and tests the graph does not hold.
+ */
+export interface LocalCoverageFacts {
+    nodes?: ReadonlyMap<string, NodeFact>;
+    /** member qname -> owner qname (local CONTAINS_METHOD edges). */
+    owners?: ReadonlyMap<string, string>;
+    /** Lower-cased IS_TEST_FOR targets of local test classes. */
+    testTargets?: ReadonlySet<string>;
+    /** Lower-cased sources of local IS_TEST_FOR edges. */
+    testSources?: ReadonlySet<string>;
+}
+/**
+ * A memoised classifier: qname -> its coverage verdict. Used by
+ * test_gap_intelligence_from_git_diff, what_broke and wip_test_gap so the
+ * three agree on roll-up, test-ness and applicability.
+ */
+export declare function makeCoverageClassifier(store: GraphStore, orgId: OrgId, local?: LocalCoverageFacts): (qname: string) => CoverageVerdict;
 //# sourceMappingURL=test-coverage.d.ts.map

package/dist/analyze/test-coverage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-coverage.d.ts","sourceRoot":"","sources":["../../src/analyze/test-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAE9F"}
+{"version":3,"file":"test-coverage.d.ts","sourceRoot":"","sources":["../../src/analyze/test-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAI3D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAAyC,CAAC;AAE1F;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAI9F;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,UAAU,EAAE,OAAO,CAAC;IACpB;;;6DAGyD;IACzD,MAAM,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtC,iEAAiE;IACjE,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,6DAA6D;IAC7D,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,sDAAsD;IACtD,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACnC;AAOD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,KAAK,GAAE,kBAAuB,GAC7B,CAAC,KAAK,EAAE,MAAM,KAAK,eAAe,CAgDpC"}

package/dist/analyze/test-coverage.js

@@ -1,5 +1,76 @@
+import { asQualifiedName } from "@ryanstark24/sfgraph-shared";
 import { REL_TYPES } from "../domain/rel-types.js";
+import { componentOf, listMembers } from "./containment.js";
+import { labelOfQname } from "./edge-filters.js";
+/**
+ * Labels a test class can exercise: `IS_TEST_FOR` only ever targets Apex
+ * classes, and an ApexTrigger is exercised through DML from tests. Every
+ * other label (LWC, Aura, Flow, FlowVersion, ...) can never be "covered", so
+ * it is reported as not applicable rather than as a gap.
+ */
+export const COVERAGE_LABELS = new Set(["ApexClass", "ApexTrigger"]);
+/**
+ * True when a test class targets `qname`'s component with IS_TEST_FOR. The
+ * edge only targets classes, so a method is resolved to its owning class
+ * first (containment.ts `componentOf`).
+ */
 export function hasTestCoverage(store, orgId, qname) {
-    return store.listEdgesTo(orgId, qname, REL_TYPES.IS_TEST_FOR).length > 0;
+    const unit = componentOf(store, orgId, qname);
+    if (store.listEdgesTo(orgId, unit, REL_TYPES.IS_TEST_FOR).length > 0)
+        return true;
+    return unit !== qname && store.listEdgesTo(orgId, qname, REL_TYPES.IS_TEST_FOR).length > 0;
+}
+const flaggedTest = (n) => n != null &&
+    (n.label === "TestMethod" ||
+        n.attributes?.isTest === true);
+/**
+ * A memoised classifier: qname -> its coverage verdict. Used by
+ * test_gap_intelligence_from_git_diff, what_broke and wip_test_gap so the
+ * three agree on roll-up, test-ness and applicability.
+ */
+export function makeCoverageClassifier(store, orgId, local = {}) {
+    // Verdicts are per unit (lower-cased), so a class and each of its
+    // members get the same answer whichever is asked first.
+    const unitMemo = new Map();
+    const unitOf = new Map();
+    const nodeOf = (q) => local.nodes?.get(q) ?? store.getNode(orgId, asQualifiedName(q));
+    const localMembers = (lowerUnit) => [...(local.owners ?? [])].filter(([, o]) => o.toLowerCase() === lowerUnit).map(([m]) => m);
+    const verdictFor = (unit) => {
+        const lowerUnit = unit.toLowerCase();
+        const hit = unitMemo.get(lowerUnit);
+        if (hit)
+            return hit;
+        const unitNode = nodeOf(unit);
+        const unitQ = asQualifiedName(unit);
+        const label = unitNode?.label ?? labelOfQname(unit);
+        // Test-ness folds in the members' flags: a test method marks its class.
+        const members = [...listMembers(store, orgId, unitQ).map(String), ...localMembers(lowerUnit)];
+        const isTest = flaggedTest(unitNode) ||
+            members.some((m) => flaggedTest(nodeOf(m))) ||
+            local.testSources?.has(lowerUnit) === true ||
+            store.listEdgesFrom(orgId, unitQ, REL_TYPES.IS_TEST_FOR).length > 0;
+        const covered = local.testTargets?.has(lowerUnit) === true || hasTestCoverage(store, orgId, unitQ);
+        const v = {
+            unit,
+            label,
+            applicable: COVERAGE_LABELS.has(label),
+            isTest,
+            covered,
+        };
+        unitMemo.set(lowerUnit, v);
+        return v;
+    };
+    return (qname) => {
+        let unit = unitOf.get(qname);
+        if (unit === undefined) {
+            const rawUnit = local.owners?.get(qname) ?? String(componentOf(store, orgId, asQualifiedName(qname)));
+            // The stored spelling: qname lookups ignore case, listings should not
+            // hold one component twice.
+            const unitNode = nodeOf(rawUnit);
+            unit = unitNode ? String(unitNode.qualifiedName) : rawUnit;
+            unitOf.set(qname, unit);
+        }
+        return verdictFor(unit);
+    };
 }
 //# sourceMappingURL=test-coverage.js.map

package/dist/analyze/test-coverage.js.map

@@ -1 +1 @@
-{"version":3,"file":"test-coverage.js","sourceRoot":"","sources":["../../src/analyze/test-coverage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,MAAM,UAAU,eAAe,CAAC,KAAiB,EAAE,KAAY,EAAE,KAAoB;IACnF,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"test-coverage.js","sourceRoot":"","sources":["../../src/analyze/test-coverage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAE1F;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB,EAAE,KAAY,EAAE,KAAoB;IACnF,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,OAAO,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7F,CAAC;AAiCD,MAAM,WAAW,GAAG,CAAC,CAA8B,EAAW,EAAE,CAC9D,CAAC,IAAI,IAAI;IACT,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY;QACtB,CAAC,CAAC,UAAkD,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAiB,EACjB,KAAY,EACZ,QAA4B,EAAE;IAE9B,kEAAkE;IAClE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAmB,EAAE,CAC5C,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAY,EAAE,CACnD,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,CAAC,IAAY,EAAmB,EAAE;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACpD,wEAAwE;QACxE,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9F,MAAM,MAAM,GACV,WAAW,CAAC,QAAQ,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI;YAC1C,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACtE,MAAM,OAAO,GACX,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACrF,MAAM,CAAC,GAAoB;YACzB,IAAI;YACJ,KAAK;YACL,UAAU,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;YACtC,MAAM;YACN,OAAO;SACR,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,OAAO,GACX,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxF,sEAAsE;YACtE,4BAA4B;YAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3D,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/analyze/wip-changed-files.d.ts

@@ -0,0 +1,88 @@
+import type { Logger } from "@ryanstark24/sfgraph-shared";
+import type { MemberRef } from "../extractors/interfaces/metadata-source.js";
+/** Absolute paths under `root` that differ from HEAD; null when `root` is not
+ *  inside a git work tree, or when git cannot be run safely there. */
+export declare function gitChangedFiles(root: string, logger?: Logger): Set<string> | null;
+/** Files under `dirs` modified after `sinceMs`. */
+export declare function filesModifiedSince(dirs: string[], sinceMs: number): Set<string>;
+/** Changed files by every available signal; null when no signal is available. */
+export declare function localChangedFiles(opts: {
+    projectRoot: string;
+    /** Directories the metadata source walks (package dirs, DataPacks). */
+    sourceDirs: string[];
+    lastSyncedAt: number | null | undefined;
+    logger?: Logger;
+}): Set<string> | null;
+/** Filesystem path of a member's `file://` sourceUri. */
+export declare function memberPath(ref: Pick<MemberRef, "sourceUri">): string;
+/** Changed files plus every folder that contains one. */
+export interface ChangeIndex {
+    files: ReadonlySet<string>;
+    dirs: ReadonlySet<string>;
+}
+export declare function indexChanges(changed: ReadonlySet<string>): ChangeIndex;
+/**
+ * Streaming pre-check of one member against the changes, without the other
+ * members: `direct` = it owns a changed file by itself (own file, sidecar,
+ * a file under a directory member); `maybe` = a changed file sits in a folder
+ * it anchors, so ownership depends on whether it is the sole member there
+ * (`membersOwningFiles` decides with every ref); `no` = it cannot own one.
+ */
+export declare function classifyMember(ref: Pick<MemberRef, "sourceUri" | "memberName">, idx: ChangeIndex): "direct" | "maybe" | "no";
+/**
+ * Which members own the changed files. A member owns:
+ *  - its source path (a file, or every file under it when it is a directory);
+ *  - the sidecar of a file member (`Foo.cls` -> `Foo.cls-meta.xml`);
+ *  - every other file in its folder when it is the only member there (a
+ *    DataPack folder, an object folder with `fields/`, ...). A folder shared
+ *    by several members (`classes/`) gives an unowned file to nobody.
+ * Returns the indexes of owning members in `refs`. Cost is O(refs + changed
+ * x path depth).
+ */
+export declare function membersOwningFiles(refs: ReadonlyArray<Pick<MemberRef, "sourceUri" | "memberName">>, changed: ReadonlySet<string>, 
+/** Anchors of members not in `refs`, counted per folder (`selectOwningMembers`). */
+extraAnchors?: ReadonlyMap<string, number>): Set<number>;
+/** What {@link selectOwningMembers} needs of an index entry and of its loaded member. */
+export interface SelectableEntry {
+    /** The member's sourceUri. */
+    key: string;
+}
+export interface SelectableMember {
+    ref: Pick<MemberRef, "sourceUri" | "memberName">;
+}
+export interface OwnerSelection<M> {
+    /** Members that own a changed file by themselves, in index order. */
+    direct: M[];
+    /** Members that own a changed file via a sole-member folder, in `membersOwningFiles` order. */
+    owners: M[];
+    indexed: number;
+    loaded: number;
+    /** Paths of loaded members whose load() returned null (unreadable). */
+    dropped: ReadonlySet<string>;
+}
+/**
+ * The members owning `changed` files, as `membersOwningFiles` over every
+ * indexed member would find them, while `load()`ing only the members that can
+ * matter, decided from each key (path) with set lookups and a stat at most:
+ *  - direct: its path or sidecar is a changed file, or it is a folder holding
+ *    one. Loaded; owns it.
+ *  - sole: the only member whose own folder (its path for a folder member, its
+ *    parent for a file) holds a changed file. Loaded; may own via that folder.
+ *  - shared: its own folder holds a changed file but other members' do too.
+ *    Not loaded: nobody owns via that folder, and its anchor there is passed
+ *    to `membersOwningFiles` as a count (`extraAnchors`).
+ *  - The one remaining role is anchoring the folder above its own when named
+ *    after it (`memberAnchors`). A member is loaded for that only when a
+ *    changed file's walk up reaches that folder before any known anchor.
+ * Other members can neither own a changed file nor change who owns one.
+ * `load` returning null (unreadable) drops the member like `iter()` does; a
+ * member never loaded still counts as an anchor of its own folder.
+ */
+export declare function selectOwningMembers<E extends SelectableEntry, M extends SelectableMember>(entries: AsyncIterable<E> | Iterable<E>, changed: ReadonlySet<string>, load: (e: E) => Promise<M | null>): Promise<OwnerSelection<M>>;
+/**
+ * Whether a deleted `file` belongs by itself to a member at `memberPaths`: its
+ * sidecar's member (`Foo.cls` for `Foo.cls-meta.xml`) or a folder member
+ * holding it (a bundle that lost one file).
+ */
+export declare function heldByMember(file: string, memberPaths: ReadonlySet<string>): boolean;
+//# sourceMappingURL=wip-changed-files.d.ts.map

package/dist/analyze/wip-changed-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wip-changed-files.d.ts","sourceRoot":"","sources":["../../src/analyze/wip-changed-files.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6CAA6C,CAAC;AAqF7E;sEACsE;AACtE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CA+BjF;AAED,mDAAmD;AACnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAyB/E;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAQrB;AAED,yDAAyD;AACzD,wBAAgB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,CAGpE;AA2BD,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,WAAW,CAYtE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,YAAY,CAAC,EAChD,GAAG,EAAE,WAAW,GACf,QAAQ,GAAG,OAAO,GAAG,IAAI,CAO3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,YAAY,CAAC,CAAC,EAChE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC;AAC5B,oFAAoF;AACpF,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACzC,GAAG,CAAC,MAAM,CAAC,CAgDb;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AACD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,YAAY,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,qEAAqE;IACrE,MAAM,EAAE,CAAC,EAAE,CAAC;IACZ,+FAA+F;IAC/F,MAAM,EAAE,CAAC,EAAE,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,SAAS,eAAe,EAAE,CAAC,SAAS,gBAAgB,EAC7F,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,EACvC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAC5B,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,GAChC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAgG5B;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAOpF"}