@sonisoft/now-sdk-ext-core 6.17.1 → 6.18.1

package/dist/sn/security/AclManager.js

@@ -0,0 +1,398 @@
+import { SessionManager } from '../../comm/http/SessionManager.js';
+import { MetadataFormWriter } from '../metadata/MetadataFormWriter.js';
+import { MetadataReader } from '../metadata/internal/MetadataReader.js';
+import { resolveScope } from '../metadata/internal/MetadataScope.js';
+import { AclError, AclPartialError } from './AclError.js';
+import { RoleElevation } from './RoleElevation.js';
+import { accessControlWriters } from '../metadata/internal/AccessControlWriters.js';
+import { isPolicyRefusal } from '../../policy/PolicyRefusal.js';
+const ID = /^[a-f0-9]{32}$/i;
+const IDENT = /^[a-z0-9_]{1,80}$/i;
+const ROLE = /^[a-z][a-z0-9_.]{0,79}$/i;
+/** Free-form ACL names (REST endpoints, UI pages, …) must not break an encoded query. */
+const RESOURCE = /^[^^\p{Cc}]{1,200}$/u;
+/** A query value the instance would evaluate as script. */
+const SCRIPT = /javascript:/i;
+const ACL = 'sys_security_acl';
+const ACL_ROLE = 'sys_security_acl_role';
+const REQUIRED_ROLE = 'security_admin';
+/** The role the platform puts on an ACL that has none (Explicit Roles). Any internal user has it. */
+const AUTOMATIC_ROLE = 'snc_internal';
+const BASE_FIELDS = 'name,type,type.name,operation,operation.name,active,admin_overrides,advanced,description,condition,script,sys_scope,sys_scope.scope,sys_updated_on';
+const bool = (value) => value === 'true' || value === '1';
+/**
+ * Access controls (sys_security_acl) and their roles, written through their forms in a named
+ * application and update set, each write verified by reading back its record and capture.
+ *
+ * Changing an ACL needs the elevated security_admin role on the writing session: construct the
+ * ServiceNowInstance with `elevatedRoles: ['security_admin']`. Reading ACLs needs no elevation,
+ * though a role the session may not read has no name (security_admin until elevated; nobody and
+ * maint always): its roleSysId identifies it.
+ *
+ * Creating an ACL with roles inserts it inactive, adds the roles, removes the snc_internal role
+ * the platform adds to an ACL that has none, then activates it: an ACL never stands active with
+ * fewer restrictions than asked for. Roles on an ACL are alternatives, so snc_internal left
+ * beside them would let every internal user pass.
+ */
+export class AclManager {
+    _instance;
+    _decisionType;
+    constructor(_instance) {
+        this._instance = _instance;
+    }
+    reader() {
+        return new MetadataReader(SessionManager.getInstance().getRequest(this._instance));
+    }
+    /** ACLs matching every given filter. At least one of table, name or scope is required. */
+    async list(options) {
+        const reader = this.reader();
+        const terms = [];
+        if (options.table !== undefined) {
+            if (!IDENT.test(options.table))
+                throw new AclError('invalid_input', 'table');
+            terms.push(`name=${options.table}^ORnameSTARTSWITH${options.table}.`);
+        }
+        if (options.name !== undefined) {
+            if (!RESOURCE.test(options.name) || SCRIPT.test(options.name))
+                throw new AclError('invalid_input', 'name');
+            terms.push(`name=${options.name}`);
+        }
+        if (options.scope !== undefined)
+            terms.push(`sys_scope=${(await resolveScope(reader, options.scope)).sysId}`);
+        if (!terms.length)
+            throw new AclError('filter_required');
+        if (options.operation !== undefined)
+            terms.push(`operation=${await this.lookup(reader, 'sys_security_operation', options.operation, 'operation_not_found')}`);
+        if (options.type !== undefined)
+            terms.push(`type=${await this.lookup(reader, 'sys_security_type', options.type, 'type_not_found')}`);
+        if (options.active !== undefined) {
+            if (typeof options.active !== 'boolean')
+                throw new AclError('invalid_input', 'active');
+            terms.push(`active=${options.active ? 'true' : 'false'}`);
+        }
+        const rows = await reader.rows(ACL, terms.join('^'), `sys_id,${await this.fields(reader)}`);
+        return this.records(reader, rows);
+    }
+    /** One ACL with its roles. */
+    async get(sysId) {
+        if (!ID.test(sysId ?? ''))
+            throw new AclError('invalid_input', 'sysId');
+        const reader = this.reader();
+        const row = await reader.exact(ACL, sysId, await this.fields(reader));
+        if (!row)
+            throw new AclError('acl_not_found');
+        return (await this.records(reader, [row]))[0];
+    }
+    async create(options) {
+        const reader = this.reader();
+        const type = options.type ?? 'record';
+        const typeId = await this.lookup(reader, 'sys_security_type', type, 'type_not_found');
+        const operationId = await this.lookup(reader, 'sys_security_operation', options.operation, 'operation_not_found');
+        const name = await this.aclName(reader, type, options);
+        const roles = await this.roles(reader, options.roles ?? []);
+        await this.requireElevation();
+        const fields = await this.fieldValues(reader, options);
+        const target = this.target(options);
+        const writer = this.writer();
+        const writes = [];
+        const active = options.active !== false;
+        // With roles, the ACL stays inactive until they are on it and the platform's own role is gone.
+        const staged = active && roles.length > 0;
+        const inserted = await writer.insert(ACL, { ...target, fields: { ...fields, type: typeId, operation: operationId, name,
+                active: active && !staged, admin_overrides: options.adminOverrides ?? true } });
+        writes.push(inserted);
+        const sysId = inserted.sysId;
+        try {
+            return await this.finishCreate(reader, writer, sysId, roles, staged, target, writes);
+        }
+        catch (error) {
+            // A refusal stays a refusal (callers recognise it by its brand), carrying the ACL it left behind.
+            if (isPolicyRefusal(error))
+                throw Object.assign(error, { aclSysId: sysId });
+            throw new AclPartialError(sysId, 'create', await this.state(sysId), error);
+        }
+    }
+    async finishCreate(reader, writer, sysId, roles, staged, target, writes) {
+        const automatic = await this.roleRows(reader, [sysId]);
+        const present = new Set(automatic.map(row => row.roleSysId));
+        for (const role of roles) {
+            if (present.has(role.sysId))
+                continue;
+            writes.push(await writer.insert(ACL_ROLE, { ...target, fields: { sys_security_acl: sysId, sys_user_role: role.sysId } }));
+        }
+        const removedAutomaticRoles = [];
+        if (roles.length) {
+            for (const row of automatic) {
+                if (roles.some(role => role.sysId === row.roleSysId))
+                    continue;
+                writes.push(await writer.delete(ACL_ROLE, row.sysId, { ...target, confirm: { table: ACL_ROLE, sysId: row.sysId } }));
+                removedAutomaticRoles.push(row.role || row.roleSysId);
+            }
+        }
+        if (roles.length) {
+            // The roles must be exactly those asked for before the ACL goes live: any other row would be one more way to pass.
+            const now = new Set((await this.roleRows(reader, [sysId])).map(row => row.roleSysId));
+            if (now.size !== roles.length || roles.some(role => !now.has(role.sysId)))
+                throw new AclError('roles_not_applied');
+        }
+        if (staged)
+            writes.push(await writer.update(ACL, sysId, { ...target, fields: { active: true } }));
+        const acl = await this.get(sysId);
+        return { acl, writes, removedAutomaticRoles, warnings: this.warnings(acl) };
+    }
+    async update(sysId, options) {
+        const previous = await this.get(sysId);
+        const reader = this.reader();
+        const fields = await this.fieldValues(reader, options);
+        if (options.operation !== undefined)
+            fields.operation = await this.lookup(reader, 'sys_security_operation', options.operation, 'operation_not_found');
+        if (options.adminOverrides !== undefined)
+            fields.admin_overrides = options.adminOverrides;
+        if (options.active !== undefined)
+            fields.active = options.active;
+        if (!Object.keys(fields).length)
+            throw new AclError('invalid_input', 'nothing_to_change');
+        await this.requireElevation();
+        const write = await this.writer().update(ACL, sysId, { ...this.target(options), fields });
+        const acl = await this.get(sysId);
+        return { acl, previous, writes: [write], removedAutomaticRoles: [], warnings: this.warnings(acl) };
+    }
+    /**
+     * Deletes the ACL. The platform deletes its role rows with it (each captured as a DELETE). It offers Delete on an
+     * active record ACL only once it is inactive, so one is deactivated first, as a separate captured update.
+     */
+    async delete(sysId, options) {
+        if (options?.confirm !== sysId)
+            throw new AclError('confirmation_required');
+        const previous = await this.get(sysId);
+        await this.requireElevation();
+        const writer = this.writer();
+        const target = this.target(options);
+        const writes = [];
+        const deactivate = previous.type === 'record' && previous.active;
+        try {
+            if (deactivate)
+                writes.push(await writer.update(ACL, sysId, { ...target, fields: { active: false } }));
+            writes.push(await writer.delete(ACL, sysId, { ...target, confirm: { table: ACL, sysId } }));
+        }
+        catch (error) {
+            if (!deactivate)
+                throw error;
+            const before = await this.state(sysId);
+            // Refused before anything was written: the caller gets the writer's own error.
+            if (!writes.length && before === 'active')
+                throw error;
+            // Whatever failed after that (the deactivation's verification, the delete, a refusal, an unreadable state), a
+            // delete must not leave the ACL switched off: put the restriction back unless it is known active or gone.
+            if (before !== 'active' && before !== 'deleted') {
+                await writer.update(ACL, sysId, { ...target, fields: { active: true } }).catch(() => undefined);
+            }
+            const state = await this.state(sysId);
+            if (isPolicyRefusal(error))
+                throw Object.assign(error, { aclSysId: sysId, aclState: state });
+            throw new AclPartialError(sysId, 'delete', state, error);
+        }
+        return { previous, writes, removedAutomaticRoles: [], warnings: [] };
+    }
+    async addRole(sysId, role, target) {
+        const previous = await this.get(sysId);
+        const [resolved] = await this.roles(this.reader(), [role]);
+        if (previous.roles.some(row => row.roleSysId === resolved.sysId))
+            throw new AclError('role_already_present', resolved.name);
+        await this.requireSameScope(previous, target);
+        await this.requireElevation();
+        const write = await this.writer().insert(ACL_ROLE, { ...this.target(target),
+            fields: { sys_security_acl: sysId, sys_user_role: resolved.sysId } });
+        const acl = await this.get(sysId);
+        return { acl, previous, writes: [write], removedAutomaticRoles: [], warnings: this.warnings(acl) };
+    }
+    /** Removing the last role makes the platform add snc_internal back; the result warns when it did. */
+    async removeRole(sysId, role, target) {
+        const previous = await this.get(sysId);
+        const [resolved] = await this.roles(this.reader(), [role]);
+        const rows = previous.roles.filter(row => row.roleSysId === resolved.sysId);
+        if (!rows.length)
+            throw new AclError('role_not_present', resolved.name);
+        await this.requireSameScope(previous, target);
+        await this.requireElevation();
+        const writer = this.writer();
+        const writes = [];
+        for (const row of rows)
+            writes.push(await writer.delete(ACL_ROLE, row.sysId, { ...this.target(target), confirm: { table: ACL_ROLE, sysId: row.sysId } }));
+        const acl = await this.get(sysId);
+        const warnings = this.warnings(acl);
+        if (acl.roles.some(row => row.roleSysId === resolved.sysId)) {
+            warnings.unshift(`${resolved.name} is still on this ACL: the platform puts ${AUTOMATIC_ROLE} back on an ACL left without a role. Add the role it should have first.`);
+        }
+        else if (!previous.roles.some(row => row.role === AUTOMATIC_ROLE) && acl.roles.some(row => row.role === AUTOMATIC_ROLE)) {
+            warnings.unshift(`The platform added ${AUTOMATIC_ROLE} when the last role was removed: every internal user now passes this ACL.`);
+        }
+        return { acl, previous, writes, removedAutomaticRoles: [], warnings };
+    }
+    target(target) {
+        if (!target?.scope)
+            throw new AclError('invalid_input', 'scope');
+        if (target.updateSet !== undefined && !ID.test(target.updateSet))
+            throw new AclError('invalid_input', 'updateSet');
+        return { scope: target.scope, ...(target.updateSet ? { updateSet: target.updateSet } : {}),
+            ...(target.storeCustomization ? { storeCustomization: target.storeCustomization } : {}) };
+    }
+    /** A writer allowed the access-control tables (the generic one refuses them). */
+    writer() {
+        const writer = new MetadataFormWriter(this._instance);
+        accessControlWriters.add(writer);
+        return writer;
+    }
+    /** The ACL read back after a failure. */
+    async state(sysId) {
+        try {
+            return (await this.get(sysId)).active ? 'active' : 'inactive';
+        }
+        catch (error) {
+            return error instanceof AclError && error.code === 'acl_not_found' ? 'deleted' : 'unknown';
+        }
+    }
+    /** A role row is written in the target application; it must be the ACL's own. */
+    async requireSameScope(acl, target) {
+        if (!target?.scope)
+            throw new AclError('invalid_input', 'scope');
+        if ((await resolveScope(this.reader(), target.scope)).sysId !== acl.scope)
+            throw new AclError('scope_mismatch');
+    }
+    async requireElevation() {
+        let elevated = [];
+        try {
+            elevated = (await new RoleElevation(this._instance).status()).elevated;
+        }
+        catch { /* unreadable: not elevated */ }
+        if (!elevated.includes(REQUIRED_ROLE))
+            throw new AclError('elevation_required', REQUIRED_ROLE);
+    }
+    /** decision_type exists from the release that added deny ACLs; read it only where it does. */
+    async fields(reader) {
+        // A failed read is not remembered: the next call asks again.
+        this._decisionType ??= reader.rows('sys_dictionary', `name=${ACL}^element=decision_type`, 'sys_id,element').then(rows => rows.length > 0, (error) => { this._decisionType = undefined; throw error; });
+        return `${BASE_FIELDS}${await this._decisionType ? ',decision_type' : ''}`;
+    }
+    async fieldValues(reader, options) {
+        const fields = {};
+        if (options.description !== undefined)
+            fields.description = options.description;
+        if (options.condition !== undefined)
+            fields.condition = options.condition;
+        if (options.script !== undefined)
+            Object.assign(fields, { advanced: true, script: options.script });
+        if (options.decisionType !== undefined) {
+            if (!['allow', 'deny'].includes(options.decisionType))
+                throw new AclError('invalid_input', 'decisionType');
+            await this.fields(reader);
+            if (!await this._decisionType)
+                throw new AclError('invalid_input', 'decisionType');
+            fields.decision_type = options.decisionType;
+        }
+        return fields;
+    }
+    async lookup(reader, table, name, missing) {
+        if (!IDENT.test(name ?? ''))
+            throw new AclError('invalid_input', missing === 'type_not_found' ? 'type' : 'operation');
+        const rows = await reader.rows(table, `name=${name}`, 'sys_id,name');
+        if (rows.length !== 1 || rows[0].name !== name)
+            throw new AclError(missing, name);
+        return rows[0].sys_id;
+    }
+    async aclName(reader, type, options) {
+        if (type !== 'record') {
+            if (options.table !== undefined || options.field !== undefined)
+                throw new AclError('invalid_input', 'table');
+            if (!RESOURCE.test(options.name ?? '') || SCRIPT.test(options.name ?? ''))
+                throw new AclError('invalid_input', 'name');
+            return options.name ?? '';
+        }
+        if (options.name !== undefined)
+            throw new AclError('invalid_input', 'name');
+        const table = options.table ?? '';
+        if (!IDENT.test(table))
+            throw new AclError('invalid_input', 'table');
+        const field = options.field;
+        if (field !== undefined && field !== '*' && !IDENT.test(field))
+            throw new AclError('invalid_input', 'field');
+        // The table and the tables it extends: a field may be defined on any of them.
+        const tables = [];
+        let next = table;
+        while (next && tables.length < 20) {
+            const rows = await reader.rows('sys_db_object', `name=${next}`, 'sys_id,name,super_class.name');
+            if (rows.length !== 1)
+                break;
+            tables.push(next);
+            next = rows[0]['super_class.name'] || undefined;
+        }
+        if (!tables.length)
+            throw new AclError('table_not_found', table);
+        if (field && field !== '*') {
+            const defined = await reader.rows('sys_dictionary', `nameIN${tables.join(',')}^element=${field}`, 'sys_id,element');
+            if (!defined.length)
+                throw new AclError('field_not_found', `${table}.${field}`);
+        }
+        return field ? `${table}.${field}` : table;
+    }
+    async roles(reader, names) {
+        const wanted = [...new Set(names.map(name => String(name).trim()).filter(Boolean))];
+        const invalid = wanted.find(name => !ROLE.test(name));
+        if (invalid !== undefined)
+            throw new AclError('invalid_input', 'role');
+        if (!wanted.length)
+            return [];
+        const rows = await reader.rows('sys_user_role', `nameIN${wanted.join(',')}`, 'sys_id,name');
+        return wanted.map(name => {
+            const matches = rows.filter(row => row.name === name);
+            // security_admin is only readable once elevated: the check runs on the elevated session for writes.
+            if (matches.length !== 1)
+                throw new AclError('role_not_found', name);
+            return { sysId: matches[0].sys_id, name };
+        });
+    }
+    async roleRows(reader, acls) {
+        if (!acls.length)
+            return [];
+        const rows = [];
+        // Bounded IN lists: an encoded query of thousands of sys_ids is refused by the instance.
+        for (let at = 0; at < acls.length; at += 100) {
+            // A role the session may not read (security_admin until elevated; nobody and maint always) has no name here.
+            const batch = await reader.rows(ACL_ROLE, `sys_security_aclIN${acls.slice(at, at + 100).join(',')}`, 'sys_id,sys_security_acl,sys_user_role,sys_user_role.name', ['sys_user_role.name']);
+            rows.push(...batch.map(row => ({ sysId: row.sys_id, roleSysId: row.sys_user_role, role: row['sys_user_role.name'], acl: row.sys_security_acl })));
+        }
+        return rows;
+    }
+    async records(reader, rows) {
+        const roles = await this.roleRows(reader, rows.map(row => row.sys_id));
+        return rows.map(row => ({
+            sysId: row.sys_id,
+            name: row.name,
+            type: row['type.name'] || row.type,
+            operation: row['operation.name'] || row.operation,
+            active: bool(row.active),
+            adminOverrides: bool(row.admin_overrides),
+            advanced: bool(row.advanced),
+            decisionType: row.decision_type ?? '',
+            description: row.description,
+            condition: row.condition,
+            script: row.script,
+            scope: row.sys_scope,
+            scopeName: row['sys_scope.scope'],
+            updatedOn: row.sys_updated_on,
+            roles: roles.filter(role => role.acl === row.sys_id).map(({ sysId, roleSysId, role }) => ({ sysId, roleSysId, role })),
+        }));
+    }
+    warnings(acl) {
+        const warnings = [];
+        if (acl.roles.length > 1 && acl.roles.some(role => role.role === AUTOMATIC_ROLE)) {
+            warnings.push(`${AUTOMATIC_ROLE} is one of this ACL's roles: any one role passes, so every internal user does.`);
+        }
+        const onlyAutomatic = acl.roles.length > 0 && acl.roles.every(role => role.role === AUTOMATIC_ROLE);
+        if (acl.active && (onlyAutomatic || !acl.roles.length) && !acl.condition && !(acl.advanced && acl.script.trim())) {
+            warnings.push(`This ACL has no role but ${AUTOMATIC_ROLE}, and no condition or script: every internal user passes it.`);
+        }
+        return warnings;
+    }
+}
+//# sourceMappingURL=AclManager.js.map

package/dist/sn/security/AclManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AclManager.js","sourceRoot":"","sources":["../../../src/sn/security/AclManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAe,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAElE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAY,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,MAAM,EAAE,GAAG,iBAAiB,CAAC;AAC7B,MAAM,KAAK,GAAG,oBAAoB,CAAC;AACnC,MAAM,IAAI,GAAG,0BAA0B,CAAC;AACxC,yFAAyF;AACzF,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AACxC,2DAA2D;AAC3D,MAAM,MAAM,GAAG,cAAc,CAAC;AAC9B,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAC/B,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AACzC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,qGAAqG;AACrG,MAAM,cAAc,GAAG,cAAc,CAAC;AACtC,MAAM,WAAW,GAAG,oJAAoJ,CAAC;AAEzK,MAAM,IAAI,GAAG,CAAC,KAAyB,EAAW,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,UAAU;IAGiB;IAF5B,aAAa,CAA+B;IAEpD,YAAoC,SAA6B;QAA7B,cAAS,GAAT,SAAS,CAAoB;IAAG,CAAC;IAE7D,MAAM;QACV,OAAO,IAAI,cAAc,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,0FAA0F;IACnF,KAAK,CAAC,IAAI,CAAC,OAAuB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAC7E,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,KAAK,oBAAoB,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC3G,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9G,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,EAAE,OAAO,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC9J,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrI,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;YACvF,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,8BAA8B;IACvB,KAAK,CAAC,GAAG,CAAC,KAAa;QAC1B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAyB;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACtF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,EAAE,OAAO,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QAClH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,MAAM,GAA0B,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;QACxC,+FAA+F;QAC/F,MAAM,MAAM,GAAG,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI;gBAClH,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,kGAAkG;YAClG,IAAI,eAAe,CAAC,KAAK,CAAC;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/E,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,MAAsB,EAAE,MAA0B,EAAE,KAAa,EAAE,KAA6C,EACvI,MAAe,EAAE,MAAsB,EAAE,MAA6B;QACtE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;YACtC,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9H,CAAC;QACD,MAAM,qBAAqB,GAAa,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACf,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC1B,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,SAAS,CAAC;oBAAE,SAAS;gBAC/D,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;gBACrH,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACf,mHAAmH;YACnH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YACtF,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACvH,CAAC;QACD,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAClG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IAChF,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAyB;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,EAAE,OAAO,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QACtJ,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;YAAE,MAAM,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAC1F,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,qBAAqB,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACvG,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAyB;QACxD,IAAI,OAAO,EAAE,OAAO,KAAK,KAAK;YAAE,MAAM,IAAI,QAAQ,CAAC,uBAAuB,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,MAAM,GAA0B,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC;QACjE,IAAI,CAAC;YACD,IAAI,UAAU;gBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACvG,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,UAAU;gBAAE,MAAM,KAAK,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACvC,+EAA+E;YAC/E,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACvD,8GAA8G;YAC9G,0GAA0G;YAC1G,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9C,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACpG,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,eAAe,CAAC,KAAK,CAAC;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7F,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACzE,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,IAAY,EAAE,MAAsB;QACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5H,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACvE,MAAM,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,qBAAqB,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACvG,CAAC;IAED,qGAAqG;IAC9F,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAY,EAAE,MAAsB;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,MAAM,GAA0B,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1J,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,QAAQ,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,4CAA4C,cAAc,yEAAyE,CAAC,CAAC;QAC1K,CAAC;aAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE,CAAC;YACxH,QAAQ,CAAC,OAAO,CAAC,sBAAsB,cAAc,2EAA2E,CAAC,CAAC;QACtI,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC1E,CAAC;IAEO,MAAM,CAAC,MAAsB;QACjC,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACnH,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClG,CAAC;IAED,iFAAiF;IACzE,MAAM;QACV,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,yCAAyC;IACjC,KAAK,CAAC,KAAK,CAAC,KAAa;QAC7B,IAAI,CAAC;YAAC,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAClF,OAAO,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,CAAC;IACL,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,gBAAgB,CAAC,GAAc,EAAE,MAAsB;QACjE,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACpH,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC1B,IAAI,QAAQ,GAAa,EAAE,CAAC;QAC5B,IAAI,CAAC;YAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;QACxH,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;IACnG,CAAC;IAED,8FAA8F;IACtF,KAAK,CAAC,MAAM,CAAC,MAAsB;QACvC,6DAA6D;QAC7D,IAAI,CAAC,aAAa,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,wBAAwB,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EACpI,CAAC,KAAc,EAAE,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,GAAG,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC/E,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAAsB,EAAE,OAA4C;QAC1F,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAChF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;YAC3G,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;YACnF,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAsB,EAAE,KAAa,EAAE,IAAY,EAAE,OAAiD;QACvH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACtH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAsB,EAAE,IAAY,EAAE,OAAyB;QACjF,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAC7G,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACvH,OAAO,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7G,8EAA8E;QAC9E,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAuB,KAAK,CAAC;QACrC,OAAO,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,GAAkB,MAAM,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,IAAI,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAC/G,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM;YAC7B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QACjE,IAAI,KAAK,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;YACpH,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,MAAsB,EAAE,KAAe;QACvD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QAC5F,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACtD,oGAAoG;YACpG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,MAAsB,EAAE,IAAc;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAqC,EAAE,CAAC;QAClD,yFAAyF;QACzF,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC;YAC3C,6GAA6G;YAC7G,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC/F,0DAA0D,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;YACxF,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;QACtJ,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAsB,EAAE,IAAmB;QAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpB,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI;YAClC,SAAS,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,SAAS;YACjD,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YACxB,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;YACzC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC5B,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE;YACrC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,SAAS;YACpB,SAAS,EAAE,GAAG,CAAC,iBAAiB,CAAC;YACjC,SAAS,EAAE,GAAG,CAAC,cAAc;YAC7B,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;SACzH,CAAC,CAAC,CAAC;IACR,CAAC;IAEO,QAAQ,CAAC,GAAc;QAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE,CAAC;YAC/E,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,gFAAgF,CAAC,CAAC;QACrH,CAAC;QACD,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;QACpG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/G,QAAQ,CAAC,IAAI,CAAC,4BAA4B,cAAc,8DAA8D,CAAC,CAAC;QAC5H,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;CACJ"}

package/dist/sn/security/AclModels.d.ts

@@ -0,0 +1,102 @@
+import type { MetadataScopeRef, MetadataWriteResult, StoreCustomizationOptions } from '../metadata/MetadataModels.js';
+/** A role on an access control (a sys_security_acl_role row). */
+export interface AclRole {
+    /** sys_id of the sys_security_acl_role row. */
+    sysId: string;
+    /** sys_user_role sys_id. */
+    roleSysId: string;
+    /** Role name; '' when the session may not read it: security_admin until elevated, nobody and maint always. */
+    role: string;
+}
+/** An access control as read back from the instance. */
+export interface AclRecord {
+    sysId: string;
+    /** `table`, `table.field` or `table.*` for record ACLs; the resource name for other types. */
+    name: string;
+    /** sys_security_type name: record, ui_page, rest_endpoint, client_callable_script_include, … */
+    type: string;
+    /** sys_security_operation name: read, write, create, delete, execute, … */
+    operation: string;
+    active: boolean;
+    adminOverrides: boolean;
+    /** The script runs only when advanced is true. */
+    advanced: boolean;
+    /** allow or deny; '' on a release without decision types. */
+    decisionType: string;
+    description: string;
+    condition: string;
+    script: string;
+    /** sys_scope sys_id, and its scope name. */
+    scope: string;
+    scopeName: string;
+    updatedOn: string;
+    roles: AclRole[];
+}
+export interface AclListOptions {
+    /** ACLs of this table: the table itself and its fields (`table`, `table.*`, `table.<field>`). */
+    table?: string;
+    /** Exact ACL name. */
+    name?: string;
+    /** Only this application's ACLs: 'global', a scope name or a sys_scope sys_id. */
+    scope?: MetadataScopeRef;
+    operation?: string;
+    type?: string;
+    active?: boolean;
+}
+/** Where a write goes: the application, and the in-progress update set that captures it. */
+export interface AclWriteTarget {
+    /** The ACL's application. */
+    scope: MetadataScopeRef;
+    /** In progress set of that application. The captures follow it; it need not be the user's current set. */
+    updateSet?: string;
+    /** Required when the application is an installed Store application (together with updateSet). */
+    storeCustomization?: StoreCustomizationOptions;
+}
+export interface AclCreateOptions extends AclWriteTarget {
+    /** sys_security_type name. Default record. */
+    type?: string;
+    /** sys_security_operation name, e.g. read, write, create, delete. */
+    operation: string;
+    /** record ACLs: the table, and optionally a field or '*' for every field. */
+    table?: string;
+    field?: string;
+    /** Other types: the resource name (UI page, REST endpoint, script include, …). */
+    name?: string;
+    /** Role names. Any one of them passes the ACL. */
+    roles?: string[];
+    condition?: string;
+    /** Script that sets `answer`; sets advanced, which the script needs to run. */
+    script?: string;
+    /** Default true, as on the form. */
+    adminOverrides?: boolean;
+    /** Default true. */
+    active?: boolean;
+    /** allow (default on the form) or deny. */
+    decisionType?: string;
+    description?: string;
+}
+export interface AclUpdateOptions extends AclWriteTarget {
+    operation?: string;
+    condition?: string;
+    script?: string;
+    adminOverrides?: boolean;
+    active?: boolean;
+    decisionType?: string;
+    description?: string;
+}
+export interface AclDeleteOptions extends AclWriteTarget {
+    /** Must repeat the ACL's sys_id. */
+    confirm: string;
+}
+export interface AclWriteResult {
+    /** The ACL as read back after the change; absent after a delete. */
+    acl?: AclRecord;
+    /** The ACL before the change; absent after a create. */
+    previous?: AclRecord;
+    /** Every verified write, in order (the ACL, its role rows). */
+    writes: MetadataWriteResult[];
+    /** Roles the platform added on its own that the write removed (snc_internal on a new ACL that was given roles). */
+    removedAutomaticRoles: string[];
+    /** Things to look at: e.g. snc_internal left beside other roles, which lets every internal user pass. */
+    warnings: string[];
+}

package/dist/sn/security/AclModels.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=AclModels.js.map

package/dist/sn/security/AclModels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AclModels.js","sourceRoot":"","sources":["../../../src/sn/security/AclModels.ts"],"names":[],"mappings":""}

package/dist/sn/security/RoleElevation.d.ts

@@ -0,0 +1,16 @@
+import { ElevationStatus } from '../../auth/SessionElevation.js';
+import type { ServiceNowInstance } from '../ServiceNowInstance.js';
+/**
+ * Elevation state of the session SessionManager shares for an instance: the one the metadata
+ * writers, AclManager and most managers use.
+ *
+ * To elevate, construct the ServiceNowInstance with `elevatedRoles`: every session then elevates
+ * as it logs in. Elevation is per server session, so elevating one session at runtime would leave
+ * any other session of the process (and any renewed session) without it.
+ */
+export declare class RoleElevation {
+    private readonly _instance;
+    constructor(_instance: ServiceNowInstance);
+    /** The roles the user may elevate to, and which of them the shared session has elevated. */
+    status(): Promise<ElevationStatus>;
+}

package/dist/sn/security/RoleElevation.js

@@ -0,0 +1,22 @@
+import { SessionManager } from '../../comm/http/SessionManager.js';
+import { readElevation } from '../../auth/SessionElevation.js';
+/**
+ * Elevation state of the session SessionManager shares for an instance: the one the metadata
+ * writers, AclManager and most managers use.
+ *
+ * To elevate, construct the ServiceNowInstance with `elevatedRoles`: every session then elevates
+ * as it logs in. Elevation is per server session, so elevating one session at runtime would leave
+ * any other session of the process (and any renewed session) without it.
+ */
+export class RoleElevation {
+    _instance;
+    constructor(_instance) {
+        this._instance = _instance;
+    }
+    /** The roles the user may elevate to, and which of them the shared session has elevated. */
+    async status() {
+        const request = await SessionManager.getInstance().getAuthenticatedRequest(this._instance);
+        return readElevation(await request.getUserSession());
+    }
+}
+//# sourceMappingURL=RoleElevation.js.map

package/dist/sn/security/RoleElevation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleElevation.js","sourceRoot":"","sources":["../../../src/sn/security/RoleElevation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAmB,MAAM,6BAA6B,CAAC;AAG7E;;;;;;;GAOG;AACH,MAAM,OAAO,aAAa;IACc;IAApC,YAAoC,SAA6B;QAA7B,cAAS,GAAT,SAAS,CAAoB;IAAG,CAAC;IAErE,4FAA4F;IACrF,KAAK,CAAC,MAAM;QACf,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3F,OAAO,aAAa,CAAC,MAAM,OAAO,CAAC,cAAc,EAAiB,CAAC,CAAC;IACxE,CAAC;CACJ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sonisoft/now-sdk-ext-core",
-  "version": "6.17.1",
+  "version": "6.18.1",
   "description": "Comprehensive TypeScript library extending ServiceNow SDK with application management, ATF testing, real-time log monitoring, AMB event subscriptions, and automation tools",
   "keywords": [
     "servicenow",