@synoikia/core 0.7.0 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/app.d.ts +2 -0
- package/dist/app.js +2 -0
- package/dist/app.js.map +1 -1
- package/dist/approvals/service.d.ts +2 -0
- package/dist/approvals/service.js +1 -0
- package/dist/approvals/service.js.map +1 -1
- package/dist/auth/mcp-auth.d.ts +5 -0
- package/dist/auth/mcp-auth.js +73 -33
- package/dist/auth/mcp-auth.js.map +1 -1
- package/dist/auth/mcp-tokens.d.ts +7 -3
- package/dist/auth/mcp-tokens.js +15 -4
- package/dist/auth/mcp-tokens.js.map +1 -1
- package/dist/auth/oauth.d.ts +3 -1
- package/dist/auth/oauth.js +2 -1
- package/dist/auth/oauth.js.map +1 -1
- package/dist/auth/oidc.js +3 -2
- package/dist/auth/oidc.js.map +1 -1
- package/dist/auth/roles.d.ts +43 -0
- package/dist/auth/roles.js +164 -0
- package/dist/auth/roles.js.map +1 -0
- package/dist/auth/users.d.ts +26 -1
- package/dist/auth/users.js +109 -12
- package/dist/auth/users.js.map +1 -1
- package/dist/catalog/groups.js +2 -1
- package/dist/catalog/groups.js.map +1 -1
- package/dist/catalog/role-levels.d.ts +67 -0
- package/dist/catalog/role-levels.js +297 -0
- package/dist/catalog/role-levels.js.map +1 -0
- package/dist/catalog/rules.d.ts +33 -9
- package/dist/catalog/rules.js +51 -25
- package/dist/catalog/rules.js.map +1 -1
- package/dist/db/schema.d.ts +566 -0
- package/dist/db/schema.js +64 -0
- package/dist/db/schema.js.map +1 -1
- package/dist/errors.d.ts +5 -2
- package/dist/errors.js +5 -0
- package/dist/errors.js.map +1 -1
- package/dist/gate/access.d.ts +23 -2
- package/dist/gate/access.js +31 -3
- package/dist/gate/access.js.map +1 -1
- package/dist/gate/pipeline.js +10 -1
- package/dist/gate/pipeline.js.map +1 -1
- package/dist/gate/preapproval.d.ts +2 -0
- package/dist/gate/preapproval.js +16 -3
- package/dist/gate/preapproval.js.map +1 -1
- package/dist/http/admin/auth.d.ts +4 -0
- package/dist/http/admin/auth.js +34 -3
- package/dist/http/admin/auth.js.map +1 -1
- package/dist/http/admin/me.d.ts +6 -0
- package/dist/http/admin/me.js +189 -0
- package/dist/http/admin/me.js.map +1 -0
- package/dist/http/admin/roles.d.ts +5 -0
- package/dist/http/admin/roles.js +45 -0
- package/dist/http/admin/roles.js.map +1 -0
- package/dist/http/admin/system.js +9 -6
- package/dist/http/admin/system.js.map +1 -1
- package/dist/http/admin-app.js +13 -2
- package/dist/http/admin-app.js.map +1 -1
- package/dist/http/common.d.ts +1 -1
- package/dist/http/mcp/approval-routes.js +7 -0
- package/dist/http/mcp/approval-routes.js.map +1 -1
- package/dist/http/mcp/endpoint.js +3 -3
- package/dist/http/mcp/endpoint.js.map +1 -1
- package/dist/http/mcp/oauth-routes.js +8 -3
- package/dist/http/mcp/oauth-routes.js.map +1 -1
- package/dist/runtime/index.js +20 -8
- package/dist/runtime/index.js.map +1 -1
- package/dist/settings.d.ts +2 -0
- package/dist/settings.js +4 -0
- package/dist/settings.js.map +1 -1
- package/dist/testing/index.js +2 -1
- package/dist/testing/index.js.map +1 -1
- package/drizzle/0013_user_roles.sql +63 -0
- package/drizzle/0014_user_registration_source.sql +1 -0
- package/drizzle/meta/0013_snapshot.json +2833 -0
- package/drizzle/meta/0014_snapshot.json +2840 -0
- package/drizzle/meta/_journal.json +14 -0
- package/package.json +3 -3
package/dist/catalog/rules.js
CHANGED
|
@@ -2,8 +2,9 @@ import { randomUUID } from 'node:crypto';
|
|
|
2
2
|
import { and, asc, eq } from 'drizzle-orm';
|
|
3
3
|
import { z } from 'zod';
|
|
4
4
|
import { writeAudit } from '../audit.js';
|
|
5
|
-
import { operations, preApprovalRules } from '../db/schema.js';
|
|
5
|
+
import { operations, preApprovalRules, roleInstances, roles, users } from '../db/schema.js';
|
|
6
6
|
import { ConflictError, NotFoundError, ValidationError } from '../errors.js';
|
|
7
|
+
import { FULL_ACCESS } from '../gate/access.js';
|
|
7
8
|
import { MatchSchema } from '../gate/match.js';
|
|
8
9
|
import { resolveAccess } from './groups.js';
|
|
9
10
|
/** Pre-approval rules (design §5.2): from the catalog, with a required reason, structured match and
|
|
@@ -65,26 +66,62 @@ function checkMatchAgainstProfile(manifest, op, match) {
|
|
|
65
66
|
if (misfit)
|
|
66
67
|
throw misfit;
|
|
67
68
|
}
|
|
68
|
-
|
|
69
|
-
|
|
69
|
+
/** Whether some role that has the endpoint can reach the operation at Ask, or lower it to Ask itself. */
|
|
70
|
+
function firesForSomeRole(db, instanceId, key) {
|
|
71
|
+
return db
|
|
72
|
+
.select({ role: roles })
|
|
73
|
+
.from(roleInstances)
|
|
74
|
+
.innerJoin(roles, eq(roleInstances.roleId, roles.id))
|
|
75
|
+
.where(eq(roleInstances.instanceId, instanceId))
|
|
76
|
+
.all()
|
|
77
|
+
.some(({ role }) => {
|
|
78
|
+
const access = resolveAccess(db, instanceId, key, { ceiling: 'write', roleId: role.id });
|
|
79
|
+
return access.reachable && (access.level === 'ask' || (role.canSetOwnLevels && access.level === 'write'));
|
|
80
|
+
});
|
|
81
|
+
}
|
|
82
|
+
function describe(db, instanceId, rule, op, owner) {
|
|
83
|
+
// An own rule fires only where its owner's levels put the operation at Ask (design §6.4).
|
|
84
|
+
const principal = owner ? { ceiling: 'write', roleId: owner.roleId, userId: owner.id } : FULL_ACCESS;
|
|
85
|
+
const access = resolveAccess(db, instanceId, op.key, principal);
|
|
86
|
+
const inert = !rule.enabled
|
|
87
|
+
? null
|
|
88
|
+
: !access.reachable
|
|
89
|
+
? access.reason
|
|
90
|
+
: access.level === 'write'
|
|
91
|
+
? 'level_write'
|
|
92
|
+
: null;
|
|
70
93
|
return {
|
|
71
94
|
...rule,
|
|
95
|
+
owner: owner ? { id: owner.id, username: owner.username } : null,
|
|
72
96
|
operation: { id: op.id, key: op.key, locked: op.locked, matchProfile: op.matchProfile },
|
|
73
|
-
/** Rules only fire at level `ask`; on unreachable or `write` operations they never do (UI flags it).
|
|
74
|
-
|
|
97
|
+
/** Rules only fire at level `ask`; on unreachable or `write` operations they never do (UI flags it).
|
|
98
|
+
* An admin rule is inert only if it is for every role that has the endpoint. */
|
|
99
|
+
inert: inert && !owner && firesForSomeRole(db, instanceId, op.key) ? null : inert,
|
|
75
100
|
};
|
|
76
101
|
}
|
|
77
102
|
export function listRules(db, instanceId) {
|
|
78
103
|
return db
|
|
79
|
-
.select({ rule: preApprovalRules, op: operations })
|
|
104
|
+
.select({ rule: preApprovalRules, op: operations, owner: users })
|
|
80
105
|
.from(preApprovalRules)
|
|
81
106
|
.innerJoin(operations, eq(preApprovalRules.operationId, operations.id))
|
|
107
|
+
.leftJoin(users, eq(preApprovalRules.ownerUserId, users.id))
|
|
82
108
|
.where(eq(preApprovalRules.instanceId, instanceId))
|
|
83
109
|
.orderBy(asc(operations.key), asc(preApprovalRules.createdAt))
|
|
84
110
|
.all()
|
|
85
|
-
.map(({ rule, op }) => describe(db, instanceId, rule, op));
|
|
111
|
+
.map(({ rule, op, owner }) => describe(db, instanceId, rule, op, owner ?? undefined));
|
|
112
|
+
}
|
|
113
|
+
/** A rule as the given owner may touch it: admins (no owner) any rule, a user only their own. */
|
|
114
|
+
function ownedRule(db, instanceId, ruleId, owner) {
|
|
115
|
+
const rule = db
|
|
116
|
+
.select()
|
|
117
|
+
.from(preApprovalRules)
|
|
118
|
+
.where(and(eq(preApprovalRules.id, ruleId), eq(preApprovalRules.instanceId, instanceId)))
|
|
119
|
+
.get();
|
|
120
|
+
if (!rule || (owner !== undefined && rule.ownerUserId !== owner))
|
|
121
|
+
throw new NotFoundError('rule_not_found', 'No such rule');
|
|
122
|
+
return rule;
|
|
86
123
|
}
|
|
87
|
-
export function createRule(db, manifest, instanceId, raw, actor = {}) {
|
|
124
|
+
export function createRule(db, manifest, instanceId, raw, actor = {}, opts = {}) {
|
|
88
125
|
const input = RuleInputSchema.parse(raw);
|
|
89
126
|
const op = loadOperation(db, instanceId, input.operationId);
|
|
90
127
|
if (op.locked)
|
|
@@ -104,6 +141,7 @@ export function createRule(db, manifest, instanceId, raw, actor = {}) {
|
|
|
104
141
|
reason: input.reason,
|
|
105
142
|
enabled: input.enabled,
|
|
106
143
|
createdBy: actor.userId ?? null,
|
|
144
|
+
ownerUserId: opts.owner ?? null,
|
|
107
145
|
createdAt: new Date(),
|
|
108
146
|
})
|
|
109
147
|
.run();
|
|
@@ -114,19 +152,13 @@ export function createRule(db, manifest, instanceId, raw, actor = {}) {
|
|
|
114
152
|
decision: 'rule_created',
|
|
115
153
|
actorKind: 'user',
|
|
116
154
|
actorId: actor.userId,
|
|
117
|
-
detail: { ruleId: id, ...input },
|
|
155
|
+
detail: { ruleId: id, ...input, ...(opts.owner ? { owner: opts.owner } : {}) },
|
|
118
156
|
});
|
|
119
157
|
});
|
|
120
158
|
return listRules(db, instanceId).find((r) => r.id === id);
|
|
121
159
|
}
|
|
122
|
-
export function updateRule(db, manifest, instanceId, ruleId, raw, actor = {}) {
|
|
123
|
-
const before = db
|
|
124
|
-
.select()
|
|
125
|
-
.from(preApprovalRules)
|
|
126
|
-
.where(and(eq(preApprovalRules.id, ruleId), eq(preApprovalRules.instanceId, instanceId)))
|
|
127
|
-
.get();
|
|
128
|
-
if (!before)
|
|
129
|
-
throw new NotFoundError('rule_not_found', 'No such rule');
|
|
160
|
+
export function updateRule(db, manifest, instanceId, ruleId, raw, actor = {}, opts = {}) {
|
|
161
|
+
const before = ownedRule(db, instanceId, ruleId, opts.owner);
|
|
130
162
|
const input = RuleInputSchema.parse({ ...before, ...raw });
|
|
131
163
|
const op = loadOperation(db, instanceId, input.operationId);
|
|
132
164
|
if (op.locked)
|
|
@@ -156,14 +188,8 @@ export function updateRule(db, manifest, instanceId, ruleId, raw, actor = {}) {
|
|
|
156
188
|
});
|
|
157
189
|
return listRules(db, instanceId).find((r) => r.id === ruleId);
|
|
158
190
|
}
|
|
159
|
-
export function deleteRule(db, instanceId, ruleId, actor = {}) {
|
|
160
|
-
const before = db
|
|
161
|
-
.select()
|
|
162
|
-
.from(preApprovalRules)
|
|
163
|
-
.where(and(eq(preApprovalRules.id, ruleId), eq(preApprovalRules.instanceId, instanceId)))
|
|
164
|
-
.get();
|
|
165
|
-
if (!before)
|
|
166
|
-
throw new NotFoundError('rule_not_found', 'No such rule');
|
|
191
|
+
export function deleteRule(db, instanceId, ruleId, actor = {}, opts = {}) {
|
|
192
|
+
const before = ownedRule(db, instanceId, ruleId, opts.owner);
|
|
167
193
|
db.transaction((tx) => {
|
|
168
194
|
tx.delete(preApprovalRules).where(eq(preApprovalRules.id, ruleId)).run();
|
|
169
195
|
writeAudit(tx, {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/catalog/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/catalog/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;uGACuG;AAEvG,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;SACnB,QAAQ,EAAE;SACV,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC;AAOH,SAAS,aAAa,CAAC,EAAM,EAAE,UAAkB,EAAE,WAAmB;IACpE,MAAM,EAAE,GAAG,EAAE;SACV,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;SACjF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;IAC9F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,WAAW,CACzB,QAAqD,EACrD,EAA8C,EAC9C,KAAyB;IAEzB,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,8CAA8C,CAAC,CAAC;IACtH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,iGAAiG;QACjG,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK;YAAE,SAAS;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,KAAK,gCAAgC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7D,OAAO,IAAI,eAAe,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,kBAAkB,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,OAAO,GACV,KAAK,CAAC,OAAO,EAAE,MAA+B,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,IAAI,eAAe,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,GAAG,6BAA6B,OAAO,GAAG,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAkB,EAAE,EAAgB,EAAE,KAAyB;IAC/F,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM;QAAE,MAAM,MAAM,CAAC;AAC3B,CAAC;AAED,yGAAyG;AACzG,SAAS,gBAAgB,CAAC,EAAM,EAAE,UAAkB,EAAE,GAAW;IAC/D,OAAO,EAAE;SACN,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SACvB,IAAI,CAAC,aAAa,CAAC;SACnB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;SACpD,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC/C,GAAG,EAAE;SACL,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,QAAQ,CAAC,EAAM,EAAE,UAAkB,EAAE,IAAa,EAAE,EAAgB,EAAE,KAAe;IAC5F,0FAA0F;IAC1F,MAAM,SAAS,GAAoB,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IACtH,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO;QACzB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS;YACjB,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO;gBACxB,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,IAAI,CAAC;IACb,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI;QAChE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE;QACvF;wFACgF;QAChF,KAAK,EAAE,KAAK,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;KAClF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAM,EAAE,UAAkB;IAClD,OAAO,EAAE;SACN,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;SAChE,IAAI,CAAC,gBAAgB,CAAC;SACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;SACtE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;SAC3D,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;SAC7D,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,iGAAiG;AACjG,SAAS,SAAS,CAAC,EAAM,EAAE,UAAkB,EAAE,MAAc,EAAE,KAAc;IAC3E,MAAM,IAAI,GAAG,EAAE;SACZ,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;SACxF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC;QAC9D,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,EAAM,EACN,QAAkB,EAClB,UAAkB,EAClB,GAAY,EACZ,QAA6B,EAAE,EAC/B,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,0CAA0C,CAAC,CAAC;IAChH,wBAAwB,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;aACxB,MAAM,CAAC;YACN,EAAE;YACF,UAAU;YACV,WAAW,EAAE,EAAE,CAAC,EAAE;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACrE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC/B,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,GAAG,EAAE,CAAC;QACT,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,YAAY,EAAE,EAAE,CAAC,GAAG;YACpB,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SAC/E,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,EAAM,EACN,QAAkB,EAClB,UAAkB,EAClB,MAAc,EACd,GAAY,EACZ,QAA6B,EAAE,EAC/B,OAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,GAAI,GAAc,EAAE,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,0CAA0C,CAAC,CAAC;IAChH,wBAAwB,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG;QACV,WAAW,EAAE,EAAE,CAAC,EAAE;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACrE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClF,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,YAAY,EAAE,EAAE,CAAC,GAAG;YACpB,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE;SACvC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,EAAM,EACN,UAAkB,EAClB,MAAc,EACd,QAA6B,EAAE,EAC/B,OAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACzE,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
|