@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/security/authorizations/services/authorizations.backend.service.d.ts

@@ -40,8 +40,16 @@ export declare class AuthorizationsBackendService {
      *
      * Emission is deliberately BEST-EFFORT and can never alter the authorization outcome: the caller
      * has already been refused by the time this is consulted, so letting an audit-store problem turn
-     * a correct 403 into a 500 would degrade the system to protect a log. Detection of that gap is
-     * the audit pipeline's own control (`audit_store_failure_total`), not this gate's.
+     * a correct 403 into a 500 would degrade the system to protect a log.
+     *
+     * Detection of the resulting gap is SPLIT, and an earlier revision of this paragraph got it
+     * wrong by naming only half. It said detection was "the audit pipeline's own control
+     * (`audit_store_failure_total`), not this gate's" — true of a store that REFUSED a write it
+     * received, and false of the case this gate actually produces most often, where the audit
+     * service is unbound and `_createAuditLog` is never reached at all. This gate now counts its own
+     * drops into `audit_observation_dropped_total` through
+     * `~wildo-backend-lib/monitoring/observability/audit-observation-emission.backend`; the store's
+     * control is unchanged and still owns the shape it can see.
      *
      * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
      */
@@ -79,8 +87,16 @@ export declare class AuthorizationsBackendService {
      *
      * Emission is deliberately BEST-EFFORT and can never alter the authorization outcome: the caller
      * has already been refused by the time this is consulted, so letting an audit-store problem turn
-     * a correct 403 into a 500 would degrade the system to protect a log. Detection of that gap is
-     * the audit pipeline's own control (`audit_store_failure_total`), not this gate's.
+     * a correct 403 into a 500 would degrade the system to protect a log.
+     *
+     * Detection of the resulting gap is SPLIT, and an earlier revision of this paragraph got it
+     * wrong by naming only half. It said detection was "the audit pipeline's own control
+     * (`audit_store_failure_total`), not this gate's" — true of a store that REFUSED a write it
+     * received, and false of the case this gate actually produces most often, where the audit
+     * service is unbound and `_createAuditLog` is never reached at all. This gate now counts its own
+     * drops into `audit_observation_dropped_total` through
+     * `~wildo-backend-lib/monitoring/observability/audit-observation-emission.backend`; the store's
+     * control is unchanged and still owns the shape it can see.
      *
      * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
      */
@@ -106,6 +122,26 @@ export declare class AuthorizationsBackendService {
     getOrgRoles(): RolesConfiguration;
     hasAppRole(roleKey: AppRoles): boolean;
     hasOrgRole(roleKey: OrgRoles): boolean;
+    /**
+     * Does holding `heldRoleKey` in `scope` satisfy a gate that requires `requiredRoleKey`?
+     *
+     * Delegates to {@link roleConfersAuthority}, which is the ONE derivation this repository has of
+     * that question — the same atom the authority floors measure their protected populations with.
+     *
+     * Sharing it is not tidiness. The atom is where the SCOPE PARTITION is consulted, and the partition
+     * is the entire reason an application-scope role string written into an organisation-scoped
+     * membership row confers nothing: the key is unknown in the passed table, so its chain is EMPTY.
+     * That safety comes from RESOLUTION rather than from the field's type, and every separate copy of
+     * these two lines is another place the argument can quietly stop holding. It was written out four
+     * times — twice in this class's own admission paths, once in the platform-authority check, and once
+     * inside the floors' shared derivation — which is the defect shape
+     * `.claude/rules/invariant-call-site-enumeration.md` exists for.
+     *
+     * The floors' derivation and these gates still ask DIFFERENT questions and keep different shapes:
+     * a floor quantifies over the declared role TABLE and returns a set, a gate quantifies over the
+     * roles a CALLER holds and returns a boolean. Only the atom is shared.
+     */
+    private roleConfersAuthority;
     getRoleHierarchy(roleKey: Roles, scope: ResourcePrimaryScope): string[];
     resetRolesToDefaults(): void;
     /**
@@ -221,6 +257,58 @@ export declare class AuthorizationsBackendService {
      */
     private operationDeclaresPublicAccess;
     authorizeInRepositoryAndService(id_or_ids: IdOrIdsOrFilterType, operation: ResourceConfiguration_Operation<any, any, any>, executionContext: ExecutionContext<any>): Promise<void>;
+    /**
+     * The core operation this call actually EXECUTES.
+     *
+     * `resourceOperationLike ?? operationIdentifier` — the derivation the controller tier, the batch
+     * dispatcher and the response serializer all already use. A custom verb declares which core
+     * operation it borrows persistence from (`approve` is UPDATE-like, `requestAccess` is CREATE-like),
+     * and without that indirection a custom READ-like verb would be invisible to every core-operation
+     * predicate in the system.
+     */
+    private resolveExecutedCoreOperation;
+    /**
+     * Refuse an APPLICATION-WIDE read unless the caller holds a usable, second-signed elevation.
+     *
+     * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — the widest read is admitted only
+     * under an elevation, on the same terms the narrowest one already was.
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+     *
+     * ## Why it runs LAST
+     *
+     * After the role gate, deliberately. A caller who does not hold the administrator role must be
+     * refused with `INSUFFICIENT_ROLES` and learn nothing about the elevation mechanism; only a caller
+     * who WOULD have been admitted before this change reaches the new refusal. That also keeps the two
+     * reasons countable: `APPLICATION_WIDE_ELEVATION_MISSING` measures exactly the standing privilege
+     * this removes, and nothing else.
+     *
+     * ## Why it is stamped on the CONTEXT
+     *
+     * The observation seams run in the service registry, AFTER the rows are in hand, and they emit the
+     * evidence. Stashing the authorizing grant id here is what lets that evidence NAME the elevation —
+     * the same mechanism `admitsCrossTenantPlatformAdministration` already uses for the per-row
+     * crossing. On the CONTEXT and never on the service: the authorizer is a singleton, and a field
+     * here would leak one request's grant onto another's audit row under concurrency.
+     */
+    private enforceApplicationWideReadAdmission;
+    /**
+     * Is there a live application-wide elevation for this operator?
+     *
+     * The sibling of {@link hasUsablePlatformAccessGrant}, and deliberately NOT a parameterisation of
+     * it: that one keys on `(operator, TENANT)` and answers `false` on an empty tenant, which is
+     * exactly the structural fact that made this resource necessary. A shared helper taking an optional
+     * tenant would make "no tenant supplied" mean two opposite things depending on which resource was
+     * being read — the kind of overload that fails open the first time a caller forgets an argument.
+     *
+     * Read on a SYSTEM context: the grants are APPLICATION-scoped and the caller's own contextual
+     * filter is not what decides whether their elevation exists. **Fails CLOSED** — a read error, an
+     * unbound repository, a missing resource all answer "no elevation", because the alternative would
+     * let an operator restore standing access by breaking the grant store.
+     *
+     * Returns the GRANT ID so the evidence can name the elevation; `true` remains possible only for a
+     * grant with no `_id`, which the repository does not produce.
+     */
+    private hasUsableApplicationAccessGrant;
     /**
      * Resolve the effective scope at runtime.
      * For isAnonymizable resources (primaryScope: USER_SELF), the effective scope
@@ -240,7 +328,7 @@ export declare class AuthorizationsBackendService {
      * `USERS` is a self-anchor scope root, so its `resourcePrimaryScope` IS `USER_SELF` and every
      * USERS operation lands here. Without an admission this check made the whole administrative
      * surface self-only: `assign_roles`, `revoke_roles`, `suspend_user`, `unsuspend_user`,
-     * `force_password_reset`, the admin READ and the core UPDATE/DELETE all refused against another
+     * `reactivate_user`, `force_password_reset`, the admin READ and the core UPDATE/DELETE all refused against another
      * user, contradicting both the resource specification and the admin UI that surfaces them as
      * per-row actions.
      *
@@ -360,9 +448,30 @@ export declare class AuthorizationsBackendService {
      *
      * Fire-and-forget by construction: no `await`, and the promise's rejection is swallowed. An
      * operator's request must not fail because the audit sink is down, and a fail-closed variant would
-     * hand anyone a way to disable operator support by breaking the sink.
+     * hand anyone a way to disable operator support by breaking the sink. That contract is unchanged
+     * and must stay unchanged.
+     *
+     * ## The loss is COUNTED — added 2026-09-09
+     *
+     * Fire-and-forget was the right trade and it was shipped without the other half: nothing recorded
+     * the drops, so an empty operator-crossing trail read identically whether no operator crossed a
+     * boundary or the audit service had been unbound since boot. That is the property that makes the
+     * evidence worthless, and it is the shape
+     * `.claude/rules/negative-results-require-a-positive-probe.md` names — an empty result is evidence
+     * about the pipeline, never about the world.
+     *
+     * Every emission now goes through {@link emitAuditObservation}, which counts an unavailable
+     * service, a synchronous throw and a rejected promise into `audit_observation_dropped_total` and
+     * logs one throttled `error` line per loss shape. It never throws and never awaits, so the
+     * contract above is preserved exactly — read that seam's header before changing anything here.
+     *
+     * **Do not restore the "`audit_store_failure_total` covers this" reading.** It does not, and that
+     * claim was carried at three sites in this package: that counter lives INSIDE
+     * `AuditLogsBackendService._createAuditLog`, so it only ever sees an emission that reached the
+     * audit service. The three shapes counted here never get that far.
      *
      * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION
+     * assurance-control: WILDO.AUDIT.SECURITY_EVENT — the loss of this evidence is itself detectable.
      */
     private recordCrossTenantAdministrativeAccess;
     /**
@@ -458,6 +567,21 @@ export declare class AuthorizationsBackendService {
      * for why this cannot be a constructor injection.
      */
     private resolveAuditLogsService;
+    /**
+     * Lazy getter for the metrics recorder behind {@link emitAuditObservation}'s loss counter.
+     *
+     * Resolved from the container rather than constructor-injected for the SAME reason the audit
+     * service is (see the `container` param's JSDoc) — but a weaker one: `MetricsService` has a
+     * zero-argument constructor and closes no dependency cycle. What the lazy form actually buys is
+     * that every partial-container test and every positional construction keeps working unchanged,
+     * which is the property this class's whole optional-dependency tail is built around.
+     *
+     * Wrapped, because this runs on the observation path: a container that throws while resolving a
+     * binding must not be able to fail the request the observation is about. Returning `undefined`
+     * degrades the loss signal to its log channel, which is the correct direction — an observability
+     * gap is never a reason to refuse.
+     */
+    private resolveMetricsService;
     /**
      * Record a refusal as a `RESOURCE_OPERATION_DENIED` audit event.
      *
@@ -487,11 +611,25 @@ export declare class AuthorizationsBackendService {
      * ## Never affects the outcome
      *
      * Every path here is swallowed. The caller has already been correctly refused; an audit-store
-     * problem must not convert that clean refusal into a 500. Detection of a lost row is the audit
-     * pipeline's own control (`audit_store_failure_total`), not this gate's.
+     * problem must not convert that clean refusal into a 500. That stays true.
+     *
+     * ## But the swallow is now COUNTED — corrected 2026-09-09
+     *
+     * This paragraph used to end "detection of a lost row is the audit pipeline's own control
+     * (`audit_store_failure_total`), not this gate's", and that was **false for the shape this method
+     * loses most often**. That counter lives inside `AuditLogsBackendService._createAuditLog`, so it
+     * only ever sees an emission that reached the audit service. When the service is unbound — a
+     * partial DI binding, a host binding an older audit service — this method returned in silence and
+     * NOTHING anywhere recorded that every refusal in the deployment was going unaudited.
+     *
+     * Both exits now report into `audit_observation_dropped_total` via `recordAuditObservationLoss`.
+     * Three paths deliberately do NOT: an absent `operation` (nothing was owed), the `AUDIT_LOGS`
+     * recursion guard, and a dedup decision of `shouldEmit: false`. Each is a suppression the design
+     * asked for, and a loss counter that fires on correct behaviour is one operators learn to ignore.
      *
      * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — the negative access decision is
      * recorded, attributable, and carries the authority context needed to review it.
+     * assurance-control: WILDO.AUDIT.SECURITY_EVENT — and its LOSS is detectable rather than silent.
      */
     private emitAuthorizationDenialAudit;
     /**

package/dist/esm/security/authorizations/services/authorizations.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorizations.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authorizations/services/authorizations.backend.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAEhI,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAC1G,OAAO,EACL,+BAA+B,EAQ/B,oBAAoB,EAMpB,kBAAkB,EAClB,cAAc,EAGd,KAAK,EACL,QAAQ,EACR,QAAQ,EAKT,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAGvG,qBACa,4BAA4B;IAUF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACd,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACpG;;;;;;OAMG;IAC6D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACnG;;;;OAIG;IACkD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IACnF;;;;;;;;;;;;;;;;;;;OAmBG;IAC8B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IA5C9D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAGxF,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAqB;gBAGiB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACzB,oBAAoB,EAAE,yCAAyC;IAC/I;;;;;;OAMG;IAC8E,iBAAiB,CAAC,EAAE,+BAA+B;IACpI;;;;OAIG;IACmE,YAAY,CAAC,EAAE,YAAY;IACjG;;;;;;;;;;;;;;;;;;;OAmBG;IAC+C,SAAS,CAAC,EAAE,SAAS;IAUzE;;OAEG;IACH,OAAO,CAAC,eAAe;IAavB;;OAEG;IACI,yBAAyB,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAIvE;;OAEG;IACH,OAAO,CAAC,cAAc;IA4Cf,sBAAsB,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAI7D,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAanE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAanE,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS;IAIzD,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS;IAIzD,WAAW,IAAI,kBAAkB;IAIjC,WAAW,IAAI,kBAAkB;IAIjC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO;IAItC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO;IAItC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,MAAM,EAAE;IAavE,oBAAoB,IAAI,IAAI;IAKnC;;OAEG;IACI,8BAA8B,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAK5E;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACU,0CAA0C,CACrD,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;YAIF,wCAAwC;IAiEtD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH;;;;;;;;;;;;;;;;;OAiBG;YACW,iCAAiC;YAkBjC,2BAA2B;IA+BzC;;;;;;;OAOG;IACH,OAAO,CAAC,2BAA2B;IAKnC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,6BAA6B;IAIxB,+BAA+B,CAAC,SAAS,EAAG,mBAAmB,EAAE,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA4WhM;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAU7B;;OAEG;YACW,gCAAgC;IAyC9C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,iBAAiB;IA6D/B;;OAEG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;YACW,uCAAuC;IAgDrD;;;;;;;;;OASG;IACH;;;;;;;OAOG;YACW,iCAAiC;YASjC,4BAA4B;IA4C1C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,6BAA6B;IAOrC,gGAAgG;IAChG,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,qCAAqC;IA8C7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,OAAO,CAAC,2BAA2B;YAarB,sBAAsB;IA8FpC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,+BAA+B;IAQvC;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,oBAAoB;IA4DlC;;;;OAIG;YACW,kBAAkB;IAchC;;OAEG;YACW,sBAAsB;IA0FpC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAK/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;YACW,4BAA4B;IA+E1C;;;;;;OAMG;YACW,qBAAqB;IAkBnC;;;;;;;;;;;;;OAaG;IACH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,2BAA2B,CACtC,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAKH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCpI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgFG;IACU,8BAA8B,CACzC,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;;;;OASG;YACW,4BAA4B;IAmE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,4BAA4B;IA0E1C;;;;;;;;OAQG;YACW,yBAAyB;IAoPvC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,qBAAqB;CAc9B"}
+{"version":3,"file":"authorizations.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/services/authorizations.backend.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAEhI,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAC1G,OAAO,EACL,+BAA+B,EAQ/B,oBAAoB,EAMpB,kBAAkB,EAClB,cAAc,EAGd,KAAK,EACL,QAAQ,EACR,QAAQ,EAKT,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAY3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAGvG,qBACa,4BAA4B;IAUF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACd,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACpG;;;;;;OAMG;IAC6D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACnG;;;;OAIG;IACkD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IACnF;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IAC8B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IApD9D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAGxF,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAqB;gBAGiB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACzB,oBAAoB,EAAE,yCAAyC;IAC/I;;;;;;OAMG;IAC8E,iBAAiB,CAAC,EAAE,+BAA+B;IACpI;;;;OAIG;IACmE,YAAY,CAAC,EAAE,YAAY;IACjG;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IAC+C,SAAS,CAAC,EAAE,SAAS;IAUzE;;OAEG;IACH,OAAO,CAAC,eAAe;IAavB;;OAEG;IACI,yBAAyB,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAIvE;;OAEG;IACH,OAAO,CAAC,cAAc;IAuDf,sBAAsB,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAI7D,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAanE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAanE,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS;IAIzD,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS;IAIzD,WAAW,IAAI,kBAAkB;IAIjC,WAAW,IAAI,kBAAkB;IAIjC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO;IAItC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO;IAI7C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,oBAAoB;IASrB,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,MAAM,EAAE;IAavE,oBAAoB,IAAI,IAAI;IAKnC;;OAEG;IACI,8BAA8B,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAK5E;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACU,0CAA0C,CACrD,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;YAIF,wCAAwC;IAiEtD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH;;;;;;;;;;;;;;;;;OAiBG;YACW,iCAAiC;YAkBjC,2BAA2B;IA+BzC;;;;;;;OAOG;IACH,OAAO,CAAC,2BAA2B;IAKnC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,6BAA6B;IAIxB,+BAA+B,CAAC,SAAS,EAAG,mBAAmB,EAAE,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAmXhM;;;;;;;;OAQG;IACH,OAAO,CAAC,4BAA4B;IAWpC;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,mCAAmC;IAmCjD;;;;;;;;;;;;;;;;OAgBG;YACW,+BAA+B;IA+B7C;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAU7B;;OAEG;YACW,gCAAgC;IAyC9C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,iBAAiB;IA6D/B;;OAEG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;YACW,uCAAuC;IA+CrD;;;;;;;;;OASG;IACH;;;;;;;OAOG;YACW,iCAAiC;YASjC,4BAA4B;IA4C1C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,6BAA6B;IAOrC,gGAAgG;IAChG,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,OAAO,CAAC,qCAAqC;IA8D7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,OAAO,CAAC,2BAA2B;YAarB,sBAAsB;IA8FpC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,+BAA+B;IAQvC;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,oBAAoB;IAoFlC;;;;OAIG;YACW,kBAAkB;IAchC;;OAEG;YACW,sBAAsB;IAsFpC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAK/B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;YACW,4BAA4B;IAgI1C;;;;;;OAMG;YACW,qBAAqB;IAkBnC;;;;;;;;;;;;;OAaG;IACH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,2BAA2B,CACtC,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAKH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCpI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgFG;IACU,8BAA8B,CACzC,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;;;;OASG;YACW,4BAA4B;IAyE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,4BAA4B;IA0E1C;;;;;;;;OAQG;YACW,yBAAyB;IAoPvC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,qBAAqB;CAW9B"}