ysk-server-shared 1.0.0

package/README.md

@@ -0,0 +1,16 @@
+# ysk-server-shared
+
+Shared types, DTOs, locales, and helpers for **[YSK Server](https://www.npmjs.com/package/ysk-server)**.
+
+Most users should install the product only:
+
+```bash
+npm install -g ysk-server
+```
+
+| | |
+|--|--|
+| **Source** | [github.com/yanshekki/ysk-server](https://github.com/yanshekki/ysk-server) (`packages/shared`) |
+| **License** | MIT |
+| **Product** | [ysk-server](https://www.npmjs.com/package/ysk-server) |
+| **Sibling** | [ysk-server-core](https://www.npmjs.com/package/ysk-server-core) |

package/dist/ai.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AI task planner surfaces — API contract (LLM untrusted).
+ */
+export interface AiTaskStepDto {
+    id: string;
+    tool: string;
+    status: string;
+    requiresApproval: boolean;
+    error?: string;
+}
+export interface AiTaskDto {
+    id: string;
+    prompt: string;
+    status: string;
+    planSummary: string;
+    steps: AiTaskStepDto[];
+}
+export interface PlaybookSummaryDto {
+    id: string;
+    name: string;
+    description: string;
+}
+export type AiTask = AiTaskDto;
+export type PlaybookSummary = PlaybookSummaryDto;
+//# sourceMappingURL=ai.d.ts.map

package/dist/ai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai.d.ts","sourceRoot":"","sources":["../src/ai.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,MAAM,GAAG,SAAS,CAAC;AAC/B,MAAM,MAAM,eAAe,GAAG,kBAAkB,CAAC"}

package/dist/ai.js

@@ -0,0 +1,5 @@
+/**
+ * AI task planner surfaces — API contract (LLM untrusted).
+ */
+export {};
+//# sourceMappingURL=ai.js.map

package/dist/ai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai.js","sourceRoot":"","sources":["../src/ai.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/browser.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Browser-safe entry for ysk-server-shared.
+ * No node:fs / node:async_hooks — web must import only this surface.
+ */
+export * from './types.js';
+export * from './dto.js';
+export * from './ops.js';
+export * from './migrate.js';
+export * from './cdn.js';
+export * from './metrics.js';
+export * from './network.js';
+export * from './system.js';
+export * from './databases.js';
+export * from './ftp.js';
+export * from './files.js';
+export * from './email-domain.js';
+export * from './fleet.js';
+export * from './software.js';
+export * from './ssl.js';
+export * from './updates.js';
+export * from './ai.js';
+export * from './capabilities.js';
+export * from './route-capabilities.js';
+export * from './service-ports.js';
+/** Unified list search/filter (browser-safe pure helpers) */
+export * from './list-query.js';
+/** Locale helpers only (no server t()/tl() loaders) */
+export { type LocaleCode, LOCALES, DEFAULT_LOCALE, RTL_LOCALES, LOCALE_LABELS, normalizeLocale, isRtlLocale, localeFromAcceptLanguage, } from './i18n/normalize-locale.js';
+/**
+ * Error codes as constants only — YskError / yskError / tl live on the Node entry.
+ * Web UI should not construct server errors.
+ */
+export { ErrorCodes, type ErrorCode } from './errors-codes.js';
+//# sourceMappingURL=browser.d.ts.map

package/dist/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,6DAA6D;AAC7D,cAAc,iBAAiB,CAAC;AAEhC,uDAAuD;AACvD,OAAO,EACL,KAAK,UAAU,EACf,OAAO,EACP,cAAc,EACd,WAAW,EACX,aAAa,EACb,eAAe,EACf,WAAW,EACX,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AAEpC;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/browser.js

@@ -0,0 +1,34 @@
+/**
+ * Browser-safe entry for ysk-server-shared.
+ * No node:fs / node:async_hooks — web must import only this surface.
+ */
+export * from './types.js';
+export * from './dto.js';
+export * from './ops.js';
+export * from './migrate.js';
+export * from './cdn.js';
+export * from './metrics.js';
+export * from './network.js';
+export * from './system.js';
+export * from './databases.js';
+export * from './ftp.js';
+export * from './files.js';
+export * from './email-domain.js';
+export * from './fleet.js';
+export * from './software.js';
+export * from './ssl.js';
+export * from './updates.js';
+export * from './ai.js';
+export * from './capabilities.js';
+export * from './route-capabilities.js';
+export * from './service-ports.js';
+/** Unified list search/filter (browser-safe pure helpers) */
+export * from './list-query.js';
+/** Locale helpers only (no server t()/tl() loaders) */
+export { LOCALES, DEFAULT_LOCALE, RTL_LOCALES, LOCALE_LABELS, normalizeLocale, isRtlLocale, localeFromAcceptLanguage, } from './i18n/normalize-locale.js';
+/**
+ * Error codes as constants only — YskError / yskError / tl live on the Node entry.
+ * Web UI should not construct server errors.
+ */
+export { ErrorCodes } from './errors-codes.js';
+//# sourceMappingURL=browser.js.map

package/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,6DAA6D;AAC7D,cAAc,iBAAiB,CAAC;AAEhC,uDAAuD;AACvD,OAAO,EAEL,OAAO,EACP,cAAc,EACd,WAAW,EACX,aAAa,EACb,eAAe,EACf,WAAW,EACX,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AAEpC;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAkB,MAAM,mBAAmB,CAAC"}

package/dist/bt-tracker.d.ts

@@ -0,0 +1,56 @@
+/**
+ * BitTorrent tracker + seeder settings / status DTOs (panel + API + CLI).
+ */
+export type BtTrackerSettings = {
+    /** Bind address for tracker HTTP/WS (default 0.0.0.0 when public; often 127.0.0.1 private) */
+    listenHost: string;
+    /** HTTP + WebSocket tracker port (default 8000) */
+    httpPort: number;
+    /** UDP tracker port; 0 = disabled (default 0) */
+    udpPort: number;
+    /** Enable WebSocket tracker for browser WebTorrent */
+    wsEnabled: boolean;
+    /** Start with control plane / on demand */
+    autostart: boolean;
+    /**
+     * Public base used in magnet announce list (host:port or full URL prefix).
+     * Empty = derive from request host / endpoint hint at create time.
+     */
+    publicAnnounceHost: string;
+    /** Max concurrent seeded shares */
+    maxSeeds: number;
+    /** Peer listen port range start for seeder (inclusive) */
+    seederPortMin: number;
+    /** Peer listen port range end (inclusive) */
+    seederPortMax: number;
+};
+export declare const DEFAULT_BT_TRACKER_SETTINGS: BtTrackerSettings;
+export type BtTrackerStatus = {
+    installed: boolean;
+    running: boolean;
+    pid: number | null;
+    settings: BtTrackerSettings;
+    /** http://host:port/announce style hints */
+    announceUrls: string[];
+    executeEnabled: boolean;
+    isRoot: boolean;
+    notes: string[];
+    stats?: {
+        torrents: number;
+        peers: number;
+        announces?: number;
+    };
+    startedAt?: string | null;
+};
+export type BtTrackerTorrentRow = {
+    infoHash: string;
+    name?: string;
+    seeders: number;
+    leechers: number;
+    completed?: number;
+    shareId?: string;
+    seedStatus?: string;
+    uploadSpeed?: number;
+    downloadSpeed?: number;
+};
+//# sourceMappingURL=bt-tracker.d.ts.map

package/dist/bt-tracker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bt-tracker.d.ts","sourceRoot":"","sources":["../src/bt-tracker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8FAA8F;IAC9F,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,SAAS,EAAE,OAAO,CAAC;IACnB,2CAA2C;IAC3C,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,iBAUzC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,4CAA4C;IAC5C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC"}

package/dist/bt-tracker.js

@@ -0,0 +1,15 @@
+/**
+ * BitTorrent tracker + seeder settings / status DTOs (panel + API + CLI).
+ */
+export const DEFAULT_BT_TRACKER_SETTINGS = {
+    listenHost: '0.0.0.0',
+    httpPort: 8000,
+    udpPort: 0,
+    wsEnabled: true,
+    autostart: false,
+    publicAnnounceHost: '',
+    maxSeeds: 32,
+    seederPortMin: 6881,
+    seederPortMax: 6889,
+};
+//# sourceMappingURL=bt-tracker.js.map

package/dist/bt-tracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bt-tracker.js","sourceRoot":"","sources":["../src/bt-tracker.ts"],"names":[],"mappings":"AAAA;;GAEG;AA0BH,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,UAAU,EAAE,SAAS;IACrB,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,KAAK;IAChB,kBAAkB,EAAE,EAAE;IACtB,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,IAAI;IACnB,aAAa,EAAE,IAAI;CACpB,CAAC"}

package/dist/capabilities.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Adjustable multi-level RBAC — capability catalog + factory defaults.
+ * Browser-safe (no Node APIs). Single source for server enforce + web UI.
+ */
+import type { OperationLevel, SystemRole } from './types.js';
+/** Stable capability ids used in API, policies, and UI. */
+export type CapabilityId = 'dashboard.read' | 'logs.read' | 'metrics.read' | 'projects.read' | 'mail.read' | 'dns.read' | 'ssl.read' | 'backups.read' | 'updates.read' | 'services.read' | 'firewall.read' | 'approvals.view' | 'users.self' | 'projects.write' | 'mail.write' | 'db.write' | 'ssl.upload' | 'files.project' | 'approvals.respond' | 'cron.manage' | 'backups.run' | 'services.control' | 'updates.apply' | 'dns.apply' | 'ssl.issue' | 'publish.apply' | 'firewall.edit' | 'mail.apply' | 'runtime.tuning' | 'mysql.console.write' | 'projects.delete' | 'db.drop' | 'backups.restore' | 'firewall.flush' | 'logs.purge' | 'users.manage' | 'packages.manage' | 'users.impersonate' | 'security.policy' | 'rbac.policy' | 'settings.system' | 'network.browse' | 'network.vpn' | 'network.vnc' | 'audit.export' | 'security.api_keys.admin';
+export interface CapabilityDef {
+    id: CapabilityId;
+    /** Danger band — used for maxLevel filter + UI grouping */
+    band: OperationLevel;
+    /** i18n key under rbac.cap.* */
+    labelKey: string;
+}
+/** Bump when factory grants change so dirty merge can reason about versions. */
+export declare const RBAC_DEFAULTS_VERSION = 1;
+export declare const OPERATION_LEVELS: OperationLevel[];
+export declare const SYSTEM_ROLES: SystemRole[];
+/** Full catalog — add new capabilities here first. */
+export declare const CAPABILITY_CATALOG: readonly CapabilityDef[];
+export declare function isCapabilityId(value: string): value is CapabilityId;
+export declare function getCapabilityDef(id: CapabilityId): CapabilityDef | undefined;
+export declare function capabilitiesInBand(band: OperationLevel): CapabilityId[];
+export declare function capabilitiesUpToLevel(maxLevel: OperationLevel): CapabilityId[];
+export declare function levelRank(level: OperationLevel): number;
+export declare function compareLevels(a: OperationLevel, b: OperationLevel): number;
+/** Persisted / API shape for one role's policy */
+export interface RolePolicy {
+    maxLevel: OperationLevel;
+    /** Explicit grants (after maxLevel filter on write) */
+    capabilities: CapabilityId[];
+    /** When set, diverged from factory for this defaultsVersion */
+    defaultsVersion?: number;
+}
+/** Factory max level per role */
+export declare const ROLE_FACTORY_MAX_LEVEL: Record<SystemRole, OperationLevel>;
+/** Code-level factory defaults — restore target */
+export declare function factoryRolePolicy(role: SystemRole): RolePolicy;
+export declare function factoryRolePolicies(): Record<SystemRole, RolePolicy>;
+/** Normalize + filter caps by maxLevel; drop unknown ids */
+export declare function normalizeRolePolicy(input: {
+    maxLevel?: OperationLevel;
+    capabilities?: string[];
+}): RolePolicy;
+/** Whether policy matches factory for role (order-independent) */
+export declare function isFactoryPolicy(role: SystemRole, policy: RolePolicy): boolean;
+/**
+ * Resolve stored policy against current factory.
+ * - missing / exact factory / pure subset of factory (same maxLevel) → full factory, not dirty
+ *   (auto-picks new catalog caps after defaultsVersion bumps without re-adding intentional extras)
+ * - otherwise keep stored list as dirty custom policy
+ */
+export declare function resolveRolePolicy(role: SystemRole, stored: RolePolicy | null | undefined): {
+    policy: RolePolicy;
+    dirty: boolean;
+};
+/**
+ * Critical privilege set that must never be fully removed from the panel
+ * (at least one non-suspended holder must keep these).
+ */
+export declare const CRITICAL_PRIVILEGE_CAPS: readonly CapabilityId[];
+/** True if set contains the minimum privilege pair to recover the panel. */
+export declare function hasCriticalPrivilege(caps: readonly CapabilityId[]): boolean;
+/**
+ * Effective capabilities for an actor.
+ * roles → union of (rolePolicy ?? factory), then +grants −revokes.
+ *
+ * **Hard guarantee:** any principal with the `admin` system role always keeps
+ * the full admin factory pack (cannot be stripped by dirty role policy or
+ * per-user revokes). This ensures at least panel admins stay fully open.
+ */
+export declare function computeEffectiveCapabilities(input: {
+    roles: SystemRole[];
+    /** Custom policies; missing role → factory */
+    rolePolicies?: Partial<Record<SystemRole, RolePolicy | null | undefined>>;
+    grants?: CapabilityId[] | string[];
+    revokes?: CapabilityId[] | string[];
+}): CapabilityId[];
+export declare function hasCapability(effective: readonly CapabilityId[] | Set<CapabilityId>, cap: CapabilityId): boolean;
+/** Batch: all caps in band for toggle-all UI */
+export declare function applyBandToCapabilities(current: CapabilityId[], band: OperationLevel, enabled: boolean, maxLevel: OperationLevel): CapabilityId[];
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7D,2DAA2D;AAC3D,MAAM,MAAM,YAAY,GACpB,gBAAgB,GAChB,WAAW,GACX,cAAc,GACd,eAAe,GACf,WAAW,GACX,UAAU,GACV,UAAU,GACV,cAAc,GACd,cAAc,GACd,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,YAAY,GACZ,UAAU,GACV,YAAY,GACZ,eAAe,GACf,mBAAmB,GACnB,aAAa,GACb,aAAa,GACb,kBAAkB,GAClB,eAAe,GACf,WAAW,GACX,WAAW,GACX,eAAe,GACf,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,qBAAqB,GACrB,iBAAiB,GACjB,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,YAAY,GACZ,cAAc,GACd,iBAAiB,GACjB,mBAAmB,GACnB,iBAAiB,GACjB,aAAa,GACb,iBAAiB,GACjB,gBAAgB,GAChB,aAAa,GACb,aAAa,GACb,cAAc,GACd,yBAAyB,CAAC;AAE9B,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,YAAY,CAAC;IACjB,2DAA2D;IAC3D,IAAI,EAAE,cAAc,CAAC;IACrB,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gFAAgF;AAChF,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAUvC,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAM5C,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,UAAU,EAA6C,CAAC;AAEnF,sDAAsD;AACtD,eAAO,MAAM,kBAAkB,EAAE,SAAS,aAAa,EAoD7C,CAAC;AAIX,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,YAAY,CAEnE;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,YAAY,GAAG,aAAa,GAAG,SAAS,CAE5E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,EAAE,CAEvE;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,GAAG,YAAY,EAAE,CAG9E;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAEvD;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,cAAc,GAAG,MAAM,CAE1E;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,uDAAuD;IACvD,YAAY,EAAE,YAAY,EAAE,CAAC;IAC7B,+DAA+D;IAC/D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,iCAAiC;AACjC,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,CAKrE,CAAC;AAMF,mDAAmD;AACnD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAM9D;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAOpE;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,GAAG,UAAU,CAkBb;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAM7E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACpC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CA2BxC;AAED;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,YAAY,EAOjD,CAAC;AAEX,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAI3E;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC;IAC1E,MAAM,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,CAAC;IACnC,OAAO,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,CAAC;CACrC,GAAG,YAAY,EAAE,CAwCjB;AAED,wBAAgB,aAAa,CAC3B,SAAS,EAAE,SAAS,YAAY,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,EACtD,GAAG,EAAE,YAAY,GAChB,OAAO,CAGT;AAED,gDAAgD;AAChD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,YAAY,EAAE,EACvB,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,YAAY,EAAE,CAehB"}

package/dist/capabilities.js

@@ -0,0 +1,272 @@
+/**
+ * Adjustable multi-level RBAC — capability catalog + factory defaults.
+ * Browser-safe (no Node APIs). Single source for server enforce + web UI.
+ */
+/** Bump when factory grants change so dirty merge can reason about versions. */
+export const RBAC_DEFAULTS_VERSION = 1;
+const LEVEL_RANK = {
+    read: 1,
+    'write-low': 2,
+    'write-high': 3,
+    destructive: 4,
+    privilege: 5,
+};
+export const OPERATION_LEVELS = [
+    'read',
+    'write-low',
+    'write-high',
+    'destructive',
+    'privilege',
+];
+export const SYSTEM_ROLES = ['admin', 'operator', 'viewer', 'agent'];
+/** Full catalog — add new capabilities here first. */
+export const CAPABILITY_CATALOG = [
+    // read
+    { id: 'dashboard.read', band: 'read', labelKey: 'rbac.cap.dashboardRead' },
+    { id: 'logs.read', band: 'read', labelKey: 'rbac.cap.logsRead' },
+    { id: 'metrics.read', band: 'read', labelKey: 'rbac.cap.metricsRead' },
+    { id: 'projects.read', band: 'read', labelKey: 'rbac.cap.projectsRead' },
+    { id: 'mail.read', band: 'read', labelKey: 'rbac.cap.mailRead' },
+    { id: 'dns.read', band: 'read', labelKey: 'rbac.cap.dnsRead' },
+    { id: 'ssl.read', band: 'read', labelKey: 'rbac.cap.sslRead' },
+    { id: 'backups.read', band: 'read', labelKey: 'rbac.cap.backupsRead' },
+    { id: 'updates.read', band: 'read', labelKey: 'rbac.cap.updatesRead' },
+    { id: 'services.read', band: 'read', labelKey: 'rbac.cap.servicesRead' },
+    { id: 'firewall.read', band: 'read', labelKey: 'rbac.cap.firewallRead' },
+    { id: 'approvals.view', band: 'read', labelKey: 'rbac.cap.approvalsView' },
+    { id: 'users.self', band: 'read', labelKey: 'rbac.cap.usersSelf' },
+    // write-low
+    { id: 'projects.write', band: 'write-low', labelKey: 'rbac.cap.projectsWrite' },
+    { id: 'mail.write', band: 'write-low', labelKey: 'rbac.cap.mailWrite' },
+    { id: 'db.write', band: 'write-low', labelKey: 'rbac.cap.dbWrite' },
+    { id: 'ssl.upload', band: 'write-low', labelKey: 'rbac.cap.sslUpload' },
+    { id: 'files.project', band: 'write-low', labelKey: 'rbac.cap.filesProject' },
+    { id: 'approvals.respond', band: 'write-low', labelKey: 'rbac.cap.approvalsRespond' },
+    { id: 'cron.manage', band: 'write-low', labelKey: 'rbac.cap.cronManage' },
+    // write-high
+    { id: 'backups.run', band: 'write-high', labelKey: 'rbac.cap.backupsRun' },
+    { id: 'services.control', band: 'write-high', labelKey: 'rbac.cap.servicesControl' },
+    { id: 'updates.apply', band: 'write-high', labelKey: 'rbac.cap.updatesApply' },
+    { id: 'dns.apply', band: 'write-high', labelKey: 'rbac.cap.dnsApply' },
+    { id: 'ssl.issue', band: 'write-high', labelKey: 'rbac.cap.sslIssue' },
+    { id: 'publish.apply', band: 'write-high', labelKey: 'rbac.cap.publishApply' },
+    { id: 'firewall.edit', band: 'write-high', labelKey: 'rbac.cap.firewallEdit' },
+    { id: 'mail.apply', band: 'write-high', labelKey: 'rbac.cap.mailApply' },
+    { id: 'runtime.tuning', band: 'write-high', labelKey: 'rbac.cap.runtimeTuning' },
+    { id: 'mysql.console.write', band: 'write-high', labelKey: 'rbac.cap.mysqlConsoleWrite' },
+    // destructive
+    { id: 'projects.delete', band: 'destructive', labelKey: 'rbac.cap.projectsDelete' },
+    { id: 'db.drop', band: 'destructive', labelKey: 'rbac.cap.dbDrop' },
+    { id: 'backups.restore', band: 'destructive', labelKey: 'rbac.cap.backupsRestore' },
+    { id: 'firewall.flush', band: 'destructive', labelKey: 'rbac.cap.firewallFlush' },
+    { id: 'logs.purge', band: 'destructive', labelKey: 'rbac.cap.logsPurge' },
+    // privilege
+    { id: 'users.manage', band: 'privilege', labelKey: 'rbac.cap.usersManage' },
+    { id: 'packages.manage', band: 'privilege', labelKey: 'rbac.cap.packagesManage' },
+    { id: 'users.impersonate', band: 'privilege', labelKey: 'rbac.cap.usersImpersonate' },
+    { id: 'security.policy', band: 'privilege', labelKey: 'rbac.cap.securityPolicy' },
+    { id: 'rbac.policy', band: 'privilege', labelKey: 'rbac.cap.rbacPolicy' },
+    { id: 'settings.system', band: 'privilege', labelKey: 'rbac.cap.settingsSystem' },
+    { id: 'network.browse', band: 'privilege', labelKey: 'rbac.cap.networkBrowse' },
+    { id: 'network.vpn', band: 'privilege', labelKey: 'rbac.cap.networkVpn' },
+    { id: 'network.vnc', band: 'privilege', labelKey: 'rbac.cap.networkVnc' },
+    { id: 'audit.export', band: 'privilege', labelKey: 'rbac.cap.auditExport' },
+    { id: 'security.api_keys.admin', band: 'privilege', labelKey: 'rbac.cap.securityApiKeysAdmin' },
+];
+const CATALOG_BY_ID = new Map(CAPABILITY_CATALOG.map((c) => [c.id, c]));
+export function isCapabilityId(value) {
+    return CATALOG_BY_ID.has(value);
+}
+export function getCapabilityDef(id) {
+    return CATALOG_BY_ID.get(id);
+}
+export function capabilitiesInBand(band) {
+    return CAPABILITY_CATALOG.filter((c) => c.band === band).map((c) => c.id);
+}
+export function capabilitiesUpToLevel(maxLevel) {
+    const max = LEVEL_RANK[maxLevel];
+    return CAPABILITY_CATALOG.filter((c) => LEVEL_RANK[c.band] <= max).map((c) => c.id);
+}
+export function levelRank(level) {
+    return LEVEL_RANK[level];
+}
+export function compareLevels(a, b) {
+    return LEVEL_RANK[a] - LEVEL_RANK[b];
+}
+/** Factory max level per role */
+export const ROLE_FACTORY_MAX_LEVEL = {
+    admin: 'privilege',
+    operator: 'write-high',
+    viewer: 'read',
+    agent: 'write-low',
+};
+function factoryCaps(role) {
+    return capabilitiesUpToLevel(ROLE_FACTORY_MAX_LEVEL[role]);
+}
+/** Code-level factory defaults — restore target */
+export function factoryRolePolicy(role) {
+    return {
+        maxLevel: ROLE_FACTORY_MAX_LEVEL[role],
+        capabilities: factoryCaps(role),
+        defaultsVersion: RBAC_DEFAULTS_VERSION,
+    };
+}
+export function factoryRolePolicies() {
+    return {
+        admin: factoryRolePolicy('admin'),
+        operator: factoryRolePolicy('operator'),
+        viewer: factoryRolePolicy('viewer'),
+        agent: factoryRolePolicy('agent'),
+    };
+}
+/** Normalize + filter caps by maxLevel; drop unknown ids */
+export function normalizeRolePolicy(input) {
+    const maxLevel = input.maxLevel && LEVEL_RANK[input.maxLevel] ? input.maxLevel : 'read';
+    const max = LEVEL_RANK[maxLevel];
+    const capabilities = [
+        ...new Set((input.capabilities ?? [])
+            .filter((id) => isCapabilityId(id))
+            .filter((id) => {
+            const def = CATALOG_BY_ID.get(id);
+            return def ? LEVEL_RANK[def.band] <= max : false;
+        })),
+    ].sort();
+    return {
+        maxLevel,
+        capabilities,
+        defaultsVersion: RBAC_DEFAULTS_VERSION,
+    };
+}
+/** Whether policy matches factory for role (order-independent) */
+export function isFactoryPolicy(role, policy) {
+    const factory = factoryRolePolicy(role);
+    if (policy.maxLevel !== factory.maxLevel)
+        return false;
+    const a = [...policy.capabilities].sort().join('\0');
+    const b = [...factory.capabilities].sort().join('\0');
+    return a === b;
+}
+/**
+ * Resolve stored policy against current factory.
+ * - missing / exact factory / pure subset of factory (same maxLevel) → full factory, not dirty
+ *   (auto-picks new catalog caps after defaultsVersion bumps without re-adding intentional extras)
+ * - otherwise keep stored list as dirty custom policy
+ */
+export function resolveRolePolicy(role, stored) {
+    const factory = factoryRolePolicy(role);
+    // Admin role is locked to full factory — stored customizations ignored
+    if (role === 'admin') {
+        return { policy: factory, dirty: false };
+    }
+    if (!stored) {
+        return { policy: factory, dirty: false };
+    }
+    const norm = normalizeRolePolicy(stored);
+    if (isFactoryPolicy(role, norm)) {
+        return { policy: factory, dirty: false };
+    }
+    const factorySet = new Set(factory.capabilities);
+    const hasExtra = norm.capabilities.some((c) => !factorySet.has(c));
+    const maxMatches = norm.maxLevel === factory.maxLevel;
+    if (maxMatches && !hasExtra) {
+        // Pure subset of factory (e.g. older snapshot missing backups.run) → upgrade
+        return { policy: factory, dirty: false };
+    }
+    return {
+        policy: {
+            ...norm,
+            defaultsVersion: RBAC_DEFAULTS_VERSION,
+        },
+        dirty: true,
+    };
+}
+/**
+ * Critical privilege set that must never be fully removed from the panel
+ * (at least one non-suspended holder must keep these).
+ */
+export const CRITICAL_PRIVILEGE_CAPS = [
+    'users.manage',
+    'rbac.policy',
+    'packages.manage',
+    'users.impersonate',
+    'security.policy',
+    'settings.system',
+];
+/** True if set contains the minimum privilege pair to recover the panel. */
+export function hasCriticalPrivilege(caps) {
+    return (hasCapability(caps, 'users.manage') && hasCapability(caps, 'rbac.policy'));
+}
+/**
+ * Effective capabilities for an actor.
+ * roles → union of (rolePolicy ?? factory), then +grants −revokes.
+ *
+ * **Hard guarantee:** any principal with the `admin` system role always keeps
+ * the full admin factory pack (cannot be stripped by dirty role policy or
+ * per-user revokes). This ensures at least panel admins stay fully open.
+ */
+export function computeEffectiveCapabilities(input) {
+    const set = new Set();
+    const roles = input.roles?.length ? input.roles : ['viewer'];
+    const isAdmin = roles.includes('admin');
+    for (const role of roles) {
+        if (!ROLE_FACTORY_MAX_LEVEL[role])
+            continue;
+        // Admin role is never reduced by stored policy — always full factory open.
+        if (role === 'admin') {
+            for (const cap of factoryRolePolicy('admin').capabilities) {
+                set.add(cap);
+            }
+            continue;
+        }
+        const custom = input.rolePolicies?.[role];
+        const policy = custom === null || custom === undefined
+            ? factoryRolePolicy(role)
+            : normalizeRolePolicy(custom);
+        for (const cap of policy.capabilities) {
+            set.add(cap);
+        }
+    }
+    for (const g of input.grants ?? []) {
+        if (isCapabilityId(g))
+            set.add(g);
+    }
+    // Per-user revokes: never strip anything from admin principals
+    if (!isAdmin) {
+        for (const r of input.revokes ?? []) {
+            if (isCapabilityId(r))
+                set.delete(r);
+        }
+    }
+    // Belt: if somehow empty but marked admin, force full factory
+    if (isAdmin && set.size === 0) {
+        for (const cap of factoryRolePolicy('admin').capabilities)
+            set.add(cap);
+    }
+    return [...set].sort();
+}
+export function hasCapability(effective, cap) {
+    if (effective instanceof Set)
+        return effective.has(cap);
+    return effective.includes(cap);
+}
+/** Batch: all caps in band for toggle-all UI */
+export function applyBandToCapabilities(current, band, enabled, maxLevel) {
+    const bandCaps = capabilitiesInBand(band);
+    if (LEVEL_RANK[band] > LEVEL_RANK[maxLevel]) {
+        // cannot enable above maxLevel
+        if (enabled)
+            return [...current];
+    }
+    const set = new Set(current);
+    for (const id of bandCaps) {
+        if (enabled) {
+            if (LEVEL_RANK[band] <= LEVEL_RANK[maxLevel])
+                set.add(id);
+        }
+        else {
+            set.delete(id);
+        }
+    }
+    return normalizeRolePolicy({ maxLevel, capabilities: [...set] }).capabilities;
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6DH,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC,MAAM,UAAU,GAAmC;IACjD,IAAI,EAAE,CAAC;IACP,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;IACf,WAAW,EAAE,CAAC;IACd,SAAS,EAAE,CAAC;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,MAAM;IACN,WAAW;IACX,YAAY;IACZ,aAAa;IACb,WAAW;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAEnF,sDAAsD;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAA6B;IAC1D,OAAO;IACP,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IAC1E,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE;IAChE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE;IACtE,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE;IACxE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE;IAChE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE;IAC9D,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE;IAC9D,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE;IACtE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE;IACtE,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE;IACxE,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE;IACxE,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IAC1E,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAAE;IAClE,YAAY;IACZ,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IAC/E,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,oBAAoB,EAAE;IACvE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,kBAAkB,EAAE;IACnE,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,oBAAoB,EAAE;IACvE,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,uBAAuB,EAAE;IAC7E,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,2BAA2B,EAAE;IACrF,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IACzE,aAAa;IACb,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IAC1E,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,0BAA0B,EAAE;IACpF,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,uBAAuB,EAAE;IAC9E,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,mBAAmB,EAAE;IACtE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,mBAAmB,EAAE;IACtE,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,uBAAuB,EAAE;IAC9E,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,uBAAuB,EAAE;IAC9E,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,oBAAoB,EAAE;IACxE,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IAChF,EAAE,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,4BAA4B,EAAE;IACzF,cAAc;IACd,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,yBAAyB,EAAE;IACnF,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE;IACnE,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,yBAAyB,EAAE;IACnF,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IACjF,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,oBAAoB,EAAE;IACzE,YAAY;IACZ,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,sBAAsB,EAAE;IAC3E,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,yBAAyB,EAAE;IACjF,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,2BAA2B,EAAE;IACrF,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,yBAAyB,EAAE;IACjF,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IACzE,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,yBAAyB,EAAE;IACjF,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,wBAAwB,EAAE;IAC/E,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IACzE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IACzE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,sBAAsB,EAAE;IAC3E,EAAE,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,+BAA+B,EAAE;CACvF,CAAC;AAEX,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAExE,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,aAAa,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAgB;IAC/C,OAAO,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAoB;IACrD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAwB;IAC5D,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAiB,EAAE,CAAiB;IAChE,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAWD,iCAAiC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,WAAW;CACnB,CAAC;AAEF,SAAS,WAAW,CAAC,IAAgB;IACnC,OAAO,qBAAqB,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,iBAAiB,CAAC,IAAgB;IAChD,OAAO;QACL,QAAQ,EAAE,sBAAsB,CAAC,IAAI,CAAC;QACtC,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC;QAC/B,eAAe,EAAE,qBAAqB;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC;QACvC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QACnC,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,KAGnC;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACxF,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG;QACnB,GAAG,IAAI,GAAG,CACR,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;aACvB,MAAM,CAAC,CAAC,EAAE,EAAsB,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;aACtD,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;YACb,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QACnD,CAAC,CAAC,CACL;KACF,CAAC,IAAI,EAAE,CAAC;IACT,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,eAAe,EAAE,qBAAqB;KACvC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,IAAgB,EAAE,MAAkB;IAClE,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAgB,EAChB,MAAqC;IAErC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,uEAAuE;IACvE,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,6EAA6E;QAC7E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO;QACL,MAAM,EAAE;YACN,GAAG,IAAI;YACP,eAAe,EAAE,qBAAqB;SACvC;QACD,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA4B;IAC9D,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,mBAAmB;IACnB,iBAAiB;IACjB,iBAAiB;CACT,CAAC;AAEX,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,IAA6B;IAChE,OAAO,CACL,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAM5C;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgB,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAkB,CAAC;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5C,2EAA2E;QAC3E,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC;gBAC1D,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACf,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GACV,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;YACrC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC;YACzB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,cAAc,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,+DAA+D;IAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACpC,IAAI,cAAc,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,IAAI,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,YAAY;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,SAAsD,EACtD,GAAiB;IAEjB,IAAI,SAAS,YAAY,GAAG;QAAE,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,uBAAuB,CACrC,OAAuB,EACvB,IAAoB,EACpB,OAAgB,EAChB,QAAwB;IAExB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,+BAA+B;QAC/B,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC;AAChF,CAAC"}