@appxdigital/appx-core 0.1.121-beta.9 → 0.1.121

package/dist/prisma/permissions-validator.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Static validation of a `PermissionsConfig` against the Prisma schema.
+ *
+ * Runs at boot (in the PrismaService constructor). It encodes the Option A
+ * authorization model: a create condition judges a model's own scalar fields
+ * only, and every foreign-key reference a create establishes is authorized by
+ * the target model's `connect` rule. Misconfigurations that would break at
+ * runtime are surfaced here — errors reject boot, warnings are advisory.
+ *
+ * Pure and schema-only (no database), so it is independently unit-testable.
+ */
+import type { PermissionsConfigType } from '../common/config/permissionsConfigTypes';
+export type RelationKind = 'belongsTo' | 'hasMany';
+export interface RelationMeta {
+    /** The relation navigation field name on the owning model. */
+    field: string;
+    /** The target model name (original casing, as in the schema). */
+    model: string;
+    /** The owning model's scalar FK column (belongsTo only). */
+    referencingColumn?: string;
+    isRequired: boolean;
+    kind: RelationKind;
+    /** False when the scalar FK is @NoWrite / @Role(none) (never client-writable). Defaults to writable. */
+    fkWritable?: boolean;
+}
+/** Relations per model, keyed by the lower-cased model name. */
+export type SchemaRelations = Record<string, RelationMeta[]>;
+export type IssueLevel = 'error' | 'warning';
+export type IssueCode = 'relation-in-create-condition' | 'missing-connect-required' | 'missing-connect' | 'connect-on-unwritable' | 'unknown-relation';
+export interface ValidationIssue {
+    level: IssueLevel;
+    code: IssueCode;
+    model: string;
+    role: string;
+    message: string;
+}
+/**
+ * Validates the permissions config against the schema relations.
+ *
+ * Checks, per model + role that can create the model:
+ *  - **error** `relation-in-create-condition` — a create condition references a
+ *    relation. Create conditions are own-scalar-only; relationship checks belong
+ *    on the target's `connect` rule.
+ *  - **error** `missing-connect-required` — a *required* belongsTo FK's target
+ *    has no `connect` rule for the role. Every create sets it, so it will always
+ *    be denied at runtime.
+ *  - **warning** `missing-connect-optional` — an *optional* belongsTo FK's target
+ *    has no `connect` rule for the role. Only denied when the payload sets it.
+ */
+export declare function validatePermissionsConfig(config: PermissionsConfigType, relations: SchemaRelations): ValidationIssue[];
+//# sourceMappingURL=permissions-validator.d.ts.map

package/dist/prisma/permissions-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-validator.d.ts","sourceRoot":"","sources":["../../src/prisma/permissions-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAErF,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,SAAS,CAAC;AAEnD,MAAM,WAAW,YAAY;IACzB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,wGAAwG;IACxG,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;AAE7D,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;AAE7C,MAAM,MAAM,SAAS,GACf,8BAA8B,GAC9B,0BAA0B,GAC1B,iBAAiB,GACjB,uBAAuB,GACvB,kBAAkB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACnB;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,SAAS,EAAE,eAAe,GAC3B,eAAe,EAAE,CAmHnB"}

package/dist/prisma/permissions-validator.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validatePermissionsConfig = void 0;
+/** Collects condition keys that name a relation (skips AND/OR/NOT, which recurse). */
+function findRelationKeys(cond, relationFields, found = new Set()) {
+    if (!cond || typeof cond !== 'object')
+        return found;
+    const objs = Array.isArray(cond) ? cond : [cond];
+    for (const obj of objs) {
+        if (!obj || typeof obj !== 'object')
+            continue;
+        for (const key of Object.keys(obj)) {
+            if (key === 'AND' || key === 'OR' || key === 'NOT') {
+                findRelationKeys(obj[key], relationFields, found);
+                continue;
+            }
+            if (relationFields.has(key))
+                found.add(key);
+        }
+    }
+    return found;
+}
+/**
+ * Validates the permissions config against the schema relations.
+ *
+ * Checks, per model + role that can create the model:
+ *  - **error** `relation-in-create-condition` — a create condition references a
+ *    relation. Create conditions are own-scalar-only; relationship checks belong
+ *    on the target's `connect` rule.
+ *  - **error** `missing-connect-required` — a *required* belongsTo FK's target
+ *    has no `connect` rule for the role. Every create sets it, so it will always
+ *    be denied at runtime.
+ *  - **warning** `missing-connect-optional` — an *optional* belongsTo FK's target
+ *    has no `connect` rule for the role. Only denied when the payload sets it.
+ */
+function validatePermissionsConfig(config, relations) {
+    const issues = [];
+    // Iterate the typed config structurally — model/role keys are dynamic, and
+    // condition/rule shapes are inspected at runtime.
+    const cfg = (config || {});
+    const byModel = {};
+    for (const m of Object.keys(cfg))
+        byModel[m.toLowerCase()] = cfg[m];
+    const hasConnectRule = (targetModel, role) => {
+        const rules = byModel[targetModel.toLowerCase()]?.[role];
+        return !!rules && rules.connect !== undefined && rules.connect !== null;
+    };
+    // A relation-scoped connect on the source (creating) model authorizes that
+    // relation on its own — the target model then needs no connect rule.
+    const hasRelationConnect = (sourceRules, field) => !!sourceRules?.relations?.[field]?.connect;
+    const canCreate = (rules) => !!rules && (rules.create !== undefined || rules.createMany !== undefined);
+    const canUpdate = (rules) => !!rules && (rules.update !== undefined || rules.updateMany !== undefined);
+    for (const modelKey of Object.keys(cfg)) {
+        const roles = cfg[modelKey] || {};
+        const rels = relations[modelKey.toLowerCase()] || [];
+        const belongsTo = rels.filter((r) => r.kind === 'belongsTo' && r.referencingColumn);
+        const relationFieldNames = new Set(rels.map((r) => r.field));
+        for (const role of Object.keys(roles)) {
+            const rules = roles[role];
+            const creatable = canCreate(rules);
+            const updatable = canUpdate(rules);
+            if (!creatable && !updatable)
+                continue;
+            const createRule = rules.create ?? rules.createMany;
+            const conditions = createRule && typeof createRule === 'object' ? createRule.conditions : undefined;
+            if (conditions) {
+                for (const relField of findRelationKeys(conditions, relationFieldNames)) {
+                    issues.push({
+                        level: 'error',
+                        code: 'relation-in-create-condition',
+                        model: modelKey,
+                        role,
+                        message: `create condition on ${modelKey}.${role} references relation '${relField}'. Create conditions judge own scalar fields only — authorize relationships with the target model's 'connect' rule.`,
+                    });
+                }
+            }
+            // Every foreign key a write can SET must have a connect rule (target
+            // or relation-scoped) — otherwise setting it is denied at runtime.
+            // A @NoWrite / @Role(none) column is never settable.
+            for (const r of belongsTo) {
+                const col = r.referencingColumn;
+                const writable = r.fkWritable !== false; // not @NoWrite / @Role(none)
+                const settableOnCreate = writable && creatable;
+                const settableOnUpdate = writable && updatable;
+                const relRule = hasRelationConnect(rules, r.field);
+                if (!settableOnCreate && !settableOnUpdate) {
+                    // A relation-scoped connect rule for a field that can't be
+                    // written is contradictory — flag it rather than silently ignore.
+                    if (relRule) {
+                        issues.push({
+                            level: 'error',
+                            code: 'connect-on-unwritable',
+                            model: modelKey,
+                            role,
+                            message: `${modelKey}.${role}.relations.${r.field}.connect is set, but its foreign key '${col}' is not writable (@NoWrite / @Role(none)). Make the field writable or remove the relation rule.`,
+                        });
+                    }
+                    continue;
+                }
+                if (relRule || hasConnectRule(r.model, role))
+                    continue;
+                const fix = `Declare '${r.model}.${role}.connect' (or 'ALL'), or scope it to this relation with '${modelKey}.${role}.relations.${r.field}.connect'.`;
+                if (settableOnCreate && r.isRequired) {
+                    issues.push({
+                        level: 'error',
+                        code: 'missing-connect-required',
+                        model: modelKey,
+                        role,
+                        message: `${modelKey}.${role} can create, but its required foreign key '${col}' → ${r.model} has no 'connect' rule for ${role}. Every create sets it, so the create is always denied. ${fix}`,
+                    });
+                }
+                else {
+                    issues.push({
+                        level: 'error',
+                        code: 'missing-connect',
+                        model: modelKey,
+                        role,
+                        message: `${modelKey}.${role} can set foreign key '${col}' → ${r.model} (on ${settableOnCreate ? 'create' : ''}${settableOnCreate && settableOnUpdate ? '/' : ''}${settableOnUpdate ? 'update' : ''}), but ${r.model} has no 'connect' rule for ${role}, so any write that sets it is denied. ${fix}`,
+                    });
+                }
+            }
+            // A `relations` key that doesn't name a real relation of this model is
+            // almost certainly a typo — it silently does nothing.
+            const relationsMap = rules.relations;
+            if (relationsMap && typeof relationsMap === 'object') {
+                for (const relField of Object.keys(relationsMap)) {
+                    if (!relationFieldNames.has(relField)) {
+                        issues.push({
+                            level: 'warning',
+                            code: 'unknown-relation',
+                            model: modelKey,
+                            role,
+                            message: `${modelKey}.${role}.relations.${relField} does not name a relation of ${modelKey} — it has no effect. Check the field name.`,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return issues;
+}
+exports.validatePermissionsConfig = validatePermissionsConfig;

package/dist/prisma/prisma.service.d.ts

@@ -52,6 +52,13 @@ export declare class PrismaService {
      */
     private rawClient;
     constructor(prismaClient: PrismaClient, permissionsConfig: PermissionsConfigType);
+    /**
+     * Validates the permissions config against the schema at boot. Warnings are
+     * logged; errors (a create condition that crosses a relation, or a required
+     * FK whose target has no `connect` rule) reject boot — the misconfiguration
+     * would otherwise surface as a runtime 403.
+     */
+    private validatePermissions;
     debugQueries(enable: boolean): void;
     withExposedModels(models: string[], callback: () => Promise<void>): Promise<void>;
     private debug;
@@ -114,6 +121,43 @@ export declare class PrismaService {
      * cannot evaluate, rather than silently allowing the insert.
      */
     private enforceCreateConditions;
+    /**
+     * Authorizes every relation a write establishes. Relationship authorization
+     * lives entirely in the `connect` action — create conditions judge a model's
+     * own scalar fields only.
+     *
+     * Runs on create AND update: a `create` can nest relation writes or set raw
+     * FKs; an `updateMany` (scalar-only) can re-point a raw FK. Both go through
+     * the same `connect` authorization.
+     *
+     *   - A raw scalar foreign key (`courseId: 7`) → the target's `connect` rule.
+     *   - `relation: { connect }` → the target's `connect` rule. `connect` is a
+     *     DEDICATED action: being allowed to READ a record does not authorize
+     *     associating it.
+     *   - `relation: { create }` → the target's `create` rule (recurses, so deeper
+     *     nesting is authorized too). Every other nested operator is rejected.
+     *
+     * The one exception is `trustedFk`: the scalar FK that points back to the row
+     * we're nested under. Prisma fills it at write time and the parent already
+     * authorized itself, so it is not re-checked.
+     */
+    private enforceNestedWrites;
+    /** Authorizes each operator inside one relation's nested-write object. */
+    private enforceNestedRelationOps;
+    /** If `column` is the scalar FK backing a belongsTo relation, returns that relation's field + target. */
+    private foreignKeyColumn;
+    /** The child's scalar FK column pointing back to the parent it's nested under (trusted). */
+    private backReferenceFk;
+    /**
+     * Authorizes attaching `relatedModel` (identified by `where`) through the
+     * `field` relation on `sourceModel`. Two rules can apply, evaluated against
+     * the candidate target row:
+     *   - a relation-scoped rule on the source (`sourceModel[role].relations[field].connect`)
+     *   - the target model's own rule (`relatedModel[role].connect`)
+     * When both exist they are ANDed (the relation rule can only strengthen).
+     * When only one exists it stands alone; when neither exists, default-deny.
+     */
+    private assertConnectAllowed;
     /**
      * True only in an explicit local-development environment. Deliberately NOT
      * `!== 'production'` — staging and other envs should behave like production
@@ -128,12 +172,25 @@ export declare class PrismaService {
      * (gated by the caller).
      */
     private warnIfCreatedRowNotFindable;
-    /** Recursively evaluates a (placeholder-resolved) condition object against a to-be-created row. */
+    /**
+     * A view of a create `row` where a belongsTo relation given via `connect`
+     * (`owner: { connect: { id } }`) is also surfaced as its scalar FK (`ownerId`),
+     * so scalar-FK create conditions match either payload form. Metadata-driven
+     * (`referencingColumn`/`foreignKey`); resolvable only when the connect targets
+     * the referenced column. Explicit scalar wins; row is not mutated.
+     */
+    private resolveConnectForeignKeys;
+    /**
+     * Evaluates a (placeholder-resolved) create condition against a to-be-created
+     * row. Create conditions judge the model's OWN scalar fields only — a clause
+     * that reaches into a relation is not a create concern (relationships are
+     * authorized by the target's `connect` rule) and is skipped here; the config
+     * validator rejects such clauses at boot. `trustedFk` (the back-reference to a
+     * same-request nesting parent) is likewise skipped — its value doesn't exist yet.
+     */
     private matchesCreateConditions;
     /** Evaluates a scalar-field condition (value or Prisma operator object) against the row's value. */
     private matchesCreateScalar;
-    /** Verifies the parent referenced by a belongsTo condition exists and satisfies the nested condition. */
-    private matchesCreateRelation;
     /**
      * Builds dynamic conditions based on the type of clause (OR, AND, or field conditions).
      * Each condition is processed, and placeholders (like `$USER_ID`) are replaced with actual values.
@@ -178,6 +235,7 @@ export declare class PrismaService {
         relation: string;
         foreignKey?: string;
         referencingColumn?: string;
+        relationName?: string;
         isRequired: boolean;
     };
     selectPermission(permissions: any, action: string, modelName: string, userRole: string): any;

package/dist/prisma/prisma.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAE/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAO3F,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IA0EX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IAqDX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAgDrC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC,mGAAmG;YACrF,uBAAuB;IAiCrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B,yGAAyG;YAC3F,qBAAqB;IAuBnC;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,UAAU,EAAE,OAAO,CAAA;KACtB;IAmBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}
+{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAkFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}