@askdb/core 1.0.0-beta.41 → 1.0.0-beta.43

package/README.md

@@ -2,7 +2,9 @@
 
 Dialect-agnostic NL→SQL pipeline for AskDB. Provides `ask()` orchestration, schema/IR types, modes, logging, and retrieval input. Bring your own dialect adapter (e.g. `@askdb/postgres`) and your own model.
 
-> **Status:** pre-1.0. `0.3.0` moved the Postgres dialect and `@askdb/core/postgres` to `@askdb/postgres`. Runtime AI provider construction lives in `@askdb/ai`; core remains BYO-model and does not read `process.env`. See [`docs/adrs/0002-integration-package-layout.md`](../../docs/adrs/0002-integration-package-layout.md), [`docs/adrs/0005-askdb-config-and-env-bootstrap.md`](../../docs/adrs/0005-askdb-config-and-env-bootstrap.md), and [`docs/adrs/0006-ai-provider-integration-strategy.md`](../../docs/adrs/0006-ai-provider-integration-strategy.md).
+> **Status:** pre-1.0. `0.3.0` moved the Postgres dialect and `@askdb/core/postgres` to `@askdb/postgres`. Runtime AI provider construction lives in `@askdb/ai`; core remains BYO-model and does not read `process.env`. See [`docs/adrs/0002-integration-package-layout.md`](https://github.com/Ygilany/AskDB/blob/main/docs/adrs/0002-integration-package-layout.md), [`docs/adrs/0005-askdb-config-and-env-bootstrap.md`](https://github.com/Ygilany/AskDB/blob/main/docs/adrs/0005-askdb-config-and-env-bootstrap.md), and [`docs/adrs/0006-ai-provider-integration-strategy.md`](https://github.com/Ygilany/AskDB/blob/main/docs/adrs/0006-ai-provider-integration-strategy.md).
+
+> **Security model:** `ask()` returns SQL and never executes it. Its SQL checks (single `SELECT`/`WITH` statement (with a SQL Server caveat), no comments, no write/DDL keywords, no known side-effecting functions, and the tenant and sensitive-column checks) are heuristic defense in depth that catch common model mistakes. The read-only and sensitive-column checks use a dialect-aware lexer; the tenant check uses a simpler scanner of its own ([#342](https://github.com/Ygilany/AskDB/issues/342)). They are not a SQL parser and not a security boundary. Run generated SQL under a read-only, least-privilege database role and enforce tenant isolation in the database. See [Safety boundaries](https://askdb.tools/concepts/safety-boundaries/).
 
 ## Install
 
@@ -19,11 +21,11 @@ pnpm add @askdb/ai-openai
 
 `@askdb/core` itself does not depend on `pg`. The optional `pg` peer lives on `@askdb/postgres` for live Postgres introspection.
 
-Runtime AI configuration helpers live in `@askdb/ai` and provider adapters such as `@askdb/ai-openai`. If you use [`@askdb/config`](../../packages/config/README.md), call `bootstrapAskDbEnv()`, create an AI registry, then pass **`getAskDbRuntimeConfig().ai.aiEnv`** to `registry.createLanguageModelFromEnv(...)`.
+Runtime AI configuration helpers live in `@askdb/ai` and provider adapters such as `@askdb/ai-openai`. If you use [`@askdb/config`](https://github.com/Ygilany/AskDB/blob/main/packages/config/README.md), call `bootstrapAskDbEnv()`, create an AI registry, then pass **`getAskDbRuntimeConfig().ai.aiEnv`** to `registry.createLanguageModelFromEnv(...)`.
 
 ## Schema format
 
-`@askdb/core` uses **Schema v2** — a split artifact designed for business-context enrichment and RAG chunking. See [`docs/contracts/schema-v2.md`](../../docs/contracts/schema-v2.md) for the full contract.
+`@askdb/core` uses **Schema v2** — a split artifact designed for business-context enrichment and RAG chunking. See [`docs/contracts/schema-v2.md`](https://github.com/Ygilany/AskDB/blob/main/docs/contracts/schema-v2.md) for the full contract.
 
 ### Directory layout
 
@@ -61,9 +63,47 @@ const { sql } = await ask({
 });
 ```
 
+## Parameterized output (default on)
+
+By default `ask()` also asks the model for an unbound form of the same SQL plus a small JSON parameter manifest. Every call is still **exactly one model call** — `parameterize` does not add or remove one, and nothing here lets a caller skip the model. The question is sent unchanged (values included); this is not a redaction feature.
+
+```ts
+import { ask, bindPreparedQuery, loadSchema } from "@askdb/core";
+
+const result = await ask({
+  question: "How many cities does Colorado have?",
+  schema,
+  model: openai("gpt-4o"),
+  dialect: "postgres",
+  tenantScope,
+});
+
+// Execute either form.
+await pool.query(result.sql);                       // ready to run
+await pool.query(result.unboundSql!, result.params); // driver binding
+
+// Render a form from result.parameters, then rebind locally — no model call.
+const rebound = bindPreparedQuery(result.preparedQuery!, {
+  state_name: "Utah",
+  ":tenant_agency_ids": authorizedAgencyIds,
+});
+await pool.query(rebound.sql);
+```
+
+Key rules:
+
+- `parameterize` defaults to **true**. Set `parameterize: false` when the extra output tokens are not worth it.
+- If the model's extra blocks are missing or inconsistent, the extras are omitted and `result.sql` is unaffected. No new error reaches a caller who does not call `bindPreparedQuery()`.
+- The model decides what to parameterize, so a mistake changes the *form*, not the query. Constrain form inputs using returned `type` and `description`.
+- `bindPreparedQuery()` is mechanical: it checks names, types, and cardinality, and **does not authorize tenant IDs**. Authorization is the host's, exactly as when building `tenantScope`.
+- Callers using the new fields must execute with `params`, not `tenantParams`.
+- List parameters are arity-stable in `unboundSql` only on PostgreSQL/CockroachDB (`= ANY($n)`); elsewhere a changed list length changes the marker count — rebind through `bindPreparedQuery()` rather than swapping the array.
+- Markers: `$N` (Postgres/CockroachDB), `?` (MySQL/MariaDB/SQLite), `@pN` (SQL Server, 0-based). Map values via `parameters[].markers` for SQL Server.
+
 ## What you get
 
-- `ask({ question, schema, model, dialect })` — generate validated SQL.
+- `ask({ question, schema, model, dialect })` — generate checked SQL (plus optional `unboundSql` / `params` / `parameters` / `preparedQuery`).
+- `bindPreparedQuery(prepared, values)` — pure local rebind of a `PreparedQuery` (no model call).
 - `AskDbLanguageModel` — AskDB's public name for the AI SDK language model contract.
 - `AskDialect` — the dialect adapter contract. `@askdb/postgres` exports a ready-made one.
 - `loadSchema(path)` — load a Schema v2 directory, bundled JSON, or `schema.json` path.

package/dist/ask.d.ts

@@ -7,6 +7,8 @@ import type { Retriever } from "./retrieval/types.js";
 import type { TenantScope } from "./schema/v2/tenant-policy.js";
 import { type BuiltInDialectId, type DialectSpec } from "./sql/dialect-spec.js";
 import { type TenantSqlOutputMode, type TenantBinding } from "./sql/tenant-placeholders.js";
+import { type SensitiveGuardrailMode, type SensitiveGuardrailResult } from "./sql/sensitive-guardrail.js";
+import { type PreparedQuery, type QueryParameterBinding, type QueryParamSlot } from "./sql/bind.js";
 /** Options forwarded to a dialect's generator. Stable across dialects. */
 export type AskDialectGenerateOptions = {
     logger?: AskDbLogger;
@@ -17,6 +19,11 @@ export type AskDialectGenerateOptions = {
     prebuiltDdl?: string;
     tenantPolicy?: import("./schema/v2/tenant-policy.js").NormalizedTenantPolicy;
     tenantScope?: TenantScope;
+    /**
+     * When true, ask the model for unbound SQL + a parameter manifest.
+     * Inert for custom {@link AskDialect} implementations.
+     */
+    parameterize?: boolean;
 };
 /** Token usage for a single `ask()` call (LLM generation only; excludes RAG embedding tokens). */
 export type AskUsage = {
@@ -24,12 +31,20 @@ export type AskUsage = {
     completionTokens: number | null;
     totalTokens: number | null;
 };
-/** Output of a dialect's generator: validated SQL plus optional dialect-specific explain metadata. */
+/** Output of a dialect's generator: the generated SQL plus optional dialect-specific explain metadata. */
 export type AskDialectGenerateResult = {
     sql: string;
     explain?: unknown;
+    /**
+     * Optional tenant guardrail result from a custom generator. When the schema has a
+     * tenant policy, `ask()` merges its warnings into its own check of `sql` and
+     * `unboundNamedSql` (before tenant rendering); it can add failures but never replace
+     * or relax that check.
+     */
     tenantGuardrail?: import("./sql/tenant-guardrail.js").TenantGuardrailResult;
     usage?: AskUsage;
+    unboundNamedSql?: string;
+    parameterManifest?: import("./sql/parameter-manifest.js").ParameterManifest;
 };
 /**
  * Escape-hatch interface for fully custom NL→SQL generators (agentic flows,
@@ -39,6 +54,19 @@ export type AskDialectGenerateResult = {
  * a {@link DialectSpec} to `ask({ dialect })` and let the centralized pipeline
  * handle prompt assembly + validation. Implement `AskDialect` only when those
  * defaults won't fit.
+ *
+ * Safety responsibilities:
+ *   - **Read-only validation is yours.** `ask()` does not run the SELECT-only
+ *     validator on SQL returned by a custom dialect (custom dialects may target
+ *     non-SELECT statements on purpose). If your generator should only emit
+ *     read-only SQL, call the exported `validateSelectSql(spec, sql)` yourself
+ *     before returning.
+ *   - **Tenant enforcement is not yours to skip.** When the schema has a tenant
+ *     policy, `ask()` runs the tenant guardrail on the returned `sql` (and
+ *     `unboundNamedSql`), with its `:tenant_<root>_ids` placeholders still in place,
+ *     then substitutes them, regardless of dialect; `strict` policies throw
+ *     `TenantGuardrailError`. A `tenantGuardrail` your
+ *     generator returns is merged into that result, never used in place of it.
  */
 export type AskDialect = {
     generate(question: string, schema: AnyNormalizedSchema, model: AskDbLanguageModel, options?: AskDialectGenerateOptions): Promise<AskDialectGenerateResult>;
@@ -62,6 +90,28 @@ export type AskGenerateDeps = {
      */
     providerOptions?: Record<string, unknown>;
 };
+/**
+ * A subtree's IDs grouped by tenant root: each key is a root table id from the
+ * tenant policy (`"table:public.clients"`), and its value holds IDs of that root's
+ * own `tenantIdColumn`, never IDs of another root.
+ *
+ * Root tables have separate ID spaces, so client `5` and agency `5` are different
+ * tenants. Keying the IDs by root lets `ask()` bind each root's IDs to that root's
+ * own `:tenant_<label>_ids` placeholder.
+ */
+export type TenantIdsByRoot = Readonly<Record<string, readonly string[]>>;
+/**
+ * Host callback that expands a `subtree` tenant scope. Given the tenant root id and
+ * the seed IDs, return the subtree's IDs grouped by root ({@link TenantIdsByRoot}):
+ *
+ * - under `tenantRoot`: the seeds and any same-table descendants (e.g. child
+ *   agencies through `agencies.parent_agency_id`);
+ * - under each descendant root the policy declares (`roots[].parent` or
+ *   `hierarchy[]`): that root's IDs in the subtree.
+ *
+ * Pass it to `ask()` as {@link AskPipelineOptions.resolveTenantDescendants}.
+ */
+export type ResolveTenantDescendants = (tenantRoot: string, seedIds: readonly string[]) => Promise<TenantIdsByRoot> | TenantIdsByRoot;
 export type AskPipelineOptions = {
     question: string;
     schema: AnyNormalizedSchema;
@@ -121,14 +171,91 @@ export type AskPipelineOptions = {
     tenantScope?: TenantScope;
     /**
      * SQL output mode for tenant placeholders. Default `"sql-only"` inlines
-     * literal values; `"sql-params"` converts to positional `$N` parameters.
+     * escaped literal values. `"sql-params"` replaces them with the dialect's
+     * driver markers (`$N` for Postgres/CockroachDB and custom `AskDialect`s, `?`
+     * for MySQL/MariaDB/SQLite, `@pN` for SQL Server): run `sql` with
+     * `tenantParams`, or `unboundSql` with `params`.
      */
     tenantSqlMode?: TenantSqlOutputMode;
+    /**
+     * Expands a `subtree` tenant scope into IDs per tenant root.
+     *
+     * Called with the tenant root id and the seed IDs from
+     * `tenantScope.access.rootIds`; returns the subtree's IDs keyed by root table id
+     * ({@link TenantIdsByRoot}). `ask()` unions the seeds into the `tenantRoot` entry
+     * and turns the result into a `multi_root` scope (an `ids` scope when only
+     * `tenantRoot` has IDs), so each root's IDs bind only to that root's placeholder.
+     * The host is the right place for this: it already knows its own hierarchy, can
+     * cache the closure, and can apply its own authorization rules.
+     *
+     * Required when `tenantScope.access.kind === "subtree"` — AskDB never opens a
+     * database connection of its own. Without it, or when it returns a flat array,
+     * a key that isn't a root in the subtree, a value that isn't an array of
+     * non-empty strings, or no IDs at all, `ask()` throws `TenantScopeError`
+     * (`SUBTREE_NOT_RESOLVABLE`) before calling the model.
+     */
+    resolveTenantDescendants?: ResolveTenantDescendants;
+    /**
+     * Ask the model to also return the SQL in unbound form plus a JSON manifest
+     * of the values it parameterized, populating `unboundSql`, `params`,
+     * `parameters`, and `preparedQuery`. Default true. Set false to save the
+     * extra output tokens when the host does not use those fields.
+     */
+    parameterize?: boolean;
+    /**
+     * How to treat SQL that references schema identifiers marked `sensitive`.
+     * Default `"warn"` — {@link AskPipelineResult.sensitiveGuardrail} is populated and
+     * `askdb.pipeline.sensitive_sql_warning` is logged, but `ask()` still resolves.
+     * `"strict"` throws {@link SensitiveReferenceError} instead. `"off"` skips the check.
+     *
+     * This only covers SQL produced by *this* call. Hosts that cache or replay SQL
+     * should call `validateSensitiveReferences` on every execution path.
+     */
+    sensitiveGuardrailMode?: SensitiveGuardrailMode | "off";
 };
 export type AskPipelineResult = {
+    /**
+     * The model's bound SQL: business values inlined as literals. Tenant IDs are
+     * inlined literals (`tenantSqlMode: "sql-only"`) or driver markers numbered from
+     * the first slot (`"sql-params"`) — then execute it with `tenantParams`.
+     */
     sql: string;
+    /**
+     * Driver markers for every value (business and, in `"sql-params"` mode, tenant).
+     * Execute with `params` — never with `tenantParams`.
+     */
+    unboundSql?: string;
+    /**
+     * Values for `unboundSql`, in driver-marker order (array slots on
+     * Postgres/CockroachDB listBinding). In `"sql-params"` mode this already
+     * includes the tenant values — for `?` dialects interleaved in source order,
+     * otherwise after the business values. Do not concatenate `tenantParams`.
+     */
+    params?: QueryParamSlot[];
+    /** Named bindings for form UIs (includes runtime values). */
+    parameters?: QueryParameterBinding[];
+    /** Definitions + template only — no runtime values. */
+    preparedQuery?: PreparedQuery;
     explain?: unknown;
+    /**
+     * Sensitive-identifier guardrail result for `sql`. Present when the schema declares
+     * at least one `sensitive` table/column and `sensitiveGuardrailMode` is not `"off"`.
+     */
+    sensitiveGuardrail?: SensitiveGuardrailResult;
+    /**
+     * Tenant guardrail result for the model's SQL, checked before tenant rendering: the
+     * bound `sql` and its `sql-unbound` block, with the `:tenant_<root>_ids` placeholders
+     * still in place. `sql` and `unboundSql` differ from those only by the substituted
+     * tenant IDs or markers. Present whenever the schema has a tenant policy, for every
+     * dialect form. In `strict` mode a failure
+     * throws `TenantGuardrailError` instead, so a returned result is always `passed`
+     * under `strict`.
+     */
     tenantGuardrail?: import("./sql/tenant-guardrail.js").TenantGuardrailResult;
+    /**
+     * `"sql-params"` mode only: the tenant IDs for the markers in `sql`, in marker
+     * order. `sql` + `tenantParams` is an executable pair on its own.
+     */
     tenantParams?: unknown[];
     tenantBindings?: TenantBinding[];
     /** Token usage for the LLM generation call. Absent when the provider does not report usage. */

package/dist/ask.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ask.d.ts","sourceRoot":"","sources":["../src/ask.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,IAAI,mBAAmB,EAAE,MAAM,IAAI,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAGjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,KAAK,mBAAmB,EAExB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AAGtC,0EAA0E;AAC1E,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yCAAyC,CAAC,EAAE,OAAO,CAAC;IACpD,YAAY,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,8BAA8B,EAAE,sBAAsB,CAAC;IAC7E,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AAEF,kGAAkG;AAClG,MAAM,MAAM,QAAQ,GAAG;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,sGAAsG;AACtG,MAAM,MAAM,wBAAwB,GAAG;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,2BAA2B,EAAE,qBAAqB,CAAC;IAC5E,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,WAAW,GAAG,UAAU,CAAC;AAE1E,qGAAqG;AACrG,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,yCAAyC,CAAC,EAAE,OAAO,CAAC;IACpD,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,wFAAwF;IACxF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,2BAA2B,EAAE,qBAAqB,CAAC;IAC5E,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,+FAA+F;IAC/F,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB,CAAC;AAEF,wBAAsB,GAAG,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA6DjF"}
+{"version":3,"file":"ask.d.ts","sourceRoot":"","sources":["../src/ask.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,IAAI,mBAAmB,EAAE,MAAM,IAAI,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,KAAK,EAGV,WAAW,EACZ,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAGjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAOtC,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAE1B,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAEvB,0EAA0E;AAC1E,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yCAAyC,CAAC,EAAE,OAAO,CAAC;IACpD,YAAY,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,8BAA8B,EAAE,sBAAsB,CAAC;IAC7E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,kGAAkG;AAClG,MAAM,MAAM,QAAQ,GAAG;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,0GAA0G;AAC1G,MAAM,MAAM,wBAAwB,GAAG;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,2BAA2B,EAAE,qBAAqB,CAAC;IAC5E,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,OAAO,6BAA6B,EAAE,iBAAiB,CAAC;CAC7E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,WAAW,GAAG,UAAU,CAAC;AAE1E,qGAAqG;AACrG,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,MAAM,EAAE,KACvB,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;AAEhD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,yCAAyC,CAAC,EAAE,OAAO,CAAC;IACpD,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,wFAAwF;IACxF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;;;;;OAgBG;IACH,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IACpD;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,GAAG,KAAK,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;IAC1B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACrC,uDAAuD;IACvD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IAC9C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,OAAO,2BAA2B,EAAE,qBAAqB,CAAC;IAC5E;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,+FAA+F;IAC/F,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB,CAAC;AAEF,wBAAsB,GAAG,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+NjF"}