@astram/guard 0.14.0 → 0.16.0

package/dist/boot/migration-ledger-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-ledger-check.d.ts","sourceRoot":"","sources":["../../src/boot/migration-ledger-check.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC7B,MAAM,cAAc,CAAC;AAGtB,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE5D,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,YAAY,EAAE,uBAAuB,EAAE,CAAC;AAExC,MAAM,WAAW,+BAAgC,SAAQ,uBAAuB;IAC9E;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC3D,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACnD,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;CACpC;AAED,MAAM,WAAW,8BAA8B;IAC7C,qDAAqD;IACrD,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,iGAAiG;IACjG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAgBD,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAO3D;AAWD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,gBAAgB,GACxB,uBAAuB,CAEzB;AAED,oFAAoF;AACpF,MAAM,WAAW,4BAA6B,SAAQ,uBAAuB;IAC3E,QAAQ,CAAC,YAAY,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,gBAAgB,GACxB,4BAA4B,CAG9B;AA+CD;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,8BAA8B,CAAC,CAyFzC;AAED,4FAA4F;AAC5F,eAAO,MAAM,gCAAgC,eAA6C,CAAC;AAE3F,qGAAqG;AACrG,eAAO,MAAM,mCAAmC,eAAgD,CAAC;AAEjG;;;;;GAKG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAOpB;IAEJ,iFAAiF;IACjF,OAAO,CAAC,MAAM,CAAC,GAAG;IAQlB,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,+BAA+B,GAAG,IAAI;IAexD,iFAAiF;IACjF,GAAG,CACD,QAAQ,EAAE,uBAAuB,GAAG;QAAE,YAAY,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAA;KAAE,GACxF,OAAO,CAAC,8BAA8B,CAAC;CAY3C;AAED;;;;;GAKG;AACH,qBAAa,6BAA8B,YAAW,sBAAsB;IAExE,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,OAAO,EAAE,+BAA+B,EACxC,QAAQ,GAAE,uBAAuB,GAAG,IAAW;IAK5D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;CAI9C"}

package/dist/boot/migration-ledger-check.js

@@ -0,0 +1,280 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FrameworkMigrationLedgerCheck = exports.MigrationLedgerRegistry = exports.SHIELD_GUARD_MIGRATION_LEDGER_CHECK = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = void 0;
+exports.frameworkMigrationIds = frameworkMigrationIds;
+exports.resolveMigrationLedger = resolveMigrationLedger;
+exports.resolveMigrationLedgerCheck = resolveMigrationLedgerCheck;
+exports.assertFrameworkMigrationsApplied = assertFrameworkMigrationsApplied;
+/**
+ * Boot check: every framework migration a package ships is recorded in the `@astram/migrate`
+ * ledger (configurable-framework-db spec 5.D, §13).
+ *
+ * The ledger lives where `astram-migrate` writes it (spec 5.G): `<ns>_app` when
+ * `SHIELD_DB_NAMESPACE` is set, else `DDL_DB_NAME ?? APP_DB_NAME ?? <default app database>` of
+ * the migrate job's env; the table is `APP_MIGRATION_TABLE ?? 'schema_migrations'`. With the
+ * namespace set the check reads `<ns>_app` directly. In default mode it cannot know the migrate
+ * job's env, so it probes core `migrationLedgerCandidates` in order (`DDL_DB_NAME`, the runtime
+ * `APP_DB_NAME`, `shield_app`; one information_schema probe each, at bootstrap only) and reads the
+ * first ledger table that exists (G-007 QA P1). That ledger must hold every id; none found fails
+ * closed naming every location tried.
+ *
+ * Missing ids, no ledger table, or an unreadable ledger:
+ * - outside `NODE_ENV` development/test (unset included) ⇒ throws, boot fails (Shield #1);
+ * - in development/test ⇒ one warning, boot continues.
+ * An unreadable ledger is never treated as "all applied". Messages carry the database name, the
+ * table name, migration ids and a driver error code only: never a user, host, password or the
+ * driver's message text (core 70-secrets).
+ *
+ * Runs once, at application bootstrap, never per request (Shield #12). Who checks what:
+ * - `AuthModule` (`auth: true`) checks `guardMigrationsDir` over its runtime pool;
+ * - `@astram/identity` checks `guardMigrationsDir` AND `identityMigrationsDir` over its own pool
+ *   (identity reads guard's authz tables; guard never imports identity, ADR-0003);
+ * - an enforcement-only app (no `auth`, no identity) opens no DB pool and reads no framework
+ *   table, so it checks nothing.
+ * When both run in one app, the per-app {@link MigrationLedgerRegistry} (provided by
+ * `ShieldModule`) merges them: every hook registers its directories when constructed, and the
+ * first hook to bootstrap runs ONE SELECT per ledger location over the union; the others await
+ * that same result (a failure fails every one of them). Without the registry each hook runs alone.
+ */
+const node_fs_1 = require("node:fs");
+const core_1 = require("@astram/core");
+const app_config_js_1 = require("../config/app-config.js");
+/** At most this many ids are listed in the message (spec §13). */
+const MAX_LISTED_IDS = 10;
+/** Same id rule as `@astram/migrate`'s loader, restricted to the shipped `.cjs` files. */
+const MIGRATION_FILE = /^(\d+)-.+\.cjs$/;
+/** MariaDB "table doesn't exist". */
+const ER_NO_SUCH_TABLE = 1146;
+/** `1`, `01` and `001` are the same migration id (migrate orders ids numerically). */
+function idKey(id) {
+    return id.replace(/^0+(?=\d)/, '');
+}
+/** The migration ids shipped in `dir` (`.cjs` files only), ascending. */
+function frameworkMigrationIds(dir) {
+    const ids = [];
+    for (const file of (0, node_fs_1.readdirSync)(dir)) {
+        const m = MIGRATION_FILE.exec(file);
+        if (m)
+            ids.push(m[1]);
+    }
+    return sortIds(ids);
+}
+/** Ascending numeric order over decimal id strings. */
+function sortIds(ids) {
+    return ids.sort((a, b) => {
+        const ka = idKey(a);
+        const kb = idKey(b);
+        return ka.length - kb.length || (ka < kb ? -1 : ka > kb ? 1 : 0);
+    });
+}
+/**
+ * The migrate CLI's ledger location rule (core `resolveMigrationLedgerLocation`: `<ns>_app` when
+ * namespaced, else `DDL_DB_NAME ?? <default app>`). The boot check itself uses
+ * {@link resolveMigrationLedgerCheck}, which also tries the runtime `APP_DB_NAME`.
+ * @throws FrameworkSchemaConfigError on a conflicting `DDL_DB_NAME` or invalid names.
+ */
+function resolveMigrationLedger(env, schemas) {
+    return (0, core_1.resolveMigrationLedgerLocation)(schemas, env);
+}
+/**
+ * The boot check's ledger locations for this process's env (G-007 QA P1): core
+ * `migrationLedgerCandidates`, split into the first location and its `alternatives`. Namespace
+ * set ⇒ `<ns>_app` only; default ⇒ `DDL_DB_NAME`, the runtime `APP_DB_NAME`, `shield_app`.
+ * Spread it into {@link FrameworkMigrationsCheckOptions}.
+ * @throws FrameworkSchemaConfigError on a conflicting `DDL_DB_NAME` or invalid names.
+ */
+function resolveMigrationLedgerCheck(env, schemas) {
+    const [first, ...alternatives] = (0, core_1.migrationLedgerCandidates)(schemas, env);
+    return { database: first.database, table: first.table, alternatives };
+}
+/** The driver error code only (never its message: it can carry user@host). */
+function errorCode(err) {
+    if (typeof err === 'object' && err !== null) {
+        const { code, errno } = err;
+        if (typeof code === 'string' && /^[A-Z0-9_]{1,64}$/.test(code))
+            return code;
+        if (typeof errno === 'number')
+            return `errno ${errno}`;
+    }
+    return 'unknown error';
+}
+function isNoSuchTable(err) {
+    if (typeof err !== 'object' || err === null)
+        return false;
+    const { code, errno } = err;
+    return code === 'ER_NO_SUCH_TABLE' || errno === ER_NO_SUCH_TABLE;
+}
+/** No candidate holds a ledger table: name every location, tell the operator what to set. */
+function notFoundMessage(tried, unverified) {
+    const where = tried.map((l) => `${l.database}.${l.table}`).join(', ');
+    return (`Shield migration ledger not found (tried, in order: ${where}); ` +
+        `${unverified} framework migrations are unverified. Set DDL_DB_NAME to the ledger database, ` +
+        'the same value for `astram-migrate` and the server, and run `astram-migrate migrate` ' +
+        'with the deploy account before starting the server.');
+}
+/** One information_schema probe: does `l.database` hold the table `l.table`? Names validated. */
+function probeSql(l) {
+    return ('SELECT 1 AS present FROM information_schema.TABLES ' +
+        `WHERE TABLE_SCHEMA = '${l.database}' AND TABLE_NAME = '${l.table}' LIMIT 1`);
+}
+function missingMessage(database, missing) {
+    const listed = missing.slice(0, MAX_LISTED_IDS);
+    const more = missing.length - listed.length;
+    const ids = more > 0 ? `${listed.join(', ')}, … ${more} more` : listed.join(', ');
+    return (`Shield database ${database} is missing ${missing.length} framework migrations (${ids}). ` +
+        'Run `astram-migrate migrate` with the deploy account before starting the server.');
+}
+/**
+ * Compare the shipped migration ids in `migrationsDir` with the ledger; throw (production) or
+ * warn (development/test) when any is missing or the ledger cannot be read.
+ * @throws Error naming the database and up to 10 missing ids, outside development/test; and in
+ *   every environment for an invalid ledger database or table name (checked before any query).
+ */
+async function assertFrameworkMigrationsApplied(options) {
+    // Every location is validated before any query (operator names: any plain MariaDB identifier).
+    const locations = [
+        { database: options.database, table: options.table },
+        ...(options.alternatives ?? []),
+    ].map((l) => {
+        const database = (0, core_1.assertLedgerDatabaseName)(l.database, 'migration ledger database');
+        if (typeof l.table !== 'string' || !core_1.MIGRATION_LEDGER_TABLE_PATTERN.test(l.table)) {
+            throw new Error(`APP_MIGRATION_TABLE is not a valid table name; expected ${core_1.MIGRATION_LEDGER_TABLE_PATTERN.source}`);
+        }
+        return { database, table: l.table };
+    });
+    let { database, table } = locations[0];
+    const devOrTest = (0, app_config_js_1.isDevOrTestNodeEnv)(options.nodeEnv);
+    const fail = (message, missing) => {
+        if (!devOrTest)
+            throw new Error(message);
+        options.logger.warn(`${message} (NODE_ENV=${options.nodeEnv}: continuing)`);
+        return { ok: false, missing };
+    };
+    let shipped;
+    try {
+        const dirs = typeof options.migrationsDir === 'string' ? [options.migrationsDir] : options.migrationsDir;
+        shipped = sortIds([...new Set(dirs.flatMap((d) => frameworkMigrationIds(d)))]);
+    }
+    catch (err) {
+        return fail(`Shield database ${database}: cannot read the framework migrations directory ` +
+            `(${errorCode(err)}); the package install is incomplete.`, []);
+    }
+    if (shipped.length === 0)
+        return { ok: true, missing: [] };
+    // Several candidates (default namespace): use the first whose ledger table exists. A probe
+    // error is never "not here" or "all applied": it fails like an unreadable ledger.
+    if (locations.length > 1) {
+        let found;
+        for (const l of locations) {
+            let rows;
+            try {
+                rows = await options.query(probeSql(l));
+            }
+            catch (err) {
+                return fail(`Shield database ${l.database}: cannot look for the migration ledger ` +
+                    `${l.database}.${l.table} (${errorCode(err)}); ${shipped.length} framework ` +
+                    'migrations are unverified.', shipped);
+            }
+            if (!Array.isArray(rows)) {
+                return fail(`Shield database ${l.database}: cannot look for the migration ledger ` +
+                    `${l.database}.${l.table} (UNEXPECTED_RESULT); ${shipped.length} framework ` +
+                    'migrations are unverified.', shipped);
+            }
+            if (rows.length > 0) {
+                found = l;
+                break;
+            }
+        }
+        if (found === undefined)
+            return fail(notFoundMessage(locations, shipped.length), shipped);
+        ({ database, table } = found);
+    }
+    let applied;
+    try {
+        const rows = await options.query(`SELECT id FROM \`${database}\`.\`${table}\``);
+        if (!Array.isArray(rows))
+            throw Object.assign(new Error(), { code: 'UNEXPECTED_RESULT' });
+        applied = new Set(rows.map((r) => idKey(String(r?.id ?? ''))));
+    }
+    catch (err) {
+        // No ledger table: nothing was ever migrated here, so every shipped id is missing.
+        if (isNoSuchTable(err))
+            return fail(missingMessage(database, shipped), shipped);
+        return fail(`Shield database ${database}: cannot read the migration ledger ${database}.${table} ` +
+            `(${errorCode(err)}); ${shipped.length} framework migrations are unverified.`, shipped);
+    }
+    const missing = shipped.filter((id) => !applied.has(idKey(id)));
+    if (missing.length === 0)
+        return { ok: true, missing: [] };
+    return fail(missingMessage(database, missing), missing);
+}
+/** DI token of the per-app {@link MigrationLedgerRegistry} (provided by `ShieldModule`). */
+exports.SHIELD_MIGRATION_LEDGER_REGISTRY = Symbol('SHIELD_MIGRATION_LEDGER_REGISTRY');
+/** DI token of guard's own check (`AuthModule`); identity provides its check under its own token. */
+exports.SHIELD_GUARD_MIGRATION_LEDGER_CHECK = Symbol('SHIELD_GUARD_MIGRATION_LEDGER_CHECK');
+/**
+ * Merges the ledger checks of one application (guard's `AuthModule` and identity) so each ledger
+ * location is read once. Hooks {@link register} at construction (all providers exist before any
+ * bootstrap hook runs); the first {@link run} for a location checks the union of every registered
+ * directory and caches that promise, so later hooks share the result, rejection included.
+ */
+class MigrationLedgerRegistry {
+    entries = new Map();
+    /** The whole candidate list: hooks with the same list share one probe + read. */
+    static key(l) {
+        return [l, ...(l.alternatives ?? [])]
+            .map((x) => `${x.database}\u0000${x.table}`)
+            .join('\u0001');
+    }
+    /** Add `options.migrationsDir` to the check of `options`' ledger location. */
+    register(options) {
+        const dirs = typeof options.migrationsDir === 'string' ? [options.migrationsDir] : options.migrationsDir;
+        const key = MigrationLedgerRegistry.key(options);
+        const entry = this.entries.get(key);
+        if (entry === undefined) {
+            this.entries.set(key, { options, dirs: new Set(dirs) });
+            return;
+        }
+        if (entry.result !== undefined) {
+            throw new Error('MigrationLedgerRegistry: a check registered after the ledger was read.');
+        }
+        for (const d of dirs)
+            entry.dirs.add(d);
+    }
+    /** The (shared) check of `location`'s ledger over every registered directory. */
+    run(location) {
+        const entry = this.entries.get(MigrationLedgerRegistry.key(location));
+        // Never registered: nothing to share, nothing claims "checked" (fail closed).
+        if (entry === undefined) {
+            return Promise.reject(new Error('MigrationLedgerRegistry: ledger location not registered.'));
+        }
+        entry.result ??= assertFrameworkMigrationsApplied({
+            ...entry.options,
+            migrationsDir: [...entry.dirs],
+        });
+        return entry.result;
+    }
+}
+exports.MigrationLedgerRegistry = MigrationLedgerRegistry;
+/**
+ * The boot hook: runs {@link assertFrameworkMigrationsApplied} once, when Nest bootstraps the
+ * application (after module init, before the HTTP server listens). Never on a request. With a
+ * {@link MigrationLedgerRegistry}, it shares one read per ledger location with the app's other
+ * hooks; without one (`null`/absent), it checks alone.
+ */
+class FrameworkMigrationLedgerCheck {
+    options;
+    registry;
+    constructor(options, registry = null) {
+        this.options = options;
+        this.registry = registry;
+        registry?.register(options);
+    }
+    async onApplicationBootstrap() {
+        if (this.registry)
+            await this.registry.run(this.options);
+        else
+            await assertFrameworkMigrationsApplied(this.options);
+    }
+}
+exports.FrameworkMigrationLedgerCheck = FrameworkMigrationLedgerCheck;

package/dist/boot/single-layout-probe.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Single-database-layout boot privilege probe (single-database-layout spec §5.F, Req 7, AC-8,
+ * ADR-0041).
+ *
+ * With `SHIELD_DB_LAYOUT=single` the four framework modules share one database, so the isolation
+ * the four-database grant matrix gave is partly gone. Which protections are really lost depends on
+ * what the runtime account may do, so this reads (never writes) `information_schema`
+ * USER_PRIVILEGES / SCHEMA_PRIVILEGES / TABLE_PRIVILEGES / COLUMN_PRIVILEGES / APPLICABLE_ROLES for `CURRENT_USER()`, once at boot, and
+ * derives the five protections lost (spec §5.F). It does not look for `prune_audit`: MariaDB hides
+ * a routine from an account without EXECUTE on it, which the runtime account must not have (spec
+ * v3); `audit:prune` reports a missing routine itself.
+ *
+ * `GRANT ... TO PUBLIC` (MariaDB 10.11+) applies to every account but information_schema shows
+ * those rows only to privileged accounts (verified on 10.11 and 11.4: a plain account sees none).
+ * `SHOW GRANTS` for the current user needs no privilege and does list them, so its `TO PUBLIC`
+ * lines are parsed and merged with the information_schema rows. Its routine-level lines
+ * (`ON PROCEDURE|FUNCTION`) are the only view of routine privileges the account has: any such grant
+ * on the database loses the retention floor. An unparsable line of the account's own is ignored, an
+ * unparsable PUBLIC or routine line fails closed; a failing `SHOW GRANTS`
+ * fails closed like any other failed read.
+ *
+ * The probe never blocks boot (the operator's ack already accepted the risk) and is never on the
+ * request path (Shield #12). Warning lines carry no credential and no host (Shield #10): a failed
+ * query's driver message is dropped.
+ */
+import { Logger, type OnApplicationBootstrap } from '@nestjs/common';
+/** Runs one parameterized read on the runtime pool (a mariadb `Pool.query` fits). */
+export type ProbeQuery = (sql: string, params?: unknown[]) => Promise<unknown[]>;
+/** Id of a protection the single layout can lose. */
+export type LostProtectionId = 'append-only-audit' | 'no-runtime-ddl' | 'schema-separation' | 'retention-floor' | 'separate-ddl-account';
+/** One lost protection: id, the invariant it belongs to, and the operator-facing text. */
+export interface LostProtection {
+    readonly id: LostProtectionId;
+    /** The Shield invariant citation, e.g. `Shield #6`. */
+    readonly invariant: string;
+    readonly text: string;
+}
+/** The probe outcome. `readFailed` ⇒ the privileges could not be read (all five reported). */
+export interface SingleLayoutProbe {
+    readonly lost: readonly LostProtection[];
+    readonly readFailed: boolean;
+}
+/**
+ * Derive the protections the runtime account has lost. Never throws, and never reports the audit
+ * wall intact when it cannot see the grants: a failed query, a runtime account whose own
+ * SELECT+INSERT on the database is invisible, or an account with roles (not inspected) reports all
+ * five with `readFailed`.
+ */
+export declare function probeSingleLayoutPrivileges(query: ProbeQuery, database: string): Promise<SingleLayoutProbe>;
+/**
+ * The boot warning: a header naming the database and ADR-0041, then one line per lost protection
+ * citing its invariant. No credential, host or driver message.
+ */
+export declare function singleLayoutWarningLines(probe: SingleLayoutProbe, database: string): string[];
+/**
+ * Runs the probe once at application bootstrap on the runtime pool and logs the warning. Never
+ * throws, so boot is never blocked (spec §5.F).
+ */
+export declare class SingleLayoutProbeBoot implements OnApplicationBootstrap {
+    private readonly query;
+    private readonly database;
+    private readonly logger;
+    constructor(query: ProbeQuery, database: string, logger?: Pick<Logger, 'warn'>);
+    onApplicationBootstrap(): Promise<void>;
+}
+//# sourceMappingURL=single-layout-probe.d.ts.map

package/dist/boot/single-layout-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-layout-probe.d.ts","sourceRoot":"","sources":["../../src/boot/single-layout-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,MAAM,EAAE,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAErE,qFAAqF;AACrF,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AAEjF,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GACxB,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,sBAAsB,CAAC;AAE3B,0FAA0F;AAC1F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,8FAA8F;AAC9F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAoMD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,iBAAiB,CAAC,CAoG5B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB7F;AAED;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAwB;IAGhE,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;CAI9C"}