@bevel-software/platform-core-backend 0.1.0

package/dist/modules/access/access-control.service.d.ts

@@ -0,0 +1,323 @@
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { IAccessControl, AccessTargetKind, GrantPrincipal, GrantSources } from './access-control.interface.js';
+export declare const ADMIN_CANONICAL = "admin";
+/**
+ * Verbs the resolver understands in an `access.md` frontmatter. Each verb
+ * is a list of grants (role or `Name <email>` references, optionally
+ * prefixed with `deny `). Keep `Verb` and `KNOWN_VERBS` in lockstep —
+ * `AccessFile.entries` is statically keyed on this union.
+ *
+ * `read` controls who may VIEW a path (the file viewer, embed surface, and
+ * the agent's read tools). It is **default-deny**: a path with no effective
+ * `read:` or `owner:` grant is not readable. To make content public, list the
+ * built-in role `everyone` under `read:`.
+ *
+ * The verbs nest: `owner` is a superset of `read` + `write` + `download`, and
+ * `write` is itself a superset of `read` (anyone who can edit can view). An
+ * `owner` grant therefore confers all three lower verbs, a `write` grant
+ * additionally confers `read`, and `owner` also marks the principal as a
+ * contact point for the node (surfaced in the UI so users know who to ask).
+ * See `sourceVerbsFor` for how these implications fold into resolution.
+ */
+export declare const KNOWN_VERBS: readonly ["read", "write", "download", "owner"];
+export type Verb = (typeof KNOWN_VERBS)[number];
+export declare const EVERYONE_CANONICAL = "everyone";
+/** Display name for the built-in `everyone` role in the share UI. */
+export declare const EVERYONE_DISPLAY = "Everyone";
+/**
+ * Verbs whose entries contribute to resolving `verb`, target verb first.
+ * `owner` implies `read`, `write`, and `download`; `write` additionally
+ * implies `read`. So resolving `read` folds in `write` and `owner`, resolving
+ * `write`/`download` folds in `owner`, and resolving `owner` uses only `owner`.
+ *
+ * The implication is **grant-only** (see `resolveAtPath`): a superset grant
+ * confers the lower verb, but a superset *denial* does not — `deny write` says
+ * nothing about `read`, so it never strips a separate read grant. The target
+ * verb itself contributes both its grants and its denials.
+ */
+export declare function sourceVerbsFor(verb: Verb): Verb[];
+export declare const RESERVED_ROLE_NAMES: Set<string>;
+export declare const DENY_PREFIX = "deny ";
+export declare const USER_REF_REGEX: RegExp;
+export declare const EMAIL_REGEX: RegExp;
+export interface RoleEntry {
+    kind: 'role';
+    role: string;
+    displayRole: string;
+    deny: boolean;
+}
+export interface UserEntry {
+    kind: 'user';
+    email: string;
+    displayName: string;
+    deny: boolean;
+}
+export type ParsedEntry = RoleEntry | UserEntry;
+export declare function isAccessMdPath(p: string): boolean;
+interface RolesIndex {
+    byCanonical: Map<string, {
+        displayName: string;
+        emails: Set<string>;
+    }>;
+    byEmail: Map<string, Set<string>>;
+}
+type YamlValue = string | YamlValue[] | {
+    [key: string]: YamlValue;
+} | null;
+interface YamlOk {
+    ok: true;
+    value: YamlValue;
+}
+interface YamlErr {
+    ok: false;
+    error: string;
+}
+export declare function parseYamlSubset(text: string): YamlOk | YamlErr;
+export declare function extractFrontmatter(text: string): {
+    ok: true;
+    frontmatter: string;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function canonicalRoleName(name: string): string;
+export declare function canonicalEmail(email: string): string;
+export declare function parseAccessEntry(raw: unknown): {
+    ok: true;
+    entry: ParsedEntry;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function parseRolesYaml(text: string): {
+    ok: true;
+    index: RolesIndex;
+} | {
+    ok: false;
+    errors: string[];
+};
+/**
+ * Per-verb access entries declared in a single node file's *own* frontmatter
+ * (the same YAML block that carries `nodeType:`). This is the most-specific
+ * scope — applied after every directory `access.md` in the chain.
+ */
+type OwnEntries = Record<Verb, ParsedEntry[]>;
+/**
+ * Parse the access verbs a node file declares in its own YAML frontmatter.
+ * Returns the per-verb entry lists, or null when the file has no frontmatter
+ * or declares no access verb at all.
+ *
+ * Forgiving by design — a node's frontmatter legitimately carries non-access
+ * keys (notably `nodeType:`), so unknown keys are ignored, and a malformed
+ * entry is dropped rather than failing the file. A typo in a node's `owner:`
+ * must never make the node unreadable; it just doesn't grant anything.
+ */
+export declare function parseOwnAccessEntries(text: string): OwnEntries | null;
+/**
+ * Where a single access scope's rules live. `'own'` is the node's own
+ * frontmatter (the most-specific scope, only present for a file target);
+ * otherwise it's the repo-relative `access.md` path that governs the scope
+ * (e.g. `access.md`, `Knowledge/Sales/access.md`). `grantSources` reads this
+ * to tell the dialog WHERE a principal's access comes from. */
+export type ScopeSource = {
+    kind: 'own';
+} | {
+    kind: 'access-md';
+    path: string;
+};
+export declare class AccessControlService implements IAccessControl {
+    private readonly workspaceService;
+    private readonly kbDirName;
+    /**
+     * Per-workspace cache: `model` is the resolved access tree and `loadedAt`
+     * is when we computed it. We re-load on a TTL — the validator runs on
+     * every commit so stale state surfaces quickly anyway, and the read cost
+     * is small (a few small files).
+     */
+    private readonly cache;
+    private static readonly CACHE_TTL_MS;
+    /**
+     * Per-workspace memo of node frontmatter access entries (keyed by
+     * repo-relative path), for the BATCH checks — the explorer tree resolves
+     * every KB file on each load, which would otherwise cost one `fs.readFile`
+     * per node per tree build. Dropped by `invalidate()` — which fires on every
+     * commit / pull / branch switch, i.e. on every path a frontmatter edit can
+     * land through — so that is the PRIMARY freshness mechanism; the TTL is
+     * only a long backstop against a missed invalidation. It is deliberately
+     * NOT the model cache's 5s TTL: at 5s every tree build was effectively
+     * cold (~one full-KB read sweep per build). Single-file gates (`canRead` /
+     * `canWrite`) stay uncached — the write gate reads disk-fresh on purpose.
+     */
+    private readonly ownEntriesCache;
+    private static readonly OWN_ENTRIES_TTL_MS;
+    constructor(workspaceService: WorkspaceService, kbDirName: string);
+    /**
+     * Drop a workspace's cached model + frontmatter memo. Call after operations
+     * that mutate the working tree — commit, push, pull, branch switch.
+     */
+    invalidate(workspaceId: string): void;
+    /** Memoized `readOwnEntries` for the batch paths; see `ownEntriesCache`. */
+    private cachedOwnEntries;
+    /**
+     * Validate a candidate `roles.yaml` against the resolver's OWN parser without
+     * writing it. See `IAccessControl.validateRolesYaml` — this is the gate that
+     * makes a malformed-`roles.yaml` admin lockout structurally impossible: the
+     * roles-admin service runs it on every candidate before committing, and
+     * because it IS `parseRolesYaml`, any text that passes here is loadable by
+     * `loadModel`.
+     */
+    validateRolesYaml(text: string): {
+        ok: true;
+    } | {
+        ok: false;
+        errors: string[];
+    };
+    /**
+     * Advisory scan of folder `access.md` files for references to a role (by
+     * canonical name). See `IAccessControl.referencesToRole` — undercounts node
+     * frontmatter by design; powers the delete warning only, never the rename
+     * gate.
+     */
+    referencesToRole(workspaceId: string, canonicalRole: string): Promise<{
+        path: string;
+        verb: string;
+    }[]>;
+    canWrite(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
+    canRead(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
+    canReadBatch(workspaceId: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean>>;
+    canWriteBatch(workspaceId: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean>>;
+    canDownload(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
+    canOwner(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
+    eligibleOwners(workspaceId: string, relativePath: string): Promise<{
+        roles: string[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+    }>;
+    eligibleWriters(workspaceId: string, relativePath: string): Promise<{
+        roles: string[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+    }>;
+    eligibleReaders(workspaceId: string, relativePath: string): Promise<{
+        restricted: boolean;
+        roles: string[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+    }>;
+    eligibleDownloaders(workspaceId: string, relativePath: string): Promise<{
+        roles: string[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+    }>;
+    eligibleWriterEmails(workspaceId: string, relativePath: string): Promise<Map<string, {
+        name: string;
+        email: string;
+    }>>;
+    eligibleOwnerEmails(workspaceId: string, relativePath: string): Promise<Map<string, {
+        name: string;
+        email: string;
+    }>>;
+    grantSources(workspaceId: string, kind: AccessTargetKind, relativePath: string, principal: GrantPrincipal): Promise<GrantSources>;
+    kbPrincipals(workspaceId: string): Promise<{
+        groups: string[];
+        people: {
+            name: string;
+            email: string;
+        }[];
+    }>;
+    findEmailByHash(workspaceId: string, hash: string): Promise<{
+        email: string;
+        displayName: string;
+    } | null>;
+    canWriteAtRef(workspaceId: string, ref: string, userEmail: string, relativePath: string): Promise<boolean | null>;
+    canReadAtRef(workspaceId: string, ref: string, userEmail: string, relativePath: string): Promise<boolean | null>;
+    canWriteBatchAtRef(workspaceId: string, ref: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean> | null>;
+    eligibleWritersAtRef(workspaceId: string, ref: string, relativePath: string): Promise<{
+        roles: string[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+    } | null>;
+    eligibleWritersForPathsAtRef(workspaceId: string, ref: string, relativePaths: string[]): Promise<Map<string, {
+        roles: string[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+        emails: Set<string>;
+        excludedEmails?: Set<string>;
+    }> | null>;
+    private loadModel;
+    private collectAccessFiles;
+    private repoDir;
+    /**
+     * Read the access verbs a node file declares in its own frontmatter from the
+     * working tree. Returns null when the file has no per-file access config
+     * (the common case). `access.md` and `roles.yaml` are skipped — `access.md`
+     * frontmatter governs its directory (handled by the dir chain), not itself,
+     * and `roles.yaml` is not a node.
+     */
+    private readOwnEntries;
+    /**
+     * Same as `readOwnEntries` but reads the file at a specific git ref. The ref
+     * MUST be the same one the dir model was loaded at — otherwise a user could
+     * grant themselves rights by editing a file's frontmatter in a branch the
+     * gate isn't reading from.
+     */
+    private readOwnEntriesAtRef;
+    /**
+     * Batched `readOwnEntriesAtRef`: ONE `git cat-file --batch` process reads
+     * every path's blob at `ref`, instead of one `git show` SPAWN per path —
+     * the difference between minutes and sub-second when a change request
+     * touches hundreds of files. Paths missing at the ref, non-blob paths, and
+     * `access.md`/`roles.yaml` (which carry no own-entries) resolve to null,
+     * mirroring the single-path helper.
+     */
+    private readOwnEntriesAtRefBatch;
+    /**
+     * Resolve a candidate ref to one git accepts. Falls back to `origin/<ref>`
+     * for short branch names, matching the heuristic in
+     * `WorkspaceService.readFileAtRef`.
+     */
+    private refCandidates;
+    /**
+     * Read a file's content at a specific ref via `git show <ref>:<path>`.
+     * Returns null when the file is absent on that ref (or the ref doesn't
+     * resolve).
+     */
+    private showAtRef;
+    /**
+     * List every `access.md` path that exists at any depth as of `ref`.
+     * The access tree is structure-agnostic: any `access.md` participates
+     * regardless of where it sits. Uses `git ls-tree -r --name-only`.
+     */
+    private listAccessFilesAtRef;
+    /**
+     * Build the access model from the access tree as it exists on a specific
+     * ref. The ref is the authoritative source — typically `origin/<base>`
+     * for PR-time decisions, so a malicious user can't grant themselves
+     * approval rights by editing access.md in their working tree (or even on
+     * an unmerged branch).
+     *
+     * Returns null when the ref doesn't carry usable access config (no
+     * `roles.yaml`, or roles.yaml is malformed). Callers treat null as
+     * "can't determine eligibility, deny." That includes the bootstrap case
+     * where access.md hasn't been merged to the target branch yet — admins
+     * must commit the initial config directly to the protected branch before
+     * the gate becomes useful. NEVER fall back to the working tree here: a
+     * working-tree fallback lets anyone with edit access to access.md grant
+     * themselves approval rights.
+     */
+    private loadModelAtRef;
+}
+export {};
+//# sourceMappingURL=access-control.service.d.ts.map

package/dist/modules/access/access-control.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.service.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,cAAc,EAEd,YAAY,EACb,MAAM,+BAA+B,CAAC;AAyEvC,eAAO,MAAM,eAAe,UAAU,CAAC;AACvC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,WAAW,iDAAkD,CAAC;AAC3E,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAC7C,qEAAqE;AACrE,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,CASjD;AACD,eAAO,MAAM,mBAAmB,aAAwC,CAAC;AACzE,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,eAAO,MAAM,cAAc,QAA6C,CAAC;AACzE,eAAO,MAAM,WAAW,QAAqC,CAAC;AAM9D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAqBhD,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,UAAU,UAAU;IAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;IACvE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;CACnC;AAqBD,KAAK,SAAS,GAAG,MAAM,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,IAAI,CAAC;AAE5E,UAAU,MAAM;IACd,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,UAAU,OAAO;IACf,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAkDD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAoE9D;AAMD,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAWlE;AAMD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAMD,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,OAAO,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAkCjE;AAMD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAyEnE;AA6DD;;;;GAIG;AACH,KAAK,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAE9C;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CA8BrE;AAED;;;;;+DAK+D;AAC/D,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AA2chF,qBAAa,oBAAqB,YAAW,cAAc;IA6BvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IA7B5B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+D;IACrF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAS;IAE7C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAc;gBAGrC,gBAAgB,EAAE,gBAAgB,EAClC,SAAS,EAAE,MAAM;IAGpC;;;OAGG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAKrC,4EAA4E;YAC9D,gBAAgB;IAiB9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAK/E;;;;;OAKG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAetC,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAc1B,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAY1B,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAMnE,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAMnE,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAaxF,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAMnE,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,YAAY,CAAC;IAiBlB,YAAY,CAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAqCrE,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqCnD,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQpB,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQpB,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAcjC,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAQ1E,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC;YA6BK,SAAS;YA6DT,kBAAkB;YA0ClB,OAAO;IAKrB;;;;;;OAMG;YACW,cAAc;IAc5B;;;;;OAKG;YACW,mBAAmB;IAWjC;;;;;;;OAOG;YACW,wBAAwB;IAoBtC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAKrB;;;;OAIG;YACW,SAAS;IAavB;;;;OAIG;YACW,oBAAoB;IAmBlC;;;;;;;;;;;;;;;OAeG;YACW,cAAc;CAyD7B"}