@bevel-software/platform-core-backend 0.23.0 → 0.25.0

package/dist/modules/database/connection.d.ts

@@ -1,4 +1,5 @@
 import * as schema from './schema.js';
+import { type PiiKeys } from '../../shared/column-crypto.js';
 /**
  * One database, one schema per knowledge base.
  *
@@ -43,6 +44,14 @@ export interface DbOptions {
     max?: number;
     /** How long an idle connection is kept before the pool closes it. Default: `pg`'s. */
     idleTimeoutMillis?: number;
+    /**
+     * The key this handle seals personal data with: the `SECRETS_ENC_KEY` of
+     * the knowledge base whose rows it holds (its own derived one, for a
+     * tenant). Without it the handle reads sealed values as their blobs and
+     * refuses to write one — right for a handle that only touches tables with
+     * no personal data, and a loud failure for one that was meant to have it.
+     */
+    piiKey?: string;
 }
 /**
  * A NEW pool on `databaseUrl`, searching `opts.schema` first. Not cached:
@@ -56,6 +65,13 @@ export declare function createDb(databaseUrl: string, opts?: DbOptions): import(
 export type Database = ReturnType<typeof createDb>;
 /** The schema a database handle searches first — for the callers that name it in DDL. */
 export declare function dbSchemaOf(db: Pick<Database, '$client'>): string;
+/**
+ * The keys a handle seals personal data with — for the few callers that
+ * handle the stored form themselves (the backfill at start; an overlay's own
+ * SQL). Everything else never sees a key: the column types and the handle's
+ * connection do the work. Throws for a handle built without one.
+ */
+export declare function piiKeysOf(db: Pick<Database, '$client'>): PiiKeys;
 /**
  * The process's pool on `databaseUrl` for `opts.schema`, created on first
  * use and shared afterwards. One per (url, schema): two handles on the same

package/dist/modules/database/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/modules/database/connection.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcrD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUnG;AAED,MAAM,WAAW,SAAS;IACxB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAcD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE,SAAc;;EAgBjE;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEnD,yFAAyF;AACzF,wBAAgB,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,CAEhE;AAOD;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE,SAAc,GAAG,QAAQ,CASzE;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1E"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/modules/database/connection.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAkD,KAAK,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAE7G;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcrD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUnG;AAED,MAAM,WAAW,SAAS;IACxB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAmFD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE,SAAc;;EAqBjE;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEnD,yFAAyF;AACzF,wBAAgB,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,OAAO,CAMhE;AAQD;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE,SAAc,GAAG,QAAQ,CAazE;AAiBD;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1E"}

package/dist/modules/database/connection.js

@@ -2,6 +2,7 @@ import { sql } from 'drizzle-orm';
 import { drizzle } from 'drizzle-orm/node-postgres';
 import pg from 'pg';
 import * as schema from './schema.js';
+import { PII_CIPHERTEXT_PREFIX, PiiParam, derivePiiKeys } from '../../shared/column-crypto.js';
 /**
  * One database, one schema per knowledge base.
  *
@@ -55,6 +56,81 @@ export async function assertSearchPath(db, schema) {
             'use session pooling, or connect directly.');
     }
 }
+/**
+ * The `pg` client of a handle that holds `keys`: the one place personal data
+ * changes form. Going in, every value a personal-data column marked (see
+ * `column-crypto.ts`) is replaced by its ciphertext or its blind index.
+ * Coming out, every sealed value of a result is opened — by its prefix, not
+ * by its column, so raw SQL through the handle reads plaintext too; a
+ * statement that needs what is STORED asks for it as bytes
+ * (`convert_to(col, 'UTF8')`).
+ *
+ * At the client, because that is what the handle owns: the pool builds every
+ * connection from this class, a transaction's included, so there is no path
+ * from this handle to the database that goes round it. Results that are
+ * streamed to a `Submittable` (a cursor) are not opened; nothing here uses one.
+ */
+function keyedClient(keys) {
+    const stored = (value) => {
+        if (!(value instanceof PiiParam))
+            return value;
+        return keys ? value.stored(keys) : value.toPostgres();
+    };
+    const openCell = (value) => typeof value === 'string' && value.startsWith(PII_CIPHERTEXT_PREFIX) ? keys.read(value) : value;
+    const openOne = (result) => {
+        const rows = result?.rows;
+        if (!Array.isArray(rows))
+            return;
+        for (const row of rows) {
+            if (Array.isArray(row)) {
+                for (let i = 0; i < row.length; i++)
+                    row[i] = openCell(row[i]);
+            }
+            else if (row && typeof row === 'object') {
+                const record = row;
+                for (const column of Object.keys(record))
+                    record[column] = openCell(record[column]);
+            }
+        }
+    };
+    const open = (result) => {
+        if (!keys)
+            return result;
+        // Several statements in one query string come back as several results.
+        if (Array.isArray(result))
+            result.forEach(openOne);
+        else
+            openOne(result);
+        return result;
+    };
+    const base = pg.Client.prototype.query;
+    class KeyedClient extends pg.Client {
+    }
+    const query = function (config, values, callback) {
+        if (typeof values === 'function') {
+            callback = values;
+            values = undefined;
+        }
+        if (Array.isArray(values)) {
+            values = values.map(stored);
+        }
+        else if (config && typeof config === 'object' && Array.isArray(config.values)) {
+            const withValues = config;
+            if (typeof withValues.submit === 'function')
+                withValues.values = withValues.values.map(stored);
+            else
+                config = { ...withValues, values: withValues.values.map(stored) };
+        }
+        if (typeof callback === 'function') {
+            const done = callback;
+            return base.call(this, config, values, (err, result) => done(err, err ? result : open(result)));
+        }
+        const pending = base.call(this, config, values);
+        return pending instanceof Promise ? pending.then(open) : pending;
+    };
+    Object.defineProperty(KeyedClient.prototype, 'query', { value: query, writable: true, configurable: true });
+    return KeyedClient;
+}
 /**
  * A bounded handshake: `pg` waits forever by default for a NEW connection to
  * come up, so a database that accepts the socket and never finishes the
@@ -74,7 +150,11 @@ const CONNECT_TIMEOUT_MS = 30_000;
  */
 export function createDb(databaseUrl, opts = {}) {
     const dbSchema = assertSchemaName(opts.schema ?? DEFAULT_DB_SCHEMA);
+    // Only an ABSENT key means "this handle holds none". A blank or malformed
+    // one was meant to be a key, and is refused here rather than read as none.
+    const keys = opts.piiKey === undefined ? null : derivePiiKeys(opts.piiKey);
     const pool = new pg.Pool({
+        Client: keyedClient(keys),
         connectionString: databaseUrl,
         connectionTimeoutMillis: CONNECT_TIMEOUT_MS,
         max: opts.max,
@@ -87,13 +167,29 @@ export function createDb(databaseUrl, opts = {}) {
     });
     const db = drizzle(pool, { schema });
     schemas.set(db, dbSchema);
+    if (keys)
+        piiKeys.set(db, { keys, of: opts.piiKey });
     return db;
 }
 /** The schema a database handle searches first — for the callers that name it in DDL. */
 export function dbSchemaOf(db) {
     return schemas.get(db) ?? DEFAULT_DB_SCHEMA;
 }
+/**
+ * The keys a handle seals personal data with — for the few callers that
+ * handle the stored form themselves (the backfill at start; an overlay's own
+ * SQL). Everything else never sees a key: the column types and the handle's
+ * connection do the work. Throws for a handle built without one.
+ */
+export function piiKeysOf(db) {
+    const held = piiKeys.get(db);
+    if (!held) {
+        throw new Error('This database handle holds no personal-data key: build it with createDb/getDb and its piiKey.');
+    }
+    return held.keys;
+}
 const schemas = new WeakMap();
+const piiKeys = new WeakMap();
 const cache = new Map();
 const cacheKey = (databaseUrl, dbSchema) => `${dbSchema}\u0000${databaseUrl}`;
 /**
@@ -109,8 +205,29 @@ export function getDb(databaseUrl, opts = {}) {
         db = createDb(databaseUrl, opts);
         cache.set(key, db);
     }
+    else if (opts.piiKey !== undefined && !holdsKey(db, opts.piiKey)) {
+        // One schema is one knowledge base and one key. Handing back the cached
+        // pool would seal this caller's rows under the other caller's key.
+        throw new Error(`The database handle for schema "${dbSchema}" is already open with a different personal-data key.`);
+    }
     return db;
 }
+/**
+ * Whether `db` was opened with the key `piiKey` spells. The KEY, not its
+ * spelling: `SECRETS_ENC_KEY` may be written as hex or as base64, and one
+ * process can be handed the same 32 bytes both ways — refusing the second as
+ * "a different key" would refuse a caller that holds the right one. Compared
+ * through what the two derive, so no key material is held here to compare.
+ */
+function holdsKey(db, piiKey) {
+    const held = piiKeys.get(db);
+    if (!held)
+        return false;
+    if (held.of === piiKey)
+        return true;
+    const probe = 'same-key?';
+    return held.keys.index(probe) === derivePiiKeys(piiKey).index(probe);
+}
 /**
  * End a handle's pool and forget it, so a later {@link getDb} for the same
  * schema opens a fresh one rather than handing out a pool that was ended.

package/dist/modules/database/connection.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../src/modules/database/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,sGAAsG,IAAI,GAAG,CAC9G,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,0EAA0E;IAC1E,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,eAAe,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAA6B,EAAE,MAAc;IAClF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mCAAmC,CAAC,CAAC;IACxE,MAAM,OAAO,GAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAqC,EAAE,MAAM,IAAI,IAAI,CAAC;IACpF,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,IAAI,QAAQ,uCAAuC,MAAM,KAAK;YACnG,0FAA0F;YAC1F,2CAA2C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAeD;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,WAAmB,EAAE,OAAkB,EAAE;IAChE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;QACvB,gBAAgB,EAAE,WAAW;QAC7B,uBAAuB,EAAE,kBAAkB;QAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,sEAAsE;QACtE,gEAAgE;QAChE,mEAAmE;QACnE,qDAAqD;QACrD,GAAG,CAAC,QAAQ,KAAK,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,QAAQ,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC;AACZ,CAAC;AAID,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAC,EAA6B;IACtD,OAAO,OAAO,CAAC,GAAG,CAAC,EAAc,CAAC,IAAI,iBAAiB,CAAC;AAC1D,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAoB,CAAC;AAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C,MAAM,QAAQ,GAAG,CAAC,WAAmB,EAAE,QAAgB,EAAE,EAAE,CAAC,GAAG,QAAQ,SAAS,WAAW,EAAE,CAAC;AAE9F;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,WAAmB,EAAE,OAAkB,EAAE;IAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAA6B;IACzD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,IAAI,MAAM,KAAK,EAAE;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../src/modules/database/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,aAAa,EAAgB,MAAM,+BAA+B,CAAC;AAE7G;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,sGAAsG,IAAI,GAAG,CAC9G,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,0EAA0E;IAC1E,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,eAAe,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAA6B,EAAE,MAAc;IAClF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mCAAmC,CAAC,CAAC;IACxE,MAAM,OAAO,GAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAqC,EAAE,MAAM,IAAI,IAAI,CAAC;IACpF,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,IAAI,QAAQ,uCAAuC,MAAM,KAAK;YACnG,0FAA0F;YAC1F,2CAA2C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AA0BD;;;;;;;;;;;;;GAaG;AACH,SAAS,WAAW,CAAC,IAAoB;IACvC,MAAM,MAAM,GAAG,CAAC,KAAc,EAAW,EAAE;QACzC,IAAI,CAAC,CAAC,KAAK,YAAY,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;IACxD,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAW,EAAE,CAC3C,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnG,MAAM,OAAO,GAAG,CAAC,MAAe,EAAQ,EAAE;QACxC,MAAM,IAAI,GAAI,MAAoC,EAAE,IAAI,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;oBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,CAAC;iBAAM,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,GAA8B,CAAC;gBAC9C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAK,MAAS,EAAK,EAAE;QAChC,IAAI,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC;QACzB,uEAAuE;QACvE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;;YAC9C,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAA2B,CAAC;IAC7D,MAAM,WAAY,SAAQ,EAAE,CAAC,MAAM;KAAG;IACtC,MAAM,KAAK,GAAY,UAAU,MAAM,EAAE,MAAM,EAAE,QAAQ;QACvD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,QAAQ,GAAG,MAAM,CAAC;YAClB,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAE,MAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1G,MAAM,UAAU,GAAG,MAAiD,CAAC;YACrE,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,UAAU;gBAAE,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;;gBAC1F,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,QAA0B,CAAC;YACxC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAY,EAAE,MAAe,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,OAAO,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACnE,CAAC,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5G,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,WAAmB,EAAE,OAAkB,EAAE;IAChE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;IACpE,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;QACvB,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC;QACzB,gBAAgB,EAAE,WAAW;QAC7B,uBAAuB,EAAE,kBAAkB;QAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,sEAAsE;QACtE,gEAAgE;QAChE,mEAAmE;QACnE,qDAAqD;QACrD,GAAG,CAAC,QAAQ,KAAK,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,QAAQ,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1B,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,MAAO,EAAE,CAAC,CAAC;IACtD,OAAO,EAAE,CAAC;AACZ,CAAC;AAID,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAC,EAA6B;IACtD,OAAO,OAAO,CAAC,GAAG,CAAC,EAAc,CAAC,IAAI,iBAAiB,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,EAA6B;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,EAAc,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAoB,CAAC;AAChD,MAAM,OAAO,GAAG,IAAI,OAAO,EAA2C,CAAC;AACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C,MAAM,QAAQ,GAAG,CAAC,WAAmB,EAAE,QAAgB,EAAE,EAAE,CAAC,GAAG,QAAQ,SAAS,WAAW,EAAE,CAAC;AAE9F;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,WAAmB,EAAE,OAAkB,EAAE;IAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACrB,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,uDAAuD,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,EAAY,EAAE,MAAc;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAA6B;IACzD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,IAAI,MAAM,KAAK,EAAE;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;AACzB,CAAC"}