@bevel-software/platform-core-backend 0.9.1 → 0.11.0

package/dist/modules/access/reference-scan.js

@@ -0,0 +1,440 @@
+/**
+ * SHARED grant-reference machinery — the single implementation both admin
+ * services (roles + groups) drive for "which access rules name this
+ * principal" and "rewrite every reference atomically":
+ *
+ *   - `findRoleRefsInText` / `rewriteRoleTokensInText`: the config-region
+ *     parse that decides what IS a principal reference. One source of truth,
+ *     so the delete/rename warning and the rename rewrite can never disagree.
+ *   - `KbReferenceScanner`: candidate collection (every KB file with an
+ *     access-frontmatter extension — `.md` and `.tool`, the resolver's own
+ *     set), the advisory reference scan (cached — roster mutations must not
+ *     rerun a full-KB read sweep, invalidated by file-changed events and a
+ *     TTL backstop), and the fail-closed reference rewrite (returns each
+ *     file's ORIGINAL text too, so rollback snapshots reuse the read the
+ *     rewrite already did instead of a second full-KB pass).
+ *
+ * Tokens here are the ENTRY-GRAMMAR canonical tokens: a bare name (group
+ * first, then role) or an explicit `role/<name>`. Callers translate: a ROLE's
+ * references are its bare token plus its `role/` token; a GROUP's are its
+ * bare token only.
+ */
+import path from 'node:path';
+import { promises as fs } from 'node:fs';
+import { KNOWN_VERBS, accessMdDeclaresBodyRules, hasAccessFrontmatterExtension, isAccessMdPath, parseAccessEntry, stripComment, } from './access-control.service.js';
+/**
+ * Resolve the [start, end) line range that role rewrites may touch — the YAML
+ * config region only, NEVER the markdown body (CodeRabbit: a body line like
+ * `- Sales` or `owner: Sales` must not be rewritten).
+ *
+ *   - A file with leading `---` frontmatter (folder `access.md`, node `.md`):
+ *     only the lines BETWEEN the opening and closing `---` are eligible.
+ *   - A fence-less file (e.g. a bare `roles.yaml`-style access config with no
+ *     `---`): the whole file is config, so all lines are eligible.
+ *   - A `.md` file with no frontmatter fence: no config region → empty range,
+ *     nothing is rewritten.
+ */
+function configLineRange(lines, isMarkdown) {
+    if (lines.length > 0 && lines[0].trim() === '---') {
+        for (let i = 1; i < lines.length; i++) {
+            if (lines[i].trim() === '---')
+                return { start: 1, end: i };
+        }
+        // Unterminated frontmatter — treat nothing as eligible (don't risk the body).
+        return { start: 0, end: 0 };
+    }
+    // No fence: a markdown file has no config region; a non-markdown access file
+    // (no body) is entirely config.
+    return isMarkdown ? { start: 0, end: 0 } : { start: 0, end: lines.length };
+}
+/** The line range AFTER the closing frontmatter fence — empty when there is
+ *  no fence or it never closes, mirroring `bodyAfterFrontmatter` (a
+ *  fence-less access.md is a hard parse error to the resolver, so it is not
+ *  a rule source and must not be rewritten). */
+function bodyLineRange(lines) {
+    if (lines.length > 0 && lines[0].trim() === '---') {
+        for (let i = 1; i < lines.length; i++) {
+            if (lines[i].trim() === '---')
+                return { start: i + 1, end: lines.length };
+        }
+    }
+    return { start: 0, end: 0 };
+}
+/**
+ * The line ranges that are RULE SOURCES for this file — the ranges the
+ * resolver actually parses rules from, so the scan/rewrite can never miss a
+ * rule the resolver enforces:
+ *
+ *   - A body-governed `access.md` (see {@link accessMdDeclaresBodyRules}):
+ *     the BODY carries the folder's rules and the frontmatter carries the
+ *     file's own rules — both are rule sources.
+ *   - Everything else: the config region as before (frontmatter for markdown,
+ *     the whole file for a fence-less config file). A legacy `access.md`'s
+ *     body and a node file's body are prose and stay untouchable.
+ */
+function ruleLineRanges(text, lines, isMarkdown, isAccessMd) {
+    if (isAccessMd && accessMdDeclaresBodyRules(text)) {
+        return [configLineRange(lines, true), bodyLineRange(lines)];
+    }
+    return [configLineRange(lines, isMarkdown)];
+}
+/** The access verb keys the resolver reads (kept in lockstep via KNOWN_VERBS). */
+const VERB_KEYS = new Set(KNOWN_VERBS);
+/**
+ * Walk the CONFIG-REGION lines of `text`, invoking `onRoleRef` for every line
+ * that PARSES as a genuine role entry — both the block-list form (`- <token>`
+ * under a ROOT-mapping `read:`/`write:`/… key) and the inline scalar form
+ * (`owner: <token>`). `verb` is the access verb the reference sits under.
+ * This is the SINGLE source of truth for "what is a role reference" — both
+ * the delete-warning scan and the rename rewrite drive off it, so they cannot
+ * disagree. The callback may mutate `lines[i]` (the rewrite does; the scan
+ * does not). User entries, other keys, nested mappings' verb-looking keys,
+ * comments and substrings never fire it.
+ *
+ * "Root" follows the resolver's OWN semantics, not column zero: the
+ * YAML-subset parser's root frame sits at indent -1 (`parseYamlSubset`), so a
+ * uniformly-INDENTED root mapping (`  read:` at column 2 with nothing
+ * enclosing it) is a live rule mapping the resolver enforces — a column-zero
+ * regex would silently skip it, and a rename would strand those grants. This
+ * walker mirrors the parser's frame stack: a key whose enclosing frame is the
+ * root is a root key; a verb key nested under some other mapping is not a
+ * rule. On a STRUCTURAL error the resolver rejects the whole region (an
+ * access.md hard-errors; node frontmatter yields no own-entries), so the walk
+ * stops — nothing there is an enforced rule.
+ *
+ * Comments follow the resolver's tokeniser rule (`stripComment`): they are
+ * invisible to MATCHING — a trailing `# note` never becomes part of the
+ * token, and a full-line comment neither ends a block nor is an entry — but
+ * the rewrite preserves them: `suffix` carries the stripped tail (trailing
+ * whitespace + comment) verbatim for re-append.
+ */
+function walkRoleRefs(lines, start, end, onRoleRef) {
+    /** A role-entry value → its parsed role entry, else null (user/empty/other). */
+    const roleEntry = (rawValue) => {
+        const parsed = parseAccessEntry(rawValue);
+        return parsed.ok && parsed.entry.kind === 'role'
+            ? { role: parsed.entry.role, deny: parsed.entry.deny }
+            : null;
+    };
+    const stack = [{ indent: -1, kind: 'map', verb: null }];
+    for (let i = start; i < end; i++) {
+        const raw = lines[i];
+        // Match against the COMMENT-STRIPPED line — the resolver's tokeniser view.
+        // `suffix` is everything stripping removed (trailing whitespace + comment),
+        // kept so a rewrite can re-append it byte-for-byte.
+        const line = stripComment(raw).replace(/\s+$/, '');
+        const suffix = raw.slice(line.length);
+        // A full-line comment (or blank line) is invisible: not an entry, and it
+        // does NOT end the current block — the tokeniser skips it entirely.
+        if (!line.trim())
+            continue;
+        // Same indent rule as the tokeniser: leading SPACES only.
+        const indent = /^( *)/.exec(line)[1].length;
+        const content = line.slice(indent);
+        while (stack.length > 1 && stack[stack.length - 1].indent >= indent)
+            stack.pop();
+        const top = stack[stack.length - 1];
+        if (content === '-' || content.startsWith('- ')) {
+            if (top.kind === 'pending')
+                top.kind = 'list';
+            // An item with no enclosing list is a structural error — the resolver
+            // rejects the whole region, so nothing here is an enforced rule.
+            if (top.kind !== 'list')
+                return;
+            if (top.verb !== null) {
+                const rest = content.slice(2);
+                const ws = /^\s*/.exec(rest)[0];
+                const entry = roleEntry(rest.trim());
+                if (entry) {
+                    onRoleRef({
+                        i,
+                        verb: top.verb,
+                        entry,
+                        indent: '',
+                        prefix: line.slice(0, indent + 2) + ws,
+                        suffix,
+                    });
+                }
+            }
+            continue;
+        }
+        const colonIdx = content.indexOf(':');
+        // Not a `key:` or `- value` line, or an empty key: a structural error the
+        // resolver rejects — stop, this region enforces nothing.
+        if (colonIdx < 0)
+            return;
+        const key = content.slice(0, colonIdx).trim();
+        if (!key)
+            return;
+        if (top.kind === 'pending') {
+            // The previous key's value turned out to be a nested MAPPING.
+            top.kind = 'map';
+            top.verb = null;
+        }
+        // A kv inside a list is a structural error (mapping key inside a list).
+        if (top.kind !== 'map')
+            return;
+        // Root per the parser's frames — NOT "column zero".
+        const verbKey = stack.length === 1 && VERB_KEYS.has(key) ? key : null;
+        const value = content.slice(colonIdx + 1).trim();
+        if (value !== '') {
+            // Inline value — no frame opens. A scalar under a root verb key is the
+            // inline scalar reference form (`owner: Sales`); `[]` is an empty list.
+            if (verbKey && value !== '[]') {
+                const afterColon = content.slice(colonIdx + 1);
+                const ws = /^\s*/.exec(afterColon)[0];
+                const entry = roleEntry(value);
+                if (entry) {
+                    onRoleRef({
+                        i,
+                        verb: verbKey,
+                        entry,
+                        indent: line.slice(0, indent + colonIdx + 1) + ws,
+                        prefix: '',
+                        suffix,
+                    });
+                }
+            }
+            continue;
+        }
+        // Empty value: what it opens (list/map/null) is decided by the next token.
+        stack.push({ indent, kind: 'pending', verb: verbKey });
+    }
+}
+/**
+ * Every genuine role/group reference in `text`'s rule regions, as
+ * {role, verb} where `role` is the canonical ENTRY TOKEN (bare name or
+ * `role/<name>`). `isAccessMd` marks an `access.md` file, whose BODY is a
+ * rule source in the body-governed format — see {@link ruleLineRanges}.
+ */
+export function findRoleRefsInText(text, isMarkdown = true, isAccessMd = false) {
+    const lines = text.split('\n');
+    const out = [];
+    for (const { start, end } of ruleLineRanges(text, lines, isMarkdown, isAccessMd)) {
+        if (start >= end)
+            continue;
+        walkRoleRefs(lines, start, end, ({ verb, entry }) => out.push({ role: entry.role, verb }));
+    }
+    return out;
+}
+/**
+ * Rewrite every RULE-REGION line that PARSES as a role reference whose
+ * canonical token == `oldToken`, replacing the token with `newDisplayName`
+ * (preserving any leading `deny ` and indentation). A prose body is never
+ * touched — a line like `- Sales` in a node file or a legacy `access.md`
+ * stays byte-for-byte intact; the body is eligible ONLY when the file is a
+ * body-governed `access.md` (`isAccessMd` + the body parses as rules), where
+ * the body IS what the resolver enforces — see {@link ruleLineRanges}. Lines
+ * that don't parse as a matching role entry (user entries, other keys,
+ * substrings) are also untouched. Exported for test.
+ *
+ * `isMarkdown` (default true) marks files that carry a markdown body below the
+ * frontmatter; pass false only for a pure-config file with no body.
+ */
+export function rewriteRoleTokensInText(text, oldToken, newDisplayName, isMarkdown = true, isAccessMd = false) {
+    const lines = text.split('\n');
+    let changed = false;
+    for (const { start, end } of ruleLineRanges(text, lines, isMarkdown, isAccessMd)) {
+        if (start >= end)
+            continue;
+        walkRoleRefs(lines, start, end, ({ i, entry, indent, prefix, suffix }) => {
+            if (entry.role !== oldToken)
+                return;
+            // `suffix` re-appends the trailing whitespace + `# comment` the match
+            // ignored — a rename must not eat an entry's comment.
+            lines[i] = `${indent}${prefix}${entry.deny ? 'deny ' : ''}${newDisplayName}${suffix}`;
+            changed = true;
+        });
+    }
+    return changed ? lines.join('\n') : text;
+}
+/** How long a cached reference scan may serve after its load. Backstop only —
+ *  reference-changing writes invalidate explicitly (the admin services after
+ *  their own rewrites, and the event-bus tap below for everyone else's). */
+const SCAN_TTL_MS = 30_000;
+/**
+ * Candidate collection + cached scan + fail-closed rewrite over one KB.
+ * Constructed per admin service; the cache means roster MUTATIONS never rerun
+ * the full-KB reference sweep (only the roster GET pays it, at most once per
+ * TTL), and `invalidate` drops it whenever a write could have moved
+ * references (rename/delete rewrites, or any external change signal).
+ *
+ * FRESHNESS: an `access.md` grant/revoke (or any other write to a scanned
+ * file) lands OUTSIDE the admin services, so their explicit invalidations
+ * can't see it — the roster's `referencedBy` would serve up to `SCAN_TTL_MS`
+ * of staleness. When an `eventBus` is provided, the scanner taps its emits
+ * and drops the workspace's cache on every path-carrying event
+ * (`file-changed` from the commit pipeline, and `lock-released` — which the
+ * share routes emit synchronously at write time, before the async commit's
+ * `file-changed` lands) whose path has a scanned extension. The TTL stays as
+ * the backstop for deployments/tests without a bus.
+ */
+export class KbReferenceScanner {
+    workspaceService;
+    kbDirName;
+    cache = new Map();
+    /**
+     * Per-workspace in-flight scan state: a scan may only CACHE its result if
+     * no invalidation landed after it started — otherwise the pre-change
+     * snapshot would repopulate the cache and stick for a whole TTL. Tracked
+     * ONLY while scans run (a future scan reads post-write state by nature, so
+     * an invalidation with nothing in flight needs only the cache drop): the
+     * entry is created by the first concurrent scan and removed by the last,
+     * so the map never accumulates workspaces.
+     */
+    inFlight = new Map();
+    constructor(workspaceService, kbDirName, eventBus) {
+        this.workspaceService = workspaceService;
+        this.kbDirName = kbDirName;
+        eventBus?.onEmit?.((event) => {
+            if (event.kind !== 'file-changed' && event.kind !== 'lock-released')
+                return;
+            if (!event.workspaceId || !event.path)
+                return;
+            // Paths on the bus are workspace-relative; only writes UNDER the KB dir
+            // to files the scan reads can move references — a `.md` elsewhere in
+            // the workspace is not scan material.
+            if (!event.path.startsWith(`${this.kbDirName}/`))
+                return;
+            if (!hasAccessFrontmatterExtension(event.path))
+                return;
+            this.invalidate(event.workspaceId);
+        });
+    }
+    invalidate(workspaceId) {
+        this.cache.delete(workspaceId);
+        const flight = this.inFlight.get(workspaceId);
+        if (flight)
+            flight.gen++;
+    }
+    /**
+     * Repo-relative paths of every file that could carry a principal reference:
+     * all `access.md` files plus every node file whose own frontmatter the
+     * resolver reads access verbs from — the shared
+     * `ACCESS_FRONTMATTER_EXTENSIONS` set (`.md` AND `.tool`; a rename that
+     * skipped `.tool` would strand a live frontmatter grant there). Sourced
+     * from the workspace file tree (which already skips `.git` and honours
+     * `.bevelignore`), filtered under the KB dir and returned bare
+     * repo-relative. (`roles.yaml` matches no scanned extension, so it's
+     * excluded; callers commit it separately.) Under save=share the working
+     * tree matches the committed set, so this is the same candidate list
+     * git-tracking would give.
+     */
+    async collectCandidateFiles(workspaceId) {
+        const tree = await this.workspaceService.listFiles(workspaceId);
+        const prefix = `${this.kbDirName}/`;
+        const out = [];
+        const visit = (node) => {
+            if (node.type === 'file') {
+                if (node.relativePath.startsWith(prefix) && hasAccessFrontmatterExtension(node.relativePath)) {
+                    out.push(node.relativePath.slice(prefix.length));
+                }
+                return;
+            }
+            for (const child of node.children ?? [])
+                visit(child);
+        };
+        visit(tree);
+        return out;
+    }
+    /**
+     * Sound scan of EVERY candidate file (folder `access.md` + `.md`/`.tool`
+     * node frontmatter) for genuine principal references, indexed by canonical
+     * entry TOKEN. Shares the
+     * candidate set and the config-region parse with the rename rewrite, so the
+     * delete warning and the rewrite see the SAME references. A file we cannot
+     * read is skipped (this is an advisory read, not the atomic write path).
+     * Cached per workspace (see class doc); reads are batched with Promise.all
+     * rather than serial per-file awaits.
+     */
+    async scan(workspaceId) {
+        const hit = this.cache.get(workspaceId);
+        if (hit && Date.now() - hit.loadedAt < SCAN_TTL_MS)
+            return hit.byToken;
+        let flight = this.inFlight.get(workspaceId);
+        if (!flight) {
+            flight = { gen: 0, scans: 0 };
+            this.inFlight.set(workspaceId, flight);
+        }
+        flight.scans++;
+        const startedUnder = flight.gen;
+        try {
+            const repoDir = await this.repoDir(workspaceId);
+            const candidates = await this.collectCandidateFiles(workspaceId);
+            const texts = await Promise.all(candidates.map(async (repoRel) => {
+                try {
+                    return await fs.readFile(path.join(repoDir, repoRel), 'utf-8');
+                }
+                catch {
+                    return null;
+                }
+            }));
+            const byToken = new Map();
+            candidates.forEach((repoRel, i) => {
+                const text = texts[i];
+                if (text === null)
+                    return;
+                for (const ref of findRoleRefsInText(text, true, isAccessMdPath(repoRel))) {
+                    const list = byToken.get(ref.role);
+                    if (list)
+                        list.push({ path: repoRel, verb: ref.verb });
+                    else
+                        byToken.set(ref.role, [{ path: repoRel, verb: ref.verb }]);
+                }
+            });
+            // Cache only when no invalidation landed mid-scan; the caller still gets
+            // this snapshot (at worst one write stale — same as the pre-scan world),
+            // but a stale snapshot must never STICK for a TTL. The next call re-scans.
+            if (flight.gen === startedUnder) {
+                this.cache.set(workspaceId, { loadedAt: Date.now(), byToken });
+            }
+            return byToken;
+        }
+        finally {
+            flight.scans--;
+            if (flight.scans === 0)
+                this.inFlight.delete(workspaceId);
+        }
+    }
+    /**
+     * Find every genuine reference to `oldToken` and rewrite it to
+     * `newDisplayName`. FAIL-CLOSED: a candidate we cannot read might reference
+     * the old token, and skipping it would commit a partial rewrite (a
+     * half-renamed principal still pointed at by stragglers = silent access
+     * drop) — so any read failure aborts via `makeError` with nothing written.
+     * Returns the writes WITH each file's original text (rollback snapshots).
+     */
+    async rewriteReferences(workspaceId, oldToken, newDisplayName, makeError) {
+        const repoDir = await this.repoDir(workspaceId);
+        const writes = [];
+        const candidates = await this.collectCandidateFiles(workspaceId);
+        const texts = await Promise.all(candidates.map(async (repoRel) => {
+            try {
+                return { ok: true, text: await fs.readFile(path.join(repoDir, repoRel), 'utf-8') };
+            }
+            catch (err) {
+                return { ok: false, repoRel, cause: err?.message };
+            }
+        }));
+        for (const t of texts) {
+            if (!t.ok) {
+                throw makeError(`Cannot read ${t.repoRel} while rewriting references; rename aborted with no changes`, t.cause);
+            }
+        }
+        candidates.forEach((repoRel, i) => {
+            const entry = texts[i];
+            if (!entry.ok)
+                return; // unreachable — the loop above threw
+            const rewritten = rewriteRoleTokensInText(entry.text, oldToken, newDisplayName, true, isAccessMdPath(repoRel));
+            if (rewritten !== entry.text) {
+                writes.push({ repoRelativePath: repoRel, content: rewritten, original: entry.text });
+            }
+        });
+        return writes;
+    }
+    async repoDir(workspaceId) {
+        const wsDir = await this.workspaceService.getWorkspacePath(workspaceId);
+        return path.join(wsDir, this.kbDirName);
+    }
+}
+//# sourceMappingURL=reference-scan.js.map

package/dist/modules/access/reference-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference-scan.js","sourceRoot":"","sources":["../../../src/modules/access/reference-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAGzC,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,6BAA6B,EAC7B,cAAc,EACd,gBAAgB,EAChB,YAAY,GACb,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,KAAe,EAAE,UAAmB;IAC3D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC7D,CAAC;QACD,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC9B,CAAC;IACD,6EAA6E;IAC7E,gCAAgC;IAChC,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC7E,CAAC;AAED;;;gDAGgD;AAChD,SAAS,aAAa,CAAC,KAAe;IACpC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CACrB,IAAY,EACZ,KAAe,EACf,UAAmB,EACnB,UAAmB;IAEnB,IAAI,UAAU,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,kFAAkF;AAClF,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAS,YAAY,CACnB,KAAe,EACf,KAAa,EACb,GAAW,EACX,SAQU;IAEV,gFAAgF;IAChF,MAAM,SAAS,GAAG,CAAC,QAAgB,EAA0C,EAAE;QAC7E,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;YAC9C,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YACtD,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IAQF,MAAM,KAAK,GAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,2EAA2E;QAC3E,4EAA4E;QAC5E,oDAAoD;QACpD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,0DAA0D;QAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QACjF,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEpC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;YAC9C,sEAAsE;YACtE,iEAAiE;YACjE,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO;YAChC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrC,IAAI,KAAK,EAAE,CAAC;oBACV,SAAS,CAAC;wBACR,CAAC;wBACD,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,KAAK;wBACL,MAAM,EAAE,EAAE;wBACV,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE;wBACtC,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,0EAA0E;QAC1E,yDAAyD;QACzD,IAAI,QAAQ,GAAG,CAAC;YAAE,OAAO;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3B,8DAA8D;YAC9D,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,wEAAwE;QACxE,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO;QAC/B,oDAAoD;QACpD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,uEAAuE;YACvE,wEAAwE;YACxE,IAAI,OAAO,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;gBAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAE,CAAC,CAAC,CAAC,CAAC;gBACvC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,SAAS,CAAC;wBACR,CAAC;wBACD,IAAI,EAAE,OAAO;wBACb,KAAK;wBACL,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,CAAC,CAAC,GAAG,EAAE;wBACjD,MAAM,EAAE,EAAE;wBACV,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,UAAU,GAAG,IAAI,EACjB,UAAU,GAAG,KAAK;IAElB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACjF,IAAI,KAAK,IAAI,GAAG;YAAE,SAAS;QAC3B,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,QAAgB,EAChB,cAAsB,EACtB,UAAU,GAAG,IAAI,EACjB,UAAU,GAAG,KAAK;IAElB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACjF,IAAI,KAAK,IAAI,GAAG;YAAE,SAAS;QAC3B,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YACvE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACpC,sEAAsE;YACtE,sDAAsD;YACtD,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,GAAG,MAAM,EAAE,CAAC;YACtF,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAeD;;4EAE4E;AAC5E,MAAM,WAAW,GAAG,MAAM,CAAC;AAY3B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,kBAAkB;IAiBV;IACA;IAjBF,KAAK,GAAG,IAAI,GAAG,EAG7B,CAAC;IACJ;;;;;;;;OAQG;IACc,QAAQ,GAAG,IAAI,GAAG,EAA0C,CAAC;IAE9E,YACmB,gBAAmC,EACnC,SAAiB,EAClC,QAAuC;QAFtB,qBAAgB,GAAhB,gBAAgB,CAAmB;QACnC,cAAS,GAAT,SAAS,CAAQ;QAGlC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;gBAAE,OAAO;YAC5E,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,IAAI;gBAAE,OAAO;YAC9C,wEAAwE;YACxE,qEAAqE;YACrE,sCAAsC;YACtC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC;gBAAE,OAAO;YACzD,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO;YACvD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,WAAmB;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,MAAM;YAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAmB;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC;QACpC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,CAAC,IAAmB,EAAQ,EAAE;YAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC7F,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnD,CAAC;gBACD,OAAO;YACT,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;gBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,WAAW;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QAEvE,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC/B,IAAI,CAAC;oBACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CACH,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;YAClD,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;gBAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,IAAI,KAAK,IAAI;oBAAE,OAAO;gBAC1B,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACnC,IAAI,IAAI;wBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;;wBAClD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC,CAAC,CAAC;YACH,yEAAyE;YACzE,yEAAyE;YACzE,2EAA2E;YAC3E,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CACrB,WAAmB,EACnB,QAAgB,EAChB,cAAsB,EACtB,SAAqD;QAErD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,MAAM,GAAuB,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/B,IAAI,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YAC9F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,OAAO,EAAE,KAAK,EAAG,GAAa,EAAE,OAAO,EAAE,CAAC;YACzE,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,SAAS,CACb,eAAe,CAAC,CAAC,OAAO,6DAA6D,EACrF,CAAC,CAAC,KAAK,CACR,CAAC;YACJ,CAAC;QACH,CAAC;QACD,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,CAAC,qCAAqC;YAC5D,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/G,IAAI,SAAS,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,WAAmB;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;CACF"}