@digimuza/saas-core 0.0.2

package/dist/db/schema/authorization.d.ts

@@ -0,0 +1,465 @@
+/**
+ * A workspace-scoped role.
+ *
+ * `key` is a stable machine identifier (`"admin"`, `"member"`) separate from the
+ * human-facing `name`. Authorization logic must not branch on role names: names
+ * are user-editable and localisable, and renaming one would silently change who
+ * can do what. Prefer permissions over roles in application code; `key` exists
+ * for the rare check that genuinely is about role identity.
+ *
+ * `is_system` marks roles the core created and that must not be deleted;
+ * `is_default` marks the role granted to a new member when none is specified.
+ */
+export declare const roles: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "roles";
+    schema: undefined;
+    columns: {
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "roles";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "roles";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "roles";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        workspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workspace_id";
+            tableName: "roles";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        key: import("drizzle-orm/pg-core").PgColumn<{
+            name: "key";
+            tableName: "roles";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "roles";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        description: import("drizzle-orm/pg-core").PgColumn<{
+            name: "description";
+            tableName: "roles";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        isSystem: import("drizzle-orm/pg-core").PgColumn<{
+            name: "is_system";
+            tableName: "roles";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        isDefault: import("drizzle-orm/pg-core").PgColumn<{
+            name: "is_default";
+            tableName: "roles";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
+/**
+ * The set of permissions an application recognises.
+ *
+ * Permissions are application-defined, so the core stores whatever the
+ * application registers rather than shipping an enum. Not workspace-scoped: the
+ * vocabulary is a property of the product, and every workspace draws from the
+ * same list.
+ *
+ * `key` is the primary key. It is the identifier applications already use
+ * (`"projects.create"`), so a surrogate id would only add a join.
+ */
+export declare const permissions: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "permissions";
+    schema: undefined;
+    columns: {
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "permissions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "permissions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        key: import("drizzle-orm/pg-core").PgColumn<{
+            name: "key";
+            tableName: "permissions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        description: import("drizzle-orm/pg-core").PgColumn<{
+            name: "description";
+            tableName: "permissions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
+/** Grants a permission to a role. */
+export declare const rolePermissions: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "role_permissions";
+    schema: undefined;
+    columns: {
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "role_permissions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "role_permissions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        roleId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role_id";
+            tableName: "role_permissions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        permissionKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "permission_key";
+            tableName: "role_permissions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
+/**
+ * Assigns a role to a workspace member. A member may hold several roles; their
+ * effective permissions are the union across all of them.
+ *
+ * ## Cross-workspace isolation
+ *
+ * `workspace_id` is stored here rather than being reached through a join, so that
+ * two composite foreign keys can share it:
+ *
+ * - `(workspace_id, user_id)` must exist in `workspace_members`
+ * - `(role_id, workspace_id)` must exist in `roles`
+ *
+ * Because both constraints read the *same* `workspace_id` column, granting a
+ * member of workspace A a role belonging to workspace B is rejected by
+ * PostgreSQL — not by application code that might be forgotten or bypassed.
+ * Deleting a membership or a role cascades the grant away.
+ */
+export declare const workspaceMemberRoles: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "workspace_member_roles";
+    schema: undefined;
+    columns: {
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "workspace_member_roles";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "workspace_member_roles";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        workspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workspace_id";
+            tableName: "workspace_member_roles";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "workspace_member_roles";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        roleId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role_id";
+            tableName: "workspace_member_roles";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
+export declare const rolesRelations: import("drizzle-orm").Relations<"roles", {
+    workspace: import("drizzle-orm").One<"workspaces", true>;
+    permissions: import("drizzle-orm").Many<"role_permissions">;
+    assignments: import("drizzle-orm").Many<"workspace_member_roles">;
+}>;
+export declare const permissionsRelations: import("drizzle-orm").Relations<"permissions", {
+    roles: import("drizzle-orm").Many<"role_permissions">;
+}>;
+export declare const rolePermissionsRelations: import("drizzle-orm").Relations<"role_permissions", {
+    role: import("drizzle-orm").One<"roles", true>;
+    permission: import("drizzle-orm").One<"permissions", true>;
+}>;
+export declare const workspaceMemberRolesRelations: import("drizzle-orm").Relations<"workspace_member_roles", {
+    role: import("drizzle-orm").One<"roles", true>;
+}>;
+export type Role = typeof roles.$inferSelect;
+export type NewRole = typeof roles.$inferInsert;
+export type Permission = typeof permissions.$inferSelect;
+export type NewPermission = typeof permissions.$inferInsert;
+export type RolePermission = typeof rolePermissions.$inferSelect;
+export type WorkspaceMemberRole = typeof workspaceMemberRoles.$inferSelect;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/db/schema/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../src/db/schema/authorization.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiCjB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAItB,CAAC;AAEH,qCAAqC;AACrC,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe3B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyBhC,CAAC;AAEF,eAAO,MAAM,cAAc;;;;EAOxB,CAAC;AAEJ,eAAO,MAAM,oBAAoB;;EAE9B,CAAC;AAEJ,eAAO,MAAM,wBAAwB;;;EASlC,CAAC;AAEJ,eAAO,MAAM,6BAA6B;;EAKvC,CAAC;AAEJ,MAAM,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AAC7C,MAAM,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,UAAU,GAAG,OAAO,WAAW,CAAC,YAAY,CAAC;AACzD,MAAM,MAAM,aAAa,GAAG,OAAO,WAAW,CAAC,YAAY,CAAC;AAC5D,MAAM,MAAM,cAAc,GAAG,OAAO,eAAe,CAAC,YAAY,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,oBAAoB,CAAC,YAAY,CAAC"}

package/dist/db/schema/authorization.js

@@ -0,0 +1,134 @@
+import { relations, sql } from "drizzle-orm";
+import { boolean, foreignKey, index, pgTable, primaryKey, text, unique, uniqueIndex, uuid, } from "drizzle-orm/pg-core";
+import { timestamps } from "./_shared.js";
+import { workspaceMembers, workspaces } from "./workspaces.js";
+/**
+ * A workspace-scoped role.
+ *
+ * `key` is a stable machine identifier (`"admin"`, `"member"`) separate from the
+ * human-facing `name`. Authorization logic must not branch on role names: names
+ * are user-editable and localisable, and renaming one would silently change who
+ * can do what. Prefer permissions over roles in application code; `key` exists
+ * for the rare check that genuinely is about role identity.
+ *
+ * `is_system` marks roles the core created and that must not be deleted;
+ * `is_default` marks the role granted to a new member when none is specified.
+ */
+export const roles = pgTable("roles", {
+    id: uuid("id").defaultRandom().primaryKey(),
+    workspaceId: uuid("workspace_id")
+        .notNull()
+        .references(() => workspaces.id, { onDelete: "cascade" }),
+    key: text("key").notNull(),
+    name: text("name").notNull(),
+    description: text("description"),
+    isSystem: boolean("is_system").notNull().default(false),
+    isDefault: boolean("is_default").notNull().default(false),
+    ...timestamps,
+}, (table) => [
+    uniqueIndex("roles_workspace_id_key_idx").on(table.workspaceId, table.key),
+    /**
+     * Redundant against the primary key on its own, but PostgreSQL requires a
+     * unique constraint on exactly the referenced columns. This is the target
+     * that lets `workspace_member_roles` and `workspace_invitations` prove a
+     * role belongs to the same workspace as the member being granted it.
+     */
+    unique("roles_id_workspace_id_key").on(table.id, table.workspaceId),
+    /** At most one default role per workspace. */
+    uniqueIndex("roles_workspace_default_idx")
+        .on(table.workspaceId)
+        .where(sql `${table.isDefault}`),
+]);
+/**
+ * The set of permissions an application recognises.
+ *
+ * Permissions are application-defined, so the core stores whatever the
+ * application registers rather than shipping an enum. Not workspace-scoped: the
+ * vocabulary is a property of the product, and every workspace draws from the
+ * same list.
+ *
+ * `key` is the primary key. It is the identifier applications already use
+ * (`"projects.create"`), so a surrogate id would only add a join.
+ */
+export const permissions = pgTable("permissions", {
+    key: text("key").primaryKey(),
+    description: text("description"),
+    ...timestamps,
+});
+/** Grants a permission to a role. */
+export const rolePermissions = pgTable("role_permissions", {
+    roleId: uuid("role_id")
+        .notNull()
+        .references(() => roles.id, { onDelete: "cascade" }),
+    permissionKey: text("permission_key")
+        .notNull()
+        .references(() => permissions.key, { onDelete: "cascade" }),
+    ...timestamps,
+}, (table) => [
+    primaryKey({ columns: [table.roleId, table.permissionKey] }),
+    index("role_permissions_permission_key_idx").on(table.permissionKey),
+]);
+/**
+ * Assigns a role to a workspace member. A member may hold several roles; their
+ * effective permissions are the union across all of them.
+ *
+ * ## Cross-workspace isolation
+ *
+ * `workspace_id` is stored here rather than being reached through a join, so that
+ * two composite foreign keys can share it:
+ *
+ * - `(workspace_id, user_id)` must exist in `workspace_members`
+ * - `(role_id, workspace_id)` must exist in `roles`
+ *
+ * Because both constraints read the *same* `workspace_id` column, granting a
+ * member of workspace A a role belonging to workspace B is rejected by
+ * PostgreSQL — not by application code that might be forgotten or bypassed.
+ * Deleting a membership or a role cascades the grant away.
+ */
+export const workspaceMemberRoles = pgTable("workspace_member_roles", {
+    workspaceId: uuid("workspace_id").notNull(),
+    userId: uuid("user_id").notNull(),
+    roleId: uuid("role_id").notNull(),
+    ...timestamps,
+}, (table) => [
+    primaryKey({ columns: [table.workspaceId, table.userId, table.roleId] }),
+    foreignKey({
+        name: "workspace_member_roles_member_fk",
+        columns: [table.workspaceId, table.userId],
+        foreignColumns: [workspaceMembers.workspaceId, workspaceMembers.userId],
+    }).onDelete("cascade"),
+    foreignKey({
+        name: "workspace_member_roles_role_fk",
+        columns: [table.roleId, table.workspaceId],
+        foreignColumns: [roles.id, roles.workspaceId],
+    }).onDelete("cascade"),
+    index("workspace_member_roles_role_id_idx").on(table.roleId),
+]);
+export const rolesRelations = relations(roles, ({ one, many }) => ({
+    workspace: one(workspaces, {
+        fields: [roles.workspaceId],
+        references: [workspaces.id],
+    }),
+    permissions: many(rolePermissions),
+    assignments: many(workspaceMemberRoles),
+}));
+export const permissionsRelations = relations(permissions, ({ many }) => ({
+    roles: many(rolePermissions),
+}));
+export const rolePermissionsRelations = relations(rolePermissions, ({ one }) => ({
+    role: one(roles, {
+        fields: [rolePermissions.roleId],
+        references: [roles.id],
+    }),
+    permission: one(permissions, {
+        fields: [rolePermissions.permissionKey],
+        references: [permissions.key],
+    }),
+}));
+export const workspaceMemberRolesRelations = relations(workspaceMemberRoles, ({ one }) => ({
+    role: one(roles, {
+        fields: [workspaceMemberRoles.roleId],
+        references: [roles.id],
+    }),
+}));
+//# sourceMappingURL=authorization.js.map

package/dist/db/schema/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../src/db/schema/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,OAAO,EACP,UAAU,EACV,KAAK,EACL,OAAO,EACP,UAAU,EACV,IAAI,EACJ,MAAM,EACN,WAAW,EACX,IAAI,GACL,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAC1B,OAAO,EACP;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;SAC9B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAE3D,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IAC1B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;IAEhC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvD,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEzD,GAAG,UAAU;CACd,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,WAAW,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC;IAE1E;;;;;OAKG;IACH,MAAM,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC;IAEnE,8CAA8C;IAC9C,WAAW,CAAC,6BAA6B,CAAC;SACvC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;SACrB,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;CAClC,CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,EAAE;IAChD,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE;IAC7B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;IAChC,GAAG,UAAU;CACd,CAAC,CAAC;AAEH,qCAAqC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CACpC,kBAAkB,EAClB;IACE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC;SAClC,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC7D,GAAG,UAAU;CACd,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;IAC5D,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;CACrE,CACF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CACzC,wBAAwB,EACxB;IACE,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACjC,GAAG,UAAU;CACd,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAExE,UAAU,CAAC;QACT,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC;QAC1C,cAAc,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC;KACxE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;IAEtB,UAAU,CAAC;QACT,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;QAC1C,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC;KAC9C,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;IAEtB,KAAK,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;CAC7D,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACjE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE;QACzB,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;QAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;KAC5B,CAAC;IACF,WAAW,EAAE,IAAI,CAAC,eAAe,CAAC;IAClC,WAAW,EAAE,IAAI,CAAC,oBAAoB,CAAC;CACxC,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC;CAC7B,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC,eAAe,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE;QACf,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC;QAChC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;KACvB,CAAC;IACF,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;QAC3B,MAAM,EAAE,CAAC,eAAe,CAAC,aAAa,CAAC;QACvC,UAAU,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;KAC9B,CAAC;CACH,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACzF,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE;QACf,MAAM,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;QACrC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;KACvB,CAAC;CACH,CAAC,CAAC,CAAC"}