@filelayer/core 0.3.0

package/dist/filelayer.d.ts

@@ -0,0 +1,542 @@
+/**
+ * FILELAYER -- the surface an application developer actually touches.
+ *
+ * Design rule for this file: every method that touches a file or an org calls
+ * into the authorization engine and does nothing before it. There is no
+ * "internal" variant that skips the check, because the moment such a variant
+ * exists someone will call it from a route handler at 6pm on a Friday.
+ *
+ * SECOND design rule, added after the security review: this file contains no
+ * security LOGIC, only security PLUMBING. Every rule that used to live here as
+ * a "patch at the wrong layer" has moved into `authz.ts` or `schema.sql`:
+ *
+ *   - capability attenuation on share       -> authorizeShare() + a BEFORE
+ *                                              INSERT trigger on file_grant
+ *   - the 410/409 existence-oracle downgrade
+ *     and its `hasStanding()` helper        -> evaluation order in authorize()
+ *   - the membership / viewer checks in
+ *     upload()                              -> authorizeOrg('create_file')
+ *   - the admin check in auditLog()         -> authorizeOrg('read_audit')
+ *   - the unaudited early return in redeem()
+ *     for unknown secrets                   -> the engine's system chain
+ *
+ * Errors are thrown as `FilelayerError`, already collapsed through
+ * `toPublicError`, so the developer cannot accidentally return our internal
+ * deny reason to an attacker. That collapsing is a security-sensitive decision
+ * we make once, here, instead of asking the developer to make it per-route.
+ */
+import { type Capability, type FileRef, type FileVisibility, type GrantSubjectType, type OrgRole, type Principal } from './authz.ts';
+import { type Queryable } from './db.ts';
+import { PostgresStore, type AuditRow, type AuditChainResult } from './store.ts';
+import { type PutBody, type StorageAdapter } from './storage.ts';
+import { FilesApi, OrgsApi, SharesApi } from './simple.ts';
+import { type Disposition, type RedirectDeliveryConfig, type StreamedDelivery } from './delivery.ts';
+import { FilelayerError } from './errors.ts';
+export { FilelayerError };
+export interface UploadInput {
+    name: string;
+    contentType: string;
+    /**
+     * Advisory. The AUTHORITATIVE size is what the adapter reports it actually
+     * wrote, and that is what lands in `size_bytes`. A caller-supplied size that
+     * disagrees with the object is how a `content-length` ends up truncating a
+     * download.
+     */
+    size?: number;
+    /**
+     * Bytes, or a stream of bytes.
+     *
+     * A `Uint8Array` is the convenient form for the small-file case that
+     * dominates (avatars, PDFs, attachments) and is kept for exactly that reason.
+     * A `ReadableStream` is the form that does not put the whole object on the
+     * heap: with the S3 adapter it becomes a multipart upload whose peak memory
+     * is one part, whatever the object's size.
+     */
+    body: PutBody;
+    /**
+     * Who, inside the owning org, can see this file before anybody shares it.
+     *
+     *   'private' (DEFAULT) -- owner + org admins/owners only. Everyone else
+     *                          needs an explicit grant.
+     *   'org'               -- every member of the org may read it.
+     *
+     * The default is the restrictive one. See schema.sql, `file_visibility`.
+     */
+    visibility?: FileVisibility;
+    /** Seconds until the file itself expires (lifecycle, not a grant). */
+    expiresIn?: number;
+    /** Seconds of retention floor: deletion is blocked until it passes. */
+    retainFor?: number;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * WHO a grant is for. A grant's subject is a PRINCIPAL SET (RFC-001):
+ *
+ *   actor      exactly one person
+ *   role       every member of an org at role >= `minRole`
+ *   org        every member of an org, at any role
+ *   link       whoever holds the secret (bearer, not identity)
+ *   anonymous  everyone
+ *
+ * `org` and `role` may name an org OTHER than the file's own -- that is the
+ * point ("the company that posted this job may read this CV") -- but it must be
+ * an org in the same PROJECT. Cross-project is unrepresentable, by composite
+ * foreign key, and refused here with a 404 before it gets that far.
+ *
+ * I6: an issuer whose own authority came from a GRANT may only mint `actor` or
+ * `link`. See `authorizeShare`.
+ */
+export type ShareSubject = {
+    type: 'link';
+} | {
+    type: 'anonymous';
+} | {
+    type: 'actor';
+    actorId: string;
+}
+/** Every member of `orgId`, at any role. */
+ | {
+    type: 'org';
+    orgId: string;
+}
+/** Every member of `orgId` at `minRole` or above. */
+ | {
+    type: 'role';
+    orgId: string;
+    minRole: OrgRole;
+};
+export interface ShareInput {
+    subject: ShareSubject;
+    capabilities?: Capability[];
+    expiresIn?: number;
+    maxDownloads?: number;
+    password?: string;
+}
+export interface ShareResult {
+    grantId: string;
+    /** Returned exactly once. Only its SHA-256 is persisted. */
+    secret?: string;
+    url?: string;
+    /**
+     * The EFFECTIVE lifetime and cap, after attenuation against the parent grant.
+     * A delegated share can never exceed the authority it came from, so these may
+     * be tighter than what was asked for. They are returned rather than silently
+     * applied so that the clamp is visible to the caller.
+     */
+    expiresAt: Date | null;
+    maxDownloads: number | null;
+    /** Non-null when this grant was delegated from another grant (P4). */
+    parentGrantId: string | null;
+}
+export interface FileRecord extends FileRef {
+    name: string;
+    contentType: string;
+    sizeBytes: number | null;
+    /**
+     * WHICH store the bytes are in. This column used to be written as the literal
+     * `'memory'` on every insert regardless of the configured adapter, which
+     * meant a production deployment recorded every object as living in an
+     * in-process Map. It participates in `file_storage_key_idx`
+     * (UNIQUE (storage_provider, storage_key)), so it is half of an object's
+     * identity, not a label.
+     */
+    storageProvider: string;
+    storageKey: string;
+    createdAt: Date;
+}
+export interface GrantSummary {
+    id: string;
+    fileId: string;
+    parentGrantId: string | null;
+    subjectType: GrantSubjectType;
+    subjectId: string | null;
+    /** The org whose members are the subject, for 'org' and 'role' grants. */
+    subjectOrgId: string | null;
+    /** The role floor, for 'role' grants. Null on 'org' reads as 'viewer'. */
+    subjectMinRole: OrgRole | null;
+    capabilities: Capability[];
+    hasPassword: boolean;
+    expiresAt: Date | null;
+    maxDownloads: number | null;
+    downloadCount: number;
+    revokedAt: Date | null;
+    /** Recursive liveness: false if this grant OR any ancestor is dead. */
+    live: boolean;
+    createdBy: string | null;
+    createdAt: Date;
+}
+export interface FilelayerOptions {
+    baseUrl?: string;
+    /**
+     * The customer application this instance speaks for (P8).
+     *
+     * In a hosted deployment the API layer resolves a project from the request's API
+     * key and constructs one of these bound to it. A bound instance cannot see,
+     * list, audit or address anything in another project. Omit it and everything
+     * lands in the default project, which is the correct behaviour for a
+     * single-project deployment. Pass `null` for the control plane.
+     */
+    projectId?: string | null;
+    /**
+     * OPT-IN REDIRECT DELIVERY. Absent means every delivery is proxied, which is
+     * the only mode with an unqualified "revocation is immediate" guarantee.
+     *
+     * Read the DELIVERY MODES block at the top of `delivery.ts` before setting
+     * this. It will not typecheck without the acknowledgement string, and the
+     * acknowledgement string says what you are accepting.
+     */
+    redirectDelivery?: RedirectDeliveryConfig;
+}
+export declare class Filelayer {
+    #private;
+    readonly store: PostgresStore;
+    private readonly db;
+    private readonly storage;
+    private readonly opts;
+    private _files?;
+    private _orgs?;
+    private _shares?;
+    /** Null unless redirect delivery was configured AND acknowledged. */
+    private readonly redirect;
+    constructor(db: Queryable, storage: StorageAdapter, opts?: FilelayerOptions);
+    /**
+     * A throwaway, in-process instance: PGlite + in-memory bytes.
+     *
+     * For a five-minute first run and for tests. **Everything is lost when the
+     * process exits** -- there is no file on disk and no bucket. Production is
+     * `new Filelayer(pgPool, new S3Storage({...}), { baseUrl })`; see
+     * docs/QUICKSTART.md, which does not hide the three configuration steps.
+     */
+    static quickstart(opts?: {
+        baseUrl?: string;
+    }): Promise<Filelayer>;
+    /** Where public URLs are rooted. Read-only; set once at construction. */
+    get baseUrl(): string | undefined;
+    /** The project this instance is bound to. Null means unscoped. */
+    get projectId(): string | null;
+    get files(): FilesApi;
+    get orgs(): OrgsApi;
+    get shares(): SharesApi;
+    /**
+     * Create an organization, optionally with its first owner.
+     *
+     * Creating a tenant is a control-plane operation: there is no principal
+     * inside the system yet who could be authorized to do it, and pretending
+     * otherwise would be theatre. Passing `ownerActorId` closes the bootstrap
+     * gap that would otherwise exist -- an org is never memberless, so there is
+     * never a "the org has no members yet, let anyone in" path for an attacker to
+     * find. Every subsequent membership change is authorized (see `addMember`).
+     */
+    createOrg(externalId: string, name?: string, opts?: {
+        ownerActorId?: string;
+    }): Promise<{
+        id: string;
+    }>;
+    createActor(externalId: string): Promise<{
+        id: string;
+    }>;
+    /**
+     * Register a customer application. Control plane; see the note on the
+     * lifecycle methods below for why these three take no principal.
+     */
+    createProject(key: string, name?: string): Promise<{
+        id: string;
+    }>;
+    /**
+     * Soft-delete a tenant. Every grant on every file in it is dead on the next
+     * request; every membership stops conferring anything. Nothing is erased and
+     * no row a retention hold protects is touched, so this cannot be used to
+     * defeat retention -- see SEMANTICS.md.
+     */
+    softDeleteOrg(orgId: string): Promise<void>;
+    /** Exactly reverses `softDeleteOrg`. Liveness is derived, so nothing is lost. */
+    restoreOrg(orgId: string): Promise<void>;
+    /**
+     * Soft-delete an identity.
+     *
+     * Three things die at once, and all three are derived rather than written:
+     * their role-derived access, every grant issued TO them, and every grant they
+     * ISSUED. The third is the judgement call; the reasoning is in schema.sql at
+     * `grant_scope_is_live` and in SEMANTICS.md. It is loud on purpose: deleting
+     * a prolific sharer revokes a lot of links, and that is the correct reading of
+     * P4, not a side effect.
+     */
+    softDeleteActor(actorId: string): Promise<void>;
+    restoreActor(actorId: string): Promise<void>;
+    /**
+     * Soft-delete a customer application: every org, every file and every grant
+     * inside it stops working immediately. This is the "we terminated that
+     * customer" operation and it is the widest blast radius in the system.
+     */
+    softDeleteProject(projectId: string): Promise<void>;
+    restoreProject(projectId: string): Promise<void>;
+    /**
+     * Add a member, or change an existing member's role.
+     *
+     * This used to take no principal at all. Anyone who could reach it could
+     * make anyone an owner of any org, and nothing was written to the audit log.
+     * Membership is the privilege that confers every other privilege, so it is
+     * now authorized by the same engine as everything else and audited on every
+     * outcome.
+     */
+    addMember(principal: Principal, orgId: string, actorId: string, role: OrgRole): Promise<void>;
+    removeMember(principal: Principal, orgId: string, actorId: string): Promise<void>;
+    /**
+     * Creation is the one file operation with no file to authorize against, so
+     * the question is org-scoped: does this actor hold `create_file` in this org?
+     * That is now asked of the engine rather than answered here.
+     *
+     * SIGNATURE CHANGE. This used to take a bare
+     * `actorId: string` while every other method took a `Principal`. That
+     * inconsistency was itself the defect: at the one call site in the example the
+     * developer passed `b.uploaderId` -- a value out of the REQUEST BODY -- rather
+     * than the authenticated actor, because the parameter's type did not tell them
+     * which one it wanted. Files are private-by-default AND owner-readable, so
+     * forging `owner_id` hands the wrong person permanent read access to the
+     * document, silently. A `Principal` is not confusable with a request field.
+     */
+    upload(principal: Principal, orgId: string, input: UploadInput): Promise<FileRecord>;
+    /**
+     * Read a file's bytes, WITH the headers required to serve them safely.
+     *
+     * The `headers` field closes a header-handling defect. Before it, this method returned a
+     * `Uint8Array` and the application decided what `Content-Type`,
+     * `Content-Disposition`, `X-Content-Type-Options` and `Cache-Control` to put
+     * on the response -- three security-sensitive decisions the library was
+     * handing back to the developer while claiming to have removed them, and
+     * which the example got wrong. They are computed here now, from the file
+     * record, with no option to disable them. See `delivery.ts`.
+     *
+     * This path now CHARGES the download cap. See `deliver()` below for the
+     * semantics and the reasoning.
+     */
+    read(principal: Principal, fileId: string, opts?: {
+        disposition?: Disposition;
+    }): Promise<{
+        file: FileRecord;
+        body: Uint8Array;
+        headers: Record<string, string>;
+        grantId?: string;
+        /** Null when no cap binds this delivery (a role-derived read, or no cap). */
+        remainingDownloads: number | null;
+    }>;
+    /**
+     * The streaming read. Same decision, same charge, same audit -- no buffer.
+     *
+     * Returns either a `ProxyDelivery` (bytes, as a stream) or, when redirect
+     * delivery is configured AND this delivery is eligible, a `RedirectDelivery`
+     * (a 302 to a short-lived presigned URL). The mode is on the returned object
+     * and in the audit log; nothing about it is implicit.
+     */
+    readStream(principal: Principal, fileId: string, 
+    /**
+     * `mode` defaults to 'auto', which means "apply this instance's redirect
+     * policy". On an instance that has not configured `redirectDelivery` -- the
+     * default -- that policy is "never redirect", so 'auto' and 'proxy' are the
+     * same thing and nothing becomes cacheable that was not before. Pass
+     * 'proxy' to force proxying on an instance that HAS opted in.
+     */
+    opts?: {
+        disposition?: Disposition;
+        mode?: 'proxy' | 'auto';
+        range?: {
+            start: number;
+            end?: number;
+        };
+    }): Promise<StreamedDelivery & {
+        file: FileRecord;
+        grantId?: string;
+        remainingDownloads: number | null;
+    }>;
+    /**
+     * Metadata without bytes, authorized exactly like `read`.
+     *
+     * This exists because `getFileRecord()` used to be public and took no
+     * principal -- see the note on it below. Callers that wanted a file's
+     * metadata had an unauthorized way to get it; now they have an authorized one.
+     *
+     * It does NOT charge the download cap, and that asymmetry is the whole point
+     * of the delivery-cap rule: the cap counts BYTES LEAVING, and `stat` delivers
+     * none.
+     */
+    stat(principal: Principal, fileId: string): Promise<FileRecord>;
+    /**
+     * Which files in this org may this principal `capability`?
+     *
+     * This is the primitive that was missing, and its absence was
+     * the reason the "0 authorization lines" claim survived: the example simply
+     * did not have a listing screen, and building one meant hand-rolling the org
+     * filter, the visibility rule, the owner check, the role check and the union
+     * over `file_grant` in application SQL.
+     *
+     * WHY IT CANNOT BE GOT WRONG.
+     *
+     *  - There is no filter parameter. The signature takes a principal, an org,
+     *    a capability, a page size and an opaque cursor. There is nothing here to
+     *    forget to pass and nothing that widens the result set.
+     *  - The predicate is generated from the same role table and the same
+     *    lifecycle gate `authorize()` uses (see `listPredicate` in authz.ts), so
+     *    the two cannot drift by editing one of them.
+     *  - `test/listing.test.ts` asserts set equality against `authorize()` over a
+     *    randomized corpus, on every capability, on every run.
+     *
+     * WHAT IT COSTS. One SQL query and one audit event, independent of page size.
+     * A per-file `authorize()` loop would be 4 round trips x N.
+     *
+     * The empty page is a valid answer: a caller with no standing sees nothing,
+     * and so does a caller naming an org that does not exist. Neither is an error,
+     * because distinguishing them would rebuild the existence oracle.
+     */
+    listFiles(principal: Principal, orgId: string, opts?: ListFilesOptions): Promise<FileListPage>;
+    /**
+     * ORDERING, and it is the mirror image of `upload()`.
+     *
+     * The metadata delete COMMITS FIRST -- the decision, the audit event the
+     * engine wrote for it, and the state change, all in one transaction -- and
+     * only then are the bytes removed. A crash in between leaves an object no row
+     * points at, which is an orphan and therefore a garbage-collection problem.
+     * The other ordering would leave a live, listable, authorizable `file` row
+     * whose object is gone, which is data loss.
+     *
+     * The bytes are removed OUTSIDE the transaction for the same reason they are
+     * written outside it: object storage cannot roll back, so including it would
+     * mean a rolled-back transaction had already destroyed the object.
+     */
+    delete(principal: Principal, fileId: string): Promise<void>;
+    /**
+     * COLLECT ORPHANED OBJECTS. A REQUIRED OPERATIONAL JOB.
+     *
+     * An orphan is an object in the store with no `file` row pointing at
+     * (provider, key). Two things produce them, both of them by design:
+     *
+     *   - a crash between `storage.put()` and the metadata commit in `upload()`;
+     *   - a crash between the metadata commit and `storage.delete()` in
+     *     `delete()`.
+     *
+     * Neither is a correctness problem -- an orphan is unreachable, because every
+     * read path in the system starts from a `file` row, and keys are fresh UUIDs
+     * that are never reissued -- but both cost money, and an uncollected orphan
+     * from a delete is a compliance problem: the customer was told the bytes were
+     * gone.
+     *
+     * WHAT MAKES THIS SAFE. Two things, and they are both load-bearing:
+     *
+     *  1. `olderThanSeconds` (default 1 hour, minimum 60s). An object written
+     *     seconds ago may belong to an upload whose transaction has not committed
+     *     yet. Deleting it would turn a successful upload into permanent data
+     *     loss -- the exact failure this whole ordering exists to avoid. The grace
+     *     period must exceed the longest plausible upload-plus-commit.
+     *  2. The `file` lookup is by (storage_provider, storage_key), the pair the
+     *     UNIQUE index is on, and it is NOT project-scoped and NOT filtered on
+     *     `deleted_at`. A soft-deleted file whose bytes were never removed still
+     *     has a row; this job must not race the delete path into removing bytes a
+     *     retention hold is protecting. It only removes what NOTHING references.
+     *
+     * Control plane: it takes no principal for the same reason the other
+     * lifecycle operations do not (see above). `dryRun` is the default.
+     */
+    collectStorageOrphans(opts?: {
+        prefix?: string;
+        olderThanSeconds?: number;
+        limit?: number;
+        dryRun?: boolean;
+    }): Promise<{
+        scanned: number;
+        orphans: string[];
+        deleted: number;
+        truncated: boolean;
+    }>;
+    share(principal: Principal, fileId: string, input: ShareInput): Promise<ShareResult>;
+    /**
+     * Revoke a grant.
+     *
+     * Nothing cascades, and nothing needs to: liveness is evaluated over the
+     * ancestor chain, so every grant ever delegated from this one dies in the
+     * same instant, at any depth, with no second write to get wrong (P4).
+     */
+    revoke(principal: Principal, grantId: string): Promise<void>;
+    listGrants(principal: Principal, fileId: string): Promise<GrantSummary[]>;
+    /**
+     * The share-link download path.
+     *
+     * Order matters: authorize FIRST (which re-validates the grant and its whole
+     * ancestor chain against `live_grant` -- P4, revocation beats a live URL),
+     * then consume the counter atomically (P6). Consuming before authorizing
+     * would let a revoked link burn a download; authorizing without consuming
+     * would make the cap a suggestion.
+     */
+    redeem(linkSecret: string, opts?: {
+        password?: string;
+        ip?: string;
+        userAgent?: string;
+        disposition?: Disposition;
+    }): Promise<{
+        file: FileRecord;
+        body: Uint8Array;
+        headers: Record<string, string>;
+        remainingDownloads: number | null;
+    }>;
+    /** The streaming share-link path. See `redeem()` for the ordering rationale. */
+    redeemStream(linkSecret: string, opts?: {
+        password?: string;
+        ip?: string;
+        userAgent?: string;
+        disposition?: Disposition;
+        mode?: 'proxy' | 'auto';
+        range?: {
+            start: number;
+            end?: number;
+        };
+    }): Promise<StreamedDelivery & {
+        file: FileRecord;
+        remainingDownloads: number | null;
+    }>;
+    /** Requires `read_audit` in the org, which is admin+. Asked of the engine. */
+    auditLog(principal: Principal, orgId: string, filter?: {
+        decision?: 'allow' | 'deny';
+        fileId?: string;
+        actorId?: string;
+        action?: string;
+        limit?: number;
+    }): Promise<AuditRow[]>;
+    /**
+     * Verify the tamper-evidence chain for an org.
+     *
+     * Authorized, because `checked` is a count of everything that has ever
+     * happened in the org and an unauthenticated caller should not be able to
+     * measure another tenant's activity.
+     */
+    verifyAuditChain(principal: Principal, orgId: string): Promise<AuditChainResult>;
+}
+/**
+ * Listing options.
+ *
+ * Note what is absent: any way to express a WHERE clause, a raw filter, an
+ * "include everything" flag, or a way to name another org. Everything here
+ * NARROWS the authorized set; nothing widens it. That is what "fail-closed by
+ * construction" has to mean for a query API -- not that the default is safe,
+ * but that the unsafe result is not expressible.
+ */
+export interface ListFilesOptions {
+    /** Which capability the caller must hold. Default `read`. */
+    capability?: Capability;
+    /** Page size. Clamped to [1, 200]. */
+    limit?: number;
+    /** Opaque keyset cursor from a previous page's `nextCursor`. */
+    cursor?: string | null;
+}
+export interface FileListPage {
+    files: FileRecord[];
+    /** Null when this is the last page. */
+    nextCursor: string | null;
+}
+/**
+ * Postgres array literal. The driver will not serialize a JS array into an
+ * enum[] parameter, and a silent misencoding here would either error loudly
+ * (fine) or store a single bogus capability (not fine), so the encoding is
+ * explicit. Enum labels are a closed set of [a-z]+ and cannot contain a
+ * separator, so no quoting is required -- but we assert that rather than
+ * assume it.
+ */
+export declare function pgArrayLiteral(values: readonly string[]): string;
+//# sourceMappingURL=filelayer.d.ts.map

package/dist/filelayer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filelayer.d.ts","sourceRoot":"","sources":["../src/filelayer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAUL,KAAK,UAAU,EAEf,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,KAAK,SAAS,EAEf,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,aAAa,EAMb,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAKL,KAAK,OAAO,EACZ,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAOL,KAAK,WAAW,EAGhB,KAAK,sBAAsB,EAE3B,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAK7C,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,IAAI,EAAE,OAAO,CAAC;IACd;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACpC,4CAA4C;GAC1C;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAChC,qDAAqD;GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,YAAY,CAAC;IACtB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sEAAsE;IACtE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,UAAW,SAAQ,OAAO;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AA8BD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0EAA0E;IAC1E,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAED,qBAAa,SAAS;;IACpB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;IAExC,OAAO,CAAC,MAAM,CAAC,CAAW;IAC1B,OAAO,CAAC,KAAK,CAAC,CAAU;IACxB,OAAO,CAAC,OAAO,CAAC,CAAY;IAE5B,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgC;gBAE7C,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,GAAE,gBAAqB;IAmD/E;;;;;;;OAOG;WACU,UAAU,CAAC,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAS5E,yEAAyE;IACzE,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAEhC;IAED,kEAAkE;IAClE,IAAI,SAAS,IAAI,MAAM,GAAG,IAAI,CAE7B;IAOD,IAAI,KAAK,IAAI,QAAQ,CAEpB;IAED,IAAI,IAAI,IAAI,OAAO,CAElB;IAED,IAAI,MAAM,IAAI,SAAS,CAEtB;IAMD;;;;;;;;;OASG;IACG,SAAS,CACb,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBpB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAS9D;;;OAGG;IACG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAgCxE;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,iFAAiF;IAC3E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB9C;;;;;;;;;OASG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BlD;;;;OAIG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtD;;;;;;;;OAQG;IACG,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,IAAI,CAAC;IAUV,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAavF;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAgG1F;;;;;;;;;;;;;OAaG;IACG,IAAI,CACR,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,WAAW,CAAA;KAAO,GACvC,OAAO,CAAC;QACT,IAAI,EAAE,UAAU,CAAC;QACjB,IAAI,EAAE,UAAU,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,6EAA6E;QAC7E,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;KACnC,CAAC;IAkBF;;;;;;;OAOG;IACG,UAAU,CACd,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM;IACd;;;;;;OAMG;IACH,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,WAAW,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAO,GACzG,OAAO,CAAC,gBAAgB,GAAG;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAgBxG;;;;;;;;;;OAUG;IACG,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsQrE;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,YAAY,CAAC;IAyBxB;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACG,qBAAqB,CACzB,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,OAAO,CAAC;KACb,GACL,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAsEjF,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAsL1F;;;;;;OAMG;IACG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsD5D,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAoC/E;;;;;;;;OAQG;IACG,MAAM,CACV,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,WAAW,CAAC;KACtB,GACL,OAAO,CAAC;QACT,IAAI,EAAE,UAAU,CAAC;QACjB,IAAI,EAAE,UAAU,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;KACnC,CAAC;IAaF,gFAAgF;IAC1E,YAAY,CAChB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACpC,GACL,OAAO,CAAC,gBAAgB,GAAG;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IA+CtF,8EAA8E;IACxE,QAAQ,CACZ,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,GAAE;QACN,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;KACX,GACL,OAAO,CAAC,QAAQ,EAAE,CAAC;IAStB;;;;;;OAMG;IACG,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA4BvF;AA0CD;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,uCAAuC;IACvC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAqCD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAKhE"}