@filelayer/core 0.3.0

package/dist/authz.d.ts

@@ -0,0 +1,524 @@
+/**
+ * FILELAYER AUTHORIZATION ENGINE
+ *
+ * Every access question in the system is answered here. There is deliberately
+ * no second path. Reads, writes, deletes, shares, signed-URL redemptions,
+ * membership changes, file creation and audit access all resolve through this
+ * module, against one decision core (`allow` / `deny`).
+ *
+ * The engine has exactly two resource scopes:
+ *
+ *   authorize()     (actor, file, capability)      -- file-scoped
+ *   authorizeOrg()  (actor, org,  org capability)  -- org-scoped
+ *
+ * The org scope exists because some privileges are not about a file: creating
+ * one, reading the audit log, and changing who is in the organization. Those
+ * used to be hand-rolled checks in the API layer or entirely absent.
+ * Membership is a privilege change like any other, so it goes through
+ * the same path, with the same deny reasons and the same audit guarantee.
+ *
+ * WHY ONE ENGINE MATTERS MORE THAN IT LOOKS:
+ * The design goal is to minimise the "number of security-sensitive decisions a
+ * developer must make". In a hand-rolled integration built directly on Supabase,
+ * Convex or Vercel, that number scales with the number of *places* the
+ * developer touches files:
+ * every route, every RLS policy, every presign call is an independent chance
+ * to leak. Here the developer makes none of them, because there is exactly one
+ * place a decision can be made and it is not in the application.
+ *
+ * INVARIANTS (mirrored from schema.sql, enforced here in code):
+ *   P1 deny by default          - DENY unless a rule fires, at the file
+ *                                 boundary as well as the tenant boundary
+ *   P2 no ambient authority     - storage keys/URLs/ids are never inputs
+ *   P4 URL <= permission        - redemption re-validates the grant AND its
+ *                                 whole ancestor chain, always
+ *   P5 audit every decision     - every return path emits exactly one event,
+ *                                 including decisions with no tenant to charge
+ *
+ * EVALUATION ORDER IS A SECURITY PROPERTY:
+ *   1. Does the file exist?           -> no: deny, audit to the system chain
+ *   2. Does the caller have STANDING? -> no: deny, and say nothing more
+ *   3. Does their standing carry the requested capability?
+ *   4. Only then: lifecycle gates (deleted / expired / not ready / retained)
+ *
+ * Steps 1-3 are indistinguishable to the caller: everything is 404. The
+ * lifecycle statuses that are NOT 404 (410 Gone, 409 retention hold) are only
+ * ever reachable by someone who has already proven they may perform the
+ * operation, so they cannot be used to probe for the existence of a file.
+ * Previously these gates ran first and the API layer patched over the resulting
+ * oracle; that patch is gone.
+ */
+export type Capability = 'read' | 'write' | 'delete' | 'share';
+export type OrgRole = 'viewer' | 'member' | 'admin' | 'owner';
+export type FileVisibility = 'private' | 'org';
+export type FileState = 'pending' | 'ready' | 'deleted';
+export declare const ALL_CAPABILITIES: readonly Capability[];
+/**
+ * Privileges that are not about a particular file.
+ *
+ * Deliberately a closed, tiny set for the same reason `org_role` is: an
+ * unbounded permission vocabulary is an authorization model nobody can audit.
+ */
+export type OrgCapability = 'create_file' | 'manage_members' | 'read_audit';
+/**
+ * A grant's subject is a PRINCIPAL SET (RFC-001). See the `grant_subject` note
+ * in schema.sql for the full reasoning; the ordering that matters here is
+ *
+ *     actor  <  role  <=  org  <  anonymous          (link is orthogonal)
+ *
+ * and it is what I6 attenuates over.
+ */
+export type GrantSubjectType = 'actor' | 'org' | 'role' | 'link' | 'anonymous';
+/**
+ * The subject types an issuer whose authority is GRANT-DERIVED may mint (I6).
+ *
+ * `actor` names one person and `link` is a bearer credential for one file;
+ * neither widens the population the issuer could already reach. `org`, `role`
+ * and `anonymous` all do, so a delegate may not create them at any depth.
+ *
+ * Exported so the rule is nameable in one place and testable directly, and so
+ * that adding a sixth subject type forces a decision about it here rather than
+ * silently defaulting to "delegable".
+ */
+export declare const DELEGABLE_SUBJECT_TYPES: readonly GrantSubjectType[];
+/**
+ * THE ROLE THRESHOLD, DEFINED ONCE.
+ *
+ * `subject_min_role` is a floor over the existing four-value `org_role` enum
+ * and nothing more -- no custom roles, no nesting, no configurable inheritance.
+ * A `role` grant matches a principal holding `actual` iff this returns true; an
+ * `org` grant is the same question with `min = 'viewer'`.
+ *
+ * Both the point check (`getGroupGrants`) and the set query
+ * (`listAuthorizedFiles`) need this rule in SQL. Neither restates it: both are
+ * generated from `membershipCells()` below, which is generated from this
+ * function, exactly as the role matrix is generated from `fileCapabilities()`.
+ */
+export declare function roleMeets(actual: OrgRole, min: OrgRole): boolean;
+/** One (floor, held) pair for which the threshold holds. */
+export interface MembershipCell {
+    minRole: OrgRole;
+    role: OrgRole;
+}
+/**
+ * Every (floor, held) pair that satisfies `roleMeets`. 4 x 4 = 16 probes of a
+ * pure function; 10 cells survive. This is the whole group-membership rule, in
+ * a form SQL can test with a tuple `IN` list.
+ */
+export declare function membershipCells(): MembershipCell[];
+export interface Principal {
+    /** Null means anonymous: a caller presenting only a link secret. */
+    actorId: string | null;
+    /** Present only when redeeming a share link. */
+    linkSecret?: string;
+    /** Present only when the share link is password protected. */
+    password?: string;
+    ip?: string;
+    userAgent?: string;
+}
+export interface FileRef {
+    id: string;
+    orgId: string;
+    ownerId: string | null;
+    state: 'pending' | 'ready' | 'deleted';
+    visibility: FileVisibility;
+    expiresAt: Date | null;
+    retainUntil: Date | null;
+}
+export type Decision = {
+    allow: true;
+    via: AuthzPath;
+    grantId?: string;
+    remainingDownloads?: number | null;
+} | {
+    allow: false;
+    reason: DenyReason;
+};
+/**
+ * Where an allow came from. `grant:org` and `grant:role` are the group paths
+ * (RFC-001, I4): the audit event records not just that a grant conferred
+ * access, but WHICH MEMBERSHIP did -- the subject org, the floor the grant
+ * asked for, and the role the caller actually held in that org. Someone reading
+ * the audit log can still answer "why did this succeed?" without joining
+ * anything.
+ */
+export type AuthzPath = 'owner' | 'role' | 'grant:actor' | 'grant:org' | 'grant:role' | 'grant:link' | 'grant:anonymous';
+export type DenyReason = 'file_not_found' | 'file_deleted' | 'file_expired' | 'file_not_ready' | 'no_membership' | 'insufficient_role' | 'no_grant' | 'grant_revoked' | 'grant_expired' | 'grant_exhausted' | 'grant_ancestor_dead' | 'grant_wrong_capability' | 'bad_link_secret' | 'bad_password' | 'foreign_grant' | 'retention_hold' | 'attenuation_violation'
+/**
+ * I6 (RFC-001). The issuer's authority was grant-derived and they asked to
+ * mint a subject wider than `actor` or `link`. Capability attenuation stops
+ * you doing more; this stops you reaching more people.
+ */
+ | 'subject_breadth_amplification' | 'role_escalation' | 'superior_target' | 'last_owner';
+/**
+ * What each org role may do to a file in its own org.
+ *
+ * Deliberately small and total. Every cell is enumerated -- there is no
+ * fallthrough, no "and also if", no special case. A reviewer can read this
+ * table in ten seconds and know the entire role model, which is the point:
+ * an authorization model you cannot hold in your head is one you cannot audit.
+ *
+ * `visibility` closes the "every viewer in an org could read every file in it"
+ * defect. Under the default ('private') a file is not
+ * visible to the org at large at all; membership alone buys nothing at the file
+ * boundary. Org admins and owners keep full access under both settings, because
+ * retention, deletion and legal hold are their responsibility, and a control
+ * the accountable party cannot exercise is not a control.
+ */
+export declare function fileCapabilities(role: OrgRole, isOwner: boolean, visibility: FileVisibility): Set<Capability>;
+/**
+ * What each org role may do to the organization itself.
+ *
+ * The same shape as the file table above, and enumerated for the same reason.
+ * `manage_members` is admin+: membership is the most powerful thing in the
+ * system, because it is the thing that confers everything else.
+ */
+export declare function orgCapabilities(role: OrgRole): Set<OrgCapability>;
+export interface AuthzDeps {
+    getFile(fileId: string): Promise<FileRef | null>;
+    orgExists(orgId: string): Promise<boolean>;
+    getMembership(orgId: string, actorId: string): Promise<OrgRole | null>;
+    countOwners(orgId: string): Promise<number>;
+    /** Live grants only: the store must apply the `live_grant` predicate. */
+    getActorGrants(fileId: string, actorId: string): Promise<GrantRow[]>;
+    /**
+     * Live GROUP grants ('org' / 'role') on this file that this actor matches
+     * through a live membership (RFC-001).
+     *
+     * THE CONTRACT THAT MAKES THE HEADLINE PROPERTY TRUE: this is a JOIN against
+     * `membership`, evaluated now. It is never a lookup into a materialized
+     * member list, and the engine never caches its result across requests. That
+     * is what makes "membership changes must change access on the next request,
+     * without recomputation" true BY CONSTRUCTION rather than by a background job
+     * that is usually up to date. An implementation of `AuthzDeps` that fans a
+     * group grant out into per-member rows satisfies the type and breaks the
+     * product.
+     *
+     * The returned rows carry `matchedRole` -- the role the actor actually holds
+     * in the subject org -- so the audit event can record which membership
+     * conferred access (I4).
+     */
+    getGroupGrants(fileId: string, actorId: string): Promise<GrantRow[]>;
+    findLiveGrantBySecret(secretHash: string): Promise<GrantRow | null>;
+    /**
+     * ANY grant with this secret hash, live or not. Used ONLY to attribute and
+     * classify a denial (P5) -- never to authorize. Without it a revoked,
+     * expired or capped-out link is indistinguishable from a forged one, and the
+     * compliance log cannot answer "why did my link stop working".
+     */
+    findGrantBySecret(secretHash: string): Promise<GrantRow | null>;
+    /** Is `grantId` the same grant as, or delegated from, `ancestorId`? */
+    isDescendantOf(ancestorId: string, grantId: string): Promise<boolean>;
+    getAnonymousGrant(fileId: string): Promise<GrantRow | null>;
+    /**
+     * The set form of the decision. Given a predicate DERIVED from the same
+     * `fileCapabilities` / `lifecycleDenial` functions the point check uses, the
+     * store returns the files in one org for which that predicate holds.
+     *
+     * It takes a `ListPredicate`, not a WHERE clause. There is no way for a
+     * caller to widen it, and no way to call it without one.
+     */
+    listAuthorizedFiles(query: ListQuery): Promise<ListedFile[]>;
+    hashSecret(secret: string): Promise<string>;
+    verifyPassword(password: string, hash: string): Promise<boolean>;
+    audit(event: AuditInput): Promise<void>;
+    now(): Date;
+}
+export interface GrantRow {
+    id: string;
+    fileId: string;
+    orgId: string;
+    parentGrantId: string | null;
+    subjectType: GrantSubjectType;
+    /** Set for 'org' and 'role' grants: the org whose members are the subject. */
+    subjectOrgId: string | null;
+    /** Set for 'role' grants only: the floor. Null on 'org' reads as 'viewer'. */
+    subjectMinRole: OrgRole | null;
+    /**
+     * For a group grant resolved for a specific principal: the role that
+     * principal actually holds in `subjectOrgId`. Not a column -- it comes out of
+     * the membership join that matched -- and it exists so the audit event can
+     * name WHICH MEMBERSHIP conferred access (I4) without a second query.
+     */
+    matchedRole?: OrgRole;
+    capabilities: Capability[];
+    passwordHash: string | null;
+    expiresAt: Date | null;
+    maxDownloads: number | null;
+    downloadCount: number;
+    revokedAt: Date | null;
+}
+export interface AuditInput {
+    /** Null is the SYSTEM chain: a decision with no tenant to charge it to. */
+    orgId: string | null;
+    action: string;
+    decision: 'allow' | 'deny';
+    reason?: string;
+    actorId: string | null;
+    fileId: string | null;
+    grantId?: string | null;
+    ip?: string;
+    userAgent?: string;
+    context?: Record<string, unknown>;
+}
+/** THE authorization decision. */
+export declare function authorize(deps: AuthzDeps, principal: Principal, fileId: string, capability: Capability): Promise<Decision>;
+export interface RoleCell {
+    role: OrgRole;
+    isOwner: boolean;
+    visibility: FileVisibility;
+}
+export interface LifecycleCell {
+    state: FileState;
+    expired: boolean;
+    retained: boolean;
+}
+export interface ListPredicate {
+    capability: Capability;
+    /** Every (role, ownership, visibility) cell whose role-derived caps hold it. */
+    roleCells: RoleCell[];
+    /** Every (state, expired, retained) cell that survives the lifecycle gate. */
+    lifecycleCells: LifecycleCell[];
+    /**
+     * Every (grant floor, held role) pair satisfying the group-grant threshold.
+     * Derived from `roleMeets()`, so the set query tests the same rule the point
+     * check applies rather than restating `>=` in SQL.
+     */
+    membershipCells: MembershipCell[];
+    /** Whether an anonymous grant can supply this capability at all. */
+    anonymousEligible: boolean;
+}
+export interface ListQuery {
+    orgId: string;
+    actorId: string | null;
+    predicate: ListPredicate;
+    now: Date;
+    limit: number;
+    cursor: {
+        createdAt: Date;
+        id: string;
+    } | null;
+}
+/** The subset of file columns listing returns. Same shape the store reads. */
+export interface ListedFile extends FileRef {
+    name: string;
+    contentType: string;
+    sizeBytes: number | null;
+    /**
+     * An object's location is (provider, key), not key alone -- that pair is what
+     * `file_storage_key_idx` makes unique. Code that carried only the key was the
+     * shape of the bug that let `storage_provider` be hardcoded to 'memory' and go
+     * unnoticed: nothing downstream ever read the column, so nothing ever
+     * disagreed with it.
+     */
+    storageProvider: string;
+    storageKey: string;
+    createdAt: Date;
+}
+/**
+ * Derive the set predicate from the point-check functions.
+ *
+ * Pure, total, and cheap enough to call per request (28 function calls). It is
+ * called per request rather than memoised so that it cannot go stale against a
+ * hot-reloaded or monkey-patched role table.
+ */
+export declare function listPredicate(capability: Capability): ListPredicate;
+export interface ListResult {
+    files: ListedFile[];
+    /** True when another page exists. Derived from a +1 over-fetch, not a count. */
+    hasMore: boolean;
+    /** The role the caller holds in the org, for the audit event. */
+    role: OrgRole | null;
+}
+/**
+ * THE set-scoped authorization decision.
+ *
+ * Note what this does NOT do: it does not gate on org membership before
+ * running the query. That would be a SECOND, different rule -- and it would be
+ * WRONG, because a grant may be issued to an actor who is not a member of the
+ * owning org at all. Such an actor's `authorize(read)` returns allow, so their
+ * `listFiles` must return that file, or the two disagree and the set query is
+ * not the access model.
+ *
+ * The empty set is therefore the correct answer for a caller with no standing,
+ * and it is also the answer for an org that does not exist. That symmetry is
+ * deliberate: a 404 for "no such org" against a 200 for "org you cannot see"
+ * would rebuild the existence oracle that the evaluation order closes.
+ *
+ * AUDIT: ONE event per call, not one per file. Reasoning in full, because it is
+ * a judgement call, and the reasons are recorded here:
+ *
+ *  - The principal made ONE decision request and the engine evaluated ONE
+ *    predicate. N events would describe an operation that did not happen: the
+ *    caller did not access N files, they enumerated their own authorized set.
+ *  - N events would put N hash-chain writes on the critical path of a read.
+ *    The chain is serialized per org (see the chain-append note in store.ts),
+ *    so a 200-row page would
+ *    serialize 200 writes behind one lock. That is not a cost trade, it is an
+ *    availability defect.
+ *  - It would make unauthenticated chain flooding trivially worse: one
+ *    request would append a page's worth of events.
+ *  - A per-file loop would also emit a DENY for every file the caller may not
+ *    see, which in a tenant with 100k files is 100k rows per listing screen.
+ *
+ * What is NOT given up: the event records the predicate (capability), the
+ * caller's role, the result cardinality and the returned ids, so "what did this
+ * principal learn the existence of, and when" is answerable from the log. And
+ * an empty result from a caller with no standing is recorded as a DENY with the
+ * same reason vocabulary the point check uses, so enumeration of a tenant by a
+ * non-member still shows up in a `decision = 'deny'` query.
+ */
+export declare function authorizeList(deps: AuthzDeps, principal: Principal, orgId: string, opts: {
+    capability: Capability;
+    limit: number;
+    cursor: {
+        createdAt: Date;
+        id: string;
+    } | null;
+}): Promise<ListResult>;
+export type ShareDecision = {
+    allow: true;
+    via: AuthzPath;
+    /**
+     * The grant the issuer's authority came from, or null when it came from
+     * an org role. This becomes the child's `parent_grant_id`, and it is what
+     * makes revocation transitive (P4).
+     */
+    parentGrantId: string | null;
+    /** Everything the issuer holds; the child may not exceed this. */
+    held: Capability[];
+} | {
+    allow: false;
+    reason: DenyReason;
+};
+/**
+ * May this principal mint a grant on this file carrying these capabilities, to
+ * this kind of subject?
+ *
+ * Three questions, and all three belong here rather than in the API layer:
+ *
+ *   1. May they share at all?
+ *   2. Is what they are handing out a SUBSET of what they hold?   (capability)
+ *   3. Is who they are handing it to no WIDER than they may reach? (I6, breadth)
+ *
+ * (2) used to live in `filelayer.share()`, which meant any second entry point
+ * built on `authorize()` silently reintroduced the escalation: a holder
+ * of `{share}` minting themselves `{delete}`. It is an authorization question,
+ * so the authorization engine answers it. The schema enforces the same rule
+ * again on the row itself, because a rule that exists only in application code
+ * binds only the application.
+ *
+ * (3) is the same argument in the other dimension, and it is new (RFC-001, I6).
+ * Attenuation over capabilities says what a delegate may DO; without a rule
+ * over subject breadth, a contractor holding one `{read, share}` grant could
+ * re-grant to an entire organization -- or to `anonymous` -- and every
+ * capability check would pass, because the child's set is a subset. Authority
+ * derived from an ORG ROLE (`via` of 'role' or 'owner') may name any subject;
+ * authority derived from a GRANT may name only an `actor` or mint a `link`.
+ *
+ * The engine refuses first, so the refusal is a decision with a reason and an
+ * audit event. The trigger in schema.sql refuses the same row again, so the
+ * rule holds for a caller issuing raw SQL. Same structure, same reasoning, as
+ * capability attenuation.
+ *
+ * -----------------------------------------------------------------------------
+ * KNOWN GAP, RECORDED RATHER THAN HIDDEN: `held` IS A UNION, `parentGrantId` IS
+ * ONE ROW.
+ * -----------------------------------------------------------------------------
+ * `held` is the union of every capability the issuer holds from every source,
+ * while `parentGrantId` is the SINGLE grant that supplied `share`. When a
+ * principal holds several grants on one file, the engine can therefore approve
+ * a capability set that no single ancestor covers -- and the attenuation
+ * trigger, which compares the child against its ONE parent, then refuses the
+ * INSERT. The outcome is a 403 rather than a disclosure, so the failure is
+ * fail-CLOSED and P4 is intact; what is wrong is that a legitimate delegation
+ * can be refused, and which one depends on the order the grants come back in.
+ *
+ * That order is now defined (`getActorGrants` sorts oldest-first) so the
+ * behaviour is at least deterministic and reproducible. Closing the gap
+ * properly means either picking the parent that covers the requested set, or
+ * minting one child per contributing ancestor, and both are changes to the
+ * delegation model rather than to this rule. Out of scope for RFC-001; flagged
+ * here so it is a decision rather than an accident.
+ */
+export declare function authorizeShare(deps: AuthzDeps, principal: Principal, fileId: string, requested: readonly Capability[], opts?: {
+    subjectType?: GrantSubjectType;
+}): Promise<ShareDecision>;
+/**
+ * May this principal revoke this grant?
+ *
+ * Found during the review of the delegation work and fixed with it: holding
+ * `share` on a file used to mean holding revoke over EVERY grant on that file.
+ * A contractor given a delegated `{read, share}` could therefore revoke the
+ * owner's unrelated share links -- not a disclosure, but a straightforward
+ * denial of service against the file's other recipients, and a strange thing
+ * for "you may pass this on" to imply.
+ *
+ * The rule mirrors the delegation model rather than adding a new one:
+ *
+ *   - authority from an org ROLE (admin, owner, or the file's own owner)
+ *     carries revoke over every grant on the file, as before;
+ *   - authority from a GRANT carries revoke only over that grant's own subtree,
+ *     which is exactly the authority it was given.
+ */
+export declare function authorizeRevoke(deps: AuthzDeps, principal: Principal, grant: {
+    id: string;
+    fileId: string;
+    orgId: string;
+}): Promise<Decision>;
+export declare function authorizeOrg(deps: AuthzDeps, principal: Principal, orgId: string, capability: OrgCapability, opts?: {
+    action?: string;
+    emitAllow?: boolean;
+}): Promise<Decision>;
+/**
+ * May this principal set `targetActorId` to `newRole` (null = remove them)?
+ *
+ * Membership is the privilege that confers every other privilege, so the rules
+ * are stated here rather than left to the application:
+ *
+ *   - you must hold `manage_members` (admin or owner);
+ *   - you may not grant a role above your own -- otherwise `admin` is just
+ *     `owner` with an extra step;
+ *   - you may not modify anyone who currently outranks you;
+ *   - you may not remove or demote the last owner, because an org nobody
+ *     administers cannot honour a retention hold or a deletion request.
+ *
+ * Exactly one audit event is emitted per attempt, allow or deny. A membership
+ * change that leaves no trace is indistinguishable from a breach after the
+ * fact.
+ */
+export declare function authorizeMembershipChange(deps: AuthzDeps, principal: Principal, orgId: string, targetActorId: string, newRole: OrgRole | null): Promise<Decision>;
+/**
+ * Emit an audit event for a decision that never reached the engine because the
+ * credential presented could not be resolved to anything at all -- a link
+ * secret matching no grant. There is no file and no tenant, so it goes to the
+ * system chain. A truncated hash of the presented secret is recorded so a
+ * brute-force sweep is correlatable; it is a 48-bit prefix of a SHA-256, not
+ * the credential, and it is useless without the original.
+ */
+export declare function auditUnresolvedSecret(deps: AuthzDeps, principal: Principal, secretHash: string): Promise<void>;
+export declare function schemaRefusal(err: unknown): string | null;
+/**
+ * Collapse internal deny reasons into what the caller is told.
+ *
+ * Internally we record precisely why access was denied, because that is what
+ * makes the audit log useful for incident response. Externally we return 404
+ * for everything that would otherwise confirm a file's existence -- otherwise
+ * the error message becomes an enumeration oracle across tenants.
+ *
+ * Grant-level lifecycle reasons (revoked / expired / exhausted / ancestor dead)
+ * collapse to 404 as well. A 410 "your link is used up" would be friendlier and
+ * is reachable only by someone holding a 256-bit secret, so the leak is
+ * theoretical -- but it costs nothing to make a dead link indistinguishable
+ * from a forged one, and the audit log carries the true reason for the operator
+ * who actually needs it.
+ *
+ * The asymmetry between what we log and what we return is intentional and is
+ * the kind of decision a hand-rolled integration requires developers to make
+ * themselves, in every route, correctly, every time.
+ */
+export declare function toPublicError(reason: DenyReason): {
+    status: number;
+    code: string;
+};
+//# sourceMappingURL=authz.d.ts.map

package/dist/authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../src/authz.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAC/D,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;AAC9D,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,KAAK,CAAC;AAC/C,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAExD,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAAyC,CAAC;AAK5F;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,gBAAgB,GAAG,YAAY,CAAC;AAU5E;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,gBAAgB,EAAsB,CAAC;AAEtF;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAEhE;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,cAAc,EAAE,CAQlD;AAED,MAAM,WAAW,SAAS;IACxB,oEAAoE;IACpE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACvC,UAAU,EAAE,cAAc,CAAC;IAC3B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,QAAQ,GAChB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACrF;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB,OAAO,GACP,MAAM,GACN,aAAa,GACb,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,iBAAiB,CAAC;AAEtB,MAAM,MAAM,UAAU,GAClB,gBAAgB,GAChB,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,eAAe,GACf,mBAAmB,GACnB,UAAU,GACV,eAAe,GACf,eAAe,GACf,iBAAiB,GACjB,qBAAqB,GACrB,wBAAwB,GACxB,iBAAiB,GACjB,cAAc,GACd,eAAe,GACf,gBAAgB,GAChB,uBAAuB;AACzB;;;;GAIG;GACD,+BAA+B,GAC/B,iBAAiB,GACjB,iBAAiB,GACjB,YAAY,CAAC;AAEjB;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,cAAc,GACzB,GAAG,CAAC,UAAU,CAAC,CAmBjB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC,CAUjE;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACjD,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACvE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,yEAAyE;IACzE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrE;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrE,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;OAKG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAChE,uEAAuE;IACvE,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7D,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,GAAG,IAAI,IAAI,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,8EAA8E;IAC9E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,8EAA8E;IAC9E,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAyRD,kCAAkC;AAClC,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,QAAQ,CAAC,CAEnB;AA0DD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,gFAAgF;IAChF,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,8EAA8E;IAC9E,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,oEAAoE;IACpE,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,aAAa,CAAC;IACzB,GAAG,EAAE,IAAI,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAChD;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAW,SAAQ,OAAO;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,aAAa,CAoDnE;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,UAAU,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,GAC9F,OAAO,CAAC,UAAU,CAAC,CA8DrB;AAMD,MAAM,MAAM,aAAa,GACrB;IACE,KAAK,EAAE,IAAI,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf;;;;OAIG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kEAAkE;IAClE,IAAI,EAAE,UAAU,EAAE,CAAC;CACpB,GACD;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,UAAU,EAAE,EAChC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,gBAAgB,CAAA;CAAO,GAC5C,OAAO,CAAC,aAAa,CAAC,CA0DxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,QAAQ,CAAC,CAqBnB;AAMD,wBAAsB,YAAY,CAChC,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,aAAa,EACzB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,OAAO,CAAC,QAAQ,CAAC,CA+BnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,OAAO,GAAG,IAAI,GACtB,OAAO,CAAC,QAAQ,CAAC,CAwCnB;AAkGD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAYf;AAcD,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAoBlF"}