@formancy/server 0.1.0 → 0.2.0

package/dist/postgres-storage-UMh8A-4C.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"postgres-storage-UMh8A-4C.mjs","names":["argon2Hash","argon2Verify"],"sources":["../src/auth-runtime.ts","../src/app.ts","../src/db.ts","../src/postgres-storage.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto'\nimport { hash as argon2Hash, verify as argon2Verify } from '@node-rs/argon2'\nimport { SignJWT, jwtVerify } from 'jose'\nimport type { Actor, Role } from '@formancy/server-core'\n\n/**\n * The real cryptography, confined to the composition root: argon2id for\n * secrets at rest, an HMAC-signed short-lived access token for sessions, and\n * a CSPRNG for API keys. server-core never sees any of this — it is handed\n * hash/verify/random functions and stays deterministic under test.\n *\n * HS256 rather than EdDSA for the session token, deliberately for this phase:\n * one secret in one env var is the self-hosting story a single-container\n * deployment can operate, and the signing scheme is an implementation detail\n * of a token that lives fifteen minutes. Revisit with key rotation.\n */\nexport function realSecretHashing(): {\n  hashSecret(secret: string): Promise<string>\n  verifySecret(secret: string, hash: string): Promise<boolean>\n} {\n  return {\n    hashSecret: (secret) => argon2Hash(secret),\n    verifySecret: async (secret, digest) => {\n      try {\n        return await argon2Verify(digest, secret)\n      } catch {\n        // A malformed digest is a failed verification, not a crash: this runs\n        // on the login path with attacker-influenced timing.\n        return false\n      }\n    },\n  }\n}\n\nexport function realRandomToken(): string {\n  return randomBytes(30).toString('base64url')\n}\n\nconst TOKEN_LIFETIME = '15m'\n\nexport interface SessionTokens {\n  issue(actor: Actor): Promise<string>\n  verify(token: string): Promise<Actor | undefined>\n}\n\nexport function createSessionTokens(secret: string): SessionTokens {\n  if (secret.length < 32) {\n    throw new Error(\n      'FORMANCY_AUTH_SECRET must be at least 32 characters. Generate one: openssl rand -base64 33',\n    )\n  }\n  const key = new TextEncoder().encode(secret)\n\n  return {\n    async issue(actor) {\n      return new SignJWT({ role: actor.role, kind: actor.kind })\n        .setProtectedHeader({ alg: 'HS256' })\n        .setSubject(actor.id)\n        .setIssuedAt()\n        .setExpirationTime(TOKEN_LIFETIME)\n        .sign(key)\n    },\n\n    async verify(token) {\n      try {\n        const { payload } = await jwtVerify(token, key, { algorithms: ['HS256'] })\n        const role = payload['role']\n        const kind = payload['kind']\n        if (\n          typeof payload.sub !== 'string' ||\n          (role !== 'admin' && role !== 'editor' && role !== 'viewer') ||\n          (kind !== 'user' && kind !== 'apiKey')\n        ) {\n          return undefined\n        }\n        return { id: payload.sub, role: role as Role, kind }\n      } catch {\n        return undefined\n      }\n    },\n  }\n}\n","import { randomUUID } from 'node:crypto'\nimport Fastify from 'fastify'\nimport type { FastifyInstance, FastifyRequest, preHandlerHookHandler } from 'fastify'\nimport {\n  authenticateApiKey,\n  authenticateLocal,\n  can,\n  createApiKey,\n  createLocalUser,\n  createSubmission,\n  exportCsv,\n  listForms,\n  listSubmissions,\n  listVersions,\n  publishForm,\n  resolveForm,\n  resumeDraft,\n  saveDraft,\n} from '@formancy/server-core'\nimport type { Action, Actor, AuthDeps, Role, ServerDeps, Storage } from '@formancy/server-core'\nimport { createSessionTokens, realRandomToken, realSecretHashing } from './auth-runtime.js'\n\nexport const SCHEMA_HASH_HEADER = 'x-formancy-schema-hash'\nexport const API_KEY_HEADER = 'x-formancy-api-key'\n\nexport interface AppOptions {\n  /** Signs the short-lived session tokens. At least 32 characters. */\n  authSecret: string\n  /**\n   * Created at startup IF no user exists yet — the docker-compose path to a\n   * first login. Ignored once any user exists, so it cannot re-seed an admin\n   * into a running installation.\n   */\n  bootstrapAdmin?: { email: string; password: string }\n}\n\n/**\n * The HTTP surface, split into two planes.\n *\n * PUBLIC — what a person filling a form needs: resolve, submit, drafts. These\n * stay unauthenticated by design; anonymous-submission hardening is its own\n * upcoming step and is opt-in per form.\n *\n * MANAGEMENT — everything an operator does: publish, catalog, submissions,\n * export, users, keys. Authenticated via a session token (login) or an API\n * key header, authorized through server-core's one-table can().\n *\n * This file is the composition root, so THIS is where ambient reality enters:\n * randomUUID, the real clock, argon2 and the CSPRNG. Everything below stays\n * injected and replayable.\n */\nexport async function createApp(storage: Storage, options: AppOptions): Promise<FastifyInstance> {\n  const app = Fastify({ logger: false })\n\n  const deps: ServerDeps = {\n    storage,\n    newId: () => randomUUID(),\n    nowIso: () => new Date().toISOString(),\n    capabilities: {\n      now: () => Date.now(),\n      today: () => new Date().toISOString().slice(0, 10),\n      random: () => Math.random(),\n    },\n  }\n\n  const authDeps: AuthDeps = {\n    storage,\n    newId: deps.newId,\n    nowIso: deps.nowIso,\n    randomToken: realRandomToken,\n    ...realSecretHashing(),\n  }\n\n  const sessions = createSessionTokens(options.authSecret)\n\n  if (options.bootstrapAdmin !== undefined) {\n    const alreadyThere = await storage.getUserByEmail(options.bootstrapAdmin.email)\n    if (alreadyThere === undefined) {\n      const outcome = await createLocalUser(authDeps, { ...options.bootstrapAdmin, role: 'admin' })\n      if (!outcome.ok) throw new Error(`Bootstrap admin rejected: ${outcome.message}`)\n    }\n  }\n\n  async function actorOf(request: FastifyRequest): Promise<Actor | undefined> {\n    const bearer = request.headers.authorization\n    if (typeof bearer === 'string' && bearer.startsWith('Bearer ')) {\n      return sessions.verify(bearer.slice('Bearer '.length))\n    }\n    const apiKey = request.headers[API_KEY_HEADER]\n    if (typeof apiKey === 'string' && apiKey !== '') {\n      const outcome = await authenticateApiKey(authDeps, apiKey)\n      return outcome.ok ? outcome.actor : undefined\n    }\n    return undefined\n  }\n\n  /** 401 without an identity, 403 with one that lacks the permission — the\n   *  difference tells a client whether to log in or to give up. */\n  function requires(action: Action): preHandlerHookHandler {\n    return async (request, reply) => {\n      const actor = await actorOf(request)\n      if (actor === undefined) {\n        return reply.code(401).send({ error: 'unauthenticated' })\n      }\n      if (!can(actor, action)) {\n        return reply.code(403).send({ error: 'forbidden', action })\n      }\n      ;(request as FastifyRequest & { actor: Actor }).actor = actor\n    }\n  }\n\n  // -------------------------------------------------------------------- auth\n\n  app.post('/auth/login', async (request, reply) => {\n    const body = request.body as { email?: unknown; password?: unknown } | null\n    if (body === null || typeof body.email !== 'string' || typeof body.password !== 'string') {\n      return reply.code(400).send({ error: 'bad_request', message: 'Body needs { email, password }.' })\n    }\n    const outcome = await authenticateLocal(authDeps, { email: body.email, password: body.password })\n    if (!outcome.ok) return reply.code(401).send({ error: 'invalid_credentials' })\n    return reply.send({ token: await sessions.issue(outcome.actor), role: outcome.actor.role })\n  })\n\n  app.post('/users', { preHandler: requires('user.create') }, async (request, reply) => {\n    const body = request.body as { email?: unknown; password?: unknown; role?: unknown } | null\n    if (\n      body === null ||\n      typeof body.email !== 'string' ||\n      typeof body.password !== 'string' ||\n      (body.role !== 'admin' && body.role !== 'editor' && body.role !== 'viewer')\n    ) {\n      return reply\n        .code(400)\n        .send({ error: 'bad_request', message: 'Body needs { email, password, role }.' })\n    }\n    const outcome = await createLocalUser(authDeps, {\n      email: body.email,\n      password: body.password,\n      role: body.role as Role,\n    })\n    if (!outcome.ok) return reply.code(422).send({ error: 'rejected', message: outcome.message })\n    return reply.code(201).send({ id: outcome.id })\n  })\n\n  app.post('/api-keys', { preHandler: requires('apiKey.create') }, async (request, reply) => {\n    const body = request.body as { name?: unknown; role?: unknown } | null\n    if (\n      body === null ||\n      typeof body.name !== 'string' ||\n      (body.role !== 'admin' && body.role !== 'editor' && body.role !== 'viewer')\n    ) {\n      return reply.code(400).send({ error: 'bad_request', message: 'Body needs { name, role }.' })\n    }\n    const outcome = await createApiKey(authDeps, { name: body.name, role: body.role as Role })\n    if (!outcome.ok) return reply.code(422).send({ error: 'rejected', message: outcome.message })\n    // The one and only time the secret exists in full outside a hash.\n    return reply.code(201).send({ id: outcome.id, secret: outcome.secret })\n  })\n\n  // -------------------------------------------------------------- management\n\n  app.post('/forms', { preHandler: requires('form.publish') }, async (request, reply) => {\n    const body = request.body as { path?: unknown; schema?: unknown } | null\n    if (body === null || typeof body.path !== 'string' || body.path === '' || body.schema === undefined) {\n      return reply.code(400).send({ error: 'bad_request', message: 'Body needs { path, schema }.' })\n    }\n\n    const outcome = await publishForm(deps, { path: body.path, schema: body.schema })\n    if (!outcome.ok) {\n      return reply.code(422).send({\n        error: outcome.kind,\n        ...(outcome.kind === 'invalid_schema' ? { errors: outcome.errors } : { message: outcome.message }),\n      })\n    }\n    return reply.code(201).send({ version: outcome.version, schemaHash: outcome.schemaHash })\n  })\n\n  app.get('/forms', { preHandler: requires('form.read') }, async (_request, reply) => {\n    return reply.send({ forms: await listForms(deps) })\n  })\n\n  app.get('/f/:path/versions', { preHandler: requires('form.read') }, async (request, reply) => {\n    const { path } = request.params as { path: string }\n    const versions = await listVersions(deps, path)\n    if (versions === undefined) return reply.code(404).send({ error: 'unknown_form' })\n    return reply.send({ versions })\n  })\n\n  app.get(\n    '/f/:path/submissions',\n    { preHandler: requires('submission.read') },\n    async (request, reply) => {\n      const { path } = request.params as { path: string }\n      const listed = await listSubmissions(deps, path)\n      if (listed === undefined) return reply.code(404).send({ error: 'unknown_form' })\n      return reply.send({ submissions: listed })\n    },\n  )\n\n  app.get(\n    '/f/:path/submissions/export.csv',\n    { preHandler: requires('submission.export') },\n    async (request, reply) => {\n      const { path } = request.params as { path: string }\n      const csv = await exportCsv(deps, path)\n      if (csv === undefined) return reply.code(404).send({ error: 'unknown_form' })\n      return reply\n        .header('content-type', 'text/csv; charset=utf-8')\n        .header('content-disposition', `attachment; filename=\"${path}-submissions.csv\"`)\n        .send(csv)\n    },\n  )\n\n  // ------------------------------------------------------------------ public\n\n  app.get('/f/:path', async (request, reply) => {\n    const { path } = request.params as { path: string }\n    const resolved = await resolveForm(deps, path)\n    if (resolved === undefined) return reply.code(404).send({ error: 'unknown_form' })\n    return reply.send({\n      version: resolved.version,\n      schemaHash: resolved.schemaHash,\n      schema: resolved.schema,\n    })\n  })\n\n  app.put('/f/:path/drafts/:draftId', async (request, reply) => {\n    const { path, draftId } = request.params as { path: string; draftId: string }\n    const saved = await saveDraft(deps, { path, draftId, data: request.body ?? {} })\n    if (saved === undefined) return reply.code(404).send({ error: 'unknown_form' })\n    return reply.send(saved)\n  })\n\n  app.get('/f/:path/drafts/:draftId', async (request, reply) => {\n    const { path, draftId } = request.params as { path: string; draftId: string }\n    const resumed = await resumeDraft(deps, { path, draftId })\n    if (resumed === undefined) return reply.code(404).send({ error: 'unknown_draft' })\n    return reply.send(resumed)\n  })\n\n  app.post('/f/:path/submissions', async (request, reply) => {\n    const { path } = request.params as { path: string }\n    const declaredSchemaHash = request.headers[SCHEMA_HASH_HEADER]\n    if (typeof declaredSchemaHash !== 'string' || declaredSchemaHash === '') {\n      return reply.code(400).send({\n        error: 'missing_schema_hash',\n        message: `Send the schema hash you rendered in the ${SCHEMA_HASH_HEADER} header.`,\n      })\n    }\n\n    const outcome = await createSubmission(deps, {\n      path,\n      declaredSchemaHash,\n      data: request.body ?? {},\n    })\n\n    if (outcome.ok) return reply.code(201).send({ id: outcome.id, data: outcome.canonicalData })\n\n    switch (outcome.kind) {\n      case 'unknown_form':\n        return reply.code(404).send({ error: 'unknown_form' })\n      case 'version_changed':\n        // 409 carries the CURRENT schema so the client can re-render and\n        // preserve what it can, instead of guessing why it was refused.\n        return reply.code(409).send({\n          error: 'FORM_VERSION_CHANGED',\n          current:\n            outcome.current === undefined\n              ? undefined\n              : {\n                  version: outcome.current.version,\n                  schemaHash: outcome.current.schemaHash,\n                  schema: outcome.current.schema,\n                },\n        })\n      case 'invalid':\n        // The identical error shape the client's engine produces, so server\n        // errors render through the same code path as local ones.\n        return reply.code(422).send({ error: 'invalid', errors: outcome.errors })\n    }\n  })\n\n  return app\n}\n","import { jsonb, integer, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core'\nimport type postgres from 'postgres'\n\n/**\n * The thin slice's tables. Three rules from the design spec are enforced HERE,\n * in the database, because application code can be bypassed and these must not\n * be:\n *\n *  - published versions are immutable (a trigger refuses UPDATE),\n *  - a submission binds to its exact version by real foreign key,\n *  - that key is ON DELETE RESTRICT, so orphaning a submission from the schema\n *    that produced it is structurally impossible.\n */\nexport const forms = pgTable('forms', {\n  id: uuid('id').primaryKey(),\n  path: text('path').notNull().unique(),\n  currentVersionId: uuid('current_version_id'),\n  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),\n})\n\nexport const formVersions = pgTable('form_versions', {\n  id: uuid('id').primaryKey(),\n  formId: uuid('form_id')\n    .notNull()\n    .references(() => forms.id),\n  version: integer('version').notNull(),\n  schema: jsonb('schema').notNull(),\n  schemaHash: text('schema_hash').notNull(),\n  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),\n})\n\nexport const users = pgTable('users', {\n  id: uuid('id').primaryKey(),\n  email: text('email').notNull().unique(),\n  passwordHash: text('password_hash').notNull(),\n  role: text('role').notNull(),\n  createdAt: timestamp('created_at', { withTimezone: true }).notNull(),\n})\n\nexport const apiKeys = pgTable('api_keys', {\n  id: uuid('id').primaryKey(),\n  name: text('name').notNull(),\n  prefix: text('prefix').notNull(),\n  secretHash: text('secret_hash').notNull(),\n  role: text('role').notNull(),\n  createdAt: timestamp('created_at', { withTimezone: true }).notNull(),\n  revokedAt: timestamp('revoked_at', { withTimezone: true }),\n})\n\nexport const drafts = pgTable('drafts', {\n  id: text('id').notNull(),\n  formId: uuid('form_id')\n    .notNull()\n    .references(() => forms.id),\n  formVersionId: uuid('form_version_id')\n    .notNull()\n    .references(() => formVersions.id),\n  data: jsonb('data').notNull(),\n  updatedAt: timestamp('updated_at', { withTimezone: true }).notNull(),\n})\n\nexport const submissions = pgTable('submissions', {\n  id: uuid('id').primaryKey(),\n  formId: uuid('form_id')\n    .notNull()\n    .references(() => forms.id),\n  formVersionId: uuid('form_version_id')\n    .notNull()\n    .references(() => formVersions.id, { onDelete: 'restrict' }),\n  data: jsonb('data').notNull(),\n  submittedAt: timestamp('submitted_at', { withTimezone: true }).notNull(),\n})\n\n/**\n * Bootstrap DDL for the thin slice — drizzle-kit migrations arrive with the\n * lifecycle work; a self-hosted skeleton that creates its own tables on first\n * start is worth more right now than a migration pipeline.\n */\nexport async function bootstrapSchema(sql: postgres.Sql): Promise<void> {\n  await sql`\n    CREATE TABLE IF NOT EXISTS forms (\n      id uuid PRIMARY KEY,\n      path text NOT NULL UNIQUE,\n      current_version_id uuid,\n      created_at timestamptz NOT NULL DEFAULT now()\n    )`\n  await sql`\n    CREATE TABLE IF NOT EXISTS form_versions (\n      id uuid PRIMARY KEY,\n      form_id uuid NOT NULL REFERENCES forms(id),\n      version integer NOT NULL,\n      schema jsonb NOT NULL,\n      schema_hash text NOT NULL,\n      created_at timestamptz NOT NULL DEFAULT now(),\n      UNIQUE (form_id, version),\n      UNIQUE (form_id, schema_hash)\n    )`\n  await sql`\n    CREATE TABLE IF NOT EXISTS submissions (\n      id uuid PRIMARY KEY,\n      form_id uuid NOT NULL REFERENCES forms(id),\n      form_version_id uuid NOT NULL REFERENCES form_versions(id) ON DELETE RESTRICT,\n      data jsonb NOT NULL,\n      submitted_at timestamptz NOT NULL\n    )`\n  await sql`\n    CREATE TABLE IF NOT EXISTS users (\n      id uuid PRIMARY KEY,\n      email text NOT NULL UNIQUE,\n      password_hash text NOT NULL,\n      role text NOT NULL,\n      created_at timestamptz NOT NULL\n    )`\n  await sql`\n    CREATE TABLE IF NOT EXISTS api_keys (\n      id uuid PRIMARY KEY,\n      name text NOT NULL,\n      prefix text NOT NULL,\n      secret_hash text NOT NULL,\n      role text NOT NULL,\n      created_at timestamptz NOT NULL,\n      revoked_at timestamptz\n    )`\n  await sql`CREATE INDEX IF NOT EXISTS api_keys_prefix ON api_keys (prefix)`\n  await sql`\n    CREATE TABLE IF NOT EXISTS drafts (\n      id text NOT NULL,\n      form_id uuid NOT NULL REFERENCES forms(id),\n      form_version_id uuid NOT NULL REFERENCES form_versions(id),\n      data jsonb NOT NULL,\n      updated_at timestamptz NOT NULL,\n      PRIMARY KEY (form_id, id)\n    )`\n  // Immutability lives in the database, not in application discipline: a\n  // published version row can never change, because every submission's audit\n  // story depends on it staying exactly what the user saw.\n  await sql`\n    CREATE OR REPLACE FUNCTION refuse_version_update() RETURNS trigger AS $$\n    BEGIN\n      RAISE EXCEPTION 'form_versions rows are immutable; publish a new version instead';\n    END\n    $$ LANGUAGE plpgsql`\n  await sql`DROP TRIGGER IF EXISTS form_versions_immutable ON form_versions`\n  await sql`\n    CREATE TRIGGER form_versions_immutable\n    BEFORE UPDATE ON form_versions\n    FOR EACH ROW EXECUTE FUNCTION refuse_version_update()`\n}\n","import { and, desc, eq, max } from 'drizzle-orm'\nimport { drizzle } from 'drizzle-orm/postgres-js'\nimport type postgres from 'postgres'\nimport type { FormSchema } from '@formancy/spec'\nimport type { Role, Storage } from '@formancy/server-core'\nimport { apiKeys, drafts, forms, formVersions, submissions } from './db.js'\nimport { users } from './db.js'\n\n/** The Storage port over Postgres — the mirror of server-core's in-memory one. */\nexport function createPostgresStorage(sql: postgres.Sql): Storage {\n  const db = drizzle(sql)\n\n  return {\n    async getFormByPath(path) {\n      const rows = await db.select().from(forms).where(eq(forms.path, path)).limit(1)\n      const row = rows[0]\n      if (row === undefined) return undefined\n      return { id: row.id, path: row.path, currentVersionId: row.currentVersionId }\n    },\n\n    async listForms() {\n      const rows = await db.select().from(forms)\n      return rows.map((row) => ({\n        id: row.id,\n        path: row.path,\n        currentVersionId: row.currentVersionId,\n      }))\n    },\n\n    async createForm(record) {\n      await db.insert(forms).values({\n        id: record.id,\n        path: record.path,\n        currentVersionId: record.currentVersionId,\n      })\n    },\n\n    async setCurrentVersion(formId, versionId) {\n      await db.update(forms).set({ currentVersionId: versionId }).where(eq(forms.id, formId))\n    },\n\n    async insertVersion(record) {\n      await db.insert(formVersions).values({\n        id: record.id,\n        formId: record.formId,\n        version: record.version,\n        schema: record.schema,\n        schemaHash: record.schemaHash,\n      })\n    },\n\n    async getVersionById(id) {\n      const rows = await db.select().from(formVersions).where(eq(formVersions.id, id)).limit(1)\n      const row = rows[0]\n      if (row === undefined) return undefined\n      return {\n        id: row.id,\n        formId: row.formId,\n        version: row.version,\n        schema: row.schema as FormSchema,\n        schemaHash: row.schemaHash,\n      }\n    },\n\n    async findVersionByHash(formId, schemaHash) {\n      const rows = await db\n        .select()\n        .from(formVersions)\n        .where(eq(formVersions.formId, formId))\n      const row = rows.find((candidate) => candidate.schemaHash === schemaHash)\n      if (row === undefined) return undefined\n      return {\n        id: row.id,\n        formId: row.formId,\n        version: row.version,\n        schema: row.schema as FormSchema,\n        schemaHash: row.schemaHash,\n      }\n    },\n\n    async latestVersionNumber(formId) {\n      const rows = await db\n        .select({ latest: max(formVersions.version) })\n        .from(formVersions)\n        .where(eq(formVersions.formId, formId))\n      return rows[0]?.latest ?? 0\n    },\n\n    async insertSubmission(record) {\n      await db.insert(submissions).values({\n        id: record.id,\n        formId: record.formId,\n        formVersionId: record.formVersionId,\n        data: record.data,\n        submittedAt: new Date(record.submittedAt),\n      })\n    },\n\n    async listSubmissions() {\n      const rows = await db.select().from(submissions)\n      return rows.map(toSubmissionRecord)\n    },\n\n    async listSubmissionsByForm(formId) {\n      const rows = await db\n        .select()\n        .from(submissions)\n        .where(eq(submissions.formId, formId))\n        .orderBy(desc(submissions.submittedAt), desc(submissions.id))\n      return rows.map(toSubmissionRecord)\n    },\n\n    async listVersionsByForm(formId) {\n      const rows = await db\n        .select()\n        .from(formVersions)\n        .where(eq(formVersions.formId, formId))\n        .orderBy(desc(formVersions.version))\n      return rows.map((row) => ({\n        id: row.id,\n        formId: row.formId,\n        version: row.version,\n        schema: row.schema as FormSchema,\n        schemaHash: row.schemaHash,\n      }))\n    },\n\n    async upsertDraft(record) {\n      await db\n        .insert(drafts)\n        .values({\n          id: record.id,\n          formId: record.formId,\n          formVersionId: record.formVersionId,\n          data: record.data,\n          updatedAt: new Date(record.updatedAt),\n        })\n        .onConflictDoUpdate({\n          target: [drafts.formId, drafts.id],\n          set: {\n            formVersionId: record.formVersionId,\n            data: record.data,\n            updatedAt: new Date(record.updatedAt),\n          },\n        })\n    },\n\n    async getDraft(formId, draftId) {\n      const rows = await db\n        .select()\n        .from(drafts)\n        .where(and(eq(drafts.formId, formId), eq(drafts.id, draftId)))\n        .limit(1)\n      const row = rows[0]\n      if (row === undefined) return undefined\n      return {\n        id: row.id,\n        formId: row.formId,\n        formVersionId: row.formVersionId,\n        data: row.data,\n        updatedAt: row.updatedAt.toISOString(),\n      }\n    },\n\n    async insertUser(record) {\n      await db.insert(users).values({\n        id: record.id,\n        email: record.email,\n        passwordHash: record.passwordHash,\n        role: record.role,\n        createdAt: new Date(record.createdAt),\n      })\n    },\n\n    async getUserByEmail(email) {\n      const rows = await db.select().from(users).where(eq(users.email, email)).limit(1)\n      const row = rows[0]\n      if (row === undefined) return undefined\n      return {\n        id: row.id,\n        email: row.email,\n        passwordHash: row.passwordHash,\n        role: row.role as Role,\n        createdAt: row.createdAt.toISOString(),\n      }\n    },\n\n    async insertApiKey(record) {\n      await db.insert(apiKeys).values({\n        id: record.id,\n        name: record.name,\n        prefix: record.prefix,\n        secretHash: record.secretHash,\n        role: record.role,\n        createdAt: new Date(record.createdAt),\n        revokedAt: record.revokedAt === null ? null : new Date(record.revokedAt),\n      })\n    },\n\n    async listApiKeys() {\n      const rows = await db.select().from(apiKeys)\n      return rows.map(toApiKeyRecord)\n    },\n\n    async findApiKeysByPrefix(prefix) {\n      const rows = await db.select().from(apiKeys).where(eq(apiKeys.prefix, prefix))\n      return rows.map(toApiKeyRecord)\n    },\n\n    async revokeApiKey(id, atIso) {\n      await db.update(apiKeys).set({ revokedAt: new Date(atIso) }).where(eq(apiKeys.id, id))\n    },\n  }\n}\n\nfunction toApiKeyRecord(row: {\n  id: string\n  name: string\n  prefix: string\n  secretHash: string\n  role: string\n  createdAt: Date\n  revokedAt: Date | null\n}) {\n  return {\n    id: row.id,\n    name: row.name,\n    prefix: row.prefix,\n    secretHash: row.secretHash,\n    role: row.role as Role,\n    createdAt: row.createdAt.toISOString(),\n    revokedAt: row.revokedAt === null ? null : row.revokedAt.toISOString(),\n  }\n}\n\nfunction toSubmissionRecord(row: {\n  id: string\n  formId: string\n  formVersionId: string\n  data: unknown\n  submittedAt: Date\n}) {\n  return {\n    id: row.id,\n    formId: row.formId,\n    formVersionId: row.formVersionId,\n    data: row.data,\n    submittedAt: row.submittedAt.toISOString(),\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,oBAGd;CACA,OAAO;EACL,aAAa,WAAWA,KAAW,MAAM;EACzC,cAAc,OAAO,QAAQ,WAAW;GACtC,IAAI;IACF,OAAO,MAAMC,OAAa,QAAQ,MAAM;GAC1C,QAAQ;IAGN,OAAO;GACT;EACF;CACF;AACF;AAEA,SAAgB,kBAA0B;CACxC,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;AAC7C;AAEA,MAAM,iBAAiB;AAOvB,SAAgB,oBAAoB,QAA+B;CACjE,IAAI,OAAO,SAAS,IAClB,MAAM,IAAI,MACR,4FACF;CAEF,MAAM,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM;CAE3C,OAAO;EACL,MAAM,MAAM,OAAO;GACjB,OAAO,IAAI,QAAQ;IAAE,MAAM,MAAM;IAAM,MAAM,MAAM;GAAK,CAAC,CAAC,CACvD,mBAAmB,EAAE,KAAK,QAAQ,CAAC,CAAC,CACpC,WAAW,MAAM,EAAE,CAAC,CACpB,YAAY,CAAC,CACb,kBAAkB,cAAc,CAAC,CACjC,KAAK,GAAG;EACb;EAEA,MAAM,OAAO,OAAO;GAClB,IAAI;IACF,MAAM,EAAE,YAAY,MAAM,UAAU,OAAO,KAAK,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;IACzE,MAAM,OAAO,QAAQ;IACrB,MAAM,OAAO,QAAQ;IACrB,IACE,OAAO,QAAQ,QAAQ,YACtB,SAAS,WAAW,SAAS,YAAY,SAAS,YAClD,SAAS,UAAU,SAAS,UAE7B;IAEF,OAAO;KAAE,IAAI,QAAQ;KAAW;KAAc;IAAK;GACrD,QAAQ;IACN;GACF;EACF;CACF;AACF;;;AC3DA,MAAa,qBAAqB;AAClC,MAAa,iBAAiB;;;;;;;;;;;;;;;;AA4B9B,eAAsB,UAAU,SAAkB,SAA+C;CAC/F,MAAM,MAAM,QAAQ,EAAE,QAAQ,MAAM,CAAC;CAErC,MAAM,OAAmB;EACvB;EACA,aAAa,WAAW;EACxB,+BAAc,IAAI,KAAK,EAAA,CAAE,YAAY;EACrC,cAAc;GACZ,WAAW,KAAK,IAAI;GACpB,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,MAAM,GAAG,EAAE;GACjD,cAAc,KAAK,OAAO;EAC5B;CACF;CAEA,MAAM,WAAqB;EACzB;EACA,OAAO,KAAK;EACZ,QAAQ,KAAK;EACb,aAAa;EACb,GAAG,kBAAkB;CACvB;CAEA,MAAM,WAAW,oBAAoB,QAAQ,UAAU;CAEvD,IAAI,QAAQ,mBAAmB,KAAA,GAEzB;MAAA,MADuB,QAAQ,eAAe,QAAQ,eAAe,KAAK,MACzD,KAAA,GAAW;GAC9B,MAAM,UAAU,MAAM,gBAAgB,UAAU;IAAE,GAAG,QAAQ;IAAgB,MAAM;GAAQ,CAAC;GAC5F,IAAI,CAAC,QAAQ,IAAI,MAAM,IAAI,MAAM,6BAA6B,QAAQ,SAAS;EACjF;;CAGF,eAAe,QAAQ,SAAqD;EAC1E,MAAM,SAAS,QAAQ,QAAQ;EAC/B,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,SAAS,GAC3D,OAAO,SAAS,OAAO,OAAO,MAAM,CAAgB,CAAC;EAEvD,MAAM,SAAS,QAAQ,QAAQ;EAC/B,IAAI,OAAO,WAAW,YAAY,WAAW,IAAI;GAC/C,MAAM,UAAU,MAAM,mBAAmB,UAAU,MAAM;GACzD,OAAO,QAAQ,KAAK,QAAQ,QAAQ,KAAA;EACtC;CAEF;;;CAIA,SAAS,SAAS,QAAuC;EACvD,OAAO,OAAO,SAAS,UAAU;GAC/B,MAAM,QAAQ,MAAM,QAAQ,OAAO;GACnC,IAAI,UAAU,KAAA,GACZ,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,kBAAkB,CAAC;GAE1D,IAAI,CAAC,IAAI,OAAO,MAAM,GACpB,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAAE,OAAO;IAAa;GAAO,CAAC;GAE3D,QAA+C,QAAQ;EAC1D;CACF;CAIA,IAAI,KAAK,eAAe,OAAO,SAAS,UAAU;EAChD,MAAM,OAAO,QAAQ;EACrB,IAAI,SAAS,QAAQ,OAAO,KAAK,UAAU,YAAY,OAAO,KAAK,aAAa,UAC9E,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,OAAO;GAAe,SAAS;EAAkC,CAAC;EAElG,MAAM,UAAU,MAAM,kBAAkB,UAAU;GAAE,OAAO,KAAK;GAAO,UAAU,KAAK;EAAS,CAAC;EAChG,IAAI,CAAC,QAAQ,IAAI,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,sBAAsB,CAAC;EAC7E,OAAO,MAAM,KAAK;GAAE,OAAO,MAAM,SAAS,MAAM,QAAQ,KAAK;GAAG,MAAM,QAAQ,MAAM;EAAK,CAAC;CAC5F,CAAC;CAED,IAAI,KAAK,UAAU,EAAE,YAAY,SAAS,aAAa,EAAE,GAAG,OAAO,SAAS,UAAU;EACpF,MAAM,OAAO,QAAQ;EACrB,IACE,SAAS,QACT,OAAO,KAAK,UAAU,YACtB,OAAO,KAAK,aAAa,YACxB,KAAK,SAAS,WAAW,KAAK,SAAS,YAAY,KAAK,SAAS,UAElE,OAAO,MACJ,KAAK,GAAG,CAAC,CACT,KAAK;GAAE,OAAO;GAAe,SAAS;EAAwC,CAAC;EAEpF,MAAM,UAAU,MAAM,gBAAgB,UAAU;GAC9C,OAAO,KAAK;GACZ,UAAU,KAAK;GACf,MAAM,KAAK;EACb,CAAC;EACD,IAAI,CAAC,QAAQ,IAAI,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,OAAO;GAAY,SAAS,QAAQ;EAAQ,CAAC;EAC5F,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,QAAQ,GAAG,CAAC;CAChD,CAAC;CAED,IAAI,KAAK,aAAa,EAAE,YAAY,SAAS,eAAe,EAAE,GAAG,OAAO,SAAS,UAAU;EACzF,MAAM,OAAO,QAAQ;EACrB,IACE,SAAS,QACT,OAAO,KAAK,SAAS,YACpB,KAAK,SAAS,WAAW,KAAK,SAAS,YAAY,KAAK,SAAS,UAElE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,OAAO;GAAe,SAAS;EAA6B,CAAC;EAE7F,MAAM,UAAU,MAAM,aAAa,UAAU;GAAE,MAAM,KAAK;GAAM,MAAM,KAAK;EAAa,CAAC;EACzF,IAAI,CAAC,QAAQ,IAAI,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,OAAO;GAAY,SAAS,QAAQ;EAAQ,CAAC;EAE5F,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,IAAI,QAAQ;GAAI,QAAQ,QAAQ;EAAO,CAAC;CACxE,CAAC;CAID,IAAI,KAAK,UAAU,EAAE,YAAY,SAAS,cAAc,EAAE,GAAG,OAAO,SAAS,UAAU;EACrF,MAAM,OAAO,QAAQ;EACrB,IAAI,SAAS,QAAQ,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,MAAM,KAAK,WAAW,KAAA,GACxF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,OAAO;GAAe,SAAS;EAA+B,CAAC;EAG/F,MAAM,UAAU,MAAM,YAAY,MAAM;GAAE,MAAM,KAAK;GAAM,QAAQ,KAAK;EAAO,CAAC;EAChF,IAAI,CAAC,QAAQ,IACX,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAC1B,OAAO,QAAQ;GACf,GAAI,QAAQ,SAAS,mBAAmB,EAAE,QAAQ,QAAQ,OAAO,IAAI,EAAE,SAAS,QAAQ,QAAQ;EAClG,CAAC;EAEH,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,SAAS,QAAQ;GAAS,YAAY,QAAQ;EAAW,CAAC;CAC1F,CAAC;CAED,IAAI,IAAI,UAAU,EAAE,YAAY,SAAS,WAAW,EAAE,GAAG,OAAO,UAAU,UAAU;EAClF,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,UAAU,IAAI,EAAE,CAAC;CACpD,CAAC;CAED,IAAI,IAAI,qBAAqB,EAAE,YAAY,SAAS,WAAW,EAAE,GAAG,OAAO,SAAS,UAAU;EAC5F,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,WAAW,MAAM,aAAa,MAAM,IAAI;EAC9C,IAAI,aAAa,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EACjF,OAAO,MAAM,KAAK,EAAE,SAAS,CAAC;CAChC,CAAC;CAED,IAAI,IACF,wBACA,EAAE,YAAY,SAAS,iBAAiB,EAAE,GAC1C,OAAO,SAAS,UAAU;EACxB,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,SAAS,MAAM,gBAAgB,MAAM,IAAI;EAC/C,IAAI,WAAW,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAC/E,OAAO,MAAM,KAAK,EAAE,aAAa,OAAO,CAAC;CAC3C,CACF;CAEA,IAAI,IACF,mCACA,EAAE,YAAY,SAAS,mBAAmB,EAAE,GAC5C,OAAO,SAAS,UAAU;EACxB,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,MAAM,MAAM,UAAU,MAAM,IAAI;EACtC,IAAI,QAAQ,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAC5E,OAAO,MACJ,OAAO,gBAAgB,yBAAyB,CAAC,CACjD,OAAO,uBAAuB,yBAAyB,KAAK,kBAAkB,CAAC,CAC/E,KAAK,GAAG;CACb,CACF;CAIA,IAAI,IAAI,YAAY,OAAO,SAAS,UAAU;EAC5C,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,WAAW,MAAM,YAAY,MAAM,IAAI;EAC7C,IAAI,aAAa,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EACjF,OAAO,MAAM,KAAK;GAChB,SAAS,SAAS;GAClB,YAAY,SAAS;GACrB,QAAQ,SAAS;EACnB,CAAC;CACH,CAAC;CAED,IAAI,IAAI,4BAA4B,OAAO,SAAS,UAAU;EAC5D,MAAM,EAAE,MAAM,YAAY,QAAQ;EAClC,MAAM,QAAQ,MAAM,UAAU,MAAM;GAAE;GAAM;GAAS,MAAM,QAAQ,QAAQ,CAAC;EAAE,CAAC;EAC/E,IAAI,UAAU,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAC9E,OAAO,MAAM,KAAK,KAAK;CACzB,CAAC;CAED,IAAI,IAAI,4BAA4B,OAAO,SAAS,UAAU;EAC5D,MAAM,EAAE,MAAM,YAAY,QAAQ;EAClC,MAAM,UAAU,MAAM,YAAY,MAAM;GAAE;GAAM;EAAQ,CAAC;EACzD,IAAI,YAAY,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,gBAAgB,CAAC;EACjF,OAAO,MAAM,KAAK,OAAO;CAC3B,CAAC;CAED,IAAI,KAAK,wBAAwB,OAAO,SAAS,UAAU;EACzD,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,qBAAqB,QAAQ,QAAQ;EAC3C,IAAI,OAAO,uBAAuB,YAAY,uBAAuB,IACnE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAC1B,OAAO;GACP,SAAS,4CAA4C,mBAAmB;EAC1E,CAAC;EAGH,MAAM,UAAU,MAAM,iBAAiB,MAAM;GAC3C;GACA;GACA,MAAM,QAAQ,QAAQ,CAAC;EACzB,CAAC;EAED,IAAI,QAAQ,IAAI,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,IAAI,QAAQ;GAAI,MAAM,QAAQ;EAAc,CAAC;EAE3F,QAAQ,QAAQ,MAAhB;GACE,KAAK,gBACH,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;GACvD,KAAK,mBAGH,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAC1B,OAAO;IACP,SACE,QAAQ,YAAY,KAAA,IAChB,KAAA,IACA;KACE,SAAS,QAAQ,QAAQ;KACzB,YAAY,QAAQ,QAAQ;KAC5B,QAAQ,QAAQ,QAAQ;IAC1B;GACR,CAAC;GACH,KAAK,WAGH,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAAE,OAAO;IAAW,QAAQ,QAAQ;GAAO,CAAC;EAC5E;CACF,CAAC;CAED,OAAO;AACT;;;;;;;;;;;;;AC9QA,MAAa,QAAQ,QAAQ,SAAS;CACpC,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,MAAM,KAAK,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO;CACpC,kBAAkB,KAAK,oBAAoB;CAC3C,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW;AAClF,CAAC;AAED,MAAa,eAAe,QAAQ,iBAAiB;CACnD,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,QAAQ,KAAK,SAAS,CAAC,CACpB,QAAQ,CAAC,CACT,iBAAiB,MAAM,EAAE;CAC5B,SAAS,QAAQ,SAAS,CAAC,CAAC,QAAQ;CACpC,QAAQ,MAAM,QAAQ,CAAC,CAAC,QAAQ;CAChC,YAAY,KAAK,aAAa,CAAC,CAAC,QAAQ;CACxC,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW;AAClF,CAAC;AAED,MAAa,QAAQ,QAAQ,SAAS;CACpC,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,OAAO,KAAK,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO;CACtC,cAAc,KAAK,eAAe,CAAC,CAAC,QAAQ;CAC5C,MAAM,KAAK,MAAM,CAAC,CAAC,QAAQ;CAC3B,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ;AACrE,CAAC;AAED,MAAa,UAAU,QAAQ,YAAY;CACzC,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,MAAM,KAAK,MAAM,CAAC,CAAC,QAAQ;CAC3B,QAAQ,KAAK,QAAQ,CAAC,CAAC,QAAQ;CAC/B,YAAY,KAAK,aAAa,CAAC,CAAC,QAAQ;CACxC,MAAM,KAAK,MAAM,CAAC,CAAC,QAAQ;CAC3B,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ;CACnE,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC;AAC3D,CAAC;AAED,MAAa,SAAS,QAAQ,UAAU;CACtC,IAAI,KAAK,IAAI,CAAC,CAAC,QAAQ;CACvB,QAAQ,KAAK,SAAS,CAAC,CACpB,QAAQ,CAAC,CACT,iBAAiB,MAAM,EAAE;CAC5B,eAAe,KAAK,iBAAiB,CAAC,CACnC,QAAQ,CAAC,CACT,iBAAiB,aAAa,EAAE;CACnC,MAAM,MAAM,MAAM,CAAC,CAAC,QAAQ;CAC5B,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ;AACrE,CAAC;AAED,MAAa,cAAc,QAAQ,eAAe;CAChD,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,QAAQ,KAAK,SAAS,CAAC,CACpB,QAAQ,CAAC,CACT,iBAAiB,MAAM,EAAE;CAC5B,eAAe,KAAK,iBAAiB,CAAC,CACnC,QAAQ,CAAC,CACT,iBAAiB,aAAa,IAAI,EAAE,UAAU,WAAW,CAAC;CAC7D,MAAM,MAAM,MAAM,CAAC,CAAC,QAAQ;CAC5B,aAAa,UAAU,gBAAgB,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ;AACzE,CAAC;;;;;;AAOD,eAAsB,gBAAgB,KAAkC;CACtE,MAAM,GAAG;;;;;;;CAOT,MAAM,GAAG;;;;;;;;;;;CAWT,MAAM,GAAG;;;;;;;;CAQT,MAAM,GAAG;;;;;;;;CAQT,MAAM,GAAG;;;;;;;;;;CAUT,MAAM,GAAG;CACT,MAAM,GAAG;;;;;;;;;CAYT,MAAM,GAAG;;;;;;CAMT,MAAM,GAAG;CACT,MAAM,GAAG;;;;AAIX;;;;AC1IA,SAAgB,sBAAsB,KAA4B;CAChE,MAAM,KAAK,QAAQ,GAAG;CAEtB,OAAO;EACL,MAAM,cAAc,MAAM;GAExB,MAAM,OAAM,MADO,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAA,CAC7D;GACjB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAC9B,OAAO;IAAE,IAAI,IAAI;IAAI,MAAM,IAAI;IAAM,kBAAkB,IAAI;GAAiB;EAC9E;EAEA,MAAM,YAAY;GAEhB,QAAO,MADY,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,EAAA,CAC7B,KAAK,SAAS;IACxB,IAAI,IAAI;IACR,MAAM,IAAI;IACV,kBAAkB,IAAI;GACxB,EAAE;EACJ;EAEA,MAAM,WAAW,QAAQ;GACvB,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,OAAO;IAC5B,IAAI,OAAO;IACX,MAAM,OAAO;IACb,kBAAkB,OAAO;GAC3B,CAAC;EACH;EAEA,MAAM,kBAAkB,QAAQ,WAAW;GACzC,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,IAAI,EAAE,kBAAkB,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,MAAM,CAAC;EACxF;EAEA,MAAM,cAAc,QAAQ;GAC1B,MAAM,GAAG,OAAO,YAAY,CAAC,CAAC,OAAO;IACnC,IAAI,OAAO;IACX,QAAQ,OAAO;IACf,SAAS,OAAO;IAChB,QAAQ,OAAO;IACf,YAAY,OAAO;GACrB,CAAC;EACH;EAEA,MAAM,eAAe,IAAI;GAEvB,MAAM,OAAM,MADO,GAAG,OAAO,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,MAAM,GAAG,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAA,CACvE;GACjB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAC9B,OAAO;IACL,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,SAAS,IAAI;IACb,QAAQ,IAAI;IACZ,YAAY,IAAI;GAClB;EACF;EAEA,MAAM,kBAAkB,QAAQ,YAAY;GAK1C,MAAM,OAAM,MAJO,GAChB,OAAO,CAAC,CACR,KAAK,YAAY,CAAC,CAClB,MAAM,GAAG,aAAa,QAAQ,MAAM,CAAC,EAAA,CACvB,MAAM,cAAc,UAAU,eAAe,UAAU;GACxE,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAC9B,OAAO;IACL,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,SAAS,IAAI;IACb,QAAQ,IAAI;IACZ,YAAY,IAAI;GAClB;EACF;EAEA,MAAM,oBAAoB,QAAQ;GAKhC,QAAO,MAJY,GAChB,OAAO,EAAE,QAAQ,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC,CAC7C,KAAK,YAAY,CAAC,CAClB,MAAM,GAAG,aAAa,QAAQ,MAAM,CAAC,EAAA,CAC5B,EAAE,EAAE,UAAU;EAC5B;EAEA,MAAM,iBAAiB,QAAQ;GAC7B,MAAM,GAAG,OAAO,WAAW,CAAC,CAAC,OAAO;IAClC,IAAI,OAAO;IACX,QAAQ,OAAO;IACf,eAAe,OAAO;IACtB,MAAM,OAAO;IACb,aAAa,IAAI,KAAK,OAAO,WAAW;GAC1C,CAAC;EACH;EAEA,MAAM,kBAAkB;GAEtB,QAAO,MADY,GAAG,OAAO,CAAC,CAAC,KAAK,WAAW,EAAA,CACnC,IAAI,kBAAkB;EACpC;EAEA,MAAM,sBAAsB,QAAQ;GAMlC,QAAO,MALY,GAChB,OAAO,CAAC,CACR,KAAK,WAAW,CAAC,CACjB,MAAM,GAAG,YAAY,QAAQ,MAAM,CAAC,CAAC,CACrC,QAAQ,KAAK,YAAY,WAAW,GAAG,KAAK,YAAY,EAAE,CAAC,EAAA,CAClD,IAAI,kBAAkB;EACpC;EAEA,MAAM,mBAAmB,QAAQ;GAM/B,QAAO,MALY,GAChB,OAAO,CAAC,CACR,KAAK,YAAY,CAAC,CAClB,MAAM,GAAG,aAAa,QAAQ,MAAM,CAAC,CAAC,CACtC,QAAQ,KAAK,aAAa,OAAO,CAAC,EAAA,CACzB,KAAK,SAAS;IACxB,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,SAAS,IAAI;IACb,QAAQ,IAAI;IACZ,YAAY,IAAI;GAClB,EAAE;EACJ;EAEA,MAAM,YAAY,QAAQ;GACxB,MAAM,GACH,OAAO,MAAM,CAAC,CACd,OAAO;IACN,IAAI,OAAO;IACX,QAAQ,OAAO;IACf,eAAe,OAAO;IACtB,MAAM,OAAO;IACb,WAAW,IAAI,KAAK,OAAO,SAAS;GACtC,CAAC,CAAC,CACD,mBAAmB;IAClB,QAAQ,CAAC,OAAO,QAAQ,OAAO,EAAE;IACjC,KAAK;KACH,eAAe,OAAO;KACtB,MAAM,OAAO;KACb,WAAW,IAAI,KAAK,OAAO,SAAS;IACtC;GACF,CAAC;EACL;EAEA,MAAM,SAAS,QAAQ,SAAS;GAM9B,MAAM,OAAM,MALO,GAChB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,IAAI,GAAG,OAAO,QAAQ,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,CAC7D,MAAM,CAAC,EAAA,CACO;GACjB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAC9B,OAAO;IACL,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,eAAe,IAAI;IACnB,MAAM,IAAI;IACV,WAAW,IAAI,UAAU,YAAY;GACvC;EACF;EAEA,MAAM,WAAW,QAAQ;GACvB,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,OAAO;IAC5B,IAAI,OAAO;IACX,OAAO,OAAO;IACd,cAAc,OAAO;IACrB,MAAM,OAAO;IACb,WAAW,IAAI,KAAK,OAAO,SAAS;GACtC,CAAC;EACH;EAEA,MAAM,eAAe,OAAO;GAE1B,MAAM,OAAM,MADO,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAA,CAC/D;GACjB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAC9B,OAAO;IACL,IAAI,IAAI;IACR,OAAO,IAAI;IACX,cAAc,IAAI;IAClB,MAAM,IAAI;IACV,WAAW,IAAI,UAAU,YAAY;GACvC;EACF;EAEA,MAAM,aAAa,QAAQ;GACzB,MAAM,GAAG,OAAO,OAAO,CAAC,CAAC,OAAO;IAC9B,IAAI,OAAO;IACX,MAAM,OAAO;IACb,QAAQ,OAAO;IACf,YAAY,OAAO;IACnB,MAAM,OAAO;IACb,WAAW,IAAI,KAAK,OAAO,SAAS;IACpC,WAAW,OAAO,cAAc,OAAO,OAAO,IAAI,KAAK,OAAO,SAAS;GACzE,CAAC;EACH;EAEA,MAAM,cAAc;GAElB,QAAO,MADY,GAAG,OAAO,CAAC,CAAC,KAAK,OAAO,EAAA,CAC/B,IAAI,cAAc;EAChC;EAEA,MAAM,oBAAoB,QAAQ;GAEhC,QAAO,MADY,GAAG,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,MAAM,GAAG,QAAQ,QAAQ,MAAM,CAAC,EAAA,CACjE,IAAI,cAAc;EAChC;EAEA,MAAM,aAAa,IAAI,OAAO;GAC5B,MAAM,GAAG,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,QAAQ,IAAI,EAAE,CAAC;EACvF;CACF;AACF;AAEA,SAAS,eAAe,KAQrB;CACD,OAAO;EACL,IAAI,IAAI;EACR,MAAM,IAAI;EACV,QAAQ,IAAI;EACZ,YAAY,IAAI;EAChB,MAAM,IAAI;EACV,WAAW,IAAI,UAAU,YAAY;EACrC,WAAW,IAAI,cAAc,OAAO,OAAO,IAAI,UAAU,YAAY;CACvE;AACF;AAEA,SAAS,mBAAmB,KAMzB;CACD,OAAO;EACL,IAAI,IAAI;EACR,QAAQ,IAAI;EACZ,eAAe,IAAI;EACnB,MAAM,IAAI;EACV,aAAa,IAAI,YAAY,YAAY;CAC3C;AACF"}