@haverstack/core 0.40.0 → 0.42.0

package/dist/scoped-stack/authority.js

@@ -0,0 +1,384 @@
+/**
+ * Scope authority
+ * -------------------------------------------------------
+ * What one (principal, subject) pair may do, as questions with yes-or-no
+ * answers: may this request read the record, create this type, reshare,
+ * reach this file. ScopedStack turns the answers into refusals and
+ * forwards what passes to its Stack; nothing here throws a refusal or
+ * writes. See docs/spec/access-control.md § Delegation: principal and
+ * subject.
+ */
+import { checkAccess, groupRoleFromAssociations, isGroupRecord, isOwnerActingAlone, } from '../access.js';
+import { StackError, StackNotFoundError, StackPermissionError } from '../errors.js';
+import { UNGRANTABLE_SYSTEM_TYPES, grantConveys, grantCoversGrantee, grantReach, } from '../grants.js';
+import { filtersContent } from '../query-validation.js';
+import { baseIdOf, fileRefFields } from '../schema.js';
+import { claimedFamilies, familyStanding, INSTALL_APP_LABEL, linkedIds } from '../install.js';
+import { findFirstMatch, loadGrantRecords, loadInstallRecords, queryAllPages, } from '../stack/reads.js';
+import { SYSTEM_TYPES } from '../types/index.js';
+export class ScopeAuthority {
+    stack;
+    principalId;
+    subjectId;
+    constructor(stack, 
+    /** Whose grants bound what this request may do — see ScopedStack.principalId. */
+    principalId, 
+    /** Whom this request acts for and attributes writes to — see ScopedStack.subjectId. */
+    subjectId) {
+        this.stack = stack;
+        this.principalId = principalId;
+        this.subjectId = subjectId;
+    }
+    resolveRecord = (id) => this.stack.get(id, { includeDeleted: true });
+    /** Every `_grant` Record — see loadGrantRecords(). */
+    loadGrants = () => loadGrantRecords((q) => this.stack.query(q));
+    /** Whether a delegated app is acting for someone other than itself. */
+    get delegated() {
+        return this.subjectId !== this.principalId;
+    }
+    /**
+     * Whether any grant could name this request — the one question every
+     * prefetch asks before scanning the `_grant` family, since an anonymous
+     * requester is reached by none. Both identities are read: `asEntity()`
+     * refuses an anonymous principal acting for a subject, so they are null
+     * together, and saying so costs nothing.
+     */
+    get identified() {
+        return this.principalId !== null || this.subjectId !== null;
+    }
+    /**
+     * Who this request is, for stamping onto whatever it mutates. Attribution
+     * follows record-level authorship: the subject is the actor, and the
+     * principal is named beside it only when the two differ.
+     * See docs/spec/data-model.md § Authorship and attribution.
+     */
+    get requester() {
+        if (this.subjectId === null)
+            return undefined;
+        return this.delegated && this.principalId !== null
+            ? { subjectId: this.subjectId, principalId: this.principalId }
+            : { subjectId: this.subjectId };
+    }
+    /**
+     * Whether unconditional owner authority applies — the owner acting as
+     * itself. The verbs resting on it are irreversible or disclose the sharing
+     * graph, so delegation never carries it, whichever side the owner is on.
+     * See docs/spec/access-control.md § Delegation: principal and subject.
+     */
+    get ownerActingAlone() {
+        return isOwnerActingAlone({ principalId: this.principalId, subjectId: this.subjectId }, this.stack.ownerEntityId);
+    }
+    /** Whether the record's own permissions let the subject `mode` it. */
+    recordPermits(record, mode) {
+        return checkAccess(record, this.subjectId, this.stack.ownerEntityId, mode, this.resolveRecord);
+    }
+    /**
+     * Whether `grantee` holds a _grant covering one of `actions` on the type's
+     * family. The flags are fixed per side of a delegation and mean nothing
+     * alone, so this is reached only through subjectAllows() and
+     * principalHolds(). See docs/spec/access-control.md § Who a grant reaches.
+     */
+    async hasGrant(typeId, actions, opts) {
+        const { grantee, record, prefetchedGrants, matchOwn = true, allowDefault = true, allowGroup = true, } = opts;
+        if (!grantee)
+            return false;
+        // Absent when the caller has no operation-scoped map to share — one
+        // call's worth of memoization, which is still every grant record in
+        // this loop naming the same group.
+        const groupRoles = opts.groupRoles ?? new Map();
+        const familyId = baseIdOf(typeId);
+        // grantType() refuses to write these, but a _grant record is an ordinary
+        // Record: an unscoped Stack, an import, or a server mapping a request
+        // body onto Stack can mint one anyway. Refusing at the point of use is
+        // what makes the rule hold regardless of how the record got there.
+        if (UNGRANTABLE_SYSTEM_TYPES.has(familyId))
+            return false;
+        let grantRecords;
+        if (prefetchedGrants !== undefined) {
+            grantRecords = prefetchedGrants;
+        }
+        else {
+            // Cursor-walked to see grants past page one. A stored baseId is
+            // judged by grantReach(), which refuses a versioned one.
+            grantRecords = await this.loadGrants();
+        }
+        for (const r of grantRecords) {
+            const c = r.content;
+            const reach = grantReach(c);
+            if (!reach || reach.familyId !== familyId)
+                continue;
+            const covers = await grantCoversGrantee(c, grantee, {
+                allowDefault,
+                allowGroup,
+                groupRoles,
+                resolveRecord: this.resolveRecord,
+            });
+            if (!covers)
+                continue;
+            const matches = actions.some((action) => {
+                if (!grantConveys(reach.actions, action))
+                    return false;
+                if (matchOwn && action.endsWith('-own'))
+                    return record?.createdBy?.subjectId === grantee;
+                return true;
+            });
+            if (matches)
+                return true;
+        }
+        return false;
+    }
+    /**
+     * The principal half of a delegated request's authority, which bounds
+     * what the subject's reaches so neither lends its reach to the other.
+     * Vacuously true without delegation. Default and group grants do not
+     * count — see docs/spec/access-control.md § Who a grant reaches.
+     */
+    principalAllows(typeId, actions, prefetchedGrants) {
+        if (!this.delegated)
+            return Promise.resolve(true);
+        if (this.principalId === this.stack.ownerEntityId)
+            return Promise.resolve(true);
+        return this.principalHolds(typeId, actions, prefetchedGrants);
+    }
+    /**
+     * principalAllows() without its shortcuts: whether the principal itself
+     * holds a grant naming it for these verbs, read the principal-side way.
+     * Also what an installed app's own migration authority rests on — see
+     * installMayMigrate().
+     */
+    principalHolds(typeId, actions, prefetchedGrants) {
+        return this.hasGrant(typeId, actions, {
+            grantee: this.principalId,
+            prefetchedGrants,
+            matchOwn: false,
+            allowDefault: false,
+            allowGroup: false,
+        });
+    }
+    /**
+     * The subject half: which records are reachable, with `-own` matching and
+     * default grants in force — the ordinary reading of a grant, since the
+     * subject is the entity a grant is written about.
+     */
+    subjectAllows(typeId, actions, opts = {}) {
+        return this.hasGrant(typeId, actions, {
+            grantee: this.subjectId,
+            record: opts.record,
+            prefetchedGrants: opts.prefetchedGrants,
+            groupRoles: opts.groupRoles,
+        });
+    }
+    /**
+     * How to refuse a record this request addressed by ID: a permission error
+     * to a requester who can read it, the not-found answer to anyone else, so
+     * `message` only reaches someone holding the record already.
+     * See docs/spec/disclosure.md § Which refusal a Record answers with.
+     */
+    async denialFor(record, message) {
+        // Prefetched here rather than threaded down from the gate: a write
+        // carried by a record-level permission settles without reading a grant
+        // at all, and that path must not pay for this one. Both halves of
+        // canRead share the one scan.
+        const grants = this.identified ? await this.loadGrants() : undefined;
+        if (await this.canRead(record, grants))
+            return new StackPermissionError(message);
+        return new StackNotFoundError(`Record not found: "${record.id}"`);
+    }
+    async canRead(record, prefetchedGrants, groupRoles) {
+        const reachable = (await this.recordPermits(record, 'read')) ||
+            (await this.subjectAllows(record.typeId, ['read-own', 'read-any'], {
+                record,
+                prefetchedGrants,
+                groupRoles,
+            }));
+        if (!reachable)
+            return false;
+        return this.principalAllows(record.typeId, ['read-own', 'read-any'], prefetchedGrants);
+    }
+    async checkCreateGrant(typeId) {
+        if (this.ownerActingAlone)
+            return true;
+        const reachable = this.subjectId === this.stack.ownerEntityId || (await this.subjectAllows(typeId, ['create']));
+        if (!reachable)
+            return false;
+        return this.principalAllows(typeId, ['create']);
+    }
+    /**
+     * `_group` records are managed, not merely written: only the owner or an
+     * `admin` roster holder may mutate them — ordinary write permissions and
+     * grants don't apply. Asked of both identities under delegation, like
+     * a reshare. See docs/spec/identity.md § Group.
+     */
+    isGroupManager(record) {
+        if (!this.managesGroup(this.principalId, record))
+            return false;
+        return !this.delegated || this.managesGroup(this.subjectId, record);
+    }
+    /** Whether one identity, on its own, manages `record` — see isGroupManager(). */
+    managesGroup(entityId, record) {
+        if (!entityId)
+            return false;
+        if (entityId === this.stack.ownerEntityId)
+            return true;
+        return groupRoleFromAssociations(record.associations, entityId) === 'admin';
+    }
+    /**
+     * Whether this request may reference `recordId` as a parent or target.
+     * Missing and unreadable are both false, so this probes nothing. The
+     * owner acting alone skips the lookup and leaves absence to `Stack`.
+     * See docs/spec/access-control.md § Reference-creation gating.
+     */
+    async canReadReferent(recordId) {
+        if (this.ownerActingAlone)
+            return true;
+        const record = await this.stack.get(recordId, { includeDeleted: true });
+        if (!record)
+            return false;
+        return this.canRead(record);
+    }
+    /**
+     * Whether this request can read some record referencing `fileId`, other
+     * than an `_attachment@1` record — otherwise one correct guess would
+     * unlock unlimited further metadata records for the file.
+     * See docs/spec/attachments.md § Creating `_attachment@1` records directly.
+     */
+    async hasReadableReference(fileId) {
+        const prefetchedGrants = this.identified ? await this.loadGrants() : undefined;
+        const groupRoles = new Map();
+        const match = await findFirstMatch((q) => this.stack.query(q), 
+        // Reach, not enumeration: a record readable by ID conveys the file it
+        // references. See docs/spec/unlisted.md.
+        { filter: { referencesFileId: fileId, includeUnlisted: true } }, (record) => baseIdOf(record.typeId) !== SYSTEM_TYPES.ATTACHMENT &&
+            this.canRead(record, prefetchedGrants, groupRoles));
+        return match !== undefined;
+    }
+    /**
+     * Whether this request may reference or download `fileId` — the dual of
+     * getAttachment()'s access rule. Nonexistent and inaccessible are
+     * indistinguishable (both false), so no confirmation oracle for guessed
+     * hashes. See docs/spec/access-control.md § Reference-creation gating.
+     */
+    async canAccessFile(fileId) {
+        if (this.ownerActingAlone)
+            return true;
+        // Reaching a file through a record this request can read is already
+        // fully intersected — canRead() applied the principal's mask against
+        // that record's own type, which is the type the reference lives on.
+        if (await this.hasReadableReference(fileId))
+            return true;
+        if (!this.subjectId)
+            return false;
+        // The remaining paths are authorship facts about the subject, so they
+        // decide *which* files match — they are not themselves a grant, and the
+        // principal still needs one of its own on the attachment type.
+        if (!(await this.principalAllows(`${SYSTEM_TYPES.ATTACHMENT}@1`, ['read-own', 'read-any']))) {
+            return false;
+        }
+        if (this.subjectId === this.stack.ownerEntityId)
+            return true;
+        // `includeUnlisted`, as hasReadableReference() above: withholding a
+        // record from enumeration decides nothing about what it conveys, and
+        // the uploader clause does not lapse. See docs/spec/unlisted.md.
+        return filtersContent(this.stack.capabilities)
+            ? (await this.stack.query({
+                filter: {
+                    typeId: `${SYSTEM_TYPES.ATTACHMENT}@1`,
+                    createdBy: { subjectId: this.subjectId },
+                    content: { fileId },
+                    includeUnlisted: true,
+                },
+                limit: 1,
+            })).records.length > 0
+            : (await queryAllPages((q) => this.stack.query(q), {
+                filter: {
+                    typeId: `${SYSTEM_TYPES.ATTACHMENT}@1`,
+                    createdBy: { subjectId: this.subjectId },
+                    includeUnlisted: true,
+                },
+            })).some((r) => r.content.fileId === fileId);
+    }
+    /**
+     * Whether this request is an installed app, acting as itself, migrating
+     * `record` within families its one live install claims, to a version the
+     * owner approved, holding `update-any` on each directly.
+     * See docs/spec/apps.md § Migrating an installed app's types.
+     */
+    async installMayMigrate(record, toTypeId) {
+        const principal = this.principalId;
+        if (!principal || this.delegated)
+            return false;
+        const families = new Set([baseIdOf(record.typeId), baseIdOf(toTypeId)]);
+        const installs = await loadInstallRecords(this.stack);
+        let install;
+        for (const family of families) {
+            const claimants = installs.filter((r) => claimedFamilies(r.content).has(family));
+            if (claimants.length !== 1)
+                return false;
+            if (familyStanding(family, claimants[0].content.appId) !== 'own')
+                return false;
+            if (install && install.id !== claimants[0].id)
+                return false;
+            install = claimants[0];
+        }
+        if (!install || install.deletedAt)
+            return false;
+        if (!Array.isArray(install.content.defines) || !install.content.defines.includes(toTypeId)) {
+            return false;
+        }
+        let linked = false;
+        for (const cardId of linkedIds(install, INSTALL_APP_LABEL)) {
+            const card = await this.stack.get(cardId);
+            if (card && baseIdOf(card.typeId) === SYSTEM_TYPES.APP) {
+                if (card.content.did === principal)
+                    linked = true;
+            }
+        }
+        if (!linked)
+            return false;
+        const grants = await this.loadGrants();
+        for (const family of families) {
+            if (!(await this.principalHolds(`${family}@1`, ['update-any'], grants)))
+                return false;
+        }
+        return true;
+    }
+    /** Names of the type's top-level file-ref fields — the content-reference half of referencesFileId matching. */
+    async fileRefFieldNames(typeId) {
+        const type = await this.stack.getType(typeId);
+        return type ? fileRefFields(type.schema) : [];
+    }
+    /**
+     * Whether this request may widen who reaches a record, at create time or
+     * after. A delegated app may not, unless the owner is its principal:
+     * widening access is what containment most needs to hold.
+     * See docs/spec/access-control.md § Delegation: principal and subject.
+     */
+    mayGrantAccess() {
+        return !this.delegated || this.principalId === this.stack.ownerEntityId;
+    }
+    /**
+     * Whether one identity, on its own, may decide who else reaches `record`
+     * — the owner-or-creator rule a reshare enforces, asked of one
+     * side at a time. See
+     * docs/spec/access-control.md § Delegation: principal and subject.
+     */
+    mayReshare(entityId, record) {
+        if (!entityId)
+            return false;
+        return entityId === this.stack.ownerEntityId || entityId === record.createdBy?.subjectId;
+    }
+    /**
+     * Whether this request may decide who else reaches `record`: management
+     * for a `_group`, so a demoted creator keeps no side door; otherwise the
+     * owner-or-author rule, asked of both sides of a delegation.
+     * See docs/spec/access-control.md § Record-level permissions.
+     */
+    canReshare(record) {
+        if (isGroupRecord(record))
+            return this.isGroupManager(record);
+        if (!this.mayReshare(this.principalId, record))
+            return false;
+        return !this.delegated || this.mayReshare(this.subjectId, record);
+    }
+}
+//# sourceMappingURL=authority.js.map

package/dist/scoped-stack/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../src/scoped-stack/authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,aAAa,EACb,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,kBAAkB,EAClB,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAejD,MAAM,OAAO,cAAc;IAEN;IAER;IAEA;IALX,YACmB,KAAY;IAC7B,iFAAiF;IACxE,WAA4B;IACrC,uFAAuF;IAC9E,SAA0B;QAJlB,UAAK,GAAL,KAAK,CAAO;QAEpB,gBAAW,GAAX,WAAW,CAAiB;QAE5B,cAAS,GAAT,SAAS,CAAiB;IAClC,CAAC;IAEa,aAAa,GAAG,CAAC,EAAU,EAA+B,EAAE,CAC3E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,sDAAsD;IAC7C,UAAU,GAAG,GAA2B,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjG,uEAAuE;IACvE,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACH,IAAI,SAAS;QACX,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAChD,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;YAC9D,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,kBAAkB,CACvB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC5D,IAAI,CAAC,KAAK,CAAC,aAAa,CACzB,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,aAAa,CAAC,MAAmB,EAAE,IAAgB;QACjD,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACjG,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,QAAQ,CACpB,MAAc,EACd,OAAsB,EACtB,IAQC;QAED,MAAM,EACJ,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,QAAQ,GAAG,IAAI,EACf,YAAY,GAAG,IAAI,EACnB,UAAU,GAAG,IAAI,GAClB,GAAG,IAAI,CAAC;QACT,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,oEAAoE;QACpE,oEAAoE;QACpE,mCAAmC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,GAAG,EAA4B,CAAC;QAE1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAElC,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAEzD,IAAI,YAA2B,CAAC;QAChC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,YAAY,GAAG,gBAAgB,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,gEAAgE;YAChE,yDAAyD;YACzD,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACzC,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAuB,CAAC;YACpC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YACpD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE;gBAClD,YAAY;gBACZ,UAAU;gBACV,UAAU;gBACV,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACtC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACvD,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,OAAO,MAAM,EAAE,SAAS,EAAE,SAAS,KAAK,OAAO,CAAC;gBACzF,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,IAAI,OAAO;gBAAE,OAAO,IAAI,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,eAAe,CACb,MAAc,EACd,OAAsB,EACtB,gBAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,cAAc,CACZ,MAAc,EACd,OAAsB,EACtB,gBAAgC;QAEhC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE;YACpC,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,gBAAgB;YAChB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;YACnB,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,aAAa,CACX,MAAc,EACd,OAAsB,EACtB,OAII,EAAE;QAEN,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE;YACpC,OAAO,EAAE,IAAI,CAAC,SAAS;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,MAAmB,EAAE,OAAe;QAClD,mEAAmE;QACnE,uEAAuE;QACvE,kEAAkE;QAClE,8BAA8B;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACjF,OAAO,IAAI,kBAAkB,CAAC,sBAAsB,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAmB,EACnB,gBAAgC,EAChC,UAA0C;QAE1C,MAAM,SAAS,GACb,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE;gBACjE,MAAM;gBACN,gBAAgB;gBAChB,UAAU;aACX,CAAC,CAAC,CAAC;QACN,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAmB;QAChC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,iFAAiF;IACzE,YAAY,CAAC,QAAyB,EAAE,MAAmB;QACjE,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QACvD,OAAO,yBAAyB,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,OAAO,CAAC;IAC9E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAc;QACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,MAAM,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;QAEvD,MAAM,KAAK,GAAG,MAAM,cAAc,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1B,sEAAsE;QACtE,yCAAyC;QACzC,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAC/D,CAAC,MAAM,EAAE,EAAE,CACT,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,UAAU;YACnD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CACrD,CAAC;QACF,OAAO,KAAK,KAAK,SAAS,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAEvC,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAElC,sEAAsE;QACtE,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,YAAY,CAAC,UAAU,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAE7D,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAC5C,CAAC,CAAC,CACE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACrB,MAAM,EAAE;oBACN,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,IAAI;oBACtC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACxC,OAAO,EAAE,EAAE,MAAM,EAAE;oBACnB,eAAe,EAAE,IAAI;iBACtB;gBACD,KAAK,EAAE,CAAC;aACT,CAAC,CACH,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACtB,CAAC,CAAC,CACE,MAAM,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC9C,MAAM,EAAE;oBACN,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,IAAI;oBACtC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;oBACxC,eAAe,EAAE,IAAI;iBACtB;aACF,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,OAA6B,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAmB,EAAE,QAAgB;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC;QACnC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,OAAgE,CAAC;QACrE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACjF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzC,IAAI,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YAChF,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAE,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC7D,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;gBACvD,IAAK,IAAI,CAAC,OAAsB,CAAC,GAAG,KAAK,SAAS;oBAAE,MAAM,GAAG,IAAI,CAAC;YACpE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+GAA+G;IAC/G,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,cAAc;QACZ,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,QAAyB,EAAE,MAAmB;QAC/D,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC;IAC3F,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,MAAmB;QAC5B,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}