@haverstack/core 0.41.0 → 0.43.0

package/dist/scoped-stack/scoped-stack.d.ts

@@ -0,0 +1,318 @@
+/**
+ * ScopedStack — the permission-enforcing view
+ * -------------------------------------------------------
+ * A `Stack` answers every question; a `ScopedStack` answers only the ones a
+ * particular requester is entitled to. It wraps a Stack rather than an
+ * adapter, so every invariant the Stack layer holds is already in force by
+ * the time a check here runs, and the gates below only ever narrow.
+ *
+ * Two identities, one rule: **the principal governs authority, the subject
+ * governs attribution.** Both are DIDs and both are often equal, which is
+ * what makes them easy to confuse — so the split is stated on every gate
+ * that depends on it. Grant lookup and the privilege-bearing gates no grant
+ * reaches (resharing, group management, purge, widening access at create
+ * time) key on the principal; authorship, `-own` matching, record-level
+ * permissions and "files I uploaded" key on the subject. Unconditional
+ * owner access splits the same way: an owner subject passes every
+ * permission check, an owner principal is not bounded by grants, and under
+ * delegation both halves apply. The questions those gates ask are
+ * ScopeAuthority's, in authority.ts; this module turns their answers into
+ * refusals.
+ *
+ * Also holds the feed side of the same rule: a subscription's deliveries
+ * ask the same read reach a get() does, so a feed can never disagree with
+ * a read about what a session sees.
+ *
+ * See docs/spec/access-control.md and docs/spec/events.md § Permission scoping.
+ */
+import { ChangeEmitter } from '../stack/changes.js';
+import type { PutAttachmentOptions, AssociationEdit, AttachmentContent, AuthorityAssociation, DataAssociation, EntityId, FileId, QueryResult, Reach, RecordChange, RecordId, RecordVersion, RecordJournalEntry, JournalQuery, VersionsQuery, StackAdapter, StackCapabilities, IfVersionOptions, StackQuery, StackRecord, SubscribeOptions, TypeId, Unsubscribe } from '../types/index.js';
+import type { SplitQuery } from '../query-validation.js';
+import type { ExpectationOptions } from '../stack/write-expectation.js';
+import type { ContentOf, ReadonlyTypeSchema, TypeHandle } from '../type-handle.js';
+import type { Collection } from '../collection.js';
+import type { MigrationRegistry } from '../stack/migrations.js';
+import type { Stack } from '../stack/stack.js';
+import type { BackdatableCreateRecordOptions, CollectAttachmentGarbageOptions, CollectAttachmentGarbageResult, DeleteRecordOptions, DeleteResult, GetRecordOptions, StackClient } from '../stack/client.js';
+/**
+ * Held by Stack alone: the index re-exports ScopedStack but not this, so
+ * asEntity()/asActor() stay the only way to one, and the actor
+ * normalization and open-check they run can't be skipped.
+ */
+export declare const scopeToken: unique symbol;
+/** Everything a ScopedStack borrows from the Stack that scoped it. */
+export type ScopedStackInit = {
+    stack: Stack;
+    principalId: EntityId | null;
+    subjectId: EntityId | null;
+    idTimestampSkewMs: number | null;
+    /**
+     * Bytes-storage primitive for putAttachment(), which composes bytes with
+     * its own create() so the record carries the subject and principal as
+     * `createdBy` — neither of which the adapter-level atomic capability takes.
+     */
+    adapter: StackAdapter;
+    /** The stack's own unfiltered stream, which subscribe() narrows. */
+    changes: ChangeEmitter;
+    assertOpen: () => void;
+    /** The app's migrations, which collection() migrates records through. */
+    migrations: MigrationRegistry;
+    /** Stack.query() within a reach over type families — see query(). */
+    queryReadable: (split: SplitQuery, reach: Reach) => Promise<QueryResult>;
+};
+/**
+ * A permission-enforcing view of a Stack for one (principal, subject) pair,
+ * obtained via `stack.asEntity()` or `stack.asActor()`. A record the request
+ * cannot read answers exactly as a missing one does.
+ * See docs/spec/disclosure.md § Which refusal a Record answers with.
+ */
+export declare class ScopedStack implements StackClient {
+    #private;
+    private readonly stack;
+    private readonly idTimestampSkewMs;
+    private readonly adapter;
+    private readonly changes;
+    private readonly assertStackOpen;
+    private readonly migrations;
+    private readonly queryReadable;
+    /** Not callable from outside the package — see ScopedStackInit. */
+    constructor(token: typeof scopeToken, init: ScopedStackInit);
+    collection<S extends ReadonlyTypeSchema>(handle: TypeHandle<S>): Collection<ContentOf<S>>;
+    /**
+     * The identity whose authority this view acts with; `null` when
+     * anonymous. See docs/spec/access-control.md § Delegation: principal and subject.
+     */
+    get principalId(): EntityId | null;
+    /**
+     * The identity this view acts for and attributes writes to; `null` when
+     * anonymous. Equal to `principalId` unless an app is acting for a user.
+     */
+    get subjectId(): EntityId | null;
+    get capabilities(): StackCapabilities;
+    private get actor();
+    /** Refuse a create outside this request's reach — see ScopeAuthority.canCreate(). */
+    private requireCreateGrant;
+    /** Refuse anything but the owner acting as itself — see ScopeAuthority.ownerActingAlone. */
+    private requireOwnerActingAlone;
+    /**
+     * Fetch a record the subject can reach and the principal holds `update` on
+     * (via permissions or an update grant), or throw. `mutating: false` marks
+     * the history readers, which borrow this gate without changing anything —
+     * the one way through it a `_grant` Record stays open to.
+     */
+    private requireUpdatable;
+    /**
+     * The write gate both requireUpdatable() and requireDeletable() are: the
+     * subject can reach the record (record-level permission or a grant) and
+     * the principal holds the same verb, intersected — or, for a `_group`, the
+     * stricter management rule that no grant reaches.
+     * See docs/spec/access-control.md § Delegation: principal and subject.
+     */
+    private requireVerb;
+    /** requireVerb()'s gate, asked of a record already found in its family. */
+    private gateVerb;
+    /**
+     * Fetch a record the subject can reach and the principal holds `delete` on
+     * (via permissions or a delete grant), or throw.
+     */
+    private requireDeletable;
+    /**
+     * Gates file-ref content fields on file access, mirroring the
+     * attachment-association gate — a file-ref field conveys attachment
+     * access exactly like an `attachment` association. Only fields present
+     * in `content` are checked (a content patch is a merge patch; untouched fields
+     * carry no new reference).
+     */
+    private requireFileRefAccess;
+    /**
+     * Reference-creation gate for one association: file access for an
+     * `attachment`, read access for a `relationship` to a record in this
+     * stack. Other targets convey nothing, and a `_group` roster has the
+     * stricter management gate. See docs/spec/access-control.md
+     * § Reference-creation gating.
+     */
+    private requireAssociationAccess;
+    /**
+     * Create a record on behalf of the subject, stamped with the requester as
+     * `createdBy`. Every option that could widen reach or forge a position is
+     * refused rather than dropped, so an app never believes it published
+     * something it didn't. See docs/spec/data-model.md § Backdating on import.
+     */
+    create<T extends Record<string, unknown> = Record<string, unknown>>(typeId: TypeId, content: T, opts?: BackdatableCreateRecordOptions): Promise<StackRecord & {
+        content: T;
+    }>;
+    /**
+     * A record this request may read, or null. Never throws
+     * StackPermissionError: an unreadable record answers exactly as a missing
+     * one does, so a caller learns only what it may read.
+     * See docs/spec/disclosure.md § Which refusal a Record answers with.
+     */
+    get(id: RecordId, opts?: GetRecordOptions): Promise<StackRecord | null>;
+    /**
+     * Runs through this.query(), so the read reach still applies — this
+     * answers a question the caller asks on its own behalf. includeUnlisted
+     * is passed only when the request is the owner acting alone, per
+     * docs/spec/identity.md § DID bindings.
+     */
+    getEntityByDid(did: EntityId): Promise<StackRecord | null>;
+    getOwnerEntity(): Promise<StackRecord | null>;
+    /**
+     * Query records, among those this request can read: the adapter matches
+     * the request's read reach as one more condition of the query, so a page,
+     * its cursor and whether one comes back are decided among readable
+     * Records alone. See docs/spec/disclosure.md § What a query reveals.
+     */
+    query(query?: StackQuery): Promise<QueryResult>;
+    /**
+     * Patch content on behalf of the subject, on the write gate, plus the
+     * gates a content value can carry: a card's binding fields and the files
+     * a `file-ref` field names. See docs/spec/access-control.md § Per-verb gates.
+     */
+    patchContent(id: RecordId, patch: Record<string, unknown | null>, opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
+    /**
+     * The write gate, plus read access to the destination: a container is a
+     * reference the requester has to be allowed to create.
+     */
+    setParent(id: RecordId, parentId: RecordId | null, opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
+    /**
+     * Listing decides who can enumerate a record, so it carries the reshare
+     * gate rather than the write bit. See docs/spec/unlisted.md.
+     */
+    setUnlisted(id: RecordId, unlisted: boolean, opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
+    /**
+     * The write gate, plus the reference gate on each add new to the record:
+     * a remove, or an add of an identity already held, names a reference the
+     * record carries, so it is gated by the write bit alone.
+     */
+    editAssociations(id: RecordId, edits: AssociationEdit[], opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
+    /** editAssociations()'s gates, with every element new to the set an add. */
+    setAssociations(id: RecordId, associations: DataAssociation[], opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
+    /**
+     * The write gate, then the reference gate over the elements a write adds,
+     * asked against the stored set so an association the record already
+     * carries is not re-gated. `Stack` asks it of each read it writes from,
+     * so a retried write is gated on the set it lands on.
+     */
+    private gateAssociationWrite;
+    /**
+     * Extend or withdraw who reaches a record, on the reshare gate. The write
+     * bit does not confer it, or a write-holder could decide who else reaches
+     * the record. See docs/spec/access-control.md § Record-level permissions.
+     */
+    editAccess(id: RecordId, edits: AssociationEdit[], opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
+    /** See editAccess() — the same gate. */
+    setAccess(id: RecordId, permissions: AuthorityAssociation[], opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
+    /**
+     * The record, having established that this request may decide who else
+     * reaches it — the owner-or-creator rule, asked of both sides of a
+     * delegation, or a Group's admin rule for a `_group`. The gate the access
+     * and listing verbs carry, which the write bit deliberately does not confer.
+     */
+    private requireReshareable;
+    /** requireReshareable()'s gate, asked of a record already found in its family. */
+    private gateReshare;
+    /**
+     * Refuse a write moving content its family reserves to the owner acting
+     * alone — an `_app` card's bindings, the owner's own DID on an `_entity`
+     * — whichever verb carries it. See docs/spec/identity.md § DID bindings.
+     */
+    private requireOwnerFields;
+    /**
+     * A delegated write's `appId` must match the `_app` card the owner
+     * registered for the principal's DID, if there is one: a verified
+     * principal may not claim a name the owner gave other software.
+     * See docs/spec/identity.md § Attribution and what can be trusted.
+     */
+    private requireAppIdMatchesPrincipal;
+    /**
+     * Refuse anyone but the owner acting alone a write to a family only the
+     * owner writes — `_grant` and `_install`, which are authority — with the
+     * refusal an unreadable Record answers with. Any other family passes.
+     * See docs/spec/access-control.md § What a grant covers.
+     */
+    private requireOwnerAloneWriter;
+    /**
+     * Purge is owner-only: it is irreversible and destroys version
+     * history, so neither the write bit nor delete-own/delete-any grants
+     * reach it, and delegation doesn't carry it either. Everyone else is
+     * limited to soft delete.
+     */
+    delete(id: RecordId, opts?: DeleteRecordOptions & ExpectationOptions): Promise<DeleteResult>;
+    /**
+     * Reverse a soft delete. Gated the same as delete() — undelete is the
+     * inverse of soft delete, so granting one direction without the other
+     * would be backwards. Idempotent, per Stack.undelete().
+     */
+    undelete(id: RecordId, opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
+    /**
+     * History is the mutation/recovery surface, not a read surface — gated
+     * like patchContent(). Reading it changes nothing, so it is the one path
+     * the `_grant` write fence leaves alone: seeing how a Record you can
+     * already read got that way is not the escalation that fence exists to
+     * stop. See docs/spec/versioning.md § History access.
+     */
+    getVersions(id: RecordId, query?: VersionsQuery): Promise<RecordVersion[]>;
+    /**
+     * See getVersions() — the same gate. A requester who may not reshare the
+     * record is served each `reshare` op without the elements beneath it.
+     * See docs/spec/journal.md § Reading it.
+     */
+    getJournal(id: RecordId, query?: JournalQuery): Promise<RecordJournalEntry[]>;
+    /** See getVersions() — the same mutate-surface gate. */
+    getVersion(id: RecordId, version: number): Promise<RecordVersion | null>;
+    /**
+     * Re-runs the reference-creation checks against the snapshot, so a
+     * restore can't re-convey access to a file the subject can no longer
+     * reach today. Only the owner acting alone is exempt: under delegation
+     * the checks resolve against the subject, which is whose reach the
+     * restore would widen. See docs/spec/versioning.md § Restore semantics.
+     */
+    restoreVersion(id: RecordId, version: number, opts?: IfVersionOptions & ExpectationOptions): Promise<StackRecord>;
+    /**
+     * Commit a per-record migration: the owner acting alone, or an installed
+     * app within its own families (requireInstallMigration()). Ordinary write
+     * access is not consent to move a record between families.
+     * See docs/spec/access-control.md § What a grant covers.
+     */
+    commitMigration(id: RecordId, toTypeId: TypeId, content: Record<string, unknown>, opts?: IfVersionOptions): Promise<StackRecord>;
+    /**
+     * Refuse a migration this request may not commit as an installed app —
+     * see ScopeAuthority.installMayMigrate(). The tombstone refusal comes
+     * only once authority is settled, as every mutating verb asks it: the
+     * owner may migrate a tombstone; an app sees it without content.
+     * See docs/spec/apps.md § Migrating an installed app's types.
+     */
+    private requireInstallMigration;
+    /**
+     * Store bytes and create an _attachment@1 metadata record (create grant
+     * on `_attachment@1` required; anonymous denied), returning that record.
+     * Authorship and principal are stamped exactly as create() does.
+     */
+    putAttachment(data: Uint8Array, opts: PutAttachmentOptions): Promise<StackRecord & {
+        content: AttachmentContent;
+    }>;
+    /**
+     * Download attachment bytes. Accessible to the owner, a reader of any
+     * referencing record, or the uploader pre-association — the same
+     * predicate as the reference-creation gate (canAccessFile).
+     */
+    getAttachment(fileId: FileId): Promise<Uint8Array>;
+    /**
+     * Delete an attachment. Only the stack owner may delete attachments.
+     * Delegates to Stack.deleteAttachment(), which enforces the "not referenced" check.
+     */
+    deleteAttachment(fileId: FileId): Promise<void>;
+    /**
+     * Sweep for unreferenced attachment bytes and delete them. Only the stack
+     * owner may run this. Delegates to Stack.collectAttachmentGarbage().
+     */
+    collectAttachmentGarbage(opts?: CollectAttachmentGarbageOptions): Promise<CollectAttachmentGarbageResult>;
+    /**
+     * Observe the changes this request may read, decided per event by the
+     * same read reach that get() and query() ask. An unreadable record yields
+     * no event at all, since a change's existence is itself a disclosure.
+     * See docs/spec/events.md § Permission scoping.
+     */
+    subscribe(handler: (change: RecordChange) => void, opts?: SubscribeOptions): Promise<Unsubscribe>;
+}
+//# sourceMappingURL=scoped-stack.d.ts.map

package/dist/scoped-stack/scoped-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-stack.d.ts","sourceRoot":"","sources":["../../src/scoped-stack/scoped-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAE,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AAEvE,OAAO,KAAK,EAIV,oBAAoB,EAEpB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,MAAM,EACN,WAAW,EACX,KAAK,EACL,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAe3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAMxE,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAUhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAK/C,OAAO,KAAK,EACV,8BAA8B,EAC9B,+BAA+B,EAC/B,8BAA8B,EAC9B,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,OAAO,MAA8B,CAAC;AAE/D,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,OAAO,EAAE,YAAY,CAAC;IACtB,oEAAoE;IACpE,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,yEAAyE;IACzE,UAAU,EAAE,iBAAiB,CAAC;IAC9B,qEAAqE;IACrE,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1E,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,WAAY,YAAW,WAAW;;IAE7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmC;IAEjE,mEAAmE;gBACvD,KAAK,EAAE,OAAO,UAAU,EAAE,IAAI,EAAE,eAAe;IAmB3D,UAAU,CAAC,CAAC,SAAS,kBAAkB,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAKzF;;;OAGG;IACH,IAAI,WAAW,IAAI,QAAQ,GAAG,IAAI,CAEjC;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,QAAQ,GAAG,IAAI,CAE/B;IAED,IAAI,YAAY,IAAI,iBAAiB,CAEpC;IAED,OAAO,KAAK,KAAK,GAKhB;IAED,qFAAqF;YACvE,kBAAkB;IAMhC,4FAA4F;IAC5F,OAAO,CAAC,uBAAuB;IAI/B;;;;;OAKG;YACW,gBAAgB;IAe9B;;;;;;OAMG;YACW,WAAW;IAezB,2EAA2E;YAC7D,QAAQ;IAgCtB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAUxB;;;;;;OAMG;YACW,oBAAoB;IAgBlC;;;;;;OAMG;YACW,wBAAwB;IA0BtC;;;;;OAKG;IACG,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,EACV,IAAI,GAAE,8BAAmC,GACxC,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,CAAC,CAAA;KAAE,CAAC;IAyExC;;;;;OAKG;IACG,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAOjF;;;;;OAKG;IACG,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAS1D,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAInD;;;;;OAKG;IACG,KAAK,CAAC,KAAK,GAAE,UAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAczD;;;;OAIG;IACG,YAAY,CAChB,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,EACrC,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IA4BvB;;;OAGG;IACG,SAAS,CACb,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,QAAQ,GAAG,IAAI,EACzB,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAgBvB;;;OAGG;IACG,WAAW,CACf,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,OAAO,EACjB,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;OAIG;IACG,gBAAgB,CACpB,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,eAAe,EAAE,EACxB,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAUvB,4EAA4E;IACtE,eAAe,CACnB,EAAE,EAAE,QAAQ,EACZ,YAAY,EAAE,eAAe,EAAE,EAC/B,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAUvB;;;;;OAKG;YACW,oBAAoB;IAYlC;;;;OAIG;IACG,UAAU,CACd,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,eAAe,EAAE,EACxB,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAUvB,wCAAwC;IAClC,SAAS,CACb,EAAE,EAAE,QAAQ,EACZ,WAAW,EAAE,oBAAoB,EAAE,EACnC,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAUvB;;;;;OAKG;YACW,kBAAkB;IAYhC,kFAAkF;YACpE,WAAW;IAWzB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;;;;OAKG;YACW,4BAA4B;IAW1C;;;;;OAKG;YACW,uBAAuB;IAarC;;;;;OAKG;IACG,MAAM,CACV,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE,mBAAmB,GAAG,kBAAuB,GAClD,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;OAIG;IACG,QAAQ,CACZ,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAKvB;;;;;;OAMG;IACG,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,aAAkB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAKpF;;;;OAIG;IACG,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,YAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAMvF,wDAAwD;IAClD,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAK9E;;;;;;OAMG;IACG,cAAc,CAClB,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,gBAAgB,GAAG,kBAAuB,GAC/C,OAAO,CAAC,WAAW,CAAC;IAuBvB;;;;;OAKG;IACG,eAAe,CACnB,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;IAavB;;;;;;OAMG;YACW,uBAAuB;IAmBrC;;;;OAIG;IACG,aAAa,CACjB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,WAAW,GAAG;QAAE,OAAO,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAqBxD;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IASxD;;;OAGG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD;;;OAGG;IACG,wBAAwB,CAC5B,IAAI,CAAC,EAAE,+BAA+B,GACrC,OAAO,CAAC,8BAA8B,CAAC;IAK1C;;;;;OAKG;IACG,SAAS,CACb,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,EACvC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC;CAkBxB"}