@memberjunction/core 6.2.0-edge.5 → 6.2.0-edge.7

package/dist/generic/fieldSecuritySQLGate.d.ts

@@ -0,0 +1,359 @@
+import { SQLScreeningDialect } from '@memberjunction/global';
+import { EntityInfo, FieldSecurityError } from './entityInfo.js';
+import { UserInfo } from './securityInfo.js';
+/** Why {@link FieldSecuritySQLGate} refuses a piece of SQL. */
+export type FieldSecurityViolationKind = 'DeniedField' | 'WholeRow' | 'Unresolvable' | 'UnknownRelation';
+/** One reason {@link FieldSecuritySQLGate.FindViolation} refuses a piece of SQL. */
+export interface FieldSecurityViolation {
+    Kind: FieldSecurityViolationKind;
+    /**
+     * `DeniedField`: the reference as the database reads it (a quoted identifier's bare name; on
+     * PostgreSQL an unquoted name in lower case). `WholeRow`: the construct, such as `FOR JSON`.
+     * `Unresolvable`: why the text could not be read. `UnknownRelation`: the relation the catalog
+     * does not know.
+     */
+    Reference: string;
+    /** The entity whose denial the reference reaches; null when the text could not be read. */
+    Entity: EntityInfo | null;
+}
+/** What {@link FieldSecuritySQLGate} needs to judge one piece of SQL for one user. */
+export interface FieldSecuritySQLContext {
+    /** The acting user. */
+    User: UserInfo;
+    /** The dialect whose lexical rules the database applies to the text. */
+    Dialect: SQLScreeningDialect;
+    /** Every entity the provider knows, so base views and tables named in the text are recognized. */
+    Catalog: readonly EntityInfo[];
+    /**
+     * For a filter, sort or aggregate fragment: the entity whose view the fragment runs against.
+     * Its columns can be named without a qualifier, so its denied fields are always checked.
+     */
+    TargetEntity?: EntityInfo | null;
+    /** Entities the SQL is known to read beyond those its text names, such as a query's declared entities. */
+    ReadEntities?: readonly EntityInfo[];
+    /**
+     * For a whole statement, such as a saved query's SQL: refuse, for a user carrying any field
+     * denial, a relation that is not a CTE and not the base view or base table of a catalog entity
+     * (a custom view, synonym, table-valued function, temp table, or a name in another schema or
+     * database), and `EXEC`/`CALL`. What such a relation reads cannot be checked.
+     */
+    RefuseUnknownRelations?: boolean;
+    /**
+     * For a saved query's rendered SQL: the character offsets of `*` tokens that a structural
+     * reading of the whole statement has shown reach the caller only as output columns (a plain
+     * `*` or `alias.*` select item of a block whose rows become the result unchanged in shape).
+     * Such a star is not refused as a whole-row read; the caller must instead drop the denied
+     * columns it brings from the result. Every other star is judged as usual.
+     */
+    ProjectionStarOffsets?: ReadonlySet<number>;
+}
+/**
+ * SECURITY — the field-level security gate for SQL text a caller authors: RunView filters, sorts and
+ * aggregate expressions, a saved view's stored clauses, dataset item filters, and the rendered SQL
+ * of a saved query.
+ *
+ * Output projection alone is not enough. A user denied `Salary` who can write
+ * `ExtraFilter: "Salary > 200000"`, sort by it, or aggregate `MIN(Salary)` reconstructs its values
+ * from which rows come back. This gate refuses such text before it reaches the cache or the
+ * database, for every caller: client requests, agents and actions alike.
+ *
+ * ## How it reads the text
+ *
+ * The text is split into tokens with the database's own lexical rules
+ * (`ScanSQLForScreening`), so a name inside a string literal or a comment is not a reference, and a
+ * `[bracketed]` or `"quoted"` name is read as the bare name it is. Every unquoted word and quoted
+ * identifier is then compared with every denied field of every entity the SQL reads:
+ * - the entity the fragment filters (its columns can be named unqualified);
+ * - the entities whose base view or base table the text names, such as a subquery's FROM;
+ * - any entities the caller says the SQL reads.
+ *
+ * A name matches a denied field by the rule `IdentifierMatches` states, or when the two are equal
+ * after Unicode compatibility folding, accent stripping and case folding, the comparisons a
+ * database collation can make. So a look-alike spelling that the database would still resolve to
+ * the denied column is refused too. Each name is compared on its own, so one denied name inside
+ * another can never hide it.
+ *
+ * A reference qualified by an alias or view name that binds only to entities whose denied set
+ * does not hold that name is not a reference to a denied field. An unknown qualifier is checked
+ * against every restricted entity.
+ *
+ * ## Whole-row constructs
+ *
+ * For a user denied something on an entity the SQL reads, constructs that read a whole row without
+ * naming its columns are refused: `SELECT *` and `alias.*` (except directly inside `EXISTS (…)`
+ * whose body has no set operation or row-picking ORDER BY), `FOR JSON`, `FOR XML`, any function of
+ * `*` other than `COUNT(*)`/`COUNT_BIG(*)` (for example `CHECKSUM(*)`), `NATURAL JOIN`, a column
+ * alias list on such a relation, and a relation or its alias used as a value (PostgreSQL's
+ * whole-row reference, as in `row_to_json(e)` or `TABLE vw`). A user with no denials on the
+ * entities read is not affected; ordinary subqueries keep working.
+ *
+ * ## Failing closed
+ *
+ * Text the scanner cannot read the way the database does is refused for any user who carries a
+ * denial on an entity the SQL could read. So is a name holding a control, format or
+ * default-ignorable character (a zero-width joiner, a direction mark), which a collation may give
+ * no weight to.
+ *
+ * ## Unknown columns
+ *
+ * A reference to a column that does not exist reaches the database, which rejects it. For a user
+ * carrying denials, {@link FieldSecuritySQLGate.ErrorForInvalidColumn} turns that rejection into the
+ * same {@link FieldSecurityError} a denied column gets, so the two cannot be told apart.
+ */
+export declare class FieldSecuritySQLGate {
+    /**
+     * The first reason `sql` must be refused for `context.User`, or null when it may run.
+     *
+     * @param sql A filter, sort or aggregate fragment, or a whole statement
+     * @param context The user, dialect, catalog and the entities the SQL is known to read
+     */
+    static FindViolation(sql: string | null | undefined, context: FieldSecuritySQLContext): FieldSecurityViolation | null;
+    /**
+     * The first reason the sort fragment `orderBy` must be refused for `context.User`, or null.
+     * Everything {@link FindViolation} refuses, and, for a user denied a field on
+     * `context.TargetEntity`, a sort item that is a column position (`3 DESC`). A position names a
+     * column of the select list without spelling it, and an entity-object read selects every
+     * column, so `ORDER BY 3` can sort by a denied field. It is refused as a whole-row construct.
+     */
+    static FindSortViolation(orderBy: string | null | undefined, context: FieldSecuritySQLContext): FieldSecurityViolation | null;
+    /**
+     * Throws a {@link FieldSecurityError} when {@link FindViolation} refuses `sql`. The error names
+     * `entityName`, the entity the caller is reading, never the entity a subquery reaches, so a
+     * refusal says nothing a "no such column" error would not.
+     */
+    static AssertAllowed(sql: string | null | undefined, context: FieldSecuritySQLContext, entityName: string): void;
+    /**
+     * Checks a whole statement, such as a saved query's rendered SQL, against the denied fields of
+     * every entity it reads. The entities come from the base views and tables the text names, plus
+     * `readEntities`. References are checked wherever they appear: the select list, WHERE, JOIN,
+     * GROUP BY, ORDER BY and HAVING. For a user carrying any field denial, a relation the catalog
+     * does not know is refused too ({@link FieldSecuritySQLContext.RefuseUnknownRelations}).
+     * Throws a {@link FieldSecurityError} on the first violation, naming the entity whose denial
+     * it reached (or `fallbackEntityName` when none).
+     */
+    static AssertStatementAllowed(sql: string, user: UserInfo, catalog: readonly EntityInfo[], dialect: SQLScreeningDialect, readEntities?: readonly EntityInfo[], fallbackEntityName?: string): void;
+    /** The error a violation raises, naming `entityName`. */
+    static ErrorForViolation(violation: FieldSecurityViolation, entityName: string): FieldSecurityError;
+    /**
+     * For a user carrying field denials on `entity`, the {@link FieldSecurityError} a database's
+     * "no such column" rejection becomes, so a column that does not exist and a column that is
+     * denied produce the same error. Null when the user carries no denials there, or the error is
+     * not a "no such column" rejection.
+     *
+     * Reads SQL Server's `Invalid column name 'x'` and `The multi-part identifier "a.x" could not be
+     * bound`, and PostgreSQL's `column "x" does not exist` and `column a.x does not exist`.
+     */
+    static ErrorForInvalidColumn(error: unknown, entity: EntityInfo | null | undefined, user: UserInfo | null | undefined): FieldSecurityError | null;
+    /**
+     * The entities whose base view or base table `sql` reads as a relation: a name after FROM, JOIN
+     * or APPLY, or in a FROM list, wherever it appears (subqueries and CTE bodies included), with
+     * schema qualifiers skipped. A name in a literal or a comment is not a relation. A bare name
+     * shared by entities in several schemas yields each of them, so the set never misses a read.
+     * A relation inside a parenthesized join and PostgreSQL's `FROM ONLY x` count too. Null when
+     * the text cannot be read the way the database reads it.
+     */
+    static RelationEntities(sql: string | null | undefined, catalog: readonly EntityInfo[], dialect: SQLScreeningDialect): EntityInfo[] | null;
+    /** True when `user` is denied at least one field on at least one of `entities`. */
+    static UserCarriesDenials(entities: Iterable<EntityInfo | null | undefined>, user: UserInfo): boolean;
+    /**
+     * True when `user` is denied at least one field on any entity of `catalog`.
+     *
+     * Memoized per (catalog, user): after the first call it costs a few comparisons. The memo is
+     * discarded when the catalog array changes length, when the field-security generation moves
+     * (an entity rebuilt, a flag assigned, a cache invalidated; see
+     * `CurrentFieldSecurityGeneration`) or when the user's roles change, which are everything the
+     * answer depends on. A catalog swapped for a new array starts a new memo.
+     */
+    static CatalogHasDenialsForUser(catalog: readonly EntityInfo[] | null | undefined, user: UserInfo): boolean;
+    /**
+     * Every field `user` may not read across `catalog`: one `entityID:field,field` entry per
+     * entity on which the user is denied something, sorted. '' for a user denied nothing.
+     * Memoized exactly as {@link CatalogHasDenialsForUser}.
+     */
+    static CatalogDenialProfileKey(catalog: readonly EntityInfo[] | null | undefined, user: UserInfo): string;
+    /** The current summary for (`catalog`, `user`), rebuilt when any part of its key moved. */
+    private static catalogDenialSummary;
+    /** The uncached walk behind {@link CatalogDenialProfileKey}. */
+    private static buildDenialProfileKey;
+    /**
+     * The column a database "no such column" message names, or null. A qualified name gives its
+     * last part, which is what the gate reports for the same reference.
+     */
+    private static invalidColumnName;
+    /** Longest prefix of a database error message scanned for a column name. */
+    private static readonly maxErrorMessageScanLength;
+    /** The last dot-separated part of an identifier path, unquoted and unescaped. */
+    private static lastIdentifierPart;
+    /**
+     * The identifier path in a PostgreSQL `column <path> does not exist` message (for example
+     * `e.salry` or `"E"."Salry"`), or null. Scanned by hand rather than with a regular expression:
+     * the path's parts may themselves contain dots, and a pattern that allows that backtracks
+     * exponentially on crafted input.
+     */
+    private static postgresColumnPath;
+    /**
+     * Index just past an identifier path starting at `start`: a run of non-space characters in
+     * which double-quoted segments (with `""` escapes) may contain spaces. Returns `start` when no
+     * path starts there, and -1 for an unterminated quote.
+     */
+    private static identifierPathEnd;
+    /**
+     * The first call of a function the dialect forbids in caller SQL (one that runs SQL given as a
+     * string, reads files or other databases), or null. What such a call reads cannot be checked.
+     */
+    private static findDynamicSQLCall;
+    /**
+     * True when the user carries a denial on any entity the SQL could read: the target, the
+     * declared read entities (checked directly, as they need not be catalog members), or any
+     * catalog entity, since the text can name any of them. The catalog answer is memoized
+     * ({@link CatalogHasDenialsForUser}).
+     *
+     * Deliberately catalog-wide rather than "the target and read entities only". Which other
+     * entities a fragment reads is only known once its text has been read the way the database
+     * reads it: a subquery, a parenthesized join, a schema-qualified or bracketed name, or a name
+     * spelled with look-alike characters all reach another entity's view. And text that cannot be
+     * read at all, a dynamic-SQL call or an invisible character must be refused for such a user
+     * whatever it appears to name. Every one of those checks needs the tokens, so a user with a
+     * denial anywhere has every fragment tokenized; {@link analyze} then derives the read set, and
+     * a fragment whose read set carries none of the user's denials passes without the
+     * denied-name and whole-row checks.
+     */
+    private static mayReadRestrictedEntity;
+    /** Builds the relation bindings, the restricted set and its denied names. */
+    private static analyze;
+    /** Adds `entity` to the restricted set when the user is denied a field on it. */
+    private static addIfRestricted;
+    /** Records each relation the text names, its alias, and which of them are restricted. */
+    private static bindRelations;
+    /** Binds a qualifier to entities. */
+    private static bind;
+    /**
+     * Whether the relation name at `i` declares a relation: it follows FROM, JOIN or APPLY, or a
+     * comma in a FROM list, with any `schema .` / `database . schema .` qualifiers, a PostgreSQL
+     * `ONLY`, and the parentheses of a parenthesized join skipped.
+     */
+    private static isRelationDeclaration;
+    /** Whether the token at `j` is a FROM, JOIN or APPLY keyword, or a comma in a FROM list. */
+    private static introducesRelation;
+    /** The index of the first part of the dotted name that ends at `i` (`db . schema . name`). */
+    private static qualifierStart;
+    /**
+     * The clause keyword that governs the token at `i` at its own parenthesis depth: the nearest
+     * preceding SELECT, FROM, JOIN, WHERE, ON, GROUP, ORDER or HAVING at that depth. Inside the
+     * parentheses of a parenthesized join (`FROM (a x, b y)`) with no such keyword, `from`.
+     */
+    private static clauseAt;
+    /** Whether the `(` at `j` opens a parenthesized join: it stands where a relation is declared. */
+    private static opensJoinGroup;
+    /**
+     * The first relation the statement reads that is not a CTE and not the base view or base table
+     * of a catalog entity, or a stored-procedure call; null when there is none. A name qualified by
+     * a schema no entity of that name lives in, or by a database, is unknown; so is a function in
+     * a relation position (`FROM f(…)`).
+     */
+    private static findUnknownRelation;
+    /**
+     * Whether the name at `i` is the last part of a relation the statement reads: after FROM (of a
+     * SELECT, not `EXTRACT(… FROM x)` or `IS DISTINCT FROM x`), JOIN, APPLY, a FROM-list comma or
+     * PostgreSQL's `TABLE`, past qualifiers, `ONLY`, `LATERAL` and join-group parentheses.
+     */
+    private static isRelationTarget;
+    /** Whether a token is `ONLY` or `LATERAL`. */
+    private static isRelationModifier;
+    /** Whether the FROM at `j` is a SELECT's FROM clause. */
+    private static isSelectFrom;
+    /**
+     * Whether the relation whose last name part is at `i` is a CTE or a catalog entity's base view
+     * or base table, in that entity's schema when qualified.
+     */
+    private static isKnownRelation;
+    /**
+     * The folded names of the CTEs a statement defines: a name after WITH, RECURSIVE or a comma
+     * that is followed by an optional column list, AS, an optional `[NOT] MATERIALIZED`, and `(`.
+     */
+    private static cteNames;
+    /** Whether the tokens from `j` are `[(columns)] AS [NOT] [MATERIALIZED] (`. */
+    private static opensCTEBody;
+    /** The index of the `)` that closes the `(` at `open`, or -1. */
+    private static closingParen;
+    /**
+     * Whether the body of the `EXISTS (` whose parenthesis is at `open` has, at its own depth, a
+     * word that makes a `SELECT *` there read column values ({@link EXISTS_ROW_READING_WORDS}).
+     * An unclosed body counts as one that does.
+     */
+    private static existsBodyReadsRows;
+    /** The index of the alias after the relation at `i` (`x a`, `x AS a`), or null. */
+    private static aliasIndexAfter;
+    /** The first reference to a denied field, honoring qualifiers that bind to known entities. */
+    private static findDeniedReference;
+    /**
+     * The denied names a reference at `i` could reach: those of the entities its qualifier binds to,
+     * or every restricted entity's when it is unqualified or its qualifier is unknown.
+     */
+    private static candidatesFor;
+    /**
+     * A sort item of `orderBy` that is a column position, as a whole-row violation, or null. Only
+     * for a user denied a field on the target entity. An item counts when its first token, inside
+     * any opening parentheses, is a number.
+     */
+    private static findSortByPosition;
+    /** The first whole-row construct, or null. */
+    private static findWholeRowConstruct;
+    /** The whole-row construct that starts at token `i`, or null. */
+    private static wholeRowConstructAt;
+    /**
+     * What a `*` at `i` reads: null for a multiplication, `COUNT(*)`, `EXISTS (SELECT *` whose body
+     * has no set operation or row-picking ORDER BY at its own depth, `alias.*` whose alias binds
+     * only to entities the user is denied nothing on, or a projection star
+     * ({@link FieldSecuritySQLContext.ProjectionStarOffsets}).
+     */
+    private static starConstruct;
+    /**
+     * A restricted relation name or alias used other than as a declaration or a qualifier (`x.`):
+     * a whole-row value on PostgreSQL, or a column alias list after the declaration.
+     */
+    private static relationValueConstruct;
+    /** Whether a token can end the left operand of a multiplication. */
+    private static endsOperand;
+    /** Whether a token can start the right operand of a multiplication. */
+    private static startsOperand;
+    /**
+     * The name a "no such column" error would give for `name` as `sql` writes it, so a denied
+     * column is reported exactly as an unknown one. On PostgreSQL, MJ quotes a capitalized or
+     * dot-qualified word before the database sees it (`AutoQuoteLeavesWordBare`), so the error
+     * names such a word as written; a word left bare is folded to lower case. A quoted name, and
+     * every name on SQL Server, is reported as written. The first token spelled `name` decides.
+     *
+     * @param sql The caller's SQL
+     * @param name The reference as the database reads it
+     * @param dialect The dialect the SQL runs under
+     */
+    static ReportedColumnName(sql: string, name: string, dialect: SQLScreeningDialect): string;
+    /** A reference's name as {@link ReportedColumnName} gives it. */
+    private static reportedName;
+    private static isName;
+    private static isWord;
+    private static isSymbol;
+    /** Folded base view and base table names of every entity in the catalog. */
+    private static relationIndex;
+}
+/**
+ * An identifier reduced to the form a database collation may compare it in: Unicode compatibility
+ * decomposition (a KELVIN SIGN reads as `K`, a full-width letter as its ASCII form), accents and
+ * other combining marks removed, control, format and default-ignorable characters (zero-width
+ * joiners, direction marks, a soft hyphen) removed, case folded through upper case (`ß` and `ẞ` both read `ss`, a
+ * final `ς` reads `σ`), and surrounding spaces trimmed.
+ */
+export declare function FoldIdentifier(name: string): string;
+/**
+ * Whether a reference as written may name `fieldName` on some database: by the rule
+ * `IdentifierMatches` states, or when both fold to the same form ({@link FoldIdentifier}). Looser
+ * than any collation, so a security check that refuses on it never lets through a reference the
+ * database would resolve to the field.
+ */
+export declare function ReferenceMayNameField(reference: string, fieldName: string): boolean;
+/** The message for a whole-row construct refused for a user carrying field denials. */
+export declare function FieldSecurityWholeRowMessage(construct: string, entityName: string): string;
+/** The message for SQL that could not be read well enough to check against field permissions. */
+export declare function FieldSecurityUnresolvableSQLMessage(entityName: string): string;
+//# sourceMappingURL=fieldSecuritySQLGate.d.ts.map

package/dist/generic/fieldSecuritySQLGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fieldSecuritySQLGate.d.ts","sourceRoot":"","sources":["../../src/generic/fieldSecuritySQLGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,mBAAmB,EAAqB,MAAM,wBAAwB,CAAC;AAEpH,OAAO,EAAkC,UAAU,EAAE,kBAAkB,EAA6B,MAAM,cAAc,CAAC;AACzH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,+DAA+D;AAC/D,MAAM,MAAM,0BAA0B,GAAG,aAAa,GAAG,UAAU,GAAG,cAAc,GAAG,iBAAiB,CAAC;AAEzG,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACnC,IAAI,EAAE,0BAA0B,CAAC;IACjC;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;CAC7B;AAED,sFAAsF;AACtF,MAAM,WAAW,uBAAuB;IACpC,uBAAuB;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,mBAAmB,CAAC;IAC7B,kGAAkG;IAClG,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B;;;OAGG;IACH,YAAY,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IACjC,0GAA0G;IAC1G,YAAY,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACrC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC/C;AAyFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,qBAAa,oBAAoB;IAC7B;;;;;OAKG;WACW,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,uBAAuB,GAAG,sBAAsB,GAAG,IAAI;IA6B5H;;;;;;OAMG;WACW,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,uBAAuB,GAAG,sBAAsB,GAAG,IAAI;IAIpI;;;;OAIG;WACW,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAOvH;;;;;;;;OAQG;WACW,sBAAsB,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,OAAO,EAAE,mBAAmB,EAC5B,YAAY,CAAC,EAAE,SAAS,UAAU,EAAE,EACpC,kBAAkB,SAAU,GAC7B,IAAI;IASP,yDAAyD;WAC3C,iBAAiB,CAAC,SAAS,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,GAAG,kBAAkB;IAW1G;;;;;;;;OAQG;WACW,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,kBAAkB,GAAG,IAAI;IASxJ;;;;;;;OAOG;WACW,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,UAAU,EAAE,EAAE,OAAO,EAAE,mBAAmB,GAAG,UAAU,EAAE,GAAG,IAAI;IAiBjJ,mFAAmF;WACrE,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO;IAS5G;;;;;;;;OAQG;WACW,wBAAwB,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO;IAIlH;;;;OAIG;WACW,uBAAuB,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM;IAShH,2FAA2F;IAC3F,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAuBnC,gEAAgE;IAChE,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAYpC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAqBhC,4EAA4E;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAQ;IAEzD,iFAAiF;IACjF,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAKjC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAgBjC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAiBhC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAWjC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAWtC,6EAA6E;IAC7E,OAAO,CAAC,MAAM,CAAC,OAAO;IAiCtB,iFAAiF;IACjF,OAAO,CAAC,MAAM,CAAC,eAAe;IAQ9B,yFAAyF;IACzF,OAAO,CAAC,MAAM,CAAC,aAAa;IAiB5B,qCAAqC;IACrC,OAAO,CAAC,MAAM,CAAC,IAAI;IAQnB;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAQpC,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAOjC,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,cAAc;IAQ7B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;IAiBvB,iGAAiG;IACjG,OAAO,CAAC,MAAM,CAAC,cAAc;IAM7B;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAclC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAa/B,8CAA8C;IAC9C,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAIjC,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,YAAY;IAM3B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAY9B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;IAavB,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,YAAY;IAc3B,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,YAAY;IAS3B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAalC,mFAAmF;IACnF,OAAO,CAAC,MAAM,CAAC,eAAe;IAS9B,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAalC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAU5B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAwBjC,8CAA8C;IAC9C,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAWpC,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAelC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAsB5B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAerC,oEAAoE;IACpE,OAAO,CAAC,MAAM,CAAC,WAAW;IAM1B,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,aAAa;IAM5B;;;;;;;;;;OAUG;WACW,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,MAAM;IAKjG,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,YAAY;IAO3B,OAAO,CAAC,MAAM,CAAC,MAAM;IAIrB,OAAO,CAAC,MAAM,CAAC,MAAM;IAIrB,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB,4EAA4E;IAC5E,OAAO,CAAC,MAAM,CAAC,aAAa;CAe/B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,uFAAuF;AACvF,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED,iGAAiG;AACjG,wBAAgB,mCAAmC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE9E"}