@memberjunction/global 6.2.0-edge.5 → 6.2.0-edge.7

package/dist/SafeExpressionEvaluator.d.ts

@@ -9,31 +9,54 @@
  * @author MemberJunction.com
  * @since 2.76.0
  */
+/** One approved global: whether it may be called by bare name, and which of its methods may be called. */
+export interface ApprovedExpressionGlobal {
+    /** `true` when the global itself may be called: `Number(x)`, `parseInt(x)`. */
+    readonly Callable: boolean;
+    /** Methods that may be called on the global by dotted name: `Math.max(a, b)`. */
+    readonly Methods: ReadonlySet<string>;
+}
 /**
- * Namespace globals whose listed methods a condition may CALL, keyed by namespace name.
+ * **The approved globals — the only host globals an expression can reach.**
  *
- * Both halves of `Math.abs(x)` are fixed identifiers in the AST, so admitting them adds no dynamic
- * lookup: the four invariants that close the sandbox escape — literal-only computed keys, no
- * `constructor`/`__proto__`/`prototype`, a closed non-computed call surface with no
- * `call`/`apply`/`bind`, and screened free identifiers — are all untouched by this list.
+ * This is the single list reviewers should check. Every other free identifier in an expression must
+ * be an evaluation-context key or an arrow-function parameter in scope; anything else is refused
+ * before compilation (see {@link SafeExpressionEvaluator.ScreenExpression}).
+ *
+ * An approved global is usable ONLY in call position — `Math.max(a, b)`, `Number(x)` — never as a
+ * bare value, a property read (`Math.PI`), or a callback (`items.map(Number)`). That rule is what
+ * stops a function being handed to code that calls it with attacker-chosen arguments: two confirmed
+ * bypasses of the earlier denylist did exactly that (`a.reduce(fetch)` and
+ * `p.reduce(Object.assign)`).
  *
- * Every entry is a pure value function. `Math.random` is deliberately absent (a condition that
- * evaluates differently on each run is not a guard), as are `Object.assign`,
- * `Object.defineProperty` and `Object.setPrototypeOf`, which mutate.
+ * Every listed member is a pure function of its arguments. Deliberately absent: `Object.assign`,
+ * `Object.defineProperty`, `Object.getPrototypeOf`/`setPrototypeOf` (mutate or open the prototype
+ * chain), `Math.random` (a guard that changes per run is not a guard), `String.fromCharCode`, and
+ * every host API (`fetch`, `setTimeout`, `require`, `process`, ...).
+ *
+ * Both halves of `Math.abs(x)` are fixed identifiers in the AST, so admitting them adds no dynamic
+ * lookup.
+ */
+export declare const APPROVED_EXPRESSION_GLOBALS: ReadonlyMap<string, ApprovedExpressionGlobal>;
+/**
+ * Global names that are VALUES, not functions, and may appear anywhere a value can: `x === undefined`.
+ * Each is a non-writable primitive, so referencing one cannot reach host code.
+ */
+export declare const APPROVED_VALUE_GLOBALS: ReadonlySet<string>;
+/**
+ * Namespace globals whose listed methods an expression may CALL, keyed by namespace name.
+ * Derived from {@link APPROVED_EXPRESSION_GLOBALS}.
  */
 export declare const SAFE_GLOBAL_NAMESPACE_METHODS: ReadonlyMap<string, ReadonlySet<string>>;
 /**
- * Global functions a condition may call by bare name — the coercions and numeric predicates that
- * authored specs use (`Number(payload.count) > 3`, `isNaN(payload.count)`).
+ * Global functions an expression may call by bare name (`Number(payload.count) > 3`).
+ * Derived from {@link APPROVED_EXPRESSION_GLOBALS}.
  */
 export declare const SAFE_GLOBAL_CALLABLES: ReadonlySet<string>;
 /**
- * Every global name a condition may reference, as a namespace or as a bare callable.
- *
- * **This is the single source of truth for the ambient globals of the condition dialect.** It lives
- * beside the policy screen that enforces it so a caller validating conditions ahead of evaluation
- * (`ai-core-plus`'s task-graph door) cannot bless a name the runtime would refuse — the failure mode
- * that shipped once already, where the door's own list and the evaluator disagreed silently.
+ * Every global name an expression may reference (in call position), as a namespace or as a bare
+ * callable. Derived from {@link APPROVED_EXPRESSION_GLOBALS}, so a caller validating conditions ahead
+ * of evaluation (`ai-core-plus`'s task-graph door) cannot bless a name the runtime would refuse.
  */
 export declare const SAFE_EXPRESSION_GLOBALS: ReadonlySet<string>;
 /**
@@ -58,17 +81,19 @@ export interface ExpressionEvaluationResult {
  * - Logical: &&, ||, !
  * - Property access: dot notation (e.g., payload.customer.name), including optional chaining (`?.`)
  * - Array access: bracket notation with a literal index/key (e.g., items[0])
- * - Safe methods: .length, .includes(), .startsWith(), .endsWith()
- * - Array methods: .some(), .every(), .find(), .filter()
- * - Safe globals: the namespaces and bare callables in {@link SAFE_EXPRESSION_GLOBALS}
+ * - Safe methods: .length, .includes(), .startsWith(), .endsWith(), .split(), .slice(), ...
+ * - Array methods: .some(), .every(), .find(), .filter(), .map(), .reduce() — the callback must be
+ *   an inline arrow function (`items.some(i => i.price > 100)`, never `items.some(fn)`)
+ * - Approved globals, in call position only: {@link APPROVED_EXPRESSION_GLOBALS}
  *   (e.g. `Math.abs(output.delta) < 5`, `Number(payload.count) > 3`, `Object.keys(payload).length`)
  * - Type checking: typeof
  *
  * Safety is enforced by parsing the expression to an AST and walking it against
- * an ALLOWLIST of node types before it is compiled — an unlisted construct
- * (computed member access with a non-literal key, `.constructor`/`__proto__`
- * access, any call outside the safe-method and safe-global lists, host-global
- * identifiers, etc.) is rejected at validation time and never reaches the compiler. A structural
+ * an ALLOWLIST before it is compiled. Node types, operators, methods and free identifiers are
+ * all allowlisted: a free identifier must be a context key, an arrow parameter in scope, or an
+ * approved global used as a call. An unlisted construct (computed member access with a non-literal
+ * key, `.constructor`/`__proto__` access, any call outside the safe-method and approved-global
+ * lists, any other identifier, etc.) is rejected at validation time and never reaches the compiler. A structural
  * allowlist cannot be defeated by string concatenation the way a textual
  * denylist can, and it does not over-reject data that merely mentions a reserved
  * word (e.g. `name == 'constructor'` is a legal comparison).
@@ -99,96 +124,47 @@ export interface ExpressionEvaluationResult {
  * ```
  */
 export declare class SafeExpressionEvaluator {
-    /**
-     * Identifiers that must never resolve to a host global. Because the compiled
-     * function runs in global scope, a bare `process`/`Function`/`globalThis`/…
-     * would reach the real global object; identifiers are atomic AST tokens, so a
-     * name that is split with string concatenation parses as separate identifiers
-     * or an operator and is caught by the structural rules instead.
-     * @private
-     */
-    private static readonly DANGEROUS_IDENTIFIERS;
-    /**
-     * Property names that open the prototype chain / constructor climb. Denied on
-     * both dotted (`x.constructor`) and literal-bracket (`x["constructor"]`) access.
-     * @private
-     */
-    private static readonly DANGEROUS_PROPERTY_NAMES;
-    /** Binary operators the evaluator permits. `instanceof`/`in`/bitwise are excluded. @private */
-    private static readonly ALLOWED_BINARY_OPERATORS;
-    /** Unary operators the evaluator permits. `delete`/`void` are excluded. @private */
-    private static readonly ALLOWED_UNARY_OPERATORS;
     /**
      * Cache for compiled expressions to improve performance on repeated evaluations
      * @private
      */
     private readonly _compiledExpressionCache;
-    /**
-     * Safe methods that can be called on objects
-     * @private
-     */
-    private static readonly SAFE_METHODS;
     /**
      * Evaluates a boolean expression against a context object
      *
      * @param {string} expression - The boolean expression to evaluate
-     * @param {Record<string, any>} context - The context object containing variables
+     * @param {Record<string, any>} [context={}] - The context object containing variables. Its keys
+     *        are the only free names the expression may use; a key named like an approved global
+     *        shadows it (see {@link ScreenExpression}).
      * @param {boolean} [enableDiagnostics=false] - Whether to include diagnostic information
      *
      * @returns {ExpressionEvaluationResult} The evaluation result
      */
-    Evaluate(expression: string, context: Record<string, any>, enableDiagnostics?: boolean): ExpressionEvaluationResult;
+    Evaluate(expression: string, context?: Record<string, any>, enableDiagnostics?: boolean): ExpressionEvaluationResult;
     /** @deprecated Use {@link Evaluate}. */
-    evaluate(expression: string, context: Record<string, any>, enableDiagnostics?: boolean): ExpressionEvaluationResult;
+    evaluate(expression: string, context?: Record<string, any>, enableDiagnostics?: boolean): ExpressionEvaluationResult;
     /**
-     * Validates an expression for safety by parsing it and walking the AST against
-     * an allowlist. Returns an error message if any construct is not permitted.
+     * Screens an expression against the allowlist WITHOUT compiling or running it. Returns the
+     * rejection message, or `null` when every construct is permitted.
      *
-     * @param {string} expression - The expression to validate
+     * This is the single policy gate for every place MemberJunction compiles a user- or LLM-authored
+     * expression: {@link Evaluate}, {@link ValidateSyntax}, and the field-rule / integration formula
+     * engine (`FieldTransformEngine`), which passes `['value', 'fields']`.
      *
-     * @returns {string | null} Error message if invalid, null if valid
+     * A context key or arrow parameter named like an approved global (`Math`, `JSON`, ...) shadows
+     * it and is screened as data, so `Math.abs(x)` with a `Math` context key is refused because
+     * `abs` is not a safe instance method. Do not pass approved-global names as context keys.
      *
-     * @private
-     */
-    private validateExpression;
-    /** Builds the standard rejection message. @private */
-    private forbidden;
-    /**
-     * Walks an AST node against the allowlist. Returns an error message on the first
-     * disallowed construct, or null if the entire subtree is permitted.
-     * @private
-     */
-    private checkNode;
-    /**
-     * Member access is allowed for dotted property reads and literal-key bracket
-     * reads, but never for a computed key built at runtime (the string-concat
-     * escape route) or a prototype-chain property.
-     * @private
-     */
-    private checkMemberExpression;
-    /**
-     * A call is admitted only when its callee is a FIXED name on one of two allowlists: a bare
-     * safe global (`parseInt(...)`) or a dotted method that is either a safe instance method or a
-     * method of a safe global namespace (`Math.abs(...)`). Everything else — a computed callee, an
-     * unlisted bare identifier (`eval(...)`, `Function(...)`), a call on a call's result that is
-     * not itself a safe method — is rejected.
-     * @private
-     */
-    private checkCallExpression;
-    /**
-     * Whether `<receiver>.<method>()` names a permitted call: a safe instance method on any value,
-     * or a method of a safe global namespace when the receiver is that namespace by bare name.
-     * @private
+     * @param expression the expression to screen
+     * @param allowedIdentifiers the names the expression may reference as values — the evaluation
+     *        context keys. Pass `null` only when they are not yet known (authoring-time syntax
+     *        checks); free identifiers are then left for evaluation time to decide, while approved
+     *        globals used as values, callbacks that are not inline arrows, and every structural rule
+     *        are still enforced.
      */
-    private isCallableMethod;
-    /** Walks a call's arguments; spreads are rejected outright. @private */
-    private checkCallArguments;
-    /**
-     * Arrow functions are permitted only as callback arguments to the safe array
-     * methods; parameters must be simple identifiers and the body an expression.
-     * @private
-     */
-    private checkArrowFunction;
+    static ScreenExpression(expression: string, allowedIdentifiers: Iterable<string> | null): string | null;
+    /** Counts parentheses textually; used only to word the error for an expression that failed to parse. @private */
+    private static hasUnbalancedParentheses;
     /**
      * Creates a safe context object with only allowed properties
      *
@@ -212,6 +188,11 @@ export declare class SafeExpressionEvaluator {
     /**
      * Safely clones a value for use in evaluation context
      *
+     * Functions are never carried into the context: a context should hold data, and a function
+     * reachable from an expression is one more thing that could be invoked. A function value
+     * becomes `undefined`, and function-valued properties are dropped from plain objects and
+     * class instances alike.
+     *
      * @param {any} value - The value to clone
      *
      * @returns {any} The cloned value
@@ -229,32 +210,35 @@ export declare class SafeExpressionEvaluator {
      * is a perfectly good condition that simply has no data yet. A submit-time check built on
      * `evaluate` therefore refuses every legitimate condition.
      *
-     * So this compiles and never runs. The expression goes through the same policy screen
-     * `evaluate` applies (the AST allowlist), then the same function body is BUILT and discarded —
-     * never invoked. Values are never consulted, which is precisely the property wanted: unknown
+     * So this parses and never runs. The expression goes through the same policy screen
+     * `evaluate` applies (the AST allowlist), then the same function body `evaluate` compiles is
+     * parsed in strict mode — never compiled, never invoked. Values are never consulted, which is precisely the property wanted: unknown
      * identifiers, absent properties and undefined chains all PASS, because none of them is a syntax
-     * error and whether they resolve is a question about a run that has not happened yet.
+     * error and whether they resolve is a question about a run that has not happened yet. Pass
+     * `contextKeys` when the evaluation context's keys ARE known, and unknown identifiers are refused
+     * here exactly as {@link Evaluate} would refuse them.
      *
-     * **Compilation is not evaluation**, and the distinction is load-bearing for safety: `Function`
-     * parses the body and returns; nothing in the expression executes. The policy screen still runs
-     * first, so the constructs `evaluate` refuses are refused here too — those produce a permanent
-     * runtime refusal, and an author is better told now.
+     * **Parsing is not evaluation**, and the distinction is load-bearing for safety: no code is
+     * constructed from the expression here, so nothing in it can execute. The policy screen still
+     * runs first, so the constructs `evaluate` refuses are refused here too — those produce a
+     * permanent runtime refusal, and an author is better told now.
      *
-     * `Undecidable` is the honest third answer. A host that forbids dynamic compilation (a strict
-     * CSP without `unsafe-eval`) cannot answer the question at all, and a validator that read that
-     * as "invalid" would refuse every condition in the browser. Callers should treat it as a pass.
+     * Because nothing is compiled, the answer does not depend on the host allowing dynamic code (a
+     * strict CSP without `unsafe-eval`). `Undecidable` is kept in the result type for callers that
+     * check it, and is no longer returned.
      *
      * @param expression the expression to check
-     * @returns `Valid: true` when it parses; `Valid: false` with `Error` when it definitely does
-     *          not; `Valid: true` with `Undecidable: true` when this environment cannot compile
+     * @param contextKeys the names the expression may reference, when known; omitted, free
+     *        identifiers are left for evaluation time (see {@link ScreenExpression})
+     * @returns `Valid: true` when it parses; `Valid: false` with `Error` when it does not
      */
-    ValidateSyntax(expression: string): {
+    ValidateSyntax(expression: string, contextKeys?: Iterable<string>): {
         Valid: boolean;
         Error?: string;
         Undecidable?: boolean;
     };
     /** @deprecated Use {@link ValidateSyntax}. */
-    validateSyntax(expression: string): {
+    validateSyntax(expression: string, contextKeys?: Iterable<string>): {
         Valid: boolean;
         Error?: string;
         Undecidable?: boolean;

package/dist/SafeExpressionEvaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SafeExpressionEvaluator.d.ts","sourceRoot":"","sources":["../src/SafeExpressionEvaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuBH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAUjF,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAEpD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAGtD,CAAC;AAEH;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC;KAC1B,CAAC;CACL;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,qBAAa,uBAAuB;IAChC;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAK1C;IAEH;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAE7C;IAEH,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAE7C;IAEH,oFAAoF;IACpF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAA8C;IAE7F;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAuD;IAEhG;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAoBlC;IAEF;;;;;;;;OAQG;IACI,QAAQ,CACX,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,iBAAiB,GAAE,OAAe,GACnC,0BAA0B;IAwE7B,wCAAwC;IACjC,QAAQ,CACX,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,iBAAiB,GAAE,OAAe,GACnC,0BAA0B;IAI7B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA4C1B,sDAAsD;IACtD,OAAO,CAAC,SAAS;IAIjB;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAmEjB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IA4B7B;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IA2B3B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAUxB,wEAAwE;IACxE,OAAO,CAAC,kBAAkB;IAW1B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAkB1B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;;;;;;;OAQG;IACH,OAAO,CAAC,uBAAuB;IAW/B;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU;IAwDlB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE;IAqBpG,8CAA8C;IACvC,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE;IAIpG;;;;;;;OAOG;IACI,gBAAgB,CACnB,WAAW,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC,EACvD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC7B,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAW7C,gDAAgD;IACzC,gBAAgB,CACnB,WAAW,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC,EACvD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC7B,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC;CAGhD;AAED;;GAEG;AACH,eAAO,MAAM,0BAA0B,yBAAgC,CAAC;AAExE,0DAA0D;AAC1D,eAAO,MAAM,0BAA0B,yBAA6B,CAAC"}
+{"version":3,"file":"SafeExpressionEvaluator.d.ts","sourceRoot":"","sources":["../src/SafeExpressionEvaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuBH,0GAA0G;AAC1G,MAAM,WAAW,wBAAwB;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAgBpF,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAA6C,CAAC;AAErG;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAElF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAErD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAA+C,CAAC;AA2WxG;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC;KAC1B,CAAC;CACL;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,qBAAa,uBAAuB;IAChC;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAuD;IAEhG;;;;;;;;;;OAUG;IACI,QAAQ,CACX,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EACjC,iBAAiB,GAAE,OAAe,GACnC,0BAA0B;IAyE7B,wCAAwC;IACjC,QAAQ,CACX,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EACjC,iBAAiB,GAAE,OAAe,GACnC,0BAA0B;IAI7B;;;;;;;;;;;;;;;;;;OAkBG;WACW,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI;IAmC9G,iHAAiH;IACjH,OAAO,CAAC,MAAM,CAAC,wBAAwB;IAUvC;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IA2BzB;;;;;;;;OAQG;IACH,OAAO,CAAC,uBAAuB;IAW/B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,UAAU;IA4DlB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACI,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE;IAgBpI,8CAA8C;IACvC,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE;IAIpI;;;;;;;OAOG;IACI,gBAAgB,CACnB,WAAW,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC,EACvD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC7B,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAW7C,gDAAgD;IACzC,gBAAgB,CACnB,WAAW,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC,EACvD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC7B,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC;CAGhD;AAED;;GAEG;AACH,eAAO,MAAM,0BAA0B,yBAAgC,CAAC;AAExE,0DAA0D;AAC1D,eAAO,MAAM,0BAA0B,yBAA6B,CAAC"}