@nifrajs/cli 2.2.0 → 2.3.0

package/dist/check.d.ts

@@ -1,20 +1,23 @@
 /**
- * `nifra check` — the agent's (and CI's) definition of done. It makes the guarantees that keep a nifra
+ * `nifra check` - the agent's (and CI's) definition of done. It makes the guarantees that keep a nifra
  * app drift-proof actually *fire*, instead of relying on the agent to remember them:
  *
- *   1. **typecheck** (`tsc --noEmit`) — the frontend↔backend contract is compiler-enforced. The typed
+ *   1. **typecheck** (`tsc --noEmit`) - the frontend↔backend contract is compiler-enforced. The typed
  *      client derives request + response types from the routes, so a shape mismatch is a type error.
- *   2. **typed-client lint** — flags hand-rolled `fetch()` to this app's *own* API (a relative URL),
+ *   2. **typed-client lint** - flags hand-rolled `fetch()` to this app's *own* API (a relative URL),
  *      which bypasses `client<typeof app>` so the compiler can't see the drift.
- *   3. **server-only-import lint** — flags a top-level import of server-only code (a DB driver, `node:`/
+ *   3. **server-only-import lint** - flags a top-level import of server-only code (a DB driver, `node:`/
  *      `bun:` builtins, the `./db` module) into a `routes/` page module. Those modules are bundled for
- *      the browser too, so the import ships server code to the client and breaks the build — the #1
+ *      the browser too, so the import ships server code to the client and breaks the build - the #1
  *      full-stack footgun. Reach server resources via `c.db` / `ctx.api`, never a top-level import.
  *
  * `collectCheckResult` returns a structured, machine-readable result (consumed by `--json` and the
  * `nifra_check` MCP tool, so an agent acts on diagnostics instead of scraping prose). Exits non-zero if
  * anything fails. Pure scanners (`scanFetchText`, `scanServerOnlyImports`) are unit-tested.
  */
+import type { AssuranceConfig, AssuranceReport } from "@nifrajs/core/assurance";
+import type { CapabilityProjectReport } from "./capabilities-tool.js";
+import { type TypeScriptApi } from "./internal/typescript-import.js";
 export interface SourceFinding {
     readonly file: string;
     readonly line: number;
@@ -31,13 +34,13 @@ export interface StaticRouteFinding extends SourceFinding {
     readonly path: string;
 }
 /**
- * Blank, with spaces (newlines preserved, so every byte offset — and line number — is unchanged):
+ * Blank, with spaces (newlines preserved, so every byte offset - and line number - is unchanged):
  *   - `//` line comments and block comments;
- *   - the CONTENTS of backtick template literals — code-as-text (doc `CodeBlock` examples, code
+ *   - the CONTENTS of backtick template literals - code-as-text (doc `CodeBlock` examples, code
  *     generators), never a real statement to lint.
  * Single/double-quoted strings are KEPT (a real import/Response specifier lives in one). A small
  * char-state machine, not a full lexer: it doesn't model regex literals, so a regex containing a quote
- * could mis-skip — in practice the constructs these scanners look for sit before any such regex.
+ * could mis-skip - in practice the constructs these scanners look for sit before any such regex.
  * Shared by the source scanners here and by `nifra doctor` ({@link ./doctor.ts}).
  */
 export declare function stripComments(src: string): string;
@@ -54,6 +57,17 @@ export declare function codePositionMask(src: string): string;
 export declare function scanFetchText(file: string, content: string, externalMounts?: readonly string[]): SourceFinding[];
 /** Statically collect simple Nifra route registrations from source, without importing app code. */
 export declare function scanStaticRouteText(file: string, content: string): StaticRouteFinding[];
+/** Scan one file's text for SQL assembled by interpolation. Pure + line-accurate. */
+export declare function scanInterpolatedSql(file: string, content: string, ts: TypeScriptApi): SourceFinding[];
+/**
+ * Collect interpolated-SQL findings across the project.
+ *
+ * Returns `undefined` - not an empty array - when TypeScript is not installed. The rule parses source
+ * with the compiler, so without it there is nothing to report and, more to the point, no basis for
+ * reporting nothing. An empty result would read as "no interpolated SQL found", which is the one
+ * answer a security rule must never give when it did not run.
+ */
+export declare function scanProjectSql(cwd: string): Promise<SourceFinding[] | undefined>;
 /** Scan one file's text for untyped `client("…")` calls. Pure + line-accurate. */
 export declare function scanUntypedClient(file: string, content: string): SourceFinding[];
 /** Flag an import of a specifier that no longer exists. Pure; matches the exact specifier or a subpath
@@ -67,13 +81,13 @@ export declare function scanServerOnlyImports(file: string, content: string): Se
  * Mirrors {@link STATIC_IMPORT}, so `import type` + dynamic `import()` are already excluded. Pure. */
 export declare function parseStaticImports(content: string): string[];
 /** The server-only SINK an import specifier names directly (a `node:`/`bun:` builtin or a known
- * server-only package), or `undefined` if it isn't a by-name sink. Pure — the label is the specifier
+ * server-only package), or `undefined` if it isn't a by-name sink. Pure - the label is the specifier
  * itself (it's already the actionable name). */
 export declare function directSinkSpecifier(spec: string): string | undefined;
 /** One transitive server-only finding: the route module, the route's offending top-level import (the
  * first hop / `specifier`), the line + snippet of that import, and the FULL chain to the sink. */
 export interface TransitiveServerImportFinding extends ServerImportFinding {
-    /** `[routeFile, ...as-written specifiers…, sink]` — the shortest path the walk found. Length 2 means
+    /** `[routeFile, ...as-written specifiers…, sink]` - the shortest path the walk found. Length 2 means
      * the route imports the sink directly (same as the regex scan's direct edge). */
     readonly chain: readonly string[];
     /** True when a precise transitive resolve wasn't possible for the first hop (a bare pkg / path alias),
@@ -94,14 +108,14 @@ export type ModuleReader = (absPath: string) => string | undefined;
  * unresolvable alias). At each node, a by-name sink import (`node:fs`, `postgres`) OR a resolved
  * `*.server` / `server-only`-marked dependency terminates the chain. Bounded by depth + a visited set, so
  * it's linear and cycle-free. `routeFile`/`routeContent` seed the walk; `resolve`/`read` supply the graph
- * — pure given those, so it's unit-testable with a fake graph.
+ * - pure given those, so it's unit-testable with a fake graph.
  */
 export declare function walkServerOnlyChain(routeFile: string, routeContent: string, resolve: ModuleResolver, read: ModuleReader): readonly string[] | undefined;
 /**
  * Resolve the FULL transitive server-only chain(s) for a route module, given a real fs-backed resolver +
  * reader. For each of the route's top-level imports, if a precise transitive walk finds a sink, the
- * finding carries the full chain; otherwise — when the first hop is itself a direct by-name sink the
- * regex scan already flags, or when a relative import can't be resolved — it falls back to the DIRECT
+ * finding carries the full chain; otherwise - when the first hop is itself a direct by-name sink the
+ * regex scan already flags, or when a relative import can't be resolved - it falls back to the DIRECT
  * edge (`fallback: true`), never a fabricated chain. Returns one finding per offending top-level import,
  * de-duplicated to the shortest chain per first-hop specifier. Non-route files yield `[]`.
  */
@@ -115,7 +129,7 @@ export declare function scanProject(cwd: string): Promise<SourceFinding[]>;
 export interface ManifestDriftFinding {
     /** The committed server-manifest file (relative to cwd). */
     readonly file: string;
-    /** Route files in `routes/` missing from the manifest (stale manifest — these routes won't serve). */
+    /** Route files in `routes/` missing from the manifest (stale manifest - these routes won't serve). */
     readonly missing: readonly string[];
     /** Route files the manifest imports that no longer exist in `routes/` (a dangling import). */
     readonly extra: readonly string[];
@@ -129,17 +143,17 @@ export interface ManifestDriftFinding {
  * a per-manifest miss (an unreadable routes dir is simply skipped).
  */
 export declare function scanServerManifestDrift(cwd: string): Promise<ManifestDriftFinding[]>;
-/** A single machine-readable check failure — the unit an agent (or CI) acts on. */
+/** A single machine-readable check failure - the unit an agent (or CI) acts on. */
 export interface CheckDiagnostic {
-    readonly rule: "typecheck" | "typed-client" | "untyped-client" | "server-only-import" | "removed-import" | "response-route" | "undeclared-dependency" | "duplicate-install" | "server-manifest-drift" | "manifest-drift" | "capability-assurance" | "capability-config" | "check-config";
-    /** `error` fails the gate (a real contract break); `warning` is advisory — surfaced to the agent but
+    readonly rule: "typecheck" | "typed-client" | "untyped-client" | "server-only-import" | "removed-import" | "interpolated-sql" | "response-route" | "undeclared-dependency" | "duplicate-install" | "server-manifest-drift" | "manifest-drift" | "capability-assurance" | "capability-config" | "check-config";
+    /** `error` fails the gate (a real contract break); `warning` is advisory - surfaced to the agent but
      * does NOT fail `nifra check`, for patterns that are sometimes intentional (a route returning a raw
      * `Response`, which silently drops the typed client to `data: never` but is valid for files/redirects). */
     readonly severity: "error" | "warning";
     readonly file?: string;
     readonly line?: number;
     readonly message: string;
-    /** The canonical, rule-level fix — clean of the per-occurrence snippet, so an agent can apply it
+    /** The canonical, rule-level fix - clean of the per-occurrence snippet, so an agent can apply it
      * directly. Set for the lint rules (they have one correct fix); omitted for `typecheck` (the fix is
      * specific to each type error). */
     readonly fix?: string;
@@ -150,12 +164,12 @@ export interface CheckDiagnostic {
      * The import chain that pulls server-only code into the browser bundle, as display labels
      * `[routeFile, …as-written specifiers…, sink]`. Set only on `server-only-import`.
      *
-     * #4.4: this is now the FULL **transitive** chain — a bounded import-resolution walk (`Bun.resolveSync`
+     * #4.4: this is now the FULL **transitive** chain - a bounded import-resolution walk (`Bun.resolveSync`
      * from each file's dir, BFS the local module graph) follows `route → ../data → ../db → node:crypto`,
      * matching the build leak-guard's depth (`detectNodeBuiltinsInClient` in `@nifrajs/web/build`). A
      * length-2 chain (`[routeFile, specifier]`) means the route imports the sink directly. When a hop can't
      * be resolved precisely (a bare pkg, a tsconfig path alias), the walk degrades to the honest direct
-     * edge rather than fabricating a deeper path — never a lie.
+     * edge rather than fabricating a deeper path - never a lie.
      */
     readonly chain?: readonly string[];
 }
@@ -167,7 +181,7 @@ export interface CheckSuggestion {
     readonly command?: readonly string[];
     readonly steps?: readonly string[];
 }
-/** The structured result of a full check — what `--json` prints and the `nifra_check` MCP tool returns. */
+/** The structured result of a full check - what `--json` prints and the `nifra_check` MCP tool returns. */
 export interface CheckResult {
     readonly ok: boolean;
     readonly typecheck: "pass" | "fail" | "skipped";
@@ -176,7 +190,7 @@ export interface CheckResult {
      * better-auth). Echoed here so `--json` / the MCP tool / the report can show what the typed-client scan
      * deliberately skipped - a suppressed prefix stays auditable instead of silently hiding real drift. */
     readonly externalMounts?: readonly string[];
-    /** Set only when the caller passed `maxDiagnostics` and there were more — `diagnostics` then holds the
+    /** Set only when the caller passed `maxDiagnostics` and there were more - `diagnostics` then holds the
      * first `shown` of `total`. It caps the serialized size so the `nifra_check` MCP tool can't emit a
      * message large enough to break the stdio transport; fix the shown diagnostics and re-run for the rest. */
     readonly truncated?: {
@@ -184,6 +198,24 @@ export interface CheckResult {
         readonly total: number;
     };
 }
+/**
+ * Pre-resolved route-assurance inputs, so the same reflection that `nifra assure` / `nifra levels`
+ * already ran can feed `check`'s capability + trust-manifest diagnostics instead of a second pass.
+ * Supplied by {@link collectProjectVerification}. When omitted, `collectCheckResult` loads and computes
+ * these itself (the standalone `nifra_check` MCP path); the two routes produce byte-identical results.
+ */
+export interface CheckAssuranceContext {
+    /** Whether `nifra.assurance.ts` exists: the gate for running the assurance-fed diagnostics at all. */
+    readonly present: boolean;
+    /** The loaded config, when it loaded. Absent when the file is missing or {@link error} is set. */
+    readonly config?: AssuranceConfig;
+    /** The failure from loading/evaluating the config, surfaced as a `capability-config` diagnostic. */
+    readonly error?: unknown;
+    /** `evaluateRouteAssurance` over the config's source + policy (drives the trust-manifest check). */
+    readonly routeAssurance?: AssuranceReport;
+    /** Static capability provenance, when the config declares a capabilities policy. */
+    readonly capability?: CapabilityProjectReport;
+}
 /** Run the three checks and assemble a structured, machine-readable result. The single source the CLI
  * report, `--json`, and the MCP tool all render from. */
 export declare function collectCheckResult(cwd: string, opts?: {
@@ -192,6 +224,13 @@ export declare function collectCheckResult(cwd: string, opts?: {
     /** Cap the returned `diagnostics` to this many (adds {@link CheckResult.truncated}). The MCP tool sets
      * it so a huge project can't produce a transport-breaking result; the CLI leaves it unset (all shown). */
     readonly maxDiagnostics?: number;
+    /** How the interpolated-SQL rule gets its compiler. Injectable so the "not installed" path - the
+     * one where a security rule reports that it did not run - is testable on a machine that has it. */
+    readonly loadTypeScript?: () => Promise<TypeScriptApi | undefined>;
+    /** Route-assurance inputs already computed by {@link collectProjectVerification}. When present,
+     * the capability + trust-manifest diagnostics reuse them instead of loading/reflecting a second
+     * time; when absent, they are computed here (unchanged standalone behavior). */
+    readonly assurance?: CheckAssuranceContext;
 }): Promise<CheckResult>;
 /** Run the full check; print a report (`--json` for machine output) and return whether it passed. */
 export declare function runCheck(cwd: string, opts?: {

package/dist/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AACD;6GAC6G;AAC7G,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,oGAAoG;IACpG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAiCD,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AA6JD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAyCjD;AAED;;;8FAG8F;AAC9F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAoCpD;AA8FD;;;;kBAIkB;AAClB,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,cAAc,GAAE,SAAS,MAAM,EAAO,GACrC,aAAa,EAAE,CAkBjB;AAED,mGAAmG;AACnG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAOvF;AAQD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAahF;AA+CD;0EAC0E;AAC1E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAcjF;AAED;;qGAEqG;AACrG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAe1F;AAsDD;sGACsG;AACtG,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE5D;AAED;;gDAEgD;AAChD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED;kGACkG;AAClG,MAAM,WAAW,6BAA8B,SAAQ,mBAAmB;IACxE;qFACiF;IACjF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;sFACkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAC3B;AAED;;+EAE+E;AAC/E,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;AACxF,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;AAElE;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,YAAY,GACjB,SAAS,MAAM,EAAE,GAAG,SAAS,CA0C/B;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,YAAY,GACjB,6BAA6B,EAAE,CAkEjC;AAQD;gHACgH;AAChH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAuBjF;AAwCD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GAC5C,OAAO,CAAC,IAAI,CAAC,CAYf;AAKD,6DAA6D;AAC7D,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAIvE;AAgBD,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sGAAsG;IACtG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAgC1F;AAyDD,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EACT,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,uBAAuB,GACvB,mBAAmB,GACnB,uBAAuB,GACvB,gBAAgB,GAChB,sBAAsB,GACtB,mBAAmB,GACnB,cAAc,CAAA;IAClB;;+GAE2G;IAC3G,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;uCAEmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;wGACoG;IACpG,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,2GAA2G;AAC3G,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;IAChD;;2GAEuG;IACvG,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;+GAE2G;IAC3G,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CACxE;AAiLD;yDACyD;AACzD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IACJ,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B;8GAC0G;IAC1G,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAC5B,GACL,OAAO,CAAC,WAAW,CAAC,CAqWtB;AAED,qGAAqG;AACrG,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACnE,OAAO,CAAC,OAAO,CAAC,CAkFlB"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAG/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AACrE,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAA;AAEtF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AACD;6GAC6G;AAC7G,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,oGAAoG;IACpG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAiCD,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AA6JD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAyCjD;AAED;;;8FAG8F;AAC9F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAoCpD;AA8FD;;;;kBAIkB;AAClB,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,cAAc,GAAE,SAAS,MAAM,EAAO,GACrC,aAAa,EAAE,CAkBjB;AAED,mGAAmG;AACnG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAOvF;AA0ID,qFAAqF;AACrF,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,aAAa,GAChB,aAAa,EAAE,CAkCjB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,GAAG,SAAS,CAAC,CAMtF;AAQD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAahF;AA+CD;0EAC0E;AAC1E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAcjF;AAED;;qGAEqG;AACrG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAe1F;AAsDD;sGACsG;AACtG,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE5D;AAED;;gDAEgD;AAChD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED;kGACkG;AAClG,MAAM,WAAW,6BAA8B,SAAQ,mBAAmB;IACxE;qFACiF;IACjF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;sFACkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAC3B;AAED;;+EAE+E;AAC/E,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;AACxF,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;AAElE;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,YAAY,GACjB,SAAS,MAAM,EAAE,GAAG,SAAS,CA0C/B;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,YAAY,GACjB,6BAA6B,EAAE,CAkEjC;AAQD;gHACgH;AAChH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAuBjF;AAwCD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GAC5C,OAAO,CAAC,IAAI,CAAC,CAYf;AAKD,6DAA6D;AAC7D,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAIvE;AAgBD,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sGAAsG;IACtG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAgC1F;AAyDD,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EACT,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,oBAAoB,GACpB,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,uBAAuB,GACvB,mBAAmB,GACnB,uBAAuB,GACvB,gBAAgB,GAChB,sBAAsB,GACtB,mBAAmB,GACnB,cAAc,CAAA;IAClB;;+GAE2G;IAC3G,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;uCAEmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;wGACoG;IACpG,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,2GAA2G;AAC3G,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;IAChD;;2GAEuG;IACvG,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;+GAE2G;IAC3G,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CACxE;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,sGAAsG;IACtG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,kGAAkG;IAClG,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,oGAAoG;IACpG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB,oGAAoG;IACpG,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAA;IACzC,oFAAoF;IACpF,QAAQ,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAA;CAC9C;AAqLD;yDACyD;AACzD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IACJ,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B;8GAC0G;IAC1G,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;uGACmG;IACnG,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;IAClE;;oFAEgF;IAChF,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;CACtC,GACL,OAAO,CAAC,WAAW,CAAC,CA2atB;AAED,qGAAqG;AACrG,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACnE,OAAO,CAAC,OAAO,CAAC,CAsFlB"}