@nifrajs/mcp-db 3.3.0 → 4.0.0

package/dist/postgres.js

@@ -0,0 +1,580 @@
+/**
+ * `@nifrajs/mcp-db/postgres` - a read-only Postgres engine for a development database, on Bun's
+ * built-in `Bun.SQL` (no npm driver). Every layer below is enforced on each call, in this order:
+ *
+ *  1. Host gate ({@link connectPostgres}): loopback, `*.localhost` or a unix socket, else only a host
+ *     named in `allowHosts`. Connection fields are passed explicitly, so `DATABASE_URL`/`PG*` in the
+ *     environment can never redirect the connection.
+ *  2. Role gate: a superuser, a member of a superuser role or of `pg_execute_server_program` /
+ *     `pg_read_server_files` / `pg_write_server_files`, or a role that may execute the server-file
+ *     functions is refused - a read-only transaction does not stop `COPY ... TO PROGRAM` or
+ *     `pg_read_file`. {@link postgresRoleSql} prints the role to use instead.
+ *  3. Extension gate: `dblink`, `postgres_fdw`, `file_fdw` or an untrusted language the role can use
+ *     is refused unless `allowExtensions` names it - `dblink_exec` writes to another database from a
+ *     read-only transaction.
+ *  4. Transaction: every connection starts with `default_transaction_read_only=on`; each call runs in
+ *     `BEGIN READ ONLY` with `statement_timeout`, `lock_timeout` and
+ *     `idle_in_transaction_session_timeout` set locally, and always rolls back.
+ *  5. Statement gate: the query goes over the extended protocol (the server refuses a second
+ *     statement) as `DECLARE ... NO SCROLL CURSOR` (the server accepts only a query there), and at most
+ *     `maxRows + 1` rows are fetched. A tokenizer in front refuses side-effect functions.
+ *  6. Table scope: the plan's relations (and every table they inherit from) must sit in the allowed
+ *     schemas and outside `exclude`. A function can still read a table internally; hard isolation
+ *     comes from the role's grants, which {@link postgresRoleSql} writes with a REVOKE per exclusion.
+ *
+ *   const target = parsePostgresUrl("postgres://nifra_dev_reader@localhost:5432/app")
+ *   const client = connectPostgres(target, { timeoutMs: 5000 })
+ *   const rows = await queryPostgres(client, "SELECT status, count(*) FROM orders GROUP BY 1", {
+ *     timeoutMs: 5000, maxRows: 100, maxResultBytes: 100 * 1024,
+ *   })
+ */
+import { explainThroughServer, fetchThroughCursor, inReadOnlyTransaction, records, } from "./internal/pg-exec.js";
+import { DENIED_FUNCTION_PREFIXES, lintPostgres, withoutTerminator } from "./internal/pg-lexer.js";
+import { dbRefusal, fitToBytes, isDbRefusal, shapeRows, } from "./internal/shared.js";
+const SSL_MODES = ["disable", "allow", "prefer", "require", "verify-ca", "verify-full"];
+/**
+ * Parse a `postgres://` (or `postgresql://`) URL. Only the host, port, user, password, database and
+ * `sslmode` are read - any other parameter (`options=-c ...` included) is ignored, so a URL cannot
+ * switch off the read-only session settings.
+ */
+export function parsePostgresUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return dbRefusal("NIFRA_DB_CONFIG", "devDatabase.url is not a valid URL");
+    }
+    if (parsed.protocol !== "postgres:" && parsed.protocol !== "postgresql:") {
+        return dbRefusal("NIFRA_DB_CONFIG", "devDatabase.url must start with postgres:// or postgresql://");
+    }
+    const params = parsed.searchParams;
+    const queryHost = params.get("host") ?? undefined;
+    const host = (queryHost ?? decodeURIComponent(parsed.hostname)).replace(/^\[(.*)\]$/, "$1");
+    if (host.includes(",")) {
+        return dbRefusal("NIFRA_DB_CONFIG", "devDatabase.url names several hosts; name one");
+    }
+    const port = Number(parsed.port || params.get("port") || 5432);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        return dbRefusal("NIFRA_DB_CONFIG", "devDatabase.url has an invalid port");
+    }
+    const username = decodeURIComponent(parsed.username) || params.get("user") || "postgres";
+    const password = decodeURIComponent(parsed.password) || params.get("password") || undefined;
+    const database = decodeURIComponent(parsed.pathname.replace(/^\//, "")) || params.get("dbname") || username;
+    const sslmode = params.get("sslmode") ?? undefined;
+    const tls = SSL_MODES.find((mode) => mode === sslmode);
+    if (sslmode !== undefined && tls === undefined) {
+        return dbRefusal("NIFRA_DB_CONFIG", `devDatabase.url has an unknown sslmode ${sslmode}`);
+    }
+    const location = host === "" || host.startsWith("/")
+        ? { socket: `${host === "" ? "/tmp" : host.replace(/\/$/, "")}/.s.PGSQL.${port}` }
+        : { host };
+    return {
+        ...location,
+        port,
+        username,
+        database,
+        ...(password === undefined ? {} : { password }),
+        ...(tls === undefined ? {} : { tls }),
+    };
+}
+/** True for `localhost`, `*.localhost`, 127.0.0.0/8 and `::1` (also as an IPv4-mapped address). */
+export function isLocalPostgresHost(host) {
+    const name = host.toLowerCase().replace(/^\[(.*)\]$/, "$1");
+    if (name === "localhost" || name.endsWith(".localhost"))
+        return true;
+    const v4 = /^(?:::ffff:)?(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(name);
+    if (v4 !== null) {
+        const octets = v4.slice(1).map(Number);
+        return octets.every((octet) => octet <= 255) && octets[0] === 127;
+    }
+    return name === "::1" || name === "0:0:0:0:0:0:0:1";
+}
+/** Refuse a TCP host that is neither local nor named in `allowHosts`. */
+export function postgresHostRefusal(target, allowHosts = []) {
+    if (target.socket !== undefined || target.host === undefined)
+        return undefined;
+    if (isLocalPostgresHost(target.host))
+        return undefined;
+    const host = target.host.toLowerCase();
+    if (allowHosts.some((allowed) => allowed.toLowerCase() === host))
+        return undefined;
+    return dbRefusal("NIFRA_DB_REMOTE_HOST", `${target.host} is not a local host, and devDatabase.allowHosts does not name it`);
+}
+/**
+ * Open a one-connection `Bun.SQL` client for `target` after the host gate. Every session starts
+ * read-only with `standard_conforming_strings` on (the statement tokenizer reads strings that way).
+ */
+export function connectPostgres(target, options) {
+    const refusal = postgresHostRefusal(target, options.allowHosts);
+    if (refusal !== undefined)
+        return refusal;
+    if (typeof Bun === "undefined") {
+        return dbRefusal("NIFRA_DB_DRIVER", "the Postgres engine needs Bun (it uses Bun.SQL)");
+    }
+    return new Bun.SQL({
+        adapter: "postgres",
+        ...(target.socket === undefined ? { hostname: target.host } : { path: target.socket }),
+        port: target.port,
+        username: target.username,
+        ...(target.password === undefined ? {} : { password: target.password }),
+        database: target.database,
+        ...(target.tls === undefined ? {} : { tls: target.tls }),
+        max: 1,
+        bigint: true,
+        connectionTimeout: Math.max(1, Math.ceil(options.timeoutMs / 1000)),
+        connection: {
+            application_name: "nifra-db",
+            default_transaction_read_only: "on",
+            standard_conforming_strings: "on",
+            statement_timeout: options.timeoutMs,
+            idle_in_transaction_session_timeout: options.timeoutMs,
+        },
+    });
+}
+const asStrings = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+async function readRole(connection) {
+    const [row] = records(await connection `
+    SELECT current_user::text AS role,
+      r.rolsuper AS superuser,
+      pg_catalog.current_setting('server_version_num')::int AS version,
+      to_json(ARRAY(SELECT s.rolname::text FROM pg_catalog.pg_roles s
+        WHERE s.rolsuper AND s.rolname <> current_user
+          AND pg_catalog.pg_has_role(current_user, s.oid, 'MEMBER') ORDER BY 1)) AS superuser_roles,
+      to_json(ARRAY(SELECT p.rolname::text FROM pg_catalog.pg_roles p
+        WHERE p.rolname IN ('pg_execute_server_program', 'pg_read_server_files', 'pg_write_server_files')
+          AND pg_catalog.pg_has_role(current_user, p.oid, 'MEMBER') ORDER BY 1)) AS server_roles,
+      to_json(ARRAY(SELECT DISTINCT f.proname::text FROM pg_catalog.pg_proc f
+        WHERE f.pronamespace = 'pg_catalog'::regnamespace
+          AND f.proname IN ('pg_read_file', 'pg_read_binary_file', 'pg_ls_dir', 'pg_stat_file', 'lo_import', 'lo_export')
+          AND pg_catalog.has_function_privilege(f.oid, 'EXECUTE') ORDER BY 1)) AS file_functions,
+      to_json(ARRAY(
+        SELECT e.extname::text FROM pg_catalog.pg_extension e
+        WHERE e.extname = 'dblink' AND EXISTS (
+          SELECT 1 FROM pg_catalog.pg_depend d JOIN pg_catalog.pg_proc p ON p.oid = d.objid
+          WHERE d.classid = 'pg_catalog.pg_proc'::regclass AND d.refclassid = 'pg_catalog.pg_extension'::regclass
+            AND d.refobjid = e.oid AND d.deptype = 'e' AND pg_catalog.has_function_privilege(p.oid, 'EXECUTE'))
+        UNION
+        SELECT w.fdwname::text FROM pg_catalog.pg_foreign_data_wrapper w
+        WHERE w.fdwname IN ('postgres_fdw', 'file_fdw') AND (
+          pg_catalog.has_foreign_data_wrapper_privilege(w.oid, 'USAGE') OR EXISTS (
+            SELECT 1 FROM pg_catalog.pg_foreign_table ft JOIN pg_catalog.pg_foreign_server fs ON fs.oid = ft.ftserver
+            WHERE fs.srvfdw = w.oid AND pg_catalog.has_table_privilege(ft.ftrelid, 'SELECT')))
+        ORDER BY 1)) AS extensions,
+      to_json(ARRAY(SELECT l.lanname::text FROM pg_catalog.pg_language l
+        WHERE NOT l.lanpltrusted AND l.lanname NOT IN ('c', 'internal') AND (
+          pg_catalog.has_language_privilege(l.oid, 'USAGE') OR EXISTS (
+            SELECT 1 FROM pg_catalog.pg_proc p WHERE p.prolang = l.oid
+              AND pg_catalog.has_function_privilege(p.oid, 'EXECUTE')))
+        ORDER BY 1)) AS languages
+    FROM pg_catalog.pg_roles r WHERE r.rolname = current_user`);
+    if (row === undefined)
+        throw new Error("the connected role is not in pg_roles");
+    return {
+        role: String(row.role),
+        superuser: row.superuser === true,
+        serverVersionNum: Number(row.version),
+        superuserRoles: asStrings(row.superuser_roles),
+        serverRoles: asStrings(row.server_roles),
+        fileFunctions: asStrings(row.file_functions),
+        extensions: asStrings(row.extensions),
+        languages: asStrings(row.languages),
+    };
+}
+/** Read the connected role's privileges, in a read-only transaction. */
+export function inspectPostgresRole(client, options) {
+    return inReadOnlyTransaction(client, options.timeoutMs, readRole);
+}
+/** The role gate and the extension gate, as one decision over a {@link PostgresRoleReport}. */
+export function postgresRoleRefusal(report, options = {}) {
+    const role = JSON.stringify(report.role);
+    if (report.superuser)
+        return dbRefusal("NIFRA_DB_SUPERUSER", `role ${role} is a superuser`);
+    if (report.superuserRoles.length > 0) {
+        return dbRefusal("NIFRA_DB_SUPERUSER", `role ${role} is a member of the superuser role ${report.superuserRoles.join(", ")}`);
+    }
+    if (report.serverRoles.length > 0) {
+        return dbRefusal("NIFRA_DB_SUPERUSER", `role ${role} is a member of ${report.serverRoles.join(", ")}, which reach server programs or files`);
+    }
+    if (report.fileFunctions.length > 0) {
+        return dbRefusal("NIFRA_DB_SUPERUSER", `role ${role} may execute ${report.fileFunctions.join(", ")}, which read or write server files`);
+    }
+    const allowed = new Set((options.allowExtensions ?? []).map((name) => name.toLowerCase()));
+    const usable = [...report.extensions, ...report.languages].filter((name) => !allowed.has(name.toLowerCase()));
+    if (usable.length > 0) {
+        return dbRefusal("NIFRA_DB_EXTENSION", `role ${role} can use ${usable.join(", ")}, which can reach outside this database`);
+    }
+    return undefined;
+}
+/** Refuse what the tokenizer layer refuses: a non-query, several statements, a denied function. */
+export function lintPostgresStatement(sql) {
+    const refusal = lintPostgres(sql);
+    if (refusal === undefined)
+        return undefined;
+    return dbRefusal(refusal.kind === "function" ? "NIFRA_DB_FUNCTION_REFUSED" : "NIFRA_DB_WRITE_REFUSED", refusal.message);
+}
+function scopeMatcher(scope) {
+    const schemas = new Set((scope.schemas ?? ["public"]).map((name) => name.toLowerCase()));
+    const excluded = new Set((scope.exclude ?? []).map((name) => name.toLowerCase()));
+    return ({ schema, name }) => {
+        const qualified = `${schema}.${name}`;
+        if (!schemas.has(schema.toLowerCase())) {
+            return `the query reads ${qualified}, outside the allowed schemas (${[...schemas].join(", ")})`;
+        }
+        if (excluded.has(name.toLowerCase()) || excluded.has(qualified.toLowerCase())) {
+            return `the query reads ${qualified}, which devDatabase.exclude leaves out`;
+        }
+        return undefined;
+    };
+}
+/**
+ * The plan-level table check: each relation, and every table it inherits from (partitions too). A
+ * `pg_*` function in FROM reads server state the way a catalog does - a system view such as
+ * `pg_stat_activity` plans as one once the planner drops its catalog joins - so it is out of scope too.
+ * With `masked`, a plan expression that uses a masked column, or a whole row holding one, is refused.
+ */
+function checkScope(scope, masked) {
+    const outOfScope = scopeMatcher(scope);
+    return async (connection, reads) => {
+        for (const fn of reads.functions) {
+            const name = fn.name.toLowerCase();
+            if (fn.schema === "pg_catalog" && name.startsWith("pg_")) {
+                return dbRefusal("NIFRA_DB_TABLE_EXCLUDED", `the query reads server state through ${fn.schema}.${fn.name}(), a system catalog function`);
+            }
+            if (DENIED_FUNCTION_PREFIXES.some((prefix) => name.startsWith(prefix))) {
+                return dbRefusal("NIFRA_DB_FUNCTION_REFUSED", `the query calls ${fn.schema}.${fn.name}(), which reaches outside a read-only query`);
+            }
+        }
+        const { relations } = reads;
+        for (const relation of relations) {
+            const reason = outOfScope(relation);
+            if (reason !== undefined)
+                return dbRefusal("NIFRA_DB_TABLE_EXCLUDED", reason);
+        }
+        if (relations.length === 0)
+            return undefined;
+        const ancestors = records(await connection `
+      WITH RECURSIVE planned AS (
+        SELECT pg_catalog.to_regclass(pg_catalog.quote_ident(r.schema) || '.' || pg_catalog.quote_ident(r.name))::oid AS oid
+        FROM pg_catalog.json_to_recordset(${[...relations]}::json) AS r(schema text, name text)
+      ), up(oid) AS (
+        SELECT i.inhparent FROM pg_catalog.pg_inherits i JOIN planned p ON i.inhrelid = p.oid
+        UNION
+        SELECT i.inhparent FROM pg_catalog.pg_inherits i JOIN up ON i.inhrelid = up.oid
+      )
+      SELECT n.nspname::text AS schema, c.relname::text AS name
+      FROM up JOIN pg_catalog.pg_class c ON c.oid = up.oid
+      JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace`);
+        for (const row of ancestors) {
+            const reason = outOfScope({ schema: String(row.schema), name: String(row.name) });
+            if (reason !== undefined)
+                return dbRefusal("NIFRA_DB_TABLE_EXCLUDED", reason);
+        }
+        if (masked === undefined)
+            return undefined;
+        const hits = new Set();
+        const wholeRows = [];
+        for (const { relation, column } of reads.columns) {
+            if (column === "*")
+                wholeRows.push(relation);
+            else if (masked(column))
+                hits.add(`${relation.name}.${column}`);
+        }
+        const listed = [...wholeRows, ...reads.outputs.map((output) => output.relation)];
+        if (listed.length > 0) {
+            const live = new Map();
+            const rows = records(await connection `
+        SELECT r.schema, r.name, a.attname::text AS column
+        FROM pg_catalog.json_to_recordset(${listed}::json) AS r(schema text, name text)
+        JOIN pg_catalog.pg_attribute a
+          ON a.attrelid = pg_catalog.to_regclass(pg_catalog.quote_ident(r.schema) || '.' || pg_catalog.quote_ident(r.name))
+        WHERE a.attnum > 0 AND NOT a.attisdropped`);
+            for (const row of rows) {
+                const key = `${String(row.schema)}.${String(row.name)}`;
+                live.set(key, [...(live.get(key) ?? []), String(row.column)]);
+            }
+            const columnsOf = (relation) => live.get(`${relation.schema}.${relation.name}`) ?? [];
+            for (const relation of wholeRows) {
+                for (const column of columnsOf(relation))
+                    if (masked(column))
+                        hits.add(`${relation.name}.${column}`);
+            }
+            for (const output of reads.outputs) {
+                const all = columnsOf(output.relation);
+                // Every column is the physical target list: the parent's expressions say what it uses.
+                if (all.length > 0 && all.every((column) => output.columns.includes(column)))
+                    continue;
+                for (const column of output.columns)
+                    if (masked(column))
+                        hits.add(`${output.relation.name}.${column}`);
+            }
+        }
+        if (hits.size === 0)
+            return undefined;
+        return dbRefusal("NIFRA_DB_COLUMN_REFUSED", `the query reads ${[...hits].join(", ")}, masked as ${hits.size === 1 ? "a credential" : "credentials"}`);
+    };
+}
+async function gated(client, sql, options, work) {
+    const linted = lintPostgresStatement(sql);
+    if (linted !== undefined)
+        return linted;
+    return inReadOnlyTransaction(client, options.timeoutMs, async (connection) => {
+        const refusal = postgresRoleRefusal(await readRole(connection), options);
+        if (refusal !== undefined)
+            return refusal;
+        return work(connection, withoutTerminator(sql.trim()));
+    });
+}
+/**
+ * Run one read-only query through every layer and return capped rows. A column `redaction.column`
+ * masks is refused wherever the plan uses it (selected under any alias, inside an expression, in a
+ * filter, or within a whole row); a matching result name is masked as well.
+ */
+export async function queryPostgres(client, sql, options) {
+    const fetched = await gated(client, sql, options, (connection, statement) => fetchThroughCursor(connection, statement, {
+        maxRows: options.maxRows,
+        scope: checkScope(options, options.redaction?.column),
+    }));
+    if (isDbRefusal(fetched))
+        return fetched;
+    return shapeRows(fetched.columns, fetched.rows, options);
+}
+/** Drop plan children below `depth` so an oversized plan still says what its top does. */
+function prunePlan(node, depth) {
+    if (Array.isArray(node))
+        return node.map((item) => prunePlan(item, depth));
+    if (typeof node !== "object" || node === null)
+        return node;
+    const out = {};
+    for (const [key, value] of Object.entries(node)) {
+        if (key === "Plans") {
+            if (depth > 0)
+                out[key] = prunePlan(value, depth - 1);
+        }
+        else
+            out[key] = key === "Plan" ? prunePlan(value, depth) : value;
+    }
+    return out;
+}
+/** `EXPLAIN (FORMAT JSON)` for one query, after the same layers as {@link queryPostgres}. */
+export async function explainPostgres(client, sql, options) {
+    const explained = await gated(client, sql, options, (connection, statement) => explainThroughServer(connection, statement, {
+        analyze: options.analyze === true,
+        scope: checkScope(options),
+    }));
+    if (isDbRefusal(explained))
+        return explained;
+    const full = JSON.stringify(explained.plan);
+    if (new TextEncoder().encode(full).byteLength <= options.maxResultBytes) {
+        return { plan: explained.plan, analyzed: options.analyze === true, truncated: false };
+    }
+    const fit = fitToBytes(32, (depth) => prunePlan(explained.plan, depth), options.maxResultBytes);
+    return { plan: fit?.value ?? null, analyzed: options.analyze === true, truncated: true };
+}
+const RELKINDS = {
+    r: "table",
+    p: "partitioned table",
+    v: "view",
+    m: "materialized view",
+    f: "foreign table",
+};
+const jsonValues = (value) => {
+    const parsed = typeof value === "string" ? JSON.parse(value) : value;
+    return Array.isArray(parsed) ? parsed : [];
+};
+const jsonStrings = (value) => asStrings(jsonValues(value));
+/**
+ * Describe the readable tables and views in the allowed schemas from `pg_catalog`, with queries this
+ * module writes (no caller SQL runs), so it works on any role: columns, primary keys, foreign keys,
+ * indexes and the planner's row estimate.
+ */
+export async function readPostgresSchema(client, options) {
+    const schemas = [...(options.schemas ?? ["public"])];
+    const excluded = new Set((options.exclude ?? []).map((name) => name.toLowerCase()));
+    const isExcluded = (schema, name) => excluded.has(name.toLowerCase()) || excluded.has(`${schema}.${name}`.toLowerCase());
+    const wanted = options.table?.toLowerCase();
+    const matchesWanted = (schema, name) => wanted === undefined ||
+        name.toLowerCase() === wanted ||
+        `${schema}.${name}`.toLowerCase() === wanted;
+    return inReadOnlyTransaction(client, options.timeoutMs, async (connection) => {
+        const relations = records(await connection `
+      SELECT n.nspname::text AS schema, c.relname::text AS name, c.relkind::text AS kind,
+        c.reltuples::float8 AS estimate,
+        to_json(ARRAY(
+          WITH RECURSIVE reach(oid) AS (
+            SELECT c.oid
+            UNION
+            SELECT next.oid FROM reach, LATERAL (
+              SELECT i.inhparent AS oid FROM pg_catalog.pg_inherits i WHERE i.inhrelid = reach.oid
+              UNION ALL
+              SELECT d.refobjid FROM pg_catalog.pg_rewrite w
+              JOIN pg_catalog.pg_depend d ON d.classid = 'pg_catalog.pg_rewrite'::regclass
+                AND d.objid = w.oid AND d.refclassid = 'pg_catalog.pg_class'::regclass
+              WHERE w.ev_class = reach.oid
+            ) AS next
+          )
+          SELECT pg_catalog.json_build_array(pn.nspname::text, pc.relname::text) FROM reach
+          JOIN pg_catalog.pg_class pc ON pc.oid = reach.oid
+          JOIN pg_catalog.pg_namespace pn ON pn.oid = pc.relnamespace
+          WHERE reach.oid <> c.oid)) AS reaches
+      FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+      WHERE c.relkind IN ('r', 'p', 'v', 'm', 'f') AND NOT c.relispartition
+        AND n.nspname = ANY(ARRAY(SELECT pg_catalog.json_array_elements_text(${schemas}::json)))
+        AND pg_catalog.has_table_privilege(c.oid, 'SELECT')
+      ORDER BY 1, 2`);
+        const columns = records(await connection `
+      SELECT n.nspname::text AS schema, c.relname::text AS table, a.attname::text AS name,
+        pg_catalog.format_type(a.atttypid, a.atttypmod) AS type, NOT a.attnotnull AS nullable,
+        pg_catalog.pg_get_expr(d.adbin, d.adrelid) AS default_value,
+        EXISTS (SELECT 1 FROM pg_catalog.pg_constraint k
+          WHERE k.conrelid = c.oid AND k.contype = 'p' AND a.attnum = ANY(k.conkey)) AS primary_key
+      FROM pg_catalog.pg_attribute a
+      JOIN pg_catalog.pg_class c ON c.oid = a.attrelid
+      JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+      LEFT JOIN pg_catalog.pg_attrdef d ON d.adrelid = a.attrelid AND d.adnum = a.attnum
+      WHERE a.attnum > 0 AND NOT a.attisdropped AND c.relkind IN ('r', 'p', 'v', 'm', 'f')
+        AND n.nspname = ANY(ARRAY(SELECT pg_catalog.json_array_elements_text(${schemas}::json)))
+      ORDER BY 1, 2, a.attnum`);
+        const foreignKeys = records(await connection `
+      SELECT n.nspname::text AS schema, c.relname::text AS table,
+        to_json(ARRAY(SELECT a.attname::text FROM unnest(k.conkey) WITH ORDINALITY AS u(num, ord)
+          JOIN pg_catalog.pg_attribute a ON a.attrelid = k.conrelid AND a.attnum = u.num ORDER BY u.ord)) AS columns,
+        fn.nspname::text AS ref_schema, fc.relname::text AS ref_table,
+        to_json(ARRAY(SELECT a.attname::text FROM unnest(k.confkey) WITH ORDINALITY AS u(num, ord)
+          JOIN pg_catalog.pg_attribute a ON a.attrelid = k.confrelid AND a.attnum = u.num ORDER BY u.ord)) AS ref_columns
+      FROM pg_catalog.pg_constraint k
+      JOIN pg_catalog.pg_class c ON c.oid = k.conrelid
+      JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+      JOIN pg_catalog.pg_class fc ON fc.oid = k.confrelid
+      JOIN pg_catalog.pg_namespace fn ON fn.oid = fc.relnamespace
+      WHERE k.contype = 'f'
+        AND n.nspname = ANY(ARRAY(SELECT pg_catalog.json_array_elements_text(${schemas}::json)))
+      ORDER BY 1, 2, k.conname`);
+        const indexes = records(await connection `
+      SELECT n.nspname::text AS schema, t.relname::text AS table, i.relname::text AS name,
+        x.indisunique AS is_unique,
+        to_json(ARRAY(SELECT pg_catalog.pg_get_indexdef(x.indexrelid, k, true)
+          FROM generate_series(1, x.indnkeyatts) AS k ORDER BY k)) AS columns
+      FROM pg_catalog.pg_index x
+      JOIN pg_catalog.pg_class i ON i.oid = x.indexrelid
+      JOIN pg_catalog.pg_class t ON t.oid = x.indrelid
+      JOIN pg_catalog.pg_namespace n ON n.oid = t.relnamespace
+      WHERE n.nspname = ANY(ARRAY(SELECT pg_catalog.json_array_elements_text(${schemas}::json)))
+      ORDER BY 1, 2, 3`);
+        const key = (schema, name) => `${String(schema)}.${String(name)}`;
+        const text = (value) => options.redaction?.text?.(value) ?? value;
+        // What the query scope would refuse is hidden too: a table inheriting from an excluded one, and a
+        // view reading one (or reading outside the allowed schemas).
+        const allowedSchemas = new Set(schemas.map((name) => name.toLowerCase()));
+        const outOfScope = (ancestor) => {
+            const [schema, name] = asStrings(ancestor);
+            return (schema === undefined ||
+                name === undefined ||
+                !allowedSchemas.has(schema.toLowerCase()) ||
+                isExcluded(schema, name));
+        };
+        const visible = relations.filter((row) => !isExcluded(String(row.schema), String(row.name)) &&
+            !jsonValues(row.reaches).some(outOfScope));
+        const shown = visible.filter((row) => matchesWanted(String(row.schema), String(row.name)));
+        if (wanted !== undefined && shown.length === 0) {
+            return dbRefusal("NIFRA_DB_TABLE_EXCLUDED", `${JSON.stringify(options.table)} is not an exposed table or view of this database`);
+        }
+        const tables = shown.map((row) => {
+            const id = key(row.schema, row.name);
+            const kind = RELKINDS[String(row.kind)] ?? "table";
+            const estimate = Number(row.estimate);
+            return {
+                schema: String(row.schema),
+                name: String(row.name),
+                kind,
+                rowEstimate: kind === "view" || !Number.isFinite(estimate) || estimate < 0
+                    ? null
+                    : Math.round(estimate),
+                columns: columns
+                    .filter((column) => key(column.schema, column.table) === id)
+                    .map((column) => ({
+                    name: String(column.name),
+                    type: String(column.type),
+                    nullable: column.nullable === true,
+                    default: typeof column.default_value === "string" ? text(column.default_value) : null,
+                    primaryKey: column.primary_key === true,
+                    redacted: options.redaction?.column?.(String(column.name)) === true,
+                })),
+                foreignKeys: foreignKeys
+                    .filter((fk) => key(fk.schema, fk.table) === id)
+                    .map((fk) => ({
+                    columns: jsonStrings(fk.columns),
+                    references: {
+                        schema: String(fk.ref_schema),
+                        table: String(fk.ref_table),
+                        columns: jsonStrings(fk.ref_columns),
+                    },
+                })),
+                indexes: indexes
+                    .filter((index) => key(index.schema, index.table) === id)
+                    .map((index) => ({
+                    name: String(index.name),
+                    unique: index.is_unique === true,
+                    columns: jsonStrings(index.columns),
+                })),
+            };
+        });
+        return { tables, excludedCount: relations.length - visible.length };
+    });
+}
+const quoteIdent = (name) => `"${name.replaceAll('"', '""')}"`;
+/**
+ * Write the SQL for a login role that can read the allowed schemas and nothing else: `pg_read_all_data`
+ * on Postgres 14+ when nothing is excluded; otherwise `GRANT SELECT` per schema plus default
+ * privileges, and a `REVOKE` for each excluded table and its partitions (`pg_read_all_data` would
+ * override a REVOKE, so it is not used then). Nothing is executed.
+ */
+export async function postgresRoleSql(client, options) {
+    const role = options.role ?? "nifra_dev_reader";
+    const schemas = options.schemas ?? ["public"];
+    const exclude = (options.exclude ?? []).map((name) => name.toLowerCase());
+    return inReadOnlyTransaction(client, options.timeoutMs, async (connection) => {
+        const [facts] = records(await connection `
+      SELECT pg_catalog.current_database()::text AS database,
+        pg_catalog.current_setting('server_version_num')::int AS version`);
+        const excluded = exclude.length === 0
+            ? []
+            : records(await connection `
+      WITH RECURSIVE picked AS (
+        SELECT c.oid FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+        WHERE c.relkind IN ('r', 'p', 'v', 'm', 'f')
+          AND n.nspname = ANY(ARRAY(SELECT pg_catalog.json_array_elements_text(${[...schemas]}::json)))
+          AND (lower(c.relname) = ANY(ARRAY(SELECT pg_catalog.json_array_elements_text(${exclude}::json)))
+            OR lower(n.nspname || '.' || c.relname) = ANY(ARRAY(SELECT pg_catalog.json_array_elements_text(${exclude}::json))))
+        UNION
+        SELECT i.inhrelid FROM pg_catalog.pg_inherits i JOIN picked p ON i.inhparent = p.oid
+      )
+      SELECT n.nspname::text AS schema, c.relname::text AS name
+      FROM picked JOIN pg_catalog.pg_class c ON c.oid = picked.oid
+      JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+      ORDER BY 1, 2`);
+        const database = String(facts?.database ?? "");
+        const version = Number(facts?.version ?? 0);
+        const who = quoteIdent(role);
+        const statements = [
+            `-- Run as the owner of the app's tables (or a superuser). Then set the password from psql with \\password ${role}`,
+            `-- and point devDatabase.url at postgres://${role}:<password>@localhost/${database}`,
+            `CREATE ROLE ${who} LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;`,
+            `ALTER ROLE ${who} SET default_transaction_read_only = on;`,
+            `GRANT CONNECT ON DATABASE ${quoteIdent(database)} TO ${who};`,
+        ];
+        if (version >= 140000 && excluded.length === 0) {
+            statements.push(`GRANT pg_read_all_data TO ${who};`);
+        }
+        else {
+            for (const schema of schemas) {
+                statements.push(`GRANT USAGE ON SCHEMA ${quoteIdent(schema)} TO ${who};`, `GRANT SELECT ON ALL TABLES IN SCHEMA ${quoteIdent(schema)} TO ${who};`, `ALTER DEFAULT PRIVILEGES IN SCHEMA ${quoteIdent(schema)} GRANT SELECT ON TABLES TO ${who};`);
+            }
+            for (const row of excluded) {
+                statements.push(`REVOKE SELECT ON TABLE ${quoteIdent(String(row.schema))}.${quoteIdent(String(row.name))} FROM ${who};`);
+            }
+        }
+        return { role, database, serverVersionNum: version, statements };
+    });
+}
+//# sourceMappingURL=postgres.js.map

package/dist/postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../src/postgres.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EAKrB,OAAO,GACR,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAClG,OAAO,EAOL,SAAS,EACT,UAAU,EACV,WAAW,EAEX,SAAS,GACV,MAAM,sBAAsB,CAAA;AAiB7B,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAU,CAAA;AAEhG;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACzE,OAAO,SAAS,CACd,iBAAiB,EACjB,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAA;IAClC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAA;IACjD,MAAM,IAAI,GAAG,CAAC,SAAS,IAAI,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;IAC3F,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAA;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAA;IACxF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAA;IAC3F,MAAM,QAAQ,GACZ,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAA;IAC5F,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAA;IAClD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAA;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC,iBAAiB,EAAE,0CAA0C,OAAO,EAAE,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,QAAQ,GACZ,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACjC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,IAAI,EAAE,EAAE;QAClF,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IACd,OAAO;QACL,GAAG,QAAQ;QACX,IAAI;QACJ,QAAQ;QACR,QAAQ;QACR,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;KACtC,CAAA;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;IAC3D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,MAAM,EAAE,GAAG,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChF,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAA;IACnE,CAAC;IACD,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,iBAAiB,CAAA;AACrD,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,MAAsB,EACtB,aAAgC,EAAE;IAElC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC9E,IAAI,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IACtC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAClF,OAAO,SAAS,CACd,sBAAsB,EACtB,GAAG,MAAM,CAAC,IAAI,mEAAmE,CAClF,CAAA;AACH,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAsB,EACtB,OAA+B;IAE/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAA;IACzC,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC,iBAAiB,EAAE,iDAAiD,CAAC,CAAA;IACxF,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC;QACjB,OAAO,EAAE,UAAU;QACnB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACtF,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvE,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACxD,GAAG,EAAE,CAAC;QACN,MAAM,EAAE,IAAI;QACZ,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QACnE,UAAU,EAAE;YACV,gBAAgB,EAAE,UAAU;YAC5B,6BAA6B,EAAE,IAAI;YACnC,2BAA2B,EAAE,IAAI;YACjC,iBAAiB,EAAE,OAAO,CAAC,SAAS;YACpC,mCAAmC,EAAE,OAAO,CAAC,SAAS;SACvD;KACF,CAAC,CAAA;AACJ,CAAC;AAmBD,MAAM,SAAS,GAAG,CAAC,KAAc,EAAY,EAAE,CAC7C,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAE9F,KAAK,UAAU,QAAQ,CAAC,UAAwB;IAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CACnB,MAAM,UAAU,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8DAiC0C,CAC3D,CAAA;IACD,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC/E,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS,KAAK,IAAI;QACjC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QACrC,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC;QAC9C,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC;QACxC,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC;QAC5C,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;QACrC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC;KACpC,CAAA;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CACjC,MAAsB,EACtB,OAAuC;IAEvC,OAAO,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;AACnE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CACjC,MAA0B,EAC1B,UAA4D,EAAE;IAE9D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC,oBAAoB,EAAE,QAAQ,IAAI,iBAAiB,CAAC,CAAA;IAC3F,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CACd,oBAAoB,EACpB,QAAQ,IAAI,sCAAsC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrF,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CACd,oBAAoB,EACpB,QAAQ,IAAI,mBAAmB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,CACrG,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CACd,oBAAoB,EACpB,QAAQ,IAAI,gBAAgB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,CAChG,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IAC1F,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAC/D,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC3C,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CACd,oBAAoB,EACpB,QAAQ,IAAI,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,CACnF,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3C,OAAO,SAAS,CACd,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,wBAAwB,EACpF,OAAO,CAAC,OAAO,CAChB,CAAA;AACH,CAAC;AAUD,SAAS,YAAY,CAAC,KAAoB;IACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACxF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACjF,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAA;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACvC,OAAO,mBAAmB,SAAS,kCAAkC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QACjG,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC9E,OAAO,mBAAmB,SAAS,wCAAwC,CAAA;QAC7E,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAoB,EAAE,MAAoC;IAC5E,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IACtC,OAAO,KAAK,EAAE,UAAwB,EAAE,KAAgB,EAAkC,EAAE;QAC1F,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;YAClC,IAAI,EAAE,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzD,OAAO,SAAS,CACd,yBAAyB,EACzB,wCAAwC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,+BAA+B,CAC5F,CAAA;YACH,CAAC;YACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvE,OAAO,SAAS,CACd,2BAA2B,EAC3B,mBAAmB,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,6CAA6C,CACrF,CAAA;YACH,CAAC;QACH,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;QAC3B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;YACnC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QAC5C,MAAM,SAAS,GAAG,OAAO,CACvB,MAAM,UAAU,CAAA;;;4CAGsB,CAAC,GAAG,SAAS,CAAC;;;;;;;;+DAQK,CAC1D,CAAA;QACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACjF,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,MAAM,SAAS,GAAmB,EAAE,CAAA;QACpC,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACjD,IAAI,MAAM,KAAK,GAAG;gBAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;iBACvC,IAAI,MAAM,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;QAChF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAA;YACxC,MAAM,IAAI,GAAG,OAAO,CAClB,MAAM,UAAU,CAAA;;4CAEoB,MAAM;;;kDAGA,CAC3C,CAAA;YACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAA;gBACvD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YAC/D,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,QAAsB,EAAqB,EAAE,CAC9D,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAA;YACvD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC;oBACtC,IAAI,MAAM,CAAC,MAAM,CAAC;wBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC,CAAA;YAC9D,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACtC,uFAAuF;gBACvF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAAE,SAAQ;gBACtF,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO;oBACjC,IAAI,MAAM,CAAC,MAAM,CAAC;wBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC,CAAA;YACrE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QACrC,OAAO,SAAS,CACd,yBAAyB,EACzB,mBAAmB,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,EAAE,CACzG,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AASD,KAAK,UAAU,KAAK,CAClB,MAAsB,EACtB,GAAW,EACX,OAA6B,EAC7B,IAA6E;IAE7E,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IACvC,OAAO,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QAC3E,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;QACxE,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAA;QACzC,OAAO,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAsB,EACtB,GAAW,EACX,OAA6B;IAE7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,CAC1E,kBAAkB,CAAC,UAAU,EAAE,SAAS,EAAE;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;KACtD,CAAC,CACH,CAAA;IACD,IAAI,WAAW,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAA;IACxC,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAC1D,CAAC;AAED,0FAA0F;AAC1F,SAAS,SAAS,CAAC,IAAa,EAAE,KAAa;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,GAAG,GAA4B,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,IAAI,KAAK,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;QACvD,CAAC;;YAAM,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACpE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAsB,EACtB,GAAW,EACX,OAA8D;IAE9D,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,CAC5E,oBAAoB,CAAC,UAAU,EAAE,SAAS,EAAE;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;QACjC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;KAC3B,CAAC,CACH,CAAA;IACD,IAAI,WAAW,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAC3C,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IACvF,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAC/F,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAC1F,CAAC;AAED,MAAM,QAAQ,GAAoD;IAChE,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,mBAAmB;IACtB,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,mBAAmB;IACtB,CAAC,EAAE,eAAe;CACnB,CAAA;AAUD,MAAM,UAAU,GAAG,CAAC,KAAc,EAAa,EAAE;IAC/C,MAAM,MAAM,GAAY,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC7E,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5C,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,KAAc,EAAY,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAsB,EACtB,OAA8B;IAE9B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACnF,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,IAAY,EAAW,EAAE,CAC3D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,CAAA;IAC3C,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,IAAY,EAAW,EAAE,CAC9D,MAAM,KAAK,SAAS;QACpB,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM;QAC7B,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAA;IAC9C,OAAO,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QAC3E,MAAM,SAAS,GAAG,OAAO,CACvB,MAAM,UAAU,CAAA;;;;;;;;;;;;;;;;;;;;;;+EAsByD,OAAO;;oBAElE,CACf,CAAA;QACD,MAAM,OAAO,GAAG,OAAO,CACrB,MAAM,UAAU,CAAA;;;;;;;;;;;+EAWyD,OAAO;8BACxD,CACzB,CAAA;QACD,MAAM,WAAW,GAAG,OAAO,CACzB,MAAM,UAAU,CAAA;;;;;;;;;;;;;+EAayD,OAAO;+BACvD,CAC1B,CAAA;QACD,MAAM,OAAO,GAAG,OAAO,CACrB,MAAM,UAAU,CAAA;;;;;;;;;+EASyD,OAAO;uBAC/D,CAClB,CAAA;QACD,MAAM,GAAG,GAAG,CAAC,MAAe,EAAE,IAAa,EAAU,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAA;QAC3F,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,CAAA;QACjF,kGAAkG;QAClG,6DAA6D;QAC7D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,CAAC,QAAiB,EAAW,EAAE;YAChD,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC1C,OAAO,CACL,MAAM,KAAK,SAAS;gBACpB,IAAI,KAAK,SAAS;gBAClB,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACzC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CACzB,CAAA;QACH,CAAC,CAAA;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAC9B,CAAC,GAAG,EAAE,EAAE,CACN,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAC5C,CAAA;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC1F,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,OAAO,SAAS,CACd,yBAAyB,EACzB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,mDAAmD,CACpF,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAoB,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAChD,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;YACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAA;YAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACrC,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBACtB,IAAI;gBACJ,WAAW,EACT,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;oBAC3D,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC1B,OAAO,EAAE,OAAO;qBACb,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;qBAC3D,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;oBAChB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACzB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI;oBAClC,OAAO,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;oBACrF,UAAU,EAAE,MAAM,CAAC,WAAW,KAAK,IAAI;oBACvC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;iBACpE,CAAC,CAAC;gBACL,WAAW,EAAE,WAAW;qBACrB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;qBAC/C,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACZ,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,OAAO,CAAC;oBAChC,UAAU,EAAE;wBACV,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC;wBAC7B,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC;wBAC3B,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC;qBACrC;iBACF,CAAC,CAAC;gBACL,OAAO,EAAE,OAAO;qBACb,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;qBACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACf,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;oBACxB,MAAM,EAAE,KAAK,CAAC,SAAS,KAAK,IAAI;oBAChC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC;iBACpC,CAAC,CAAC;aACN,CAAA;QACH,CAAC,CAAC,CAAA;QACF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAA;IACrE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAA;AAiB9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAsB,EACtB,OAA+B;IAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAA;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IACzE,OAAO,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QAC3E,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CACrB,MAAM,UAAU,CAAA;;yEAEmD,CACpE,CAAA;QACD,MAAM,QAAQ,GACZ,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,OAAO,CACL,MAAM,UAAU,CAAA;;;;iFAIqD,CAAC,GAAG,OAAO,CAAC;yFACJ,OAAO;6GACa,OAAO;;;;;;;oBAOhG,CACT,CAAA;QACP,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAA;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC,CAAA;QAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,UAAU,GAAG;YACjB,6GAA6G,IAAI,EAAE;YACnH,8CAA8C,IAAI,yBAAyB,QAAQ,EAAE;YACrF,eAAe,GAAG,uEAAuE;YACzF,cAAc,GAAG,0CAA0C;YAC3D,6BAA6B,UAAU,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG;SAC/D,CAAA;QACD,IAAI,OAAO,IAAI,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,UAAU,CAAC,IAAI,CAAC,6BAA6B,GAAG,GAAG,CAAC,CAAA;QACtD,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,UAAU,CAAC,IAAI,CACb,yBAAyB,UAAU,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,EACxD,wCAAwC,UAAU,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,EACvE,sCAAsC,UAAU,CAAC,MAAM,CAAC,8BAA8B,GAAG,GAAG,CAC7F,CAAA;YACH,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,UAAU,CAAC,IAAI,CACb,0BAA0B,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CACxG,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC"}