@northstartech/cipher 0.0.0-stage → 1.0.0

package/dist/integrations/shared.js

@@ -0,0 +1,513 @@
+import { CipherError } from '../errors.js';
+import { SearchIndex } from '../search.js';
+/** Text prefix of every stored ciphertext (protocol §3). */
+export const CIPHERTEXT_PREFIX = 'nsc:v1:';
+/** Placeholder written by the two-phase insert before the real id is known. Never decryptable. */
+export const PENDING_SENTINEL = 'nsc:pending:v1';
+/** Default suffix of the blind-index column next to a searchable field (`email` → `email_bidx`). */
+export const INDEX_SUFFIX = '_bidx';
+const NORMALIZATIONS = new Set(['exact', 'case_insensitive', 'email', 'alphanumeric', 'digits']);
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const TOKEN_VALUES_PER_REQUEST = 100; // protocol §11.3: 1–100 values per /v1/indexes/token call
+const MAX_CONTEXT_VALUE_BYTES = 512; // protocol §3.1
+export function configError(message) {
+    return new CipherError('CONFIGURATION_ERROR', message);
+}
+export function requestError(message) {
+    return new CipherError('INVALID_REQUEST', message);
+}
+/** Validate and normalize a field spec (`true` or options). */
+export function normalizeFieldSpec(spec, label) {
+    if (spec === true)
+        return { searchable: false };
+    if (!spec || typeof spec !== 'object')
+        throw configError(`${label}: expected \`true\` or an options object`);
+    const o = spec;
+    for (const k of Object.keys(o)) {
+        if (k !== 'searchable' && k !== 'indexField')
+            throw configError(`${label}: unknown option "${k}"`);
+    }
+    if (o.indexField !== undefined && (typeof o.indexField !== 'string' || !o.indexField))
+        throw configError(`${label}: indexField must be a non-empty string`);
+    if (o.searchable === undefined || o.searchable === false) {
+        if (o.indexField !== undefined)
+            throw configError(`${label}: indexField requires searchable`);
+        return { searchable: false };
+    }
+    if (o.searchable === true)
+        return { searchable: true, normalization: 'exact', indexField: o.indexField };
+    if (typeof o.searchable !== 'string' || !NORMALIZATIONS.has(o.searchable)) {
+        throw configError(`${label}: searchable must be true or one of ${[...NORMALIZATIONS].join(', ')}`);
+    }
+    return { searchable: true, normalization: o.searchable, indexField: o.indexField };
+}
+/**
+ * Canonical `record_id` for a primary-key value. UUIDs are lowercased because
+ * PostgreSQL returns them lowercase whatever case was inserted; ObjectIds use
+ * their hex form; integers their decimal form.
+ */
+export function recordIdOf(value, label) {
+    let s;
+    if (typeof value === 'string')
+        s = UUID_RE.test(value) ? value.toLowerCase() : value;
+    else if (typeof value === 'number') {
+        if (!Number.isSafeInteger(value))
+            throw requestError(`${label}: primary key ${value} is not a safe integer`);
+        s = String(value);
+    }
+    else if (typeof value === 'bigint')
+        s = value.toString();
+    else if (value && typeof value === 'object' && typeof value.toHexString === 'function') {
+        s = value.toHexString();
+    }
+    else if (value === undefined || value === null) {
+        throw requestError(`${label}: the primary key is not known, so the value cannot be bound to its record`);
+    }
+    else
+        throw requestError(`${label}: unsupported primary key type ${typeof value}`);
+    const bytes = new TextEncoder().encode(s).length;
+    if (bytes < 1 || bytes > MAX_CONTEXT_VALUE_BYTES)
+        throw requestError(`${label}: primary key must be 1–${MAX_CONTEXT_VALUE_BYTES} bytes`);
+    return s;
+}
+/** Plaintext of an encrypted field: strings only (store other types serialized). */
+export function plaintextOf(value, label) {
+    if (typeof value !== 'string') {
+        throw requestError(`${label}: encrypted fields hold strings (got ${value === null ? 'null' : typeof value}); serialize other types before assigning`);
+    }
+    return value;
+}
+/** True for a value written by Northstar Cipher (`nsc:v1:…`). */
+export function isCiphertext(value) {
+    return typeof value === 'string' && value.startsWith(CIPHERTEXT_PREFIX);
+}
+/** Strip the `CODE: ` prefix CipherError adds to its message. */
+function bareMessage(e) {
+    const p = `${e.code}: `;
+    return e.message.startsWith(p) ? e.message.slice(p.length) : e.message;
+}
+function located(e, label) {
+    if (e instanceof CipherError) {
+        return new CipherError(e.code, `${label}: ${bareMessage(e)}`, { requestId: e.requestId, status: e.status, retryable: e.retryable });
+    }
+    return new CipherError('INTERNAL', `${label}: ${e?.message ?? String(e)}`);
+}
+/** Encrypt values in ONE logical batch (the SDK chunks at 1 000 items), reporting per-item outcomes. */
+export async function encryptSettled(cipher, items, opts = {}) {
+    if (!items.length)
+        return [];
+    const results = await cipher.encryptManySettled(items.map((it) => ({
+        ...(opts.keyId ? { keyId: opts.keyId } : {}),
+        plaintext: it.plaintext,
+        context: { collection: it.collection, field: it.field, recordId: it.recordId },
+        ...(it.normalization ? { index: { normalization: it.normalization } } : {}),
+    })));
+    if (results.length !== items.length)
+        throw new CipherError('PROTOCOL_ERROR', `encrypt batch returned ${results.length} results for ${items.length} items`);
+    return results.map((r, i) => {
+        const it = items[i];
+        if (!r.ok)
+            return { ok: false, error: located(r.error, it.label) };
+        if (!isCiphertext(r.value.ciphertext))
+            return { ok: false, error: new CipherError('PROTOCOL_ERROR', `${it.label}: service returned a malformed ciphertext`) };
+        if (it.normalization && !r.value.index)
+            return { ok: false, error: new CipherError('PROTOCOL_ERROR', `${it.label}: service did not return a blind index`) };
+        return { ok: true, value: { ciphertext: r.value.ciphertext, ...(it.normalization ? { index: r.value.index } : {}) } };
+    });
+}
+/**
+ * Encrypt values in ONE logical batch. Throws on the first failed item: callers
+ * must not write anything in that case.
+ */
+export async function encryptValues(cipher, items, opts = {}) {
+    return (await encryptSettled(cipher, items, opts)).map((r) => {
+        if (!r.ok)
+            throw r.error;
+        return r.value;
+    });
+}
+/**
+ * Coalesce encryptions requested in the same tick (e.g. per-entity ORM hooks
+ * fired for one `save([...])`) into one batch request. Each caller still gets
+ * all of its own items or an error (records stay independent).
+ */
+export function encryptCoalescer(cipher, opts = {}) {
+    let queue = [];
+    const flush = async () => {
+        const batch = queue;
+        queue = [];
+        try {
+            const results = await encryptSettled(cipher, batch.flatMap((b) => b.items), opts);
+            let k = 0;
+            for (const b of batch) {
+                const mine = results.slice(k, (k += b.items.length));
+                const failed = mine.find((r) => !r.ok);
+                if (failed && !failed.ok)
+                    b.reject(failed.error);
+                else
+                    b.resolve(mine.map((r) => r.value));
+            }
+        }
+        catch (e) {
+            for (const b of batch)
+                b.reject(e);
+        }
+    };
+    return (items) => new Promise((resolve, reject) => {
+        if (!items.length)
+            return resolve([]);
+        if (!queue.length)
+            setTimeout(() => void flush(), 0);
+        queue.push({ items, resolve, reject });
+    });
+}
+/**
+ * Classify and decrypt stored values in ONE logical batch. `null`/`undefined`
+ * pass through without a request. Plaintext, the pending sentinel and foreign
+ * values throw `INVALID_CIPHERTEXT` before anything is sent.
+ */
+export async function decryptValues(cipher, items, opts = {}) {
+    const out = new Array(items.length).fill(null);
+    const pending = [];
+    items.forEach((it, i) => {
+        const v = it.stored;
+        if (v === null || v === undefined)
+            return;
+        if (isCiphertext(v))
+            pending.push({ i, ciphertext: v });
+        else if (v === PENDING_SENTINEL) {
+            throw new CipherError('INVALID_CIPHERTEXT', `${it.label}: value is the pending sentinel of an interrupted two-phase write; re-save the record`);
+        }
+        else if (opts.readLegacyPlaintext && typeof v === 'string')
+            out[i] = v;
+        else
+            throw new CipherError('INVALID_CIPHERTEXT', `${it.label}: stored value is not Northstar ciphertext; refusing to read it as plaintext`);
+    });
+    if (!pending.length)
+        return out;
+    const results = await cipher.decryptManySettled(pending.map((p) => {
+        const it = items[p.i];
+        return { ciphertext: p.ciphertext, context: { collection: it.collection, field: it.field, recordId: it.recordId } };
+    }), opts.purpose ? { purpose: opts.purpose } : {});
+    if (results.length !== pending.length)
+        throw new CipherError('PROTOCOL_ERROR', `decrypt batch returned ${results.length} results for ${pending.length} items`);
+    results.forEach((r, k) => {
+        const p = pending[k];
+        if (!r.ok)
+            throw located(r.error, items[p.i].label);
+        out[p.i] = r.value.plaintext;
+    });
+    return out;
+}
+/** Decrypt one stored value through the client's auto-batching (`cipher.decrypt`). */
+export async function decryptOne(cipher, item, opts = {}) {
+    const v = item.stored;
+    if (v === null || v === undefined)
+        return null;
+    if (!isCiphertext(v)) {
+        if (v === PENDING_SENTINEL) {
+            throw new CipherError('INVALID_CIPHERTEXT', `${item.label}: value is the pending sentinel of an interrupted two-phase write; re-save the record`);
+        }
+        if (opts.readLegacyPlaintext && typeof v === 'string')
+            return v;
+        throw new CipherError('INVALID_CIPHERTEXT', `${item.label}: stored value is not Northstar ciphertext; refusing to read it as plaintext`);
+    }
+    try {
+        const r = await cipher.decrypt({
+            ciphertext: v,
+            context: { collection: item.collection, field: item.field, recordId: item.recordId },
+            ...(opts.purpose ? { purpose: opts.purpose } : {}),
+        });
+        return r.plaintext;
+    }
+    catch (e) {
+        throw located(e, item.label);
+    }
+}
+/**
+ * Exact-match search tokens for one or more values: the union of every token
+ * (active and query-only index versions) to match with `IN (…)`.
+ */
+export async function searchTokensFor(cipher, input) {
+    const raw = Array.isArray(input.values) ? input.values : [input.values];
+    const values = raw.map((v) => {
+        if (typeof v !== 'string')
+            throw requestError(`${input.label}: search values must be strings`);
+        return v;
+    });
+    const tokens = new Set();
+    for (let i = 0; i < values.length; i += TOKEN_VALUES_PER_REQUEST) {
+        const lists = await cipher.searchTokens({
+            ...(input.keyId ? { keyId: input.keyId } : {}),
+            collection: input.collection,
+            field: input.field,
+            ...(input.normalization ? { normalization: input.normalization } : {}),
+            values: values.slice(i, i + TOKEN_VALUES_PER_REQUEST),
+        });
+        for (const list of lists)
+            for (const t of list)
+                tokens.add(t);
+    }
+    return [...tokens];
+}
+/** Validate `search` integration options. */
+export function normalizeSearchSync(o, label) {
+    const s = o;
+    if (!s || typeof s !== 'object' || !(s.index instanceof SearchIndex))
+        throw configError(`${label}: search.index must be a SearchIndex (cipher.index(name))`);
+    if (!Array.isArray(s.fields) || !s.fields.length || !s.fields.every((f) => typeof f === 'string' && f))
+        throw configError(`${label}: search.fields must list the attributes to index`);
+    if (s.onError !== undefined && typeof s.onError !== 'function')
+        throw configError(`${label}: search.onError must be a function`);
+    return s;
+}
+/**
+ * Value of one search field: stored ciphertext of an encrypted attribute becomes
+ * `{ ciphertext, context }` (decrypted inside the enclave), other values become
+ * JSON scalars (dates as RFC 3339). Objects (JSON columns, relations) are skipped.
+ */
+export function searchValue(value, encrypted, label) {
+    if (value === undefined)
+        return undefined;
+    if (value === null)
+        return null;
+    if (encrypted && isCiphertext(value))
+        return SearchIndex.ciphertext(value, encrypted);
+    if (value === PENDING_SENTINEL)
+        throw new CipherError('INVALID_CIPHERTEXT', `${label}: the record holds the pending sentinel of an unfinished two-phase write`);
+    if (typeof value === 'string' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? value : null;
+    if (typeof value === 'bigint')
+        return Number.isSafeInteger(Number(value)) ? Number(value) : value.toString();
+    if (value instanceof Date)
+        return Number.isNaN(value.getTime()) ? null : value.toISOString();
+    if (Array.isArray(value)) {
+        return value.map((v) => searchValue(v, undefined, label)).filter((v) => v === null || (v !== undefined && typeof v !== 'object'));
+    }
+    if (typeof value.toHexString === 'function')
+        return value.toHexString();
+    return undefined;
+}
+/**
+ * Build the search document of a record (stored row or ORM instance): the id is
+ * the canonical record id, encrypted attributes holding ciphertext keep it, and
+ * attributes holding plaintext (already decrypted records) are sent as values.
+ * Attributes missing from the record are left out.
+ */
+export function searchDocumentOf(record, plan) {
+    const recordId = recordIdOf(plan.id, plan.label);
+    const fields = {};
+    for (const f of plan.fields) {
+        const v = searchValue(record[f.attr], f.encrypted ? { ...f.encrypted, recordId } : undefined, `${plan.label}.${f.attr}`);
+        if (v !== undefined)
+            fields[f.attr] = v;
+    }
+    return { id: recordId, fields };
+}
+/**
+ * Apply a change to a synced index (merge mode: attributes a partially loaded
+ * record lacks keep their indexed values). `deferred`: running after a commit,
+ * so a failure without `onError` is logged instead of thrown.
+ */
+export async function applySearchChange(sync, change, deferred = false) {
+    const upserted = (change.upsert ?? []).map((d) => String(d.id));
+    const deleted = change.delete ?? [];
+    try {
+        if (upserted.length) {
+            const r = await sync.index.upsert(change.upsert, { mode: 'merge', ...(sync.wait ? { wait: true } : {}) });
+            const first = r.errors[0];
+            if (first)
+                throw new CipherError(first.error.code, `search index ${sync.index.name} rejected document ${first.id}: ${bareMessage(first.error)}`);
+        }
+        if (deleted.length)
+            await sync.index.delete(deleted, sync.wait ? { wait: true } : {});
+    }
+    catch (e) {
+        if (sync.onError)
+            return sync.onError(e, { upserted, deleted });
+        if (!deferred)
+            throw e;
+        console.error(`[northstar-cipher] search index ${sync.index.name} is out of date (${upserted.length} upsert(s), ${deleted.length} delete(s)): ${e?.message ?? String(e)}`);
+    }
+}
+/**
+ * Index changes collected during a transaction and applied once it commits:
+ * one request per index, the last write of each record wins (a record deleted
+ * and written again is reset first).
+ */
+export class SearchChangeSet {
+    byIndex = new Map();
+    add(sync, change) {
+        let m = this.byIndex.get(sync);
+        if (!m)
+            this.byIndex.set(sync, (m = new Map()));
+        for (const id of change.delete ?? [])
+            m.set(id, { fields: null, reset: true });
+        for (const d of change.upsert ?? []) {
+            const id = String(d.id);
+            const prev = m.get(id);
+            m.set(id, { fields: { ...(prev?.fields ?? {}), ...d.fields }, reset: prev?.reset ?? false });
+        }
+    }
+    /** Fold a committed savepoint's changes into its parent. */
+    merge(other) {
+        for (const [sync, m] of other.byIndex) {
+            for (const [id, e] of m) {
+                if (e.fields === null)
+                    this.add(sync, { delete: [id] });
+                else {
+                    if (e.reset)
+                        this.add(sync, { delete: [id] });
+                    this.add(sync, { upsert: [{ id, fields: e.fields }] });
+                }
+            }
+        }
+    }
+    async apply(deferred) {
+        for (const [sync, m] of this.byIndex) {
+            const deletes = [...m].filter(([, e]) => e.reset).map(([id]) => id);
+            const upserts = [...m].filter(([, e]) => e.fields !== null).map(([id, e]) => ({ id, fields: e.fields }));
+            if (deletes.length)
+                await applySearchChange(sync, { delete: deletes }, deferred);
+            if (upserts.length)
+                await applySearchChange(sync, { upsert: upserts }, deferred);
+        }
+        this.byIndex.clear();
+    }
+}
+// ------------------------------------------------------------------ record ids
+/** Quote a PostgreSQL identifier. */
+export function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+/** `"schema"."table"` (schema optional) for `pg_get_serial_sequence`, which parses its first argument as an identifier. */
+export function qualifiedTable(table, schema) {
+    return schema ? `${quoteIdent(schema)}.${quoteIdent(table)}` : quoteIdent(table);
+}
+/** SQL reserving `$3` values from the serial/identity sequence of `$1` (qualified table) `$2` (column). */
+export const RESERVE_IDS_SQL = 'SELECT nextval(pg_get_serial_sequence($1, $2))::text AS id FROM generate_series(1, $3::int)';
+/** Check rows returned by {@link RESERVE_IDS_SQL}. */
+export function reservedIdsFrom(rows, count, label) {
+    const list = Array.isArray(rows) ? rows : rows?.rows;
+    if (!Array.isArray(list) || list.length !== count)
+        throw new CipherError('PROTOCOL_ERROR', `${label}: sequence reservation returned an unexpected result`);
+    return list.map((r) => {
+        const id = r?.id;
+        if (id === null || id === undefined) {
+            throw configError(`${label}: the primary key has no serial/identity sequence; supply ids explicitly or use a client-generated id`);
+        }
+        return String(id);
+    });
+}
+const B36 = '0123456789abcdefghijklmnopqrstuvwxyz';
+const CROCKFORD = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
+const URL_ALPHABET = 'useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyz';
+function rand(n) {
+    return globalThis.crypto.getRandomValues(new Uint8Array(n));
+}
+function randomChars(alphabet, n) {
+    // Rejection sampling keeps the distribution uniform.
+    const limit = 256 - (256 % alphabet.length);
+    let out = '';
+    while (out.length < n) {
+        for (const b of rand(n * 2)) {
+            if (b < limit)
+                out += alphabet[b % alphabet.length];
+            if (out.length === n)
+                break;
+        }
+    }
+    return out;
+}
+function uuidV4() {
+    return globalThis.crypto.randomUUID();
+}
+function uuidV7() {
+    const b = rand(16);
+    const ms = BigInt(Date.now());
+    for (let i = 0; i < 6; i++)
+        b[i] = Number((ms >> BigInt(8 * (5 - i))) & 0xffn);
+    b[6] = (b[6] & 0x0f) | 0x70;
+    b[8] = (b[8] & 0x3f) | 0x80;
+    const h = Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+    return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+}
+let cuidCounter = Math.floor(Math.random() * 1679616);
+const cuidFingerprint = randomChars(B36, 4);
+/** cuid (v1 layout: `c` + time + counter + fingerprint + random, 25 chars). */
+function cuidV1() {
+    cuidCounter = (cuidCounter + 1) % 1679616;
+    return `c${Date.now().toString(36).padStart(8, '0').slice(-8)}${cuidCounter.toString(36).padStart(4, '0')}${cuidFingerprint}${randomChars(B36, 8)}`;
+}
+/** cuid2-compatible id: a lowercase letter followed by 23 random base-36 chars. */
+function cuidV2() {
+    return randomChars(B36.slice(10), 1) + randomChars(B36, 23);
+}
+function ulid() {
+    let t = Date.now();
+    let time = '';
+    for (let i = 0; i < 10; i++) {
+        time = CROCKFORD[t % 32] + time;
+        t = Math.floor(t / 32);
+    }
+    return time + randomChars(CROCKFORD, 16);
+}
+function nanoid() {
+    return randomChars(URL_ALPHABET, 21);
+}
+/** Client-side id generators (all CSPRNG based, no dependencies). */
+export const ID_GENERATORS = {
+    uuid: uuidV4,
+    uuidv4: uuidV4,
+    uuidv7: uuidV7,
+    cuid: cuidV1,
+    cuid2: cuidV2,
+    ulid,
+    nanoid,
+};
+export function isIdGeneratorName(v) {
+    return typeof v === 'string' && Object.prototype.hasOwnProperty.call(ID_GENERATORS, v);
+}
+/** True for a UUID-shaped string. */
+export function isUuid(v) {
+    return typeof v === 'string' && UUID_RE.test(v);
+}
+/**
+ * Remembers, per model instance/document, the plaintext of fields whose stored
+ * representation was just swapped for ciphertext, so integrations can restore
+ * plaintext after the write (or after a failed write) and never re-encrypt their
+ * own ciphertext on a retry.
+ */
+export class PlaintextLedger {
+    map = new WeakMap();
+    set(owner, attr, plaintext, ciphertext) {
+        let m = this.map.get(owner);
+        if (!m)
+            this.map.set(owner, (m = new Map()));
+        m.set(attr, { plaintext, ciphertext });
+    }
+    get(owner, attr) {
+        return this.map.get(owner)?.get(attr);
+    }
+    entries(owner) {
+        return [...(this.map.get(owner)?.entries() ?? [])];
+    }
+    has(owner) {
+        return (this.map.get(owner)?.size ?? 0) > 0;
+    }
+    clear(owner) {
+        this.map.delete(owner);
+    }
+    /**
+     * The plaintext a current value stands for: if `current` is exactly the
+     * ciphertext (or sentinel) this ledger produced for `attr`, the remembered
+     * plaintext; otherwise `current` itself.
+     */
+    resolve(owner, attr, current) {
+        const e = this.get(owner, attr);
+        return e && e.ciphertext !== null && current === e.ciphertext ? e.plaintext : current;
+    }
+}
+//# sourceMappingURL=shared.js.map

package/dist/integrations/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/integrations/shared.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,WAAW,EAA+E,MAAM,cAAc,CAAA;AAEvH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAA;AAC1C,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAA;AAChD,oGAAoG;AACpG,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAA;AAEnC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAA;AACrH,MAAM,OAAO,GAAG,iEAAiE,CAAA;AACjF,MAAM,wBAAwB,GAAG,GAAG,CAAA,CAAC,0DAA0D;AAC/F,MAAM,uBAAuB,GAAG,GAAG,CAAA,CAAC,gBAAgB;AAoCpD,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,IAAI,WAAW,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,WAAW,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;AACpD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,IAAa,EAAE,KAAa;IAC7D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,WAAW,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAA;IAC5G,MAAM,CAAC,GAAG,IAA6B,CAAA;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,YAAY;YAAE,MAAM,WAAW,CAAC,GAAG,KAAK,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACpG,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;QAAE,MAAM,WAAW,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAA;IAC3J,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACzD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,WAAW,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAA;QAC7F,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IAC9B,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAA;IACxG,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1E,MAAM,WAAW,CAAC,GAAG,KAAK,uCAAuC,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpG,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAA;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,KAAa;IACtD,IAAI,CAAS,CAAA;IACb,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;SAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,MAAM,YAAY,CAAC,GAAG,KAAK,iBAAiB,KAAK,wBAAwB,CAAC,CAAA;QAC5G,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAA;SACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAmC,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACtH,CAAC,GAAI,KAAmC,CAAC,WAAW,EAAE,CAAA;IACxD,CAAC;SAAM,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,YAAY,CAAC,GAAG,KAAK,4EAA4E,CAAC,CAAA;IAC1G,CAAC;;QAAM,MAAM,YAAY,CAAC,GAAG,KAAK,kCAAkC,OAAO,KAAK,EAAE,CAAC,CAAA;IACnF,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAChD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,uBAAuB;QAAE,MAAM,YAAY,CAAC,GAAG,KAAK,2BAA2B,uBAAuB,QAAQ,CAAC,CAAA;IACxI,OAAO,CAAC,CAAA;AACV,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,KAAa;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,YAAY,CAAC,GAAG,KAAK,wCAAwC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,2CAA2C,CAAC,CAAA;IACvJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAA;AACzE,CAAC;AAmBD,iEAAiE;AACjE,SAAS,WAAW,CAAC,CAAc;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAA;IACvB,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AACxE,CAAC;AAED,SAAS,OAAO,CAAC,CAAU,EAAE,KAAa;IACxC,IAAI,CAAC,YAAY,WAAW,EAAE,CAAC;QAC7B,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA;IACrI,CAAC;IACD,OAAO,IAAI,WAAW,CAAC,UAAU,EAAE,GAAG,KAAK,KAAM,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AACvF,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAuB,EAAE,KAAoB,EAAE,OAA2B,EAAE;IAC/G,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAC7C,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;QAC9E,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC,CAAC,CACJ,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,0BAA0B,OAAO,CAAC,MAAM,gBAAgB,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAA;IAC1J,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAA2B,EAAE;QACnD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACpB,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;QAClE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK,2CAA2C,CAAC,EAAE,CAAA;QAC7J,IAAI,EAAE,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK,wCAAwC,CAAC,EAAE,CAAA;QAC3J,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;IACvH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAuB,EAAE,KAAoB,EAAE,OAA2B,EAAE;IAC9G,OAAO,CAAC,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3D,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,CAAC,CAAC,KAAK,CAAA;QACxB,OAAO,CAAC,CAAC,KAAK,CAAA;IAChB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAuB,EAAE,OAA2B,EAAE;IACrF,IAAI,KAAK,GAAqG,EAAE,CAAA;IAChH,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,MAAM,KAAK,GAAG,KAAK,CAAA;QACnB,KAAK,GAAG,EAAE,CAAA;QACV,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAA;YACjF,IAAI,CAAC,GAAG,CAAC,CAAA;YACT,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;gBACpD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBACtC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE;oBAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;;oBAC3C,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAyC,CAAC,KAAK,CAAC,CAAC,CAAA;YACnF,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACpC,CAAC;IACH,CAAC,CAAA;IACD,OAAO,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9B,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;QACpD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACN,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAuB,EACvB,KAAoB,EACpB,OAA4D,EAAE;IAE9D,MAAM,GAAG,GAAsB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjE,MAAM,OAAO,GAAwC,EAAE,CAAA;IACvD,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAA;QACnB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,OAAM;QACzC,IAAI,YAAY,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAA;aAClD,IAAI,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,KAAK,uFAAuF,CAAC,CAAA;QACjJ,CAAC;aAAM,IAAI,IAAI,CAAC,mBAAmB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;;YACnE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,KAAK,8EAA8E,CAAC,CAAA;IAC7I,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,GAAG,CAAA;IAC/B,MAAM,OAAO,GAAqC,MAAM,MAAM,CAAC,kBAAkB,CAC/E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,CAAA;QACtB,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAA;IACrH,CAAC,CAAC,EACF,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAC9C,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,0BAA0B,OAAO,CAAC,MAAM,gBAAgB,OAAO,CAAC,MAAM,QAAQ,CAAC,CAAA;IAC9J,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;QACrB,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAA;QACpD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAA;IAC9B,CAAC,CAAC,CAAA;IACF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAuB,EACvB,IAAiB,EACjB,OAA4D,EAAE;IAE9D,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAA;IACrB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC9C,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,GAAG,IAAI,CAAC,KAAK,uFAAuF,CAAC,CAAA;QACnJ,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAA;QAC/D,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,GAAG,IAAI,CAAC,KAAK,8EAA8E,CAAC,CAAA;IAC1I,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YAC7B,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;YACpF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,SAAS,CAAA;IACpB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAuB,EACvB,KAA2H;IAE3H,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,MAAM,YAAY,CAAC,GAAG,KAAK,CAAC,KAAK,iCAAiC,CAAC,CAAA;QAC9F,OAAO,CAAC,CAAA;IACV,CAAC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,wBAAwB,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,wBAAwB,CAAC;SACtD,CAAC,CAAA;QACF,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAA;AACpB,CAAC;AAiCD,6CAA6C;AAC7C,MAAM,UAAU,mBAAmB,CAAC,CAAU,EAAE,KAAa;IAC3D,MAAM,CAAC,GAAG,CAAsB,CAAA;IAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;QAAE,MAAM,WAAW,CAAC,GAAG,KAAK,2DAA2D,CAAC,CAAA;IAC5J,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC;QAAE,MAAM,WAAW,CAAC,GAAG,KAAK,mDAAmD,CAAC,CAAA;IACtL,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU;QAAE,MAAM,WAAW,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAA;IAChI,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,SAA8E,EAAE,KAAa;IACvI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,SAAS,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACrF,IAAI,KAAK,KAAK,gBAAgB;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,GAAG,KAAK,0EAA0E,CAAC,CAAA;IAC/J,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC5G,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;IAC5F,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAA;IACtJ,CAAC;IACD,IAAI,OAAQ,KAAmC,CAAC,WAAW,KAAK,UAAU;QAAE,OAAQ,KAAmC,CAAC,WAAW,EAAE,CAAA;IACrI,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA+B,EAAE,IAA+D;IAC/H,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACxH,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAuB,EAAE,MAAwD,EAAE,QAAQ,GAAG,KAAK;IACzI,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IACnC,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YAC1G,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YACzB,IAAI,KAAK;gBAAE,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,IAAI,CAAC,KAAK,CAAC,IAAI,sBAAsB,KAAK,CAAC,EAAE,KAAK,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAClJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACvF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;QAC/D,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,CAAA;QACtB,OAAO,CAAC,KAAK,CAAC,mCAAmC,IAAI,CAAC,KAAK,CAAC,IAAI,oBAAoB,QAAQ,CAAC,MAAM,eAAe,OAAO,CAAC,MAAM,gBAAiB,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACvL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACT,OAAO,GAAG,IAAI,GAAG,EAAmF,CAAA;IAErH,GAAG,CAAC,IAAuB,EAAE,MAAwD;QACnF,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAA;QAC/C,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;YAAE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtB,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK,EAAE,CAAC,CAAA;QAC9F,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,KAAsB;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACtC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;oBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;qBAClD,CAAC;oBACJ,IAAI,CAAC,CAAC,KAAK;wBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;oBAC7C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAiB;QAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;YACnE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAO,EAAE,CAAC,CAAC,CAAA;YACzG,IAAI,OAAO,CAAC,MAAM;gBAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAA;YAChF,IAAI,OAAO,CAAC,MAAM;gBAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAA;QAClF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;CACF;AAED,gFAAgF;AAEhF,qCAAqC;AACrC,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAA;AACxC,CAAC;AAED,2HAA2H;AAC3H,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAsB;IAClE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AAClF,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,eAAe,GAAG,6FAA6F,CAAA;AAE5H,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,IAAa,EAAE,KAAa,EAAE,KAAa;IACzE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAoC,EAAE,IAAI,CAAA;IACrF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;QAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,GAAG,KAAK,sDAAsD,CAAC,CAAA;IAC1J,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpB,MAAM,EAAE,GAAI,CAA6B,EAAE,EAAE,CAAA;QAC7C,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,WAAW,CAAC,GAAG,KAAK,uGAAuG,CAAC,CAAA;QACpI,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAA;IACnB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,GAAG,GAAG,sCAAsC,CAAA;AAClD,MAAM,SAAS,GAAG,kCAAkC,CAAA;AACpD,MAAM,YAAY,GAAG,8DAA8D,CAAA;AAEnF,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,CAAS;IAC9C,qDAAqD;IACrD,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,KAAK;gBAAE,GAAG,IAAI,QAAQ,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;YACnD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAK;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,MAAM;IACb,OAAO,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAA;AACvC,CAAC;AAED,SAAS,MAAM;IACb,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;IAClB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAA;IAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAA;IAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACxE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAA;AAClG,CAAC;AAED,IAAI,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAA;AACrD,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;AAE3C,+EAA+E;AAC/E,SAAS,MAAM;IACb,WAAW,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,OAAO,CAAA;IACzC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAA;AACrJ,CAAC;AAED,mFAAmF;AACnF,SAAS,MAAM;IACb,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,IAAI;IACX,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAClB,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAA;QAC/B,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,MAAM;IACb,OAAO,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;AACtC,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,MAAM;IACb,IAAI;IACJ,MAAM;CACE,CAAA;AAIV,MAAM,UAAU,iBAAiB,CAAC,CAAU;IAC1C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;AACxF,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,MAAM,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACT,GAAG,GAAG,IAAI,OAAO,EAA2E,CAAA;IAE7G,GAAG,CAAC,KAAQ,EAAE,IAAY,EAAE,SAAwB,EAAE,UAAyB;QAC7E,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAA;QAC5C,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAA;IACxC,CAAC;IAED,GAAG,CAAC,KAAQ,EAAE,IAAY;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;IACvC,CAAC;IAED,OAAO,CAAC,KAAQ;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACpD,CAAC;IAED,GAAG,CAAC,KAAQ;QACV,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAC7C,CAAC;IAED,KAAK,CAAC,KAAQ;QACZ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,KAAQ,EAAE,IAAY,EAAE,OAAgB;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAA;IACvF,CAAC;CACF"}

package/dist/integrations/typeorm.d.ts

@@ -0,0 +1,109 @@
+/**
+ * TypeORM integration: an `@Encrypted()` property decorator and an entity subscriber.
+ *
+ * ```ts
+ * import { Encrypted, northstarCipherSubscriber, cipherWhere } from '@northstartech/cipher/typeorm'
+ *
+ * @Entity('todos')
+ * class Todo {
+ *   @PrimaryGeneratedColumn('uuid') id!: string
+ *   @Encrypted() @Column({ type: 'text', nullable: true }) title!: string | null
+ *   @Encrypted({ searchable: 'email' }) @Column({ type: 'text', nullable: true }) email!: string | null
+ *   @Index() @Column({ type: 'varchar', length: 64, nullable: true }) email_bidx!: string | null
+ * }
+ *
+ * const ds = new DataSource({ …, entities: [Todo], subscribers: [northstarCipherSubscriber(cipher)] })
+ * await ds.getRepository(Todo).save({ title: 'Buy milk', email: 'ana@example.com' })
+ * const todos = await ds.getRepository(Todo).find()          // afterLoad decrypts in one batch request
+ * const mine = await ds.getRepository(Todo).findBy(await cipherWhere(ds, Todo, 'email', 'ANA@example.com'))
+ * ```
+ *
+ * Record ids: `uuid` primary keys are generated client-side before the insert;
+ * generated integer keys (increment/identity/rowid) use the two-phase write
+ * (sentinel, then ciphertext in `afterInsert`, inside `save()`'s transaction).
+ *
+ * Northstar Search: `northstarCipherSubscriber(cipher, { search: [{ entity: Todo, index: cipher.index('todos'), fields: ['title', 'email'] }] })`
+ * keeps an index in sync after each transaction commits (encrypted properties are
+ * indexed from their stored ciphertext, which the enclave decrypts);
+ * `searchDocuments(ds, Todo, rows, fields)` builds documents for a (re)index.
+ */
+import { type DataSource, type EntitySubscriberInterface, In, type InsertEvent, type LoadEvent, type ObjectLiteral, type RemoveEvent, type SoftRemoveEvent, type TransactionCommitEvent, type TransactionRollbackEvent, type UpdateEvent } from 'typeorm';
+import type { NorthstarCipher } from '../client.js';
+import { CipherError } from '../errors.js';
+import { type CipherIntegrationOptions, type EncryptedFieldOptions, type SearchSyncOptions, isCiphertext } from './shared.js';
+import type { SearchDocument } from '../search.js';
+export { CIPHERTEXT_PREFIX, PENDING_SENTINEL } from './shared.js';
+export type { EncryptedFieldOptions, CipherIntegrationOptions, SearchSyncOptions } from './shared.js';
+type Ctor = abstract new (...args: never[]) => unknown;
+/**
+ * Mark an entity property as encrypted. Use with a text column:
+ * `@Encrypted() @Column({ type: 'text', nullable: true }) title!: string | null`.
+ * Searchable properties need a `<property>_bidx` varchar(64) column (or `indexField`).
+ */
+export declare function Encrypted(options?: EncryptedFieldOptions): PropertyDecorator;
+type Entity = ObjectLiteral;
+/** Keep a Northstar Search index in sync with an entity (`save()`/`remove()`/`softRemove()` through repositories and managers). */
+export interface TypeOrmSearchSync extends SearchSyncOptions {
+    /** Entity class (or entity name). */
+    entity: Ctor | string;
+}
+export interface NorthstarTypeOrmOptions extends CipherIntegrationOptions {
+    /**
+     * Northstar Search indexes to keep in sync. Changes made in a transaction are
+     * applied once it commits (dropped on rollback); `QueryBuilder` and
+     * `Repository.update()/delete()` writes are not tracked: reindex after those.
+     */
+    search?: TypeOrmSearchSync[];
+}
+/**
+ * Entity subscriber that encrypts `@Encrypted()` properties before INSERT/UPDATE
+ * and decrypts them after load. Register an instance (or use
+ * {@link northstarCipherSubscriber} for the DataSource `subscribers` option).
+ */
+export declare class NorthstarCipherSubscriber implements EntitySubscriberInterface<Entity> {
+    readonly cipher: NorthstarCipher;
+    readonly options: NorthstarTypeOrmOptions;
+    private readonly ledger;
+    private readonly encrypt;
+    private readonly searchPlans;
+    /** Index changes per query runner and transaction depth, applied when the outermost transaction commits. */
+    private readonly pendingSearch;
+    constructor(cipher: NorthstarCipher, options?: NorthstarTypeOrmOptions);
+    private searchPlanFor;
+    /** Index a change now, or once the transaction it belongs to commits. */
+    private queueSearch;
+    afterTransactionCommit(event: TransactionCommitEvent): Promise<void>;
+    afterTransactionRollback(event: TransactionRollbackEvent): void;
+    private searchDocument;
+    /** Encrypt `fields` of one entity (one batch, coalesced with other entities of the same save). */
+    private encryptEntity;
+    private restore;
+    beforeInsert(event: InsertEvent<Entity>): Promise<void>;
+    afterInsert(event: InsertEvent<Entity>): Promise<void>;
+    beforeUpdate(event: UpdateEvent<Entity>): Promise<void>;
+    afterUpdate(event: UpdateEvent<Entity>): Promise<void>;
+    afterRemove(event: RemoveEvent<Entity>): Promise<void>;
+    afterSoftRemove(event: SoftRemoveEvent<Entity>): Promise<void>;
+    private unindex;
+    /** afterInsert of an entity without encrypted properties. */
+    private indexPlain;
+    afterLoad(entity: Entity, event?: LoadEvent<Entity>): Promise<void> | void;
+}
+/** Subscriber class bound to `cipher`, for `new DataSource({ subscribers: [northstarCipherSubscriber(cipher)] })`. */
+export declare function northstarCipherSubscriber(cipher: NorthstarCipher, options?: NorthstarTypeOrmOptions): new () => NorthstarCipherSubscriber;
+/**
+ * Exact-match condition for a searchable encrypted property:
+ * `repo.findBy(await cipherWhere(ds, Todo, 'email', 'ana@example.com'))` → `{ email_bidx: In(tokens) }`.
+ */
+export declare function cipherWhere(dataSource: DataSource, entity: Ctor | string, property: string, value: string | string[]): Promise<Record<string, ReturnType<typeof In<string>>>>;
+/**
+ * Northstar Search documents for entities or rows of `entity`. Rows read without
+ * the subscriber's decryption (e.g. `ds.createQueryBuilder(Todo, 't').getRawMany()`
+ * mapped to property names, or a DataSource without the subscriber) hold stored
+ * ciphertext, sent with the context it is bound to and decrypted inside the
+ * enclave; decrypted entities send their plaintext.
+ */
+export declare function searchDocuments(dataSource: DataSource, entity: Ctor | string, rows: Entity[], fields: string[]): SearchDocument[];
+/** True when a raw column value is Northstar ciphertext (useful in migrations and tests). */
+export { isCiphertext };
+export { CipherError };