@opendatalabs/personal-server-ts-core 1.33.8 → 1.34.0

package/dist/pdpp/resolve.js

@@ -0,0 +1,393 @@
+/**
+ * PDPP Core §6→§7 resolution: turn a validated selection request into the
+ * explicit grant facts that get frozen at issuance.
+ *
+ * Every request-only convenience dies here. Wildcards and presets expand to
+ * concrete stream rows, views resolve to field lists, omitted fields become
+ * the declaration's full field set, omitted instance handles resolve against
+ * the owner's connection inventory, and `time_range` freezes against the
+ * declaration's `consent_time_field`. §7 is explicit that none of these
+ * conveniences are continuing authority in the grant — the RS must never have
+ * to resolve anything, which is also what the AS→RS contract promises.
+ *
+ * Resolution runs against the same retained snapshot `selection.ts` validated
+ * against. Passing a newer declaration here is the bug §9 AS item 16 exists to
+ * prevent: it would let a later declaration widen an in-flight authorization.
+ */
+import { PDPP_DATA_ACCESS_TYPE_V02, } from "./types.js";
+function failure(code, message, extra) {
+    return { ok: false, failure: { code, message, ...extra } };
+}
+/** Stable de-duplication. Grant field and instance lists must be unique (§7). */
+function unique(values) {
+    return Array.from(new Set(values));
+}
+/**
+ * The requested field ceiling for one stream, before owner choices.
+ *
+ * Under v0.1 the declaration's `required_fields` are unioned in: §6 called
+ * them the per-stream consent floor, so a client asking for fewer fields got
+ * the floor rather than an error.
+ *
+ * Under v0.2 that union is gone. PR #1 changes the rule deliberately: the
+ * record format describes a complete record, while the owner's approval
+ * determines which fields the app receives. A schema can require a field of
+ * every valid record and the owner can still withhold it, and the RS must not
+ * add it back. Keeping the union here would make the whole withholding
+ * guarantee unreachable — the AS would re-add the field before the owner ever
+ * saw a choice about it.
+ */
+function requestedFields(request, declared, snapshot, revision) {
+    let requested;
+    if (request.view !== undefined) {
+        const view = snapshot.views?.find((v) => v.name === request.view);
+        if (!view) {
+            return {
+                ok: false,
+                failure: {
+                    code: "unknown_view",
+                    message: `view '${request.view}' is not defined for this source`,
+                    stream: declared.name,
+                },
+            };
+        }
+        requested = view.fields;
+    }
+    else if (request.fields !== undefined) {
+        requested = request.fields;
+    }
+    else {
+        // §6 "Note on defaults": omitting both asks the AS to resolve all
+        // permitted fields from the retained snapshot.
+        requested = declared.fields;
+    }
+    // Intersect with the declared schema first, so a view or allowlist can
+    // never introduce a field the snapshot does not define.
+    const permitted = requested.filter((f) => declared.fields.includes(f));
+    const fields = revision === "0.1"
+        ? unique([...permitted, ...declared.required_fields])
+        : unique(permitted);
+    if (fields.length === 0) {
+        return {
+            ok: false,
+            failure: {
+                code: "empty_field_set",
+                message: `stream '${declared.name}' resolved to an empty field set`,
+                stream: declared.name,
+            },
+        };
+    }
+    return { ok: true, fields };
+}
+/**
+ * Apply the owner's field narrowing by intersection with the ceiling.
+ *
+ * Intersection rather than replacement is the security property: a choice
+ * naming a field the request never asked for cannot add it. An *absent*
+ * choice means "no narrowing", which is different from an empty one — an
+ * empty choice is a real decision to share nothing from this stream, and
+ * silently reading it as "all fields" would invert it.
+ */
+function narrowFields(ceiling, chosen) {
+    if (chosen === undefined)
+        return ceiling;
+    return ceiling.filter((f) => chosen.includes(f));
+}
+/** Instant for a bound, with an absent bound reading as the open end. */
+function instant(value, open) {
+    return value === undefined ? open : Date.parse(value);
+}
+/**
+ * Clamp the owner's window into the requested window.
+ *
+ * The result is the intersection, so the later `since` and the earlier
+ * `until` win. An owner asking for more history than the client requested
+ * gets the client's limit, not their own ask.
+ */
+function narrowTimeRange(ceiling, chosen) {
+    if (chosen === undefined)
+        return ceiling;
+    const since = [ceiling?.since, chosen.since]
+        .filter((v) => v !== undefined)
+        .sort((a, b) => Date.parse(b) - Date.parse(a))[0];
+    const until = [ceiling?.until, chosen.until]
+        .filter((v) => v !== undefined)
+        .sort((a, b) => Date.parse(a) - Date.parse(b))[0];
+    if (since === undefined && until === undefined)
+        return undefined;
+    return {
+        ...(since !== undefined && { since }),
+        ...(until !== undefined && { until }),
+    };
+}
+/**
+ * Whether one stream's resolved shape satisfies its explicit minimum.
+ *
+ * This answers a permission question and nothing else. A satisfied minimum
+ * says the grant *permits* those fields and that window; v0.2 is explicit
+ * that it asserts nothing about record existence, freshness, completeness, or
+ * suitability, and that the AS must not require records to exist to satisfy
+ * one. So this function never touches a record.
+ */
+function minimumSatisfied(minimum, fields, window) {
+    if (!minimum)
+        return { ok: true };
+    if (minimum.fields) {
+        const missing = minimum.fields.filter((f) => !fields.includes(f));
+        if (missing.length > 0) {
+            return {
+                ok: false,
+                reason: `the approved fields omit the required minimum field(s) ${missing.join(", ")}`,
+            };
+        }
+    }
+    if (minimum.time_range) {
+        // The resolved window must *contain* the entire minimum window. An absent
+        // resolved lower bound is negative infinity and an absent upper bound is
+        // positive infinity, so an unbounded window contains every floor.
+        const from = instant(window?.since, -Infinity);
+        const to = instant(window?.until, Infinity);
+        if (Date.parse(minimum.time_range.since) < from ||
+            Date.parse(minimum.time_range.until) > to) {
+            return {
+                ok: false,
+                reason: "the approved time window does not contain the required minimum window",
+            };
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Resolve instance handles for one stream.
+ *
+ * Three outcomes, per §6 and §7: explicit handles are verified for
+ * eligibility; a single eligible handle resolves automatically; anything else
+ * is an owner choice the AS must surface before the final approval surface.
+ */
+function resolveInstances(request, streamName, inventory) {
+    const eligible = inventory.eligibleFor(streamName);
+    if (request.instance_ids !== undefined && request.instance_ids.length > 0) {
+        const ineligible = request.instance_ids.filter((id) => !eligible.includes(id));
+        if (ineligible.length > 0) {
+            return {
+                ok: false,
+                failure: {
+                    code: "unknown_instance",
+                    message: `stream '${streamName}' requests instance handles that are not eligible: ${ineligible.join(", ")}`,
+                    stream: streamName,
+                },
+            };
+        }
+        // Explicitly listing more than one handle is how a client asks for
+        // fan-in, and it is allowed precisely because it is explicit.
+        return { ok: true, instanceIds: unique(request.instance_ids) };
+    }
+    if (eligible.length === 0) {
+        return {
+            ok: false,
+            failure: {
+                code: "no_eligible_instance",
+                message: `stream '${streamName}' has no connected instance to authorize`,
+                stream: streamName,
+            },
+        };
+    }
+    if (eligible.length > 1) {
+        // Omission never means fan-in. The owner picks.
+        return {
+            ok: false,
+            failure: {
+                code: "instance_choice_required",
+                message: `stream '${streamName}' has ${eligible.length} eligible instances and the request named none`,
+                stream: streamName,
+                candidates: eligible,
+            },
+        };
+    }
+    return { ok: true, instanceIds: [eligible[0]] };
+}
+/**
+ * Freeze `time_range` into the grant's `time_constraint`, binding the
+ * declaration's `consent_time_field` as the field the RS evaluates against.
+ * Freezing the field name (not just the bounds) is what stops a later
+ * declaration that renames its time field from silently re-scoping the grant.
+ */
+function resolveTimeConstraint(window, declared) {
+    if (!window)
+        return undefined;
+    const { since, until } = window;
+    if (since === undefined && until === undefined)
+        return undefined;
+    // Validation already rejected time_range on a stream with no time field.
+    const field = declared.consent_time_field;
+    if (!field)
+        return undefined;
+    return {
+        field,
+        ...(since !== undefined && { since }),
+        ...(until !== undefined && { until }),
+    };
+}
+function resolveOneStream(request, declared, snapshot, inventory, revision, choices) {
+    const ceiling = requestedFields(request, declared, snapshot, revision);
+    if (!ceiling.ok)
+        return { kind: "failed", failure: ceiling.failure };
+    // v0.1 has no narrowing step, so its resolution is untouched by choices.
+    const fields = revision === "0.2"
+        ? narrowFields(ceiling.fields, choices?.fields?.[declared.name])
+        : ceiling.fields;
+    if (fields.length === 0) {
+        // The resolved selection must contain at least one field per retained
+        // stream, so an owner who narrowed everything away has refused the
+        // stream, not asked for all of it.
+        return {
+            kind: "failed",
+            failure: {
+                code: "empty_field_set",
+                message: `stream '${declared.name}' resolved to an empty field set`,
+                stream: declared.name,
+            },
+        };
+    }
+    const window = revision === "0.2"
+        ? narrowTimeRange(request.time_range, choices?.time_ranges?.[declared.name])
+        : request.time_range;
+    if (revision === "0.2") {
+        // Checked before instance resolution: an unsatisfiable minimum is a
+        // decision about this stream that does not depend on which handle serves
+        // it, and an optional stream that is about to drop out should not fail
+        // the whole authorization on a missing instance it will never use.
+        const satisfied = minimumSatisfied(request.minimum, fields, window);
+        if (!satisfied.ok) {
+            return { kind: "minimum_unmet", reason: satisfied.reason };
+        }
+    }
+    const instances = resolveInstances(request, declared.name, inventory);
+    if (!instances.ok)
+        return { kind: "failed", failure: instances.failure };
+    const timeConstraint = resolveTimeConstraint(window, declared);
+    return {
+        kind: "resolved",
+        stream: {
+            name: declared.name,
+            instance_ids: instances.instanceIds,
+            fields,
+            ...(timeConstraint && { time_constraint: timeConstraint }),
+            ...(request.resources && { resources: unique(request.resources) }),
+        },
+    };
+}
+/**
+ * Expand the request's stream selections into the concrete list to resolve.
+ *
+ * A wildcard entry fans out to every declared stream, carrying its own
+ * per-stream parameters with it — §6 says a wildcard's `instance_ids` apply to
+ * every expanded stream, and each handle is then verified per stream by
+ * `resolveInstances`. A preset expands from the snapshot instead.
+ *
+ * Exported because the consent surface must expand a request the same way
+ * resolution does. `approval.ts` collects the owner's pending instance
+ * choices over these expanded streams; when it derived its own list from
+ * `request.streams` alone, a `selection_preset` expanded to nothing there and
+ * to two eligible instances here, so the owner was never asked and the
+ * request died as unresolvable. One expansion, two readers.
+ */
+export function expandSelections(request, snapshot) {
+    if (request.selection_preset !== undefined) {
+        const preset = snapshot.selection_presets?.find((p) => p.name === request.selection_preset);
+        return preset ? preset.streams : [];
+    }
+    const streams = request.streams ?? [];
+    const wildcard = streams.find((s) => s.name === "*");
+    if (wildcard) {
+        return snapshot.streams.map((declared) => ({
+            ...wildcard,
+            name: declared.name,
+            // A wildcard cannot carry a view (validation rejects that pairing), and
+            // its time_range only applies to streams that can accept one. Dropping
+            // it for time-incapable streams is what makes `{"name":"*"}` with a
+            // time_range usable on a mixed-capability source at all.
+            ...(wildcard.time_range && !declared.consent_time_field
+                ? { time_range: undefined }
+                : {}),
+        }));
+    }
+    return streams;
+}
+/**
+ * Resolve every enforcement axis for a validated selection request.
+ *
+ * Call this before showing the final approval surface: §7 requires the
+ * approval artifact to contain the exact resolved instance handles, stream
+ * names, fields, resources, and temporal bounds, which only exist once this
+ * has run.
+ */
+export function resolveSelection(request, snapshot, inventory, choices) {
+    const revision = request.type === PDPP_DATA_ACCESS_TYPE_V02 ? "0.2" : "0.1";
+    const selections = expandSelections(request, snapshot);
+    if (selections.length === 0) {
+        return failure("unknown_stream", "the selection resolved to no streams against the retained snapshot");
+    }
+    const resolved = [];
+    const omitted = [];
+    const requestedStreams = [];
+    for (const selection of selections) {
+        const declared = snapshot.streams.find((s) => s.name === selection.name);
+        if (!declared) {
+            return failure("unknown_stream", `stream '${selection.name}' is not declared by the retained snapshot`, { stream: selection.name });
+        }
+        // `necessity` defaults to `required`, so an unmarked stream is one the AS
+        // must retain or refuse. Inferring "optional" from omission would let a
+        // client's silence become the owner's permission to drop a stream the
+        // client actually depends on.
+        const necessity = selection.necessity ?? "required";
+        if (revision === "0.2") {
+            const ceiling = requestedFields(selection, declared, snapshot, "0.2");
+            requestedStreams.push({
+                name: declared.name,
+                necessity,
+                fields: ceiling.ok ? ceiling.fields : [],
+                ...(selection.time_range && { time_range: selection.time_range }),
+                ...(selection.minimum && { minimum: selection.minimum }),
+            });
+            if (choices?.declined_streams?.includes(declared.name)) {
+                if (necessity === "required") {
+                    // A required stream is retained or the authorization is refused.
+                    // There is no third outcome, and in particular no weaker grant.
+                    return failure("required_stream_declined", `stream '${declared.name}' is required by the request and cannot be declined`, { stream: declared.name });
+                }
+                omitted.push(declared.name);
+                continue;
+            }
+        }
+        const outcome = resolveOneStream(selection, declared, snapshot, inventory, revision, choices);
+        if (outcome.kind === "failed") {
+            return { ok: false, failure: outcome.failure };
+        }
+        if (outcome.kind === "minimum_unmet") {
+            if (necessity === "required") {
+                // Refuse issuance rather than issue a weaker grant for this stream.
+                // The OAuth binding reports this as `access_denied`: the request was
+                // well-formed and the owner decided: the two are simply incompatible.
+                return failure("minimum_not_met", `stream '${declared.name}' is required and ${outcome.reason}`, { stream: declared.name });
+            }
+            // For an optional stream, failing its minimum permits omission of the
+            // whole stream — never a retained stream with a weaker projection.
+            omitted.push(declared.name);
+            continue;
+        }
+        resolved.push(outcome.stream);
+    }
+    if (resolved.length === 0) {
+        // No empty grants, and nothing added to compensate for a refused
+        // selection. A different proposal needs a new authorization request.
+        return failure("no_streams_approved", "the owner approved no streams; a grant with no authorized stream cannot be issued");
+    }
+    return {
+        ok: true,
+        streams: resolved,
+        ...(omitted.length > 0 && { omittedStreams: omitted }),
+        ...(revision === "0.2" && { requestedStreams }),
+    };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/pdpp/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/pdpp/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,yBAAyB,GAS1B,MAAM,YAAY,CAAC;AA8EpB,SAAS,OAAO,CACd,IAA2B,EAC3B,OAAe,EACf,KAAkC;IAElC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,iFAAiF;AACjF,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,eAAe,CACtB,OAAsB,EACtB,QAAwB,EACxB,QAA6B,EAC7B,QAAuB;IAEvB,IAAI,SAAmB,CAAC;IAExB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,SAAS,OAAO,CAAC,IAAI,kCAAkC;oBAChE,MAAM,EAAE,QAAQ,CAAC,IAAI;iBACtB;aACF,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxC,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,kEAAkE;QAClE,+CAA+C;QAC/C,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GACV,QAAQ,KAAK,KAAK;QAChB,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;QACrD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAExB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,WAAW,QAAQ,CAAC,IAAI,kCAAkC;gBACnE,MAAM,EAAE,QAAQ,CAAC,IAAI;aACtB;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CACnB,OAAiB,EACjB,MAA4B;IAE5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAS,OAAO,CAAC,KAAyB,EAAE,IAAY;IACtD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACtB,OAA8B,EAC9B,MAA6B;IAE7B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;SACzC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;SACzC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO;QACL,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CACvB,OAAiC,EACjC,MAAgB,EAChB,MAA6B;IAE7B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAElC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,0DAA0D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,0EAA0E;QAC1E,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5C,IACE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI;YAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,EACzC,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,uEAAuE;aAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,OAAsB,EACtB,UAAkB,EAClB,SAA4B;IAI5B,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAEnD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAC5C,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAC/B,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,WAAW,UAAU,sDAAsD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC3G,MAAM,EAAE,UAAU;iBACnB;aACF,CAAC;QACJ,CAAC;QACD,mEAAmE;QACnE,8DAA8D;QAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,WAAW,UAAU,0CAA0C;gBACxE,MAAM,EAAE,UAAU;aACnB;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,gDAAgD;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,WAAW,UAAU,SAAS,QAAQ,CAAC,MAAM,gDAAgD;gBACtG,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,QAAQ;aACrB;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,MAA6B,EAC7B,QAAwB;IAExB,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjE,yEAAyE;IACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,kBAAkB,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO;QACL,KAAK;QACL,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAaD,SAAS,gBAAgB,CACvB,OAAsB,EACtB,QAAwB,EACxB,QAA6B,EAC7B,SAA4B,EAC5B,QAAuB,EACvB,OAAiC;IAEjC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IAErE,yEAAyE;IACzE,MAAM,MAAM,GACV,QAAQ,KAAK,KAAK;QAChB,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAErB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,sEAAsE;QACtE,mEAAmE;QACnE,mCAAmC;QACnC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE;gBACP,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,WAAW,QAAQ,CAAC,IAAI,kCAAkC;gBACnE,MAAM,EAAE,QAAQ,CAAC,IAAI;aACtB;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,QAAQ,KAAK,KAAK;QAChB,CAAC,CAAC,eAAe,CACb,OAAO,CAAC,UAAU,EAClB,OAAO,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CACtC;QACH,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAEzB,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAEzE,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE/D,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,YAAY,EAAE,SAAS,CAAC,WAAW;YACnC,MAAM;YACN,GAAG,CAAC,cAAc,IAAI,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;SACnE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAyB,EACzB,QAA6B;IAE7B,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAC7C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,gBAAgB,CAC3C,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACzC,GAAG,QAAQ;YACX,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,yDAAyD;YACzD,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,kBAAkB;gBACrD,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE;gBAC3B,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC,CAAC;IACN,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAyB,EACzB,QAA6B,EAC7B,SAA4B,EAC5B,OAAsB;IAEtB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5E,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CACZ,gBAAgB,EAChB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAE/C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,OAAO,CACZ,gBAAgB,EAChB,WAAW,SAAS,CAAC,IAAI,4CAA4C,EACrE,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,CAC3B,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,8BAA8B;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,UAAU,CAAC;QAEpD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACtE,gBAAgB,CAAC,IAAI,CAAC;gBACpB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,SAAS;gBACT,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBACxC,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC;gBACjE,GAAG,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;aACzD,CAAC,CAAC;YAEH,IAAI,OAAO,EAAE,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;oBAC7B,iEAAiE;oBACjE,gEAAgE;oBAChE,OAAO,OAAO,CACZ,0BAA0B,EAC1B,WAAW,QAAQ,CAAC,IAAI,qDAAqD,EAC7E,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAC1B,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAC9B,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,OAAO,CACR,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACjD,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACrC,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;gBAC7B,oEAAoE;gBACpE,qEAAqE;gBACrE,sEAAsE;gBACtE,OAAO,OAAO,CACZ,iBAAiB,EACjB,WAAW,QAAQ,CAAC,IAAI,qBAAqB,OAAO,CAAC,MAAM,EAAE,EAC7D,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAC1B,CAAC;YACJ,CAAC;YACD,sEAAsE;YACtE,mEAAmE;YACnE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,iEAAiE;QACjE,qEAAqE;QACrE,OAAO,OAAO,CACZ,qBAAqB,EACrB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,QAAQ;QACjB,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QACtD,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,EAAE,gBAAgB,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC"}