@polardbx/pxbaas 0.1.0-beta.1 → 0.1.0-beta.10

package/templates/webapp/ssr-blog/db/schema.sql

@@ -6,11 +6,13 @@
 --   · 多租户实例：__SCHEMA__ = tenant_<tenant_id>
 --   sed 's/__SCHEMA__/public/g' db/schema.sql
 --
--- 执行通道：单租户可 pxbaas db query；多租户走 POST {endpoint}/pg/query
---           （全局 service_role key 作 Authorization+apikey），语句写全限定名。
+-- 执行通道（推荐）：`pxbaas app db-init <name>` —— 单/多租户通用：
+--   单租户 __SCHEMA__→public 经 /pg/query；多租户 __SCHEMA__ 去限定经 /api/tenant-ddl
+--   用 per-tenant service_role key 执行（GRANT 仅本租户库）。本文件只含 DDL + 种子；
+--   RLS 声明在同目录 db/rls.json，由 db-init 一并应用。
 --
--- ⚠️ RLS 元数据落点（写错静默失效＝RLS 关闭）：永远写中心库 supabase._mysqlrest_rls_*，
---    且 table_schema 填 __SCHEMA__；租户库内同名表无人读取，勿写入。
+-- ⚠️ RLS 元数据落点（写错静默失效＝RLS 关闭）：永远写中心库 supabase._mysqlrest_rls_*；
+--    db-init 自动绑定 table_schema（单租户=--schema，多租户=服务端强绑），勿手写库名。
 -- =============================================================================
 
 CREATE TABLE IF NOT EXISTS `__SCHEMA__`.`posts_ssr` (
@@ -26,30 +28,8 @@ CREATE TABLE IF NOT EXISTS `__SCHEMA__`.`posts_ssr` (
   KEY `idx_posts_ssr_status` (`status`, `created_at`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
--- ---- RLS 注册 ----
-INSERT IGNORE INTO supabase._mysqlrest_rls_tables (table_schema, table_name, rls_enabled, rls_forced)
-VALUES ('__SCHEMA__','posts_ssr',1,0);
-
--- ---- RLS 策略：anon 只读 published；authenticated 读 published 或本人；写改删限本人 ----
-INSERT IGNORE INTO supabase._mysqlrest_rls_policies
-  (table_schema, table_name, policy_name, role_name, command, using_expr, check_expr, permissive)
-VALUES ('__SCHEMA__','posts_ssr','posts_ssr_select_anon','anon','SELECT','`status` = ''published''',NULL,1);
-INSERT IGNORE INTO supabase._mysqlrest_rls_policies
-  (table_schema, table_name, policy_name, role_name, command, using_expr, check_expr, permissive)
-VALUES ('__SCHEMA__','posts_ssr','posts_ssr_select_auth','authenticated','SELECT',
-        '`status` = ''published'' OR author_id = {{request.jwt.claim.sub}}',NULL,1);
-INSERT IGNORE INTO supabase._mysqlrest_rls_policies
-  (table_schema, table_name, policy_name, role_name, command, using_expr, check_expr, permissive)
-VALUES ('__SCHEMA__','posts_ssr','posts_ssr_insert_auth','authenticated','INSERT',NULL,
-        'author_id = {{request.jwt.claim.sub}}',1);
-INSERT IGNORE INTO supabase._mysqlrest_rls_policies
-  (table_schema, table_name, policy_name, role_name, command, using_expr, check_expr, permissive)
-VALUES ('__SCHEMA__','posts_ssr','posts_ssr_update_auth','authenticated','UPDATE',
-        'author_id = {{request.jwt.claim.sub}}','author_id = {{request.jwt.claim.sub}}',1);
-INSERT IGNORE INTO supabase._mysqlrest_rls_policies
-  (table_schema, table_name, policy_name, role_name, command, using_expr, check_expr, permissive)
-VALUES ('__SCHEMA__','posts_ssr','posts_ssr_delete_auth','authenticated','DELETE',
-        'author_id = {{request.jwt.claim.sub}}',NULL,1);
+-- ---- RLS 注册与策略：声明在同目录 db/rls.json，由 `pxbaas app db-init` 应用 ----
+--   anon 只读 published；authenticated 读 published 或本人；写/改/删限本人（author_id = jwt.sub）。
 
 -- ---- 种子文章（3 篇 published，幂等）----
 INSERT INTO `__SCHEMA__`.`posts_ssr` (title, content, author_id, author_name, status)

package/templates/webapp/ssr-hono/backend/index.ts

@@ -37,30 +37,45 @@ function esc(s: string): string {
     .split(String.fromCharCode(34)).join(""");
 }
 
-// L3 shape demo: server-side fetch of DB content via the derived internal base
-// (anon key from env; RLS enforced server-side). Degrades gracefully so the
-// shell still renders if the internal entry is ever unreachable.
-app.get("/ssr-data", async (c) => {
-  let rows: Array<Record<string, unknown>> = [];
-  let note = "";
-  try {
-    const r = await fetch(internalBase() + "/rest/v1/?select=1", {
-      headers: { apikey: Deno.env.get("SUPABASE_ANON_KEY") || "" },
-    });
-    note = `internal base reachable: http-${r.status}`;
-  } catch (e) {
-    note = `internal base unreachable: ${String(e).slice(0, 60)}`;
-  }
-  return c.html(`<!DOCTYPE html><html><head><meta charset="utf-8"><title>L3 demo</title></head><body>
+// Path contract (APP_WORKER_PATH_REWRITE off = current default): the proxy
+// forwards /apps/{mount}/api/<x> to the worker as /<candidateSlug>/<x> — the
+// candidate slug prefix is NOT stripped at runtime (the stripped path is only
+// delivered via X-Pxbaas-Worker-Path when the rewrite kill-switch is ON, which
+// is disabled by default due to the D18 streamRid regression). Normalize the
+// slug prefix away and match on the logical path, so handlers resolve under ANY
+// prefix shape (/{slug}/x, /api/x, or /x) and still work if the switch flips on.
+// Same convention as the ssr-shop / ssr-blog / csr-bff templates.
+function norm(path: string): string {
+  return path.replace(/^\/app_[^/]+/, "") || path;
+}
+
+app.get("*", async (c) => {
+  const p = norm(new URL(c.req.url).pathname);
+
+  // L3 shape demo: server-side fetch of DB content via the derived internal base
+  // (anon key from env; RLS enforced server-side). Degrades gracefully so the
+  // shell still renders if the internal entry is ever unreachable.
+  if (p === "/ssr-data") {
+    let rows: Array<Record<string, unknown>> = [];
+    let note = "";
+    try {
+      const r = await fetch(internalBase() + "/rest/v1/?select=1", {
+        headers: { apikey: Deno.env.get("SUPABASE_ANON_KEY") || "" },
+      });
+      note = `internal base reachable: http-${r.status}`;
+    } catch (e) {
+      note = `internal base unreachable: ${String(e).slice(0, 60)}`;
+    }
+    return c.html(`<!DOCTYPE html><html><head><meta charset="utf-8"><title>L3 demo</title></head><body>
 <div id="__ssr" data-ssr="v1"><h1>L3 full-SSR demo</h1><p>${esc(note)}</p><pre>${esc(JSON.stringify(rows))}</pre></div>
 </body></html>`);
-});
+  }
 
-app.get("/page", (c) => {
-  const theme = c.req.query("theme") === "dark" ? "dark" : "light";
-  const bg = theme === "dark" ? "#111" : "#fafafa";
-  const fg = theme === "dark" ? "#eee" : "#222";
-  const html = `<!DOCTYPE html><html><head><meta charset="utf-8">
+  if (p === "/page") {
+    const theme = c.req.query("theme") === "dark" ? "dark" : "light";
+    const bg = theme === "dark" ? "#111" : "#fafafa";
+    const fg = theme === "dark" ? "#eee" : "#222";
+    const html = `<!DOCTYPE html><html><head><meta charset="utf-8">
 <title>{{APP_NAME}} SSR</title>
 <style>body{font-family:sans-serif;max-width:720px;margin:40px auto;background:${bg};color:${fg}}</style>
 </head><body>
@@ -77,16 +92,20 @@ app.get("/page", (c) => {
 })();
 </script>
 </body></html>`;
-  return c.html(html);
-});
+    return c.html(html);
+  }
+
+  // JSON API. /apps/{m}/api/data and /api/health normalize to /data and /health
+  // after the slug strip; the /api-prefixed shapes are kept as a defensive
+  // fallback for deployments that deliver the logical path un-stripped.
+  if (p === "/data" || p === "/api/data") {
+    return c.json({ ok: true, engine: "hono", now: new Date().toISOString() });
+  }
+  if (p === "/health" || p === "/api/health") {
+    return c.json({ ok: true });
+  }
 
-// Path contract (APP_WORKER_PATH_REWRITE off, current default): the /api/* branch
-// delivers the STRIPPED logical path (/data, /health) while static-miss
-// fallthrough delivers the FULL logical path (/page). Register both shapes so
-// the worker behaves identically when the rewrite kill-switch is flipped back on.
-app.get("/data", (c) => c.json({ ok: true, engine: "hono", now: new Date().toISOString() }));
-app.get("/api/data", (c) => c.json({ ok: true, engine: "hono", now: new Date().toISOString() }));
-app.get("/health", (c) => c.json({ ok: true }));
-app.get("/api/health", (c) => c.json({ ok: true }));
+  return c.json({ ok: false, error: "not_found", path: p }, 404);
+});
 
 Deno.serve(app.fetch);

package/templates/webapp/ssr-shop/db/rls.json

@@ -0,0 +1,16 @@
+{
+  "$comment": "Declarative RLS for the shop webapp. Applied by `pxbaas app db-init` (single-tenant AND multi-tenant). table_schema is NEVER declared here: single-tenant binds it to --schema (default public); multi-tenant binds it server-side to the tenant db. using/check expressions may embed {{request.jwt.claim.*}} templates.",
+  "tables": [
+    { "table": "products", "rlsEnabled": true, "rlsForced": false },
+    { "table": "orders", "rlsEnabled": true, "rlsForced": false },
+    { "table": "order_items", "rlsEnabled": true, "rlsForced": false }
+  ],
+  "policies": [
+    { "table": "products", "name": "products_select_anon", "role": "anon", "command": "SELECT", "using": "1=1", "check": null, "permissive": true },
+    { "table": "products", "name": "products_select_auth", "role": "authenticated", "command": "SELECT", "using": "1=1", "check": null, "permissive": true },
+    { "table": "orders", "name": "orders_select_auth", "role": "authenticated", "command": "SELECT", "using": "`buyer_email` = {{request.jwt.claim.email}} OR {{request.jwt.claim.email}} = 'admin@shop.demo'", "check": null, "permissive": true },
+    { "table": "orders", "name": "orders_insert_auth", "role": "authenticated", "command": "INSERT", "using": null, "check": "`buyer_email` = {{request.jwt.claim.email}}", "permissive": true },
+    { "table": "order_items", "name": "order_items_select_auth", "role": "authenticated", "command": "SELECT", "using": "`buyer_email` = {{request.jwt.claim.email}} OR {{request.jwt.claim.email}} = 'admin@shop.demo'", "check": null, "permissive": true },
+    { "table": "order_items", "name": "order_items_insert_auth", "role": "authenticated", "command": "INSERT", "using": null, "check": "`buyer_email` = {{request.jwt.claim.email}}", "permissive": true }
+  ]
+}

package/templates/webapp/ssr-shop/db/schema.sql

@@ -6,15 +6,16 @@
 --   · 多租户实例：__SCHEMA__ = tenant_<tenant_id>（每租户一套库）
 --   sed 's/__SCHEMA__/public/g' db/schema.sql
 --
--- 执行通道：
---   · 单租户：pxbaas db query "<单条 SQL>" --role service_role --profile <p>
---   · 多租户：POST {endpoint}/pg/query（全局 service_role key 作 Authorization+apikey），
---             语句里必须写全限定名 tenant_<id>.<table>；pxbaas db query 在 MT 下会 401。
+-- 执行通道（推荐）：`pxbaas app db-init <name>` —— 单/多租户通用，自动：
+--   · 单租户：__SCHEMA__ → public，经 /pg/query（全局 admin）执行；
+--   · 多租户：__SCHEMA__ 去限定（连接已锁租户库），经 /api/tenant-ddl 用
+--             per-tenant service_role key 执行；GRANT 仅本租户库，天然隔离。
+--   本文件只含 DDL + 种子；RLS 声明在同目录 db/rls.json，由 db-init 一并应用。
 --
 -- ⚠️ RLS 元数据的落点（写错静默失效，等价于关闭 RLS）：
---   永远写中心库 supabase._mysqlrest_rls_tables / _mysqlrest_rls_policies，
---   且 table_schema 填 __SCHEMA__（单租户=public，多租户=tenant_<id>）。
---   租户库里由开通流程创建的同名 _mysqlrest_rls_* 表没有任何服务读取，勿写入。
+--   永远写中心库 supabase._mysqlrest_rls_tables / _mysqlrest_rls_policies。
+--   db-init 会自动绑定 table_schema（单租户=--schema，多租户=服务端强绑租户库），
+--   无需也不要手写库名。租户库内同名 _mysqlrest_rls_* 表没有任何服务读取，勿写入。
 -- =============================================================================
 
 -- ---- 表结构 ----
@@ -54,41 +55,10 @@ CREATE TABLE IF NOT EXISTS `__SCHEMA__`.`order_items` (
   created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
 );
 
--- ---- RLS 注册（中心库 supabase）----
-INSERT IGNORE INTO supabase._mysqlrest_rls_tables (table_schema, table_name, rls_enabled, rls_forced)
-VALUES ('__SCHEMA__','products',1,0), ('__SCHEMA__','orders',1,0), ('__SCHEMA__','order_items',1,0);
-
--- ---- RLS 策略 ----
--- products：公开目录，anon / authenticated 均可读
-INSERT IGNORE INTO supabase._mysqlrest_rls_policies
-  (table_schema, table_name, policy_name, role_name, command, using_expr, check_expr, permissive)
-VALUES ('__SCHEMA__','products','products_select_anon','anon','SELECT','1=1',NULL,1);
-INSERT IGNORE INTO supabase._mysqlrest_rls_policies
-  (table_schema, table_name, policy_name, role_name, command, using_expr, check_expr, permissive)
-VALUES ('__SCHEMA__','products','products_select_auth','authenticated','SELECT','1=1',NULL,1);
-
--- orders：仅本人（buyer_email = jwt.email）或管理员白名单可读；仅本人可写
-INSERT IGNORE INTO supabase._mysqlrest_rls_policies
-  (table_schema, table_name, policy_name, role_name, command, using_expr, check_expr, permissive)
-VALUES ('__SCHEMA__','orders','orders_select_auth','authenticated','SELECT',
-        '`buyer_email` = {{request.jwt.claim.email}} OR {{request.jwt.claim.email}} = ''admin@shop.demo''',
-        NULL, 1);
-INSERT IGNORE INTO supabase._mysqlrest_rls_policies
-  (table_schema, table_name, policy_name, role_name, command, using_expr, check_expr, permissive)
-VALUES ('__SCHEMA__','orders','orders_insert_auth','authenticated','INSERT',NULL,
-        '`buyer_email` = {{request.jwt.claim.email}}', 1);
-
--- order_items：仅本人（buyer_email = jwt.email）或管理员白名单可读；仅本人可写（owner 门禁落在本表，
--- 不依赖前端按 order_id 过滤 —— 前端过滤不是安全边界，R2-05）。
-INSERT IGNORE INTO supabase._mysqlrest_rls_policies
-  (table_schema, table_name, policy_name, role_name, command, using_expr, check_expr, permissive)
-VALUES ('__SCHEMA__','order_items','order_items_select_auth','authenticated','SELECT',
-        '`buyer_email` = {{request.jwt.claim.email}} OR {{request.jwt.claim.email}} = ''admin@shop.demo''',
-        NULL, 1);
-INSERT IGNORE INTO supabase._mysqlrest_rls_policies
-  (table_schema, table_name, policy_name, role_name, command, using_expr, check_expr, permissive)
-VALUES ('__SCHEMA__','order_items','order_items_insert_auth','authenticated','INSERT',NULL,
-        '`buyer_email` = {{request.jwt.claim.email}}', 1);
+-- ---- RLS 注册与策略：声明在同目录 db/rls.json，由 `pxbaas app db-init` 应用 ----
+--   · products：公开目录，anon / authenticated 均可读；
+--   · orders / order_items：仅本人（buyer_email = jwt.email）或管理员白名单可读，仅本人可写。
+--   （不再内联 INSERT，避免与 rls.json 双源；如需手动注册见 db/rls.json。）
 
 -- ---- 种子商品（10 件，幂等）----
 INSERT INTO `__SCHEMA__`.`products` (name, description, price_cents, stock, emoji, category)

package/dist/commands/login/login.d.ts

@@ -1,3 +0,0 @@
-import { Command } from 'commander';
-export declare function registerLoginCommand(program: Command): void;
-//# sourceMappingURL=login.d.ts.map

package/dist/commands/login/login.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/login/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4CpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAkB3D"}

package/dist/commands/login/login.js

@@ -1,185 +0,0 @@
-import inquirer from 'inquirer';
-import { CredentialStore, ProfileManager, introspectJwt, validateTenantConsistency, assertTty, assertNoKeyArgs, formatSuccess, formatError, computeFingerprint, } from '../../credentials/index.js';
-/**
- * 从 stdin 读取一行（用于 --anon-key-stdin / --service-key-stdin）
- */
-async function readFromStdin() {
-    return new Promise((resolve, reject) => {
-        let data = '';
-        process.stdin.setEncoding('utf8');
-        process.stdin.on('readable', () => {
-            let chunk;
-            while ((chunk = process.stdin.read()) !== null) {
-                data += chunk;
-            }
-        });
-        process.stdin.on('end', () => {
-            resolve(data.trim());
-        });
-        process.stdin.on('error', reject);
-    });
-}
-export function registerLoginCommand(program) {
-    program
-        .command('login')
-        .description('Authenticate with PolarDB-X BaaS (interactive TTY only)')
-        .option('--endpoint <url>', 'BaaS endpoint URL')
-        .option('--tenant-id <id>', 'Tenant ID (for multi-tenant mode)')
-        .option('--anon-key-stdin', 'Read anon key from stdin')
-        .option('--service-key-stdin', 'Read service role key from stdin')
-        .option('--profile <name>', 'Profile name to use')
-        .action(async (options) => {
-        try {
-            await handleLogin(options, program);
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            console.error(formatError(message));
-            process.exit(1);
-        }
-    });
-}
-async function handleLogin(options, program) {
-    // 检查 argv 中是否有密钥参数（安全守卫）
-    assertNoKeyArgs(process.argv);
-    const isStdinMode = options.anonKeyStdin || options.serviceKeyStdin;
-    // 如果不是 stdin 模式，必须是 TTY
-    if (!isStdinMode) {
-        assertTty();
-    }
-    let endpoint;
-    let tenantId;
-    let anonKey;
-    let serviceRoleKey;
-    if (isStdinMode) {
-        // stdin 模式：从命令行参数或 stdin 获取
-        endpoint = options.endpoint || '';
-        tenantId = options.tenantId;
-        if (!endpoint) {
-            throw new Error('--endpoint is required when using --anon-key-stdin or --service-key-stdin');
-        }
-        if (options.anonKeyStdin && options.serviceKeyStdin) {
-            // 两个都从 stdin 读取（每行一个）
-            const lines = (await readFromStdin()).split('\n');
-            if (lines.length < 2) {
-                throw new Error('Expected two lines from stdin: anon key on first line, service role key on second line');
-            }
-            anonKey = lines[0].trim();
-            serviceRoleKey = lines[1].trim();
-        }
-        else if (options.anonKeyStdin) {
-            anonKey = (await readFromStdin()).trim();
-            throw new Error('--service-key-stdin is required when using --anon-key-stdin');
-        }
-        else {
-            serviceRoleKey = (await readFromStdin()).trim();
-            throw new Error('--anon-key-stdin is required when using --service-key-stdin');
-        }
-    }
-    else {
-        // TTY 交互模式：使用 inquirer 提示
-        const answers = await inquirer.prompt([
-            {
-                type: 'input',
-                name: 'endpoint',
-                message: 'BaaS endpoint URL:',
-                default: options.endpoint || 'http://localhost:8000',
-                validate: (input) => {
-                    if (!input.trim())
-                        return 'Endpoint is required';
-                    if (!input.startsWith('http://') && !input.startsWith('https://')) {
-                        return 'Endpoint must start with http:// or https://';
-                    }
-                    return true;
-                },
-            },
-            {
-                type: 'input',
-                name: 'tenantId',
-                message: 'Tenant ID (leave empty for single-tenant mode):',
-                default: options.tenantId || '',
-            },
-            {
-                type: 'password',
-                name: 'anonKey',
-                message: 'Anon Key:',
-                mask: '*',
-                validate: (input) => {
-                    if (!input.trim())
-                        return 'Anon key is required';
-                    return true;
-                },
-            },
-            {
-                type: 'password',
-                name: 'serviceRoleKey',
-                message: 'Service Role Key:',
-                mask: '*',
-                validate: (input) => {
-                    if (!input.trim())
-                        return 'Service role key is required';
-                    return true;
-                },
-            },
-        ]);
-        endpoint = answers.endpoint;
-        tenantId = answers.tenantId || undefined;
-        anonKey = answers.anonKey;
-        serviceRoleKey = answers.serviceRoleKey;
-    }
-    // 解析 JWT
-    const anonJwt = await introspectJwt(anonKey);
-    const serviceJwt = await introspectJwt(serviceRoleKey);
-    // 检查 JWT 是否过期
-    if (anonJwt.isExpired) {
-        console.warn(formatError('Warning: Anon key is expired'));
-    }
-    if (serviceJwt.isExpired) {
-        console.warn(formatError('Warning: Service role key is expired'));
-    }
-    // 创建 profile
-    const mode = tenantId ? 'multi-tenant' : 'single-tenant';
-    const profileName = options.profile || 'default';
-    const profile = {
-        name: profileName,
-        endpoint,
-        tenantId,
-        mode,
-        createdAt: new Date().toISOString(),
-        updatedAt: new Date().toISOString(),
-    };
-    // 验证租户一致性
-    validateTenantConsistency(profile, anonJwt, serviceJwt);
-    // 保存 profile
-    const profileManager = new ProfileManager();
-    await profileManager.setProfile(profile);
-    await profileManager.useProfile(profileName);
-    // 保存凭据
-    const credentialStore = new CredentialStore();
-    await credentialStore.setCredentials(profileName, {
-        anonKey,
-        serviceRoleKey,
-        storedAt: new Date().toISOString(),
-    });
-    // 输出成功消息
-    const output = {
-        profile: profileName,
-        endpoint,
-        tenantId: tenantId || '(single-tenant)',
-        mode,
-        anonKeyFingerprint: computeFingerprint(anonKey),
-        serviceKeyFingerprint: computeFingerprint(serviceRoleKey),
-    };
-    if (options.json || program.opts().json) {
-        console.log(JSON.stringify(output, null, 2));
-    }
-    else {
-        console.log(formatSuccess(`Login successful for profile: ${profileName}`));
-        console.log(`  Endpoint:    ${endpoint}`);
-        console.log(`  Tenant ID:   ${tenantId || '(single-tenant)'}`);
-        console.log(`  Mode:        ${mode}`);
-        console.log(`  Anon Key:    ${output.anonKeyFingerprint}`);
-        console.log(`  Service Key: ${output.serviceKeyFingerprint}`);
-    }
-}
-//# sourceMappingURL=login.js.map

package/dist/commands/login/login.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/login/login.ts"],"names":[],"mappings":"AACA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,eAAe,EACf,cAAc,EACd,aAAa,EACb,yBAAyB,EACzB,SAAS,EACT,eAAe,EACf,aAAa,EACb,WAAW,EACX,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAWpC;;GAEG;AACH,KAAK,UAAU,aAAa;IAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE;YAChC,IAAI,KAAa,CAAC;YAClB,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/C,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;SAC/C,MAAM,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SAC/D,MAAM,CAAC,kBAAkB,EAAE,0BAA0B,CAAC;SACtD,MAAM,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;SACjE,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;SACjD,MAAM,CAAC,KAAK,EAAE,OAAqB,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE,OAAgB;IAChE,yBAAyB;IACzB,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;IAEpE,wBAAwB;IACxB,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,SAAS,EAAE,CAAC;IACd,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,QAA4B,CAAC;IACjC,IAAI,OAAe,CAAC;IACpB,IAAI,cAAsB,CAAC;IAE3B,IAAI,WAAW,EAAE,CAAC;QAChB,4BAA4B;QAC5B,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAE5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YACpD,sBAAsB;YACtB,MAAM,KAAK,GAAG,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;YAC5G,CAAC;YACD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1B,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC;aAAM,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAChC,OAAO,GAAG,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,0BAA0B;QAC1B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;YACpC;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,oBAAoB;gBAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,uBAAuB;gBACpD,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;wBAAE,OAAO,sBAAsB,CAAC;oBACjD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;wBAClE,OAAO,8CAA8C,CAAC;oBACxD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF;YACD;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,iDAAiD;gBAC1D,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;aAChC;YACD;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;wBAAE,OAAO,sBAAsB,CAAC;oBACjD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF;YACD;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,mBAAmB;gBAC5B,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;wBAAE,OAAO,8BAA8B,CAAC;oBACzD,OAAO,IAAI,CAAC;gBACd,CAAC;aACF;SACF,CAAC,CAAC;QAEH,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;QACzC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1B,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1C,CAAC;IAED,SAAS;IACT,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC;IAEvD,cAAc;IACd,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,aAAa;IACb,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC;IACzD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC;IAEjD,MAAM,OAAO,GAAgB;QAC3B,IAAI,EAAE,WAAW;QACjB,QAAQ;QACR,QAAQ;QACR,IAAI;QACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,UAAU;IACV,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAExD,aAAa;IACb,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAE7C,OAAO;IACP,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9C,MAAM,eAAe,CAAC,cAAc,CAAC,WAAW,EAAE;QAChD,OAAO;QACP,cAAc;QACd,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC;IAEH,SAAS;IACT,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,WAAW;QACpB,QAAQ;QACR,QAAQ,EAAE,QAAQ,IAAI,iBAAiB;QACvC,IAAI;QACJ,kBAAkB,EAAE,kBAAkB,CAAC,OAAO,CAAC;QAC/C,qBAAqB,EAAE,kBAAkB,CAAC,cAAc,CAAC;KAC1D,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,iCAAiC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,IAAI,iBAAiB,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}