@polardbx/pxbaas 0.1.0-beta.1 → 0.1.0-beta.3

package/dist/db/apply-schema.d.ts

@@ -1,17 +1,31 @@
 /**
- * Single-tenant schema apply engine shared by `pxbaas db push <file>` and
- * `pxbaas app db-init <name>`.
+ * Schema apply engine shared by `pxbaas db push <file>` and `pxbaas app db-init <name>`.
  *
- * Safety contract (agreed design):
- *   - The plan (every statement) is shown BEFORE anything runs.
+ * Two execution identities (chosen by profile.mode via {@link getSchemaSink}):
+ *   - single-tenant → MetaDriver `/pg/query` with the global service_role key
+ *     (that key IS the platform admin, so it can also write the central RLS
+ *     registry `supabase._mysqlrest_rls_*` directly).
+ *   - multi-tenant  → TenantDdlDriver `/api/tenant-ddl/*` with the per-tenant
+ *     service_role key. DDL/DML runs on the tenant's OWN database; RLS goes
+ *     through the structured endpoints (the tenant account has NO grant on the
+ *     shared `supabase` database, so a raw central INSERT would be denied).
+ *
+ * Safety contract (agreed design, unchanged):
+ *   - The plan (every step) is shown BEFORE anything runs.
  *   - Execution requires explicit authorization: an interactive confirm, or
  *     `--yes` for non-interactive use. `--dry-run` only previews.
- *   - Statements run sequentially and STOP ON THE FIRST ERROR.
- *   - No automatic rollback — already-applied statements stay applied.
- *   - Multi-tenant profiles are rejected: tenant DDL is out of scope (it needs
- *     the global service_role key via POST /pg/query with tenant_<id>.<table>).
+ *   - Steps run sequentially and STOP ON THE FIRST ERROR.
+ *   - No automatic rollback — already-applied steps stay applied.
+ *
+ * RLS source (see plan §5, decision R-C "hybrid"):
+ *   - a declarative `db/rls.json` is preferred when present;
+ *   - otherwise the `INSERT ... supabase._mysqlrest_rls_*` statements embedded in
+ *     schema.sql are parsed (multi-tenant) or run verbatim (single-tenant).
  */
-import { MetaDriver } from "@polardbx/pxbaas-client";
+import { MetaDriver, type RlsTableInput, type RlsPolicyInput } from "@polardbx/pxbaas-client";
+import type { ProfileMode } from "../credentials/profile.js";
+import { type RlsJson } from "./sql-file.js";
+export type { RlsJson };
 export interface ApplyOptions {
     /** Target schema the `__SCHEMA__` placeholder resolves to (single-tenant: public). */
     schema: string;
@@ -22,9 +36,12 @@ export interface ApplyOptions {
     /** Emit a structured result instead of human text (caller prints JSON). */
     json: boolean;
 }
+export type StepKind = "sql" | "rls-table" | "rls-policy";
 export interface StatementResult {
     index: number;
+    /** For sql steps this is the SQL; for RLS steps a human-readable description. */
     sql: string;
+    kind?: StepKind;
     status: "pending" | "ok" | "failed" | "skipped";
     error?: string;
 }
@@ -37,12 +54,56 @@ export interface ApplyResult {
     dryRun: boolean;
     authorized: boolean;
     statements: StatementResult[];
+    /** Present when produced by {@link applySchema}. */
+    mode?: ProfileMode;
+    rls?: {
+        tables: number;
+        policies: number;
+        source: "rls.json" | "schema.sql" | "none";
+    };
 }
 /** A minimal SQL executor so this module stays unit-testable without MetaDriver. */
 export type SqlExecutor = (sql: string) => Promise<unknown>;
+/** Per-call context the sink needs to render/apply structured RLS. */
+export interface RlsApplyContext {
+    /** Single-tenant target schema; ignored by the multi-tenant sink (server-bound). */
+    schema: string;
+}
+/**
+ * Execution strategy for a resolved profile. Encapsulates the single- vs
+ * multi-tenant channel difference so {@link applySchema} stays mode-agnostic.
+ */
+export interface SchemaSink {
+    mode: ProfileMode;
+    profileName: string;
+    /** Run one DDL/DML statement on the appropriate channel. */
+    runStatement(sql: string): Promise<unknown>;
+    /** Apply one RLS table toggle. */
+    applyRlsTable(input: RlsTableInput, ctx: RlsApplyContext): Promise<unknown>;
+    /** Apply one RLS policy. */
+    applyRlsPolicy(input: RlsPolicyInput, ctx: RlsApplyContext): Promise<unknown>;
+    /** Human-readable label for the plan preview. */
+    renderRlsTable(input: RlsTableInput, ctx: RlsApplyContext): string;
+    renderRlsPolicy(input: RlsPolicyInput, ctx: RlsApplyContext): string;
+    /** Drop one of the app's tables (used by `app destroy --purge-db`). */
+    dropTable(table: string, ctx: RlsApplyContext): Promise<unknown>;
+    /**
+     * Remove the RLS registry rows for one table. `toggleRemoved` reports whether
+     * the central `_mysqlrest_rls_tables` enable/force row was deleted. In
+     * multi-tenant this uses `DELETE /api/tenant-ddl/rls/tables`; on instances that
+     * predate that endpoint the call fails and we degrade gracefully (the benign
+     * toggle row is left and self-heals on the next db-init upsert).
+     */
+    purgeRlsForTable(table: string, ctx: RlsApplyContext): Promise<{
+        policiesDeleted: number;
+        toggleRemoved: boolean;
+    }>;
+}
 /**
  * Resolve the active profile into a single-tenant MetaDriver.
  * @throws when there is no profile, no credentials, or the profile is multi-tenant.
+ * @deprecated prefer {@link getSchemaSink}, which supports both modes. Kept for
+ * single-tenant callers and existing tests.
  */
 export declare function getSingleTenantMetaDriver(role?: "anon" | "service_role"): Promise<{
     driver: MetaDriver;
@@ -50,8 +111,34 @@ export declare function getSingleTenantMetaDriver(role?: "anon" | "service_role"
     profileName: string;
 }>;
 /**
- * Show the plan, obtain authorization, then apply statements sequentially with
- * stop-on-first-error semantics. Never rolls back.
+ * Resolve the active profile into a mode-appropriate {@link SchemaSink}.
+ * Unlike {@link getSingleTenantMetaDriver}, a multi-tenant profile is fully
+ * supported: DDL/RLS route through the tenant self-service endpoints using the
+ * per-tenant service_role key (Kong injects the trusted X-Tenant-Id).
+ */
+export declare function getSchemaSink(role?: "anon" | "service_role"): Promise<SchemaSink>;
+/**
+ * Apply a raw SQL script through an injected executor (single-tenant legacy
+ * path). Schema substitution uses the single-tenant rule; RLS statements are
+ * NOT diverted (they run verbatim through the executor). For mode-aware apply
+ * with RLS diversion use {@link applySchema}.
  */
 export declare function applySqlStatements(rawSql: string, source: string, opts: ApplyOptions, executor: SqlExecutor): Promise<ApplyResult>;
+export interface ApplySchemaParams extends ApplyOptions {
+    rawSql: string;
+    source: string;
+    /** Parsed `db/rls.json` (preferred RLS source); null/absent → fall back to schema.sql. */
+    rls?: RlsJson | null;
+}
+/**
+ * Mode-aware apply used by `db push` and `app db-init`.
+ *
+ * - Splits the script, then (multi-tenant OR when rls.json is present) diverts
+ *   the embedded central-registry RLS INSERTs out of the raw-SQL stream.
+ * - RLS source: `db/rls.json` when present; else parsed from schema.sql
+ *   (multi-tenant) or left embedded (single-tenant legacy).
+ * - `__SCHEMA__`: single-tenant → --schema; multi-tenant → de-qualified.
+ * - Order: DDL/seed first (tables must exist), then RLS tables, then policies.
+ */
+export declare function applySchema(params: ApplySchemaParams, sink: SchemaSink): Promise<ApplyResult>;
 //# sourceMappingURL=apply-schema.d.ts.map

package/dist/db/apply-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply-schema.d.ts","sourceRoot":"","sources":["../../src/db/apply-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAUrD,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,oFAAoF;AACpF,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE5D;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,GAAE,MAAM,GAAG,cAA+B,GAC7C,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/E;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,WAAW,CAAC,CAyItB"}
+{"version":3,"file":"apply-schema.d.ts","sourceRoot":"","sources":["../../src/db/apply-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EACL,UAAU,EAEV,KAAK,aAAa,EAClB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AAQjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAWL,KAAK,OAAO,EACb,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,OAAO,EAAE,CAAC;AAExB,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,WAAW,GAAG,YAAY,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,MAAM,CAAA;KAAE,CAAC;CACxF;AAED,oFAAoF;AACpF,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE5D,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,kCAAkC;IAClC,aAAa,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,4BAA4B;IAC5B,cAAc,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,iDAAiD;IACjD,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACnE,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACrE,uEAAuE;IACvE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE;;;;;;OAMG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACjE;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,GAAE,MAAM,GAAG,cAA+B,GAC7C,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,IAAI,GAAE,MAAM,GAAG,cAA+B,GAC7C,OAAO,CAAC,UAAU,CAAC,CAoGrB;AA8ID;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA0DnG"}

package/dist/db/apply-schema.js

@@ -1,23 +1,36 @@
 /**
- * Single-tenant schema apply engine shared by `pxbaas db push <file>` and
- * `pxbaas app db-init <name>`.
+ * Schema apply engine shared by `pxbaas db push <file>` and `pxbaas app db-init <name>`.
  *
- * Safety contract (agreed design):
- *   - The plan (every statement) is shown BEFORE anything runs.
+ * Two execution identities (chosen by profile.mode via {@link getSchemaSink}):
+ *   - single-tenant → MetaDriver `/pg/query` with the global service_role key
+ *     (that key IS the platform admin, so it can also write the central RLS
+ *     registry `supabase._mysqlrest_rls_*` directly).
+ *   - multi-tenant  → TenantDdlDriver `/api/tenant-ddl/*` with the per-tenant
+ *     service_role key. DDL/DML runs on the tenant's OWN database; RLS goes
+ *     through the structured endpoints (the tenant account has NO grant on the
+ *     shared `supabase` database, so a raw central INSERT would be denied).
+ *
+ * Safety contract (agreed design, unchanged):
+ *   - The plan (every step) is shown BEFORE anything runs.
  *   - Execution requires explicit authorization: an interactive confirm, or
  *     `--yes` for non-interactive use. `--dry-run` only previews.
- *   - Statements run sequentially and STOP ON THE FIRST ERROR.
- *   - No automatic rollback — already-applied statements stay applied.
- *   - Multi-tenant profiles are rejected: tenant DDL is out of scope (it needs
- *     the global service_role key via POST /pg/query with tenant_<id>.<table>).
+ *   - Steps run sequentially and STOP ON THE FIRST ERROR.
+ *   - No automatic rollback — already-applied steps stay applied.
+ *
+ * RLS source (see plan §5, decision R-C "hybrid"):
+ *   - a declarative `db/rls.json` is preferred when present;
+ *   - otherwise the `INSERT ... supabase._mysqlrest_rls_*` statements embedded in
+ *     schema.sql are parsed (multi-tenant) or run verbatim (single-tenant).
  */
 import inquirer from "inquirer";
-import { MetaDriver } from "@polardbx/pxbaas-client";
+import { MetaDriver, TenantDdlDriver, } from "@polardbx/pxbaas-client";
 import { CredentialStore, ProfileManager, formatError, formatSuccess, formatWarning, } from "../credentials/index.js";
-import { buildStatementPlan, SCHEMA_PLACEHOLDER } from "./sql-file.js";
+import { buildStatementPlan, partitionStatements, parseRlsPolicyInsert, parseRlsTableInsert, renderRlsPolicyInsert, renderRlsTableInsert, splitSqlStatements, substituteSchema, substituteSchemaForTenant, SCHEMA_PLACEHOLDER, } from "./sql-file.js";
 /**
  * Resolve the active profile into a single-tenant MetaDriver.
  * @throws when there is no profile, no credentials, or the profile is multi-tenant.
+ * @deprecated prefer {@link getSchemaSink}, which supports both modes. Kept for
+ * single-tenant callers and existing tests.
  */
 export async function getSingleTenantMetaDriver(role = "service_role") {
     const profileManager = new ProfileManager();
@@ -43,102 +56,187 @@ export async function getSingleTenantMetaDriver(role = "service_role") {
     return { driver, useServiceRole: role === "service_role", profileName: profile.name };
 }
 /**
- * Show the plan, obtain authorization, then apply statements sequentially with
- * stop-on-first-error semantics. Never rolls back.
+ * Resolve the active profile into a mode-appropriate {@link SchemaSink}.
+ * Unlike {@link getSingleTenantMetaDriver}, a multi-tenant profile is fully
+ * supported: DDL/RLS route through the tenant self-service endpoints using the
+ * per-tenant service_role key (Kong injects the trusted X-Tenant-Id).
  */
-export async function applySqlStatements(rawSql, source, opts, executor) {
-    const { statements, substituted } = buildStatementPlan(rawSql, opts.schema);
-    if (statements.length === 0) {
-        if (!opts.json) {
-            console.log(formatWarning(`No executable statements found in ${source}.`));
+export async function getSchemaSink(role = "service_role") {
+    const profileManager = new ProfileManager();
+    const profile = await profileManager.getCurrentProfile();
+    if (!profile) {
+        throw new Error('No active profile. Use "pxbaas login" to authenticate first.');
+    }
+    const credentials = await new CredentialStore().getCredentials(profile.name);
+    if (!credentials) {
+        throw new Error(`No credentials found for profile: ${profile.name}. Use "pxbaas login" to authenticate.`);
+    }
+    if (profile.mode === "multi-tenant") {
+        if (!profile.tenantId) {
+            throw new Error('Multi-tenant profile is missing tenantId; re-run "pxbaas login --tenant-id <id>" ' +
+                "with this tenant's per-tenant anon/service keys.");
         }
+        // Only the per-tenant service_role key is accepted by /api/tenant-ddl (the
+        // resolver role-gates on service_role). Kong injects X-Tenant-Id from the JWT.
+        const driver = new TenantDdlDriver({
+            endpoint: profile.endpoint,
+            serviceRoleKey: credentials.serviceRoleKey,
+        });
         return {
-            source,
-            schema: opts.schema,
-            total: 0,
-            executed: 0,
-            failed: 0,
-            dryRun: opts.dryRun,
-            authorized: false,
-            statements: [],
+            mode: "multi-tenant",
+            profileName: profile.name,
+            runStatement: (sql) => driver.query(sql),
+            applyRlsTable: (input) => driver.upsertRlsTable(input),
+            applyRlsPolicy: (input) => driver.upsertRlsPolicy(input),
+            renderRlsTable: (input) => `RLS ${input.rls_forced ? "FORCE" : "ENABLE"} ${input.table_name}`,
+            renderRlsPolicy: (input) => `RLS POLICY ${input.policy_name} ON ${input.table_name} ` +
+                `[${(input.command ?? "ALL").toString().toUpperCase()} / ${input.role_name ?? "*"}]`,
+            dropTable: (table) => driver.query(`DROP TABLE IF EXISTS ${quoteIdent(table)}`),
+            purgeRlsForTable: async (table) => {
+                assertSafeIdent(table);
+                const policies = await driver.listRlsPolicies(table);
+                for (const p of policies)
+                    await driver.deleteRlsPolicy(table, p.policy_name);
+                // Remove the central toggle row via DELETE /rls/tables. Tolerate instances
+                // that predate the endpoint (it 404/405s): degrade to leaving the benign
+                // row rather than failing the whole purge.
+                let toggleRemoved = false;
+                try {
+                    await driver.deleteRlsTable(table);
+                    toggleRemoved = true;
+                }
+                catch {
+                    toggleRemoved = false;
+                }
+                return { policiesDeleted: policies.length, toggleRemoved };
+            },
         };
     }
+    const driver = new MetaDriver({
+        endpoint: profile.endpoint,
+        anonKey: credentials.anonKey,
+        serviceRoleKey: credentials.serviceRoleKey,
+        tenantId: profile.tenantId,
+    });
+    const useServiceRole = role === "service_role";
+    return {
+        mode: "single-tenant",
+        profileName: profile.name,
+        runStatement: (sql) => driver.query(sql, useServiceRole),
+        // Single-tenant: the service_role key is the platform admin, so RLS is
+        // written straight into the central registry via /pg/query.
+        applyRlsTable: (input, ctx) => driver.query(renderRlsTableInsert(ctx.schema, input), useServiceRole),
+        applyRlsPolicy: (input, ctx) => driver.query(renderRlsPolicyInsert(ctx.schema, input), useServiceRole),
+        renderRlsTable: (input, ctx) => renderRlsTableInsert(ctx.schema, input),
+        renderRlsPolicy: (input, ctx) => renderRlsPolicyInsert(ctx.schema, input),
+        dropTable: (table, ctx) => driver.query(`DROP TABLE IF EXISTS ${quoteIdent(ctx.schema)}.${quoteIdent(table)}`, useServiceRole),
+        purgeRlsForTable: async (table, ctx) => {
+            assertSafeIdent(table);
+            const schemaLit = sqlQuote(ctx.schema);
+            const tableLit = sqlQuote(table);
+            const found = await driver.query(`SELECT policy_name FROM supabase._mysqlrest_rls_policies ` +
+                `WHERE table_schema = '${schemaLit}' AND table_name = '${tableLit}'`, useServiceRole);
+            const names = found.rows.map((r) => String(r.policy_name));
+            for (const pn of names) {
+                await driver.query(`DELETE FROM supabase._mysqlrest_rls_policies WHERE table_schema = '${schemaLit}' ` +
+                    `AND table_name = '${tableLit}' AND policy_name = '${sqlQuote(pn)}'`, useServiceRole);
+            }
+            await driver.query(`DELETE FROM supabase._mysqlrest_rls_tables WHERE table_schema = '${schemaLit}' AND table_name = '${tableLit}'`, useServiceRole);
+            return { policiesDeleted: names.length, toggleRemoved: true };
+        },
+    };
+}
+const SAFE_IDENT_RE = /^[A-Za-z0-9_]+$/;
+/** Reject anything but a bare identifier before interpolating into DDL. */
+function assertSafeIdent(name) {
+    if (!SAFE_IDENT_RE.test(name) || name.length > 64) {
+        throw new Error(`Unsafe table identifier refused: '${name}'`);
+    }
+}
+/** Backtick-quote a validated identifier. */
+function quoteIdent(name) {
+    assertSafeIdent(name);
+    return `\`${name}\``;
+}
+/** Escape a single-quoted SQL string literal. */
+function sqlQuote(value) {
+    return String(value).replace(/'/g, "''");
+}
+/**
+ * Shared show-plan → authorize → execute-sequentially (stop on first error) core.
+ * Used by both {@link applySqlStatements} and {@link applySchema} so the safety
+ * contract lives in exactly one place.
+ */
+async function executePlan(params) {
+    const { items, opts, source } = params;
+    const skippedAll = () => items.map((it, i) => ({ index: i + 1, sql: it.label, kind: it.kind, status: "skipped" }));
+    const envelope = (partial, statements) => ({
+        source,
+        schema: opts.schema,
+        total: partial.total,
+        executed: partial.executed,
+        failed: partial.failed,
+        dryRun: partial.dryRun,
+        authorized: partial.authorized,
+        statements,
+        ...(params.mode ? { mode: params.mode } : {}),
+        ...(params.rls ? { rls: params.rls } : {}),
+    });
+    if (items.length === 0) {
+        if (!opts.json) {
+            console.log(formatWarning(`No executable statements found in ${source}.`));
+        }
+        return envelope({ total: 0, executed: 0, failed: 0, dryRun: opts.dryRun, authorized: false }, []);
+    }
     // 1) Show the plan (text mode). JSON callers receive the structured result.
     if (!opts.json) {
         console.log(formatSuccess(`Plan for ${source} (schema: ${opts.schema})`));
-        if (!substituted) {
-            console.log(formatWarning(`Script contains no ${SCHEMA_PLACEHOLDER} placeholder; --schema has no effect.`));
-        }
-        statements.forEach((sql, i) => {
-            console.log(`\n[${i + 1}/${statements.length}] ${sql}`);
+        for (const w of params.preWarnings ?? [])
+            console.log(formatWarning(w));
+        items.forEach((it, i) => {
+            console.log(`\n[${i + 1}/${items.length}] ${it.label}`);
         });
         console.log("");
     }
     // 2) Dry run: preview only.
     if (opts.dryRun) {
         if (!opts.json) {
-            console.log(formatWarning(`Dry run: 0 of ${statements.length} statement(s) executed.`));
+            console.log(formatWarning(`Dry run: 0 of ${items.length} statement(s) executed.`));
         }
-        return {
-            source,
-            schema: opts.schema,
-            total: statements.length,
-            executed: 0,
-            failed: 0,
-            dryRun: true,
-            authorized: false,
-            statements: statements.map((sql, i) => ({
-                index: i + 1,
-                sql,
-                status: "skipped",
-            })),
-        };
+        return envelope({ total: items.length, executed: 0, failed: 0, dryRun: true, authorized: false }, skippedAll());
     }
     // 3) Authorization gate.
-    const authorized = await authorize(statements.length, opts);
+    const authorized = await authorize(items.length, opts);
     if (!authorized) {
         if (!opts.json) {
             console.log(formatWarning("Aborted by operator; nothing was executed."));
         }
-        return {
-            source,
-            schema: opts.schema,
-            total: statements.length,
-            executed: 0,
-            failed: 0,
-            dryRun: false,
-            authorized: false,
-            statements: statements.map((sql, i) => ({
-                index: i + 1,
-                sql,
-                status: "skipped",
-            })),
-        };
+        return envelope({ total: items.length, executed: 0, failed: 0, dryRun: false, authorized: false }, skippedAll());
     }
     // 4) Execute sequentially; stop on the first error; no rollback.
     const results = [];
     let executed = 0;
     let failed = 0;
-    for (let i = 0; i < statements.length; i++) {
-        const sql = statements[i];
-        const r = { index: i + 1, sql, status: "pending" };
+    for (let i = 0; i < items.length; i++) {
+        const item = items[i];
+        const r = { index: i + 1, sql: item.label, kind: item.kind, status: "pending" };
         results.push(r);
         try {
-            await executor(sql);
+            await item.exec();
             r.status = "ok";
             executed++;
             if (!opts.json)
-                console.log(formatSuccess(`[${i + 1}/${statements.length}] ok`));
+                console.log(formatSuccess(`[${i + 1}/${items.length}] ok`));
         }
         catch (e) {
             r.status = "failed";
             r.error = e instanceof Error ? e.message : String(e);
             failed++;
             if (!opts.json) {
-                console.error(formatError(`[${i + 1}/${statements.length}] failed: ${r.error}`));
+                console.error(formatError(`[${i + 1}/${items.length}] failed: ${r.error}`));
             }
-            for (let j = i + 1; j < statements.length; j++) {
-                results.push({ index: j + 1, sql: statements[j], status: "skipped" });
+            for (let j = i + 1; j < items.length; j++) {
+                results.push({ index: j + 1, sql: items[j].label, kind: items[j].kind, status: "skipped" });
             }
             break;
         }
@@ -146,23 +244,92 @@ export async function applySqlStatements(rawSql, source, opts, executor) {
     if (!opts.json) {
         console.log("");
         if (failed === 0) {
-            console.log(formatSuccess(`Applied ${executed}/${statements.length} statement(s) to schema '${opts.schema}'.`));
+            console.log(formatSuccess(`Applied ${executed}/${items.length} statement(s) to schema '${opts.schema}'.`));
         }
         else {
             console.log(formatError(`Stopped after failure: ${executed} ok, ${failed} failed, ` +
-                `${statements.length - executed - failed} skipped. No rollback performed.`));
+                `${items.length - executed - failed} skipped. No rollback performed.`));
         }
     }
-    return {
-        source,
-        schema: opts.schema,
-        total: statements.length,
-        executed,
-        failed,
-        dryRun: false,
-        authorized: true,
-        statements: results,
-    };
+    return envelope({ total: items.length, executed, failed, dryRun: false, authorized: true }, results);
+}
+/**
+ * Apply a raw SQL script through an injected executor (single-tenant legacy
+ * path). Schema substitution uses the single-tenant rule; RLS statements are
+ * NOT diverted (they run verbatim through the executor). For mode-aware apply
+ * with RLS diversion use {@link applySchema}.
+ */
+export async function applySqlStatements(rawSql, source, opts, executor) {
+    const { statements, substituted } = buildStatementPlan(rawSql, opts.schema);
+    const items = statements.map((sql) => ({
+        label: sql,
+        kind: "sql",
+        exec: () => executor(sql),
+    }));
+    const preWarnings = substituted
+        ? []
+        : [`Script contains no ${SCHEMA_PLACEHOLDER} placeholder; --schema has no effect.`];
+    return executePlan({ items, opts, source, preWarnings });
+}
+/**
+ * Mode-aware apply used by `db push` and `app db-init`.
+ *
+ * - Splits the script, then (multi-tenant OR when rls.json is present) diverts
+ *   the embedded central-registry RLS INSERTs out of the raw-SQL stream.
+ * - RLS source: `db/rls.json` when present; else parsed from schema.sql
+ *   (multi-tenant) or left embedded (single-tenant legacy).
+ * - `__SCHEMA__`: single-tenant → --schema; multi-tenant → de-qualified.
+ * - Order: DDL/seed first (tables must exist), then RLS tables, then policies.
+ */
+export async function applySchema(params, sink) {
+    const statements = splitSqlStatements(params.rawSql);
+    const { rlsTableInserts, rlsPolicyInserts, plain } = partitionStatements(statements);
+    const embeddedRlsCount = rlsTableInserts.length + rlsPolicyInserts.length;
+    const rls = params.rls;
+    const hasRlsJson = Boolean(rls && (rls.tables.length > 0 || rls.policies.length > 0));
+    // Single-tenant without rls.json keeps the legacy behavior: run schema.sql
+    // verbatim (embedded RLS INSERTs work through the admin /pg/query channel).
+    const divertEmbedded = sink.mode === "multi-tenant" || hasRlsJson;
+    const rawRun = divertEmbedded ? plain : statements;
+    const preWarnings = [];
+    let tables = [];
+    let policies = [];
+    let rlsSource = "none";
+    if (hasRlsJson) {
+        tables = rls.tables;
+        policies = rls.policies;
+        rlsSource = "rls.json";
+        if (embeddedRlsCount > 0) {
+            preWarnings.push(`db/rls.json is present — ignoring ${embeddedRlsCount} RLS INSERT statement(s) embedded ` +
+                `in ${params.source} to keep a single source of truth.`);
+        }
+    }
+    else if (sink.mode === "multi-tenant") {
+        tables = rlsTableInserts.flatMap(parseRlsTableInsert);
+        policies = rlsPolicyInserts.flatMap(parseRlsPolicyInsert);
+        rlsSource = tables.length || policies.length ? "schema.sql" : "none";
+    }
+    const substitute = (sql) => sink.mode === "multi-tenant" ? substituteSchemaForTenant(sql) : substituteSchema(sql, params.schema);
+    const ctx = { schema: params.schema };
+    const items = [];
+    for (const sql of rawRun) {
+        const rendered = substitute(sql);
+        items.push({ label: rendered, kind: "sql", exec: () => sink.runStatement(rendered) });
+    }
+    for (const t of tables) {
+        items.push({ label: sink.renderRlsTable(t, ctx), kind: "rls-table", exec: () => sink.applyRlsTable(t, ctx) });
+    }
+    for (const p of policies) {
+        items.push({ label: sink.renderRlsPolicy(p, ctx), kind: "rls-policy", exec: () => sink.applyRlsPolicy(p, ctx) });
+    }
+    return executePlan({
+        items,
+        opts: params,
+        source: params.source,
+        preWarnings,
+        mode: sink.mode,
+        rls: { tables: tables.length, policies: policies.length, source: rlsSource },
+    });
 }
 /**
  * Decide whether execution is authorized. `--yes` authorizes outright; JSON mode

package/dist/db/apply-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"apply-schema.js","sourceRoot":"","sources":["../../src/db/apply-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAkCvE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgC,cAAc;IAE9C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kFAAkF;YAChF,sFAAsF;YACtF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,CAAC,IAAI,uCAAuC,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,MAAc,EACd,IAAkB,EAClB,QAAqB;IAErB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE5E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,qCAAqC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO;YACL,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,CAAC;YACR,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,EAAE;SACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,MAAM,aAAa,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,aAAa,CACX,sBAAsB,kBAAkB,uCAAuC,CAChF,CACF,CAAC;QACJ,CAAC;QACD,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,4BAA4B;IAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,iBAAiB,UAAU,CAAC,MAAM,yBAAyB,CAAC,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,UAAU,CAAC,MAAM;YACxB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtC,KAAK,EAAE,CAAC,GAAG,CAAC;gBACZ,GAAG;gBACH,MAAM,EAAE,SAAkB;aAC3B,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,4CAA4C,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO;YACL,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,UAAU,CAAC,MAAM;YACxB,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtC,KAAK,EAAE,CAAC,GAAG,CAAC;gBACZ,GAAG;gBACH,MAAM,EAAE,SAAkB;aAC3B,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAoB,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;YAChB,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC,CAAC,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CACX,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC,CAClE,CAAC;YACJ,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,aAAa,CACX,WAAW,QAAQ,IAAI,UAAU,CAAC,MAAM,4BAA4B,IAAI,CAAC,MAAM,IAAI,CACpF,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,WAAW,CACT,0BAA0B,QAAQ,QAAQ,MAAM,WAAW;gBACzD,GAAG,UAAU,CAAC,MAAM,GAAG,QAAQ,GAAG,MAAM,kCAAkC,CAC7E,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,UAAU,CAAC,MAAM;QACxB,QAAQ;QACR,MAAM;QACN,MAAM,EAAE,KAAK;QACb,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,OAAO;KACpB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,IAAkB;IACxD,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAkB;QACpD;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,WAAW,KAAK,iCAAiC,IAAI,CAAC,MAAM,4BAA4B;YACjG,OAAO,EAAE,KAAK;SACf;KACF,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"apply-schema.js","sourceRoot":"","sources":["../../src/db/apply-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,UAAU,EACV,eAAe,GAGhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,kBAAkB,GAEnB,MAAM,eAAe,CAAC;AAgFvB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgC,cAAc;IAE9C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kFAAkF;YAChF,sFAAsF;YACtF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,CAAC,IAAI,uCAAuC,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgC,cAAc;IAE9C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,CAAC,IAAI,uCAAuC,CACzF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,mFAAmF;gBACjF,kDAAkD,CACrD,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,+EAA+E;QAC/E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,cAAc,EAAE,WAAW,CAAC,cAAc;SAC3C,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;YACxC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC;YACtD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC;YACxD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CACxB,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE;YACpE,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CACzB,cAAc,KAAK,CAAC,WAAW,OAAO,KAAK,CAAC,UAAU,GAAG;gBACzD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG;YACtF,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/E,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBAChC,eAAe,CAAC,KAAK,CAAC,CAAC;gBACvB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBACrD,KAAK,MAAM,CAAC,IAAI,QAAQ;oBAAE,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC7E,2EAA2E;gBAC3E,yEAAyE;gBACzE,2CAA2C;gBAC3C,IAAI,aAAa,GAAG,KAAK,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;oBACnC,aAAa,GAAG,IAAI,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa,GAAG,KAAK,CAAC;gBACxB,CAAC;gBACD,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;YAC7D,CAAC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,KAAK,cAAc,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,OAAO,CAAC,IAAI;QACzB,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;QACxD,uEAAuE;QACvE,4DAA4D;QAC5D,aAAa,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC;QACpG,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC;QACtG,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QACvE,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QACzE,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxB,MAAM,CAAC,KAAK,CAAC,wBAAwB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC;QACrG,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B,2DAA2D;gBACzD,yBAAyB,SAAS,uBAAuB,QAAQ,GAAG,EACtE,cAAc,CACf,CAAC;YACF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3D,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,MAAM,CAAC,KAAK,CAChB,sEAAsE,SAAS,IAAI;oBACjF,qBAAqB,QAAQ,wBAAwB,QAAQ,CAAC,EAAE,CAAC,GAAG,EACtE,cAAc,CACf,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAChB,oEAAoE,SAAS,uBAAuB,QAAQ,GAAG,EAC/G,cAAc,CACf,CAAC;YACF,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,2EAA2E;AAC3E,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,6CAA6C;AAC7C,SAAS,UAAU,CAAC,IAAY;IAC9B,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,iDAAiD;AACjD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAiBD;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,MAAyB;IAClD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACvC,MAAM,UAAU,GAAG,GAAsB,EAAE,CACzC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,CACf,OAAqF,EACrF,UAA6B,EAChB,EAAE,CAAC,CAAC;QACjB,MAAM;QACN,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU;QACV,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,qCAAqC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,MAAM,aAAa,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,4BAA4B;IAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,iBAAiB,KAAK,CAAC,MAAM,yBAAyB,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,4CAA4C,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,iEAAiE;IACjE,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,CAAC,GAAoB,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;YAChB,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC,CAAC,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC9E,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,QAAQ,IAAI,KAAK,CAAC,MAAM,4BAA4B,IAAI,CAAC,MAAM,IAAI,CAAC,CAC9F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,WAAW,CACT,0BAA0B,QAAQ,QAAQ,MAAM,WAAW;gBACzD,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,GAAG,MAAM,kCAAkC,CACxE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;AACvG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,MAAc,EACd,IAAkB,EAClB,QAAqB;IAErB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAe,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACjD,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,KAAc;QACpB,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;KAC1B,CAAC,CAAC,CAAC;IACJ,MAAM,WAAW,GAAG,WAAW;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,sBAAsB,kBAAkB,uCAAuC,CAAC,CAAC;IACtF,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAC3D,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyB,EAAE,IAAgB;IAC3E,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACrF,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAE1E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAEtF,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,UAAU,CAAC;IAClE,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAEnD,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,MAAM,GAAoB,EAAE,CAAC;IACjC,IAAI,QAAQ,GAAqB,EAAE,CAAC;IACpC,IAAI,SAAS,GAAuC,MAAM,CAAC;IAE3D,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,GAAI,CAAC,MAAM,CAAC;QACrB,QAAQ,GAAG,GAAI,CAAC,QAAQ,CAAC;QACzB,SAAS,GAAG,UAAU,CAAC;QACvB,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CACd,qCAAqC,gBAAgB,oCAAoC;gBACvF,MAAM,MAAM,CAAC,MAAM,oCAAoC,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACtD,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC1D,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CACjC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACvG,MAAM,GAAG,GAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,OAAO,WAAW,CAAC;QACjB,KAAK;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,IAAkB;IACxD,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAkB;QACpD;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,WAAW,KAAK,iCAAiC,IAAI,CAAC,MAAM,4BAA4B;YACjG,OAAO,EAAE,KAAK;SACf;KACF,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC"}