@portaidentity/server 1.7.3 → 1.9.0

package/dist/portability/repository.js

@@ -0,0 +1,390 @@
+/** Explicit PostgreSQL reads used by selective portability export. */
+import { PortabilityError } from './types.js';
+import { validateImage } from '../lib/image-validator.js';
+/** Create the fixed safe rejection used for unavailable or protected export scope. */
+function rejectedScope() {
+    return new PortabilityError(409, 'export_scope_rejected', 'Export scope rejected');
+}
+/** Convert an organization database row into its portable representation. */
+function portableOrganization(row) {
+    return {
+        slug: row.slug,
+        name: row.name,
+        status: row.status,
+        default_locale: row.default_locale,
+        default_login_methods: row.default_login_methods,
+        two_factor_policy: row.two_factor_policy,
+        branding: {
+            logo_url: row.branding_logo_url,
+            favicon_url: row.branding_favicon_url,
+            primary_color: row.branding_primary_color,
+            company_name: row.branding_company_name,
+            custom_css: row.branding_custom_css,
+            logo_asset: null,
+            favicon_asset: null,
+        },
+    };
+}
+/** Convert a user row into the exact portable profile without operational account state. */
+function portableUser(row) {
+    return {
+        organization_slug: row.organization_slug,
+        email: row.email.toLowerCase(),
+        email_verified: row.email_verified,
+        given_name: row.given_name,
+        family_name: row.family_name,
+        middle_name: row.middle_name,
+        nickname: row.nickname,
+        preferred_username: row.preferred_username,
+        profile_url: row.profile_url,
+        picture_url: row.picture_url,
+        website_url: row.website_url,
+        gender: row.gender,
+        birthdate: row.birthdate,
+        zoneinfo: row.zoneinfo,
+        locale: row.locale,
+        phone_number: row.phone_number,
+        phone_number_verified: row.phone_number_verified,
+        address_street: row.address_street,
+        address_locality: row.address_locality,
+        address_region: row.address_region,
+        address_postal_code: row.address_postal_code,
+        address_country: row.address_country,
+        status: row.status === 'locked' ? 'active' : row.status,
+    };
+}
+/** Compare already-normalized text with stable code-point ordering. */
+function compareText(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+/** Compare records by each natural-key component in order. */
+function compareNaturalKey(left, right) {
+    for (let index = 0; index < left.length; index += 1) {
+        const result = compareText(left[index] ?? '', right[index] ?? '');
+        if (result !== 0)
+            return result;
+    }
+    return 0;
+}
+/**
+ * Resolve an organization or environment export scope while excluding the control plane.
+ *
+ * @param client - Request-owned PostgreSQL client
+ * @param scope - Validated public export scope
+ * @param controlPlaneOrganizationId - Authenticated control-plane organization identifier
+ * @returns Portable organizations and private identifiers for dependent reads
+ * @throws PortabilityError when an organization scope is missing or protected
+ */
+export async function readOrganizationExportScope(client, scope, controlPlaneOrganizationId) {
+    const parameters = scope.kind === 'organization'
+        ? [controlPlaneOrganizationId, scope.organization_slug]
+        : [controlPlaneOrganizationId];
+    const scopePredicate = scope.kind === 'organization' ? 'AND slug = $2' : '';
+    const result = await client.query(`SELECT id, slug, name, status, default_locale, default_login_methods,
+            two_factor_policy, branding_logo_url, branding_favicon_url,
+            branding_primary_color, branding_company_name, branding_custom_css
+       FROM organizations
+      WHERE is_super_admin = FALSE
+        AND id <> $1
+        ${scopePredicate}
+      ORDER BY slug COLLATE "C"`, parameters);
+    if (scope.kind === 'organization' && result.rows.length !== 1)
+        throw rejectedScope();
+    return {
+        organizationIds: result.rows.map((row) => row.id),
+        organizations: result.rows
+            .map(portableOrganization)
+            .sort((left, right) => compareText(left.slug, right.slug)),
+    };
+}
+/**
+ * Resolve the explicit global application selection and exclude Porta's Admin application.
+ *
+ * @param client - Request-owned PostgreSQL client
+ * @param selection - Validated all-or-explicit application choice
+ * @returns Portable applications and private identifiers for dependent reads
+ * @throws PortabilityError when an explicit slug is missing or selects the Admin application
+ */
+export async function readApplicationExportSelection(client, selection) {
+    if (selection.application_slugs.includes('porta-admin'))
+        throw rejectedScope();
+    const result = await client.query(`SELECT id, slug, name, description, status
+       FROM applications
+      WHERE slug <> 'porta-admin'
+        AND ($1::boolean OR slug = ANY($2::text[]))
+      ORDER BY slug COLLATE "C"`, [selection.all_applications, selection.application_slugs]);
+    if (!selection.all_applications && result.rows.length !== selection.application_slugs.length) {
+        throw rejectedScope();
+    }
+    return {
+        applicationIds: result.rows.map((row) => row.id),
+        applications: result.rows
+            .map(({ slug, name, description, status }) => ({
+            slug,
+            name,
+            description,
+            status,
+        }))
+            .sort((left, right) => compareText(left.slug, right.slug)),
+    };
+}
+/**
+ * Read the complete portable authorization graph for selected applications.
+ *
+ * @param client - Request-owned PostgreSQL client
+ * @param applicationIds - Resolved internal application identifiers
+ * @returns All portable child collections for those applications
+ */
+export async function readAuthorizationExportGraph(client, applicationIds) {
+    if (applicationIds.length === 0) {
+        return {
+            applicationModules: [],
+            roles: [],
+            permissions: [],
+            claimDefinitions: [],
+            rolePermissionMappings: [],
+        };
+    }
+    const modules = await client.query(`SELECT a.slug AS application_slug, m.slug, m.name, m.description, m.status
+         FROM application_modules m
+         JOIN applications a ON a.id = m.application_id
+        WHERE m.application_id = ANY($1::uuid[])
+        ORDER BY a.slug COLLATE "C", m.slug COLLATE "C"`, [applicationIds]);
+    const roles = await client.query(`SELECT a.slug AS application_slug, r.slug, r.name, r.description
+         FROM roles r
+         JOIN applications a ON a.id = r.application_id
+        WHERE r.application_id = ANY($1::uuid[])
+        ORDER BY a.slug COLLATE "C", BTRIM(r.slug) COLLATE "C"`, [applicationIds]);
+    const permissions = await client.query(`SELECT a.slug AS application_slug, p.slug, m.slug AS module_slug,
+              p.name, p.description
+         FROM permissions p
+         JOIN applications a ON a.id = p.application_id
+         LEFT JOIN application_modules m ON m.id = p.module_id
+        WHERE p.application_id = ANY($1::uuid[])
+        ORDER BY a.slug COLLATE "C", BTRIM(p.slug) COLLATE "C"`, [applicationIds]);
+    const claims = await client.query(`SELECT a.slug AS application_slug, c.claim_name, c.claim_type, c.description,
+              c.include_in_id_token, c.include_in_access_token, c.include_in_userinfo
+         FROM custom_claim_definitions c
+         JOIN applications a ON a.id = c.application_id
+        WHERE c.application_id = ANY($1::uuid[])
+        ORDER BY a.slug COLLATE "C", c.claim_name COLLATE "C"`, [applicationIds]);
+    const mappings = await client.query(`SELECT a.slug AS application_slug, r.slug AS role_slug,
+              ARRAY_AGG(p.slug ORDER BY BTRIM(p.slug) COLLATE "C") AS permission_slugs
+         FROM role_permissions rp
+         JOIN roles r ON r.id = rp.role_id
+         JOIN permissions p ON p.id = rp.permission_id
+         JOIN applications a ON a.id = r.application_id
+        WHERE r.application_id = ANY($1::uuid[])
+          AND p.application_id = r.application_id
+        GROUP BY a.slug, r.slug
+        ORDER BY a.slug COLLATE "C", BTRIM(r.slug) COLLATE "C"`, [applicationIds]);
+    return {
+        applicationModules: modules.rows
+            .map(({ application_slug, slug, name, description, status }) => ({
+            application_slug,
+            slug,
+            name,
+            description,
+            status,
+        }))
+            .sort((left, right) => compareNaturalKey([left.application_slug, left.slug], [right.application_slug, right.slug])),
+        roles: roles.rows
+            .map(({ application_slug, slug, name, description }) => ({
+            application_slug,
+            slug: slug.trim(),
+            name,
+            description,
+        }))
+            .sort((left, right) => compareNaturalKey([left.application_slug, left.slug], [right.application_slug, right.slug])),
+        permissions: permissions.rows
+            .map(({ application_slug, slug, module_slug, name, description }) => ({
+            application_slug,
+            slug: slug.trim(),
+            module_slug,
+            name,
+            description,
+        }))
+            .sort((left, right) => compareNaturalKey([left.application_slug, left.slug], [right.application_slug, right.slug])),
+        claimDefinitions: claims.rows
+            .map(({ application_slug, claim_name, claim_type, description, include_in_id_token, include_in_access_token, include_in_userinfo, }) => ({
+            application_slug,
+            claim_name,
+            claim_type,
+            description,
+            include_in_id_token,
+            include_in_access_token,
+            include_in_userinfo,
+        }))
+            .sort((left, right) => compareNaturalKey([left.application_slug, left.claim_name], [right.application_slug, right.claim_name])),
+        rolePermissionMappings: mappings.rows
+            .map(({ application_slug, role_slug, permission_slugs }) => ({
+            application_slug,
+            role_slug: role_slug.trim(),
+            permission_slugs: permission_slugs.map((slug) => slug.trim()).sort(compareText),
+        }))
+            .sort((left, right) => compareNaturalKey([left.application_slug, left.role_slug], [right.application_slug, right.role_slug])),
+    };
+}
+/**
+ * Attach validated stored branding bytes to portable organization records.
+ *
+ * @param client - Request-owned PostgreSQL client
+ * @param organizations - Portable organizations in the selected scope
+ * @param organizationIds - Matching private organization identifiers
+ * @returns Organization records with validated logo and favicon content
+ * @throws Error when stored bytes no longer satisfy the branding validation boundary
+ */
+export async function attachOrganizationBrandingAssets(client, organizations, organizationIds) {
+    if (organizationIds.length === 0)
+        return organizations;
+    const assets = await client.query(`SELECT o.slug AS organization_slug, b.asset_type, b.content_type, b.data
+       FROM branding_assets b
+       JOIN organizations o ON o.id = b.organization_id
+      WHERE b.organization_id = ANY($1::uuid[])
+      ORDER BY o.slug COLLATE "C", b.asset_type COLLATE "C"`, [organizationIds]);
+    const byOrganization = new Map();
+    for (const asset of assets.rows) {
+        const validation = validateImage(asset.data, asset.content_type, asset.asset_type);
+        if (!validation.valid || validation.data === undefined) {
+            throw new Error('Stored branding asset is invalid');
+        }
+        const organizationAssets = byOrganization.get(asset.organization_slug) ?? {};
+        organizationAssets[asset.asset_type] = { ...asset, data: validation.data };
+        byOrganization.set(asset.organization_slug, organizationAssets);
+    }
+    return organizations.map((organization) => {
+        const organizationAssets = byOrganization.get(organization.slug);
+        const logo = organizationAssets?.logo;
+        const favicon = organizationAssets?.favicon;
+        return {
+            ...organization,
+            branding: {
+                ...organization.branding,
+                logo_asset: logo === undefined
+                    ? null
+                    : { media_type: logo.content_type, content_base64: logo.data.toString('base64') },
+                favicon_asset: favicon === undefined
+                    ? null
+                    : { media_type: favicon.content_type, content_base64: favicon.data.toString('base64') },
+            },
+        };
+    });
+}
+/**
+ * Read every scoped user and only relationships owned by selected applications.
+ *
+ * @param client - Request-owned PostgreSQL client
+ * @param organizationIds - Resolved organization scope identifiers
+ * @param applicationIds - Resolved application selection identifiers
+ * @returns Portable users, role assignments, and claim values
+ */
+export async function readUserExportGraph(client, organizationIds, applicationIds) {
+    if (organizationIds.length === 0) {
+        return { users: [], userRoleAssignments: [], userClaimValues: [] };
+    }
+    const users = await client.query(`SELECT o.slug AS organization_slug, u.email::text AS email, u.email_verified,
+            u.given_name, u.family_name, u.middle_name, u.nickname, u.preferred_username,
+            u.profile_url, u.picture_url, u.website_url, u.gender, u.birthdate::text AS birthdate,
+            u.zoneinfo, u.locale, u.phone_number, u.phone_number_verified, u.address_street,
+            u.address_locality, u.address_region, u.address_postal_code, u.address_country,
+            u.status
+       FROM users u
+       JOIN organizations o ON o.id = u.organization_id
+      WHERE u.organization_id = ANY($1::uuid[])
+      ORDER BY o.slug COLLATE "C", LOWER(u.email::text) COLLATE "C"`, [organizationIds]);
+    const assignments = applicationIds.length === 0
+        ? { rows: [] }
+        : await client.query(`SELECT o.slug AS organization_slug, u.email::text AS email,
+                    a.slug AS application_slug, r.slug AS role_slug
+               FROM user_roles ur
+               JOIN users u ON u.id = ur.user_id
+               JOIN organizations o ON o.id = u.organization_id
+               JOIN roles r ON r.id = ur.role_id
+               JOIN applications a ON a.id = r.application_id
+              WHERE u.organization_id = ANY($1::uuid[])
+                AND r.application_id = ANY($2::uuid[])
+              ORDER BY o.slug COLLATE "C", LOWER(u.email::text) COLLATE "C",
+                       a.slug COLLATE "C", BTRIM(r.slug) COLLATE "C"`, [organizationIds, applicationIds]);
+    const claimValues = applicationIds.length === 0
+        ? { rows: [] }
+        : await client.query(`SELECT o.slug AS organization_slug, u.email::text AS email,
+                    a.slug AS application_slug, c.claim_name, v.value
+               FROM custom_claim_values v
+               JOIN users u ON u.id = v.user_id
+               JOIN organizations o ON o.id = u.organization_id
+               JOIN custom_claim_definitions c ON c.id = v.claim_id
+               JOIN applications a ON a.id = c.application_id
+              WHERE u.organization_id = ANY($1::uuid[])
+                AND c.application_id = ANY($2::uuid[])
+              ORDER BY o.slug COLLATE "C", LOWER(u.email::text) COLLATE "C",
+                       a.slug COLLATE "C", c.claim_name COLLATE "C"`, [organizationIds, applicationIds]);
+    return {
+        users: users.rows
+            .map(portableUser)
+            .sort((left, right) => compareNaturalKey([left.organization_slug, left.email], [right.organization_slug, right.email])),
+        userRoleAssignments: assignments.rows
+            .map(({ organization_slug, email, application_slug, role_slug }) => ({
+            organization_slug,
+            email: email.toLowerCase(),
+            application_slug,
+            role_slug: role_slug.trim(),
+        }))
+            .sort((left, right) => compareNaturalKey([left.organization_slug, left.email, left.application_slug, left.role_slug], [right.organization_slug, right.email, right.application_slug, right.role_slug])),
+        userClaimValues: claimValues.rows
+            .map(({ organization_slug, email, application_slug, claim_name, value }) => ({
+            organization_slug,
+            email: email.toLowerCase(),
+            application_slug,
+            claim_name,
+            value,
+        }))
+            .sort((left, right) => compareNaturalKey([left.organization_slug, left.email, left.application_slug, left.claim_name], [right.organization_slug, right.email, right.application_slug, right.claim_name])),
+    };
+}
+/**
+ * Read OIDC clients owned by both the selected organization and application scopes.
+ *
+ * @param client - Request-owned PostgreSQL client
+ * @param organizationIds - Resolved organization scope identifiers
+ * @param applicationIds - Resolved application selection identifiers
+ * @returns Portable clients without credential material
+ */
+export async function readClientExportRecords(client, organizationIds, applicationIds) {
+    if (organizationIds.length === 0 || applicationIds.length === 0)
+        return [];
+    const result = await client.query(`SELECT c.client_id, o.slug AS organization_slug, a.slug AS application_slug,
+            c.client_name AS name, c.client_type, c.application_type, c.status,
+            c.grant_types, c.response_types, c.scope, c.login_methods,
+            c.token_endpoint_auth_method, c.redirect_uris,
+            COALESCE(c.post_logout_redirect_uris, '{}') AS post_logout_redirect_uris,
+            COALESCE(c.allowed_origins, '{}') AS allowed_origins, c.require_pkce,
+            c.require_consent
+       FROM clients c
+       JOIN organizations o ON o.id = c.organization_id
+       JOIN applications a ON a.id = c.application_id
+      WHERE c.organization_id = ANY($1::uuid[])
+        AND c.application_id = ANY($2::uuid[])
+      ORDER BY c.client_id COLLATE "C"`, [organizationIds, applicationIds]);
+    return result.rows
+        .map(({ client_id, organization_slug, application_slug, name, client_type, application_type, status, grant_types, response_types, scope, login_methods, token_endpoint_auth_method, redirect_uris, post_logout_redirect_uris, allowed_origins, require_pkce, require_consent, }) => ({
+        client_id,
+        organization_slug,
+        application_slug,
+        name,
+        client_type,
+        application_type,
+        status,
+        grant_types,
+        response_types,
+        scope,
+        login_methods,
+        token_endpoint_auth_method,
+        redirect_uris,
+        post_logout_redirect_uris,
+        allowed_origins,
+        require_pkce,
+        require_consent,
+    }))
+        .sort((left, right) => compareText(left.client_id, right.client_id));
+}
+//# sourceMappingURL=repository.js.map

package/dist/portability/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/portability/repository.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAmBtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAkB,MAAM,2BAA2B,CAAC;AAgI1E,sFAAsF;AACtF,SAAS,aAAa;IACpB,OAAO,IAAI,gBAAgB,CAAC,GAAG,EAAE,uBAAuB,EAAE,uBAAuB,CAAC,CAAC;AACrF,CAAC;AAED,6EAA6E;AAC7E,SAAS,oBAAoB,CAAC,GAA0B;IACtD,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;QAChD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,QAAQ,EAAE;YACR,QAAQ,EAAE,GAAG,CAAC,iBAAiB;YAC/B,WAAW,EAAE,GAAG,CAAC,oBAAoB;YACrC,aAAa,EAAE,GAAG,CAAC,sBAAsB;YACzC,YAAY,EAAE,GAAG,CAAC,qBAAqB;YACvC,UAAU,EAAE,GAAG,CAAC,mBAAmB;YACnC,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,IAAI;SACpB;KACF,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,GAAkB;IACtC,OAAO;QACL,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE;QAC9B,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;QAChD,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;QAC5C,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;KACxD,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,8DAA8D;AAC9D,SAAS,iBAAiB,CAAC,IAAuB,EAAE,KAAwB;IAC1E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;IAClC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAkB,EAClB,KAAuB,EACvB,0BAAkC;IAElC,MAAM,UAAU,GACd,KAAK,CAAC,IAAI,KAAK,cAAc;QAC3B,CAAC,CAAC,CAAC,0BAA0B,EAAE,KAAK,CAAC,iBAAiB,CAAC;QACvD,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACnC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;;;;;;UAMM,cAAc;gCACQ,EAC5B,UAAU,CACX,CAAC;IAEF,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,aAAa,EAAE,CAAC;IACrF,OAAO;QACL,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,aAAa,EAAE,MAAM,CAAC,IAAI;aACvB,GAAG,CAAC,oBAAoB,CAAC;aACzB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAkB,EAClB,SAA0C;IAE1C,IAAI,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,MAAM,aAAa,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;;;;gCAI4B,EAC5B,CAAC,SAAS,CAAC,gBAAgB,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAC1D,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC7F,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IACD,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,YAAY,EAAE,MAAM,CAAC,IAAI;aACtB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7C,IAAI;YACJ,IAAI;YACJ,WAAW;YACX,MAAM;SACP,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAkB,EAClB,cAAiC;IAEjC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,kBAAkB,EAAE,EAAE;YACtB,KAAK,EAAE,EAAE;YACT,WAAW,EAAE,EAAE;YACf,gBAAgB,EAAE,EAAE;YACpB,sBAAsB,EAAE,EAAE;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;;;wDAIoD,EACpD,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B;;;;+DAI2D,EAC3D,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC;;;;;;+DAM2D,EAC3D,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;;;;;8DAK0D,EAC1D,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;;;;;;+DAS2D,EAC3D,CAAC,cAAc,CAAC,CACjB,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,OAAO,CAAC,IAAI;aAC7B,GAAG,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/D,gBAAgB;YAChB,IAAI;YACJ,IAAI;YACJ,WAAW;YACX,MAAM;SACP,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,iBAAiB,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAC5F;QACH,KAAK,EAAE,KAAK,CAAC,IAAI;aACd,GAAG,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YACvD,gBAAgB;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACjB,IAAI;YACJ,WAAW;SACZ,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,iBAAiB,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAC5F;QACH,WAAW,EAAE,WAAW,CAAC,IAAI;aAC1B,GAAG,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YACpE,gBAAgB;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACjB,WAAW;YACX,IAAI;YACJ,WAAW;SACZ,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,iBAAiB,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAC5F;QACH,gBAAgB,EAAE,MAAM,CAAC,IAAI;aAC1B,GAAG,CACF,CAAC,EACC,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,GACpB,EAAE,EAAE,CAAC,CAAC;YACL,gBAAgB;YAChB,UAAU;YACV,UAAU;YACV,WAAW;YACX,mBAAmB;YACnB,uBAAuB;YACvB,mBAAmB;SACpB,CAAC,CACH;aACA,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,iBAAiB,CACf,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,EACxC,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,CAC3C,CACF;QACH,sBAAsB,EAAE,QAAQ,CAAC,IAAI;aAClC,GAAG,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,gBAAgB;YAChB,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE;YAC3B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;SAChF,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,iBAAiB,CACf,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,EACvC,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,CAC1C,CACF;KACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,MAAkB,EAClB,aAAiD,EACjD,eAAkC;IAElC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;;;;4DAIwD,EACxD,CAAC,eAAe,CAAC,CAClB,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8D,CAAC;IAC7F,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,kBAAkB,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAC7E,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;QAC3E,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;QACxC,MAAM,kBAAkB,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,kBAAkB,EAAE,IAAI,CAAC;QACtC,MAAM,OAAO,GAAG,kBAAkB,EAAE,OAAO,CAAC;QAC5C,OAAO;YACL,GAAG,YAAY;YACf,QAAQ,EAAE;gBACR,GAAG,YAAY,CAAC,QAAQ;gBACxB,UAAU,EACR,IAAI,KAAK,SAAS;oBAChB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACrF,aAAa,EACX,OAAO,KAAK,SAAS;oBACnB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;aAC5F;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAkB,EAClB,eAAkC,EAClC,cAAiC;IAEjC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B;;;;;;;;;oEASgE,EAChE,CAAC,eAAe,CAAC,CAClB,CAAC;IACF,MAAM,WAAW,GACf,cAAc,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACd,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;;;;;;qEAU2D,EAC3D,CAAC,eAAe,EAAE,cAAc,CAAC,CAClC,CAAC;IACR,MAAM,WAAW,GACf,cAAc,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACd,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;;;;;;oEAU0D,EAC1D,CAAC,eAAe,EAAE,cAAc,CAAC,CAClC,CAAC;IACR,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,IAAI;aACd,GAAG,CAAC,YAAY,CAAC;aACjB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,iBAAiB,CACf,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,EACpC,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,CACvC,CACF;QACH,mBAAmB,EAAE,WAAW,CAAC,IAAI;aAClC,GAAG,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YACnE,iBAAiB;YACjB,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,gBAAgB;YAChB,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE;SAC5B,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,iBAAiB,CACf,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,EAC3E,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,CAChF,CACF;QACH,eAAe,EAAE,WAAW,CAAC,IAAI;aAC9B,GAAG,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,iBAAiB;YACjB,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,gBAAgB;YAChB,UAAU;YACV,KAAK;SACN,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,iBAAiB,CACf,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,EAC5E,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,CACjF,CACF;KACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAkB,EAClB,eAAkC,EAClC,cAAiC;IAEjC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;;;;;;;;;;;;uCAYmC,EACnC,CAAC,eAAe,EAAE,cAAc,CAAC,CAClC,CAAC;IACF,OAAO,MAAM,CAAC,IAAI;SACf,GAAG,CACF,CAAC,EACC,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,IAAI,EACJ,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,WAAW,EACX,cAAc,EACd,KAAK,EACL,aAAa,EACb,0BAA0B,EAC1B,aAAa,EACb,yBAAyB,EACzB,eAAe,EACf,YAAY,EACZ,eAAe,GAChB,EAAE,EAAE,CAAC,CAAC;QACL,SAAS;QACT,iBAAiB;QACjB,gBAAgB;QAChB,IAAI;QACJ,WAAW;QACX,gBAAgB;QAChB,MAAM;QACN,WAAW;QACX,cAAc;QACd,KAAK;QACL,aAAa;QACb,0BAA0B;QAC1B,aAAa;QACb,yBAAyB;QACzB,eAAe;QACf,YAAY;QACZ,eAAe;KAChB,CAAC,CACH;SACA,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC"}