@raybase/core 0.0.2 → 0.3.4

package/dist/data-secrets.d.ts

@@ -0,0 +1,164 @@
+import type { SqlExecutor } from "./db.js";
+import { RaybaseHttpError } from "./http-error.js";
+import type { RaybaseSchema, RaybaseSystemTable } from "./schema.js";
+/**
+ * Secret-at-rest app data. A `secret()` column stores an AES-256-GCM envelope
+ * sealed under the deployment key and bound to its table, column, and row id.
+ * Plaintext never reaches SQLite, so every raw-SQL path (backups, PITR,
+ * exports) carries ciphertext at worst; every generic read surface shows
+ * `raybaseSecretRedacted` instead. Plaintext comes back only from an explicit,
+ * audited `revealSecret()` call on an action or job context.
+ *
+ * Envelope: `rbs1.<keyId>.<nonce>.<ciphertext>`, base64url pieces. The key id is
+ * HKDF-derived from the key, so it names a key without revealing it.
+ */
+export declare const raybaseSecretRedacted: "[REDACTED]";
+export type RaybaseRedactedSecret = typeof raybaseSecretRedacted;
+export declare const dataSecretsKeyEnvName = "RAYBASE_DATA_SECRETS_KEY";
+export declare const dataSecretsRetainedKeysEnvName = "RAYBASE_DATA_SECRETS_KEY_RETAINED";
+export declare const dataSecretLimits: {
+    readonly maxPlaintextBytes: number;
+    readonly defaultResealBatch: 200;
+    readonly maxResealBatch: 1000;
+    readonly maxReportedUnreadable: 50;
+};
+export type RaybaseDataSecretErrorCode = "data_secrets_key_missing" | "data_secrets_key_invalid" | "data_secret_key_unavailable" | "data_secret_undecryptable" | "data_secret_invalid" | "data_secret_unaudited";
+export declare class RaybaseDataSecretError extends RaybaseHttpError<RaybaseDataSecretErrorCode> {
+    constructor(code: RaybaseDataSecretErrorCode, message: string);
+}
+/** What a sealed value is bound to. Moving ciphertext to another row or column makes it undecryptable. */
+export type RaybaseDataSecretScope = {
+    table: string;
+    column: string;
+    rowId: string;
+};
+export type RaybaseOpenedDataSecret = {
+    value: string;
+    /** Null for a legacy plaintext value written before the column became `secret()`. */
+    keyId: string | null;
+    legacyPlaintext: boolean;
+};
+export type RaybaseDataSecretsKeyStatus = {
+    configured: boolean;
+    currentKeyId: string | null;
+    retainedKeyIds: string[];
+    /** Safe configuration error, never key material. */
+    error: string | null;
+};
+export type RaybaseDataSecrets = {
+    seal(scope: RaybaseDataSecretScope, plaintext: string): Promise<string>;
+    open(scope: RaybaseDataSecretScope, stored: string): Promise<RaybaseOpenedDataSecret>;
+    /** Throws the typed missing/invalid-key error when no usable key is configured. */
+    currentKeyId(): Promise<string>;
+    keyStatus(): Promise<RaybaseDataSecretsKeyStatus>;
+};
+/** Build a cipher from key strings. Keys are validated and derived on first use, so reads never depend on them. */
+export declare function createDataSecrets(input: {
+    currentKey?: string | null;
+    retainedKeys?: string | readonly string[] | null;
+}): RaybaseDataSecrets;
+/** The deployment cipher for this env, memoized by key strings so derived keys are reused across requests. */
+export declare function dataSecretsFromEnv(env: unknown): RaybaseDataSecrets;
+/** The read-side projection of a stored secret: the marker when set, null when not. */
+export declare function redactSecretValue(value: unknown): RaybaseRedactedSecret | null;
+type ColumnKinds = {
+    columns: Record<string, {
+        kind: string;
+    }>;
+};
+export declare function secretColumnNames(table: ColumnKinds): string[];
+export type RaybaseSecretColumnTarget = {
+    key: string;
+    table: {
+        name: string;
+    };
+    column: string;
+};
+/**
+ * Every secret column the deployment holds: app tables keyed by schema key,
+ * then manifest system tables (such as an integration's sealed session store)
+ * keyed by their physical name.
+ */
+export declare function schemaSecretColumns(schema: RaybaseSchema, systemTables?: readonly RaybaseSystemTable[]): RaybaseSecretColumnTarget[];
+/** Replace secret column values in a raw SQL row (export, operator query) with the redaction marker. */
+export declare function redactSecretColumns<Row extends Record<string, unknown>>(table: ColumnKinds, row: Row): Row;
+/** The name of every secret column the deployment holds, in app tables and manifest system tables. */
+export declare function secretColumnKeys(schema: RaybaseSchema, systemTables?: readonly RaybaseSystemTable[]): ReadonlySet<string>;
+/**
+ * For records that carry column values outside their table row (tool-call
+ * arguments, import inputs, audit metadata): redact, at any depth, every
+ * object key named like a secret column. Such a record may predate the column
+ * becoming `secret()`, so this is applied where the record is read as well as
+ * where it is written. A same-named ordinary column in another table is
+ * redacted too, which is the safe direction.
+ */
+export declare function redactSecretColumnKeys<Value>(columns: ReadonlySet<string>, value: Value): Value;
+export declare function isDataSecretEnvelope(value: unknown): value is string;
+/** The key id a stored value was sealed with; null for legacy plaintext. */
+export declare function dataSecretKeyId(value: string): string | null;
+export declare function assertSecretPlaintext(value: unknown, scope?: Omit<RaybaseDataSecretScope, "rowId"> & {
+    rowId?: string;
+}): asserts value is string;
+export type RaybaseDataSecretColumnStatus = {
+    table: string;
+    column: string;
+    set: number;
+    current: number;
+    /** Values sealed with a retained key, by key id. */
+    retained: Record<string, number>;
+    /** Values sealed with a key that is not configured at all. */
+    unknownKey: Record<string, number>;
+    /** Values written before the column became `secret()`. */
+    legacyPlaintext: number;
+};
+export type RaybaseDataSecretsStatus = {
+    key: RaybaseDataSecretsKeyStatus;
+    columns: RaybaseDataSecretColumnStatus[];
+    /** True when every set value is sealed with the current key. */
+    current: boolean;
+};
+/** Count secret values by key, without decrypting anything. */
+export declare function readDataSecretsStatus(input: {
+    schema: RaybaseSchema;
+    systemTables?: readonly RaybaseSystemTable[];
+    executorFor: (tableName: string) => SqlExecutor;
+    secrets: RaybaseDataSecrets;
+}): Promise<RaybaseDataSecretsStatus>;
+export type RaybaseDataSecretsResealCursor = {
+    table: string;
+    column: string;
+    afterId: string | null;
+};
+export type RaybaseDataSecretsResealResult = {
+    currentKeyId: string;
+    /** Values re-sealed from a retained key. */
+    resealed: number;
+    /** Legacy plaintext values sealed for the first time. */
+    sealed: number;
+    /** Values that could not be opened; they are left untouched. */
+    unreadable: Array<{
+        table: string;
+        column: string;
+        id: string;
+        code: RaybaseDataSecretErrorCode | "unknown";
+    }>;
+    unreadableCount: number;
+    cursor: RaybaseDataSecretsResealCursor | null;
+    done: boolean;
+};
+/**
+ * Re-seal every secret value not under the current key: values sealed with a
+ * retained key, and legacy plaintext left by turning an existing column into
+ * `secret()`. Bounded per call; pass `cursor` back until `done`. Each write is
+ * compare-and-swap on the old stored value, so a concurrent write wins.
+ */
+export declare function resealDataSecrets(input: {
+    schema: RaybaseSchema;
+    systemTables?: readonly RaybaseSystemTable[];
+    executorFor: (tableName: string) => SqlExecutor;
+    secrets: RaybaseDataSecrets;
+    limit?: number;
+    cursor?: RaybaseDataSecretsResealCursor | null;
+}): Promise<RaybaseDataSecretsResealResult>;
+export {};
+//# sourceMappingURL=data-secrets.d.ts.map

package/dist/data-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-secrets.d.ts","sourceRoot":"","sources":["../src/data-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGrE;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,qBAAqB,EAAG,YAAqB,CAAC;AAC3D,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC;AAEjE,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAChE,eAAO,MAAM,8BAA8B,sCAAsC,CAAC;AAElF,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAQX,MAAM,MAAM,0BAA0B,GAClC,0BAA0B,GAC1B,0BAA0B,GAC1B,6BAA6B,GAC7B,2BAA2B,GAC3B,qBAAqB,GACrB,uBAAuB,CAAC;AAW5B,qBAAa,sBAAuB,SAAQ,gBAAgB,CAAC,0BAA0B,CAAC;gBAC1E,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAI9D;AAED,0GAA0G;AAC1G,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oDAAoD;IACpD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,CAAC,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtF,mFAAmF;IACnF,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,SAAS,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAAC;CACnD,CAAC;AAKF,mHAAmH;AACnH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CAClD,GAAG,kBAAkB,CAiErB;AAID,8GAA8G;AAC9G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAWnE;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,GAAG,IAAI,CAE9E;AAED,KAAK,WAAW,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAEjE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,CAE9D;AAED,MAAM,MAAM,yBAAyB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,GAAE,SAAS,kBAAkB,EAAO,GAAG,yBAAyB,EAAE,CAKxI;AAED,wGAAwG;AACxG,wBAAgB,mBAAmB,CAAC,GAAG,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,CAQ1G;AAED,sGAAsG;AACtG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,GAAE,SAAS,kBAAkB,EAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAE7H;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,CAQ/F;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE5D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAOjJ;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,GAAG,EAAE,2BAA2B,CAAC;IACjC,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACzC,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAIF,+DAA+D;AAC/D,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7C,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,WAAW,CAAC;IAChD,OAAO,EAAE,kBAAkB,CAAC;CAC7B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAqBpC;AAED,MAAM,MAAM,8BAA8B,GAAG;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,0BAA0B,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IAC/G,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,8BAA8B,GAAG,IAAI,CAAC;IAC9C,IAAI,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7C,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,WAAW,CAAC;IAChD,OAAO,EAAE,kBAAkB,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,8BAA8B,GAAG,IAAI,CAAC;CAChD,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAmE1C"}

package/dist/data-secrets.js

@@ -0,0 +1,383 @@
+import { RaybaseHttpError } from "./http-error.js";
+import { q } from "./sql.js";
+/**
+ * Secret-at-rest app data. A `secret()` column stores an AES-256-GCM envelope
+ * sealed under the deployment key and bound to its table, column, and row id.
+ * Plaintext never reaches SQLite, so every raw-SQL path (backups, PITR,
+ * exports) carries ciphertext at worst; every generic read surface shows
+ * `raybaseSecretRedacted` instead. Plaintext comes back only from an explicit,
+ * audited `revealSecret()` call on an action or job context.
+ *
+ * Envelope: `rbs1.<keyId>.<nonce>.<ciphertext>`, base64url pieces. The key id is
+ * HKDF-derived from the key, so it names a key without revealing it.
+ */
+export const raybaseSecretRedacted = "[REDACTED]";
+export const dataSecretsKeyEnvName = "RAYBASE_DATA_SECRETS_KEY";
+export const dataSecretsRetainedKeysEnvName = "RAYBASE_DATA_SECRETS_KEY_RETAINED";
+export const dataSecretLimits = {
+    maxPlaintextBytes: 16 * 1024,
+    defaultResealBatch: 200,
+    maxResealBatch: 1_000,
+    maxReportedUnreadable: 50
+};
+const envelopeVersion = "rbs1";
+const keyIdBytes = 9;
+const keyIdPattern = /^[A-Za-z0-9_-]{12}$/;
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const errorStatus = {
+    data_secrets_key_missing: 503,
+    data_secrets_key_invalid: 503,
+    data_secret_key_unavailable: 503,
+    data_secret_undecryptable: 500,
+    data_secret_invalid: 400,
+    data_secret_unaudited: 500
+};
+export class RaybaseDataSecretError extends RaybaseHttpError {
+    constructor(code, message) {
+        super({ status: errorStatus[code], code, message });
+        this.name = "RaybaseDataSecretError";
+    }
+}
+/** Build a cipher from key strings. Keys are validated and derived on first use, so reads never depend on them. */
+export function createDataSecrets(input) {
+    let keyring = null;
+    const loadKeyring = () => {
+        keyring ??= deriveKeyring(input.currentKey ?? null, splitRetainedKeys(input.retainedKeys));
+        return keyring;
+    };
+    return {
+        async seal(scope, plaintext) {
+            assertSecretPlaintext(plaintext, scope);
+            const { current } = await loadKeyring();
+            const nonce = crypto.getRandomValues(new Uint8Array(12));
+            const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv: bufferSource(nonce), additionalData: bufferSource(aad(current.keyId, scope)) }, current.key, bufferSource(encoder.encode(plaintext)));
+            return [envelopeVersion, current.keyId, base64Url(nonce), base64Url(new Uint8Array(ciphertext))].join(".");
+        },
+        async open(scope, stored) {
+            const envelope = parseEnvelope(stored);
+            if (!envelope)
+                return { value: stored, keyId: null, legacyPlaintext: true };
+            const { byId } = await loadKeyring();
+            const derived = byId.get(envelope.keyId);
+            if (!derived) {
+                throw new RaybaseDataSecretError("data_secret_key_unavailable", `${describeScope(scope)} was sealed with data-secrets key ${envelope.keyId}, which is not configured. Add that key to ${dataSecretsRetainedKeysEnvName}.`);
+            }
+            try {
+                const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: bufferSource(envelope.nonce), additionalData: bufferSource(aad(envelope.keyId, scope)) }, derived.key, bufferSource(envelope.ciphertext));
+                return { value: decoder.decode(plaintext), keyId: envelope.keyId, legacyPlaintext: false };
+            }
+            catch {
+                throw new RaybaseDataSecretError("data_secret_undecryptable", `${describeScope(scope)} could not be decrypted: the stored value was modified or does not belong to this row and column.`);
+            }
+        },
+        async currentKeyId() {
+            return (await loadKeyring()).current.keyId;
+        },
+        async keyStatus() {
+            try {
+                const { current, byId } = await loadKeyring();
+                return {
+                    configured: true,
+                    currentKeyId: current.keyId,
+                    retainedKeyIds: [...byId.keys()].filter((keyId) => keyId !== current.keyId),
+                    error: null
+                };
+            }
+            catch (error) {
+                return {
+                    configured: false,
+                    currentKeyId: null,
+                    retainedKeyIds: [],
+                    error: error instanceof Error ? error.message : "Data-secrets key is not usable"
+                };
+            }
+        }
+    };
+}
+const envSecretsCache = new Map();
+/** The deployment cipher for this env, memoized by key strings so derived keys are reused across requests. */
+export function dataSecretsFromEnv(env) {
+    const record = env && typeof env === "object" ? env : {};
+    const currentKey = typeof record[dataSecretsKeyEnvName] === "string" ? record[dataSecretsKeyEnvName] : "";
+    const retainedKeys = typeof record[dataSecretsRetainedKeysEnvName] === "string" ? record[dataSecretsRetainedKeysEnvName] : "";
+    const cacheKey = `${currentKey}\u0000${retainedKeys}`;
+    const cached = envSecretsCache.get(cacheKey);
+    if (cached)
+        return cached;
+    const secrets = createDataSecrets({ currentKey, retainedKeys });
+    if (envSecretsCache.size >= 16)
+        envSecretsCache.delete(envSecretsCache.keys().next().value);
+    envSecretsCache.set(cacheKey, secrets);
+    return secrets;
+}
+/** The read-side projection of a stored secret: the marker when set, null when not. */
+export function redactSecretValue(value) {
+    return value === null || value === undefined || value === "" ? null : raybaseSecretRedacted;
+}
+export function secretColumnNames(table) {
+    return Object.entries(table.columns).filter(([, column]) => column.kind === "secret").map(([name]) => name);
+}
+/**
+ * Every secret column the deployment holds: app tables keyed by schema key,
+ * then manifest system tables (such as an integration's sealed session store)
+ * keyed by their physical name.
+ */
+export function schemaSecretColumns(schema, systemTables = []) {
+    return [
+        ...Object.entries(schema.tables).flatMap(([key, table]) => secretColumnNames(table).map((column) => ({ key, table, column }))),
+        ...systemTables.flatMap((table) => secretColumnNames(table).map((column) => ({ key: table.name, table, column })))
+    ];
+}
+/** Replace secret column values in a raw SQL row (export, operator query) with the redaction marker. */
+export function redactSecretColumns(table, row) {
+    const secrets = secretColumnNames(table);
+    if (!secrets.length)
+        return row;
+    const output = { ...row };
+    for (const column of secrets) {
+        if (column in output)
+            output[column] = redactSecretValue(output[column]);
+    }
+    return output;
+}
+/** The name of every secret column the deployment holds, in app tables and manifest system tables. */
+export function secretColumnKeys(schema, systemTables = []) {
+    return new Set(schemaSecretColumns(schema, systemTables).map((target) => target.column));
+}
+/**
+ * For records that carry column values outside their table row (tool-call
+ * arguments, import inputs, audit metadata): redact, at any depth, every
+ * object key named like a secret column. Such a record may predate the column
+ * becoming `secret()`, so this is applied where the record is read as well as
+ * where it is written. A same-named ordinary column in another table is
+ * redacted too, which is the safe direction.
+ */
+export function redactSecretColumnKeys(columns, value) {
+    if (!columns.size || value === null || typeof value !== "object")
+        return value;
+    if (Array.isArray(value))
+        return value.map((item) => redactSecretColumnKeys(columns, item));
+    const output = {};
+    for (const [key, entry] of Object.entries(value)) {
+        output[key] = columns.has(key) ? redactSecretValue(entry) : redactSecretColumnKeys(columns, entry);
+    }
+    return output;
+}
+export function isDataSecretEnvelope(value) {
+    return typeof value === "string" && parseEnvelope(value) !== null;
+}
+/** The key id a stored value was sealed with; null for legacy plaintext. */
+export function dataSecretKeyId(value) {
+    return parseEnvelope(value)?.keyId ?? null;
+}
+export function assertSecretPlaintext(value, scope) {
+    const label = scope ? `${scope.table}.${scope.column}` : "Secret value";
+    if (typeof value !== "string")
+        throw new RaybaseDataSecretError("data_secret_invalid", `${label} must be a string`);
+    if (!value.trim())
+        throw new RaybaseDataSecretError("data_secret_invalid", `${label} must not be empty; write null to clear a secret`);
+    if (encoder.encode(value).byteLength > dataSecretLimits.maxPlaintextBytes) {
+        throw new RaybaseDataSecretError("data_secret_invalid", `${label} exceeds ${dataSecretLimits.maxPlaintextBytes} bytes`);
+    }
+}
+const currentPrefixLength = envelopeVersion.length + 1 + 12 + 1;
+/** Count secret values by key, without decrypting anything. */
+export async function readDataSecretsStatus(input) {
+    const key = await input.secrets.keyStatus();
+    const retainedIds = new Set(key.retainedKeyIds);
+    const columns = [];
+    for (const { key: tableKey, table, column } of schemaSecretColumns(input.schema, input.systemTables)) {
+        const groups = await input.executorFor(tableKey).all(`SELECT CASE WHEN substr(${q(column)}, 1, ${envelopeVersion.length + 1}) = '${envelopeVersion}.' THEN substr(${q(column)}, ${envelopeVersion.length + 2}, 12) ELSE NULL END AS "keyId", COUNT(*) AS "count"
+       FROM ${q(table.name)} WHERE ${q(column)} IS NOT NULL AND ${q(column)} != '' GROUP BY "keyId"`);
+        const status = { table: table.name, column, set: 0, current: 0, retained: {}, unknownKey: {}, legacyPlaintext: 0 };
+        for (const group of groups) {
+            const count = Number(group.count);
+            status.set += count;
+            if (group.keyId === null)
+                status.legacyPlaintext += count;
+            else if (group.keyId === key.currentKeyId)
+                status.current += count;
+            else if (retainedIds.has(group.keyId))
+                status.retained[group.keyId] = count;
+            else
+                status.unknownKey[group.keyId] = count;
+        }
+        columns.push(status);
+    }
+    return { key, columns, current: columns.every((column) => column.current === column.set) };
+}
+/**
+ * Re-seal every secret value not under the current key: values sealed with a
+ * retained key, and legacy plaintext left by turning an existing column into
+ * `secret()`. Bounded per call; pass `cursor` back until `done`. Each write is
+ * compare-and-swap on the old stored value, so a concurrent write wins.
+ */
+export async function resealDataSecrets(input) {
+    const currentKeyId = await input.secrets.currentKeyId();
+    const currentPrefix = `${envelopeVersion}.${currentKeyId}.`;
+    const limit = Math.min(Math.max(Math.trunc(input.limit ?? dataSecretLimits.defaultResealBatch), 1), dataSecretLimits.maxResealBatch);
+    const targets = schemaSecretColumns(input.schema, input.systemTables);
+    const result = {
+        currentKeyId,
+        resealed: 0,
+        sealed: 0,
+        unreadable: [],
+        unreadableCount: 0,
+        cursor: null,
+        done: false
+    };
+    let startIndex = 0;
+    let afterId = null;
+    if (input.cursor) {
+        startIndex = targets.findIndex((target) => target.table.name === input.cursor.table && target.column === input.cursor.column);
+        if (startIndex < 0)
+            throw new RaybaseDataSecretError("data_secret_invalid", "Reseal cursor does not name a secret column in this schema");
+        afterId = input.cursor.afterId;
+    }
+    let budget = limit;
+    for (let index = startIndex; index < targets.length; index += 1) {
+        const { key: tableKey, table, column } = targets[index];
+        const executor = input.executorFor(tableKey);
+        while (budget > 0) {
+            const batchLimit = budget;
+            const rows = await executor.all(`SELECT "id", ${q(column)} AS "value" FROM ${q(table.name)}
+         WHERE ${q(column)} IS NOT NULL AND ${q(column)} != '' AND substr(${q(column)}, 1, ${currentPrefixLength}) != ?
+         ${afterId === null ? "" : `AND "id" > ?`}
+         ORDER BY "id" LIMIT ?`, afterId === null ? [currentPrefix, batchLimit] : [currentPrefix, afterId, batchLimit]);
+            for (const row of rows) {
+                const scope = { table: table.name, column, rowId: String(row.id) };
+                afterId = String(row.id);
+                budget -= 1;
+                let opened;
+                try {
+                    opened = await input.secrets.open(scope, row.value);
+                    assertSecretPlaintext(opened.value, scope);
+                }
+                catch (error) {
+                    result.unreadableCount += 1;
+                    if (result.unreadable.length < dataSecretLimits.maxReportedUnreadable) {
+                        result.unreadable.push({ table: table.name, column, id: scope.rowId, code: error instanceof RaybaseDataSecretError ? error.code : "unknown" });
+                    }
+                    continue;
+                }
+                const sealed = await input.secrets.seal(scope, opened.value);
+                await executor.run(`UPDATE ${q(table.name)} SET ${q(column)} = ? WHERE "id" = ? AND ${q(column)} = ?`, [sealed, scope.rowId, row.value]);
+                if (opened.legacyPlaintext)
+                    result.sealed += 1;
+                else
+                    result.resealed += 1;
+            }
+            if (rows.length < batchLimit)
+                break;
+        }
+        if (budget === 0) {
+            result.cursor = { table: table.name, column, afterId };
+            return result;
+        }
+        afterId = null;
+    }
+    result.done = true;
+    return result;
+}
+function splitRetainedKeys(value) {
+    const entries = typeof value === "string" ? value.split(/[\s,]+/) : [...(value ?? [])];
+    return entries.map((entry) => entry.trim()).filter(Boolean);
+}
+async function deriveKeyring(currentKey, retainedKeys) {
+    if (!currentKey?.trim()) {
+        throw new RaybaseDataSecretError("data_secrets_key_missing", `${dataSecretsKeyEnvName} is not configured. Secret columns cannot be written or revealed without it; run raybase data-secrets enable.`);
+    }
+    const labelled = [
+        { label: dataSecretsKeyEnvName, value: currentKey },
+        ...retainedKeys.map((value, index) => ({ label: `${dataSecretsRetainedKeysEnvName} entry ${index + 1}`, value }))
+    ];
+    const derived = [];
+    for (const { label, value } of labelled)
+        derived.push(await deriveKey(decodeKeyMaterial(value, label)));
+    // A retained copy of the current key is harmless and expected mid-rotation,
+    // when the retained list is uploaded before the new current key.
+    const byId = new Map();
+    for (const entry of derived)
+        if (!byId.has(entry.keyId))
+            byId.set(entry.keyId, entry);
+    return { current: derived[0], byId };
+}
+function decodeKeyMaterial(value, label) {
+    const normalized = value.trim().replace(/-/g, "+").replace(/_/g, "/");
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(normalized)) {
+        throw new RaybaseDataSecretError("data_secrets_key_invalid", `${label} must be base64 or base64url encoded`);
+    }
+    let bytes;
+    try {
+        bytes = Uint8Array.from(atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=")), (char) => char.charCodeAt(0));
+    }
+    catch {
+        throw new RaybaseDataSecretError("data_secrets_key_invalid", `${label} is not valid base64`);
+    }
+    if (bytes.byteLength < 32) {
+        throw new RaybaseDataSecretError("data_secrets_key_invalid", `${label} must contain at least 256 bits of random key material`);
+    }
+    if (new Set(bytes).size < 16) {
+        bytes.fill(0);
+        throw new RaybaseDataSecretError("data_secrets_key_invalid", `${label} does not contain enough entropy`);
+    }
+    return bytes;
+}
+async function deriveKey(material) {
+    try {
+        const source = await crypto.subtle.importKey("raw", bufferSource(material), "HKDF", false, ["deriveKey", "deriveBits"]);
+        const salt = bufferSource(encoder.encode("raybase/data-secrets/v1"));
+        const keyIdBits = await crypto.subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info: bufferSource(encoder.encode("key-id")) }, source, keyIdBytes * 8);
+        const key = await crypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt, info: bufferSource(encoder.encode("aes-256-gcm")) }, source, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+        return { keyId: base64Url(new Uint8Array(keyIdBits)), key };
+    }
+    finally {
+        material.fill(0);
+    }
+}
+function parseEnvelope(value) {
+    const parts = value.split(".");
+    if (parts.length !== 4 || parts[0] !== envelopeVersion || !keyIdPattern.test(parts[1]))
+        return null;
+    const nonce = fromBase64Url(parts[2]);
+    const ciphertext = fromBase64Url(parts[3]);
+    // A GCM ciphertext carries at least its 16-byte authentication tag.
+    if (!nonce || nonce.byteLength !== 12 || !ciphertext || ciphertext.byteLength < 17)
+        return null;
+    return { keyId: parts[1], nonce, ciphertext };
+}
+function aad(keyId, scope) {
+    return encoder.encode(JSON.stringify({
+        subsystem: "raybase-data-secret",
+        envelope: envelopeVersion,
+        keyId,
+        table: scope.table,
+        column: scope.column,
+        rowId: scope.rowId
+    }));
+}
+function describeScope(scope) {
+    return `Secret ${scope.table}.${scope.column} on row ${scope.rowId}`;
+}
+function base64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function fromBase64Url(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        return null;
+    try {
+        const base64 = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+        return Uint8Array.from(atob(base64), (char) => char.charCodeAt(0));
+    }
+    catch {
+        return null;
+    }
+}
+function bufferSource(bytes) {
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+//# sourceMappingURL=data-secrets.js.map

package/dist/data-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-secrets.js","sourceRoot":"","sources":["../src/data-secrets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAE7B;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAqB,CAAC;AAG3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAChE,MAAM,CAAC,MAAM,8BAA8B,GAAG,mCAAmC,CAAC;AAElF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,iBAAiB,EAAE,EAAE,GAAG,IAAI;IAC5B,kBAAkB,EAAE,GAAG;IACvB,cAAc,EAAE,KAAK;IACrB,qBAAqB,EAAE,EAAE;CACjB,CAAC;AAEX,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAU1D,MAAM,WAAW,GAA+C;IAC9D,wBAAwB,EAAE,GAAG;IAC7B,wBAAwB,EAAE,GAAG;IAC7B,2BAA2B,EAAE,GAAG;IAChC,yBAAyB,EAAE,GAAG;IAC9B,mBAAmB,EAAE,GAAG;IACxB,qBAAqB,EAAE,GAAG;CAC3B,CAAC;AAEF,MAAM,OAAO,sBAAuB,SAAQ,gBAA4C;IACtF,YAAY,IAAgC,EAAE,OAAe;QAC3D,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAmCD,mHAAmH;AACnH,MAAM,UAAU,iBAAiB,CAAC,KAGjC;IACC,IAAI,OAAO,GAAmC,IAAI,CAAC;IACnD,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,OAAO,KAAK,aAAa,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3F,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS;YACzB,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,EACrG,OAAO,CAAC,GAAG,EACX,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CACxC,CAAC;YACF,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7G,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM;YACtB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YAC5E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,EAC7B,GAAG,aAAa,CAAC,KAAK,CAAC,qCAAqC,QAAQ,CAAC,KAAK,8CAA8C,8BAA8B,GAAG,CAC1J,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,EAC/G,OAAO,CAAC,GAAG,EACX,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAClC,CAAC;gBACF,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;YAC7F,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,sBAAsB,CAC9B,2BAA2B,EAC3B,GAAG,aAAa,CAAC,KAAK,CAAC,mGAAmG,CAC3H,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,YAAY;YAChB,OAAO,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,SAAS;YACb,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;gBAC9C,OAAO;oBACL,UAAU,EAAE,IAAI;oBAChB,YAAY,EAAE,OAAO,CAAC,KAAK;oBAC3B,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;oBAC3E,KAAK,EAAE,IAAI;iBACZ,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,UAAU,EAAE,KAAK;oBACjB,YAAY,EAAE,IAAI;oBAClB,cAAc,EAAE,EAAE;oBAClB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;iBACjF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAA8B,CAAC;AAE9D,8GAA8G;AAC9G,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,MAAM,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAA8B,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,qBAAqB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACpH,MAAM,YAAY,GAAG,OAAO,MAAM,CAAC,8BAA8B,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,8BAA8B,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACxI,MAAM,QAAQ,GAAG,GAAG,UAAU,SAAS,YAAY,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;IAChE,IAAI,eAAe,CAAC,IAAI,IAAI,EAAE;QAAE,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;IAC7F,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC;AAC9F,CAAC;AAID,MAAM,UAAU,iBAAiB,CAAC,KAAkB;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC9G,CAAC;AAID;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqB,EAAE,eAA8C,EAAE;IACzG,OAAO;QACL,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9H,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;KACnH,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,mBAAmB,CAAsC,KAAkB,EAAE,GAAQ;IACnG,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IAChC,MAAM,MAAM,GAA4B,EAAE,GAAG,GAAG,EAAE,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,IAAI,MAAM;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAa,CAAC;AACvB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,gBAAgB,CAAC,MAAqB,EAAE,eAA8C,EAAE;IACtG,OAAO,IAAI,GAAG,CAAC,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAQ,OAA4B,EAAE,KAAY;IACtF,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAU,CAAC;IACrG,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,MAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACpE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAE,KAAkE;IACtH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACxE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;IACpH,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,GAAG,KAAK,kDAAkD,CAAC,CAAC;IACvI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;QAC1E,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,GAAG,KAAK,YAAY,gBAAgB,CAAC,iBAAiB,QAAQ,CAAC,CAAC;IAC1H,CAAC;AACH,CAAC;AAsBD,MAAM,mBAAmB,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAEhE,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAK3C;IACC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAChD,MAAM,OAAO,GAAoC,EAAE,CAAC;IACpD,KAAK,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACrG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,CAClD,2BAA2B,CAAC,CAAC,MAAM,CAAC,QAAQ,eAAe,CAAC,MAAM,GAAG,CAAC,QAAQ,eAAe,kBAAkB,CAAC,CAAC,MAAM,CAAC,KAAK,eAAe,CAAC,MAAM,GAAG,CAAC;cAC/I,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,yBAAyB,CAC/F,CAAC;QACF,MAAM,MAAM,GAAkC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QAClJ,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC;YACpB,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;gBAAE,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC;iBACrD,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,YAAY;gBAAE,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;iBAC9D,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;;gBACvE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7F,CAAC;AAqBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAOvC;IACC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IACxD,MAAM,aAAa,GAAG,GAAG,eAAe,IAAI,YAAY,GAAG,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACrI,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,MAAM,GAAmC;QAC7C,YAAY;QACZ,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,CAAC;QACT,UAAU,EAAE,EAAE;QACd,eAAe,EAAE,CAAC;QAClB,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,KAAK;KACZ,CAAC;IACF,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAO,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC;QAChI,IAAI,UAAU,GAAG,CAAC;YAAE,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,4DAA4D,CAAC,CAAC;QAC1I,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;IACjC,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,UAAU,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAChE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC7C,OAAO,MAAM,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,MAAM,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAC7B,gBAAgB,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;iBACjD,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,QAAQ,mBAAmB;WACrG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc;+BAClB,EACvB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,UAAU,CAAC,CACtF,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnE,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzB,MAAM,IAAI,CAAC,CAAC;gBACZ,IAAI,MAA+B,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;oBACpD,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC7C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;oBAC5B,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,gBAAgB,CAAC,qBAAqB,EAAE,CAAC;wBACtE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;oBACjJ,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7D,MAAM,QAAQ,CAAC,GAAG,CAChB,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,MAAM,CAAC,MAAM,EAClF,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CACjC,CAAC;gBACF,IAAI,MAAM,CAAC,eAAe;oBAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;;oBAC1C,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YAC5B,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,GAAG,UAAU;gBAAE,MAAM;QACtC,CAAC;QACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAoD;IAC7E,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,UAAyB,EAAE,YAAsB;IAC5E,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,sBAAsB,CAC9B,0BAA0B,EAC1B,GAAG,qBAAqB,+GAA+G,CACxI,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,UAAU,EAAE;QACnD,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,8BAA8B,UAAU,KAAK,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;KAClH,CAAC;IACF,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACxG,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,GAAG,KAAK,wDAAwD,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,GAAG,KAAK,kCAAkC,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAoB;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;QACxH,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAC9C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EACrF,MAAM,EACN,UAAU,GAAG,CAAC,CACf,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,EAC1F,MAAM,EACN,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrG,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC5C,oEAAoE;IACpE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAChG,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,GAAG,CAAC,KAAa,EAAE,KAA6B;IACvD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,eAAe;QACzB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,KAA6B;IAClD,OAAO,UAAU,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACxG,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAC;AAClG,CAAC"}