@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/cjs/permissions/plan-registry.js

@@ -0,0 +1,454 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PlanRegistry = void 0;
+const crypto_1 = require("crypto");
+const role_policy_1 = require("./role-policy");
+/**
+ * In-memory registry of single-use migration plans, keyed by plan id.
+ *
+ * Every question about a plan is asked about **one** id: `validate()` to inspect,
+ * `consume()` to decide and hand out authority, `unregister()` for administrative
+ * removal. There is deliberately no "list every live plan" accessor — it had no
+ * production caller, and an enumeration API over live plan ids invites exactly the
+ * probing that the single-id refusals are written to prevent (finding M-22). Do
+ * not reintroduce one for debugging: log the id you are about to look up.
+ */
+class PlanRegistry {
+    plans = new Map();
+    /**
+     * Tombstones of plans that were consumed, oldest first.
+     *
+     * Without them a consumed plan is indistinguishable from one that was never
+     * registered, so a replay attempt reads as a typo. They carry the id and the
+     * consumption time only — no statements, no user id, no role — so a refusal
+     * built from them says "this id was already spent" and nothing about any
+     * other plan. Bounded to `maxPlans` entries.
+     */
+    consumed = new Map();
+    opts;
+    constructor(opts) {
+        this.opts = {
+            ttlMs: opts?.ttlMs ?? 300_000,
+            maxPlans: opts?.maxPlans ?? 100,
+        };
+    }
+    /**
+     * Whether this principal may register a migration plan at all.
+     *
+     * This is the source of truth for the `plan_register` entry gate so the
+     * dispatcher and the registry cannot disagree:
+     *   - `read_only` never registers plans; there is nothing to approve a
+     *     write against.
+     *   - a role without the `migration_run` capability never registers plans.
+     */
+    canRegister(role, permissionLevel) {
+        if (permissionLevel === 'read_only') {
+            return {
+                allowed: false,
+                code: 'read_only_permission_level',
+                reason: `Plan registration is refused at permission level 'read_only'`,
+            };
+        }
+        if (!(0, role_policy_1.hasCapability)(role, 'migration_run')) {
+            return {
+                allowed: false,
+                code: 'role_lacks_migration_run',
+                reason: `Role '${role}' lacks the 'migration_run' capability and cannot register plans`,
+            };
+        }
+        return { allowed: true };
+    }
+    /**
+     * Register a migration plan on behalf of `principal`.
+     *
+     * Registration is an authorization event, so the plan records WHO registered
+     * it, WITH WHAT ROLE, and AT WHAT PERMISSION LEVEL. Without all three the
+     * registry is a self-attesting allow-list: the same untrusted principal
+     * registers the plan and runs it, and a statement-hash match proves nothing.
+     *
+     * `principal` is optional only so the record can distinguish "no principal
+     * attested" from "no principal": an unattested plan is stored but is
+     * restricted to its registrant and carries no permission-level floor. Callers
+     * must pass it.
+     */
+    register(planId, statements, registeredBy, riskLevel, principal) {
+        if (!principal) {
+            return {
+                ok: false,
+                code: 'unattested_principal',
+                reason: 'Plan registration requires the registering principal (user id, role and ' +
+                    'permission level). Refusing to store an unattested plan.',
+            };
+        }
+        const gate = this.canRegister(principal.role, principal.permission_level);
+        if (!gate.allowed) {
+            return {
+                ok: false,
+                code: gate.code ?? 'unattested_principal',
+                reason: gate.reason ?? 'Plan registration refused',
+            };
+        }
+        if (registeredBy !== principal.user_id) {
+            return {
+                ok: false,
+                code: 'unattested_principal',
+                reason: 'Plan registration refused: the registering user id does not match the ' +
+                    'attested principal.',
+            };
+        }
+        // the registration must name the resolved database it belongs to.
+        // Stored unbound, the plan's statement hash and provenance survive a change
+        // of database and it executes unchanged against production.
+        const scope = scopeOf(principal.project, principal.db_alias);
+        if (!scope) {
+            return {
+                ok: false,
+                code: 'unscoped_plan_registration',
+                reason: 'Plan registration requires the resolved project and db_alias the plan is bound ' +
+                    'to. Refusing to store a plan that is not bound to a database.',
+            };
+        }
+        // M-22: expiry was enforced only by whichever lookup happened to notice, so
+        // a plan nobody ever ran stayed in the map until the process exited. Purging
+        // on the registration path keeps the registry bounded without a timer.
+        // `expires_at` is `registered_at + ttlMs` (300s by default), so a plan
+        // registered moments ago is never a purge candidate.
+        this.purgeExpired();
+        // If registry is at max, evict the oldest plan (LRU)
+        if (this.plans.size >= this.opts.maxPlans) {
+            const oldestKey = this.plans.keys().next().value;
+            if (oldestKey !== undefined) {
+                this.plans.delete(oldestKey);
+            }
+        }
+        const now = Date.now();
+        const plan = {
+            plan_id: planId,
+            statements_hash: this.hashStatements(statements),
+            statement_count: statements.length,
+            registered_at: now,
+            expires_at: now + this.opts.ttlMs,
+            registered_by: principal.user_id,
+            registered_by_role: principal.role,
+            registered_permission_level: principal.permission_level,
+            project: scope.project,
+            db_alias: scope.db_alias,
+            risk_level: riskLevel,
+        };
+        this.plans.set(planId, plan);
+        return { ok: true, plan };
+    }
+    /**
+     * Look up a live plan, distinguishing "never registered" from "already
+     * consumed".
+     *
+     * Both refusals are about this id only: neither mentions another plan, a
+     * user, a role or a statement, so probing for someone else's plan id tells
+     * the prober nothing beyond "no such plan".
+     */
+    lookup(planId) {
+        const plan = this.plans.get(planId);
+        if (plan) {
+            return { ok: true, plan };
+        }
+        if (this.consumed.has(planId)) {
+            return {
+                ok: false,
+                code: 'plan_already_consumed',
+                reason: `Plan '${planId}' has already been consumed; a migration plan is single-use ` +
+                    'and cannot be replayed',
+            };
+        }
+        return { ok: false, code: 'plan_not_registered', reason: 'Plan ID not found in registry' };
+    }
+    /**
+     * Check if a plan is valid (exists, not expired, statements match).
+     *
+     * This does NOT consume the plan and does NOT check who is asking, so it is
+     * an inspection helper only. Anything about to execute a plan must call
+     * `consume()`, which is the single atomic hand-off of authority.
+     */
+    validate(planId, statements) {
+        const found = this.lookup(planId);
+        if (!found.ok) {
+            return { valid: false, reason: found.reason };
+        }
+        const plan = found.plan;
+        if (Date.now() > plan.expires_at) {
+            this.unregister(planId);
+            return { valid: false, reason: 'Plan expired' };
+        }
+        const hash = this.hashStatements(statements);
+        if (hash !== plan.statements_hash) {
+            return { valid: false, reason: 'Statements do not match registered plan' };
+        }
+        // Update access order for LRU cache
+        this.plans.delete(planId);
+        this.plans.set(planId, plan);
+        return { valid: true, plan };
+    }
+    /**
+     * Validate, authorise and destroy `planId` in one synchronous step.
+     *
+     * `check()` in the permission pipeline is async, so authority must not be
+     * handed out by a `validate()` … `unregister()` pair: that sequence is only
+     * single-use by accident of the current call graph, and any `await` added
+     * between the two turns it into a replay of the same plan. Here the plan
+     * leaves the map in the same synchronous step that grants it, so a second
+     * caller — whatever it interleaved at — sees a tombstone and is refused.
+     *
+     * A refused attempt does NOT burn the plan: an unauthorised runner must not
+     * be able to invalidate somebody else's registration by trying it. Expiry is
+     * the only other way a plan leaves the map.
+     */
+    consume(planId, statements, runner) {
+        const found = this.lookup(planId);
+        if (!found.ok) {
+            return found;
+        }
+        const plan = found.plan;
+        if (Date.now() > plan.expires_at) {
+            this.unregister(planId);
+            return { ok: false, code: 'plan_expired', reason: 'Plan expired' };
+        }
+        if (this.hashStatements(statements) !== plan.statements_hash) {
+            return {
+                ok: false,
+                code: 'statements_changed',
+                reason: 'Statements do not match registered plan',
+            };
+        }
+        const scopeVerdict = assertPlanScope(plan, runner.scope);
+        if (!scopeVerdict.ok) {
+            return scopeVerdict;
+        }
+        const provenance = this.mayExecutePlan(plan, runner);
+        if (!provenance.allowed) {
+            return {
+                ok: false,
+                code: plan.registered_by_role === null || plan.registered_permission_level === null
+                    ? 'principal_not_attested'
+                    : !(0, role_policy_1.isAtLeastAsPermissive)(runner.permission_level, plan.registered_permission_level)
+                        ? 'registered_at_more_permissive_level'
+                        : 'runner_not_privileged',
+                reason: provenance.reason ?? 'insufficient authority',
+            };
+        }
+        this.plans.delete(planId);
+        this.rememberConsumed(planId);
+        return { ok: true, plan };
+    }
+    /**
+     * Inspect a plan without consuming it and check only its database binding.
+     *
+     * The dispatcher calls this before the permission pipeline runs, because the
+     * registry cannot see the frame on its own: `AutoUpgradeChecker` (which owns
+     * the `consume()` call) receives an `ActionRequest` and today forwards only
+     * the principal. Comparing here means the check cannot be skipped by a code
+     * path that reaches `consume()` some other way — and a plan id that is not
+     * registered at all passes, because a `migration_run` at `full` legitimately
+     * needs no plan.
+     *
+     * A refused attempt does NOT burn the plan: an out-of-scope runner must not be
+     * able to invalidate somebody else's registration.
+     */
+    assertExecutionScope(planId, scope) {
+        const plan = this.plans.get(planId);
+        // Unknown or already consumed: the consume path reports it, with a refusal
+        // that says nothing about other plans.
+        if (!plan)
+            return { ok: true };
+        const verdict = assertPlanScope(plan, scope);
+        if (verdict.ok)
+            return verdict;
+        return {
+            ok: false,
+            code: 'plan_scope_mismatch',
+            reason: `Plan ${planId} was registered against project '${plan.project}' (alias ` +
+                `'${plan.db_alias}') and may not be executed against project '${scope.project}' ` +
+                `(alias '${scope.db_alias}')`,
+        };
+    }
+    /**
+     * Whether `runner` may execute `plan`.
+     *
+     * Four independent conditions, all fail-closed:
+     *   0. The runner's resolved database must equal the one the plan was
+     *      registered against. See {@link assertPlanScope}; enforced by
+     *      `consume()` when the runner supplies a scope and by
+     *      {@link assertExecutionScope} on the request path.
+     *   1. The runner's role must be at least as privileged as the role the plan
+     *      was registered under. Authority is not retained across a demotion: a
+     *      plan registered by an `admin` is admin authority even when the same
+     *      user id now presents a weaker role.
+     *   2. The runner must be the registering principal, or hold a STRICTLY more
+     *      privileged role. An admin may run a developer's plan; a peer may not
+     *      run another peer's, because the plan is authority exercised at the
+     *      registrant's level.
+     *   3. The plan may only be executed at a permission level at least as
+     *      permissive as the one it was registered under, so a plan that needed
+     *      no human at `full` cannot be executed unattended at `auto_upgrade`.
+     *
+     * An unattested plan (no role or level recorded) may only be executed by the
+     * user that registered it.
+     */
+    mayExecutePlan(plan, runner) {
+        const scopeVerdict = assertPlanScope(plan, runner.scope);
+        if (!scopeVerdict.ok) {
+            return { allowed: false, reason: scopeVerdict.reason };
+        }
+        if (plan.registered_by_role === null || plan.registered_permission_level === null) {
+            if (plan.registered_by !== runner.user_id) {
+                return {
+                    allowed: false,
+                    reason: `Plan ${plan.plan_id} was registered without an attested principal, so a ` +
+                        'different user may not execute it; only the registering user id may',
+                };
+            }
+            return { allowed: true };
+        }
+        if (!(0, role_policy_1.isAtLeastAsPrivileged)(runner.role, plan.registered_by_role)) {
+            return {
+                allowed: false,
+                reason: `Plan ${plan.plan_id} was registered under role '${plan.registered_by_role}', ` +
+                    `which role '${runner.role}' does not match or exceed`,
+            };
+        }
+        if (plan.registered_by !== runner.user_id &&
+            !(0, role_policy_1.isStrictlyMorePrivileged)(runner.role, plan.registered_by_role)) {
+            return {
+                allowed: false,
+                reason: `Plan ${plan.plan_id} was registered by '${plan.registered_by}' ` +
+                    `(role '${plan.registered_by_role}'); a different user may not execute it unless ` +
+                    `their role is strictly more privileged, and role '${runner.role}' is not`,
+            };
+        }
+        if (!(0, role_policy_1.isAtLeastAsPermissive)(runner.permission_level, plan.registered_permission_level)) {
+            return {
+                allowed: false,
+                reason: `Plan ${plan.plan_id} was registered at permission level ` +
+                    `'${plan.registered_permission_level}' and may not be executed at the more ` +
+                    `restrictive level '${runner.permission_level}'`,
+            };
+        }
+        return { allowed: true };
+    }
+    /**
+     * Remove a plan (after migration runs or fails).
+     *
+     * This is administrative removal, not a consumption: no tombstone is left,
+     * so a later use of the id is reported as unknown rather than as a replay.
+     * `consume()` is what a migration run must use.
+     */
+    unregister(planId) {
+        this.plans.delete(planId);
+        this.consumed.delete(planId);
+    }
+    /**
+     * Drop plans whose TTL has elapsed. Called on the registration path, so an
+     * expired plan never occupies a slot or survives until process exit.
+     *
+     * Expiry is `expires_at = registered_at + ttlMs`, so a plan registered
+     * moments ago has `expires_at` five minutes in the future and can never be
+     * swept by this. Nothing here decides authorisation.
+     */
+    purgeExpired() {
+        const now = Date.now();
+        let purged = 0;
+        for (const [id, plan] of this.plans.entries()) {
+            if (now > plan.expires_at) {
+                this.plans.delete(id);
+                purged++;
+            }
+        }
+        for (const [id, consumedAt] of this.consumed.entries()) {
+            if (now - consumedAt > this.opts.ttlMs) {
+                this.consumed.delete(id);
+            }
+        }
+        return purged;
+    }
+    /** Record a consumption as a tombstone, bounded to `maxPlans` entries. */
+    rememberConsumed(planId) {
+        this.consumed.delete(planId);
+        this.consumed.set(planId, Date.now());
+        while (this.consumed.size > this.opts.maxPlans) {
+            const oldest = this.consumed.keys().next().value;
+            if (oldest === undefined) {
+                break;
+            }
+            this.consumed.delete(oldest);
+        }
+    }
+    /**
+     * Compute a stable hash of statements.
+     *
+     * Whitespace is collapsed and case folded so the comparison cannot be
+     * defeated by re-spacing, and the entries are length-delimited so
+     * `['A','BC']` and `['AB','C']` cannot collide.
+     */
+    hashStatements(statements) {
+        const normalized = statements
+            .map((s) => {
+            const flat = s.trim().replace(/\s+/g, ' ').toLowerCase();
+            return `${flat.length}:${flat}`;
+        })
+            .join('|');
+        return (0, crypto_1.createHash)('sha256').update(normalized).digest('hex');
+    }
+}
+exports.PlanRegistry = PlanRegistry;
+/**
+ * A registration scope, or null when either half is missing.
+ *
+ * Trimmed and required non-empty: `''` would be a database named by nothing, and
+ * comparing it against a real alias would have to be treated as a match by every
+ * string comparison downstream.
+ */
+function scopeOf(project, dbAlias) {
+    const p = typeof project === 'string' ? project.trim() : '';
+    const a = typeof dbAlias === 'string' ? dbAlias.trim() : '';
+    if (p.length === 0 || a.length === 0)
+        return null;
+    return { project: p, db_alias: a };
+}
+/**
+ * Whether `scope` is the database `plan` was registered against.
+ *
+ * Fail-closed in both directions: a plan with no recorded scope and a runner
+ * with no supplied scope are both refused, so a caller cannot reach an unbound
+ * plan by simply not telling the registry which database it is talking about.
+ * `assertExecutionScope` on the request path is what supplies the scope for a
+ * caller (`AutoUpgradeChecker`) that does not forward one itself.
+ */
+function assertPlanScope(plan, scope) {
+    const registered = scopeOf(plan.project, plan.db_alias);
+    if (!registered) {
+        return {
+            ok: false,
+            code: 'plan_scope_mismatch',
+            reason: `Plan ${plan.plan_id} is not bound to a database, so it may not be executed. ` +
+                'Register it again against the database it is intended for.',
+        };
+    }
+    const requested = scopeOf(scope?.project, scope?.db_alias);
+    if (!requested) {
+        return {
+            ok: false,
+            code: 'plan_scope_mismatch',
+            reason: `Execution scope for plan ${plan.plan_id} is unknown, so it may not be executed. ` +
+                'The resolved project and db_alias must both be supplied.',
+        };
+    }
+    if (registered.project !== requested.project || registered.db_alias !== requested.db_alias) {
+        return {
+            ok: false,
+            code: 'plan_scope_mismatch',
+            reason: `Plan ${plan.plan_id} is bound to project '${registered.project}' (alias ` +
+                `'${registered.db_alias}') and may not be executed against project ` +
+                `'${requested.project}' (alias '${requested.db_alias}')`,
+        };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=plan-registry.js.map

package/dist/cjs/permissions/plan-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-registry.js","sourceRoot":"","sources":["../../../src/permissions/plan-registry.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AAGpC,+CAKuB;AA+FvB;;;;;;;;;GASG;AACH,MAAa,YAAY;IACf,KAAK,GAAgC,IAAI,GAAG,EAAE,CAAC;IACvD;;;;;;;;OAQG;IACK,QAAQ,GAAwB,IAAI,GAAG,EAAE,CAAC;IACjC,IAAI,CAAgC;IAErD,YAAY,IAA0B;QACpC,IAAI,CAAC,IAAI,GAAG;YACV,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,OAAO;YAC7B,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG;SAChC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CACT,IAAU,EACV,eAAgC;QAEhC,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,4BAA4B;gBAClC,MAAM,EAAE,8DAA8D;aACvE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAA,2BAAa,EAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,SAAS,IAAI,kEAAkE;aACxF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,QAAQ,CACN,MAAc,EACd,UAAoB,EACpB,YAAoB,EACpB,SAAqC,EACrC,SAAyB;QAEzB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EACJ,0EAA0E;oBAC1E,0DAA0D;aAC7D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,sBAAsB;gBACzC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,2BAA2B;aACnD,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;YACvC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EACJ,wEAAwE;oBACxE,qBAAqB;aACxB,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,4EAA4E;QAC5E,4DAA4D;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,4BAA4B;gBAClC,MAAM,EACJ,iFAAiF;oBACjF,+DAA+D;aAClE,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,6EAA6E;QAC7E,uEAAuE;QACvE,uEAAuE;QACvE,qDAAqD;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,qDAAqD;QACrD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,MAAM;YACf,eAAe,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;YAChD,eAAe,EAAE,UAAU,CAAC,MAAM;YAClC,aAAa,EAAE,GAAG;YAClB,UAAU,EAAE,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK;YACjC,aAAa,EAAE,SAAS,CAAC,OAAO;YAChC,kBAAkB,EAAE,SAAS,CAAC,IAAI;YAClC,2BAA2B,EAAE,SAAS,CAAC,gBAAgB;YACvD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,SAAS;SACtB,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CACZ,MAAc;QAEd,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EACJ,SAAS,MAAM,8DAA8D;oBAC7E,wBAAwB;aAC3B,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAC7F,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CACN,MAAc,EACd,UAAoB;QAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAChD,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAC7E,CAAC;QACD,oCAAoC;QACpC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,OAAO,CACL,MAAc,EACd,UAAoB,EACpB,MAAsG;QAEtG,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QAExB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAC7D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,yCAAyC;aAClD,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EACF,IAAI,CAAC,kBAAkB,KAAK,IAAI,IAAI,IAAI,CAAC,2BAA2B,KAAK,IAAI;oBAC3E,CAAC,CAAC,wBAAwB;oBAC1B,CAAC,CAAC,CAAC,IAAA,mCAAqB,EAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,CAAC,2BAA2B,CAAC;wBACjF,CAAC,CAAC,qCAAqC;wBACvC,CAAC,CAAC,uBAAuB;gBAC/B,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,wBAAwB;aACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,oBAAoB,CAClB,MAAc,EACd,KAAyB;QAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,2EAA2E;QAC3E,uCAAuC;QACvC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EACJ,QAAQ,MAAM,oCAAoC,IAAI,CAAC,OAAO,WAAW;gBACzE,IAAI,IAAI,CAAC,QAAQ,+CAA+C,KAAK,CAAC,OAAO,IAAI;gBACjF,WAAW,KAAK,CAAC,QAAQ,IAAI;SAChC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,cAAc,CACZ,IAAoB,EACpB,MAAsG;QAEtG,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;QACzD,CAAC;QAED,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,IAAI,IAAI,CAAC,2BAA2B,KAAK,IAAI,EAAE,CAAC;YAClF,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC1C,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EACJ,QAAQ,IAAI,CAAC,OAAO,sDAAsD;wBAC1E,qEAAqE;iBACxE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,IAAA,mCAAqB,EAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,QAAQ,IAAI,CAAC,OAAO,+BAA+B,IAAI,CAAC,kBAAkB,KAAK;oBAC/E,eAAe,MAAM,CAAC,IAAI,4BAA4B;aACzD,CAAC;QACJ,CAAC;QAED,IACE,IAAI,CAAC,aAAa,KAAK,MAAM,CAAC,OAAO;YACrC,CAAC,IAAA,sCAAwB,EAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,kBAAkB,CAAC,EAC/D,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,QAAQ,IAAI,CAAC,OAAO,uBAAuB,IAAI,CAAC,aAAa,IAAI;oBACjE,UAAU,IAAI,CAAC,kBAAkB,iDAAiD;oBAClF,qDAAqD,MAAM,CAAC,IAAI,UAAU;aAC7E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAA,mCAAqB,EAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACtF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,QAAQ,IAAI,CAAC,OAAO,sCAAsC;oBAC1D,IAAI,IAAI,CAAC,2BAA2B,wCAAwC;oBAC5E,sBAAsB,MAAM,CAAC,gBAAgB,GAAG;aACnD,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,MAAc;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,YAAY;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACtB,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0EAA0E;IAClE,gBAAgB,CAAC,MAAc;QACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM;YACR,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,UAAoB;QACzC,MAAM,UAAU,GAAG,UAAU;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YACzD,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC,CAAC;aACD,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;CACF;AA9bD,oCA8bC;AAED;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,OAAgB,EAAE,OAAgB;IACjD,MAAM,CAAC,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,CAAC,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CACtB,IAAoB,EACpB,KAAqC;IAErC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EACJ,QAAQ,IAAI,CAAC,OAAO,0DAA0D;gBAC9E,4DAA4D;SAC/D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EACJ,4BAA4B,IAAI,CAAC,OAAO,0CAA0C;gBAClF,0DAA0D;SAC7D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3F,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EACJ,QAAQ,IAAI,CAAC,OAAO,yBAAyB,UAAU,CAAC,OAAO,WAAW;gBAC1E,IAAI,UAAU,CAAC,QAAQ,6CAA6C;gBACpE,IAAI,SAAS,CAAC,OAAO,aAAa,SAAS,CAAC,QAAQ,IAAI;SAC3D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}