@schema-weaver/pg-connector 0.0.0-stage → 2.0.1

package/dist/esm/audit/cloud-writer.js

@@ -0,0 +1,91 @@
+import { CloudClient, deriveHttpBase } from './cloud-client';
+import { isDevToken } from '../config/token';
+const AUDIT_INGEST_PATH = '/api/agent/audit/ingest';
+/**
+ * Cloud audit writer. Buffers audit events and ships them to the cloud ingest
+ * endpoint through the shared `CloudClient`, which batches them, retries a
+ * failed batch a bounded number of times, and drops the oldest records once its
+ * queue is full.
+ *
+ * What this class actually does when delivery fails, so callers know what they
+ * are relying on:
+ *   - `log()` never throws and never blocks. It returns `queued` as soon as the
+ *     record is in the client's buffer.
+ *   - `disabled` when `enabled` is false, `not_configured` when no client could
+ *     be built (no URL, or a development token). The record is simply not
+ *     buffered; nothing is retried, because there is nowhere to retry to.
+ *   - Records the client later cannot deliver are counted here, exposed through
+ *     {@link CloudAuditWriter.dropped} and {@link CloudAuditWriter.stats}, and
+ *     handed to `onDrop` so an owner with a durable log can record the loss.
+ *     There is no in-memory retry marker of its own.
+ *
+ * The local audit log is the durable record; this is best-effort egress.
+ */
+export class CloudAuditWriter {
+    config;
+    client = null;
+    droppedCount = 0;
+    constructor(config) {
+        this.config = config;
+        this.initClient();
+    }
+    initClient() {
+        if (!this.config.enabled)
+            return;
+        const token = this.config.agent_token;
+        // Single shared dev-token predicate: this check was inlined here and in the
+        // operation logger while `isDevToken()` sat unused (finding M-22/M-23).
+        if (!token || isDevToken(token))
+            return;
+        let baseUrl = this.config.url;
+        if (!baseUrl && this.config.cloudUrl) {
+            baseUrl = deriveHttpBase(this.config.cloudUrl);
+        }
+        if (!baseUrl)
+            return;
+        this.client = new CloudClient({
+            baseUrl,
+            token,
+            agentId: this.config.agent_id || 'unknown',
+            onDrop: (drop) => {
+                this.droppedCount += drop.count;
+                this.config.onDrop?.(drop);
+            },
+        });
+        this.client.start();
+    }
+    async log(event) {
+        if (!this.config.enabled) {
+            return { status: 'disabled' };
+        }
+        if (!this.client) {
+            // No ingest endpoint was resolved, so there is nowhere to buffer to.
+            // Reported per call: the sink counts these, and suppressing the repeat
+            // here would hide a permanent misconfiguration.
+            return { status: 'not_configured', dropped: this.droppedCount };
+        }
+        try {
+            this.client.enqueue(AUDIT_INGEST_PATH, event);
+            return { status: 'queued', dropped: this.droppedCount };
+        }
+        catch {
+            this.droppedCount++;
+            return { status: 'dropped', dropped: this.droppedCount };
+        }
+    }
+    /** Records buffered for cloud delivery that were dropped instead. */
+    get dropped() {
+        return this.droppedCount;
+    }
+    /** Queue / inflight / drop accounting, or `null` when no client is attached. */
+    stats() {
+        return this.client ? this.client.getStats() : null;
+    }
+    /** Flush and close the underlying client. Called on shutdown. */
+    async flush() {
+        if (this.client) {
+            await this.client.shutdown();
+        }
+    }
+}
+//# sourceMappingURL=cloud-writer.js.map

package/dist/esm/audit/cloud-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-writer.js","sourceRoot":"","sources":["../../../src/audit/cloud-writer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAA+B,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAwB7C,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,gBAAgB;IACV,MAAM,CAAoB;IACnC,MAAM,GAAuB,IAAI,CAAC;IAClC,YAAY,GAAG,CAAC,CAAC;IAEzB,YAAY,MAAyB;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAEjC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACtC,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO;QAExC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QAC9B,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrC,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,CAAC;YAC5B,OAAO;YACP,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,SAAS;YAC1C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACf,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,qEAAqE;YACrE,uEAAuE;YACvE,gDAAgD;YAChD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClE,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,gFAAgF;IAChF,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;CACF"}

package/dist/esm/audit/context.d.ts

@@ -0,0 +1,51 @@
+import type { DbEntry } from '../config/db-config';
+/**
+ * The database identity an audit record is written under.
+ *
+ *  made this a required part of every record: the audit trail used to
+ * carry only the caller-asserted `project`, so a frame that named one database
+ * and executed against another left a record that named a database the
+ * operation never touched, with no field able to name the one it did.
+ *
+ * These two values come from the entry the request actually resolved to, never
+ * from the frame.
+ */
+export interface ResolvedDbIdentity {
+    resolved_db_alias: string;
+    resolved_database: string;
+}
+/**
+ * The fail-closed identity: this request resolved to no database.
+ *
+ * Used when no context is established (an agent-generated record, a refusal, a
+ * record written outside a request) and whenever the values are missing. It is
+ * deliberately an obvious non-name rather than an empty string, so a record can
+ * never be mistaken for one that resolved to a database whose alias happens to
+ * be blank.
+ */
+export declare const UNRESOLVED_DB_ALIAS = "unresolved";
+export declare const UNRESOLVED_DB_IDENTITY: Readonly<ResolvedDbIdentity>;
+/**
+ * Build an identity from a resolved entry, failing closed.
+ *
+ * A missing or blank `db_alias`/`database` yields `'unresolved'` rather than an
+ * empty string, so "we could not tell" is distinguishable from "the database has
+ * no alias" at read time and in a MAC-verified record.
+ */
+export declare function resolvedIdentityOf(entry: DbEntry | null | undefined): ResolvedDbIdentity;
+/**
+ * Run `fn` with every audit record written inside it attributed to `identity`.
+ *
+ * This is the durable half of the  fix: the audit sink stamps the resolved
+ * identity from this context on every record it builds, so no call site can
+ * forget it and no call site can override it with the frame's own claim. The
+ * dispatcher establishes the context at the single point where the resolved
+ * entry is known.
+ */
+export declare function withResolvedDatabase<T>(identity: ResolvedDbIdentity, fn: () => T): T;
+/**
+ * The identity of the request currently in scope, or the fail-closed
+ * `'unresolved'` default when none was established.
+ */
+export declare function currentResolvedDbIdentity(): ResolvedDbIdentity;
+//# sourceMappingURL=context.d.ts.map

package/dist/esm/audit/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/audit/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,kBAAkB,CAG9D,CAAC;AAaH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,kBAAkB,CAOxF;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEpF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,kBAAkB,CAE9D"}

package/dist/esm/audit/context.js

@@ -0,0 +1,69 @@
+import { AsyncLocalStorage } from 'async_hooks';
+/**
+ * The fail-closed identity: this request resolved to no database.
+ *
+ * Used when no context is established (an agent-generated record, a refusal, a
+ * record written outside a request) and whenever the values are missing. It is
+ * deliberately an obvious non-name rather than an empty string, so a record can
+ * never be mistaken for one that resolved to a database whose alias happens to
+ * be blank.
+ */
+export const UNRESOLVED_DB_ALIAS = 'unresolved';
+export const UNRESOLVED_DB_IDENTITY = Object.freeze({
+    resolved_db_alias: UNRESOLVED_DB_ALIAS,
+    resolved_database: UNRESOLVED_DB_ALIAS,
+});
+/**
+ * Per-request store for the resolved identity.
+ *
+ * An `AsyncLocalStorage` rather than a mutable field on the sink because the
+ * sink is shared by every concurrent request: the identity has to follow the
+ * async call tree of the request that established it, and a plain field would
+ * let one request's audit record inherit another's identity — which is the same
+ * class of defect as the caller-asserted value this replaces, only inverted.
+ */
+const storage = new AsyncLocalStorage();
+/**
+ * Build an identity from a resolved entry, failing closed.
+ *
+ * A missing or blank `db_alias`/`database` yields `'unresolved'` rather than an
+ * empty string, so "we could not tell" is distinguishable from "the database has
+ * no alias" at read time and in a MAC-verified record.
+ */
+export function resolvedIdentityOf(entry) {
+    const alias = typeof entry?.db_alias === 'string' ? entry.db_alias.trim() : '';
+    const database = typeof entry?.database === 'string' ? entry.database.trim() : '';
+    return {
+        resolved_db_alias: alias.length > 0 ? alias : UNRESOLVED_DB_ALIAS,
+        resolved_database: database.length > 0 ? database : UNRESOLVED_DB_ALIAS,
+    };
+}
+/**
+ * Run `fn` with every audit record written inside it attributed to `identity`.
+ *
+ * This is the durable half of the  fix: the audit sink stamps the resolved
+ * identity from this context on every record it builds, so no call site can
+ * forget it and no call site can override it with the frame's own claim. The
+ * dispatcher establishes the context at the single point where the resolved
+ * entry is known.
+ */
+export function withResolvedDatabase(identity, fn) {
+    return storage.run(normaliseIdentity(identity), fn);
+}
+/**
+ * The identity of the request currently in scope, or the fail-closed
+ * `'unresolved'` default when none was established.
+ */
+export function currentResolvedDbIdentity() {
+    return storage.getStore() ?? UNRESOLVED_DB_IDENTITY;
+}
+/** Force every field to a non-empty, non-whitespace value. */
+function normaliseIdentity(identity) {
+    const alias = typeof identity?.resolved_db_alias === 'string' ? identity.resolved_db_alias.trim() : '';
+    const database = typeof identity?.resolved_database === 'string' ? identity.resolved_database.trim() : '';
+    return {
+        resolved_db_alias: alias.length > 0 ? alias : UNRESOLVED_DB_ALIAS,
+        resolved_database: database.length > 0 ? database : UNRESOLVED_DB_ALIAS,
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/esm/audit/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../src/audit/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAmBhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEhD,MAAM,CAAC,MAAM,sBAAsB,GAAiC,MAAM,CAAC,MAAM,CAAC;IAChF,iBAAiB,EAAE,mBAAmB;IACtC,iBAAiB,EAAE,mBAAmB;CACvC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAsB,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAiC;IAClE,MAAM,KAAK,GAAG,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,QAAQ,GAAG,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,OAAO;QACL,iBAAiB,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB;QACjE,iBAAiB,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAI,QAA4B,EAAE,EAAW;IAC/E,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,sBAAsB,CAAC;AACtD,CAAC;AAED,8DAA8D;AAC9D,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,KAAK,GAAG,OAAO,QAAQ,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvG,MAAM,QAAQ,GACZ,OAAO,QAAQ,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,OAAO;QACL,iBAAiB,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB;QACjE,iBAAiB,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB;KACxE,CAAC;AACJ,CAAC"}

package/dist/esm/audit/files.d.ts

@@ -0,0 +1,111 @@
+import { AuditEvent } from './types';
+export interface AuditLogFilter {
+    project?: string;
+    user?: string;
+    action?: string;
+    decision?: string;
+    outcome?: string;
+    search?: string;
+    since?: string | number;
+    until?: string | number;
+    order?: 'asc' | 'desc';
+    limit?: number;
+}
+/** Whole-log read result, used by chain verification. */
+export interface AuditLogReadResult {
+    /** Log files in chronological order (oldest archive first, active file last). */
+    files: string[];
+    /** Every parsed record, oldest first. */
+    events: AuditEvent[];
+    /** Log files that exist but could not be read. */
+    unreadableFiles: string[];
+    /** Lines that are not parseable JSON — corruption or injected content. */
+    malformedLines: number;
+}
+/**
+ * Mode for the audit **directory**. A directory needs the execute bit to be
+ * traversable; creating one with a regular file's mode (0o600) makes every
+ * stat/open/readdir inside it fail with EACCES, which is how a clean install
+ * ended up with no audit trail at all.
+ */
+export declare const AUDIT_DIR_MODE = 448;
+/** Mode for the audit log files themselves: read/write for the owner only. */
+export declare const AUDIT_FILE_MODE = 384;
+/**
+ * Repairs an audit directory left with a mode that cannot be traversed.
+ *
+ * `fs.mkdir({ recursive: true })` is a no-op on an existing directory, so a
+ * directory created earlier with the wrong mode stays wrong and every later
+ * append keeps failing EACCES. The explicit chmod is what makes an
+ * already-broken install repair itself.
+ *
+ * @returns true when the mode had to be corrected.
+ */
+export declare function repairAuditDirMode(dir: string, mode?: number): Promise<boolean>;
+/**
+ * Ensures the audit directory exists and is traversable, creating it at mode
+ * 0o700 and repairing a pre-existing wrong mode.
+ *
+ * Idempotent and safe to call from setup, startup, append and repair paths:
+ *
+ * ```ts
+ * await ensureAuditDir(path.join(getSwAgentDir(), 'audit'));
+ * ```
+ *
+ * @returns true when the directory had to be created or its mode corrected.
+ */
+export declare function ensureAuditDir(dir: string, opts?: {
+    dirMode?: number;
+}): Promise<boolean>;
+/** Result of {@link probeAuditDir}. */
+export interface AuditDirProbe {
+    ok: boolean;
+    dir: string;
+    dirMode: number;
+    /** True when {@link repairAuditDirMode} had to change the mode. */
+    repaired: boolean;
+    reason?: string;
+}
+/**
+ * Startup gate for the audit path: creates/repairs the directory, then proves a
+ * real write + fsync succeeds. "Audit loss must not be silent" is only
+ * enforceable if startup refuses to claim the log is fine without trying it.
+ */
+export declare function probeAuditDir(dir: string, opts?: {
+    dirMode?: number;
+    fileMode?: number;
+}): Promise<AuditDirProbe>;
+/**
+ * Returns audit log files in strict chronological order:
+ * audit-N.jsonl (oldest archive) -> ... -> audit-1.jsonl (most recent archive) -> audit.jsonl (active file)
+ */
+export declare function getAuditFilesChronological(auditDir: string): Promise<string[]>;
+/**
+ * Returns audit log files in reverse-chronological order:
+ * audit.jsonl (active, newest) -> audit-1.jsonl -> audit-2.jsonl -> ... -> audit-N.jsonl (oldest)
+ */
+export declare function getAuditFilesReverse(auditDir: string): Promise<string[]>;
+/**
+ * Parse relative time string (e.g. "15m", "1h", "24h", "7d", "today") or ISO string into unix timestamp (ms).
+ */
+export declare function parseSince(since?: string | number): number | null;
+/**
+ * Reads every record of the audit log in strict chronological order across all
+ * rotated files, with no limit.
+ *
+ * Chain verification must see the log as one sequence: verifying each rotated
+ * file in isolation reports every file that begins mid-chain as broken, which is
+ * what made routine rotation look like tampering.
+ */
+export declare function readAuditLogChronological(auditDir: string): Promise<AuditLogReadResult>;
+/**
+ * Checks whether an event satisfies the given filter.
+ */
+export declare function eventMatchesFilter(event: AuditEvent, filter: AuditLogFilter, sinceTs?: number | null, untilTs?: number | null, searchLower?: string): boolean;
+/**
+ * Reads audit events matching the filter.
+ * Defaults to descending order (newest first).
+ * Fast backwards reading: stops as soon as `limit` matches are satisfied.
+ */
+export declare function readAuditEvents(auditDir: string, filter?: AuditLogFilter): Promise<AuditEvent[]>;
+//# sourceMappingURL=files.d.ts.map

package/dist/esm/audit/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../src/audit/files.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yCAAyC;IACzC,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,kDAAkD;IAClD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,MAAQ,CAAC;AAEpC,8EAA8E;AAC9E,eAAO,MAAM,eAAe,MAAQ,CAAC;AAMrC;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,MAAuB,GAC5B,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9B,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED,uCAAuC;AACvC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACjD,OAAO,CAAC,aAAa,CAAC,CA4CxB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA4BpF;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAG9E;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CA6BjE;AAMD;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoC7F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,EACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,EACvB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CA8CT;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,cAAmB,GAC1B,OAAO,CAAC,UAAU,EAAE,CAAC,CAiEvB"}