@smthrs/kernel 0.0.0-stage → 1.0.0-rc.4

package/dist/cjs/FileSystem.d.ts

@@ -0,0 +1,452 @@
+/**
+ * Permission-aware filesystem operations.
+ *
+ * There is no kernel `FileSystem` interface and no kernel `FileSystem` tag.
+ * Effect owns both, and its tag fixes the error channel to `PlatformError`, so
+ * this module is only the middleware: a `Layer` over Effect's own tag that
+ * reads the raw service out of context and returns a guarded one in its place.
+ * Permission failures are projected into `PlatformError` by
+ * `Permission.toPlatformError`, which keeps the structured kernel failure on
+ * the error's `cause`.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md`,
+ * `docs/specs/Concepts/Effect Taxonomy.md`, and
+ * `docs/specs/Concepts/Host Adapters.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import { Effect, FileSystem as EffectFileSystem, Layer, Path as EffectPath, PlatformError, Result, Schema } from "effect";
+import * as Batch from "./FileSystemBatch.ts";
+import { GrantStore } from "./GrantStore.ts";
+import { Workspace } from "./Workspace.ts";
+export * from "./FileSystemBatch.ts";
+/**
+ * The directory name that stands in for the host's system temporary directory
+ * in a capability resource. `makeTempFile` and friends called without an
+ * explicit `directory` are checked against this name resolved one level above
+ * the workspace root, so an implicit system-temp write names a resource that
+ * is always outside the workspace envelope and is never confusable with a real
+ * workspace path.
+ *
+ * @since 1.0.0-rc.0
+ * @category models
+ */
+export declare const systemTemporaryDirectoryName = "<system-temp>";
+/**
+ * Host-private extension used for race-free, descriptor-relative filesystem
+ * operations. A plain path-based `FileSystem` cannot provide confinement: an
+ * attacker can replace any checked component before the delegate resolves it.
+ * Platform adapters opt in only when they can pin a root handle and reject
+ * symlinks while traversing from it. Hosts without this extension fail closed.
+ *
+ * @since 1.0.0-rc.0
+ * @category security
+ */
+export declare const AtomicFileSystemTypeId: unique symbol;
+/** The pinned root every atomic request is resolved against.
+ *
+ * The guarded layer fills these in at the boundary from the composed
+ * workspace, so a caller that builds a request leaves them out.
+ *
+ * @since 1.0.0-rc.0
+ * @category security
+ */
+export interface AtomicRoot {
+    readonly boundaryRoot?: string | undefined;
+    readonly logicalRoot?: string | undefined;
+    readonly rootIdentity?: string | undefined;
+}
+/** A serializable operation executed relative to a pinned filesystem root.
+ *
+ * One member per operation, discriminated by `operation`, so a request cannot
+ * omit an operand its operation needs — a `rename` carries both endpoints or
+ * does not compile — and an adapter cannot quietly leave an operation
+ * unimplemented. Every member is the same flat JSON object the helper protocol
+ * already framed, so the wire shape is unchanged.
+ *
+ * @since 1.0.0-rc.0
+ * @category security
+ */
+export type AtomicRequest = (AtomicRoot & {
+    readonly operation: "exists";
+    readonly path: string;
+}) | (AtomicRoot & {
+    readonly operation: "chmod";
+    readonly path: string;
+    readonly options: {
+        readonly mode: number;
+    };
+}) | (AtomicRoot & {
+    readonly operation: "chown";
+    readonly path: string;
+    readonly options: {
+        readonly uid: number;
+        readonly gid: number;
+    };
+}) | (AtomicRoot & {
+    readonly operation: "glob";
+    readonly pattern: string;
+    readonly root: string;
+    readonly options?: {
+        readonly exclude?: ReadonlyArray<string> | undefined;
+    } | undefined;
+}) | (AtomicRoot & {
+    readonly operation: "makeDirectory";
+    readonly path: string;
+    readonly options?: {
+        readonly recursive?: boolean | undefined;
+        readonly mode?: number | undefined;
+    } | undefined;
+}) | (AtomicRoot & {
+    readonly operation: "readDirectory";
+    readonly path: string;
+    readonly options?: {
+        readonly recursive?: boolean | undefined;
+    } | undefined;
+}) | (AtomicRoot & {
+    readonly operation: "readFile";
+    readonly path: string;
+}) | (AtomicRoot & {
+    readonly operation: "readFileString";
+    readonly path: string;
+    readonly encoding?: string | undefined;
+}) | (AtomicRoot & {
+    readonly operation: "readLink";
+    readonly path: string;
+}) | (AtomicRoot & {
+    readonly operation: "realPath";
+    readonly path: string;
+}) | (AtomicRoot & {
+    readonly operation: "resolve";
+    readonly path: string;
+}) | (AtomicRoot & {
+    readonly operation: "remove";
+    readonly path: string;
+    readonly options?: {
+        readonly recursive?: boolean | undefined;
+        readonly force?: boolean | undefined;
+    } | undefined;
+}) | (AtomicRoot & {
+    readonly operation: "rename";
+    readonly from: string;
+    readonly to: string;
+}) | (AtomicRoot & {
+    readonly operation: "stat";
+    readonly path: string;
+}) | (AtomicRoot & {
+    readonly operation: "writeFile";
+    readonly path: string;
+    /** Base64 of the bytes, bounded by the host's `contentLimit`. */
+    readonly data: string;
+    readonly options?: {
+        readonly flag?: EffectFileSystem.OpenFlag | undefined;
+        readonly mode?: number | undefined;
+    } | undefined;
+}) | (AtomicRoot & {
+    readonly operation: "writeFileString";
+    readonly path: string;
+    readonly data: string;
+    readonly options?: {
+        readonly flag?: EffectFileSystem.OpenFlag | undefined;
+        readonly mode?: number | undefined;
+    } | undefined;
+}) | (AtomicRoot & {
+    readonly operation: "batch";
+    readonly requests: ReadonlyArray<AtomicBatchRequest>;
+});
+/** Where a no-follow executor's `resolve` walk stopped.
+ *
+ * `path` is the canonical path the walk reached below the pinned root, in
+ * on-disk spelling for every existing component. When `target` is `null`,
+ * `path` is the whole request, with a missing component and its descendants
+ * kept as requested. Otherwise `path` names the first link or reparse point
+ * on the way and `target` is its text, which the executor read without
+ * opening what it names.
+ *
+ * @since 1.0.0-rc.1
+ * @category security
+ */
+export interface Resolution {
+    readonly path: string;
+    readonly target: string | null;
+}
+/** One member of an executor batch: a public read, or authorization's `resolve`.
+ *
+ * @since 1.0.0-rc.1
+ * @category security
+ */
+export type AtomicBatchRequest = Batch.BatchRequest | {
+    readonly operation: "resolve";
+    readonly path: string;
+};
+/** One member's value in an executor batch.
+ *
+ * @since 1.0.0-rc.1
+ * @category security
+ */
+export type AtomicBatchValue = Batch.BatchValue | {
+    readonly operation: "resolve";
+    readonly resolution: Resolution;
+};
+/** An executor batch's answer: {@link Batch.BatchResponse} over {@link AtomicBatchValue}.
+ *
+ * @since 1.0.0-rc.1
+ * @category security
+ */
+export interface AtomicBatchResponse {
+    readonly rootIdentity: string;
+    readonly entries: ReadonlyArray<{
+        readonly index: number;
+        readonly path: string;
+        readonly result: Result.Result<AtomicBatchValue, PlatformError.PlatformError>;
+    }>;
+}
+/** The value each atomic operation resolves to.
+ *
+ * The executor no longer takes the result type from its caller: an operation
+ * names its own result here, so a host that answers a `stat` with a boolean is
+ * a compile error rather than a decode that succeeds and reads wrong.
+ *
+ * @since 1.0.0-rc.0
+ * @category security
+ */
+export interface AtomicResults {
+    readonly exists: boolean;
+    readonly chmod: void;
+    readonly chown: void;
+    readonly glob: Array<string>;
+    readonly makeDirectory: void;
+    readonly readDirectory: Array<string>;
+    readonly readFile: Uint8Array;
+    readonly readFileString: string;
+    readonly readLink: string;
+    readonly realPath: string;
+    readonly resolve: Resolution;
+    readonly remove: void;
+    readonly rename: void;
+    readonly stat: EffectFileSystem.File.Info;
+    readonly writeFile: void;
+    readonly writeFileString: void;
+    readonly batch: AtomicBatchResponse;
+}
+/** The result of one request, read from the operation it names.
+ *
+ * @since 1.0.0-rc.0
+ * @category security
+ */
+export type AtomicResult<R extends AtomicRequest> = AtomicResults[R["operation"]];
+/** One typed implementation per operation.
+ *
+ * A record of this type receives each operation's own request and returns that
+ * operation's own result, and a record missing an operation does not compile,
+ * which is the exhaustiveness a `string` operation could not give an adapter.
+ *
+ * @since 1.0.0-rc.0
+ * @category security
+ */
+export type AtomicHandlers = {
+    readonly [K in keyof AtomicResults]: (request: Extract<AtomicRequest, {
+        readonly operation: K;
+    }>) => Effect.Effect<AtomicResults[K], PlatformError.PlatformError>;
+};
+/** Trusted host extension implementing atomic path resolution and operation.
+ *
+ * @since 1.0.0-rc.0
+ * @category security
+ */
+export interface AtomicFileSystem {
+    /**
+     * The executor refuses symlinks and hard links during every handle-relative
+     * operation. Authorization still resolves the on-disk path spelling, but
+     * does not need a separate hard-link stat before invoking the executor.
+     */
+    readonly noFollowAuthorization?: true | undefined;
+    /** Exact composition-time identity when native file IDs exceed numeric precision. */
+    readonly identifyRoot?: ((path: string) => Effect.Effect<string, PlatformError.PlatformError>) | undefined;
+    readonly execute: <R extends AtomicRequest>(request: R) => Effect.Effect<AtomicResult<R>, PlatformError.PlatformError>;
+    /**
+     * A filesystem already confined by an enforceable process/filesystem
+     * boundary (for example an in-memory browser volume). Methods not expressible
+     * as one descriptor-relative request may delegate only through this surface.
+     */
+    readonly isolated?: EffectFileSystem.FileSystem | undefined;
+    /** Advertised only by executors implementing the bounded batch protocol. */
+    readonly batchLimits?: {
+        readonly size: number;
+        readonly response: number;
+    } | undefined;
+    /**
+     * Advertised byte ceiling for one serialized `writeFile` payload. The kernel
+     * refuses a larger payload with a typed `BadArgument` before base64-encoding
+     * it, so an executor that frames requests across a serialized host boundary
+     * never asks its runtime for a string it cannot represent. Hosts delegating
+     * through `isolated` receive the bytes directly and advertise nothing.
+     */
+    readonly contentLimit?: number | undefined;
+}
+/** An Effect filesystem carrying the atomic host extension.
+ *
+ * @since 1.0.0-rc.0
+ * @category security
+ */
+export type AtomicHostFileSystem = EffectFileSystem.FileSystem & {
+    readonly [AtomicFileSystemTypeId]: AtomicFileSystem;
+};
+/** Attaches a trusted platform's descriptor-relative executor to its service.
+ *
+ * The executor is attached to the supplied object, so a later attachment over
+ * the same service replaces this one. A host attaches exactly once at its
+ * boundary; a caller that deliberately layers over an existing executor must
+ * read it first and delegate to it, which is what makes replacement its own
+ * decision rather than an accident.
+ *
+ * @since 1.0.0-rc.0
+ * @category security
+ */
+export declare const withAtomicFileSystem: (fileSystem: EffectFileSystem.FileSystem, atomic: AtomicFileSystem) => AtomicHostFileSystem;
+/**
+ * Why a filesystem composition or guarded batch refused.
+ *
+ * @since 1.0.0-rc.0
+ * @category models
+ */
+export declare const FileSystemFaultCode: Schema.Literals<readonly ["executor_already_present", "isolated_operation_unsupported", "workspace_identity_changed"]>;
+/**
+ * The stable code of a {@link FileSystemFault}.
+ *
+ * @since 1.0.0-rc.0
+ * @category models
+ */
+export type FileSystemFaultCode = typeof FileSystemFaultCode.Type;
+declare const FileSystemFault_base: Schema.Class<FileSystemFault, Schema.TaggedStruct<"@smthrs/kernel/FileSystemFault", {
+    readonly code: Schema.Literals<readonly ["executor_already_present", "isolated_operation_unsupported", "workspace_identity_changed"]>;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A broken filesystem composition or a workspace whose descriptor identity
+ * changed. `withIsolatedFileSystem` throws `executor_already_present`; an
+ * attested volume reaching an operation it never advertises dies with
+ * `isolated_operation_unsupported` (a bug); a batch whose root no longer names
+ * the authorized descriptor is the `cause` of a `Busy` `PlatformError` with
+ * `workspace_identity_changed`.
+ *
+ * @since 1.0.0-rc.0
+ * @category errors
+ */
+export declare class FileSystemFault extends FileSystemFault_base {
+    readonly name = "FileSystemFault";
+}
+/**
+ * Attests that a host filesystem is already isolated as a whole. Intended for
+ * browser/test volumes whose implementation cannot address the host
+ * filesystem at all; native path-based adapters must not use this shortcut.
+ *
+ * The attestation is refused for a filesystem that already carries a
+ * descriptor-relative executor. That executor is the stronger guarantee, and
+ * replacing it with a path-delegating one would route `access`, `copy`,
+ * `chmod`, `link`, `symlink`, `open`, `watch`, `sink`, `stream`, and every
+ * `makeTemp*` back through pathnames after the capability check: the exact
+ * symlink-swap window this module exists to close. The refusal is a throw at
+ * composition time, so a host cannot be assembled that way.
+ *
+ * @since 1.0.0-rc.0
+ * @category security
+ */
+export declare const withIsolatedFileSystem: (fileSystem: EffectFileSystem.FileSystem) => AtomicHostFileSystem;
+/**
+ * Whether {@link confined} can build a view over this filesystem: it carries a
+ * descriptor-relative executor, or a whole-filesystem isolation attestation.
+ * A plain path-based host answers `false`.
+ *
+ * @since 1.0.0-rc.1
+ * @category security
+ */
+export declare const isConfinable: (fileSystem: EffectFileSystem.FileSystem) => boolean;
+/**
+ * The logical root a filesystem is already confined to: a {@link confined}
+ * view's pinned root, or the guarded {@link layer} service's workspace root.
+ * `undefined` for any other filesystem, including a host that is merely
+ * confinable. Machinery that shares a filesystem with its caller confines to
+ * this root, so its paths resolve exactly where the caller's do.
+ *
+ * @since 1.0.0-rc.1
+ * @category security
+ */
+export declare const confinedRoot: (fileSystem: EffectFileSystem.FileSystem) => string | undefined;
+/**
+ * Fails with the typed `PermissionDenied` refusal unless {@link confined} can
+ * build a view over this filesystem. Composition-time check for layers that
+ * pin their root later, when it is known to exist.
+ *
+ * @since 1.0.0-rc.1
+ * @category security
+ */
+export declare const requireConfinable: (fileSystem: EffectFileSystem.FileSystem, root: string) => Effect.Effect<void, PlatformError.PlatformError>;
+/**
+ * A filesystem view confined to `root` without capability checks: engine
+ * machinery that must not ask a grant store for its own bookkeeping, but must
+ * still never be redirected outside the workspace.
+ *
+ * Every operation is one descriptor-relative request against the root pinned
+ * here (its canonical path and `device:inode` identity), resolved by the host
+ * helper with `O_NOFOLLOW` at each component, so there is no window between a
+ * check and a write for a symlink to be swapped into. A symlink anywhere on the
+ * path, a hard-linked file, `..` traversal, or a root whose identity changed is
+ * refused by the host, never followed. The requests are exactly the ones the
+ * guarded {@link layer} sends, minus the grant check.
+ *
+ * A host carrying a whole-filesystem isolation attestation
+ * ({@link withIsolatedFileSystem}) is returned as it is: its attestation is
+ * the boundary. So is the guarded {@link layer}'s own service when it is
+ * rooted at the same workspace, since each of its path operations is already
+ * one such request. A plain path-based host is refused with `PermissionDenied`, so
+ * there is no path-based fallback that claims confinement. Operations that
+ * cannot be expressed as one atomic request (`open`, `stream`, `sink`, `copy`,
+ * `link`, `symlink`, `watch`, `truncate`, `utimes`, `access`, and every
+ * `makeTemp*`) fail with the same refusal.
+ *
+ * The root must exist when the view is built.
+ *
+ * @since 1.0.0-rc.1
+ * @category security
+ */
+export declare const confined: (fileSystem: EffectFileSystem.FileSystem, root: string) => Effect.Effect<EffectFileSystem.FileSystem, PlatformError.PlatformError, EffectPath.Path>;
+/**
+ * Resolves a path through every existing ancestor and maps paths inside the
+ * canonical workspace back to the stable logical workspace root. Existing
+ * symlinks therefore cannot turn an inside-workspace grant into outside
+ * authority, while capability resources remain stable when the root itself is
+ * a symlink. The host's `realPath` must return the on-disk spelling of existing
+ * components, including on case-insensitive volumes. Native Node hosts use
+ * the promise-based `realpath`, which uses the native implementation.
+ *
+ * @category security
+ * @since 1.0.0-rc.0
+ */
+export declare const canonicalResource: (fileSystem: EffectFileSystem.FileSystem, path: EffectPath.Path, workspaceRoot: string, value: string) => Effect.Effect<string, PlatformError.PlatformError>;
+/**
+ * Decorates Effect's filesystem service in place with workspace-normalized
+ * capability checks. Every host resolves canonical path spelling before the
+ * capability check and again after every grant decision. Descriptor-relative
+ * executors enforce hard-link refusal themselves; other hosts also run the
+ * hard-link guard here. A decision can
+ * suspend (an attended request, a journal-backed store), and an operation
+ * whose path no longer names the resource that was authorized is refused
+ * rather than performed. Open file handles bind their authorization to the
+ * `device:inode` identity fstat'd at open time and refuse any operation once
+ * the authorized path names a different resource.
+ *
+ * The layer provides the tag it also requires: compose it over a host
+ * filesystem layer with `Layer.provide` and every consumer of
+ * `FileSystem.FileSystem` — including one that never heard of the kernel —
+ * resolves the guarded implementation. A denied request surfaces as a
+ * `PlatformError` whose reason is `PermissionDenied` and whose `cause` is the
+ * kernel's own `PermissionRequired`, `PermissionDenied`, or `GrantStoreError`;
+ * `Permission.fromPlatformError` reads it back.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layer: Layer.Layer<EffectFileSystem.FileSystem, PlatformError.PlatformError, EffectFileSystem.FileSystem | EffectPath.Path | Workspace | GrantStore>;
+//# sourceMappingURL=FileSystem.d.ts.map

package/dist/cjs/FileSystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FileSystem.d.ts","sourceRoot":"","sources":["../../src/FileSystem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EACL,MAAM,EAEN,UAAU,IAAI,gBAAgB,EAC9B,KAAK,EAEL,IAAI,IAAI,UAAU,EAClB,aAAa,EACb,MAAM,EACN,MAAM,EAGP,MAAM,QAAQ,CAAA;AACf,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,cAAc,sBAAsB,CAAA;AAEpC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,kBAAkB,CAAA;AAE3D;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,eAAgD,CAAA;AAEnF;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3C;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GACrB,CAAC,UAAU,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GACtE,CAAC,UAAU,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,GAClH,CAAC,UAAU,GAAG;IACd,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CACjE,CAAC,GACA,CAAC,UAAU,GAAG;IACd,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAA;CACxF,CAAC,GACA,CAAC,UAAU,GAAG;IACd,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAA;CAChH,CAAC,GACA,CAAC,UAAU,GAAG;IACd,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAA;CAC5E,CAAC,GACA,CAAC,UAAU,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GACxE,CAAC,UAAU,GAAG;IACd,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACvC,CAAC,GACA,CAAC,UAAU,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GACxE,CAAC,UAAU,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GACxE,CAAC,UAAU,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GACvE,CAAC,UAAU,GAAG;IACd,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAA;CAClH,CAAC,GACA,CAAC,UAAU,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3F,CAAC,UAAU,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GACpE,CAAC,UAAU,GAAG;IACd,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EACb;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,QAAQ,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAC7F,SAAS,CAAA;CACd,CAAC,GACA,CAAC,UAAU,GAAG;IACd,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EACb;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,QAAQ,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAC7F,SAAS,CAAA;CACd,CAAC,GACA,CAAC,UAAU,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE,CAAC,CAAA;AAExG;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,KAAK,CAAC,YAAY,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9G;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAAE,CAAA;AAEpH;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;KAC9E,CAAC,CAAA;CACH;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAA;CACpC;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;AAEjF;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,CAAC,IAAI,MAAM,aAAa,GAAG,CACnC,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;KAAE,CAAC,KACvD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC;CAClE,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;IACjD,qFAAqF;IACrF,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC,GAAG,SAAS,CAAA;IAC1G,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,aAAa,EACxC,OAAO,EAAE,CAAC,KACP,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;IAChE;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,UAAU,GAAG,SAAS,CAAA;IAC3D,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAA;IACvF;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3C;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,UAAU,GAAG;IAC/D,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAA;CACpD,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAC/B,YAAY,gBAAgB,CAAC,UAAU,EACvC,QAAQ,gBAAgB,KACvB,oBAAuF,CAAA;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,wHAI9B,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;;;;;AAEjE;;;;;;;;;;GAUG;AACH,qBAAa,eAAgB,SAAQ,oBAGnC;IACA,SAAkB,IAAI,qBAAoB;CAC3C;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GACjC,YAAY,gBAAgB,CAAC,UAAU,KACtC,oBAuCF,CAAA;AA8ED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,YAAY,gBAAgB,CAAC,UAAU,KAAG,OACS,CAAA;AAEhF;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,GAAI,YAAY,gBAAgB,CAAC,UAAU,KAAG,MAAM,GAAG,SACY,CAAA;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC5B,YAAY,gBAAgB,CAAC,UAAU,EACvC,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,aAAa,CACkC,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,QAAQ,GACnB,YAAY,gBAAgB,CAAC,UAAU,EACvC,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,CA6FtF,CAAA;AAwCJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC5B,YAAY,gBAAgB,CAAC,UAAU,EACvC,MAAM,UAAU,CAAC,IAAI,EACrB,eAAe,MAAM,EACrB,OAAO,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,CA6CnD,CAAA;AAoID;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAC7B,gBAAgB,CAAC,UAAU,EAC3B,aAAa,CAAC,aAAa,EAC3B,gBAAgB,CAAC,UAAU,GAAG,UAAU,CAAC,IAAI,GAAG,SAAS,GAAG,UAAU,CAkvBvE,CAAA"}