@stratum-hq/mysql 0.4.0 → 0.6.0

package/dist/integrations/sequelize.js

@@ -1,29 +1,420 @@
 "use strict";
-// ─── Structural types (no hard dependency on sequelize) ───
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.withMysqlTenantScope = withMysqlTenantScope;
+const node_async_hooks_1 = require("node:async_hooks");
+const utils_js_1 = require("../utils.js");
+const REFUSED = "Stratum: withMysqlTenantScope";
+/** The tenant scope of the running withMysqlTenantScope callback. */
+const scopeStorage = new node_async_hooks_1.AsyncLocalStorage();
+/** True inside a model call that tenant scoping has already handled (but not inside its hooks). */
+const scopedCall = new node_async_hooks_1.AsyncLocalStorage();
 /**
- * Runs fn inside a session-variable scope for MySQL tenant isolation.
- * Sets @stratum_tenant_id inside a Sequelize transaction and clears it in a
- * finally block, even if fn throws.
+ * The model method whose own options the next top-level _injectScope call
+ * scopes, and whether that method requires a where clause (update, destroy,
+ * increment), in which case a missing where is left for Sequelize to refuse.
+ */
+const topLevelCall = new node_async_hooks_1.AsyncLocalStorage();
+const PATCHED = Symbol("stratum.sequelizeTenantScope");
+const guardedInstances = new WeakSet();
+/**
+ * Runs fn with the tenant's rows scoped for Sequelize models, inside a
+ * transaction that also sets the @stratum_tenant_id session variable.
+ *
+ * Inside fn, for every model with a tenant_id attribute:
+ * - findAll, findOne, findByPk, findAndCountAll, count, sum, min, max and
+ *   reload() see only the tenant's rows, and every include of a tenant model
+ *   (including those that scopes and hooks add) is filtered in its join
+ *   condition, so a non-required include keeps the parent;
+ * - update, destroy, restore and increment/decrement change only the tenant's
+ *   rows; updates never write tenant_id (by attribute or column name), and
+ *   increment/decrement of tenant_id is refused. update, destroy and increment
+ *   without a where clause are still refused by Sequelize;
+ * - create, save of a new instance and bulkCreate write the tenant's tenant_id;
+ * - save, destroy and restore of an instance whose row belongs to another
+ *   tenant, or of a model without a primary key, throw;
+ * - upsert, bulkCreate with updateOnDuplicate, truncate, and `or` / `right`
+ *   on an include of a tenant model are refused, and a query that carries a
+ *   tenant model but bypasses these methods throws, also inside model hooks;
+ * - right before each query the tenant condition is checked again, so a query
+ *   whose condition a hook removed is refused.
+ * Hooks passed `hooks: false` do not skip the filter. Raw `sequelize.query()`
+ * and models without a tenant_id attribute are not scoped. Outside fn,
+ * Sequelize behaves as usual.
  *
- * The variable exists only on the transaction's connection. fn receives that
- * transaction as its second argument, and every query inside fn must pass it
- * (`{ transaction }`); a query without it runs on another pooled connection
- * where the variable is not set.
+ * The session variable exists only on the transaction's connection. fn
+ * receives that transaction as its second argument; pass it to queries that
+ * must run in the transaction.
+ *
+ * @throws Error when sequelize is not a Sequelize v6 instance, because the
+ *   tenant scope could not be applied.
  */
 async function withMysqlTenantScope(sequelize, tenantId, fn) {
+    (0, utils_js_1.assertTenantId)(tenantId);
+    installTenantScoping(sequelize);
     return sequelize.transaction(async (transaction) => {
         await sequelize.query("SET @stratum_tenant_id = ?", {
             replacements: [tenantId],
             transaction,
         });
         try {
-            return await fn(sequelize, transaction);
+            return await scopeStorage.run({ sequelize, tenantId }, () => fn(sequelize, transaction));
         }
         finally {
             await sequelize.query("SET @stratum_tenant_id = NULL", { transaction });
         }
     });
 }
+/** Patches Sequelize's Model class once and guards this instance's queries. */
+function installTenantScoping(sequelize) {
+    const candidate = sequelize;
+    const Model = candidate.constructor?.Model;
+    const Op = candidate.constructor?.Op;
+    if (typeof Model !== "function" || !Op || typeof candidate.addHook !== "function") {
+        throw new Error(`${REFUSED} needs a Sequelize v6 instance, because it scopes the tenant's rows through Sequelize's models.`);
+    }
+    const statics = Model;
+    if (!statics[PATCHED]) {
+        patchModel(statics, Op.and);
+        statics[PATCHED] = true;
+    }
+    if (!guardedInstances.has(sequelize)) {
+        // Any model query that did not go through the scoped methods is refused.
+        candidate.addHook("beforeQuery", (options) => {
+            const scope = scopeStorage.getStore();
+            if (!scope || scope.sequelize !== sequelize || scopedCall.getStore())
+                return;
+            const instance = options.instance;
+            const model = options.model ?? instance?.constructor;
+            if (model && tenantAttribute(model)) {
+                throw new Error(`${REFUSED}: this query on a tenant model is not tenant-scoped and was refused.`);
+            }
+        });
+        guardQueryInterface(candidate, Op.and);
+        guardedInstances.add(sequelize);
+    }
+}
+/**
+ * Checks the statements that Sequelize's query interface is about to build for
+ * a tenant model inside the callback. Hooks run after the tenant condition is
+ * added and can replace a where clause or add includes, so the condition is
+ * verified here, right before the query, and the query is refused when it is
+ * missing. Values written to tenant_id (by attribute or column name, in any
+ * letter case) are dropped from updates and replaced on inserts.
+ */
+function guardQueryInterface(sequelize, and) {
+    const queryInterface = sequelize.getQueryInterface();
+    const active = (model) => {
+        const scope = scopeStorage.getStore();
+        if (!model || !scope || scope.sequelize !== sequelize || !tenantAttribute(model))
+            return undefined;
+        return scope.tenantId;
+    };
+    const hasTenantCondition = (where, names, tenantId) => {
+        if (!where || typeof where !== "object")
+            return false;
+        if (Array.isArray(where))
+            return where.some((part) => hasTenantCondition(part, names, tenantId));
+        const record = where;
+        if (Object.keys(record).some((key) => names.has(key.toLowerCase()) && record[key] === tenantId))
+            return true;
+        // Only AND positions count; a condition under OR does not scope the query.
+        return record[and] !== undefined && hasTenantCondition(record[and], names, tenantId);
+    };
+    const requireTenantCondition = (model, where, tenantId) => {
+        if (!hasTenantCondition(where, tenantNames(model), tenantId)) {
+            throw new Error(`${REFUSED}: this query is not tenant-scoped, because its tenant condition is missing ` +
+                "(a hook may have replaced the where clause or added an include), and was refused.");
+        }
+    };
+    const checkIncludes = (include, tenantId) => {
+        for (const item of Array.isArray(include) ? include : include ? [include] : []) {
+            const entry = item;
+            const model = entry.model;
+            if (!entry._pseudo && model && tenantAttribute(model)) {
+                if (entry.or || entry.right) {
+                    throw new Error(`${REFUSED}: "or" and "right" are refused on an include of a tenant model.`);
+                }
+                requireTenantCondition(model, entry.where, tenantId);
+            }
+            checkIncludes(entry.include, tenantId);
+        }
+    };
+    const withoutTenantKeys = (model, values) => {
+        const names = tenantNames(model);
+        return Object.fromEntries(Object.entries(values ?? {}).filter(([key]) => !names.has(key.toLowerCase())));
+    };
+    const withTenantValue = (model, values, tenantId) => ({
+        ...withoutTenantKeys(model, values),
+        [tenantField(model)]: tenantId,
+    });
+    const wrap = (name, check) => {
+        const original = queryInterface[name];
+        queryInterface[name] = function (...args) {
+            try {
+                check(args);
+            }
+            catch (error) {
+                return Promise.reject(error);
+            }
+            return original.apply(this, args);
+        };
+    };
+    wrap("select", (args) => {
+        const model = args[0];
+        const options = args[2];
+        const tenantId = active(model);
+        if (tenantId)
+            requireTenantCondition(model, options.where, tenantId);
+        const scope = scopeStorage.getStore();
+        if (scope && scope.sequelize === sequelize)
+            checkIncludes(options.include, scope.tenantId);
+    });
+    wrap("rawSelect", (args) => {
+        const options = args[1];
+        const model = args[3];
+        const tenantId = active(model);
+        if (tenantId)
+            requireTenantCondition(model, options.where, tenantId);
+        const scope = scopeStorage.getStore();
+        if (scope && scope.sequelize === sequelize)
+            checkIncludes(options.include, scope.tenantId);
+    });
+    wrap("bulkUpdate", (args) => {
+        const model = args[3]?.model;
+        const tenantId = active(model);
+        if (!tenantId)
+            return;
+        requireTenantCondition(model, args[2], tenantId);
+        args[1] = withoutTenantKeys(model, args[1]);
+    });
+    wrap("bulkDelete", (args) => {
+        const model = args[3];
+        const tenantId = active(model);
+        if (tenantId)
+            requireTenantCondition(model, args[1], tenantId);
+    });
+    for (const name of ["increment", "decrement"]) {
+        wrap(name, (args) => {
+            const model = args[0];
+            const tenantId = active(model);
+            if (!tenantId)
+                return;
+            const names = tenantNames(model);
+            const touched = [...Object.keys(args[3] ?? {}), ...Object.keys(args[4] ?? {})];
+            if (touched.some((key) => names.has(key.toLowerCase()))) {
+                throw new Error(`${REFUSED}: increment or decrement of tenant_id is refused.`);
+            }
+            requireTenantCondition(model, args[2], tenantId);
+        });
+    }
+    wrap("update", (args) => {
+        const model = args[0].constructor;
+        if (active(model))
+            args[2] = withoutTenantKeys(model, args[2]);
+    });
+    wrap("insert", (args) => {
+        const model = args[0]?.constructor;
+        const tenantId = active(model);
+        if (tenantId)
+            args[2] = withTenantValue(model, args[2], tenantId);
+    });
+    wrap("bulkInsert", (args) => {
+        const model = args[2]?.model;
+        const tenantId = active(model);
+        if (tenantId) {
+            args[1] = args[1].map((record) => withTenantValue(model, record, tenantId));
+        }
+    });
+}
+/** The tenant attribute's name and column name, lower-cased. */
+function tenantNames(model) {
+    const attribute = tenantAttribute(model);
+    if (!attribute)
+        return new Set();
+    return new Set([attribute.toLowerCase(), tenantField(model).toLowerCase()]);
+}
+/** The column name of the tenant attribute. */
+function tenantField(model) {
+    const attribute = tenantAttribute(model);
+    return model.rawAttributes?.[attribute]?.field ?? attribute;
+}
+/** Returns the attribute that maps to the tenant_id column, if the model has one. */
+function tenantAttribute(model) {
+    for (const [name, attribute] of Object.entries(model.rawAttributes ?? {})) {
+        if ((attribute.field ?? name).toLowerCase() === "tenant_id")
+            return name;
+    }
+    return undefined;
+}
+/** Returns the running scope when it belongs to this model's Sequelize instance. */
+function scopeFor(model) {
+    const scope = scopeStorage.getStore();
+    return scope && scope.sequelize === model.sequelize ? scope : undefined;
+}
+function patchModel(Model, and) {
+    const withTenant = (where, attribute, tenantId) => where === undefined || where === null
+        ? { [attribute]: tenantId }
+        : { [and]: [where, { [attribute]: tenantId }] };
+    // Sequelize merges scopes into a call's options, and into each include, in
+    // _injectScope. The tenant condition is added after that merge, so scope
+    // includes, scope where clauses and includes added by hooks are all covered.
+    const originalInject = Model._injectScope;
+    Model._injectScope = function (options) {
+        const result = originalInject.call(this, options);
+        const active = scopeFor(this);
+        const attribute = tenantAttribute(this);
+        if (!active || !attribute)
+            return result;
+        if (options.association !== undefined) {
+            // An include being validated (_validateIncludedElement).
+            if (options.or || options.right) {
+                throw new Error(`${REFUSED}: "or" and "right" are refused on an include of a tenant model.`);
+            }
+            // An include with a where clause defaults to required; keep the
+            // caller's join type so a LEFT JOIN still returns the parent row.
+            if (options.required === undefined)
+                options.required = !!options.where;
+            options.where = withTenant(options.where, attribute, active.tenantId);
+            return result;
+        }
+        const call = topLevelCall.getStore();
+        if (call?.model === this && call.requiresWhere && (options.where === undefined || options.where === null)) {
+            return result;
+        }
+        options.where = withTenant(options.where, attribute, active.tenantId);
+        return result;
+    };
+    // Model hooks run user code; the beforeQuery guard applies there again.
+    const originalRunHooks = Model.runHooks;
+    Model.runHooks = function (...args) {
+        return scopedCall.run(false, () => originalRunHooks.apply(this, args));
+    };
+    const wrapStatic = (name, requiresWhere, scope) => {
+        const original = Model[name];
+        Model[name] = function (...args) {
+            const active = scopeFor(this);
+            if (!active)
+                return original.apply(this, args);
+            const scopedArgs = scope(this, args, active.tenantId);
+            const run = () => scopedCall.run(true, () => original.apply(this, scopedArgs));
+            return requiresWhere === undefined ? run() : topLevelCall.run({ model: this, requiresWhere }, run);
+        };
+    };
+    const unchanged = (_model, args) => args;
+    const refuseForTenantModel = (what) => (model, args) => {
+        if (tenantAttribute(model))
+            throw new Error(`${REFUSED}: ${what} on a tenant model is refused.`);
+        return args;
+    };
+    wrapStatic("findAll", false, unchanged);
+    wrapStatic("aggregate", false, unchanged);
+    wrapStatic("increment", true, unchanged);
+    wrapStatic("update", true, (model, [values, options]) => {
+        // Drop tenant_id by attribute or column name, in any letter case.
+        const names = tenantNames(model);
+        const isTenantKey = (key) => typeof key === "string" && names.has(key.toLowerCase());
+        const scopedValues = Object.fromEntries(Object.entries(values ?? {}).filter(([key]) => !isTenantKey(key)));
+        const scopedOptions = { ...(options ?? {}) };
+        if (Array.isArray(scopedOptions.fields))
+            scopedOptions.fields = scopedOptions.fields.filter((f) => !isTenantKey(f));
+        return [scopedValues, scopedOptions];
+    });
+    wrapStatic("destroy", true, (model, args) => {
+        if (tenantAttribute(model) && args[0]?.truncate) {
+            throw new Error(`${REFUSED}: truncate on a tenant model is refused, because it removes every tenant's rows.`);
+        }
+        return args;
+    });
+    // restore() does not go through _injectScope; Sequelize does not require a
+    // where clause for it, so the tenant condition is always added.
+    wrapStatic("restore", undefined, (model, [options], tenantId) => {
+        const attribute = tenantAttribute(model);
+        const scoped = { ...(options ?? {}) };
+        if (attribute)
+            scoped.where = withTenant(scoped.where, attribute, tenantId);
+        return [scoped];
+    });
+    wrapStatic("upsert", undefined, refuseForTenantModel("upsert"));
+    wrapStatic("bulkCreate", undefined, (model, [records, options], tenantId) => {
+        const attribute = tenantAttribute(model);
+        if (!attribute)
+            return [records, options];
+        const scopedOptions = { ...(options ?? {}) };
+        if (scopedOptions.updateOnDuplicate) {
+            throw new Error(`${REFUSED}: bulkCreate with updateOnDuplicate on a tenant model is refused.`);
+        }
+        if (Array.isArray(scopedOptions.fields) && !scopedOptions.fields.includes(attribute)) {
+            scopedOptions.fields = [...scopedOptions.fields, attribute];
+        }
+        const scopedRecords = records.map((record) => {
+            if (record instanceof Model) {
+                record.setDataValue(attribute, tenantId);
+                return record;
+            }
+            return { ...record, [attribute]: tenantId };
+        });
+        return [scopedRecords, scopedOptions];
+    });
+    const proto = Model.prototype;
+    const wrapInstance = (name) => {
+        const original = proto[name];
+        proto[name] = async function (...args) {
+            const model = this.constructor;
+            const active = scopeFor(model);
+            const attribute = tenantAttribute(model);
+            if (!active || !attribute)
+                return original.apply(this, args);
+            const options = { ...(args[0] ?? {}) };
+            const names = tenantNames(model);
+            const isTenantKey = (key) => typeof key === "string" && names.has(key.toLowerCase());
+            if (name === "save" && this.isNewRecord) {
+                if (Array.isArray(options.fields) && !options.fields.includes(attribute)) {
+                    options.fields = [...options.fields, attribute];
+                }
+            }
+            else {
+                await assertRowOfTenant(this, attribute, active.tenantId, options.transaction);
+                // An existing row keeps its tenant: tenant_id is not written.
+                if (name === "save" && Array.isArray(options.fields)) {
+                    options.fields = options.fields.filter((f) => !isTenantKey(f));
+                }
+            }
+            if (name === "save")
+                this.setDataValue(attribute, active.tenantId);
+            return scopedCall.run(true, () => original.apply(this, [options, ...args.slice(1)]));
+        };
+    };
+    wrapInstance("save");
+    wrapInstance("destroy");
+    wrapInstance("restore");
+}
+/**
+ * Throws when the row that an instance's primary key identifies belongs to
+ * another tenant. The lookup is raw SQL, so it is not tenant-scoped, and its
+ * result is used only for this decision.
+ */
+async function assertRowOfTenant(instance, attribute, tenantId, transaction) {
+    const model = instance.constructor;
+    const sequelize = model.sequelize;
+    // Without a primary key, Sequelize identifies the row by the where clause
+    // of the query that loaded it, which cannot be checked here.
+    const key = (model.primaryKeyAttributes ?? []).length > 0 ? instance.where() : null;
+    const columns = key && typeof key === "object" ? Object.keys(key) : [];
+    if (!key || columns.length === 0) {
+        throw new Error(`${REFUSED}: the row's tenant cannot be checked, because the model has no primary key.`);
+    }
+    const tenantColumn = model.rawAttributes?.[attribute]?.field ?? attribute;
+    const sql = `SELECT ${(0, utils_js_1.escapeIdentifier)(tenantColumn)} AS tenant_id ` +
+        `FROM ${sequelize.getQueryInterface().queryGenerator.quoteTable(model.getTableName())} ` +
+        `WHERE ${columns.map((column) => `${(0, utils_js_1.escapeIdentifier)(column)} = ?`).join(" AND ")} LIMIT 1`;
+    const rows = (await sequelize.query(sql, {
+        replacements: columns.map((column) => key[column]),
+        transaction,
+        type: "SELECT",
+        raw: true,
+    }));
+    if (rows.length > 0 && rows[0].tenant_id !== tenantId) {
+        throw new Error(`${REFUSED}: the row belongs to another tenant.`);
+    }
+}
 //# sourceMappingURL=sequelize.js.map

package/dist/integrations/sequelize.js.map

@@ -1 +1 @@
-{"version":3,"file":"sequelize.js","sourceRoot":"","sources":["../../src/integrations/sequelize.ts"],"names":[],"mappings":";AAAA,6DAA6D;;AAiB7D,oDAgBC;AA1BD;;;;;;;;;GASG;AACI,KAAK,UAAU,oBAAoB,CACxC,SAAwB,EACxB,QAAgB,EAChB,EAAkE;IAElE,OAAO,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;QACjD,MAAM,SAAS,CAAC,KAAK,CAAC,4BAA4B,EAAE;YAClD,YAAY,EAAE,CAAC,QAAQ,CAAC;YACxB,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sequelize.js","sourceRoot":"","sources":["../../src/integrations/sequelize.ts"],"names":[],"mappings":";;AAuFA,oDAkBC;AAzGD,uDAAqD;AACrD,0CAA+D;AAwC/D,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAChD,qEAAqE;AACrE,MAAM,YAAY,GAAG,IAAI,oCAAiB,EAAS,CAAC;AACpD,mGAAmG;AACnG,MAAM,UAAU,GAAG,IAAI,oCAAiB,EAAW,CAAC;AACpD;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,oCAAiB,EAAqD,CAAC;AAChG,MAAM,OAAO,GAAG,MAAM,CAAC,8BAA8B,CAAC,CAAC;AACvD,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAU,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACI,KAAK,UAAU,oBAAoB,CACxC,SAAwB,EACxB,QAAgB,EAChB,EAAkE;IAElE,IAAA,yBAAc,EAAC,QAAQ,CAAC,CAAC;IACzB,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;QACjD,MAAM,SAAS,CAAC,KAAK,CAAC,4BAA4B,EAAE;YAClD,YAAY,EAAE,CAAC,QAAQ,CAAC;YACxB,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QAC3F,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,SAAS,oBAAoB,CAAC,SAAwB;IACpD,MAAM,SAAS,GAAG,SAA8B,CAAC;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC;IAC3C,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,CAAC,EAAE,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,iGAAiG,CAC5G,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAgD,CAAC;IACjE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,yEAAyE;QACzE,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,OAAgB,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,EAAE;gBAAE,OAAO;YAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAyC,CAAC;YACnE,MAAM,KAAK,GAAI,OAAO,CAAC,KAAoC,IAAI,QAAQ,EAAE,WAAW,CAAC;YACrF,IAAI,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,sEAAsE,CAAC,CAAC;YACpG,CAAC;QACH,CAAC,CAAC,CAAC;QACH,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACvC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,SAA4B,EAAE,GAAW;IACpE,MAAM,cAAc,GAAG,SAAS,CAAC,iBAAiB,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,KAAiC,EAAsB,EAAE;QACvE,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACnG,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAE,KAAkB,EAAE,QAAgB,EAAW,EAAE;QAC3F,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,KAAgB,CAAC;QAChC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7G,2EAA2E;QAC3E,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvF,CAAC,CAAC;IACF,MAAM,sBAAsB,GAAG,CAAC,KAAqB,EAAE,KAAc,EAAE,QAAgB,EAAE,EAAE;QACzF,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,6EAA6E;gBACrF,mFAAmF,CACtF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAE,QAAgB,EAAQ,EAAE;QACjE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC/E,MAAM,KAAK,GAAG,IAAe,CAAC;YAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAmC,CAAC;YACxD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,iEAAiE,CAAC,CAAC;gBAC/F,CAAC;gBACD,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvD,CAAC;YACD,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,iBAAiB,GAAG,CAAC,KAAqB,EAAE,MAAe,EAAW,EAAE;QAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAE,MAA8B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CACvG,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,CAAC,KAAqB,EAAE,MAAe,EAAE,QAAgB,EAAW,EAAE,CAAC,CAAC;QAC9F,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC;QACnC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ;KAC/B,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,KAAgC,EAAE,EAAE;QAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAgB,CAAC;QACrD,cAAc,CAAC,IAAI,CAAC,GAAG,UAAyB,GAAG,IAAe;YAChE,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAmB,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAY,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,QAAQ;YAAE,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAY,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAA+B,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,QAAQ;YAAE,sBAAsB,CAAC,KAAuB,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAI,IAAI,CAAC,CAAC,CAAyB,EAAE,KAAmC,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,sBAAsB,CAAC,KAAuB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,KAAuB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAA+B,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,QAAQ;YAAE,sBAAsB,CAAC,KAAuB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAmB,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ;gBAAE,OAAO;YACtB,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAE,IAAI,CAAC,CAAC,CAAa,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAE,IAAI,CAAC,CAAC,CAAa,IAAI,EAAE,CAAC,CAAC,CAAC;YACzG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,mDAAmD,CAAC,CAAC;YACjF,CAAC;YACD,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;QACtB,MAAM,KAAK,GAAI,IAAI,CAAC,CAAC,CAAuB,CAAC,WAAW,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;QACtB,MAAM,KAAK,GAAI,IAAI,CAAC,CAAC,CAA8B,EAAE,WAAW,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,QAAQ;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,KAAuB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAI,IAAI,CAAC,CAAC,CAAyB,EAAE,KAAmC,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,CAAC,GAAI,IAAI,CAAC,CAAC,CAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,KAAuB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,SAAS,WAAW,CAAC,KAAqB;IACxC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACjC,OAAO,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,+CAA+C;AAC/C,SAAS,WAAW,CAAC,KAAqB;IACxC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAW,CAAC;IACnD,OAAO,KAAK,CAAC,aAAa,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,SAAS,CAAC;AAC9D,CAAC;AAED,qFAAqF;AACrF,SAAS,eAAe,CAAC,KAAqB;IAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oFAAoF;AACpF,SAAS,QAAQ,CAAC,KAAqB;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IACtC,OAAO,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,KAAmC,EAAE,GAAW;IAClE,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,SAAiB,EAAE,QAAgB,EAAW,EAAE,CAClF,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QACnC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE;QAC3B,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAEpD,2EAA2E;IAC3E,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,cAAc,GAAG,KAAK,CAAC,YAA2B,CAAC;IACzD,KAAK,CAAC,YAAY,GAAG,UAAgC,OAAgB;QACnE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,OAAO,MAAM,CAAC;QACzC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,yDAAyD;YACzD,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,iEAAiE,CAAC,CAAC;YAC/F,CAAC;YACD,gEAAgE;YAChE,kEAAkE;YAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YACvE,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1G,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,wEAAwE;IACxE,MAAM,gBAAgB,GAAG,KAAK,CAAC,QAAuB,CAAC;IACvD,KAAK,CAAC,QAAQ,GAAG,UAAyB,GAAG,IAAe;QAC1D,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CACjB,IAAY,EACZ,aAAkC,EAClC,KAA8E,EAC9E,EAAE;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAgB,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,UAAgC,GAAG,IAAe;YAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;YAC/E,OAAO,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;QACrG,CAAC,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAsB,EAAE,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC;IACpE,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,KAAqB,EAAE,IAAe,EAAE,EAAE;QACxF,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,KAAK,IAAI,gCAAgC,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACxC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1C,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACzC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE;QACtD,kEAAkE;QAClE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9F,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAE,MAAkB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxH,MAAM,aAAa,GAAY,EAAE,GAAG,CAAE,OAA+B,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/E,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC;YAAE,aAAa,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACpH,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC1C,IAAI,eAAe,CAAC,KAAK,CAAC,IAAK,IAAI,CAAC,CAAC,CAAyB,EAAE,QAAQ,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,kFAAkF,CAAC,CAAC;QAChH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,2EAA2E;IAC3E,gEAAgE;IAChE,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE;QAC9D,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,MAAM,GAAY,EAAE,GAAG,CAAE,OAA+B,IAAI,EAAE,CAAC,EAAE,CAAC;QACxE,IAAI,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5E,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChE,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE;QAC1E,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,aAAa,GAAY,EAAE,GAAG,CAAE,OAA+B,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/E,IAAI,aAAa,CAAC,iBAAiB,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,mEAAmE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,aAAa,CAAC,MAAM,GAAG,CAAC,GAAI,aAAa,CAAC,MAAmB,EAAE,SAAS,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,aAAa,GAAI,OAAqB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAC1D,IAAI,MAAM,YAAa,KAAqC,EAAE,CAAC;gBAC5D,MAA4B,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAChE,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,EAAE,GAAI,MAAkB,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,KAAK,CAAC,SAAyC,CAAC;IAC9D,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAgB,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,WAAoC,GAAG,IAAe;YACvE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;YAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,EAAE,GAAG,CAAE,IAAI,CAAC,CAAC,CAAyB,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9F,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACxC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBACzE,OAAO,CAAC,MAAM,GAAG,CAAC,GAAI,OAAO,CAAC,MAAmB,EAAE,SAAS,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBAC/E,8DAA8D;gBAC9D,IAAI,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrD,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;YACD,IAAI,IAAI,KAAK,MAAM;gBAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnE,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC,CAAC;IACJ,CAAC,CAAC;IACF,YAAY,CAAC,MAAM,CAAC,CAAC;IACrB,YAAY,CAAC,SAAS,CAAC,CAAC;IACxB,YAAY,CAAC,SAAS,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,QAA2B,EAC3B,SAAiB,EACjB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC;IACnC,MAAM,SAAS,GAAG,KAAK,CAAC,SAA8B,CAAC;IACvD,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,MAAM,OAAO,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,6EAA6E,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,SAAS,CAAC;IAC1E,MAAM,GAAG,GACP,UAAU,IAAA,2BAAgB,EAAC,YAAY,CAAC,gBAAgB;QACxD,QAAQ,SAAS,CAAC,iBAAiB,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,GAAG;QACxF,SAAS,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAA,2BAAgB,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;IAC9F,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE;QACvC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,IAAI;KACV,CAAC,CAA6B,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,sCAAsC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC"}

package/dist/integrations/typeorm-subscriber.d.ts

@@ -1,5 +1,33 @@
+/** The part of a TypeORM column's metadata that tenant scoping uses. */
+interface ColumnLike {
+    propertyName: string;
+    databaseName: string;
+    getEntityValue?(entity: Record<string, unknown>): unknown;
+    setEntityValue?(entity: Record<string, unknown>, value: unknown): void;
+}
+/** The part of a TypeORM entity's metadata that tenant scoping uses. */
+/** The part of a TypeORM relation's metadata that tenant scoping uses. */
+interface RelationLike {
+    propertyName: string;
+    joinColumns?: {
+        databaseName: string;
+    }[];
+}
+interface EntityMetadataLike {
+    tablePath: string;
+    columns: ColumnLike[];
+    primaryColumns: ColumnLike[];
+    relations?: RelationLike[];
+}
+interface QueryRunnerLike {
+    query(sql: string, parameters?: unknown[]): Promise<unknown>;
+}
 export interface InsertEvent {
     entity: Record<string, unknown>;
+    /** The inserted entity's metadata, when TypeORM has it. */
+    metadata?: EntityMetadataLike;
+    /** The query runner that will run the insert. */
+    queryRunner?: QueryRunnerLike;
 }
 export interface UpdateEvent {
     /** The entity being saved, or the SET values of a query builder / repository update. */
@@ -11,11 +39,18 @@ export interface UpdateEvent {
             propertyName: string;
             databaseName: string;
         }[];
+        relations?: RelationLike[];
     };
 }
 export interface BeforeQueryEvent {
     /** The SQL text that TypeORM is about to send to MySQL. */
     query: string;
+    /** The query runner that is about to send the query. */
+    queryRunner?: {
+        query(sql: string, parameters?: unknown[]): Promise<unknown>;
+    };
+    /** The data source that is about to send the query. */
+    dataSource?: object;
 }
 export interface EntitySubscriberInterface {
     beforeInsert?(event: InsertEvent): void | Promise<void>;
@@ -26,6 +61,20 @@ export interface EntitySubscriberInterface {
 export interface TypeOrmDataSourceLike {
     readonly isInitialized: boolean;
     readonly subscribers: unknown[];
+    /**
+     * Used once to reach TypeORM's select, insert, update, delete and soft-delete
+     * query builder classes. The returned builder is itself the select query builder.
+     */
+    createQueryBuilder(): {
+        insert(): object;
+        update(): object;
+        delete(): object;
+        softDelete(): object;
+    };
+    /** Entity and view metadata; view expressions built by a query builder are exempt from the read scope. */
+    readonly entityMetadatas?: readonly {
+        expression?: unknown;
+    }[];
 }
 /**
  * TypeORM subscriber that injects tenant_id into inserted entities via ALS and
@@ -34,31 +83,69 @@ export interface TypeOrmDataSourceLike {
  * Register it with `registerStratumSubscriber(dataSource)` after
  * `dataSource.initialize()`. TypeORM's `subscribers` option only loads classes
  * decorated with `@EventSubscriber()`, so it does not load this class.
+ * Registration also scopes TypeORM's update, delete and soft-delete query
+ * builders (repository update(), delete(), save() of an existing row, remove(),
+ * softDelete(), restore()) to the current tenant: `tenant_id = <tenant>` is
+ * ANDed to their WHERE clause, and they are refused outside a tenant context.
  *
- * Known limitation: TypeORM subscribers cannot intercept query filtering.
- * This subscriber handles writes only. Use the shared-table adapter's
- * structured methods for tenant-scoped reads.
+ * Registration scopes reads the same way. Every SQL statement that TypeORM's
+ * select query builder produces (repository find*, findOne*, count*, exists*,
+ * sum/average/min/max, preload(), query builder getMany/getOne/getRawMany/
+ * getRawOne/getCount/getManyAndCount/getExists/stream, relation loading, the
+ * row that save() loads, and the count and pagination queries TypeORM builds
+ * internally) ANDs `tenant_id = <tenant>` for the FROM entity to its WHERE
+ * clause and adds it to the ON condition of each joined entity, so a LEFT JOIN
+ * still returns the parent row. Reads of an entity with a tenant_id column are
+ * refused outside a tenant context.
+ *
+ * Not scoped: raw SQL (`dataSource.query()`, `queryRunner.query()`), SQL taken
+ * from a builder's getQuery() / getQueryAndParameters() and run by hand, reads
+ * from a table that has no entity on the data source, and many-to-many junction
+ * tables. Add the tenant condition to those yourself, or use the shared-table
+ * adapter's structured methods.
  */
 export declare class StratumTypeOrmSubscriber implements EntitySubscriberInterface {
-    /** Injects the current tenant's ID into the entity before insert. */
-    beforeInsert(event: InsertEvent): void;
+    /**
+     * Injects the current tenant's ID into the entity before insert, into the
+     * property mapped to the tenant_id column.
+     *
+     * When the entity supplies its whole primary key and the insert builder has
+     * not checked it yet (save() runs this hook before the builder), the key is
+     * checked against the table first, so a save() with another tenant's key is
+     * refused rather than inserted. See checkKeyIsFree.
+     *
+     * @returns A promise that rejects when the key belongs to another tenant's row.
+     */
+    beforeInsert(event: InsertEvent): void | Promise<void>;
     /**
      * Keeps tenant_id out of an update. On save() the loaded value is restored,
      * so the column is unchanged; on a repository or query builder update the
      * column is dropped from the SET values (MySQL column names are
      * case-insensitive, so any letter case is dropped).
+     *
+     * @throws Error when save() loaded a row whose tenant_id is not the current
+     *   tenant's. The loaded tenant_id is not copied onto the entity.
      */
     beforeUpdate(event: UpdateEvent): void;
     /**
-     * Rejects an upsert that writes tenant_id on a key conflict.
+     * Rejects an upsert that could update another tenant's row.
      *
      * A conflict update must never change the tenant of an existing row. A
      * subscriber cannot remove one column from the conflict update, so the
      * statement fails before it runs.
      *
+     * MySQL runs ON DUPLICATE KEY UPDATE on a conflict with any unique key of
+     * the table, whatever conflict columns were passed to upsert() or
+     * orUpdate(). The upsert is therefore allowed only when every unique key
+     * (including the primary key) of the target table contains tenant_id, so a
+     * conflict can only ever be with a row of the same tenant. The keys are read
+     * from information_schema through the same query runner.
+     *
      * @throws Error when the ON DUPLICATE KEY UPDATE clause assigns tenant_id.
+     * @returns A promise that rejects when a unique key of the table does not
+     *   include tenant_id, or when the table cannot be determined.
      */
-    beforeQuery(event: BeforeQueryEvent): void;
+    beforeQuery(event: BeforeQueryEvent): void | Promise<void>;
 }
 /**
  * Returns the one StratumTypeOrmSubscriber on the data source, and adds it first when it is missing.
@@ -66,9 +153,14 @@ export declare class StratumTypeOrmSubscriber implements EntitySubscriberInterfa
  * A second call returns the subscriber that the first call added, so the
  * data source never runs the subscriber twice.
  *
+ * It also scopes TypeORM's select, update, delete and soft-delete query
+ * builders to the current tenant (see StratumTypeOrmSubscriber). The subscriber refuses an
+ * UPDATE or DELETE on a data source that was not registered this way.
+ *
  * @param dataSource - An initialized TypeORM `DataSource`.
  * @throws Error when the data source is not initialized. `initialize()` replaces
  *   the subscriber list, so an earlier registration has no effect.
  */
 export declare function registerStratumSubscriber(dataSource: TypeOrmDataSourceLike): StratumTypeOrmSubscriber;
+export {};
 //# sourceMappingURL=typeorm-subscriber.d.ts.map

package/dist/integrations/typeorm-subscriber.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"typeorm-subscriber.d.ts","sourceRoot":"","sources":["../../src/integrations/typeorm-subscriber.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE;YAAE,YAAY,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;CAC1E;AAED,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,CAAC,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,YAAY,CAAC,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,WAAW,CAAC,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;CACjC;AAOD;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAyB,YAAW,yBAAyB;IACxE,qEAAqE;IACrE,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAMtC;;;;;OAKG;IACH,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAuBtC;;;;;;;;OAQG;IACH,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI;CAS3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,qBAAqB,GAChC,wBAAwB,CAgB1B"}
+{"version":3,"file":"typeorm-subscriber.d.ts","sourceRoot":"","sources":["../../src/integrations/typeorm-subscriber.ts"],"names":[],"mappings":"AAMA,wEAAwE;AACxE,UAAU,UAAU;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;IAC1D,cAAc,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACxE;AAED,wEAAwE;AACxE,0EAA0E;AAC1E,UAAU,YAAY;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C;AAED,UAAU,kBAAkB;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;CAC5B;AAED,UAAU,eAAe;IACvB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE;YAAE,YAAY,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;CACtG;AAED,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,WAAW,CAAC,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;IAC/E,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,CAAC,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,YAAY,CAAC,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,WAAW,CAAC,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;IAChC;;;OAGG;IACH,kBAAkB,IAAI;QAAE,MAAM,IAAI,MAAM,CAAC;QAAC,MAAM,IAAI,MAAM,CAAC;QAAC,MAAM,IAAI,MAAM,CAAC;QAAC,UAAU,IAAI,MAAM,CAAA;KAAE,CAAC;IACrG,0GAA0G;IAC1G,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAChE;AA2FD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,wBAAyB,YAAW,yBAAyB;IACxE;;;;;;;;;;OAUG;IACH,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IActD;;;;;;;;OAQG;IACH,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAgDtC;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAsB3D;AAuYD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,qBAAqB,GAChC,wBAAwB,CAoB1B"}