@telorun/cel 0.0.0-stage → 0.107.0

package/dist/regular-expression.js

@@ -0,0 +1,77 @@
+/**
+ * `matches` — and it is RE2, not the host's regular expressions.
+ *
+ * CEL's pattern language is RE2: linear-time matching with no backreferences and no
+ * lookaround. The host's own engine accepts patterns RE2 refuses and is exponential on
+ * some of them, so an expression that matches here would behave differently on another
+ * runtime and a hostile pattern in a manifest would be a denial of service. A pattern
+ * RE2 cannot parse is `invalid_regular_expression`, never a silent `false`.
+ *
+ * Compilation is memoized, bounded, because a pattern is almost always a literal
+ * evaluated many times. **One compile serves every caller** — the language's `matches`
+ * and the catalog's regex family alike — so a pattern is read one way and the cache is
+ * not duplicated; what differs is only how each words its refusal, which is why a refusal
+ * answers RE2's parse-error KIND beside the library's whole message.
+ */
+import { RE2JS, RE2JSSyntaxException } from "re2js";
+import { BoundedCache } from "./bounded-cache.js";
+import { celError } from "./cel-value.js";
+/** How many compiled patterns one process keeps. */
+export const PATTERN_CACHE_CAPACITY = 128;
+/** The flag letters a caller may map onto RE2's own flags. */
+export const RE2_FLAG_LETTERS = {
+    i: RE2JS.CASE_INSENSITIVE,
+    m: RE2JS.MULTILINE,
+    s: RE2JS.DOTALL,
+};
+/**
+ * RE2's parse-error kinds, in RE2's own words — the closed vocabulary an invalid-pattern
+ * refusal ends with, so every engine words one identically. The last two are RE2's parser
+ * limits: a nesting height above 1000, and a parsed size above 3,355,443.
+ */
+export const RE2_PATTERN_ERROR_KINDS = [
+    "missing closing )",
+    "missing closing ]",
+    "unexpected )",
+    "trailing backslash at end of expression",
+    "invalid escape sequence",
+    "invalid character class range",
+    "invalid named capture",
+    "duplicate capture group name",
+    "invalid or unsupported Perl syntax",
+    "missing argument to repetition operator",
+    "invalid nested repetition operator",
+    "invalid repeat count",
+    "expression nests too deeply",
+    "expression too large",
+];
+const compiled = new BoundedCache(PATTERN_CACHE_CAPACITY);
+/** A compiled pattern, or why RE2 refused it. One compile and one cache for every caller. */
+export function re2Pattern(pattern, flags = 0) {
+    const key = `${flags}\u0000${pattern}`;
+    let held = compiled.get(key);
+    if (held === undefined) {
+        try {
+            held = { pattern: RE2JS.compile(pattern, flags) };
+        }
+        catch (cause) {
+            const kind = cause instanceof RE2JSSyntaxException ? cause.error : undefined;
+            held = {
+                refused: {
+                    ...(kind !== undefined && RE2_PATTERN_ERROR_KINDS.includes(kind) ? { kind } : {}),
+                    message: cause.message,
+                },
+            };
+        }
+        compiled.set(key, held);
+    }
+    return held;
+}
+/** Whether the pattern matches anywhere in the text, or why the pattern is not one. */
+export function celMatches(text, pattern, range) {
+    const held = re2Pattern(pattern);
+    if ("refused" in held) {
+        return celError("invalid_regular_expression", `${JSON.stringify(pattern)} is not an RE2 pattern: ${held.refused.message}`, range);
+    }
+    return held.pattern.matcher(text).find();
+}

package/dist/reserved-words.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The words no CEL identifier may be: cel-spec's `RESERVED` production, which its
+ * `IDENT` production excludes. All 21 of them.
+ *
+ * The set is frozen deliberately: a word added here stops a manifest that uses it as
+ * a variable or a function name from parsing, so it is widened only with a
+ * deprecation behind it.
+ *
+ * **Three of the 21 are refused by being read as something else**, and the
+ * distinction is the lexer's whole policy about words, so it lives here rather than
+ * there. `true`, `false` and `null` are literals; `in` is the membership operator.
+ * Neither reading can be reached from a name position, which is why cel-spec needs
+ * them in `RESERVED` and why an engine must not quietly accept one as a name — doing
+ * so breaks the premise every consumer of the set is written against.
+ *
+ * **A reserved word is refused as an IDENTIFIER, not as a member name.** CEL's own
+ * conformance suite reads `{'let': 1}.let` and `a.while()`; `a.in` and `a.true` are
+ * the same position, and read for the same reason. A member name is a name of a
+ * value's entry, not a name in the expression's scope.
+ *
+ * **No host's property names are here.** A member *name* is written by the author; a
+ * member *key* can come from a request (`a[request.query.k]`), so a word list cannot
+ * be what keeps a host's property out of a CEL value — it does not touch the computed
+ * form at all. That guarantee belongs to the member-read operation, which resolves
+ * every form against the value's own entries and never performs a host property read.
+ * `constructor` never being on any such list is the same point made by its absence.
+ *
+ * `cel` and `optional` are legal identifiers, reserved only against being registered
+ * as a namespace (`namespace-resolution.ts`), because the standard macros are written
+ * on them (`cel.bind`, `optional.of`).
+ */
+export declare const RESERVED_WORDS: readonly string[];
+/** The reserved words that are a literal where they stand. */
+export declare const LITERAL_WORDS: readonly string[];
+/** The reserved words that are an operator where they stand. */
+export declare const OPERATOR_WORDS: readonly string[];
+/** How a word is read where an expression begins. */
+export type WordReading = 
+/** An ordinary identifier. */
+"name"
+/** A literal value: `true`, `false`, `null`. */
+ | "literal"
+/** An operator written as a word: `in`. */
+ | "operator"
+/** Reserved, with no other reading — refused wherever a name is read. */
+ | "refused";
+export declare function wordReading(text: string): WordReading;
+/** Whether the word is one cel-spec reserves, however it is read. */
+export declare function isReservedWord(name: string): boolean;
+/** Whether the text is spelled as a CEL identifier, reserved or not. */
+export declare function isIdentifierSpelling(text: string): boolean;
+//# sourceMappingURL=reserved-words.d.ts.map

package/dist/reserved-words.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reserved-words.d.ts","sourceRoot":"","sources":["../src/reserved-words.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAsB3C,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAA8B,CAAC;AAE1E,gEAAgE;AAChE,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAW,CAAC;AAMxD,qDAAqD;AACrD,MAAM,MAAM,WAAW;AACrB,8BAA8B;AAC5B,MAAM;AACR,gDAAgD;GAC9C,SAAS;AACX,2CAA2C;GACzC,UAAU;AACZ,yEAAyE;GACvE,SAAS,CAAC;AAEd,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAIrD;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAID,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D"}

package/dist/reserved-words.js

@@ -0,0 +1,77 @@
+/**
+ * The words no CEL identifier may be: cel-spec's `RESERVED` production, which its
+ * `IDENT` production excludes. All 21 of them.
+ *
+ * The set is frozen deliberately: a word added here stops a manifest that uses it as
+ * a variable or a function name from parsing, so it is widened only with a
+ * deprecation behind it.
+ *
+ * **Three of the 21 are refused by being read as something else**, and the
+ * distinction is the lexer's whole policy about words, so it lives here rather than
+ * there. `true`, `false` and `null` are literals; `in` is the membership operator.
+ * Neither reading can be reached from a name position, which is why cel-spec needs
+ * them in `RESERVED` and why an engine must not quietly accept one as a name — doing
+ * so breaks the premise every consumer of the set is written against.
+ *
+ * **A reserved word is refused as an IDENTIFIER, not as a member name.** CEL's own
+ * conformance suite reads `{'let': 1}.let` and `a.while()`; `a.in` and `a.true` are
+ * the same position, and read for the same reason. A member name is a name of a
+ * value's entry, not a name in the expression's scope.
+ *
+ * **No host's property names are here.** A member *name* is written by the author; a
+ * member *key* can come from a request (`a[request.query.k]`), so a word list cannot
+ * be what keeps a host's property out of a CEL value — it does not touch the computed
+ * form at all. That guarantee belongs to the member-read operation, which resolves
+ * every form against the value's own entries and never performs a host property read.
+ * `constructor` never being on any such list is the same point made by its absence.
+ *
+ * `cel` and `optional` are legal identifiers, reserved only against being registered
+ * as a namespace (`namespace-resolution.ts`), because the standard macros are written
+ * on them (`cel.bind`, `optional.of`).
+ */
+export const RESERVED_WORDS = [
+    "as",
+    "break",
+    "const",
+    "continue",
+    "else",
+    "false",
+    "for",
+    "function",
+    "if",
+    "import",
+    "in",
+    "let",
+    "loop",
+    "namespace",
+    "null",
+    "package",
+    "return",
+    "true",
+    "var",
+    "void",
+    "while",
+];
+/** The reserved words that are a literal where they stand. */
+export const LITERAL_WORDS = ["true", "false", "null"];
+/** The reserved words that are an operator where they stand. */
+export const OPERATOR_WORDS = ["in"];
+const RESERVED = new Set(RESERVED_WORDS);
+const LITERALS = new Set(LITERAL_WORDS);
+const OPERATORS = new Set(OPERATOR_WORDS);
+export function wordReading(text) {
+    if (LITERALS.has(text))
+        return "literal";
+    if (OPERATORS.has(text))
+        return "operator";
+    return RESERVED.has(text) ? "refused" : "name";
+}
+/** Whether the word is one cel-spec reserves, however it is read. */
+export function isReservedWord(name) {
+    return RESERVED.has(name);
+}
+const IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Whether the text is spelled as a CEL identifier, reserved or not. */
+export function isIdentifierSpelling(text) {
+    return IDENTIFIER.test(text);
+}

package/dist/resolved-call.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Which function each call in an expression resolved to.
+ *
+ * A host needs this for policy the engine cannot know: whether a non-deterministic call
+ * sits in a field evaluated once at startup, whether a call reaches the host at all,
+ * which error codes a call can fail with. All three are properties of the **resolved**
+ * signature, not of the name written — two overloads of one name can differ in every
+ * one of them — so the answer has to come from the checker, which is what resolved it.
+ *
+ * **It is the checker's lowering, not the tree.** A macro is not a dispatch and is not
+ * listed: `xs.map(i, i)` becomes a comprehension and reaches no function, while the
+ * calls written inside it are listed where they are written. A list read off the tree
+ * would instead report whatever the reader's parser happened to expand.
+ */
+import type { CallForm } from "./signature.js";
+import type { SourceRange } from "./syntax-tree.js";
+export interface ResolvedCall {
+    /** The name as written — `<namespace>.<name>` for a namespaced call. */
+    readonly name: string;
+    readonly form: CallForm;
+    /** Set only for a namespaced call. */
+    readonly namespace?: string;
+    readonly arity: number;
+    readonly range: SourceRange;
+    /** The signature it resolved to, absent where nothing resolved. */
+    readonly signature?: string;
+    /** The type the call answers here, with type parameters substituted. */
+    readonly returns?: string;
+    readonly deterministic?: boolean;
+    readonly hostBacked?: boolean;
+    readonly throws?: readonly string[];
+}
+//# sourceMappingURL=resolved-call.d.ts.map

package/dist/resolved-call.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolved-call.d.ts","sourceRoot":"","sources":["../src/resolved-call.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC"}

package/dist/resolved-call.js

@@ -0,0 +1,15 @@
+/**
+ * Which function each call in an expression resolved to.
+ *
+ * A host needs this for policy the engine cannot know: whether a non-deterministic call
+ * sits in a field evaluated once at startup, whether a call reaches the host at all,
+ * which error codes a call can fail with. All three are properties of the **resolved**
+ * signature, not of the name written — two overloads of one name can differ in every
+ * one of them — so the answer has to come from the checker, which is what resolved it.
+ *
+ * **It is the checker's lowering, not the tree.** A macro is not a dispatch and is not
+ * listed: `xs.map(i, i)` becomes a comprehension and reaches no function, while the
+ * calls written inside it are listed where they are written. A list read off the tree
+ * would instead report whatever the reader's parser happened to expand.
+ */
+export {};

package/dist/root-references.d.ts

@@ -0,0 +1,23 @@
+/**
+ * What an expression reads from its environment.
+ *
+ * The answer is the first identifier of every access chain — `request` in
+ * `request.query.limit`, `xs` in `xs[0].id` — with three exclusions, each of which
+ * would otherwise invent a dependency the expression does not have:
+ *
+ * - a name a comprehension or `cel.bind` binds, which the expression supplies itself;
+ * - the namespace of a qualified call, which names a module rather than a value;
+ * - the receiver of a call on a reserved namespace (`cel.bind(…)`, `optional.of(…)`),
+ *   for the same reason.
+ *
+ * A function name is not an identifier node at all, so no call name can be mistaken
+ * for a read. Field names are not nodes either, which is why only the root of a
+ * chain is answered.
+ *
+ * The result is sorted and deduplicated: it is a set of names, and a consumer that
+ * compares two expressions' reads must not see an ordering difference.
+ */
+import type { CelNode } from "./syntax-tree.js";
+/** Every name the expression reads from its environment, sorted. */
+export declare function rootReferences(root: CelNode): readonly string[];
+//# sourceMappingURL=root-references.d.ts.map

package/dist/root-references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-references.d.ts","sourceRoot":"","sources":["../src/root-references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAoBhD,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAI/D"}

package/dist/root-references.js

@@ -0,0 +1,120 @@
+/**
+ * What an expression reads from its environment.
+ *
+ * The answer is the first identifier of every access chain — `request` in
+ * `request.query.limit`, `xs` in `xs[0].id` — with three exclusions, each of which
+ * would otherwise invent a dependency the expression does not have:
+ *
+ * - a name a comprehension or `cel.bind` binds, which the expression supplies itself;
+ * - the namespace of a qualified call, which names a module rather than a value;
+ * - the receiver of a call on a reserved namespace (`cel.bind(…)`, `optional.of(…)`),
+ *   for the same reason.
+ *
+ * A function name is not an identifier node at all, so no call name can be mistaken
+ * for a read. Field names are not nodes either, which is why only the root of a
+ * chain is answered.
+ *
+ * The result is sorted and deduplicated: it is a set of names, and a consumer that
+ * compares two expressions' reads must not see an ordering difference.
+ */
+import { namespaceMacroBinding, receiverMacroBinding } from "./comprehension-bindings.js";
+import { RESERVED_NAMESPACES } from "./namespace-resolution.js";
+class BoundNames {
+    depth = new Map();
+    bind(name) {
+        this.depth.set(name, (this.depth.get(name) ?? 0) + 1);
+    }
+    unbind(name) {
+        const held = this.depth.get(name);
+        if (held === 1)
+            this.depth.delete(name);
+        else
+            this.depth.set(name, held - 1);
+    }
+    has(name) {
+        return this.depth.has(name);
+    }
+}
+/** Every name the expression reads from its environment, sorted. */
+export function rootReferences(root) {
+    const found = new Set();
+    collect(root, new BoundNames(), found);
+    return [...found].sort();
+}
+function collect(node, bound, found) {
+    switch (node.kind) {
+        case "ident":
+            // An absolute name reads past every binding by construction, so a binding of the
+            // same name says nothing about it.
+            if (node.absolute || !bound.has(node.name))
+                found.add(node.name);
+            return;
+        case "literal":
+        case "unparsed":
+            return;
+        case "receiverCall":
+            collectCall(node, bound, found);
+            return;
+        case "list":
+            for (const element of node.elements)
+                collect(element.value, bound, found);
+            return;
+        case "map":
+            for (const entry of node.entries) {
+                collect(entry.key, bound, found);
+                collect(entry.value, bound, found);
+            }
+            return;
+        case "select":
+            collect(node.operand, bound, found);
+            return;
+        case "index":
+            collect(node.operand, bound, found);
+            collect(node.index, bound, found);
+            return;
+        case "call":
+        case "qcall":
+            for (const argument of node.args)
+                collect(argument, bound, found);
+            return;
+        case "unary":
+            collect(node.operand, bound, found);
+            return;
+        case "binary":
+            collect(node.left, bound, found);
+            collect(node.right, bound, found);
+            return;
+        case "conditional":
+            collect(node.condition, bound, found);
+            collect(node.whenTrue, bound, found);
+            collect(node.whenFalse, bound, found);
+            return;
+    }
+}
+function collectCall(node, bound, found) {
+    const receiver = node.receiver;
+    const onNamespace = receiver.kind === "ident" && RESERVED_NAMESPACES.includes(receiver.name);
+    const binding = onNamespace
+        ? namespaceMacroBinding(receiver.name, node.name, node.args.length)
+        : receiverMacroBinding(node.name, node.args.length);
+    if (!onNamespace)
+        collect(receiver, bound, found);
+    const variable = binding ? node.args[binding.variableArgument] : undefined;
+    if (!binding || variable?.kind !== "ident") {
+        for (const argument of node.args)
+            collect(argument, bound, found);
+        return;
+    }
+    for (const [at, argument] of node.args.entries()) {
+        if (at === binding.variableArgument || binding.scopedArguments.includes(at))
+            continue;
+        collect(argument, bound, found);
+    }
+    bound.bind(variable.name);
+    for (const at of binding.scopedArguments) {
+        const argument = node.args[at];
+        if (argument)
+            collect(argument, bound, found);
+    }
+    bound.unbind(variable.name);
+}

package/dist/runtime-library.d.ts

@@ -0,0 +1,56 @@
+/**
+ * What every operator and standard function **does** — once, for both backends.
+ *
+ * The declarations are data (`signatures/standard-library.json`); this is the behaviour
+ * behind them, keyed by the same dispatch key the registry resolves on. The closure
+ * backend calls through here and the emitter will too, so there is exactly one answer
+ * per operation and no second copy to drift: a semantics written inside a backend is a
+ * semantics each backend gets slightly wrong in its own way.
+ *
+ * An implementation takes its arguments **already evaluated and already free of
+ * errors** — the caller carries an error-valued operand through for the short-circuit
+ * rules — and returns a value, which may itself be an error value (an overflow, a
+ * missing key, a pattern RE2 refuses). Its return type is not thenable, so an
+ * implementation that answers asynchronously does not compile.
+ */
+import type { CelOptional, CelValue } from "./cel-value.js";
+import { type CelError, type CelTypeValue } from "./cel-value.js";
+import type { CelSignature } from "./signature.js";
+import type { SourceRange } from "./syntax-tree.js";
+/** What an implementation knows about the call it is answering. */
+export interface CelCallContext {
+    /** The span of the call, carried into any error value it produces. */
+    readonly range?: SourceRange;
+}
+export type CelImplementation = (args: readonly CelValue[], ctx: CelCallContext) => CelValue;
+/** The name a type value carries. A null's type and an optional's are named apart. */
+export declare function typeValueName(typeName: string): string;
+/** The type value of any value — `type()` must answer for anything, including `dyn`. */
+export declare function celTypeValueOf(value: CelValue, range?: SourceRange): CelTypeValue | CelError;
+/** Bytes as base64 with the standard alphabet and padding. */
+export declare function base64Text(input: Uint8Array): string;
+/**
+ * JSON as CEL values: an object is a map, an array a list, a number a double. Exported
+ * because the function catalog's `parseJson` answers the same question, and two readings
+ * of what JSON becomes would be two value domains.
+ */
+export declare function jsonAsCelValue(parsed: unknown): CelValue;
+/**
+ * The implementation of a registered signature, or nothing where the registration has
+ * none — a host's own function, which the host supplies itself.
+ */
+export declare function implementationOf(signature: CelSignature): CelImplementation | undefined;
+/** Every dispatch key this file answers for, for a completeness check. */
+export declare function implementedKeys(): readonly string[];
+/**
+ * The values the library's own constants read as: each type name as a type value, and
+ * `google`, through which the two well-known type names are reached — the only spelling
+ * in which an expression can name the timestamp or duration type.
+ */
+export declare function standardConstantValues(optionalTypes: boolean): ReadonlyMap<string, CelValue>;
+/**
+ * `optional.ofNonZeroValue(v)`: present unless the value is its type's zero — which is
+ * what makes it different from `optional.of`, and what three of the vectors' rows read.
+ */
+export declare function optionalOfNonZero(value: CelValue): CelOptional;
+//# sourceMappingURL=runtime-library.d.ts.map

package/dist/runtime-library.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-library.d.ts","sourceRoot":"","sources":["../src/runtime-library.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAGV,WAAW,EAEX,QAAQ,EACT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAaL,KAAK,QAAQ,EACb,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAqBxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAYpD,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;CAC9B;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,SAAS,QAAQ,EAAE,EAAE,GAAG,EAAE,cAAc,KAAK,QAAQ,CAAC;AA6E7F,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED,wFAAwF;AACxF,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,YAAY,GAAG,QAAQ,CAM5F;AAMD,8DAA8D;AAC9D,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAYpD;AAQD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,CAQxD;AAwVD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,YAAY,GAAG,iBAAiB,GAAG,SAAS,CAEvF;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,IAAI,SAAS,MAAM,EAAE,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAc5F;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,GAAG,WAAW,CAE9D"}