fluxmail 0.3.0 → 0.4.1

package/dist/storage/apiKeys.js

@@ -1,16 +1,37 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { eq } from 'drizzle-orm';
+import { EmailError } from '@fluxmail/core';
 import { apiKeys } from './db.js';
 import { getMember } from './members.js';
-import { deserializePermissionPolicy, FULL_PERMISSION_POLICY, normalizePermissionPolicy, serializeCustomCapabilities, } from '../permissions.js';
+import { deserializePermissionPolicy, FULL_PERMISSION_POLICY, normalizePermissionPolicy, serializeCustomCapabilities, serializeSupplementalCapabilities, hasCapability, } from '../permissions.js';
+function uniqueAccountIds(accountIds) {
+    return [...new Set(accountIds)];
+}
+function serializeAccountIds(accountIds) {
+    return accountIds === null ? null : JSON.stringify(uniqueAccountIds(accountIds));
+}
+function deserializeAccountIds(value) {
+    if (value === null)
+        return null;
+    const parsed = JSON.parse(value);
+    if (!Array.isArray(parsed) || !parsed.every((item) => typeof item === 'string')) {
+        throw new Error('API key account scope must be a JSON array of strings.');
+    }
+    return uniqueAccountIds(parsed);
+}
 function hashKey(key) {
     return createHash('sha256').update(key).digest('hex');
 }
 /** Returns the plaintext key exactly once; only its hash is stored. */
-export function createApiKey(db, name, memberId, permissions = FULL_PERMISSION_POLICY) {
-    if (memberId)
-        getMember(db, memberId);
+export function createApiKey(db, name, memberId, permissions = FULL_PERMISSION_POLICY, accountIds = null) {
+    if (!memberId) {
+        throw new EmailError('invalid_request', 'A member is required when creating an API key.');
+    }
+    const member = getMember(db, memberId);
     const policy = normalizePermissionPolicy(permissions);
+    if (member.role !== 'admin' && policy.capabilities.some((capability) => capability.startsWith('admin.'))) {
+        throw new EmailError('permission_denied', 'Administrative capabilities can only be issued to an admin member.');
+    }
     const id = `key_${randomBytes(8).toString('hex')}`;
     const key = `fmk_${randomBytes(24).toString('hex')}`;
     const createdAt = Date.now();
@@ -20,9 +41,11 @@ export function createApiKey(db, name, memberId, permissions = FULL_PERMISSION_P
         name,
         keyHash: hashKey(key),
         createdAt,
-        memberId: memberId ?? null,
+        memberId,
         permissionProfile: policy.profile,
         customCapabilities: serializeCustomCapabilities(policy),
+        supplementalCapabilities: serializeSupplementalCapabilities(policy),
+        accountIds: serializeAccountIds(accountIds),
     })
         .run();
     return {
@@ -32,15 +55,17 @@ export function createApiKey(db, name, memberId, permissions = FULL_PERMISSION_P
             name,
             createdAt,
             lastUsedAt: null,
-            memberId: memberId ?? null,
+            memberId,
             permissionProfile: policy.profile,
             capabilities: policy.capabilities,
+            supplementalCapabilities: policy.supplementalCapabilities,
+            accountIds: accountIds === null ? null : uniqueAccountIds(accountIds),
         },
     };
 }
 /**
- * Verify a key, record its use, and return the scope it authorizes. Callers must
- * honour `memberId`: a member-scoped key may only reach shared or owned mailboxes.
+ * Verify a key, record its use, and return its live member role and mailbox
+ * narrowing. Memberless migrated keys authenticate for management only.
  */
 export function authenticateApiKey(db, key) {
     const row = db
@@ -52,13 +77,15 @@ export function authenticateApiKey(db, key) {
         return null;
     let permissions;
     try {
-        permissions = deserializePermissionPolicy(row.permissionProfile, row.customCapabilities);
+        permissions = deserializePermissionPolicy(row.permissionProfile, row.customCapabilities, row.supplementalCapabilities);
+        const accountIds = deserializeAccountIds(row.accountIds);
+        const member = row.memberId ? getMember(db, row.memberId) : null;
+        db.update(apiKeys).set({ lastUsedAt: Date.now() }).where(eq(apiKeys.id, row.id)).run();
+        return { keyId: row.id, memberId: row.memberId, role: member?.role ?? null, permissions, accountIds };
     }
     catch {
         return null;
     }
-    db.update(apiKeys).set({ lastUsedAt: Date.now() }).where(eq(apiKeys.id, row.id)).run();
-    return { memberId: row.memberId, permissions };
 }
 export function verifyApiKey(db, key) {
     return authenticateApiKey(db, key) !== null;
@@ -69,7 +96,8 @@ export function listApiKeys(db) {
         .from(apiKeys)
         .all()
         .map((r) => {
-        const permissions = deserializePermissionPolicy(r.permissionProfile, r.customCapabilities);
+        const permissions = deserializePermissionPolicy(r.permissionProfile, r.customCapabilities, r.supplementalCapabilities);
+        const accountIds = deserializeAccountIds(r.accountIds);
         return {
             id: r.id,
             name: r.name,
@@ -78,21 +106,85 @@ export function listApiKeys(db) {
             memberId: r.memberId,
             permissionProfile: permissions.profile,
             capabilities: permissions.capabilities,
+            supplementalCapabilities: permissions.supplementalCapabilities,
+            accountIds,
         };
     });
 }
+export function updateApiKeyAccounts(db, id, accountIds) {
+    const result = db
+        .update(apiKeys)
+        .set({ accountIds: serializeAccountIds(accountIds) })
+        .where(eq(apiKeys.id, id))
+        .run();
+    return result.changes > 0;
+}
 export function updateApiKeyPermissions(db, id, permissions) {
     const policy = normalizePermissionPolicy(permissions);
+    const existing = db.select().from(apiKeys).where(eq(apiKeys.id, id)).get();
+    if (!existing)
+        return false;
+    const member = existing.memberId ? getMember(db, existing.memberId) : null;
+    if (member && member.role !== 'admin' && policy.capabilities.some((capability) => capability.startsWith('admin.'))) {
+        throw new EmailError('permission_denied', 'Administrative capabilities can only be issued to an admin member.');
+    }
     const result = db
         .update(apiKeys)
         .set({
         permissionProfile: policy.profile,
         customCapabilities: serializeCustomCapabilities(policy),
+        supplementalCapabilities: serializeSupplementalCapabilities(policy),
     })
         .where(eq(apiKeys.id, id))
         .run();
     return result.changes > 0;
 }
+/** Replace requested key fields in one write after all validation succeeds. */
+export function updateApiKey(db, id, update) {
+    const existing = db.select().from(apiKeys).where(eq(apiKeys.id, id)).get();
+    if (!existing)
+        return undefined;
+    const policy = update.permissions ? normalizePermissionPolicy(update.permissions) : undefined;
+    const member = existing.memberId ? getMember(db, existing.memberId) : null;
+    if (policy && member && member.role !== 'admin' && policy.capabilities.some((item) => item.startsWith('admin.'))) {
+        throw new EmailError('permission_denied', 'Administrative capabilities can only be issued to an admin member.');
+    }
+    db.update(apiKeys)
+        .set({
+        ...(policy
+            ? {
+                permissionProfile: policy.profile,
+                customCapabilities: serializeCustomCapabilities(policy),
+                supplementalCapabilities: serializeSupplementalCapabilities(policy),
+            }
+            : {}),
+        ...(update.accountIds !== undefined ? { accountIds: serializeAccountIds(update.accountIds) } : {}),
+    })
+        .where(eq(apiKeys.id, id))
+        .run();
+    return listApiKeys(db).find((key) => key.id === id);
+}
+export function isUsableRootKey(db, id) {
+    const row = db.select().from(apiKeys).where(eq(apiKeys.id, id)).get();
+    if (!row)
+        return false;
+    try {
+        const permissions = deserializePermissionPolicy(row.permissionProfile, row.customCapabilities, row.supplementalCapabilities);
+        if (!hasCapability(permissions, 'admin.api_keys'))
+            return false;
+        return row.memberId === null || getMember(db, row.memberId).role === 'admin';
+    }
+    catch {
+        return false;
+    }
+}
+export function countUsableRootKeys(db, excludingId) {
+    return db
+        .select({ id: apiKeys.id })
+        .from(apiKeys)
+        .all()
+        .filter((row) => row.id !== excludingId && isUsableRootKey(db, row.id)).length;
+}
 export function revokeApiKey(db, id) {
     const result = db.delete(apiKeys).where(eq(apiKeys.id, id)).run();
     return result.changes > 0;

package/dist/storage/apiKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiKeys.js","sourceRoot":"","sources":["../../src/storage/apiKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,OAAO,EAAmB,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,GAI5B,MAAM,mBAAmB,CAAC;AAa3B,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAC1B,EAAc,EACd,IAAY,EACZ,QAAiB,EACjB,cAAgC,sBAAsB;IAEtD,IAAI,QAAQ;QAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC;QACN,EAAE;QACF,IAAI;QACJ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;QACrB,SAAS;QACT,QAAQ,EAAE,QAAQ,IAAI,IAAI;QAC1B,iBAAiB,EAAE,MAAM,CAAC,OAAO;QACjC,kBAAkB,EAAE,2BAA2B,CAAC,MAAM,CAAC;KACxD,CAAC;SACD,GAAG,EAAE,CAAC;IACT,OAAO;QACL,GAAG;QACH,IAAI,EAAE;YACJ,EAAE;YACF,IAAI;YACJ,SAAS;YACT,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,QAAQ,IAAI,IAAI;YAC1B,iBAAiB,EAAE,MAAM,CAAC,OAAO;YACjC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC;KACF,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAc,EAAE,GAAW;IAC5D,MAAM,GAAG,GAAG,EAAE;SACX,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;SACxC,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,WAA6B,CAAC;IAClC,IAAI,CAAC;QACH,WAAW,GAAG,2BAA2B,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACvF,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAc,EAAE,GAAW;IACtD,OAAO,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAc;IACxC,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,WAAW,GAAG,2BAA2B,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC3F,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,iBAAiB,EAAE,WAAW,CAAC,OAAO;YACtC,YAAY,EAAE,WAAW,CAAC,YAAY;SACvC,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAc,EAAE,EAAU,EAAE,WAA6B;IAC/F,MAAM,MAAM,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC;QACH,iBAAiB,EAAE,MAAM,CAAC,OAAO;QACjC,kBAAkB,EAAE,2BAA2B,CAAC,MAAM,CAAC;KACxD,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACzB,GAAG,EAAE,CAAC;IACT,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAc,EAAE,EAAU;IACrD,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAClE,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"apiKeys.js","sourceRoot":"","sources":["../../src/storage/apiKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAmB,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,SAAS,EAAmB,MAAM,cAAc,CAAC;AAC1D,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAC3B,iCAAiC,EACjC,aAAa,GAKd,MAAM,mBAAmB,CAAC;AAgB3B,SAAS,gBAAgB,CAAC,UAA6B;IACrD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAoC;IAC/D,OAAO,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAoB;IACjD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAC1B,EAAc,EACd,IAAY,EACZ,QAAiB,EACjB,cAAgC,sBAAsB,EACtD,aAAuC,IAAI;IAE3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,oEAAoE,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC;QACN,EAAE;QACF,IAAI;QACJ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;QACrB,SAAS;QACT,QAAQ;QACR,iBAAiB,EAAE,MAAM,CAAC,OAAO;QACjC,kBAAkB,EAAE,2BAA2B,CAAC,MAAM,CAAC;QACvD,wBAAwB,EAAE,iCAAiC,CAAC,MAAM,CAAC;QACnE,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC;KAC5C,CAAC;SACD,GAAG,EAAE,CAAC;IACT,OAAO;QACL,GAAG;QACH,IAAI,EAAE;YACJ,EAAE;YACF,IAAI;YACJ,SAAS;YACT,UAAU,EAAE,IAAI;YAChB,QAAQ;YACR,iBAAiB,EAAE,MAAM,CAAC,OAAO;YACjC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;YACzD,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC;SACtE;KACF,CAAC;AACJ,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAc,EAAE,GAAW;IAC5D,MAAM,GAAG,GAAG,EAAE;SACX,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;SACxC,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,WAA6B,CAAC;IAClC,IAAI,CAAC;QACH,WAAW,GAAG,2BAA2B,CACvC,GAAG,CAAC,iBAAiB,EACrB,GAAG,CAAC,kBAAkB,EACtB,GAAG,CAAC,wBAAwB,CAC7B,CAAC;QACF,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACvF,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAc,EAAE,GAAW;IACtD,OAAO,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAc;IACxC,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,WAAW,GAAG,2BAA2B,CAC7C,CAAC,CAAC,iBAAiB,EACnB,CAAC,CAAC,kBAAkB,EACpB,CAAC,CAAC,wBAAwB,CAC3B,CAAC;QACF,MAAM,UAAU,GAAG,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,iBAAiB,EAAE,WAAW,CAAC,OAAO;YACtC,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;YAC9D,UAAU;SACX,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,EAAc,EAAE,EAAU,EAAE,UAAoC;IACnG,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,EAAE,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;SACpD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACzB,GAAG,EAAE,CAAC;IACT,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAc,EAAE,EAAU,EAAE,WAA6B;IAC/F,MAAM,MAAM,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3E,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,oEAAoE,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC;QACH,iBAAiB,EAAE,MAAM,CAAC,OAAO;QACjC,kBAAkB,EAAE,2BAA2B,CAAC,MAAM,CAAC;QACvD,wBAAwB,EAAE,iCAAiC,CAAC,MAAM,CAAC;KACpE,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACzB,GAAG,EAAE,CAAC;IACT,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;AAC5B,CAAC;AAOD,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,EAAc,EAAE,EAAU,EAAE,MAAoB;IAC3E,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3E,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,oEAAoE,CAAC,CAAC;IAClH,CAAC;IACD,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC;QACH,GAAG,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,iBAAiB,EAAE,MAAM,CAAC,OAAO;gBACjC,kBAAkB,EAAE,2BAA2B,CAAC,MAAM,CAAC;gBACvD,wBAAwB,EAAE,iCAAiC,CAAC,MAAM,CAAC;aACpE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnG,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACzB,GAAG,EAAE,CAAC;IACT,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAc,EAAE,EAAU;IACxD,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,2BAA2B,CAC7C,GAAG,CAAC,iBAAiB,EACrB,GAAG,CAAC,kBAAkB,EACtB,GAAG,CAAC,wBAAwB,CAC7B,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,gBAAgB,CAAC;YAAE,OAAO,KAAK,CAAC;QAChE,OAAO,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAc,EAAE,WAAoB;IACtE,OAAO,EAAE;SACN,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;SAC1B,IAAI,CAAC,OAAO,CAAC;SACb,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,WAAW,IAAI,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAc,EAAE,EAAU;IACrD,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAClE,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;AAC5B,CAAC"}