mindoodb 0.0.23 → 0.0.32

package/dist/core/accesscontrol/evaluate.js

@@ -0,0 +1,206 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PSEUDO_TOKEN_AUTHOR = exports.PSEUDO_TOKEN_ADMIN = exports.ALWAYS_PRESENT_PSEUDO_TOKENS = void 0;
+exports.defaultWhenForOp = defaultWhenForOp;
+exports.evaluateAccess = evaluateAccess;
+const types_1 = require("./types");
+Object.defineProperty(exports, "PSEUDO_TOKEN_ADMIN", { enumerable: true, get: function () { return types_1.PSEUDO_TOKEN_ADMIN; } });
+Object.defineProperty(exports, "PSEUDO_TOKEN_AUTHOR", { enumerable: true, get: function () { return types_1.PSEUDO_TOKEN_AUTHOR; } });
+/** The default `when` for a clause, given the operation (§6.3). */
+function defaultWhenForOp(op) {
+    return op === "doc_create" ? "after" : "before";
+}
+function allow(reason, tier, matchedRuleId) {
+    return { allowed: true, reason, tier, matchedRuleId };
+}
+function deny(reason, tier, matchedRuleId) {
+    return { allowed: false, reason, tier, matchedRuleId };
+}
+/**
+ * Evaluate access for an operation (§7). The result is fully determined by the
+ * inputs; see {@link EvaluateAccessInput}.
+ */
+function evaluateAccess(input) {
+    const { op, dbid, identity, node, isServer } = input;
+    // No policy document has ever existed -> access control was never enabled ->
+    // everything is allowed (§6.1, the "no acl_defaultpolicy" state).
+    if (node.defaultPolicy === null) {
+        return allow("access control not enabled (no default policy)", "tier1");
+    }
+    const dbPolicy = node.dbPolicies.get(dbid) ?? null;
+    const eff = (0, types_1.effectivePolicy)(node.defaultPolicy, dbPolicy);
+    // Step 0: master switch short-circuits everything, including standalone deny
+    // rules (§7 step 0).
+    if (eff.disableAllAccessChecksAndPolicies) {
+        return allow("access control disabled by master switch", "tier1");
+    }
+    // Step 2: baseline from the effective deny<Op> flag.
+    const denyField = {
+        doc_create: eff.denyDocCreate,
+        doc_change: eff.denyDocChange,
+        doc_delete: eff.denyDocDelete,
+        doc_undelete: eff.denyDocUndelete,
+        doc_snapshot: eff.denyDocSnapshot,
+        doc_read: eff.denyDocRead,
+    }[op];
+    const baselineDenied = denyField === true;
+    // Step 4: collect rules of this type whose dbid matches and whose users_hashes
+    // intersect the identity set.
+    const candidateRules = (node.rulesByType.get(op) ?? []).filter((r) => (r.dbid === dbid || r.dbid === "*") && intersects(r.users_hashes, identity.hashes));
+    // Partition into Tier 1 (no withfields) and Tier 2 (withfields) rules.
+    let denyMatched = null;
+    let allowMatched = null;
+    // Tracks whether a Tier 2 rule *could* allow (used by the server to defer).
+    let tier2AllowDeferred = false;
+    let tier2DenyDeferred = false;
+    for (const rule of candidateRules) {
+        const isTier2 = (rule.withfields?.length ?? 0) > 0;
+        if (isTier2 && isServer) {
+            // The server cannot evaluate content; remember that a Tier 2 rule of this
+            // action exists so it can defer to the client rather than over-deny/allow.
+            if (rule.action === "allow")
+                tier2AllowDeferred = true;
+            else
+                tier2DenyDeferred = true;
+            continue;
+        }
+        const matches = isTier2 ? withFieldsPass(rule, input) : true;
+        if (!matches)
+            continue;
+        const tier = isTier2 ? "tier2" : "tier1";
+        if (rule.action === "deny" && !denyMatched)
+            denyMatched = { rule, tier };
+        if (rule.action === "allow" && !allowMatched)
+            allowMatched = { rule, tier };
+    }
+    // Step 5: deny-overrides-allow (set-based, order-independent).
+    if (denyMatched) {
+        return deny(`denied by rule ${denyMatched.rule.ruleId}`, denyMatched.tier, denyMatched.rule.ruleId);
+    }
+    if (allowMatched) {
+        return allow(`allowed by rule ${allowMatched.rule.ruleId}`, allowMatched.tier, allowMatched.rule.ruleId);
+    }
+    // No conclusive rule matched. On the server, defer to the client when the
+    // only thing that could change the verdict is a Tier 2 rule (§7).
+    if (isServer && baselineDenied && tier2AllowDeferred) {
+        return allow("baseline deny may be overridden by a Tier 2 allow (deferred to client)", "tier1");
+    }
+    if (isServer && !baselineDenied && tier2DenyDeferred) {
+        // A Tier 2 deny might apply, but only the client can check it.
+        return allow("baseline allow; Tier 2 deny deferred to client", "tier1");
+    }
+    return baselineDenied
+        ? deny(`denied by baseline policy for ${op}`, "tier1")
+        : allow(`allowed by baseline policy for ${op}`, "tier1");
+}
+/** Returns true if any element of `hashes` is in `set`. */
+function intersects(hashes, set) {
+    for (const h of hashes) {
+        if (set.has(h))
+            return true;
+    }
+    return false;
+}
+/**
+ * Evaluate every `withfields` clause of a Tier 2 rule against the document
+ * state selected by each clause's `when` (§6.3). All clauses must pass.
+ */
+function withFieldsPass(rule, input) {
+    for (const clause of rule.withfields ?? []) {
+        const when = clause.when ?? defaultWhenForOp(input.op);
+        const doc = when === "after" ? input.afterDoc : input.beforeDoc;
+        if (!evaluateClause(clause, doc ?? null, input.identity)) {
+            return false;
+        }
+    }
+    return true;
+}
+/** Resolve a clause value, expanding placeholders against the identity set. */
+function resolveValue(value, identity) {
+    if ((0, types_1.isPlaceholder)(value)) {
+        switch (value) {
+            case "${user.username}":
+                return { scalar: identity.username, list: [identity.username] };
+            case "${user.usernames}":
+                return { list: identity.usernames };
+            case "${user.groups}":
+                return { list: identity.groups };
+        }
+    }
+    if (Array.isArray(value)) {
+        return { list: value };
+    }
+    return { scalar: value };
+}
+/** Read a dot-path from a document object. */
+function readPath(doc, key) {
+    if (!doc)
+        return undefined;
+    const parts = key.split(".");
+    let cur = doc;
+    for (const part of parts) {
+        if (cur === null || cur === undefined || typeof cur !== "object")
+            return undefined;
+        cur = cur[part];
+    }
+    return cur;
+}
+/** Evaluate a single clause against a document state. */
+function evaluateClause(clause, doc, identity) {
+    const op = clause.op;
+    const docValue = readPath(doc, clause.key);
+    // Existence operators don't need the value.
+    if (op === "exists")
+        return docValue !== undefined;
+    if (op === "notExists")
+        return docValue === undefined;
+    const resolved = resolveValue(clause.value, identity);
+    switch (op) {
+        case "equals":
+            return resolved.scalar !== undefined && docValue === resolved.scalar;
+        case "notEquals":
+            return resolved.scalar === undefined || docValue !== resolved.scalar;
+        case "contains": {
+            // docValue is an array or string; check it contains the scalar value.
+            const needle = resolved.scalar;
+            if (needle === undefined)
+                return false;
+            if (Array.isArray(docValue))
+                return docValue.includes(needle);
+            if (typeof docValue === "string" && typeof needle === "string")
+                return docValue.includes(needle);
+            return false;
+        }
+        case "containsAny": {
+            const list = resolved.list ?? (resolved.scalar !== undefined ? [resolved.scalar] : []);
+            if (!Array.isArray(docValue))
+                return false;
+            return list.some((v) => docValue.includes(v));
+        }
+        case "containsAll": {
+            const list = resolved.list ?? (resolved.scalar !== undefined ? [resolved.scalar] : []);
+            if (!Array.isArray(docValue))
+                return false;
+            return list.every((v) => docValue.includes(v));
+        }
+        case "gt":
+        case "gte":
+        case "lt":
+        case "lte": {
+            if (typeof docValue !== "number" || typeof resolved.scalar !== "number")
+                return false;
+            const a = docValue;
+            const b = resolved.scalar;
+            return op === "gt" ? a > b : op === "gte" ? a >= b : op === "lt" ? a < b : a <= b;
+        }
+        default:
+            return false;
+    }
+}
+/**
+ * Convenience: the set of reserved pseudo-tokens an identity always/optionally
+ * carries. `$everyone` is always present for registered users; `$admin` and
+ * `$author` are added by the caller when applicable.
+ */
+exports.ALWAYS_PRESENT_PSEUDO_TOKENS = [types_1.PSEUDO_TOKEN_EVERYONE];
+//# sourceMappingURL=evaluate.js.map

package/dist/core/accesscontrol/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/evaluate.ts"],"names":[],"mappings":";;;AAgFA,4CAEC;AAcD,wCAuFC;AAvLD,mCAaiB;AA8RR,mGAvSP,0BAAkB,OAuSO;AAAE,oGAtS3B,2BAAmB,OAsS2B;AA5NhD,mEAAmE;AACnE,SAAgB,gBAAgB,CAAC,EAAY;IAC3C,OAAO,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC;AAED,SAAS,KAAK,CAAC,MAAc,EAAE,IAAuB,EAAE,aAAsB;IAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAuB,EAAE,aAAsB;IAC3E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAErD,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACnD,MAAM,GAAG,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAE1D,6EAA6E;IAC7E,qBAAqB;IACrB,IAAI,GAAG,CAAC,iCAAiC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,0CAA0C,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,qDAAqD;IACrD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,YAAY,EAAE,GAAG,CAAC,eAAe;QACjC,YAAY,EAAE,GAAG,CAAC,eAAe;QACjC,QAAQ,EAAE,GAAG,CAAC,WAAW;KAC1B,CAAC,EAAE,CAAC,CAAC;IACN,MAAM,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;IAE1C,+EAA+E;IAC/E,8BAA8B;IAC9B,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAC1F,CAAC;IAEF,uEAAuE;IACvE,IAAI,WAAW,GAAyD,IAAI,CAAC;IAC7E,IAAI,YAAY,GAAyD,IAAI,CAAC;IAC9E,4EAA4E;IAC5E,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;gBAAE,kBAAkB,GAAG,IAAI,CAAC;;gBAClD,iBAAiB,GAAG,IAAI,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,IAAI,GAAsB,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,WAAW;YAAE,WAAW,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,YAAY;YAAE,YAAY,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9E,CAAC;IAED,+DAA+D;IAC/D,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI,CACT,kBAAkB,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAC3C,WAAW,CAAC,IAAI,EAChB,WAAW,CAAC,IAAI,CAAC,MAAM,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,KAAK,CACV,mBAAmB,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAC7C,YAAY,CAAC,IAAI,EACjB,YAAY,CAAC,IAAI,CAAC,MAAM,CACzB,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,QAAQ,IAAI,cAAc,IAAI,kBAAkB,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC,wEAAwE,EAAE,OAAO,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,cAAc,IAAI,iBAAiB,EAAE,CAAC;QACrD,+DAA+D;QAC/D,OAAO,KAAK,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,cAAc;QACnB,CAAC,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,EAAE,OAAO,CAAC;QACtD,CAAC,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,2DAA2D;AAC3D,SAAS,UAAU,CAAC,MAAgB,EAAE,GAAgB;IACpD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAgB,EAAE,KAA0B;IAClE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CACnB,KAA+B,EAC/B,QAAqB;IAErB,IAAI,IAAA,qBAAa,EAAC,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,KAAoB,EAAE,CAAC;YAC7B,KAAK,kBAAkB;gBACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,KAAK,mBAAmB;gBACtB,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;YACtC,KAAK,gBAAgB;gBACnB,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,8CAA8C;AAC9C,SAAS,QAAQ,CAAC,GAAmC,EAAE,GAAW;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACnF,GAAG,GAAI,GAA+B,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yDAAyD;AACzD,SAAS,cAAc,CACrB,MAAuB,EACvB,GAAmC,EACnC,QAAqB;IAErB,MAAM,EAAE,GAAa,MAAM,CAAC,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAE3C,4CAA4C;IAC5C,IAAI,EAAE,KAAK,QAAQ;QAAE,OAAO,QAAQ,KAAK,SAAS,CAAC;IACnD,IAAI,EAAE,KAAK,WAAW;QAAE,OAAO,QAAQ,KAAK,SAAS,CAAC;IAEtD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAEtD,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,MAAM,CAAC;QACvE,KAAK,WAAW;YACd,OAAO,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,MAAM,CAAC;QACvE,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,sEAAsE;YACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,QAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,QAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACtF,MAAM,CAAC,GAAG,QAAQ,CAAC;YACnB,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC1B,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC;QACD;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACU,QAAA,4BAA4B,GAAsB,CAAC,6BAAqB,CAAC,CAAC"}

package/dist/core/accesscontrol/grantKeys.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Helpers for reading and writing the public-key fields of a `grantaccess`
+ * directory document in a way that is forward- and backward-compatible
+ * (docs/accesscontrol.md §6.5).
+ *
+ * Active devices and revoked devices live in TWO SEPARATE lists:
+ *
+ *  - `userKeyPairs`: the ACTIVE device key pairs, an array of
+ *    `{ signingPublicKey, encryptionPublicKey, label? }` objects. Pairing the
+ *    keys per device keeps a device's signing and encryption keys together and
+ *    lets each carry an optional human-readable label. This is the canonical
+ *    list the server/auth treat as granting access. Because revoked devices are
+ *    NOT in this list, any reader (old or new) that treats `userKeyPairs` as
+ *    "the keys that have access" is correct without understanding revocation.
+ *  - `revokedUserKeyPairs`: the RETAINED revoked device key pairs (§6.5), same
+ *    shape plus an optional `revokedAt` timestamp. Membership in this list — not
+ *    a per-entry flag — is what marks a device revoked. Retaining them lets
+ *    admin UIs list "devices with revoked access" and optionally restore them.
+ *
+ * For older clients that predate `userKeyPairs`, writers also mirror the ACTIVE
+ * keys into the legacy forms, read in this order of authority:
+ *
+ *  1. `userKeyPairs` (the active list above; authoritative once present).
+ *  2. `userSigningPublicKeys` / `userEncryptionPublicKeys`: two parallel string
+ *     arrays (previous form). Index-aligned by convention; no labels.
+ *  3. `userSigningPublicKey` / `userEncryptionPublicKey`: single legacy scalars
+ *     (oldest form).
+ *
+ * The most specific present form wins. Critically, a present-but-EMPTY
+ * `userKeyPairs` is authoritative (it denotes a grant with no active devices,
+ * §6.5): we must NOT fall back to a stale lower form and resurrect access that
+ * revocation removed.
+ *
+ * Writers ({@link applyKeyPairFields}) keep the legacy forms mirrored so older
+ * clients (which only understand the array or scalar forms) keep working.
+ *
+ * These functions are pure (operate on a plain data object) so they can be
+ * reused by the directory cache builder, the time-travel node builder, and the
+ * server, and unit-tested in isolation.
+ */
+import type { GrantKeyPair } from "../types";
+/**
+ * All device key pairs on this document — active first, then revoked — in the
+ * canonical `{ signingPublicKey, encryptionPublicKey, label?, revoked?,
+ * revokedAt? }` shape (§6.5). Used by write paths that need to preserve the
+ * full device set (e.g. relabel/merge/revoke) before re-applying.
+ *
+ * For older documents that predate the canonical lists it reconstructs pairs
+ * from the parallel signing/encryption arrays (index-aligned) or the legacy
+ * scalars. De-duplicated by signing key.
+ */
+export declare function extractKeyPairs(data: Record<string, unknown>): GrantKeyPair[];
+/**
+ * The active (non-revoked) device key pairs. This is the set the server/auth
+ * treat as granting access; revoked pairs are retained on the document (in
+ * `revokedUserKeyPairs`) but excluded here (docs/accesscontrol.md §6.5).
+ */
+export declare function extractActiveKeyPairs(data: Record<string, unknown>): GrantKeyPair[];
+/**
+ * The revoked device key pairs retained on the grant document (§6.5), each
+ * carrying its `revokedAt` timestamp and optional label, so admin UIs can list
+ * "devices with revoked access" and optionally restore them.
+ */
+export declare function extractRevokedKeyPairs(data: Record<string, unknown>): GrantKeyPair[];
+/**
+ * Write the key representations onto `data` from the canonical list of pairs
+ * (§6.5). Pairs are partitioned by their `revoked` flag into two lists:
+ *
+ *  - active pairs → `userKeyPairs` (also mirrored to the legacy array/scalar
+ *    forms so older readers keep working), and
+ *  - revoked pairs → `revokedUserKeyPairs` (retained with their `revokedAt`
+ *    timestamp and label, but never mirrored to the legacy forms).
+ *
+ * Both lists are always written (possibly empty), so the document is
+ * authoritative: an empty `userKeyPairs` denotes no active devices and prevents
+ * any stale legacy form from resurrecting access. The legacy scalars are left
+ * untouched when there is no active pair. This also heals documents written in
+ * the older format (revoked pairs embedded in `userKeyPairs`) into the two-list
+ * form, since revoked pairs are routed to `revokedUserKeyPairs` here.
+ */
+export declare function applyKeyPairFields(data: Record<string, unknown>, pairs: GrantKeyPair[]): void;
+/**
+ * Merge `additional` pairs into `existing`, keyed by signing public key. A new
+ * entry with the same signing key replaces the existing one (so its encryption
+ * key and/or label are updated). Order is preserved: existing pairs first
+ * (updated in place), then brand-new pairs in input order.
+ */
+export declare function mergeKeyPairs(existing: GrantKeyPair[], additional: GrantKeyPair[]): GrantKeyPair[];
+/**
+ * All signing public keys granted by this document. Prefers `userKeyPairs`,
+ * then the `userSigningPublicKeys` array, then the legacy scalar. Returns a
+ * de-duplicated list (possibly empty, e.g. when all keys were removed to fully
+ * revoke the user).
+ */
+export declare function extractSigningPublicKeys(data: Record<string, unknown>): string[];
+/**
+ * All encryption public keys granted by this document. Prefers `userKeyPairs`,
+ * then the `userEncryptionPublicKeys` array, then the legacy scalar.
+ */
+export declare function extractEncryptionPublicKeys(data: Record<string, unknown>): string[];
+/**
+ * The primary signing/encryption key for legacy consumers that still expect a
+ * single value. Returns the first array element, else the scalar, else null.
+ */
+export declare function primarySigningPublicKey(data: Record<string, unknown>): string | null;
+export declare function primaryEncryptionPublicKey(data: Record<string, unknown>): string | null;
+/**
+ * Signing public keys whose device must wipe the local tenant on next connect
+ * (`wipeRequestedForSigningKeys`, §6.5). Self-contained key values, not
+ * references into the grant arrays.
+ */
+export declare function extractWipeRequestedSigningKeys(data: Record<string, unknown>): string[];
+//# sourceMappingURL=grantKeys.d.ts.map

package/dist/core/accesscontrol/grantKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grantKeys.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/grantKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAkG7C;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,CAK7E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,CAKnF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,CAEpF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CA6C7F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CAKlG;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAShF;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAanF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAEpF;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAEvF"}

package/dist/core/accesscontrol/grantKeys.js

@@ -0,0 +1,302 @@
+"use strict";
+/**
+ * Helpers for reading and writing the public-key fields of a `grantaccess`
+ * directory document in a way that is forward- and backward-compatible
+ * (docs/accesscontrol.md §6.5).
+ *
+ * Active devices and revoked devices live in TWO SEPARATE lists:
+ *
+ *  - `userKeyPairs`: the ACTIVE device key pairs, an array of
+ *    `{ signingPublicKey, encryptionPublicKey, label? }` objects. Pairing the
+ *    keys per device keeps a device's signing and encryption keys together and
+ *    lets each carry an optional human-readable label. This is the canonical
+ *    list the server/auth treat as granting access. Because revoked devices are
+ *    NOT in this list, any reader (old or new) that treats `userKeyPairs` as
+ *    "the keys that have access" is correct without understanding revocation.
+ *  - `revokedUserKeyPairs`: the RETAINED revoked device key pairs (§6.5), same
+ *    shape plus an optional `revokedAt` timestamp. Membership in this list — not
+ *    a per-entry flag — is what marks a device revoked. Retaining them lets
+ *    admin UIs list "devices with revoked access" and optionally restore them.
+ *
+ * For older clients that predate `userKeyPairs`, writers also mirror the ACTIVE
+ * keys into the legacy forms, read in this order of authority:
+ *
+ *  1. `userKeyPairs` (the active list above; authoritative once present).
+ *  2. `userSigningPublicKeys` / `userEncryptionPublicKeys`: two parallel string
+ *     arrays (previous form). Index-aligned by convention; no labels.
+ *  3. `userSigningPublicKey` / `userEncryptionPublicKey`: single legacy scalars
+ *     (oldest form).
+ *
+ * The most specific present form wins. Critically, a present-but-EMPTY
+ * `userKeyPairs` is authoritative (it denotes a grant with no active devices,
+ * §6.5): we must NOT fall back to a stale lower form and resurrect access that
+ * revocation removed.
+ *
+ * Writers ({@link applyKeyPairFields}) keep the legacy forms mirrored so older
+ * clients (which only understand the array or scalar forms) keep working.
+ *
+ * These functions are pure (operate on a plain data object) so they can be
+ * reused by the directory cache builder, the time-travel node builder, and the
+ * server, and unit-tested in isolation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractKeyPairs = extractKeyPairs;
+exports.extractActiveKeyPairs = extractActiveKeyPairs;
+exports.extractRevokedKeyPairs = extractRevokedKeyPairs;
+exports.applyKeyPairFields = applyKeyPairFields;
+exports.mergeKeyPairs = mergeKeyPairs;
+exports.extractSigningPublicKeys = extractSigningPublicKeys;
+exports.extractEncryptionPublicKeys = extractEncryptionPublicKeys;
+exports.primarySigningPublicKey = primarySigningPublicKey;
+exports.primaryEncryptionPublicKey = primaryEncryptionPublicKey;
+exports.extractWipeRequestedSigningKeys = extractWipeRequestedSigningKeys;
+function asStringArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((v) => typeof v === "string" && v.length > 0);
+}
+function asScalarString(value) {
+    return typeof value === "string" && value.length > 0 ? value : null;
+}
+function asLabel(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+/**
+ * The signing keys from the legacy (pre-`userKeyPairs`) representation: the
+ * `userSigningPublicKeys` array if present (authoritative even when empty),
+ * else the legacy scalar.
+ */
+function legacySigningKeys(data) {
+    if (Array.isArray(data.userSigningPublicKeys)) {
+        return Array.from(new Set(asStringArray(data.userSigningPublicKeys)));
+    }
+    const scalar = asScalarString(data.userSigningPublicKey);
+    return scalar ? [scalar] : [];
+}
+/** Encryption keys from the legacy representation (array else scalar). */
+function legacyEncryptionKeys(data) {
+    if (Array.isArray(data.userEncryptionPublicKeys)) {
+        return Array.from(new Set(asStringArray(data.userEncryptionPublicKeys)));
+    }
+    const scalar = asScalarString(data.userEncryptionPublicKey);
+    return scalar ? [scalar] : [];
+}
+/**
+ * Parse an array of `{ signingPublicKey, encryptionPublicKey, label? }` entries
+ * into {@link GrantKeyPair}s, de-duplicated by signing key. When `markRevoked`
+ * is set (parsing `revokedUserKeyPairs`), every parsed pair is marked revoked
+ * and carries its `revokedAt` timestamp.
+ */
+function parsePairEntries(value, markRevoked) {
+    if (!Array.isArray(value))
+        return [];
+    const seen = new Set();
+    const pairs = [];
+    for (const entry of value) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const rec = entry;
+        const signingPublicKey = asScalarString(rec.signingPublicKey);
+        if (!signingPublicKey || seen.has(signingPublicKey))
+            continue;
+        seen.add(signingPublicKey);
+        const encryptionPublicKey = asScalarString(rec.encryptionPublicKey) ?? "";
+        const label = asLabel(rec.label);
+        const pair = { signingPublicKey, encryptionPublicKey };
+        if (label !== undefined)
+            pair.label = label;
+        if (markRevoked) {
+            pair.revoked = true;
+            if (typeof rec.revokedAt === "number")
+                pair.revokedAt = rec.revokedAt;
+        }
+        pairs.push(pair);
+    }
+    return pairs;
+}
+/** True when the document uses the canonical two-list form (active and/or revoked). */
+function hasCanonicalKeyLists(data) {
+    return Array.isArray(data.userKeyPairs) || Array.isArray(data.revokedUserKeyPairs);
+}
+/** The active pairs from the canonical `userKeyPairs` list. */
+function canonicalActivePairs(data) {
+    return parsePairEntries(data.userKeyPairs, false);
+}
+/**
+ * The revoked pairs from the canonical `revokedUserKeyPairs` list, each marked
+ * revoked and carrying its `revokedAt` timestamp.
+ */
+function canonicalRevokedPairs(data) {
+    return parsePairEntries(data.revokedUserKeyPairs, true);
+}
+/** Reconstruct active pairs from the legacy parallel arrays / scalars by index. */
+function legacyKeyPairs(data) {
+    const signing = legacySigningKeys(data);
+    const encryption = legacyEncryptionKeys(data);
+    const seen = new Set();
+    const pairs = [];
+    signing.forEach((signingPublicKey, index) => {
+        if (seen.has(signingPublicKey))
+            return;
+        seen.add(signingPublicKey);
+        pairs.push({ signingPublicKey, encryptionPublicKey: encryption[index] ?? "" });
+    });
+    return pairs;
+}
+/**
+ * All device key pairs on this document — active first, then revoked — in the
+ * canonical `{ signingPublicKey, encryptionPublicKey, label?, revoked?,
+ * revokedAt? }` shape (§6.5). Used by write paths that need to preserve the
+ * full device set (e.g. relabel/merge/revoke) before re-applying.
+ *
+ * For older documents that predate the canonical lists it reconstructs pairs
+ * from the parallel signing/encryption arrays (index-aligned) or the legacy
+ * scalars. De-duplicated by signing key.
+ */
+function extractKeyPairs(data) {
+    if (hasCanonicalKeyLists(data)) {
+        return [...canonicalActivePairs(data), ...canonicalRevokedPairs(data)];
+    }
+    return legacyKeyPairs(data);
+}
+/**
+ * The active (non-revoked) device key pairs. This is the set the server/auth
+ * treat as granting access; revoked pairs are retained on the document (in
+ * `revokedUserKeyPairs`) but excluded here (docs/accesscontrol.md §6.5).
+ */
+function extractActiveKeyPairs(data) {
+    if (hasCanonicalKeyLists(data)) {
+        return canonicalActivePairs(data);
+    }
+    return legacyKeyPairs(data);
+}
+/**
+ * The revoked device key pairs retained on the grant document (§6.5), each
+ * carrying its `revokedAt` timestamp and optional label, so admin UIs can list
+ * "devices with revoked access" and optionally restore them.
+ */
+function extractRevokedKeyPairs(data) {
+    return canonicalRevokedPairs(data);
+}
+/**
+ * Write the key representations onto `data` from the canonical list of pairs
+ * (§6.5). Pairs are partitioned by their `revoked` flag into two lists:
+ *
+ *  - active pairs → `userKeyPairs` (also mirrored to the legacy array/scalar
+ *    forms so older readers keep working), and
+ *  - revoked pairs → `revokedUserKeyPairs` (retained with their `revokedAt`
+ *    timestamp and label, but never mirrored to the legacy forms).
+ *
+ * Both lists are always written (possibly empty), so the document is
+ * authoritative: an empty `userKeyPairs` denotes no active devices and prevents
+ * any stale legacy form from resurrecting access. The legacy scalars are left
+ * untouched when there is no active pair. This also heals documents written in
+ * the older format (revoked pairs embedded in `userKeyPairs`) into the two-list
+ * form, since revoked pairs are routed to `revokedUserKeyPairs` here.
+ */
+function applyKeyPairFields(data, pairs) {
+    const activePairs = pairs.filter((pair) => !pair.revoked);
+    const revokedPairs = pairs.filter((pair) => pair.revoked === true);
+    // Active devices: the canonical `userKeyPairs` list. No `revoked` flag is
+    // written — membership in this list is what marks a device active.
+    data.userKeyPairs = activePairs.map((pair) => {
+        const entry = {
+            signingPublicKey: pair.signingPublicKey,
+            encryptionPublicKey: pair.encryptionPublicKey,
+        };
+        if (pair.label !== undefined && pair.label.length > 0) {
+            entry.label = pair.label;
+        }
+        return entry;
+    });
+    // Revoked devices: retained in a SEPARATE list (§6.5). Membership here marks
+    // a device revoked; we keep the `revokedAt` timestamp and label for admin UIs.
+    data.revokedUserKeyPairs = revokedPairs.map((pair) => {
+        const entry = {
+            signingPublicKey: pair.signingPublicKey,
+            encryptionPublicKey: pair.encryptionPublicKey,
+        };
+        if (pair.label !== undefined && pair.label.length > 0) {
+            entry.label = pair.label;
+        }
+        if (typeof pair.revokedAt === "number") {
+            entry.revokedAt = pair.revokedAt;
+        }
+        return entry;
+    });
+    // Mirror the parallel-array form (ACTIVE only) for readers that predate
+    // userKeyPairs. A revoked device must never appear here.
+    data.userSigningPublicKeys = activePairs.map((pair) => pair.signingPublicKey);
+    data.userEncryptionPublicKeys = activePairs
+        .map((pair) => pair.encryptionPublicKey)
+        .filter((key) => key.length > 0);
+    // Keep the legacy scalars pointing at the primary (first) ACTIVE pair for the
+    // oldest readers. Only updated when at least one active pair remains.
+    if (activePairs.length > 0) {
+        data.userSigningPublicKey = activePairs[0].signingPublicKey;
+        data.userEncryptionPublicKey = activePairs[0].encryptionPublicKey;
+    }
+}
+/**
+ * Merge `additional` pairs into `existing`, keyed by signing public key. A new
+ * entry with the same signing key replaces the existing one (so its encryption
+ * key and/or label are updated). Order is preserved: existing pairs first
+ * (updated in place), then brand-new pairs in input order.
+ */
+function mergeKeyPairs(existing, additional) {
+    const merged = new Map();
+    for (const pair of existing)
+        merged.set(pair.signingPublicKey, pair);
+    for (const pair of additional)
+        merged.set(pair.signingPublicKey, pair);
+    return Array.from(merged.values());
+}
+/**
+ * All signing public keys granted by this document. Prefers `userKeyPairs`,
+ * then the `userSigningPublicKeys` array, then the legacy scalar. Returns a
+ * de-duplicated list (possibly empty, e.g. when all keys were removed to fully
+ * revoke the user).
+ */
+function extractSigningPublicKeys(data) {
+    // The canonical form is authoritative once present, even when `userKeyPairs`
+    // is empty: a grant with no active devices is how a fully-revoked user is
+    // represented (§6.5), so we must not fall back to the legacy arrays/scalars
+    // in that case. Only ACTIVE (non-revoked) pairs count.
+    if (hasCanonicalKeyLists(data)) {
+        return Array.from(new Set(extractActiveKeyPairs(data).map((pair) => pair.signingPublicKey)));
+    }
+    return legacySigningKeys(data);
+}
+/**
+ * All encryption public keys granted by this document. Prefers `userKeyPairs`,
+ * then the `userEncryptionPublicKeys` array, then the legacy scalar.
+ */
+function extractEncryptionPublicKeys(data) {
+    // See extractSigningPublicKeys: a present (even empty) canonical form is
+    // authoritative, and only ACTIVE (non-revoked) pairs count.
+    if (hasCanonicalKeyLists(data)) {
+        return Array.from(new Set(extractActiveKeyPairs(data)
+            .map((pair) => pair.encryptionPublicKey)
+            .filter((key) => key.length > 0)));
+    }
+    return legacyEncryptionKeys(data);
+}
+/**
+ * The primary signing/encryption key for legacy consumers that still expect a
+ * single value. Returns the first array element, else the scalar, else null.
+ */
+function primarySigningPublicKey(data) {
+    return extractSigningPublicKeys(data)[0] ?? null;
+}
+function primaryEncryptionPublicKey(data) {
+    return extractEncryptionPublicKeys(data)[0] ?? null;
+}
+/**
+ * Signing public keys whose device must wipe the local tenant on next connect
+ * (`wipeRequestedForSigningKeys`, §6.5). Self-contained key values, not
+ * references into the grant arrays.
+ */
+function extractWipeRequestedSigningKeys(data) {
+    return Array.from(new Set(asStringArray(data.wipeRequestedForSigningKeys)));
+}
+//# sourceMappingURL=grantKeys.js.map

package/dist/core/accesscontrol/grantKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grantKeys.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/grantKeys.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;;AA8GH,0CAKC;AAOD,sDAKC;AAOD,wDAEC;AAkBD,gDA6CC;AAQD,sCAKC;AAQD,4DASC;AAMD,kEAaC;AAMD,0DAEC;AAED,gEAEC;AAOD,0EAEC;AAzQD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAA6B;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC;AAED,0EAA0E;AAC1E,SAAS,oBAAoB,CAAC,IAA6B;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAc,EAAE,WAAoB;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,gBAAgB,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAC9D,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3B,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,GAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;QACrE,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5C,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QACxE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,IAA6B;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AACrF,CAAC;AAED,+DAA+D;AAC/D,SAAS,oBAAoB,CAAC,IAA6B;IACzD,OAAO,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,IAA6B;IAC1D,OAAO,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CAAC,IAA6B;IACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,OAAO,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,KAAK,EAAE,EAAE;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAAE,OAAO;QACvC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAAC,IAA6B;IAC3D,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,IAA6B;IACjE,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,IAA6B;IAClE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,kBAAkB,CAAC,IAA6B,EAAE,KAAqB;IACrF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAEnE,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,KAAK,GAA4B;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACnD,MAAM,KAAK,GAA4B;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,yDAAyD;IACzD,IAAI,CAAC,qBAAqB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9E,IAAI,CAAC,wBAAwB,GAAG,WAAW;SACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC;SACvC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,oBAAoB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC5D,IAAI,CAAC,uBAAuB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,QAAwB,EAAE,UAA0B;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,IAA6B;IACpE,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,uDAAuD;IACvD,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,IAA6B;IACvE,yEAAyE;IACzE,4DAA4D;IAC5D,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,qBAAqB,CAAC,IAAI,CAAC;aACxB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC;aACvC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CACnC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,IAA6B;IACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAgB,0BAA0B,CAAC,IAA6B;IACtE,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAgB,+BAA+B,CAAC,IAA6B;IAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC"}