pyric 0.0.1 → 0.1.0-alpha.7

package/dist/rules/simulator/handler.js

@@ -0,0 +1,583 @@
+import { parseToAST } from '../grammar/FirestoreParser.js';
+import { assembleExpression } from '../grammar/FirestoreAssembler.js';
+import { evaluate, UnsupportedError, TraceRecorder } from './evaluator.js';
+import { Timestamp } from './wrappers/timestamp.js';
+import { Path } from './wrappers/path.js';
+import { projectAfterState } from './project-after-state.js';
+/**
+ * Collects per-block resolution attempts as `resolveMatch` walks the
+ * match-block tree. Optional — when absent, `resolveMatch` is unchanged.
+ * The handler instantiates one per test case and attaches the resulting
+ * `attempts` array to the corresponding `TestResult.pathResolution`.
+ *
+ * Records both successful matches (the winning block) and every block
+ * the resolver considered and rejected. Used by `debug_firestore_rules`
+ * to surface "near-miss" blocks in PATH_MISMATCH diagnoses — without
+ * this trace, the agent would have to manually walk the rule AST to
+ * figure out which block was closest to the failing path.
+ */
+class PathResolutionRecorder {
+    attempts = [];
+    push(entry) {
+        this.attempts.push(entry);
+    }
+}
+/** Render a block's `PathPattern` back to source form for the trace
+ *  entry. Literal segments pass through; wildcards become `{name}`;
+ *  recursive segments become `{name=**}`. Matches the shape the agent
+ *  sees in the rules file. */
+function renderBlockPath(block) {
+    const parts = block.path.segments.map(seg => {
+        if (seg.type === 'literal')
+            return seg.value;
+        if (seg.type === 'wildcard')
+            return `{${seg.name}}`;
+        return `{${seg.name}=**}`;
+    });
+    return '/' + parts.join('/');
+}
+/**
+ * Given a document path like "chess/game1", find the matching match block
+ * in the AST. Resolves wildcards and binds path variables.
+ *
+ * When `recorder` is supplied, every block the function considers
+ * (matched or not) is logged as a `PathResolutionEntry`. Tests +
+ * `debug_firestore_rules` rely on this trace; production callers can
+ * omit it and pay zero cost.
+ */
+function resolveMatch(block, pathSegments, parentFunctions, recorder) {
+    const allFunctions = [...parentFunctions, ...block.functions];
+    // Check if this block's path pattern matches the remaining segments
+    const pattern = block.path.segments;
+    const bindings = {};
+    let consumed = 0;
+    // Track WHY we stopped — needed for the resolution trace. Default
+    // 'literal-mismatch' is overwritten before the early-return paths
+    // that have a more specific reason.
+    let failureReason;
+    for (const seg of pattern) {
+        if (seg.type === 'literal') {
+            if (consumed >= pathSegments.length) {
+                // The block path has more segments than the request supplied
+                // — distinct from a literal-mismatch even though we technically
+                // ran out of input mid-loop. Flag it for the trace before the
+                // early-return below.
+                failureReason = 'request-shorter';
+                break;
+            }
+            if (pathSegments[consumed] !== seg.value) {
+                failureReason = 'literal-mismatch';
+                break;
+            }
+            consumed++;
+        }
+        else if (seg.type === 'wildcard') {
+            if (consumed >= pathSegments.length) {
+                failureReason = 'request-shorter';
+                break;
+            }
+            bindings[seg.name] = pathSegments[consumed];
+            consumed++;
+        }
+        else if (seg.type === 'recursive') {
+            // {document=**} matches all remaining segments
+            bindings[seg.name] = pathSegments.slice(consumed).join('/');
+            consumed = pathSegments.length;
+        }
+    }
+    // If we exited the loop early with a failureReason set, this block
+    // didn't fully consume its own pattern — record + bail.
+    if (failureReason !== undefined) {
+        recorder?.push({
+            ...(block.loc ? { line: block.loc.line } : {}),
+            blockPath: renderBlockPath(block),
+            matchedSegments: consumed,
+            totalSegments: pattern.length,
+            bindings,
+            matched: false,
+            reason: failureReason,
+        });
+        return null;
+    }
+    const remaining = pathSegments.slice(consumed);
+    // If all segments consumed, this block matches directly
+    if (remaining.length === 0) {
+        recorder?.push({
+            ...(block.loc ? { line: block.loc.line } : {}),
+            blockPath: renderBlockPath(block),
+            matchedSegments: consumed,
+            totalSegments: pattern.length,
+            bindings,
+            matched: true,
+        });
+        return { block, pathVariables: bindings, parentFunctions: allFunctions };
+    }
+    // Otherwise, try children
+    for (const child of block.children) {
+        const childResult = resolveMatch(child, remaining, allFunctions, recorder);
+        if (childResult) {
+            // Parent recorded as a successful "partial" match — the child
+            // completed the resolution. Record THIS block as matched too;
+            // bindings merge happens below.
+            recorder?.push({
+                ...(block.loc ? { line: block.loc.line } : {}),
+                blockPath: renderBlockPath(block),
+                matchedSegments: consumed,
+                totalSegments: pattern.length,
+                bindings,
+                matched: true,
+            });
+            // Merge parent bindings
+            childResult.pathVariables = { ...bindings, ...childResult.pathVariables };
+            return childResult;
+        }
+    }
+    // Block consumed its own segments but no child block covered the
+    // remaining request segments. Record + bail.
+    recorder?.push({
+        ...(block.loc ? { line: block.loc.line } : {}),
+        blockPath: renderBlockPath(block),
+        matchedSegments: consumed,
+        totalSegments: pattern.length,
+        bindings,
+        matched: false,
+        reason: 'no-matching-child',
+    });
+    return null;
+}
+// ═══ Operation mapping ═══
+function methodToOperations(method) {
+    switch (method) {
+        case 'get': return ['get', 'read'];
+        case 'list': return ['list', 'read'];
+        case 'create': return ['create', 'write'];
+        case 'update': return ['update', 'write'];
+        case 'delete': return ['delete', 'write'];
+        default: return [method];
+    }
+}
+// ═══ Rule evaluation ═══
+/**
+ * Evaluate all allow rules in a match block for a given operation.
+ * Uses OR semantics — if any matching rule allows, access is granted.
+ *
+ * Decision logic:
+ *   - any rule ALLOW → ALLOW (short-circuit)
+ *   - else if any rule threw UnsupportedError → UNSUPPORTED (sim abstains)
+ *   - else → DENY
+ *
+ * Real evaluation errors (EvalError, type mismatches) are *not* lifted to
+ * UNSUPPORTED — they're caught and counted as deny, matching production's
+ * "runtime errors deny the request" behavior.
+ */
+function evaluateRules(block, operation, ctx) {
+    const ops = methodToOperations(operation);
+    const trace = [];
+    const notes = [];
+    // Find allow rules that match this operation
+    const matchingRules = [];
+    for (let i = 0; i < block.allows.length; i++) {
+        const rule = block.allows[i];
+        if (rule.operations.some(op => ops.includes(op))) {
+            matchingRules.push({ rule, index: i });
+        }
+    }
+    if (matchingRules.length === 0) {
+        notes.push(`No allow rules found for operation '${operation}'`);
+        return { decision: 'DENY', trace, notes };
+    }
+    // Evaluate each matching rule (OR semantics). Each rule gets its own
+    // TraceRecorder so the per-rule expressionTrace stays isolated even
+    // when multiple rules evaluate before a verdict lands. We attach via
+    // mutation+restore on the shared ctx — cheaper than cloning ctx for
+    // every rule and keeps wrappers' identity (Timestamp etc.) stable
+    // across the loop.
+    let sawUnsupported = false;
+    const priorRecorder = ctx.trace;
+    for (const { rule, index } of matchingRules) {
+        const entry = newEntry(rule, index);
+        const recorder = new TraceRecorder();
+        ctx.trace = recorder;
+        try {
+            const result = evaluate(rule.condition, ctx);
+            entry.expressionTrace = recorder.entries;
+            if (result) {
+                entry.verdict = 'ALLOW';
+                trace.push(entry);
+                ctx.trace = priorRecorder;
+                return { decision: 'ALLOW', trace, notes };
+            }
+            entry.verdict = 'DENY';
+            trace.push(entry);
+        }
+        catch (e) {
+            entry.expressionTrace = recorder.entries;
+            if (e instanceof UnsupportedError) {
+                sawUnsupported = true;
+                entry.verdict = 'UNSUPPORTED';
+                entry.message = e.message;
+            }
+            else {
+                entry.verdict = 'ERROR';
+                entry.message = e instanceof Error ? e.message : String(e);
+            }
+            trace.push(entry);
+        }
+    }
+    ctx.trace = priorRecorder;
+    // No rule allowed. If at least one rule abstained on a sim gap, escalate
+    // to UNSUPPORTED so the agent sees "sim couldn't decide" rather than a
+    // misleading DENY. If every failure was a real eval error, return DENY
+    // (production would also deny on runtime errors).
+    return { decision: sawUnsupported ? 'UNSUPPORTED' : 'DENY', trace, notes };
+}
+function newEntry(rule, index) {
+    const entry = {
+        ruleIndex: index,
+        operations: [...rule.operations],
+        verdict: 'DENY',
+        conditionText: assembleExpression(rule.condition),
+    };
+    if (rule.loc)
+        entry.line = rule.loc.line;
+    return entry;
+}
+// ═══ Build simulation context from TestCase ═══
+// ═══ Server timestamp sentinel ═══
+/** Sentinel value for FieldValue.serverTimestamp() in test data. */
+export const SERVER_TIMESTAMP = { __type: 'serverTimestamp' };
+function isServerTimestampSentinel(value) {
+    return typeof value === 'object' && value !== null
+        && value.__type === 'serverTimestamp';
+}
+/**
+ * Recursively replace serverTimestamp sentinels with the actual server time.
+ * Item 1.3: `serverTime` is now a Timestamp wrapper (was ISO string). The
+ * SAME instance is reused across every sentinel hit so `data.createdAt ==
+ * request.time` succeeds via rulesValuesEqual -> Timestamp.equals (field
+ * compare). Without instance reuse, two distinct Timestamp instances would
+ * still equate via field compare — but the single-instance invariant is
+ * documented here so future refactors don't break it accidentally.
+ */
+export function resolveServerTimestamps(data, serverTime) {
+    const resolved = {};
+    for (const [key, value] of Object.entries(data)) {
+        if (isServerTimestampSentinel(value)) {
+            resolved[key] = serverTime;
+        }
+        else if (isPlainObject(value)) {
+            // Only descend into plain objects ({} / Object.create(null)). After
+            // Item 1 the value tree may legitimately contain class instances
+            // (Timestamp, Bytes, LatLng, future DocumentReference) — walking
+            // them as maps would shred their prototype and break `is timestamp`,
+            // `is reference`, etc.
+            resolved[key] = resolveServerTimestamps(value, serverTime);
+        }
+        else {
+            resolved[key] = value;
+        }
+    }
+    return resolved;
+}
+function isPlainObject(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    if (Array.isArray(value))
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Populate `request.query` for `list` operations from the optional
+ * TestCase.query payload (REBUILD_PLAN.md Item 6 follow-up).
+ *
+ * Production's `request.query` exposes `limit / offset / orderBy` as
+ * always-present, NULLABLE fields on a `list` request — `request.query.limit
+ * == null` is the documented way to assert "no limit clause." So we ALWAYS
+ * expose the three keys (null when the test omits them) rather than omitting
+ * them; otherwise, after RULES-B2 (dotted-field access of a MISSING key
+ * errors), `request.query.limit` would error instead of reading null, breaking
+ * the legitimate `== null` guard. For non-list methods `request.query` is the
+ * empty map (the fields don't apply), matching production.
+ */
+function buildRequestQuery(tc) {
+    if (tc.method !== 'list')
+        return {};
+    return {
+        limit: tc.query?.limit ?? null,
+        offset: tc.query?.offset ?? null,
+        orderBy: tc.query?.orderBy ?? null,
+    };
+}
+function buildContext(tc, functions, pathVariables, getDoc) {
+    const fnMap = new Map();
+    for (const fn of functions)
+        fnMap.set(fn.name, fn);
+    const mockDocs = new Map();
+    if (tc.functionMocks) {
+        for (const mock of tc.functionMocks) {
+            if (mock.function === 'get' && typeof mock.result === 'object' && mock.result !== null) {
+                mockDocs.set(mock.path, mock.result);
+            }
+            else if (mock.function === 'exists') {
+                if (mock.result === true)
+                    mockDocs.set(mock.path, {});
+            }
+        }
+    }
+    // request.time defaults to wallclock; tc.requestTime (Item 0.F) lets
+    // tests pin a deterministic value for date-gated rules. Item 1.3
+    // flipped the in-evaluator type from ISO string to Timestamp wrapper
+    // (REBUILD_PLAN Risk 1) — `tc.requestTime` stays an ISO string for
+    // backwards-compat with the prod Test API, parsed here.
+    const serverTime = tc.requestTime
+        ? Timestamp.fromIsoString(tc.requestTime)
+        : Timestamp.fromMillis(Date.now());
+    // Item 6: build the full document path for request.path / __name__.
+    // tc.path arrives as a relative path like "users/alice"; the spec form
+    // is /databases/(default)/documents/<rel>. Strip a leading slash so we
+    // don't end up with a double slash.
+    const relPath = tc.path.startsWith('/') ? tc.path.slice(1) : tc.path;
+    const fullPathSegs = ['databases', '(default)', 'documents', ...relPath.split('/').filter(Boolean)];
+    // Pass pathVariables as bindings so `request.path.<name>` (where <name> is
+    // a wildcard from the matched rule, e.g. {uid}) returns the bound segment
+    // value instead of null. Without this, named-field access on request.path
+    // silently DENYs any rule that reads it.
+    const fullPath = new Path(fullPathSegs, pathVariables);
+    // resource.id = last segment of the relative path
+    const relSegs = relPath.split('/').filter(Boolean);
+    const docId = relSegs.length > 0 ? relSegs[relSegs.length - 1] : '';
+    // Item 7 — project the after-state.
+    //
+    // If tc.writeMode is set (Item 0.D), run projectAfterState to derive both
+    // request.resource.data and what getAfter() returns. Otherwise preserve
+    // legacy behavior where tc.data IS the after-state for create/update,
+    // tc.resource for read methods, and null for delete. The legacy fallback
+    // keeps every existing test passing while letting new tests opt into
+    // proper merge semantics.
+    const payload = tc.data ?? {};
+    const existing = tc.resource ?? null;
+    let afterState;
+    let existsAfter;
+    if (tc.writeMode) {
+        afterState = projectAfterState(tc.writeMode, existing, payload);
+        existsAfter = afterState !== null;
+    }
+    else {
+        switch (tc.method) {
+            case 'create':
+            case 'update':
+                // RULES-B10: the prod-faithful update post-state is `existing` merged
+                // with the payload. That merge IS implemented and correct on the
+                // `writeMode: { kind: 'update' }` path above (`projectAfterState`),
+                // which agent-facing `simulate()` callers should use. The legacy
+                // no-writeMode default keeps `afterState = payload`: the sandbox
+                // LocalEnvironment path ALREADY pre-merges + pre-applies deleteField()
+                // and hands us the FULL post-write doc, so re-merging here would
+                // resurrect deleted keys (RULES-B10 step doc records this cross-track
+                // coupling — making merge the unconditional default needs a coordinated
+                // T2 change to have LocalEnvironment declare its writeMode).
+                afterState = payload;
+                existsAfter = true;
+                break;
+            case 'delete':
+                afterState = null;
+                existsAfter = false;
+                break;
+            case 'get':
+            case 'list':
+            default:
+                afterState = existing; // no write happens
+                existsAfter = existing !== null;
+                break;
+        }
+    }
+    const projectedAfter = afterState !== null
+        ? resolveServerTimestamps(afterState, serverTime)
+        : null;
+    // request.resource.data: for non-write methods (get/list) Firestore exposes
+    // null. For writes, it's the projected after-state. We keep the legacy
+    // shape (`{}` when tc.data is absent) for backwards-compat — the parity
+    // packs that exercise this surface explicitly set tc.data.
+    const reqResourceData = projectedAfter ?? {};
+    return {
+        request: {
+            auth: tc.auth ? { uid: tc.auth.uid, token: tc.auth.token ?? {} } : null,
+            resource: { data: reqResourceData },
+            method: tc.method,
+            path: fullPath, // Item 6: Path wrapper, full /databases/.../documents/... form
+            query: buildRequestQuery(tc),
+            time: serverTime,
+        },
+        resource: {
+            data: existing ?? {}, // NOT resolved — resource is pre-write, no sentinels
+            id: docId, // Item 6
+            __name__: fullPath, // Item 6
+        },
+        mockDocuments: mockDocs,
+        getDoc,
+        pathVariables,
+        functions: fnMap,
+        database: '(default)',
+        // Item 7 — projected post-write state for the request target.
+        //   afterStatePath: full Path being written to (matches request.path)
+        //   afterState: post-write doc data, or null when deleted
+        //   existsAfter: false when method is delete (or projectAfterState → null)
+        afterStatePath: fullPath,
+        afterState: projectedAfter,
+        existsAfter,
+    };
+}
+// ═══ Main handler ═══
+export class SimulateFirestoreRulesHandler {
+    /**
+     * Simulate Firestore rules evaluation locally.
+     * Same interface as TestFirestoreRulesHandler.execute().
+     */
+    simulate(source, testCases, opts) {
+        // Parse rules. Give the empty-input case a distinct, actionable
+        // error — agents that see "Failed to parse rules source" otherwise
+        // hex-dump the rules file looking for invisible characters before
+        // realizing the source string is just empty (see
+        // CLAUDE_DEBUG_SESSION.md).
+        if (!source || source.trim().length === 0) {
+            return {
+                success: false,
+                error: {
+                    code: 'PARSE_FAILED',
+                    message: 'Empty rules source — call sandbox.setRules(rules) before operating, '
+                        + 'or initialize without rules to use the open-by-default ruleset. '
+                        + 'See pyric/sandbox docs.',
+                    recoverable: true,
+                },
+            };
+        }
+        const ast = parseToAST(source);
+        if (!ast) {
+            return {
+                success: false,
+                error: { code: 'PARSE_FAILED', message: 'Failed to parse rules source', recoverable: true },
+            };
+        }
+        const results = [];
+        let passed = 0;
+        let failed = 0;
+        let unsupported = 0;
+        // Resolve any wildcards on the root match (typically just one for
+        // the database segment) and bind each to '(default)'. The root
+        // wildcard can be named anything in production — `database`, `db`,
+        // `dbId` are all valid — and `get(/databases/$(name)/...)` paths
+        // inside rules expect that exact name to resolve. Previously we
+        // hardcoded `database` only, so any other name silently became
+        // `undefined` inside path interpolation and broke every `get()` /
+        // `exists()` call.
+        //
+        // `database` stays seeded as a default so rules that don't use a
+        // wildcard on the root match (or that hardcode `$(database)` in a
+        // `get()` path) still work.
+        const rootBindings = { database: '(default)' };
+        for (const seg of ast.service.match.path.segments) {
+            if (seg.type === 'wildcard') {
+                rootBindings[seg.name] = '(default)';
+            }
+        }
+        for (const tc of testCases) {
+            // Resolve the match block for this path.
+            // The root match is /databases/{database}/documents — skip it,
+            // start matching from its children directly.
+            const pathSegments = tc.path.split('/').filter(Boolean);
+            const rootFunctions = ast.service.match.functions;
+            let match = null;
+            // Fresh recorder per test case so each `TestResult.pathResolution`
+            // captures only its own resolution attempts.
+            const pathRecorder = new PathResolutionRecorder();
+            for (const child of ast.service.match.children) {
+                match = resolveMatch(child, pathSegments, rootFunctions, pathRecorder);
+                if (match)
+                    break;
+            }
+            // `list` targets a COLLECTION, but rules match blocks are document-
+            // level: real Firestore evaluates a query against the doc block with
+            // the document wildcard hypothetical (and `resource` undefined). When
+            // a collection path resolves no block directly, retry with a
+            // synthetic trailing document segment so `list menuItems` evaluates
+            // `match /menuItems/{id}` exactly like the emulator does. Doc-style
+            // list paths (`menuItems/any`) keep resolving on the first attempt,
+            // so existing call sites are unaffected. (RULES-LIST parity pack.)
+            let syntheticListDoc = false;
+            if (!match && tc.method === 'list') {
+                const widened = [...pathSegments, '__hypothetical_doc__'];
+                for (const child of ast.service.match.children) {
+                    match = resolveMatch(child, widened, rootFunctions, pathRecorder);
+                    if (match)
+                        break;
+                }
+                if (match)
+                    syntheticListDoc = true;
+            }
+            const pathResolution = {
+                requestPath: tc.path,
+                attempts: pathRecorder.attempts,
+            };
+            if (!match) {
+                // No match block at all → production default-DENY. Expectation
+                // 'DENY' agrees → PASSED; expectation 'ALLOW' disagrees → FAILED.
+                const state = tc.expectation === 'DENY' ? 'PASSED' : 'FAILED';
+                if (state === 'PASSED')
+                    passed++;
+                else
+                    failed++;
+                results.push({
+                    description: tc.description,
+                    expectation: tc.expectation,
+                    state,
+                    decision: 'DENY',
+                    trace: [],
+                    notes: [`No match block found for path '${tc.path}'`],
+                    pathResolution,
+                });
+                continue;
+            }
+            // Build context — `rootBindings` carries the root-match wildcards
+            // (e.g. `db` or `database`) so `$(name)` interpolation inside
+            // get()/exists() paths resolves regardless of which name the
+            // ruleset chose. Child match bindings override on collision (a
+            // child rule that shadows the name wins inside that scope).
+            const allFunctions = [...match.parentFunctions, ...match.block.functions];
+            const pathVars = { ...rootBindings, ...match.pathVariables };
+            const ctx = buildContext(tc, allFunctions, pathVars, opts?.getDoc);
+            // Evaluate rules
+            const { decision, trace, notes } = evaluateRules(match.block, tc.method, ctx);
+            if (syntheticListDoc) {
+                notes.push(`list on collection path '${tc.path}' evaluated against the document-level match block (document wildcard hypothetical, resource undefined) — emulator-faithful`);
+            }
+            // Compare with expectation. UNSUPPORTED is its own terminal state —
+            // not PASSED (we didn't agree, we abstained) and not FAILED (the
+            // failure is on the simulator's side, not the rule's).
+            let state;
+            if (decision === 'UNSUPPORTED') {
+                state = 'UNSUPPORTED';
+                unsupported++;
+            }
+            else if (decision === tc.expectation) {
+                state = 'PASSED';
+                passed++;
+            }
+            else {
+                state = 'FAILED';
+                failed++;
+            }
+            results.push({
+                description: tc.description,
+                expectation: tc.expectation,
+                state,
+                decision,
+                trace,
+                notes,
+                pathResolution,
+            });
+        }
+        return { success: true, data: { passed, failed, unsupported, results } };
+    }
+}
+//# sourceMappingURL=handler.js.map

package/dist/rules/simulator/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/rules/simulator/handler.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAA0B,MAAM,gBAAgB,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAY7D;;;;;;;;;;;GAWG;AACH,MAAM,sBAAsB;IACjB,QAAQ,GAA0B,EAAE,CAAC;IAC9C,IAAI,CAAC,KAA0B;QAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF;AAED;;;8BAG8B;AAC9B,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAC7C,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC;QACpD,OAAO,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CACnB,KAAiB,EACjB,YAAsB,EACtB,eAA8B,EAC9B,QAAiC;IAEjC,MAAM,YAAY,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAE9D,oEAAoE;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;IACpC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,kEAAkE;IAClE,kEAAkE;IAClE,oCAAoC;IACpC,IAAI,aAAwD,CAAC;IAE7D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;gBACpC,6DAA6D;gBAC7D,gEAAgE;gBAChE,8DAA8D;gBAC9D,sBAAsB;gBACtB,aAAa,GAAG,iBAAiB,CAAC;gBAClC,MAAM;YACR,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;gBACzC,aAAa,GAAG,kBAAkB,CAAC;gBACnC,MAAM;YACR,CAAC;YACD,QAAQ,EAAE,CAAC;QACb,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,IAAI,QAAQ,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;gBACpC,aAAa,GAAG,iBAAiB,CAAC;gBAClC,MAAM;YACR,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC5C,QAAQ,EAAE,CAAC;QACb,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACpC,+CAA+C;YAC/C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5D,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC;QACjC,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,wDAAwD;IACxD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,QAAQ,EAAE,IAAI,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC;YACjC,eAAe,EAAE,QAAQ;YACzB,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,QAAQ;YACR,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE/C,wDAAwD;IACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,QAAQ,EAAE,IAAI,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC;YACjC,eAAe,EAAE,QAAQ;YACzB,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,QAAQ;YACR,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;IAC3E,CAAC;IAED,0BAA0B;IAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC3E,IAAI,WAAW,EAAE,CAAC;YAChB,8DAA8D;YAC9D,8DAA8D;YAC9D,gCAAgC;YAChC,QAAQ,EAAE,IAAI,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC;gBACjC,eAAe,EAAE,QAAQ;gBACzB,aAAa,EAAE,OAAO,CAAC,MAAM;gBAC7B,QAAQ;gBACR,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,wBAAwB;YACxB,WAAW,CAAC,aAAa,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC;YAC1E,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,6CAA6C;IAC7C,QAAQ,EAAE,IAAI,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC;QACjC,eAAe,EAAE,QAAQ;QACzB,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,QAAQ;QACR,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,mBAAmB;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4BAA4B;AAE5B,SAAS,kBAAkB,CAAC,MAAc;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrC,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,0BAA0B;AAE1B;;;;;;;;;;;;GAYG;AACH,SAAS,aAAa,CACpB,KAAiB,EACjB,SAAiB,EACjB,GAAsB;IAEtB,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,6CAA6C;IAC7C,MAAM,aAAa,GAAyC,EAAE,CAAC;IAC/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACjD,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,uCAAuC,SAAS,GAAG,CAAC,CAAC;QAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,mBAAmB;IACnB,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC;IAChC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,aAAa,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,GAAG,QAAQ,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC7C,KAAK,CAAC,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,GAAG,CAAC,KAAK,GAAG,aAAa,CAAC;gBAC1B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC7C,CAAC;YACD,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC;YACzC,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC;gBAClC,cAAc,GAAG,IAAI,CAAC;gBACtB,KAAK,CAAC,OAAO,GAAG,aAAa,CAAC;gBAC9B,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;gBACxB,KAAK,CAAC,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,GAAG,CAAC,KAAK,GAAG,aAAa,CAAC;IAE1B,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,kDAAkD;IAClD,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe,EAAE,KAAa;IAC9C,MAAM,KAAK,GAAmB;QAC5B,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAChC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;KAClD,CAAC;IACF,IAAI,IAAI,CAAC,GAAG;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iDAAiD;AAEjD,oCAAoC;AAEpC,oEAAoE;AACpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAW,CAAC;AAEvE,SAAS,yBAAyB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;WAC5C,KAAiC,CAAC,MAAM,KAAK,iBAAiB,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA6B,EAC7B,UAAqB;IAErB,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;QAC7B,CAAC;aAAM,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,oEAAoE;YACpE,iEAAiE;YACjE,iEAAiE;YACjE,qEAAqE;YACrE,uBAAuB;YACvB,QAAQ,CAAC,GAAG,CAAC,GAAG,uBAAuB,CAAC,KAAgC,EAAE,UAAU,CAAC,CAAC;QACxF,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,EAAY;IACrC,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO;QACL,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI;QAC9B,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI;QAChC,OAAO,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,EAAY,EACZ,SAAwB,EACxB,aAAqC,EACrC,MAAyD;IAEzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,EAAE,IAAI,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC5D,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACvF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAiC,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;oBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,iEAAiE;IACjE,qEAAqE;IACrE,mEAAmE;IACnE,wDAAwD;IACxD,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW;QAC/B,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAErC,oEAAoE;IACpE,uEAAuE;IACvE,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;IACrE,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACpG,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,yCAAyC;IACzC,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IACvD,kDAAkD;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,oCAAoC;IACpC,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,qEAAqE;IACrE,0BAA0B;IAC1B,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,IAAI,IAAI,CAAC;IACrC,IAAI,UAA0C,CAAC;IAC/C,IAAI,WAAoB,CAAC;IACzB,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACjB,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChE,WAAW,GAAG,UAAU,KAAK,IAAI,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,QAAQ,CAAC;YACd,KAAK,QAAQ;gBACX,sEAAsE;gBACtE,iEAAiE;gBACjE,oEAAoE;gBACpE,iEAAiE;gBACjE,iEAAiE;gBACjE,uEAAuE;gBACvE,iEAAiE;gBACjE,sEAAsE;gBACtE,wEAAwE;gBACxE,6DAA6D;gBAC7D,UAAU,GAAG,OAAO,CAAC;gBACrB,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM;YACR,KAAK,QAAQ;gBACX,UAAU,GAAG,IAAI,CAAC;gBAClB,WAAW,GAAG,KAAK,CAAC;gBACpB,MAAM;YACR,KAAK,KAAK,CAAC;YACX,KAAK,MAAM,CAAC;YACZ;gBACE,UAAU,GAAG,QAAQ,CAAC,CAAC,mBAAmB;gBAC1C,WAAW,GAAG,QAAQ,KAAK,IAAI,CAAC;gBAChC,MAAM;QACV,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,UAAU,KAAK,IAAI;QACxC,CAAC,CAAC,uBAAuB,CAAC,UAAU,EAAE,UAAU,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,eAAe,GAAG,cAAc,IAAI,EAAE,CAAC;IAE7C,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;YACvE,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;YACnC,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,QAAQ,EAAS,+DAA+D;YACtF,KAAK,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC5B,IAAI,EAAE,UAAU;SACjB;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAG,qDAAqD;YAC5E,EAAE,EAAE,KAAK,EAAc,SAAS;YAChC,QAAQ,EAAE,QAAQ,EAAK,SAAS;SACjC;QACD,aAAa,EAAE,QAAQ;QACvB,MAAM;QACN,aAAa;QACb,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,WAAW;QACrB,8DAA8D;QAC9D,sEAAsE;QACtE,0DAA0D;QAC1D,2EAA2E;QAC3E,cAAc,EAAE,QAAQ;QACxB,UAAU,EAAE,cAAc;QAC1B,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,uBAAuB;AAEvB,MAAM,OAAO,6BAA6B;IACxC;;;OAGG;IACH,QAAQ,CACN,MAAc,EACd,SAAqB,EACrB,IAAoE;QAEpE,gEAAgE;QAChE,mEAAmE;QACnE,kEAAkE;QAClE,iDAAiD;QACjD,4BAA4B;QAC5B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EACL,sEAAsE;0BACpE,kEAAkE;0BAClE,yBAAyB;oBAC7B,WAAW,EAAE,IAAI;iBAClB;aACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,IAAI,EAAE;aAC5F,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,iEAAiE;QACjE,gEAAgE;QAChE,+DAA+D;QAC/D,kEAAkE;QAClE,mBAAmB;QACnB,EAAE;QACF,iEAAiE;QACjE,kEAAkE;QAClE,4BAA4B;QAC5B,MAAM,YAAY,GAA2B,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QACvE,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClD,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC5B,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;YACvC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,yCAAyC;YACzC,+DAA+D;YAC/D,6CAA6C;YAC7C,MAAM,YAAY,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YAClD,IAAI,KAAK,GAAuB,IAAI,CAAC;YACrC,mEAAmE;YACnE,6CAA6C;YAC7C,MAAM,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;YAClD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC/C,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;gBACvE,IAAI,KAAK;oBAAE,MAAM;YACnB,CAAC;YACD,oEAAoE;YACpE,qEAAqE;YACrE,sEAAsE;YACtE,6DAA6D;YAC7D,oEAAoE;YACpE,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,IAAI,gBAAgB,GAAG,KAAK,CAAC;YAC7B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,EAAE,sBAAsB,CAAC,CAAC;gBAC1D,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAC/C,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;oBAClE,IAAI,KAAK;wBAAE,MAAM;gBACnB,CAAC;gBACD,IAAI,KAAK;oBAAE,gBAAgB,GAAG,IAAI,CAAC;YACrC,CAAC;YACD,MAAM,cAAc,GAAwB;gBAC1C,WAAW,EAAE,EAAE,CAAC,IAAI;gBACpB,QAAQ,EAAE,YAAY,CAAC,QAAQ;aAChC,CAAC;YAEF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,+DAA+D;gBAC/D,kEAAkE;gBAClE,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC9D,IAAI,KAAK,KAAK,QAAQ;oBAAE,MAAM,EAAE,CAAC;;oBAAM,MAAM,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC;oBACX,WAAW,EAAE,EAAE,CAAC,WAAW;oBAC3B,WAAW,EAAE,EAAE,CAAC,WAAW;oBAC3B,KAAK;oBACL,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,EAAE;oBACT,KAAK,EAAE,CAAC,kCAAkC,EAAE,CAAC,IAAI,GAAG,CAAC;oBACrD,cAAc;iBACf,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,kEAAkE;YAClE,8DAA8D;YAC9D,6DAA6D;YAC7D,+DAA+D;YAC/D,4DAA4D;YAC5D,MAAM,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC,eAAe,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC1E,MAAM,QAAQ,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAEnE,iBAAiB;YACjB,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9E,IAAI,gBAAgB,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CACR,4BAA4B,EAAE,CAAC,IAAI,6HAA6H,CACjK,CAAC;YACJ,CAAC;YAED,oEAAoE;YACpE,iEAAiE;YACjE,uDAAuD;YACvD,IAAI,KAA0C,CAAC;YAC/C,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC/B,KAAK,GAAG,aAAa,CAAC;gBACtB,WAAW,EAAE,CAAC;YAChB,CAAC;iBAAM,IAAI,QAAQ,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;gBACvC,KAAK,GAAG,QAAQ,CAAC;gBACjB,MAAM,EAAE,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,QAAQ,CAAC;gBACjB,MAAM,EAAE,CAAC;YACX,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,KAAK;gBACL,QAAQ;gBACR,KAAK;gBACL,KAAK;gBACL,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;IAC3E,CAAC;CACF"}

package/dist/rules/simulator/mapdiff.d.ts

@@ -0,0 +1,29 @@
+/**
+ * MapDiff implementation for Firestore rules simulation.
+ *
+ * Implements request.resource.data.diff(resource.data) which returns
+ * a MapDiff object with methods for comparing two document states.
+ *
+ * Semantics derived from production Firestore behavior:
+ * - Only compares top-level keys (nested map diff is unreliable in production)
+ * - Values are compared with Firestore Rules value equality
+ * - Returns Set-like objects with hasOnly(), hasAll(), hasAny(), size()
+ */
+import { FirestoreSet } from './firestore-set.js';
+export { FirestoreSet } from './firestore-set.js';
+export declare class MapDiff {
+    private before;
+    private after;
+    constructor(before: Record<string, unknown>, after: Record<string, unknown>);
+    /** Keys present in `after` but not in `before`. */
+    addedKeys(): FirestoreSet;
+    /** Keys present in `before` but not in `after`. */
+    removedKeys(): FirestoreSet;
+    /** Keys present in both but with different values. */
+    changedKeys(): FirestoreSet;
+    /** Keys that were added, removed, or changed. Union of added + removed + changed. */
+    affectedKeys(): FirestoreSet;
+    /** Keys present in both with identical values. */
+    unchangedKeys(): FirestoreSet;
+}
+//# sourceMappingURL=mapdiff.d.ts.map

package/dist/rules/simulator/mapdiff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapdiff.d.ts","sourceRoot":"","sources":["../../../src/rules/simulator/mapdiff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qBAAa,OAAO;IAClB,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,KAAK,CAA0B;gBAE3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAK3E,mDAAmD;IACnD,SAAS,IAAI,YAAY;IAQzB,mDAAmD;IACnD,WAAW,IAAI,YAAY;IAQ3B,sDAAsD;IACtD,WAAW,IAAI,YAAY;IAU3B,qFAAqF;IACrF,YAAY,IAAI,YAAY;IAW5B,kDAAkD;IAClD,aAAa,IAAI,YAAY;CAS9B"}