{"version":3,"sources":["../src/index.ts","../src/harness.ts","../src/derive.ts","../src/verify.ts","../src/rls.ts","../src/conformance.ts","../src/read-coercion.ts"],"sourcesContent":["// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n//\n// @objectstack/verify — public API.\n//\n// Boot any ObjectStack app in-process and verify it through the real HTTP\n// stack. Two proof families, both app-agnostic (derived from your metadata):\n// - data fidelity : runCrudVerification — author → write → read → assert\n// - authorization : runRlsProofs — \"you can't write what you can't read\"\n\nexport { bootStack } from './harness.js';\nexport type { VerifyStack, BootOptions } from './harness.js';\n\nexport { deriveCrudCases, fillRelationalRefs } from './derive.js';\nexport type { CrudCase, DerivedAssert, AssertKind, RelationalRef } from './derive.js';\n\nexport { runCrudVerification, formatReport } from './verify.js';\nexport type { VerifyReport, ObjectVerifyResult } from './verify.js';\n\nexport { runRlsProofs, formatRlsReport } from './rls.js';\nexport type { RlsReport, RlsResult } from './rls.js';\n\n// ADR-0060 — reusable conformance-ledger helper (static complement to the\n// runtime harness): classify every declarable property, fail closed on drift.\nexport { checkLedger } from './conformance.js';\nexport type { ConformanceRow, ConformanceState, CheckLedgerOptions } from './conformance.js';\n\n// Driver read-coercion conformance: a stored value must read back as its\n// declared type on every driver (the case_escalation `1 != true` invariant).\n// Driver-agnostic — any driver, including out-of-tree ones, runs the same check.\nexport { checkReadCoercion } from './read-coercion.js';\nexport type { CoercibleDriver, ReadCoercionOptions } from './read-coercion.js';\n","// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n//\n// @objectstack/verify — boot harness.\n//\n// Boots a real ObjectStack app **in-process** against an in-memory SQLite\n// database, wired with the same service plugins `objectstack dev` loads, and\n// exposes the live HTTP surface via Hono's request-injection (no port, no\n// sockets — CI-stable). A verifier then exercises the app exactly as a browser\n// client would: sign in, hit `/api/v1/...`, assert on real responses.\n//\n// Why in-process + real HTTP: a whole class of regressions only surfaces when\n// the real engine + strategies + services + REST context run together — each\n// layer can be individually correct (and individually mocked in unit tests) yet\n// break at the seams (e.g. timezone date-bucketing across analytics strategy,\n// in-memory aggregation, and the REST execution context). This harness runs the\n// integrated stack so those breaks are observable.\n//\n// Posture: development / in-memory. `NODE_ENV` is forced to `development` so the\n// auth plugin's dev-admin bootstrap provisions a known, loginable admin (mirrors\n// `objectstack dev`). This is a verification harness — it never touches a real\n// database or production data.\n\nimport { ObjectKernel, AppPlugin, DriverPlugin, createDispatcherPlugin } from '@objectstack/runtime';\nimport { ObjectQLPlugin } from '@objectstack/objectql';\nimport { SqliteWasmDriver } from '@objectstack/driver-sqlite-wasm';\nimport { HonoServerPlugin } from '@objectstack/plugin-hono-server';\nimport { createRestApiPlugin } from '@objectstack/rest';\nimport { AuthPlugin } from '@objectstack/plugin-auth';\nimport { SecurityPlugin } from '@objectstack/plugin-security';\nimport { SharingServicePlugin } from '@objectstack/plugin-sharing';\nimport { SettingsServicePlugin, LocalCryptoProvider } from '@objectstack/service-settings';\nimport { AnalyticsServicePlugin } from '@objectstack/service-analytics';\n\n/** A Hono app exposes `.request(path, init)` returning a standard `Response`. */\ninterface InjectableApp {\n request(input: string, init?: RequestInit): Promise;\n}\n\nconst API_PREFIX = '/api/v1';\nconst DEFAULT_ADMIN_EMAIL = 'admin@objectos.ai';\nconst DEFAULT_ADMIN_PASSWORD = 'admin123';\nconst DEFAULT_AUTH_SECRET = 'objectstack-verify-secret';\n\nexport interface VerifyStack {\n /** The booted kernel — for direct service calls when bypassing HTTP is intentional. */\n kernel: ObjectKernel;\n /** Inject an HTTP request through the real Hono app (no socket). Path is relative to `/api/v1`. */\n api(path: string, init?: RequestInit): Promise;\n /** Inject a request at an absolute path (e.g. `/api/settings/...`). */\n raw(path: string, init?: RequestInit): Promise;\n /** Sign in through the real auth route; returns a bearer token. Defaults to the dev admin. */\n signIn(email?: string, password?: string): Promise;\n /** Sign up a NEW user through the real auth route; returns their bearer token.\n * The first user is the seeded dev admin, so a fresh sign-up is a plain member\n * (no roles/grants) — exactly what RLS cross-owner proofs need. */\n signUp(email: string, password?: string, name?: string): Promise;\n /** Convenience: an authed JSON request relative to `/api/v1`. */\n apiAs(token: string, method: string, path: string, body?: unknown): Promise;\n /** Tear down the kernel (close DB / HTTP handles). */\n stop(): Promise;\n}\n\nexport interface BootOptions {\n /** Override the dev admin credentials the harness signs in with. */\n admin?: { email: string; password: string };\n /** Override the auth signing secret. Defaults to a fixed in-process dev secret. */\n authSecret?: string;\n /**\n * Override the SecurityPlugin instance. Pass a `new SecurityPlugin({...})`\n * to carry a custom `fallbackPermissionSet` / extra permission sets — this\n * is how an owner-isolated RLS fixture makes a fresh member fall back to a\n * permission set that carries `RLS.ownerPolicy(...)` instead of the broad-read\n * `member_default`. Defaults to a vanilla `new SecurityPlugin()`.\n */\n security?: SecurityPlugin;\n /**\n * Boot multi-tenant: register `@objectstack/plugin-org-scoping` BEFORE the\n * SecurityPlugin so the wildcard `organization_id` RLS policies that ship in\n * the default permission sets actually apply (SecurityPlugin probes the\n * `org-scoping` service once at start and otherwise STRIPS them — see\n * `collectRLSPolicies`). This exercises the org-scoped isolation real apps\n * rely on, rather than the single-tenant default where every tenant policy is\n * stripped and a member sees every row. Default `false`.\n */\n multiTenant?: boolean;\n /**\n * Register `@objectstack/service-automation` so authored flows execute against\n * the real stack. The plugin seeds the built-in node executors and, at start(),\n * pulls every flow in the app config from the ObjectQL registry and registers\n * it — so `POST /api/v1/automation/:name/trigger` actually runs the flow's\n * nodes. Without this the dispatcher's automation routes resolve no `automation`\n * service and flow execution is unreachable. Opt-in (like `multiTenant`) so the\n * default boot stays lean for apps that don't exercise flows. Default `false`.\n */\n automation?: boolean;\n}\n\n/**\n * Boot an app config in-process and return a live verification stack.\n *\n * `NODE_ENV` is forced to `development` so the auth plugin's dev-admin\n * bootstrap provisions a known, loginable admin (mirrors `objectstack dev`).\n */\nexport async function bootStack(\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n config: any,\n opts: BootOptions = {},\n): Promise {\n process.env.NODE_ENV = 'development';\n\n const kernel = new ObjectKernel();\n\n // Data engine + in-memory SQLite (pure-JS WASM driver — no native build, CI-safe).\n await kernel.use(new ObjectQLPlugin());\n await kernel.use(new DriverPlugin(new SqliteWasmDriver({ filename: ':memory:' })));\n\n // HTTP server (registers the `http-server` IHttpServer service the REST +\n // dispatcher plugins mount their routes onto). Port 0 = ephemeral; we never\n // hit the socket — requests are injected through the Hono app directly.\n await kernel.use(new HonoServerPlugin({ port: 0 }));\n\n // The app under test (objects, datasets, cubes, flows, seed data).\n await kernel.use(new AppPlugin(config));\n\n // Service plugins `objectstack dev` auto-loads for an app of this shape.\n await kernel.use(new SettingsServicePlugin());\n await kernel.use(new AnalyticsServicePlugin());\n await kernel.use(new AuthPlugin({ secret: opts.authSecret ?? DEFAULT_AUTH_SECRET }));\n\n // ADR-0062 — datasource connection service (registers 'datasource-connection'),\n // mirroring `objectstack dev`/serve. Without it, AppPlugin's declared-datasource\n // auto-connect (D1/D2) degrades and a federated app would need an `onEnable`\n // driver bridge — so this is what exercises the no-`onEnable` federation path\n // end-to-end in the dogfood gate. Wired only when the app declares datasources\n // (so the vast majority of apps are unaffected); the D2 gate then leaves\n // managed/unrouted datasources metadata-only (e.g. app-crm — unchanged).\n {\n const dsDefs = (config as { datasources?: unknown }).datasources;\n const declaresDatasources = Array.isArray(dsDefs)\n ? dsDefs.length > 0\n : !!dsDefs && typeof dsDefs === 'object' && Object.keys(dsDefs).length > 0;\n if (declaresDatasources) {\n const { DatasourceAdminServicePlugin, createDefaultDatasourceDriverFactory } = await import(\n '@objectstack/service-datasource'\n );\n await kernel.use(new DatasourceAdminServicePlugin({ driverFactory: createDefaultDatasourceDriverFactory() }));\n }\n }\n\n // Multi-tenant: org-scoping MUST register BEFORE SecurityPlugin — the latter\n // probes the `org-scoping` service exactly once at start and caches it, then\n // keeps (vs strips) the wildcard `organization_id` RLS policies accordingly.\n // Mirrors the CLI's ordering for `OS_MULTI_ORG_ENABLED`.\n if (opts.multiTenant) {\n const { OrgScopingPlugin } = await import('@objectstack/plugin-org-scoping');\n await kernel.use(new OrgScopingPlugin());\n }\n\n // Automation service — opt-in. Registered before bootstrap so its start()\n // phase pulls the app's flows from the ObjectQL registry (populated by\n // AppPlugin.init) and registers them. `memory` suspended-run store keeps the\n // harness free of any manifest/persistence dependency for flow execution.\n if (opts.automation) {\n const { AutomationServicePlugin } = await import('@objectstack/service-automation');\n await kernel.use(new AutomationServicePlugin({ suspendedRunStore: 'memory' }));\n }\n\n await kernel.use(opts.security ?? new SecurityPlugin());\n // Sharing service — apps that declare `requires: ['sharing']` rely on it for\n // record-share grants; without it their RLS/sharing rules are inert and the\n // verifier would under-report authorization.\n await kernel.use(new SharingServicePlugin());\n\n // REST + dispatcher route surfaces (mount onto the http-server service).\n // No `requireAuth` override: the harness deliberately boots on the platform\n // DEFAULT (secure-by-default deny, ADR-0056 D2) so every dogfood proof —\n // anonymous-deny, public-form survival, share-links — exercises the posture\n // a fresh production deployment actually gets.\n await kernel.use(createRestApiPlugin({}));\n await kernel.use(createDispatcherPlugin({}));\n\n // Fire the ready lifecycle: seed data, dev-admin bootstrap, route registration.\n await kernel.bootstrap();\n\n // Secret fields (Field.secret) refuse to persist without a crypto provider —\n // mirror `objectstack dev`, which wires LocalCryptoProvider in development so\n // an app with an encrypted field is exercisable end-to-end.\n try {\n const engine = await kernel.getServiceAsync<{ setCryptoProvider?: (p: unknown) => void }>('objectql');\n if (engine && typeof engine.setCryptoProvider === 'function') {\n engine.setCryptoProvider(new LocalCryptoProvider());\n }\n } catch {\n /* no engine / no crypto support — secret fields will fail closed, as in prod */\n }\n\n const httpServer = await kernel.getServiceAsync<{ getRawApp(): InjectableApp; close?(): Promise }>(\n 'http-server',\n );\n const app = httpServer.getRawApp();\n\n // Same-origin loopback base for request-injection. A *ported* localhost origin\n // matches better-auth's default dev trusted-origins set (`http://localhost:*`),\n // so the in-process dev-admin sign-in passes the CSRF origin check regardless\n // of runtime (a bare `node` CLI vs a test runner) or ambient CORS env. A\n // path-only inject yields `http://localhost` (no port), which does NOT match\n // the `:*` wildcard and gets a 403. Routing is by path; the host:port only\n // shapes `new URL(request.url).origin`, which the auth layer reads.\n const ORIGIN = 'http://localhost:3000';\n const raw = (path: string, init?: RequestInit) => app.request(`${ORIGIN}${path}`, init);\n const api = (path: string, init?: RequestInit) => raw(`${API_PREFIX}${path}`, init);\n\n const admin = opts.admin ?? { email: DEFAULT_ADMIN_EMAIL, password: DEFAULT_ADMIN_PASSWORD };\n\n const signIn = async (\n email: string = admin.email,\n password: string = admin.password,\n ): Promise => {\n const res = await api('/auth/sign-in/email', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ email, password }),\n });\n if (!res.ok) {\n throw new Error(`verify signIn failed: ${res.status} ${await res.text()}`);\n }\n const data = (await res.json()) as { token?: string };\n if (!data.token) throw new Error('verify signIn: no token in response');\n return data.token;\n };\n\n const signUp = async (\n email: string,\n password = 'Member-Pass-123',\n name?: string,\n ): Promise => {\n const res = await api('/auth/sign-up/email', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ email, password, name: name ?? email.split('@')[0] }),\n });\n if (!res.ok) {\n throw new Error(`verify signUp failed: ${res.status} ${await res.text()}`);\n }\n const data = (await res.json()) as { token?: string };\n if (!data.token) throw new Error('verify signUp: no token in response');\n return data.token;\n };\n\n const apiAs = (token: string, method: string, path: string, body?: unknown) =>\n api(path, {\n method,\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${token}`,\n },\n ...(body !== undefined ? { body: JSON.stringify(body) } : {}),\n });\n\n const stop = async () => {\n try {\n await httpServer.close?.();\n } catch {\n /* best-effort */\n }\n try {\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n await (kernel as any).shutdown?.();\n } catch {\n /* best-effort */\n }\n };\n\n return { kernel, api, raw, signIn, signUp, apiAs, stop };\n}\n","// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n//\n// Metadata-driven proof derivation.\n//\n// The platform's apps are 100% declarative metadata, so a baseline runtime\n// contract can be DERIVED from the metadata itself — no hand-written tests. This\n// is the seed of `objectstack verify`: point it at any app (a framework example\n// OR a third-party app like hotcrm) and it auto-generates \"author this object →\n// write it → read it back → assert type fidelity\" for every object, then runs\n// it against the real in-process stack.\n//\n// v0 derived per-object CRUD round-trip cases and SKIPPED any object with a\n// required relation (lookup / master_detail) — it had no target id to write.\n// v1 (ADR-0055 P0) closes that gap with RELATED-RECORD TOPOLOGICAL SYNTHESIS:\n// build the object dependency graph from required relational fields, topologically\n// order it (targets before dependents), and have the runner thread real ids — so\n// relationship-dense objects (the core of real apps) are verified, not skipped.\n// What it still can't satisfy (required-reference cycles, external/missing targets)\n// is reported `blocked` with a precise reason — the gate stays honest.\n\n/* eslint-disable @typescript-eslint/no-explicit-any */\n\nconst COMPUTED = new Set(['formula', 'summary', 'autonumber', 'rollup', 'vector']);\nconst RELATIONAL = new Set(['lookup', 'master_detail', 'master-detail', 'masterdetail', 'tree']);\nconst STRUCTURED = new Set(['composite', 'repeater', 'record', 'location', 'address']);\nconst MEDIA = new Set(['image', 'file', 'avatar', 'video', 'audio', 'signature', 'qrcode']);\nconst SYSTEM_NAMES = new Set([\n 'id', 'created_at', 'updated_at', 'created_by', 'updated_by', 'owner',\n 'space', 'instance_state', 'record_id', 'is_deleted',\n]);\n\nexport type AssertKind = 'equal' | 'set' | 'none';\nexport interface DerivedAssert {\n field: string;\n type: string;\n value: unknown;\n kind: AssertKind;\n}\n/** A relational field to fill with a real target id at run time (threaded by the runner). */\nexport interface RelationalRef {\n field: string; // the FK field key on this object\n target: string; // the referenced object name\n required: boolean;\n multiple: boolean; // store as an array of ids\n}\nexport interface CrudCase {\n object: string;\n blocked?: string; // why this object can't be auto-CRUD'd (e.g. required-reference cycle)\n body?: Record;\n asserts?: DerivedAssert[];\n skippedFields?: Array<{ name: string; type: string; reason: string }>;\n relationalRefs?: RelationalRef[]; // resolved against created-record ids by the runner\n}\n\nfunction clampNum(f: any, fallback: number): number {\n const { min, max, step } = f;\n let v = fallback;\n if (typeof min === 'number' && v < min) v = min;\n if (typeof max === 'number' && v > max) v = max;\n if (typeof step === 'number' && typeof min === 'number') {\n v = min + step * Math.round((v - min) / step);\n }\n return v;\n}\n\n/** Synthesize a valid value for a field type, or null if not synthesizable. */\nfunction synth(type: string, f: any): { value: unknown; kind: AssertKind } | null {\n switch (type) {\n case 'text': case 'textarea': case 'string':\n case 'markdown': case 'html': case 'richtext': case 'code':\n return { value: 'verify-sample', kind: 'equal' };\n case 'email': return { value: 'verify@example.com', kind: 'equal' };\n case 'url': return { value: 'https://example.com', kind: 'equal' };\n case 'phone': return { value: '+14155550100', kind: 'equal' };\n case 'color': return { value: '#3366CC', kind: 'equal' };\n case 'number': return { value: clampNum(f, 7), kind: 'equal' };\n case 'currency': return { value: clampNum(f, 100), kind: 'equal' };\n case 'percent': return { value: clampNum(f, 50), kind: 'equal' };\n case 'rating': return { value: clampNum(f, Math.min(3, f.max ?? 5)), kind: 'equal' };\n case 'slider': case 'progress': return { value: clampNum(f, 25), kind: 'equal' };\n case 'boolean': case 'toggle': return { value: true, kind: 'equal' };\n case 'date': return { value: '2024-03-15', kind: 'equal' };\n case 'datetime': return { value: '2024-03-15T08:30:00.000Z', kind: 'equal' };\n case 'time': return { value: '14:30:00', kind: 'equal' };\n case 'json': return { value: { sample: true }, kind: 'equal' };\n case 'select': case 'radio': {\n const opt = f.options?.[0]?.value;\n return opt != null ? { value: opt, kind: 'equal' } : null;\n }\n case 'multiselect': case 'checkboxes': {\n const opt = f.options?.[0]?.value;\n return opt != null ? { value: [opt], kind: 'set' } : null;\n }\n case 'tags': return { value: ['alpha', 'beta'], kind: 'set' };\n // Opaque-on-read: write a value but don't assert a round-trip (hashed/encrypted).\n case 'password': case 'secret': return { value: 'Sample-Secret-123', kind: 'none' };\n default: return null;\n }\n}\n\n/** The target object a relational field references (snake_case object name), or null. */\nfunction relationTarget(f: any): string | null {\n const ref = f?.reference ?? f?.reference_to ?? f?.referenceTo;\n return typeof ref === 'string' && ref.length > 0 ? ref : null;\n}\n\ninterface Draft {\n name: string;\n body: Record;\n asserts: DerivedAssert[];\n skippedFields: Array<{ name: string; type: string; reason: string }>;\n relationalRefs: RelationalRef[];\n requiredTargets: string[]; // referenced objects that MUST exist + be ordered-before\n blocked?: string;\n}\n\n/**\n * Derive one CRUD round-trip case per authorable object, in DEPENDENCY ORDER.\n *\n * Required relational fields no longer block the object outright: the referenced\n * target is created first (topological order) and the runner threads its real id\n * in. Only genuinely unsatisfiable shapes are `blocked`:\n * - a required relation whose target is missing from the app config (external), or\n * - a required-reference cycle (incl. a required self-reference), or\n * - a required relation whose target is itself blocked (cascade), or\n * - a required non-relational field that can't be synthesized (unchanged from v0).\n */\nexport function deriveCrudCases(config: any): CrudCase[] {\n const objects: any[] = config?.objects ?? [];\n const byName = new Map();\n for (const o of objects) if (o?.name) byName.set(o.name, o);\n const dsByName = new Map();\n for (const ds of (config?.datasources ?? [])) if (ds?.name) dsByName.set(ds.name, ds);\n\n const drafts = new Map();\n\n // ── Pass 1: per-object field classification ───────────────────────────────\n for (const obj of objects) {\n if (!obj?.name) continue;\n const fields: Record = obj?.fields ?? {};\n const d: Draft = {\n name: obj.name, body: {}, asserts: [], skippedFields: [], relationalRefs: [], requiredTargets: [],\n };\n\n // Federated (external) objects are read-only unless BOTH the datasource and\n // the object opt into writes (ADR-0015 write gate). The CRUD probe insert is\n // correctly rejected by the gate for them, so mark the case blocked (skipped)\n // rather than letting a guaranteed-rejected insert surface as a failure.\n if (obj.external) {\n const ds = obj.datasource ? dsByName.get(obj.datasource) : undefined;\n const writable = ds?.external?.allowWrites === true && obj.external?.writable === true;\n if (!writable) {\n d.blocked = `external read-only object (federated datasource \"${obj.datasource ?? 'default'}\"; no inserts)`;\n drafts.set(obj.name, d);\n continue;\n }\n }\n\n for (const [name, f] of Object.entries(fields)) {\n const type = String((f as any)?.type ?? '').toLowerCase();\n const isRequired = !!(f as any)?.required;\n if (SYSTEM_NAMES.has(name) || (f as any)?.system || (f as any)?.readonly) continue;\n if (COMPUTED.has(type)) continue;\n\n if (RELATIONAL.has(type)) {\n const target = relationTarget(f);\n if (!target) {\n if (isRequired) { d.blocked = `required ${type} field \"${name}\" has no \\`reference\\` target`; break; }\n d.skippedFields.push({ name, type, reason: 'relation-missing-reference' });\n continue;\n }\n if (!byName.has(target)) {\n // External / cross-app target — we can't synthesize a record for it.\n if (isRequired) { d.blocked = `required ${type} field \"${name}\" → target \"${target}\" not in app config`; break; }\n d.skippedFields.push({ name, type, reason: `relation-target-external:${target}` });\n continue;\n }\n d.relationalRefs.push({ field: name, target, required: isRequired, multiple: !!(f as any)?.multiple });\n if (isRequired) d.requiredTargets.push(target);\n continue;\n }\n\n if (STRUCTURED.has(type) || MEDIA.has(type)) {\n if (isRequired) { d.blocked = `required ${type} field \"${name}\" (needs structured/media value)`; break; }\n d.skippedFields.push({ name, type, reason: 'unsynthesizable-optional' });\n continue;\n }\n\n const s = synth(type, f);\n if (!s) {\n if (isRequired) { d.blocked = `required field \"${name}\" of type \"${type}\" is not synthesizable`; break; }\n d.skippedFields.push({ name, type, reason: 'no-synth' });\n continue;\n }\n d.body[name] = s.value;\n if (s.kind !== 'none') d.asserts.push({ field: name, type, value: s.value, kind: s.kind });\n }\n\n drafts.set(obj.name, d);\n }\n\n // ── Pass 2: cascade-block on missing/blocked required targets (to fixpoint) ─\n let changed = true;\n while (changed) {\n changed = false;\n for (const d of drafts.values()) {\n if (d.blocked) continue;\n for (const t of d.requiredTargets) {\n const td = drafts.get(t);\n if (!td || td.blocked) {\n d.blocked = `required relational target \"${t}\" is ${!td ? 'missing' : 'not synthesizable'}`;\n changed = true;\n break;\n }\n }\n }\n }\n\n // ── Pass 3: topological order (targets before dependents) over required edges ─\n const emitted = new Set();\n const order: string[] = [];\n const live = [...drafts.values()].filter((d) => !d.blocked).map((d) => d.name);\n let progress = true;\n while (progress) {\n progress = false;\n for (const name of live) {\n if (emitted.has(name)) continue;\n const d = drafts.get(name)!;\n if (d.requiredTargets.every((t) => emitted.has(t))) {\n emitted.add(name);\n order.push(name);\n progress = true;\n }\n }\n }\n // Residue = a required-reference cycle (incl. required self-reference).\n for (const name of live) {\n if (!emitted.has(name)) drafts.get(name)!.blocked = 'unsatisfiable required-reference cycle';\n }\n\n // ── Assemble: ordered live cases first, then blocked ones ──────────────────\n const cases: CrudCase[] = [];\n for (const name of order) {\n const d = drafts.get(name)!;\n cases.push({\n object: d.name,\n body: d.body,\n asserts: d.asserts,\n skippedFields: d.skippedFields,\n ...(d.relationalRefs.length ? { relationalRefs: d.relationalRefs } : {}),\n });\n }\n for (const d of drafts.values()) {\n if (d.blocked) cases.push({ object: d.name, blocked: d.blocked });\n }\n return cases;\n}\n\n/**\n * Resolve a case's relational fields against the registry of already-created\n * record ids, returning the body to POST. When a REQUIRED target has no created\n * record (its own creation failed at run time), returns a `missing` reason so the\n * caller can skip rather than POST an invalid body.\n */\nexport function fillRelationalRefs(\n c: CrudCase,\n created: Map,\n): { body: Record; missing?: string } {\n const body: Record = { ...(c.body ?? {}) };\n for (const ref of c.relationalRefs ?? []) {\n const id = created.get(ref.target);\n if (id == null) {\n if (ref.required) return { body, missing: `required relation \"${ref.field}\" → no created \"${ref.target}\" record` };\n continue; // optional: leave unset\n }\n body[ref.field] = ref.multiple ? [id] : id;\n }\n return { body };\n}\n","// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n//\n// The verify runner — executes derived proofs against a live dogfood stack.\n//\n// This is what a consumer (a framework example OR a third-party app like hotcrm)\n// would run: boot my app in-process, auto-derive a runtime contract from my\n// metadata, exercise it through the real HTTP surface, and tell me where the\n// declared behavior doesn't actually hold at runtime.\n\n/* eslint-disable @typescript-eslint/no-explicit-any */\n\nimport type { VerifyStack } from './harness.js';\nimport { deriveCrudCases, fillRelationalRefs, type CrudCase } from './derive.js';\n\nexport interface ObjectVerifyResult {\n object: string;\n status: 'verified' | 'fidelity-gaps' | 'create-failed' | 'read-failed' | 'skipped' | 'needs-fixture';\n checked?: number;\n reason?: string;\n code?: number;\n detail?: string;\n mismatches?: Array<{ field: string; type: string; wrote: unknown; read: unknown }>;\n}\n\nexport interface VerifyReport {\n app: string;\n results: ObjectVerifyResult[];\n summary: {\n objects: number;\n verified: number;\n fidelityGaps: number;\n createFailed: number;\n needsFixture: number;\n readFailed: number;\n skipped: number;\n mismatchTotal: number;\n };\n}\n\nfunction setEqual(a: unknown, b: unknown[]): boolean {\n if (!Array.isArray(a)) return false;\n return JSON.stringify([...a].sort()) === JSON.stringify([...b].sort());\n}\nfunction deepEqual(a: unknown, b: unknown): boolean {\n return JSON.stringify(a) === JSON.stringify(b);\n}\n\n/**\n * Run auto-derived CRUD round-trip proofs for every object in `config`, as the\n * authenticated `token`, against the live `stack`. Returns a structured report;\n * never throws on a per-object failure (collects them).\n */\nexport async function runCrudVerification(\n stack: VerifyStack,\n token: string,\n config: any,\n): Promise {\n const cases = deriveCrudCases(config);\n const results: ObjectVerifyResult[] = [];\n // Registry of created record ids, threaded so a dependent object's required\n // relation is filled with a real target id (topological order guarantees the\n // target was created first). One instance per object — reused across refs.\n const createdIds = new Map();\n\n for (const c of cases as CrudCase[]) {\n if (c.blocked) {\n results.push({ object: c.object, status: 'skipped', reason: c.blocked });\n continue;\n }\n const { body, missing } = fillRelationalRefs(c, createdIds);\n if (missing) {\n results.push({ object: c.object, status: 'skipped', reason: missing });\n continue;\n }\n let created: Response;\n try {\n created = await stack.apiAs(token, 'POST', `/data/${c.object}`, body);\n } catch (e: any) {\n results.push({ object: c.object, status: 'create-failed', detail: String(e?.message ?? e).slice(0, 200) });\n continue;\n }\n if (created.status >= 300) {\n const text = (await created.text()).slice(0, 280);\n // A 400 validation failure means our auto-derived record didn't satisfy the\n // app's own validation rules (record-level format/json-schema/CEL) — that's\n // a fixture gap, not a platform finding. A 5xx (or crypto/driver error) is a\n // real runtime failure the app's author needs to see.\n const isValidation = created.status === 400 && /VALIDATION_FAILED|Validation failed/i.test(text);\n results.push({\n object: c.object,\n status: isValidation ? 'needs-fixture' : 'create-failed',\n code: created.status,\n detail: text,\n });\n continue;\n }\n const cj = (await created.json()) as any;\n const id = cj?.id ?? cj?.record?.id;\n if (!id) {\n results.push({ object: c.object, status: 'create-failed', detail: 'no id returned' });\n continue;\n }\n createdIds.set(c.object, String(id));\n\n const got = await stack.apiAs(token, 'GET', `/data/${c.object}/${id}`);\n if (got.status !== 200) {\n results.push({ object: c.object, status: 'read-failed', code: got.status });\n continue;\n }\n const rec = ((await got.json()) as any)?.record ?? {};\n\n const mismatches: ObjectVerifyResult['mismatches'] = [];\n for (const a of c.asserts ?? []) {\n const actual = rec[a.field];\n const ok = a.kind === 'set' ? setEqual(actual, a.value as unknown[]) : deepEqual(actual, a.value);\n if (!ok) mismatches.push({ field: a.field, type: a.type, wrote: a.value, read: actual });\n }\n results.push({\n object: c.object,\n status: mismatches.length ? 'fidelity-gaps' : 'verified',\n checked: (c.asserts ?? []).length,\n ...(mismatches.length ? { mismatches } : {}),\n });\n }\n\n const summary = {\n objects: results.length,\n verified: results.filter((r) => r.status === 'verified').length,\n fidelityGaps: results.filter((r) => r.status === 'fidelity-gaps').length,\n createFailed: results.filter((r) => r.status === 'create-failed').length,\n needsFixture: results.filter((r) => r.status === 'needs-fixture').length,\n readFailed: results.filter((r) => r.status === 'read-failed').length,\n skipped: results.filter((r) => r.status === 'skipped').length,\n mismatchTotal: results.reduce((n, r) => n + (r.mismatches?.length ?? 0), 0),\n };\n return { app: config?.manifest?.id ?? config?.manifest?.namespace ?? 'app', results, summary };\n}\n\n/** Pretty one-line-per-object summary for logs. */\nexport function formatReport(report: VerifyReport): string {\n const lines: string[] = [`\\n=== objectstack verify — ${report.app} ===`];\n for (const r of report.results) {\n if (r.status === 'verified') lines.push(` ✓ ${r.object} (${r.checked} fields)`);\n else if (r.status === 'fidelity-gaps') {\n lines.push(` ⚠ ${r.object} ${r.mismatches!.length} fidelity gap(s):`);\n for (const m of r.mismatches!) lines.push(` ${m.field} <${m.type}>: wrote ${JSON.stringify(m.wrote)} → read ${JSON.stringify(m.read)}`);\n }\n else if (r.status === 'skipped') lines.push(` – ${r.object} skipped: ${r.reason}`);\n else if (r.status === 'needs-fixture') lines.push(` ~ ${r.object} needs-fixture (app validation rejected the auto-record): ${(r.detail ?? '').slice(0,120)}`);\n else lines.push(` ✗ ${r.object} ${r.status}${r.code ? ` (${r.code})` : ''}: ${r.detail ?? ''}`);\n }\n const s = report.summary;\n lines.push(` ── ${s.verified} verified, ${s.fidelityGaps} gaps, ${s.createFailed + s.readFailed} FAILED, ${s.needsFixture} needs-fixture, ${s.skipped} skipped (${s.mismatchTotal} mismatches)`);\n return lines.join('\\n');\n}\n","// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n//\n// Metadata-driven RLS cross-owner proofs — the #1994 invariant.\n//\n// #1994 (\"member edits others' records\") was a by-id write that skipped the\n// row-level predicate: `driver.update(object, id, …)` builds no AST, so RLS\n// never scoped it. The clean, app-agnostic invariant that catches it without\n// interpreting each sharing rule:\n//\n// A user who CANNOT READ a record must not be able to WRITE it.\n// (\"You can't mutate what you can't see.\")\n//\n// Derivation, per object: admin creates a record; a fresh member (no roles or\n// grants) tries to read it, then tries to mutate it by id; we re-read as admin\n// to see if the row actually changed. If the member couldn't see it yet changed\n// it, that's the #1994 class of hole — regardless of the app's sharing config.\n\n/* eslint-disable @typescript-eslint/no-explicit-any */\n\nimport type { VerifyStack } from './harness.js';\nimport { deriveCrudCases, fillRelationalRefs } from './derive.js';\n\nconst PROBE_TYPES = new Set(['text', 'textarea', 'string']);\nconst MUTATION = 'rls-mutated-by-B';\n\nexport interface RlsResult {\n object: string;\n status: 'rls-consistent' | 'rls-hole' | 'member-visible' | 'skipped';\n detail?: string;\n}\n\nexport interface RlsReport {\n app: string;\n results: RlsResult[];\n summary: { objects: number; consistent: number; holes: number; memberVisible: number; skipped: number };\n}\n\nexport async function runRlsProofs(\n stack: VerifyStack,\n adminToken: string,\n memberToken: string,\n config: any,\n): Promise {\n const cases = deriveCrudCases(config);\n const results: RlsResult[] = [];\n // Admin-created ids, threaded so a detail's required relation points at a real\n // master (topological order created it first) — lets the #1994 invariant reach\n // relationship-dense objects, not just the leaves.\n const createdIds = new Map();\n\n for (const c of cases) {\n if (c.blocked) { results.push({ object: c.object, status: 'skipped', detail: c.blocked }); continue; }\n\n // A plain-text field to mutate (avoid email/url/phone — their format checks\n // would reject the probe for a benign reason, masking the RLS signal).\n const probe = (c.asserts ?? []).find((a) => PROBE_TYPES.has(a.type));\n if (!probe) { results.push({ object: c.object, status: 'skipped', detail: 'no plain-text probe field' }); continue; }\n\n const { body, missing } = fillRelationalRefs(c, createdIds);\n if (missing) { results.push({ object: c.object, status: 'skipped', detail: missing }); continue; }\n\n // Admin (owner) creates the record.\n const created = await stack.apiAs(adminToken, 'POST', `/data/${c.object}`, body);\n if (created.status >= 300) {\n results.push({ object: c.object, status: 'skipped', detail: `admin create failed (${created.status})` });\n continue;\n }\n const cj = (await created.json()) as any;\n const id = cj?.id ?? cj?.record?.id;\n if (!id) { results.push({ object: c.object, status: 'skipped', detail: 'no id from create' }); continue; }\n createdIds.set(c.object, String(id));\n\n // Member B: can they SEE it?\n const bRead = await stack.apiAs(memberToken, 'GET', `/data/${c.object}/${id}`);\n let canRead = false;\n if (bRead.status === 200) {\n const rec = ((await bRead.json()) as any)?.record;\n canRead = !!rec && rec.id === id;\n }\n\n // Member B: try to MUTATE it by id.\n const bWrite = await stack.apiAs(memberToken, 'PATCH', `/data/${c.object}/${id}`, { [probe.field]: MUTATION });\n\n // Ground truth: re-read as admin — did the row actually change?\n const after = await stack.apiAs(adminToken, 'GET', `/data/${c.object}/${id}`);\n const afterVal = (((await after.json()) as any)?.record ?? {})[probe.field];\n const changed = afterVal === MUTATION;\n\n if (canRead) {\n results.push({ object: c.object, status: 'member-visible', detail: 'member can read this object — not a cross-owner scenario (no RLS isolation, or read is granted)' });\n } else if (changed) {\n results.push({\n object: c.object,\n status: 'rls-hole',\n detail: `member B cannot read it (GET ${bRead.status}) yet MUTATED it by id (PATCH ${bWrite.status}) — by-id write bypassed RLS (#1994 class)`,\n });\n } else {\n results.push({\n object: c.object,\n status: 'rls-consistent',\n detail: `member B cannot read (GET ${bRead.status}) and could not mutate (PATCH ${bWrite.status}, row unchanged)`,\n });\n }\n }\n\n const summary = {\n objects: results.length,\n consistent: results.filter((r) => r.status === 'rls-consistent').length,\n holes: results.filter((r) => r.status === 'rls-hole').length,\n memberVisible: results.filter((r) => r.status === 'member-visible').length,\n skipped: results.filter((r) => r.status === 'skipped').length,\n };\n return { app: config?.manifest?.id ?? 'app', results, summary };\n}\n\nexport function formatRlsReport(report: RlsReport): string {\n const lines: string[] = [`\\n=== objectstack verify (RLS / #1994) — ${report.app} ===`];\n for (const r of report.results) {\n const mark = r.status === 'rls-hole' ? '✗✗' : r.status === 'rls-consistent' ? '✓' : r.status === 'member-visible' ? '·' : '–';\n lines.push(` ${mark} ${r.object} [${r.status}] ${r.detail ?? ''}`);\n }\n const s = report.summary;\n lines.push(` ── ${s.consistent} consistent, ${s.holes} HOLES, ${s.memberVisible} member-visible, ${s.skipped} skipped`);\n return lines.join('\\n');\n}\n","// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Conformance ledger — the reusable platform pattern (ADR-0060).\n *\n * A \"conformance ledger\" classifies every declarable property of a surface into\n * exactly one honest state — `enforced` / `experimental` / `removed` (ADR-0049) —\n * names the runtime site that enforces it, and (for high-risk) references a proof.\n * The platform hand-wrote this twice (ADR-0056 D10 authz matrix, ADR-0058 D7\n * expression surface) before promoting the shared invariants here.\n *\n * `checkLedger` returns a list of problems (empty = sound) so the helper carries\n * no test-runner dependency — callers assert `toEqual([])`. The optional\n * `discover` enables the **ratchet**: re-derive the real surface from source and\n * fail when a declaration is unclassified (the #1887 / declared-but-unenforced\n * class) or a `covers` entry is stale.\n */\n\nimport { existsSync } from 'node:fs';\nimport { join } from 'node:path';\n\nexport type ConformanceState = 'enforced' | 'experimental' | 'removed';\n\nexport interface ConformanceRow {\n /** Stable unique id. */\n id: string;\n /** One-line human summary. */\n summary: string;\n /** The declaration site this row classifies (free-form; e.g. `file:field`). */\n surface?: string;\n /** Exactly one honest state (ADR-0049). */\n state: ConformanceState;\n /** Runtime enforcement site — REQUIRED when `state === 'enforced'`. */\n enforcement?: string;\n /** Proof path (resolved against {@link CheckLedgerOptions.proofRoot}); file must exist. */\n proof?: string;\n /** Ratchet keys this row accounts for (matched against `discover()`). */\n covers?: string[];\n /** Rationale — REQUIRED when `state !== 'enforced'`. */\n note?: string;\n /** Per-surface extras (dialect, mode, fail-policy, …) — not checked here. */\n meta?: Record;\n}\n\nexport interface CheckLedgerOptions {\n /** Directory each row's `proof` is resolved against. */\n proofRoot: string;\n /** Re-derive the real surface from source; enables the ratchet. */\n discover?: () => Iterable;\n /** Row ids that MUST carry a proof. */\n highRisk?: string[];\n /** When true, EVERY enforced row must carry a proof (default: only high-risk). */\n proofRequiredForEnforced?: boolean;\n}\n\nconst VALID_STATES: ReadonlySet = new Set(['enforced', 'experimental', 'removed']);\n\n/**\n * Assert a conformance ledger's shared invariants. Returns a list of problem\n * strings; an empty array means the ledger is sound.\n */\nexport function checkLedger(rows: readonly ConformanceRow[], opts: CheckLedgerOptions): string[] {\n const problems: string[] = [];\n\n // Unique ids.\n const seenIds = new Set();\n for (const r of rows) {\n if (seenIds.has(r.id)) problems.push(`duplicate id: ${r.id}`);\n seenIds.add(r.id);\n }\n\n for (const r of rows) {\n if (!VALID_STATES.has(r.state)) problems.push(`${r.id}: invalid state '${r.state}'`);\n if (!r.summary) problems.push(`${r.id}: missing summary`);\n if (r.state === 'enforced' && !r.enforcement) problems.push(`${r.id}: enforced but names no enforcement site`);\n if (r.state !== 'enforced' && !r.note) problems.push(`${r.id}: ${r.state} but carries no note (honest rationale)`);\n if (r.proof && !existsSync(join(opts.proofRoot, r.proof))) problems.push(`${r.id}: proof missing on disk: ${r.proof}`);\n if (opts.proofRequiredForEnforced && r.state === 'enforced' && !r.proof) problems.push(`${r.id}: enforced but carries no proof`);\n }\n\n // High-risk rows must carry a proof.\n for (const id of opts.highRisk ?? []) {\n const r = rows.find((x) => x.id === id);\n if (!r) problems.push(`high-risk id not in ledger: ${id}`);\n else if (!r.proof) problems.push(`high-risk ${id} must carry a proof`);\n }\n\n // `covers`: each surface classified by exactly one row.\n const covered = new Map();\n for (const r of rows) {\n for (const c of r.covers ?? []) {\n const prev = covered.get(c);\n if (prev) problems.push(`surface \"${c}\" classified by more than one row (${prev}, ${r.id})`);\n else covered.set(c, r.id);\n }\n }\n\n // The ratchet: every discovered surface is covered; no stale covers.\n if (opts.discover) {\n const discovered = new Set(opts.discover());\n for (const s of discovered) {\n if (!covered.has(s)) problems.push(`UNCLASSIFIED surface — add a ledger row (ADR-0060): ${s}`);\n }\n for (const c of covered.keys()) {\n if (!discovered.has(c)) problems.push(`STALE covers — surface no longer in source: ${c}`);\n }\n }\n\n return problems;\n}\n","// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Driver read-coercion conformance — a reusable, driver-agnostic check.\n *\n * A stored value must read back as its DECLARED type on every driver: a\n * `boolean` as a JS boolean (not the integer 0/1 SQLite stores), a `json` field\n * as an object/array (not serialized text), an `integer` as a number. When two\n * drivers disagree, code that is green on one silently breaks on the other.\n *\n * This is the invariant behind the 2026-07-06 `case_escalation` incident: a\n * boolean guard `field != true` read the field back as integer `1` on Turso, so\n * `1 != true` was always true and the flow self-triggered forever — while the\n * local repro (memory / better-sqlite3, both of which coerce) was green.\n *\n * Like {@link checkLedger}, this returns a list of human-readable problems\n * (empty = conformant) and carries NO test-runner dependency — callers assert\n * `expect(await checkReadCoercion(driver)).toEqual([])`. It takes any driver\n * structurally (see {@link CoercibleDriver}) so out-of-tree drivers — e.g.\n * cloud's `driver-turso` in remote mode — can run the identical contract against\n * themselves without importing a concrete driver type.\n */\n\n/** The minimal driver surface this check drives. */\nexport interface CoercibleDriver {\n connect?(): Promise;\n disconnect?(): Promise;\n syncSchema(object: string, schema: unknown, options?: unknown): Promise;\n create(object: string, data: Record, options?: unknown): Promise;\n find(object: string, query: unknown, options?: unknown): Promise;\n}\n\nexport interface ReadCoercionOptions {\n /** Object/table name to create for the probe. Default `read_coercion_probe`. */\n object?: string;\n}\n\nconst FIELDS = {\n name: { type: 'string' },\n active: { type: 'boolean' },\n meta: { type: 'json' },\n count: { type: 'integer' },\n} as const;\n\nconst INPUT = { id: '1', name: 'Widget', active: true, meta: { k: 1, arr: [1, 2] }, count: 5 };\n\nfunction stableStringify(v: unknown): string {\n // Order-insensitive for plain objects so a driver that reorders JSON keys on\n // round-trip is not falsely flagged; arrays keep their order.\n const norm = (x: any): any => {\n if (Array.isArray(x)) return x.map(norm);\n if (x && typeof x === 'object') {\n return Object.keys(x).sort().reduce((o: any, k) => ((o[k] = norm(x[k])), o), {});\n }\n return x;\n };\n return JSON.stringify(norm(v));\n}\n\n/**\n * Round-trip a typed row through `driver` and report every field whose read-back\n * value does not match its declared type. Empty array = conformant.\n */\nexport async function checkReadCoercion(\n driver: CoercibleDriver,\n opts: ReadCoercionOptions = {},\n): Promise {\n const object = opts.object ?? 'read_coercion_probe';\n const problems: string[] = [];\n\n await driver.connect?.();\n try {\n await driver.syncSchema(object, { name: object, fields: FIELDS });\n await driver.create(object, { ...INPUT });\n\n // Read back only the row we just wrote (by id), so the check is robust even\n // when the probe object already holds unrelated rows on a shared backend.\n const rows = await driver.find(object, { object, where: { id: INPUT.id } });\n if (!Array.isArray(rows) || rows.length !== 1) {\n problems.push(`find returned ${Array.isArray(rows) ? `${rows.length} rows` : typeof rows}, expected exactly 1`);\n return problems;\n }\n const row = rows[0] as Record;\n\n if (row.active !== true) {\n problems.push(`boolean not coerced: 'active' expected true, got ${typeof row.active} ${JSON.stringify(row.active)}`);\n }\n if (stableStringify(row.meta) !== stableStringify(INPUT.meta)) {\n problems.push(`json not coerced: 'meta' expected object ${JSON.stringify(INPUT.meta)}, got ${typeof row.meta} ${JSON.stringify(row.meta)}`);\n }\n if (row.count !== 5) {\n problems.push(`number not coerced: 'count' expected 5, got ${typeof row.count} ${JSON.stringify(row.count)}`);\n }\n } finally {\n await driver.disconnect?.();\n }\n\n return problems;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACsBA,qBAA8E;AAC9E,sBAA+B;AAC/B,gCAAiC;AACjC,gCAAiC;AACjC,kBAAoC;AACpC,yBAA2B;AAC3B,6BAA+B;AAC/B,4BAAqC;AACrC,8BAA2D;AAC3D,+BAAuC;AAOvC,IAAM,aAAa;AACnB,IAAM,sBAAsB;AAC5B,IAAM,yBAAyB;AAC/B,IAAM,sBAAsB;AA8D5B,eAAsB,UAEpB,QACA,OAAoB,CAAC,GACC;AACtB,UAAQ,IAAI,WAAW;AAEvB,QAAM,SAAS,IAAI,4BAAa;AAGhC,QAAM,OAAO,IAAI,IAAI,+BAAe,CAAC;AACrC,QAAM,OAAO,IAAI,IAAI,4BAAa,IAAI,2CAAiB,EAAE,UAAU,WAAW,CAAC,CAAC,CAAC;AAKjF,QAAM,OAAO,IAAI,IAAI,2CAAiB,EAAE,MAAM,EAAE,CAAC,CAAC;AAGlD,QAAM,OAAO,IAAI,IAAI,yBAAU,MAAM,CAAC;AAGtC,QAAM,OAAO,IAAI,IAAI,8CAAsB,CAAC;AAC5C,QAAM,OAAO,IAAI,IAAI,gDAAuB,CAAC;AAC7C,QAAM,OAAO,IAAI,IAAI,8BAAW,EAAE,QAAQ,KAAK,cAAc,oBAAoB,CAAC,CAAC;AASnF;AACE,UAAM,SAAU,OAAqC;AACrD,UAAM,sBAAsB,MAAM,QAAQ,MAAM,IAC5C,OAAO,SAAS,IAChB,CAAC,CAAC,UAAU,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM,EAAE,SAAS;AAC3E,QAAI,qBAAqB;AACvB,YAAM,EAAE,8BAA8B,qCAAqC,IAAI,MAAM,OACnF,iCACF;AACA,YAAM,OAAO,IAAI,IAAI,6BAA6B,EAAE,eAAe,qCAAqC,EAAE,CAAC,CAAC;AAAA,IAC9G;AAAA,EACF;AAMA,MAAI,KAAK,aAAa;AACpB,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,iCAAiC;AAC3E,UAAM,OAAO,IAAI,IAAI,iBAAiB,CAAC;AAAA,EACzC;AAMA,MAAI,KAAK,YAAY;AACnB,UAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,iCAAiC;AAClF,UAAM,OAAO,IAAI,IAAI,wBAAwB,EAAE,mBAAmB,SAAS,CAAC,CAAC;AAAA,EAC/E;AAEA,QAAM,OAAO,IAAI,KAAK,YAAY,IAAI,sCAAe,CAAC;AAItD,QAAM,OAAO,IAAI,IAAI,2CAAqB,CAAC;AAO3C,QAAM,OAAO,QAAI,iCAAoB,CAAC,CAAC,CAAC;AACxC,QAAM,OAAO,QAAI,uCAAuB,CAAC,CAAC,CAAC;AAG3C,QAAM,OAAO,UAAU;AAKvB,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,gBAA8D,UAAU;AACpG,QAAI,UAAU,OAAO,OAAO,sBAAsB,YAAY;AAC5D,aAAO,kBAAkB,IAAI,4CAAoB,CAAC;AAAA,IACpD;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,aAAa,MAAM,OAAO;AAAA,IAC9B;AAAA,EACF;AACA,QAAM,MAAM,WAAW,UAAU;AASjC,QAAM,SAAS;AACf,QAAM,MAAM,CAAC,MAAc,SAAuB,IAAI,QAAQ,GAAG,MAAM,GAAG,IAAI,IAAI,IAAI;AACtF,QAAM,MAAM,CAAC,MAAc,SAAuB,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI,IAAI;AAElF,QAAM,QAAQ,KAAK,SAAS,EAAE,OAAO,qBAAqB,UAAU,uBAAuB;AAE3F,QAAM,SAAS,OACb,QAAgB,MAAM,OACtB,WAAmB,MAAM,aACL;AACpB,UAAM,MAAM,MAAM,IAAI,uBAAuB;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,SAAS,CAAC;AAAA,IAC1C,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,IAAI,MAAM,IAAI,KAAK,CAAC,EAAE;AAAA,IAC3E;AACA,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAI,CAAC,KAAK,MAAO,OAAM,IAAI,MAAM,qCAAqC;AACtE,WAAO,KAAK;AAAA,EACd;AAEA,QAAM,SAAS,OACb,OACA,WAAW,mBACX,SACoB;AACpB,UAAM,MAAM,MAAM,IAAI,uBAAuB;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,UAAU,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;AAAA,IAC7E,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,IAAI,MAAM,yBAAyB,IAAI,MAAM,IAAI,MAAM,IAAI,KAAK,CAAC,EAAE;AAAA,IAC3E;AACA,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAI,CAAC,KAAK,MAAO,OAAM,IAAI,MAAM,qCAAqC;AACtE,WAAO,KAAK;AAAA,EACd;AAEA,QAAM,QAAQ,CAAC,OAAe,QAAgB,MAAc,SAC1D,IAAI,MAAM;AAAA,IACR;AAAA,IACA,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,eAAe,UAAU,KAAK;AAAA,IAChC;AAAA,IACA,GAAI,SAAS,SAAY,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE,IAAI,CAAC;AAAA,EAC7D,CAAC;AAEH,QAAM,OAAO,YAAY;AACvB,QAAI;AACF,YAAM,WAAW,QAAQ;AAAA,IAC3B,QAAQ;AAAA,IAER;AACA,QAAI;AAEF,YAAO,OAAe,WAAW;AAAA,IACnC,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,KAAK,KAAK,QAAQ,QAAQ,OAAO,KAAK;AACzD;;;AC5PA,IAAM,WAAW,oBAAI,IAAI,CAAC,WAAW,WAAW,cAAc,UAAU,QAAQ,CAAC;AACjF,IAAM,aAAa,oBAAI,IAAI,CAAC,UAAU,iBAAiB,iBAAiB,gBAAgB,MAAM,CAAC;AAC/F,IAAM,aAAa,oBAAI,IAAI,CAAC,aAAa,YAAY,UAAU,YAAY,SAAS,CAAC;AACrF,IAAM,QAAQ,oBAAI,IAAI,CAAC,SAAS,QAAQ,UAAU,SAAS,SAAS,aAAa,QAAQ,CAAC;AAC1F,IAAM,eAAe,oBAAI,IAAI;AAAA,EAC3B;AAAA,EAAM;AAAA,EAAc;AAAA,EAAc;AAAA,EAAc;AAAA,EAAc;AAAA,EAC9D;AAAA,EAAS;AAAA,EAAkB;AAAA,EAAa;AAC1C,CAAC;AAyBD,SAAS,SAAS,GAAQ,UAA0B;AAClD,QAAM,EAAE,KAAK,KAAK,KAAK,IAAI;AAC3B,MAAI,IAAI;AACR,MAAI,OAAO,QAAQ,YAAY,IAAI,IAAK,KAAI;AAC5C,MAAI,OAAO,QAAQ,YAAY,IAAI,IAAK,KAAI;AAC5C,MAAI,OAAO,SAAS,YAAY,OAAO,QAAQ,UAAU;AACvD,QAAI,MAAM,OAAO,KAAK,OAAO,IAAI,OAAO,IAAI;AAAA,EAC9C;AACA,SAAO;AACT;AAGA,SAAS,MAAM,MAAc,GAAqD;AAChF,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAA,IAAQ,KAAK;AAAA,IAAY,KAAK;AAAA,IACnC,KAAK;AAAA,IAAY,KAAK;AAAA,IAAQ,KAAK;AAAA,IAAY,KAAK;AAClD,aAAO,EAAE,OAAO,iBAAiB,MAAM,QAAQ;AAAA,IACjD,KAAK;AAAS,aAAO,EAAE,OAAO,sBAAsB,MAAM,QAAQ;AAAA,IAClE,KAAK;AAAO,aAAO,EAAE,OAAO,uBAAuB,MAAM,QAAQ;AAAA,IACjE,KAAK;AAAS,aAAO,EAAE,OAAO,gBAAgB,MAAM,QAAQ;AAAA,IAC5D,KAAK;AAAS,aAAO,EAAE,OAAO,WAAW,MAAM,QAAQ;AAAA,IACvD,KAAK;AAAU,aAAO,EAAE,OAAO,SAAS,GAAG,CAAC,GAAG,MAAM,QAAQ;AAAA,IAC7D,KAAK;AAAY,aAAO,EAAE,OAAO,SAAS,GAAG,GAAG,GAAG,MAAM,QAAQ;AAAA,IACjE,KAAK;AAAW,aAAO,EAAE,OAAO,SAAS,GAAG,EAAE,GAAG,MAAM,QAAQ;AAAA,IAC/D,KAAK;AAAU,aAAO,EAAE,OAAO,SAAS,GAAG,KAAK,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ;AAAA,IACnF,KAAK;AAAA,IAAU,KAAK;AAAY,aAAO,EAAE,OAAO,SAAS,GAAG,EAAE,GAAG,MAAM,QAAQ;AAAA,IAC/E,KAAK;AAAA,IAAW,KAAK;AAAU,aAAO,EAAE,OAAO,MAAM,MAAM,QAAQ;AAAA,IACnE,KAAK;AAAQ,aAAO,EAAE,OAAO,cAAc,MAAM,QAAQ;AAAA,IACzD,KAAK;AAAY,aAAO,EAAE,OAAO,4BAA4B,MAAM,QAAQ;AAAA,IAC3E,KAAK;AAAQ,aAAO,EAAE,OAAO,YAAY,MAAM,QAAQ;AAAA,IACvD,KAAK;AAAQ,aAAO,EAAE,OAAO,EAAE,QAAQ,KAAK,GAAG,MAAM,QAAQ;AAAA,IAC7D,KAAK;AAAA,IAAU,KAAK,SAAS;AAC3B,YAAM,MAAM,EAAE,UAAU,CAAC,GAAG;AAC5B,aAAO,OAAO,OAAO,EAAE,OAAO,KAAK,MAAM,QAAQ,IAAI;AAAA,IACvD;AAAA,IACA,KAAK;AAAA,IAAe,KAAK,cAAc;AACrC,YAAM,MAAM,EAAE,UAAU,CAAC,GAAG;AAC5B,aAAO,OAAO,OAAO,EAAE,OAAO,CAAC,GAAG,GAAG,MAAM,MAAM,IAAI;AAAA,IACvD;AAAA,IACA,KAAK;AAAQ,aAAO,EAAE,OAAO,CAAC,SAAS,MAAM,GAAG,MAAM,MAAM;AAAA;AAAA,IAE5D,KAAK;AAAA,IAAY,KAAK;AAAU,aAAO,EAAE,OAAO,qBAAqB,MAAM,OAAO;AAAA,IAClF;AAAS,aAAO;AAAA,EAClB;AACF;AAGA,SAAS,eAAe,GAAuB;AAC7C,QAAM,MAAM,GAAG,aAAa,GAAG,gBAAgB,GAAG;AAClD,SAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,IAAI,MAAM;AAC3D;AAuBO,SAAS,gBAAgB,QAAyB;AACvD,QAAM,UAAiB,QAAQ,WAAW,CAAC;AAC3C,QAAM,SAAS,oBAAI,IAAiB;AACpC,aAAW,KAAK,QAAS,KAAI,GAAG,KAAM,QAAO,IAAI,EAAE,MAAM,CAAC;AAC1D,QAAM,WAAW,oBAAI,IAAiB;AACtC,aAAW,MAAO,QAAQ,eAAe,CAAC,EAAI,KAAI,IAAI,KAAM,UAAS,IAAI,GAAG,MAAM,EAAE;AAEpF,QAAM,SAAS,oBAAI,IAAmB;AAGtC,aAAW,OAAO,SAAS;AACzB,QAAI,CAAC,KAAK,KAAM;AAChB,UAAM,SAA8B,KAAK,UAAU,CAAC;AACpD,UAAM,IAAW;AAAA,MACf,MAAM,IAAI;AAAA,MAAM,MAAM,CAAC;AAAA,MAAG,SAAS,CAAC;AAAA,MAAG,eAAe,CAAC;AAAA,MAAG,gBAAgB,CAAC;AAAA,MAAG,iBAAiB,CAAC;AAAA,IAClG;AAMA,QAAI,IAAI,UAAU;AAChB,YAAM,KAAK,IAAI,aAAa,SAAS,IAAI,IAAI,UAAU,IAAI;AAC3D,YAAM,WAAW,IAAI,UAAU,gBAAgB,QAAQ,IAAI,UAAU,aAAa;AAClF,UAAI,CAAC,UAAU;AACb,UAAE,UAAU,oDAAoD,IAAI,cAAc,SAAS;AAC3F,eAAO,IAAI,IAAI,MAAM,CAAC;AACtB;AAAA,MACF;AAAA,IACF;AAEA,eAAW,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC9C,YAAM,OAAO,OAAQ,GAAW,QAAQ,EAAE,EAAE,YAAY;AACxD,YAAM,aAAa,CAAC,CAAE,GAAW;AACjC,UAAI,aAAa,IAAI,IAAI,KAAM,GAAW,UAAW,GAAW,SAAU;AAC1E,UAAI,SAAS,IAAI,IAAI,EAAG;AAExB,UAAI,WAAW,IAAI,IAAI,GAAG;AACxB,cAAM,SAAS,eAAe,CAAC;AAC/B,YAAI,CAAC,QAAQ;AACX,cAAI,YAAY;AAAE,cAAE,UAAU,YAAY,IAAI,WAAW,IAAI;AAAiC;AAAA,UAAO;AACrG,YAAE,cAAc,KAAK,EAAE,MAAM,MAAM,QAAQ,6BAA6B,CAAC;AACzE;AAAA,QACF;AACA,YAAI,CAAC,OAAO,IAAI,MAAM,GAAG;AAEvB,cAAI,YAAY;AAAE,cAAE,UAAU,YAAY,IAAI,WAAW,IAAI,oBAAe,MAAM;AAAuB;AAAA,UAAO;AAChH,YAAE,cAAc,KAAK,EAAE,MAAM,MAAM,QAAQ,4BAA4B,MAAM,GAAG,CAAC;AACjF;AAAA,QACF;AACA,UAAE,eAAe,KAAK,EAAE,OAAO,MAAM,QAAQ,UAAU,YAAY,UAAU,CAAC,CAAE,GAAW,SAAS,CAAC;AACrG,YAAI,WAAY,GAAE,gBAAgB,KAAK,MAAM;AAC7C;AAAA,MACF;AAEA,UAAI,WAAW,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,GAAG;AAC3C,YAAI,YAAY;AAAE,YAAE,UAAU,YAAY,IAAI,WAAW,IAAI;AAAoC;AAAA,QAAO;AACxG,UAAE,cAAc,KAAK,EAAE,MAAM,MAAM,QAAQ,2BAA2B,CAAC;AACvE;AAAA,MACF;AAEA,YAAM,IAAI,MAAM,MAAM,CAAC;AACvB,UAAI,CAAC,GAAG;AACN,YAAI,YAAY;AAAE,YAAE,UAAU,mBAAmB,IAAI,cAAc,IAAI;AAA0B;AAAA,QAAO;AACxG,UAAE,cAAc,KAAK,EAAE,MAAM,MAAM,QAAQ,WAAW,CAAC;AACvD;AAAA,MACF;AACA,QAAE,KAAK,IAAI,IAAI,EAAE;AACjB,UAAI,EAAE,SAAS,OAAQ,GAAE,QAAQ,KAAK,EAAE,OAAO,MAAM,MAAM,OAAO,EAAE,OAAO,MAAM,EAAE,KAAK,CAAC;AAAA,IAC3F;AAEA,WAAO,IAAI,IAAI,MAAM,CAAC;AAAA,EACxB;AAGA,MAAI,UAAU;AACd,SAAO,SAAS;AACd,cAAU;AACV,eAAW,KAAK,OAAO,OAAO,GAAG;AAC/B,UAAI,EAAE,QAAS;AACf,iBAAW,KAAK,EAAE,iBAAiB;AACjC,cAAM,KAAK,OAAO,IAAI,CAAC;AACvB,YAAI,CAAC,MAAM,GAAG,SAAS;AACrB,YAAE,UAAU,+BAA+B,CAAC,QAAQ,CAAC,KAAK,YAAY,mBAAmB;AACzF,oBAAU;AACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,CAAC,GAAG,OAAO,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAC7E,MAAI,WAAW;AACf,SAAO,UAAU;AACf,eAAW;AACX,eAAW,QAAQ,MAAM;AACvB,UAAI,QAAQ,IAAI,IAAI,EAAG;AACvB,YAAM,IAAI,OAAO,IAAI,IAAI;AACzB,UAAI,EAAE,gBAAgB,MAAM,CAAC,MAAM,QAAQ,IAAI,CAAC,CAAC,GAAG;AAClD,gBAAQ,IAAI,IAAI;AAChB,cAAM,KAAK,IAAI;AACf,mBAAW;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAEA,aAAW,QAAQ,MAAM;AACvB,QAAI,CAAC,QAAQ,IAAI,IAAI,EAAG,QAAO,IAAI,IAAI,EAAG,UAAU;AAAA,EACtD;AAGA,QAAM,QAAoB,CAAC;AAC3B,aAAW,QAAQ,OAAO;AACxB,UAAM,IAAI,OAAO,IAAI,IAAI;AACzB,UAAM,KAAK;AAAA,MACT,QAAQ,EAAE;AAAA,MACV,MAAM,EAAE;AAAA,MACR,SAAS,EAAE;AAAA,MACX,eAAe,EAAE;AAAA,MACjB,GAAI,EAAE,eAAe,SAAS,EAAE,gBAAgB,EAAE,eAAe,IAAI,CAAC;AAAA,IACxE,CAAC;AAAA,EACH;AACA,aAAW,KAAK,OAAO,OAAO,GAAG;AAC/B,QAAI,EAAE,QAAS,OAAM,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,EAAE,QAAQ,CAAC;AAAA,EAClE;AACA,SAAO;AACT;AAQO,SAAS,mBACd,GACA,SACqD;AACrD,QAAM,OAAgC,EAAE,GAAI,EAAE,QAAQ,CAAC,EAAG;AAC1D,aAAW,OAAO,EAAE,kBAAkB,CAAC,GAAG;AACxC,UAAM,KAAK,QAAQ,IAAI,IAAI,MAAM;AACjC,QAAI,MAAM,MAAM;AACd,UAAI,IAAI,SAAU,QAAO,EAAE,MAAM,SAAS,sBAAsB,IAAI,KAAK,wBAAmB,IAAI,MAAM,WAAW;AACjH;AAAA,IACF;AACA,SAAK,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,EAAE,IAAI;AAAA,EAC1C;AACA,SAAO,EAAE,KAAK;AAChB;;;AC/OA,SAAS,SAAS,GAAY,GAAuB;AACnD,MAAI,CAAC,MAAM,QAAQ,CAAC,EAAG,QAAO;AAC9B,SAAO,KAAK,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;AACvE;AACA,SAAS,UAAU,GAAY,GAAqB;AAClD,SAAO,KAAK,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC;AAC/C;AAOA,eAAsB,oBACpB,OACA,OACA,QACuB;AACvB,QAAM,QAAQ,gBAAgB,MAAM;AACpC,QAAM,UAAgC,CAAC;AAIvC,QAAM,aAAa,oBAAI,IAAoB;AAE3C,aAAW,KAAK,OAAqB;AACnC,QAAI,EAAE,SAAS;AACb,cAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,QAAQ,WAAW,QAAQ,EAAE,QAAQ,CAAC;AACvE;AAAA,IACF;AACA,UAAM,EAAE,MAAM,QAAQ,IAAI,mBAAmB,GAAG,UAAU;AAC1D,QAAI,SAAS;AACX,cAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,QAAQ,WAAW,QAAQ,QAAQ,CAAC;AACrE;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,MAAM,MAAM,OAAO,QAAQ,SAAS,EAAE,MAAM,IAAI,IAAI;AAAA,IACtE,SAAS,GAAQ;AACf,cAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,QAAQ,iBAAiB,QAAQ,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,EAAE,CAAC;AACzG;AAAA,IACF;AACA,QAAI,QAAQ,UAAU,KAAK;AACzB,YAAM,QAAQ,MAAM,QAAQ,KAAK,GAAG,MAAM,GAAG,GAAG;AAKhD,YAAM,eAAe,QAAQ,WAAW,OAAO,uCAAuC,KAAK,IAAI;AAC/F,cAAQ,KAAK;AAAA,QACX,QAAQ,EAAE;AAAA,QACV,QAAQ,eAAe,kBAAkB;AAAA,QACzC,MAAM,QAAQ;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AACD;AAAA,IACF;AACA,UAAM,KAAM,MAAM,QAAQ,KAAK;AAC/B,UAAM,KAAK,IAAI,MAAM,IAAI,QAAQ;AACjC,QAAI,CAAC,IAAI;AACP,cAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,QAAQ,iBAAiB,QAAQ,iBAAiB,CAAC;AACpF;AAAA,IACF;AACA,eAAW,IAAI,EAAE,QAAQ,OAAO,EAAE,CAAC;AAEnC,UAAM,MAAM,MAAM,MAAM,MAAM,OAAO,OAAO,SAAS,EAAE,MAAM,IAAI,EAAE,EAAE;AACrE,QAAI,IAAI,WAAW,KAAK;AACtB,cAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,QAAQ,eAAe,MAAM,IAAI,OAAO,CAAC;AAC1E;AAAA,IACF;AACA,UAAM,OAAQ,MAAM,IAAI,KAAK,IAAY,UAAU,CAAC;AAEpD,UAAM,aAA+C,CAAC;AACtD,eAAW,KAAK,EAAE,WAAW,CAAC,GAAG;AAC/B,YAAM,SAAS,IAAI,EAAE,KAAK;AAC1B,YAAM,KAAK,EAAE,SAAS,QAAQ,SAAS,QAAQ,EAAE,KAAkB,IAAI,UAAU,QAAQ,EAAE,KAAK;AAChG,UAAI,CAAC,GAAI,YAAW,KAAK,EAAE,OAAO,EAAE,OAAO,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,MAAM,OAAO,CAAC;AAAA,IACzF;AACA,YAAQ,KAAK;AAAA,MACX,QAAQ,EAAE;AAAA,MACV,QAAQ,WAAW,SAAS,kBAAkB;AAAA,MAC9C,UAAU,EAAE,WAAW,CAAC,GAAG;AAAA,MAC3B,GAAI,WAAW,SAAS,EAAE,WAAW,IAAI,CAAC;AAAA,IAC5C,CAAC;AAAA,EACH;AAEA,QAAM,UAAU;AAAA,IACd,SAAS,QAAQ;AAAA,IACjB,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE;AAAA,IACzD,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,eAAe,EAAE;AAAA,IAClE,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,eAAe,EAAE;AAAA,IAClE,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,eAAe,EAAE;AAAA,IAClE,YAAY,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,aAAa,EAAE;AAAA,IAC9D,SAAS,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE;AAAA,IACvD,eAAe,QAAQ,OAAO,CAAC,GAAG,MAAM,KAAK,EAAE,YAAY,UAAU,IAAI,CAAC;AAAA,EAC5E;AACA,SAAO,EAAE,KAAK,QAAQ,UAAU,MAAM,QAAQ,UAAU,aAAa,OAAO,SAAS,QAAQ;AAC/F;AAGO,SAAS,aAAa,QAA8B;AACzD,QAAM,QAAkB,CAAC;AAAA,gCAA8B,OAAO,GAAG,MAAM;AACvE,aAAW,KAAK,OAAO,SAAS;AAC9B,QAAI,EAAE,WAAW,WAAY,OAAM,KAAK,YAAO,EAAE,MAAM,MAAM,EAAE,OAAO,UAAU;AAAA,aACvE,EAAE,WAAW,iBAAiB;AACrC,YAAM,KAAK,YAAO,EAAE,MAAM,KAAK,EAAE,WAAY,MAAM,mBAAmB;AACtE,iBAAW,KAAK,EAAE,WAAa,OAAM,KAAK,SAAS,EAAE,KAAK,KAAK,EAAE,IAAI,YAAY,KAAK,UAAU,EAAE,KAAK,CAAC,gBAAW,KAAK,UAAU,EAAE,IAAI,CAAC,EAAE;AAAA,IAC7I,WACS,EAAE,WAAW,UAAW,OAAM,KAAK,YAAO,EAAE,MAAM,cAAc,EAAE,MAAM,EAAE;AAAA,aAC1E,EAAE,WAAW,gBAAiB,OAAM,KAAK,OAAO,EAAE,MAAM,+DAA+D,EAAE,UAAU,IAAI,MAAM,GAAE,GAAG,CAAC,EAAE;AAAA,QACzJ,OAAM,KAAK,YAAO,EAAE,MAAM,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,KAAK,EAAE,IAAI,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;AAAA,EAClG;AACA,QAAM,IAAI,OAAO;AACjB,QAAM,KAAK,kBAAQ,EAAE,QAAQ,cAAc,EAAE,YAAY,UAAU,EAAE,eAAe,EAAE,UAAU,YAAY,EAAE,YAAY,mBAAmB,EAAE,OAAO,aAAa,EAAE,aAAa,cAAc;AAChM,SAAO,MAAM,KAAK,IAAI;AACxB;;;ACpIA,IAAM,cAAc,oBAAI,IAAI,CAAC,QAAQ,YAAY,QAAQ,CAAC;AAC1D,IAAM,WAAW;AAcjB,eAAsB,aACpB,OACA,YACA,aACA,QACoB;AACpB,QAAM,QAAQ,gBAAgB,MAAM;AACpC,QAAM,UAAuB,CAAC;AAI9B,QAAM,aAAa,oBAAI,IAAoB;AAE3C,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,SAAS;AAAE,cAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,QAAQ,WAAW,QAAQ,EAAE,QAAQ,CAAC;AAAG;AAAA,IAAU;AAIrG,UAAM,SAAS,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,MAAM,YAAY,IAAI,EAAE,IAAI,CAAC;AACnE,QAAI,CAAC,OAAO;AAAE,cAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,QAAQ,WAAW,QAAQ,4BAA4B,CAAC;AAAG;AAAA,IAAU;AAEpH,UAAM,EAAE,MAAM,QAAQ,IAAI,mBAAmB,GAAG,UAAU;AAC1D,QAAI,SAAS;AAAE,cAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,QAAQ,WAAW,QAAQ,QAAQ,CAAC;AAAG;AAAA,IAAU;AAGjG,UAAM,UAAU,MAAM,MAAM,MAAM,YAAY,QAAQ,SAAS,EAAE,MAAM,IAAI,IAAI;AAC/E,QAAI,QAAQ,UAAU,KAAK;AACzB,cAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,QAAQ,WAAW,QAAQ,wBAAwB,QAAQ,MAAM,IAAI,CAAC;AACvG;AAAA,IACF;AACA,UAAM,KAAM,MAAM,QAAQ,KAAK;AAC/B,UAAM,KAAK,IAAI,MAAM,IAAI,QAAQ;AACjC,QAAI,CAAC,IAAI;AAAE,cAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,QAAQ,WAAW,QAAQ,oBAAoB,CAAC;AAAG;AAAA,IAAU;AACzG,eAAW,IAAI,EAAE,QAAQ,OAAO,EAAE,CAAC;AAGnC,UAAM,QAAQ,MAAM,MAAM,MAAM,aAAa,OAAO,SAAS,EAAE,MAAM,IAAI,EAAE,EAAE;AAC7E,QAAI,UAAU;AACd,QAAI,MAAM,WAAW,KAAK;AACxB,YAAM,OAAQ,MAAM,MAAM,KAAK,IAAY;AAC3C,gBAAU,CAAC,CAAC,OAAO,IAAI,OAAO;AAAA,IAChC;AAGA,UAAM,SAAS,MAAM,MAAM,MAAM,aAAa,SAAS,SAAS,EAAE,MAAM,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC;AAG7G,UAAM,QAAQ,MAAM,MAAM,MAAM,YAAY,OAAO,SAAS,EAAE,MAAM,IAAI,EAAE,EAAE;AAC5E,UAAM,aAAc,MAAM,MAAM,KAAK,IAAY,UAAU,CAAC,GAAG,MAAM,KAAK;AAC1E,UAAM,UAAU,aAAa;AAE7B,QAAI,SAAS;AACX,cAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,QAAQ,kBAAkB,QAAQ,uGAAkG,CAAC;AAAA,IACxK,WAAW,SAAS;AAClB,cAAQ,KAAK;AAAA,QACX,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,QACR,QAAQ,gCAAgC,MAAM,MAAM,iCAAiC,OAAO,MAAM;AAAA,MACpG,CAAC;AAAA,IACH,OAAO;AACL,cAAQ,KAAK;AAAA,QACX,QAAQ,EAAE;AAAA,QACV,QAAQ;AAAA,QACR,QAAQ,6BAA6B,MAAM,MAAM,iCAAiC,OAAO,MAAM;AAAA,MACjG,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,gBAAgB,EAAE;AAAA,IACjE,OAAO,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE;AAAA,IACtD,eAAe,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,gBAAgB,EAAE;AAAA,IACpE,SAAS,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE;AAAA,EACzD;AACA,SAAO,EAAE,KAAK,QAAQ,UAAU,MAAM,OAAO,SAAS,QAAQ;AAChE;AAEO,SAAS,gBAAgB,QAA2B;AACzD,QAAM,QAAkB,CAAC;AAAA,8CAA4C,OAAO,GAAG,MAAM;AACrF,aAAW,KAAK,OAAO,SAAS;AAC9B,UAAM,OAAO,EAAE,WAAW,aAAa,iBAAO,EAAE,WAAW,mBAAmB,WAAM,EAAE,WAAW,mBAAmB,SAAM;AAC1H,UAAM,KAAK,KAAK,IAAI,IAAI,EAAE,MAAM,MAAM,EAAE,MAAM,KAAK,EAAE,UAAU,EAAE,EAAE;AAAA,EACrE;AACA,QAAM,IAAI,OAAO;AACjB,QAAM,KAAK,kBAAQ,EAAE,UAAU,gBAAgB,EAAE,KAAK,WAAW,EAAE,aAAa,oBAAoB,EAAE,OAAO,UAAU;AACvH,SAAO,MAAM,KAAK,IAAI;AACxB;;;AC1GA,qBAA2B;AAC3B,uBAAqB;AAoCrB,IAAM,eAAoC,oBAAI,IAAI,CAAC,YAAY,gBAAgB,SAAS,CAAC;AAMlF,SAAS,YAAY,MAAiC,MAAoC;AAC/F,QAAM,WAAqB,CAAC;AAG5B,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,KAAK,MAAM;AACpB,QAAI,QAAQ,IAAI,EAAE,EAAE,EAAG,UAAS,KAAK,iBAAiB,EAAE,EAAE,EAAE;AAC5D,YAAQ,IAAI,EAAE,EAAE;AAAA,EAClB;AAEA,aAAW,KAAK,MAAM;AACpB,QAAI,CAAC,aAAa,IAAI,EAAE,KAAK,EAAG,UAAS,KAAK,GAAG,EAAE,EAAE,oBAAoB,EAAE,KAAK,GAAG;AACnF,QAAI,CAAC,EAAE,QAAS,UAAS,KAAK,GAAG,EAAE,EAAE,mBAAmB;AACxD,QAAI,EAAE,UAAU,cAAc,CAAC,EAAE,YAAa,UAAS,KAAK,GAAG,EAAE,EAAE,0CAA0C;AAC7G,QAAI,EAAE,UAAU,cAAc,CAAC,EAAE,KAAM,UAAS,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,yCAAyC;AACjH,QAAI,EAAE,SAAS,KAAC,+BAAW,uBAAK,KAAK,WAAW,EAAE,KAAK,CAAC,EAAG,UAAS,KAAK,GAAG,EAAE,EAAE,4BAA4B,EAAE,KAAK,EAAE;AACrH,QAAI,KAAK,4BAA4B,EAAE,UAAU,cAAc,CAAC,EAAE,MAAO,UAAS,KAAK,GAAG,EAAE,EAAE,iCAAiC;AAAA,EACjI;AAGA,aAAW,MAAM,KAAK,YAAY,CAAC,GAAG;AACpC,UAAM,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;AACtC,QAAI,CAAC,EAAG,UAAS,KAAK,+BAA+B,EAAE,EAAE;AAAA,aAChD,CAAC,EAAE,MAAO,UAAS,KAAK,aAAa,EAAE,qBAAqB;AAAA,EACvE;AAGA,QAAM,UAAU,oBAAI,IAAoB;AACxC,aAAW,KAAK,MAAM;AACpB,eAAW,KAAK,EAAE,UAAU,CAAC,GAAG;AAC9B,YAAM,OAAO,QAAQ,IAAI,CAAC;AAC1B,UAAI,KAAM,UAAS,KAAK,YAAY,CAAC,sCAAsC,IAAI,KAAK,EAAE,EAAE,GAAG;AAAA,UACtF,SAAQ,IAAI,GAAG,EAAE,EAAE;AAAA,IAC1B;AAAA,EACF;AAGA,MAAI,KAAK,UAAU;AACjB,UAAM,aAAa,IAAI,IAAI,KAAK,SAAS,CAAC;AAC1C,eAAW,KAAK,YAAY;AAC1B,UAAI,CAAC,QAAQ,IAAI,CAAC,EAAG,UAAS,KAAK,4DAAuD,CAAC,EAAE;AAAA,IAC/F;AACA,eAAW,KAAK,QAAQ,KAAK,GAAG;AAC9B,UAAI,CAAC,WAAW,IAAI,CAAC,EAAG,UAAS,KAAK,oDAA+C,CAAC,EAAE;AAAA,IAC1F;AAAA,EACF;AAEA,SAAO;AACT;;;ACxEA,IAAM,SAAS;AAAA,EACb,MAAM,EAAE,MAAM,SAAS;AAAA,EACvB,QAAQ,EAAE,MAAM,UAAU;AAAA,EAC1B,MAAM,EAAE,MAAM,OAAO;AAAA,EACrB,OAAO,EAAE,MAAM,UAAU;AAC3B;AAEA,IAAM,QAAQ,EAAE,IAAI,KAAK,MAAM,UAAU,QAAQ,MAAM,MAAM,EAAE,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE;AAE7F,SAAS,gBAAgB,GAAoB;AAG3C,QAAM,OAAO,CAAC,MAAgB;AAC5B,QAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,EAAE,IAAI,IAAI;AACvC,QAAI,KAAK,OAAO,MAAM,UAAU;AAC9B,aAAO,OAAO,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAQ,OAAQ,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,GAAI,IAAI,CAAC,CAAC;AAAA,IACjF;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,UAAU,KAAK,CAAC,CAAC;AAC/B;AAMA,eAAsB,kBACpB,QACA,OAA4B,CAAC,GACV;AACnB,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,WAAqB,CAAC;AAE5B,QAAM,OAAO,UAAU;AACvB,MAAI;AACF,UAAM,OAAO,WAAW,QAAQ,EAAE,MAAM,QAAQ,QAAQ,OAAO,CAAC;AAChE,UAAM,OAAO,OAAO,QAAQ,EAAE,GAAG,MAAM,CAAC;AAIxC,UAAM,OAAO,MAAM,OAAO,KAAK,QAAQ,EAAE,QAAQ,OAAO,EAAE,IAAI,MAAM,GAAG,EAAE,CAAC;AAC1E,QAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,GAAG;AAC7C,eAAS,KAAK,iBAAiB,MAAM,QAAQ,IAAI,IAAI,GAAG,KAAK,MAAM,UAAU,OAAO,IAAI,sBAAsB;AAC9G,aAAO;AAAA,IACT;AACA,UAAM,MAAM,KAAK,CAAC;AAElB,QAAI,IAAI,WAAW,MAAM;AACvB,eAAS,KAAK,oDAAoD,OAAO,IAAI,MAAM,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,EAAE;AAAA,IACrH;AACA,QAAI,gBAAgB,IAAI,IAAI,MAAM,gBAAgB,MAAM,IAAI,GAAG;AAC7D,eAAS,KAAK,4CAA4C,KAAK,UAAU,MAAM,IAAI,CAAC,SAAS,OAAO,IAAI,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,EAAE;AAAA,IAC5I;AACA,QAAI,IAAI,UAAU,GAAG;AACnB,eAAS,KAAK,+CAA+C,OAAO,IAAI,KAAK,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,EAAE;AAAA,IAC9G;AAAA,EACF,UAAE;AACA,UAAM,OAAO,aAAa;AAAA,EAC5B;AAEA,SAAO;AACT;","names":[]}