@adcp/eslint-plugin 0.0.0 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adcp/eslint-plugin",
-  "version": "0.0.0",
+  "version": "0.1.2",
   "description": "ESLint rules for AdCP adopters — flags credential-handling antipatterns at lint time. Build-time sibling to the SDK's `credentialPolicy: 'authInfo-only'` runtime guard.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -35,11 +35,14 @@
   "bugs": {
     "url": "https://github.com/adcontextprotocol/adcp-client/issues"
   },
+  "publishConfig": {
+    "access": "public"
+  },
   "peerDependencies": {
     "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"
   },
   "dependencies": {
-    "@adcp/sdk": "^7.3.0",
+    "@adcp/sdk": "^8.0.0",
     "@typescript-eslint/utils": "^8.0.0"
   },
   "devDependencies": {

package/dist/index.d.ts

@@ -1,43 +0,0 @@
-/**
- * @adcp/eslint-plugin entry.
- *
- * Exposes the rules namespace and a `recommended` config. Adopters wire it
- * as:
- *
- * ```js
- * // .eslintrc.cjs
- * module.exports = {
- *   plugins: ['@adcp'],
- *   extends: ['plugin:@adcp/recommended'],
- * };
- * ```
- *
- * Or, in flat-config style:
- *
- * ```js
- * import adcp from '@adcp/eslint-plugin';
- *
- * export default [
- *   {
- *     plugins: { '@adcp': adcp },
- *     rules: { '@adcp/no-credential-read-from-args': 'error' },
- *   },
- * ];
- * ```
- */
-export declare const rules: {
-    'no-credential-read-from-args': import("@typescript-eslint/utils/dist/ts-eslint").RuleModule<"credentialReadFromArgs", [({
-        additionalPatterns?: string[];
-    } | undefined)?], unknown, import("@typescript-eslint/utils/dist/ts-eslint").RuleListener> & {
-        name: string;
-    };
-};
-export declare const configs: {
-    recommended: {
-        plugins: string[];
-        rules: {
-            '@adcp/no-credential-read-from-args': string;
-        };
-    };
-};
-//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,eAAO,MAAM,KAAK;;;;;;CAEjB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;CAOnB,CAAC"}

package/dist/index.js

@@ -1,46 +0,0 @@
-"use strict";
-/**
- * @adcp/eslint-plugin entry.
- *
- * Exposes the rules namespace and a `recommended` config. Adopters wire it
- * as:
- *
- * ```js
- * // .eslintrc.cjs
- * module.exports = {
- *   plugins: ['@adcp'],
- *   extends: ['plugin:@adcp/recommended'],
- * };
- * ```
- *
- * Or, in flat-config style:
- *
- * ```js
- * import adcp from '@adcp/eslint-plugin';
- *
- * export default [
- *   {
- *     plugins: { '@adcp': adcp },
- *     rules: { '@adcp/no-credential-read-from-args': 'error' },
- *   },
- * ];
- * ```
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.configs = exports.rules = void 0;
-const no_credential_read_from_args_1 = __importDefault(require("./rules/no-credential-read-from-args"));
-exports.rules = {
-    'no-credential-read-from-args': no_credential_read_from_args_1.default,
-};
-exports.configs = {
-    recommended: {
-        plugins: ['@adcp'],
-        rules: {
-            '@adcp/no-credential-read-from-args': 'error',
-        },
-    },
-};
-//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;;;;AAEH,wGAA4E;AAE/D,QAAA,KAAK,GAAG;IACnB,8BAA8B,EAAE,sCAAwB;CACzD,CAAC;AAEW,QAAA,OAAO,GAAG;IACrB,WAAW,EAAE;QACX,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,KAAK,EAAE;YACL,oCAAoC,EAAE,OAAO;SAC9C;KACF;CACF,CAAC"}

package/dist/rules/no-credential-read-from-args.d.ts

@@ -1,32 +0,0 @@
-/**
- * Flag credential-shaped reads off the buyer-supplied `args` bag inside
- * platform method implementations.
- *
- * Adopters keep reading `args.<vendor>_access_token` (and similar) inside
- * `extractContext` / `synthesizeFromArgs`, silently trusting buyer-supplied
- * identity material. The SDK's `credentialPolicy: 'authInfo-only'` catches
- * this at dispatch; this rule catches it at code-write time.
- *
- * Detection is method-name keyed (`extractContext`, `synthesizeFromArgs`),
- * not interface-type keyed — TypeScript type-graph analysis is unreliable
- * against duck-typed `definePlatform` shapes and class methods that don't
- * `implements` the interface explicitly.
- *
- * Credential-name patterns are the {@link DEFAULT_CREDENTIAL_PATTERNS}
- * exported from `@adcp/sdk/server`. Importing the constant directly keeps
- * the rule and the runtime guard in lockstep — adding a regex to the SDK
- * surfaces it at lint time automatically on next adopter `npm install`.
- *
- * @see adcontextprotocol/adcp-client#1541
- */
-import { ESLintUtils } from '@typescript-eslint/utils';
-type Options = [
-    {
-        additionalPatterns?: string[];
-    }?
-];
-declare const _default: ESLintUtils.RuleModule<"credentialReadFromArgs", Options, unknown, ESLintUtils.RuleListener> & {
-    name: string;
-};
-export default _default;
-//# sourceMappingURL=no-credential-read-from-args.d.ts.map

package/dist/rules/no-credential-read-from-args.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"no-credential-read-from-args.d.ts","sourceRoot":"","sources":["../../src/rules/no-credential-read-from-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAA4B,MAAM,0BAA0B,CAAC;AAWjF,KAAK,OAAO,GAAG;IACb;QACE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC/B,CAAC;CACH,CAAC;;;;AA0MF,wBA2JG"}

package/dist/rules/no-credential-read-from-args.js

@@ -1,360 +0,0 @@
-"use strict";
-/**
- * Flag credential-shaped reads off the buyer-supplied `args` bag inside
- * platform method implementations.
- *
- * Adopters keep reading `args.<vendor>_access_token` (and similar) inside
- * `extractContext` / `synthesizeFromArgs`, silently trusting buyer-supplied
- * identity material. The SDK's `credentialPolicy: 'authInfo-only'` catches
- * this at dispatch; this rule catches it at code-write time.
- *
- * Detection is method-name keyed (`extractContext`, `synthesizeFromArgs`),
- * not interface-type keyed — TypeScript type-graph analysis is unreliable
- * against duck-typed `definePlatform` shapes and class methods that don't
- * `implements` the interface explicitly.
- *
- * Credential-name patterns are the {@link DEFAULT_CREDENTIAL_PATTERNS}
- * exported from `@adcp/sdk/server`. Importing the constant directly keeps
- * the rule and the runtime guard in lockstep — adding a regex to the SDK
- * surfaces it at lint time automatically on next adopter `npm install`.
- *
- * @see adcontextprotocol/adcp-client#1541
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-const utils_1 = require("@typescript-eslint/utils");
-const server_1 = require("@adcp/sdk/server");
-const FLAGGED_METHOD_NAMES = new Set(['extractContext', 'synthesizeFromArgs']);
-const createRule = utils_1.ESLintUtils.RuleCreator(name => `https://github.com/adcontextprotocol/adcp-client/blob/main/packages/eslint-plugin/README.md#${name}`);
-/**
- * Build the active pattern set from the SDK defaults plus any
- * adopter-supplied `additionalPatterns`. Adopters using
- * `credentialPolicy.patterns.extend(...)` at runtime mirror the same
- * strings here for lint parity. A fully-replaceable
- * `credentialPolicy.matcher` function has no lint analogue — that's a
- * known gap documented in the README.
- */
-function buildPatternMatcher(extra) {
-    const extraRegexes = extra.map(p => new RegExp(p, 'i'));
-    const patterns = [...server_1.DEFAULT_CREDENTIAL_PATTERNS, ...extraRegexes];
-    return (name) => patterns.some(rx => rx.test(name));
-}
-/**
- * Return the property name from a MemberExpression's `property` slot when
- * the access is a plain identifier (`foo.bar`) or a string-literal computed
- * access (`foo['bar']`). Returns `null` for dynamic / non-literal accesses
- * — the rule cannot statically evaluate those and stays silent rather than
- * false-positive.
- */
-function propertyNameOf(node) {
-    if (!node.computed && node.property.type === utils_1.AST_NODE_TYPES.Identifier) {
-        return node.property.name;
-    }
-    if (node.computed && node.property.type === utils_1.AST_NODE_TYPES.Literal && typeof node.property.value === 'string') {
-        return node.property.value;
-    }
-    return null;
-}
-/**
- * Walk an arbitrary expression and return `true` when it bottoms out on
- * `<argsParamName>` — handles direct reference, `args.<x>`, and
- * `args.<x>.<y>` chains. The rule fires when ANY MemberExpression in
- * the chain reads a credential-shaped key, so detection is per-segment;
- * this helper is the "is this rooted at args?" check used to scope the
- * traversal.
- */
-function isRootedAtIdentifier(expr, name) {
-    let cur = expr;
-    while (cur.type === utils_1.AST_NODE_TYPES.MemberExpression) {
-        cur = cur.object;
-    }
-    return cur.type === utils_1.AST_NODE_TYPES.Identifier && cur.name === name;
-}
-/**
- * Extract the parameter name to scan for. The platform-method shape is
- * `(args, ctx) => …` or `(args: SomeArgs, ctx) => …`. We key on the
- * first parameter regardless of declared type — the rule is structural.
- *
- * Handles:
- *   - Plain identifier: `(args) => …`
- *   - Typed identifier: `(args: Foo) => …`
- *   - Default-value: `(args = {}) => …` — unwrap `AssignmentPattern.left`
- *   - Destructured first param: `({ access_token }) => …` (flagged via
- *     the destructure scan, not via this name)
- *   - Destructured with default: `({ access_token } = {}) => …` (same)
- *
- * Returns `null` when the function takes no params or when the first
- * param has no nameable identifier (pure destructure).
- */
-function firstParamIdentifierName(fn) {
-    const first = fn.params[0];
-    if (!first)
-        return null;
-    if (first.type === utils_1.AST_NODE_TYPES.Identifier)
-        return first.name;
-    if (first.type === utils_1.AST_NODE_TYPES.AssignmentPattern) {
-        const left = first.left;
-        if (left.type === utils_1.AST_NODE_TYPES.Identifier)
-            return left.name;
-    }
-    // ObjectPattern / ArrayPattern — destructure cases are caught by the
-    // ObjectPattern scan below, not here.
-    return null;
-}
-/**
- * Walk the first parameter's `ObjectPattern` (including when wrapped in
- * an `AssignmentPattern` for default-value forms like
- * `({ access_token } = {})`) and collect every destructured key, including
- * nested patterns. Reports paths like `args.context.access_token` so the
- * error message reflects the depth of the destructure.
- *
- * Recurses through nested `ObjectPattern`s (`{ context: { access_token } }`)
- * and handles renamed properties (`{ access_token: tok }` — fires on
- * `access_token`, the source key, not the alias). `RestElement` is
- * recorded as a binding but never matched against credential patterns:
- * the post-extraction `rest.access_token` read is an aliasing pattern
- * documented as out-of-scope.
- */
-function destructuredKeys(fn) {
-    const first = fn.params[0];
-    if (!first)
-        return [];
-    let pattern = first;
-    if (pattern.type === utils_1.AST_NODE_TYPES.AssignmentPattern) {
-        pattern = pattern.left;
-    }
-    if (pattern.type !== utils_1.AST_NODE_TYPES.ObjectPattern)
-        return [];
-    const out = [];
-    collectObjectPatternKeys(pattern, ['args'], out);
-    return out;
-}
-/**
- * Walk an ObjectPattern's properties, recursing into nested
- * ObjectPatterns. `pathSoFar` accumulates the dotted-path segments used
- * to render the error message (e.g. `['args', 'context']` →
- * `args.context.access_token`).
- */
-function collectObjectPatternKeys(pattern, pathSoFar, out) {
-    for (const prop of pattern.properties) {
-        if (prop.type === utils_1.AST_NODE_TYPES.RestElement)
-            continue;
-        if (prop.type !== utils_1.AST_NODE_TYPES.Property)
-            continue;
-        const keyName = propertyKeyName(prop.key, prop.computed);
-        if (keyName === null)
-            continue;
-        // `prop.value` is the binding target — either an Identifier (plain or
-        // renamed), an ObjectPattern (nested destructure), or an
-        // AssignmentPattern wrapping either of those.
-        let valueNode = prop.value;
-        if (valueNode.type === utils_1.AST_NODE_TYPES.AssignmentPattern) {
-            valueNode = valueNode.left;
-        }
-        if (valueNode.type === utils_1.AST_NODE_TYPES.ObjectPattern) {
-            collectObjectPatternKeys(valueNode, [...pathSoFar, keyName], out);
-            continue;
-        }
-        // Leaf binding — report at the source key (`prop.key`), not the
-        // alias (`prop.value`), so the error highlights the credential name
-        // the buyer would supply, not the local variable name the adopter
-        // chose.
-        out.push({
-            path: [...pathSoFar, keyName].join('.'),
-            node: prop.key,
-        });
-    }
-}
-function propertyKeyName(key, computed) {
-    if (!computed && key.type === utils_1.AST_NODE_TYPES.Identifier)
-        return key.name;
-    if (key.type === utils_1.AST_NODE_TYPES.Literal && typeof key.value === 'string')
-        return key.value;
-    return null;
-}
-/**
- * Return the method name for any function node, when that function is
- * itself the value of a property / method in an object literal or a class
- * body. Returns `null` for free-standing function declarations or
- * arrow-callback expressions whose enclosing context isn't a method
- * binding. The rule fires only when this returns a name in
- * {@link FLAGGED_METHOD_NAMES}.
- *
- * Cases handled:
- *   - Object property: `{ extractContext: (args) => … }` / `{ extractContext(args) { … } }`
- *   - Class method: `class Foo { extractContext(args) { … } }`
- *
- * `FunctionDeclaration`s (`function extractContext(args) { … }`) are
- * intentionally NOT matched — free-standing functions named
- * `extractContext` are rare and the false-positive cost outweighs the
- * duck-typed coverage win.
- */
-function methodNameForFunction(fn) {
-    if (fn.type === utils_1.AST_NODE_TYPES.FunctionDeclaration) {
-        return null;
-    }
-    const parent = fn.parent;
-    if (!parent)
-        return null;
-    if (parent.type === utils_1.AST_NODE_TYPES.Property) {
-        const key = parent.key;
-        if (!parent.computed && key.type === utils_1.AST_NODE_TYPES.Identifier)
-            return key.name;
-        if (key.type === utils_1.AST_NODE_TYPES.Literal && typeof key.value === 'string')
-            return key.value;
-        return null;
-    }
-    if (parent.type === utils_1.AST_NODE_TYPES.MethodDefinition) {
-        const key = parent.key;
-        if (!parent.computed && key.type === utils_1.AST_NODE_TYPES.Identifier)
-            return key.name;
-        if (key.type === utils_1.AST_NODE_TYPES.Literal && typeof key.value === 'string')
-            return key.value;
-        return null;
-    }
-    return null;
-}
-exports.default = createRule({
-    name: 'no-credential-read-from-args',
-    meta: {
-        type: 'problem',
-        docs: {
-            description: 'Disallow reading credential-shaped keys off the buyer-supplied args bag inside extractContext / synthesizeFromArgs.',
-        },
-        messages: {
-            credentialReadFromArgs: 'Reading credential-shaped key {{path}} from `args` trusts buyer-supplied identity. Re-derive bearers per request from `ctx.authInfo` + your token cache; embed only non-secret upstream IDs in `args`.',
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    additionalPatterns: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        description: 'Extra regex patterns appended to DEFAULT_CREDENTIAL_PATTERNS. Mirror your credentialPolicy.patterns.extend contents here for lint parity.',
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [{}],
-    create(context) {
-        const options = context.options[0] ?? {};
-        const isCredentialName = buildPatternMatcher(options.additionalPatterns ?? []);
-        /**
-         * Stack of `{ argsParamName }` frames for the platform methods we're
-         * currently inside. The rule fires only when the stack is non-empty.
-         * Nested functions inside a flagged method inherit the parent frame;
-         * arrow callbacks that close over `args` still trip the scan.
-         */
-        const stack = [];
-        function enterFunction(fn) {
-            const methodName = methodNameForFunction(fn);
-            if (methodName !== null && FLAGGED_METHOD_NAMES.has(methodName)) {
-                const argsParamName = firstParamIdentifierName(fn);
-                stack.push({ argsParamName });
-                // Destructure form: `({ access_token, ... }) => …` (with or
-                // without an `AssignmentPattern` default-value wrapper, and
-                // including nested patterns) — flag at each leaf destructure
-                // site. MemberExpression traversal can't see these because the
-                // access never happens.
-                for (const { path, node } of destructuredKeys(fn)) {
-                    // `path` is `args.<...>.<key>`; the leaf segment is the key
-                    // whose name decides credential-shape.
-                    const segments = path.split('.');
-                    const leaf = segments[segments.length - 1];
-                    if (leaf && isCredentialName(leaf)) {
-                        context.report({
-                            node,
-                            messageId: 'credentialReadFromArgs',
-                            data: { path },
-                        });
-                    }
-                }
-            }
-        }
-        function exitFunction(fn) {
-            const methodName = methodNameForFunction(fn);
-            if (methodName !== null && FLAGGED_METHOD_NAMES.has(methodName)) {
-                stack.pop();
-            }
-        }
-        function currentFrame() {
-            if (stack.length === 0)
-                return null;
-            return stack[stack.length - 1] ?? null;
-        }
-        return {
-            FunctionDeclaration: enterFunction,
-            'FunctionDeclaration:exit': exitFunction,
-            FunctionExpression: enterFunction,
-            'FunctionExpression:exit': exitFunction,
-            ArrowFunctionExpression: enterFunction,
-            'ArrowFunctionExpression:exit': exitFunction,
-            VariableDeclarator(node) {
-                const frame = currentFrame();
-                if (!frame || frame.argsParamName === null)
-                    return;
-                // Only handle `const { ... } = args` shapes — the args parameter
-                // name has to appear on the right-hand side as an Identifier.
-                if (!node.init || node.init.type !== utils_1.AST_NODE_TYPES.Identifier)
-                    return;
-                if (node.init.name !== frame.argsParamName)
-                    return;
-                if (node.id.type !== utils_1.AST_NODE_TYPES.ObjectPattern)
-                    return;
-                const out = [];
-                collectObjectPatternKeys(node.id, [frame.argsParamName], out);
-                for (const entry of out) {
-                    const segments = entry.path.split('.');
-                    const leaf = segments[segments.length - 1];
-                    if (leaf && isCredentialName(leaf)) {
-                        context.report({
-                            node: entry.node,
-                            messageId: 'credentialReadFromArgs',
-                            data: { path: entry.path },
-                        });
-                    }
-                }
-            },
-            MemberExpression(node) {
-                const frame = currentFrame();
-                if (!frame || frame.argsParamName === null)
-                    return;
-                // Only scan accesses rooted at the args parameter.
-                if (!isRootedAtIdentifier(node.object, frame.argsParamName)) {
-                    return;
-                }
-                const propName = propertyNameOf(node);
-                if (propName === null)
-                    return;
-                if (!isCredentialName(propName))
-                    return;
-                // Reconstruct the dotted path for the error message. Walk from the
-                // member expression's leftmost identifier through each step.
-                const segments = [];
-                let cur = node;
-                while (cur.type === utils_1.AST_NODE_TYPES.MemberExpression) {
-                    const seg = propertyNameOf(cur);
-                    if (seg === null) {
-                        // Dynamic segment in the middle of the chain — bail; the error
-                        // message would be misleading. The current node's read is still
-                        // flagged on the way back up if it itself matches.
-                        segments.unshift('<dynamic>');
-                    }
-                    else {
-                        segments.unshift(seg);
-                    }
-                    cur = cur.object;
-                }
-                const path = `${frame.argsParamName}.${segments.join('.')}`;
-                context.report({
-                    node,
-                    messageId: 'credentialReadFromArgs',
-                    data: { path },
-                });
-            },
-        };
-    },
-});
-//# sourceMappingURL=no-credential-read-from-args.js.map

package/dist/rules/no-credential-read-from-args.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"no-credential-read-from-args.js","sourceRoot":"","sources":["../../src/rules/no-credential-read-from-args.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;AAEH,oDAAiF;AACjF,6CAA+D;AAE/D,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAE/E,MAAM,UAAU,GAAG,mBAAW,CAAC,WAAW,CACxC,IAAI,CAAC,EAAE,CAAC,+FAA+F,IAAI,EAAE,CAC9G,CAAC;AAUF;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,KAAe;IAC1C,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,CAAC,GAAG,oCAA2B,EAAE,GAAG,YAAY,CAAC,CAAC;IACnE,OAAO,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,IAA+B;IACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,sBAAc,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,IAAyB,EAAE,IAAY;IACnE,IAAI,GAAG,GAAwB,IAAI,CAAC;IACpC,OAAO,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,gBAAgB,EAAE,CAAC;QACpD,GAAG,GAAG,GAAG,CAAC,MAA6B,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB,CAC/B,EAAiG;IAEjG,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAChE,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAc,CAAC,iBAAiB,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAChE,CAAC;IACD,qEAAqE;IACrE,sCAAsC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,gBAAgB,CACvB,EAAiG;IAEjG,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,IAAI,OAAO,GAAkB,KAAK,CAAC;IACnC,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAc,CAAC,iBAAiB,EAAE,CAAC;QACtD,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAc,CAAC,aAAa;QAAE,OAAO,EAAE,CAAC;IAE7D,MAAM,GAAG,GAA4C,EAAE,CAAC;IACxD,wBAAwB,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,OAA+B,EAC/B,SAAmB,EACnB,GAA4C;IAE5C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAc,CAAC,WAAW;YAAE,SAAS;QACvD,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAc,CAAC,QAAQ;YAAE,SAAS;QAEpD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAE/B,sEAAsE;QACtE,yDAAyD;QACzD,8CAA8C;QAC9C,IAAI,SAAS,GAAkB,IAAI,CAAC,KAAK,CAAC;QAC1C,IAAI,SAAS,CAAC,IAAI,KAAK,sBAAc,CAAC,iBAAiB,EAAE,CAAC;YACxD,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC;QAC7B,CAAC;QAED,IAAI,SAAS,CAAC,IAAI,KAAK,sBAAc,CAAC,aAAa,EAAE,CAAC;YACpD,wBAAwB,CAAC,SAAS,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QAED,gEAAgE;QAChE,oEAAoE;QACpE,kEAAkE;QAClE,SAAS;QACT,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACvC,IAAI,EAAE,IAAI,CAAC,GAAG;SACf,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAgD,EAAE,QAAiB;IAC1F,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IACzE,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAC5B,EAAiG;IAEjG,IAAI,EAAE,CAAC,IAAI,KAAK,sBAAc,CAAC,mBAAmB,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAI,EAA4C,CAAC,MAAM,CAAC;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAc,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAChF,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAc,CAAC,gBAAgB,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAChF,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kBAAe,UAAU,CAAsB;IAC7C,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,qHAAqH;SACxH;QACD,QAAQ,EAAE;YACR,sBAAsB,EACpB,wMAAwM;SAC3M;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,kBAAkB,EAAE;wBAClB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,WAAW,EACT,2IAA2I;qBAC9I;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,CAAC;IACpB,MAAM,CAAC,OAAO;QACZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAE/E;;;;;WAKG;QACH,MAAM,KAAK,GAAuC,EAAE,CAAC;QAErD,SAAS,aAAa,CACpB,EAAiG;YAEjG,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,UAAU,KAAK,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChE,MAAM,aAAa,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;gBACnD,KAAK,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;gBAE9B,4DAA4D;gBAC5D,4DAA4D;gBAC5D,6DAA6D;gBAC7D,+DAA+D;gBAC/D,wBAAwB;gBACxB,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;oBAClD,4DAA4D;oBAC5D,uCAAuC;oBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC3C,IAAI,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;wBACnC,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI;4BACJ,SAAS,EAAE,wBAAwB;4BACnC,IAAI,EAAE,EAAE,IAAI,EAAE;yBACf,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,YAAY,CACnB,EAAiG;YAEjG,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,UAAU,KAAK,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChE,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,CAAC;QACH,CAAC;QAED,SAAS,YAAY;YACnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QACzC,CAAC;QAED,OAAO;YACL,mBAAmB,EAAE,aAAa;YAClC,0BAA0B,EAAE,YAAY;YACxC,kBAAkB,EAAE,aAAa;YACjC,yBAAyB,EAAE,YAAY;YACvC,uBAAuB,EAAE,aAAa;YACtC,8BAA8B,EAAE,YAAY;YAE5C,kBAAkB,CAAC,IAAiC;gBAClD,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;gBAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI;oBAAE,OAAO;gBAEnD,iEAAiE;gBACjE,8DAA8D;gBAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,sBAAc,CAAC,UAAU;oBAAE,OAAO;gBACvE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa;oBAAE,OAAO;gBACnD,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,sBAAc,CAAC,aAAa;oBAAE,OAAO;gBAE1D,MAAM,GAAG,GAA4C,EAAE,CAAC;gBACxD,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC9D,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC3C,IAAI,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;wBACnC,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,SAAS,EAAE,wBAAwB;4BACnC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;yBAC3B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,gBAAgB,CAAC,IAA+B;gBAC9C,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;gBAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI;oBAAE,OAAO;gBAEnD,mDAAmD;gBACnD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAA6B,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;oBACnF,OAAO;gBACT,CAAC;gBAED,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,QAAQ,KAAK,IAAI;oBAAE,OAAO;gBAC9B,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;oBAAE,OAAO;gBAExC,mEAAmE;gBACnE,6DAA6D;gBAC7D,MAAM,QAAQ,GAAa,EAAE,CAAC;gBAC9B,IAAI,GAAG,GAAwB,IAAI,CAAC;gBACpC,OAAO,GAAG,CAAC,IAAI,KAAK,sBAAc,CAAC,gBAAgB,EAAE,CAAC;oBACpD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;wBACjB,+DAA+D;wBAC/D,gEAAgE;wBAChE,mDAAmD;wBACnD,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;oBAChC,CAAC;yBAAM,CAAC;wBACN,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;oBACD,GAAG,GAAG,GAAG,CAAC,MAA6B,CAAC;gBAC1C,CAAC;gBACD,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,aAAa,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAE5D,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,wBAAwB;oBACnC,IAAI,EAAE,EAAE,IAAI,EAAE;iBACf,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}