@caelo-cms/provisioning 0.10.53 → 0.10.55

package/dist/agent-db.js

@@ -382,6 +382,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a;
   for (let i = start;i < issues.length; i++) {
@@ -1379,7 +1391,7 @@ ${content.join(`
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // ../../node_modules/zod/v4/core/schemas.js
@@ -1931,6 +1943,29 @@ var $ZodNever = /* @__PURE__ */ $constructor("$ZodNever", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse(payload, ctx);
+  };
+}
+var arraySize = (input) => Array.isArray(input) ? input.length : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -1974,6 +2009,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
   const isPresent = key in input;
@@ -6921,7 +6957,7 @@ var PLATFORM_UPDATE_STALE_REASON = "The upgrader stopped before it finished (its
 var PLATFORM_UPDATE_EVENT_MAX = 4000;
 var SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
 var releaseVersionSchema = string2().regex(SEMVER, "expected a release version like 0.11.0 (no leading v)");
-var UPDATE_POLICY_MODES = ["off", "notify", "auto"];
+var UPDATE_POLICY_MODES = ["notify", "auto"];
 var UPDATE_POLICY_CHANNELS = ["stable", "rc", "beta", "alpha"];
 var WALL_CLOCK = /^([01]\d|2[0-3]):[0-5]\d$/;
 function isKnownTimeZone(tz) {
@@ -6937,6 +6973,7 @@ var updatePolicySchema = object({
   autoSecurity: boolean2(),
   autoPatch: boolean2(),
   autoMinor: boolean2(),
+  autoConverge: boolean2(),
   channel: _enum(UPDATE_POLICY_CHANNELS),
   windowStart: string2().regex(WALL_CLOCK, "expected HH:MM").nullable(),
   windowEnd: string2().regex(WALL_CLOCK, "expected HH:MM").nullable(),
@@ -7079,6 +7116,119 @@ var counters = new Map;
 var NAV_FUNCTIONAL_CSS = ".caelo-nav-menu .caelo-nav-toggle{display:none;background:none;border:0;cursor:pointer;padding:0.5rem;color:inherit;font:inherit}" + ".caelo-nav-menu .caelo-nav-toggle .caelo-nav-bar{display:block;width:1.25em;height:2px;background:currentColor;margin:0.25em 0}" + "@media (max-width: 720px){" + ".caelo-nav-menu .caelo-nav-toggle{display:inline-block}" + ".caelo-nav-menu > ul{display:none}" + '.caelo-nav-menu[data-nav-open="true"] > ul{display:block}' + "}";
 var NAV_TOGGLE_JS = "(function(){" + "document.querySelectorAll('.caelo-nav-menu').forEach(function(nav){" + "var btn=nav.querySelector('.caelo-nav-toggle');if(!btn)return;" + "btn.addEventListener('click',function(){" + "var open=nav.getAttribute('data-nav-open')==='true';" + "nav.setAttribute('data-nav-open',String(!open));" + "btn.setAttribute('aria-expanded',String(!open));" + "});" + "nav.addEventListener('keydown',function(e){" + "if(e.key==='Escape'&&nav.getAttribute('data-nav-open')==='true'){" + "nav.setAttribute('data-nav-open','false');" + "btn.setAttribute('aria-expanded','false');btn.focus();" + "}});" + "});" + "})();";
 
+// ../shared/src/media.ts
+var MEDIA_ALLOWED_MIMES = [
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/avif",
+  "image/gif",
+  "image/svg+xml",
+  "image/x-icon",
+  "application/pdf",
+  "video/mp4",
+  "font/woff2",
+  "font/woff",
+  "font/ttf",
+  "font/otf"
+];
+var MEDIA_SIZE_CAPS = {
+  "image/jpeg": 10 * 1024 * 1024,
+  "image/png": 10 * 1024 * 1024,
+  "image/webp": 10 * 1024 * 1024,
+  "image/avif": 10 * 1024 * 1024,
+  "image/gif": 8 * 1024 * 1024,
+  "image/svg+xml": 1 * 1024 * 1024,
+  "image/x-icon": 1 * 1024 * 1024,
+  "application/pdf": 20 * 1024 * 1024,
+  "video/mp4": 50 * 1024 * 1024,
+  "font/woff2": 5 * 1024 * 1024,
+  "font/woff": 5 * 1024 * 1024,
+  "font/ttf": 5 * 1024 * 1024,
+  "font/otf": 5 * 1024 * 1024
+};
+var MEDIA_HARD_LIMIT_BYTES = 50 * 1024 * 1024;
+var MEDIA_URL_PREFIX = "/_caelo/media";
+var RASTER_IMAGE_MIMES = new Set([
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/avif",
+  "image/gif"
+]);
+var mediaUrlPattern = new RegExp(`${MEDIA_URL_PREFIX}/([a-z0-9][a-z0-9-]{0,63})(?:/([a-z][a-z0-9-]{0,63}))?`, "g");
+var sha256Schema = string2().regex(/^[0-9a-f]{64}$/, "must be hex sha256");
+var mediaVisibilitySchema = _enum(["library", "reference"]);
+var mediaUploadInputSchema = object({
+  sha256: sha256Schema,
+  originalName: string2().min(1).max(512),
+  name: string2().max(200).optional(),
+  mime: _enum(MEDIA_ALLOWED_MIMES),
+  sizeBytes: number2().int().positive(),
+  width: number2().int().positive().nullable(),
+  height: number2().int().positive().nullable(),
+  alt: string2().max(2048).default(""),
+  storageKey: string2().min(1),
+  storageProvider: string2().min(1).max(64).default("local"),
+  sourceKind: _enum(["upload", "ai_generated", "imported", "external"]).optional(),
+  sourceDetail: string2().max(2048).optional(),
+  license: string2().max(200).optional(),
+  visibility: mediaVisibilitySchema.optional(),
+  derivedFromId: string2().uuid().optional(),
+  variants: array(object({
+    variant: string2().min(1).max(64),
+    format: string2().min(1).max(32),
+    width: number2().int().positive().nullable(),
+    height: number2().int().positive().nullable(),
+    sizeBytes: number2().int().positive(),
+    storageKey: string2().min(1)
+  })).min(1)
+}).strict();
+var mediaListInputSchema = object({
+  query: string2().max(256).optional(),
+  mime: _enum(MEDIA_ALLOWED_MIMES).optional(),
+  sort: _enum(["recent", "most_used"]).default("recent"),
+  visibility: _enum(["library", "reference", "all"]).default("library"),
+  limit: number2().int().positive().max(200).default(60),
+  offset: number2().int().nonnegative().default(0)
+}).strict();
+var mediaUpdateAltInputSchema = object({
+  assetId: string2().uuid(),
+  alt: string2().max(2048)
+}).strict();
+var mediaSetSourceInputSchema = object({
+  assetId: string2().uuid(),
+  sourceKind: _enum(["upload", "ai_generated", "imported", "external"]).optional(),
+  sourceDetail: string2().max(2048).optional(),
+  license: string2().max(200).optional()
+}).strict();
+var mediaSetVisibilityInputSchema = object({
+  assetId: string2().uuid(),
+  visibility: mediaVisibilitySchema
+}).strict();
+var mediaDeleteInputSchema = object({
+  assetId: string2().uuid(),
+  force: boolean2().default(false)
+}).strict();
+var mediaRecordUsageInputSchema = object({
+  deltas: record(string2().uuid(), number2().int())
+}).strict();
+var mediaSetCdnInputSchema = object({
+  enabled: boolean2(),
+  threshold: number2().int().min(1).max(1e4)
+}).strict();
+
+// ../shared/src/link-refs.ts
+var UUID_SRC = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+var QUERY_SRC = "[A-Za-z0-9_\\-.~%=&;+/:@!$()*]{1,512}";
+var ANCHOR_SRC = "[A-Za-z0-9_\\-.~%:]{1,256}";
+var VARIANT_SRC = "[a-z][a-z0-9-]{0,63}";
+var ID_END_SRC = "(?![A-Za-z0-9_/\\-])";
+var PAGE_BODY_SRC = `page/(${UUID_SRC})${ID_END_SRC}(?:\\?(${QUERY_SRC}))?(?:#(${ANCHOR_SRC}))?`;
+var MEDIA_BODY_SRC = `media/(${UUID_SRC})(?:/(${VARIANT_SRC}))?${ID_END_SRC}`;
+var PAGE_REF_EXACT = new RegExp(`^caelo:${PAGE_BODY_SRC}$`);
+var MEDIA_REF_EXACT = new RegExp(`^caelo:${MEDIA_BODY_SRC}$`);
+
 // ../../node_modules/mustache/mustache.mjs
 /*!
  * mustache.js - Logic-less {{mustache}} templates with JavaScript
@@ -7551,6 +7701,21 @@ var THEME_ASSET_KEY_TO_SLOT = {
 };
 var THEME_ASSET_KEYS = Object.keys(THEME_ASSET_KEY_TO_SLOT);
 
+// ../shared/src/template-balance.ts
+var RAW_TEXT_ELEMENTS = new Set([
+  "script",
+  "style",
+  "textarea",
+  "title",
+  "xmp",
+  "iframe",
+  "noembed",
+  "noframes",
+  "noscript"
+]);
+var CODE_ELEMENTS = new Set(["script", "style"]);
+var FOREIGN_ROOTS = new Set(["svg", "math"]);
+
 // ../shared/src/font-assets.ts
 var fontRef = object({ id: string2().uuid(), sha256: string2().regex(/^[a-f0-9]{64}$/) }).strict();
 var fontLicense = object({
@@ -7908,6 +8073,8 @@ var SYSTEM_FONT_FAMILIES = new Set([
   "lucida console",
   "lucida sans"
 ].map((f) => f.toLowerCase()));
+var UNICODE_RANGE_ITEM = "U\\+[0-9A-F?]{1,6}(?:-[0-9A-F]{1,6})?";
+var UNICODE_RANGE_RE = new RegExp(`^${UNICODE_RANGE_ITEM}(?:, *${UNICODE_RANGE_ITEM})*$`, "i");
 // ../shared/src/genesis.ts
 var designBriefSchema = object({
   audience: string2().min(1).max(500).optional(),
@@ -7994,107 +8161,6 @@ var GENERIC_FONT_KEYWORDS = new Set([
 ]);
 // ../shared/src/markup-structure.ts
 var LEAF_TAGS = new Set(["svg", "math", "script", "style", "noscript", "iframe"]);
-// ../shared/src/media.ts
-var MEDIA_ALLOWED_MIMES = [
-  "image/jpeg",
-  "image/png",
-  "image/webp",
-  "image/avif",
-  "image/gif",
-  "image/svg+xml",
-  "image/x-icon",
-  "application/pdf",
-  "video/mp4",
-  "font/woff2",
-  "font/woff",
-  "font/ttf",
-  "font/otf"
-];
-var MEDIA_SIZE_CAPS = {
-  "image/jpeg": 10 * 1024 * 1024,
-  "image/png": 10 * 1024 * 1024,
-  "image/webp": 10 * 1024 * 1024,
-  "image/avif": 10 * 1024 * 1024,
-  "image/gif": 8 * 1024 * 1024,
-  "image/svg+xml": 1 * 1024 * 1024,
-  "image/x-icon": 1 * 1024 * 1024,
-  "application/pdf": 20 * 1024 * 1024,
-  "video/mp4": 50 * 1024 * 1024,
-  "font/woff2": 5 * 1024 * 1024,
-  "font/woff": 5 * 1024 * 1024,
-  "font/ttf": 5 * 1024 * 1024,
-  "font/otf": 5 * 1024 * 1024
-};
-var MEDIA_HARD_LIMIT_BYTES = 50 * 1024 * 1024;
-var MEDIA_URL_PREFIX = "/_caelo/media";
-var RASTER_IMAGE_MIMES = new Set([
-  "image/jpeg",
-  "image/png",
-  "image/webp",
-  "image/avif",
-  "image/gif"
-]);
-var mediaUrlPattern = new RegExp(`${MEDIA_URL_PREFIX}/([a-z0-9][a-z0-9-]{0,63})(?:/([a-z][a-z0-9-]{0,63}))?`, "g");
-var sha256Schema = string2().regex(/^[0-9a-f]{64}$/, "must be hex sha256");
-var mediaVisibilitySchema = _enum(["library", "reference"]);
-var mediaUploadInputSchema = object({
-  sha256: sha256Schema,
-  originalName: string2().min(1).max(512),
-  name: string2().max(200).optional(),
-  mime: _enum(MEDIA_ALLOWED_MIMES),
-  sizeBytes: number2().int().positive(),
-  width: number2().int().positive().nullable(),
-  height: number2().int().positive().nullable(),
-  alt: string2().max(2048).default(""),
-  storageKey: string2().min(1),
-  storageProvider: string2().min(1).max(64).default("local"),
-  sourceKind: _enum(["upload", "ai_generated", "imported", "external"]).optional(),
-  sourceDetail: string2().max(2048).optional(),
-  license: string2().max(200).optional(),
-  visibility: mediaVisibilitySchema.optional(),
-  derivedFromId: string2().uuid().optional(),
-  variants: array(object({
-    variant: string2().min(1).max(64),
-    format: string2().min(1).max(32),
-    width: number2().int().positive().nullable(),
-    height: number2().int().positive().nullable(),
-    sizeBytes: number2().int().positive(),
-    storageKey: string2().min(1)
-  })).min(1)
-}).strict();
-var mediaListInputSchema = object({
-  query: string2().max(256).optional(),
-  mime: _enum(MEDIA_ALLOWED_MIMES).optional(),
-  sort: _enum(["recent", "most_used"]).default("recent"),
-  visibility: _enum(["library", "reference", "all"]).default("library"),
-  limit: number2().int().positive().max(200).default(60),
-  offset: number2().int().nonnegative().default(0)
-}).strict();
-var mediaUpdateAltInputSchema = object({
-  assetId: string2().uuid(),
-  alt: string2().max(2048)
-}).strict();
-var mediaSetSourceInputSchema = object({
-  assetId: string2().uuid(),
-  sourceKind: _enum(["upload", "ai_generated", "imported", "external"]).optional(),
-  sourceDetail: string2().max(2048).optional(),
-  license: string2().max(200).optional()
-}).strict();
-var mediaSetVisibilityInputSchema = object({
-  assetId: string2().uuid(),
-  visibility: mediaVisibilitySchema
-}).strict();
-var mediaDeleteInputSchema = object({
-  assetId: string2().uuid(),
-  force: boolean2().default(false)
-}).strict();
-var mediaRecordUsageInputSchema = object({
-  deltas: record(string2().uuid(), number2().int())
-}).strict();
-var mediaSetCdnInputSchema = object({
-  enabled: boolean2(),
-  threshold: number2().int().min(1).max(1e4)
-}).strict();
 // ../shared/src/page-log.ts
 var pageLogEntryKinds = [
   "edited",
@@ -18018,6 +18084,9 @@ class DatabaseAdapter {
     return this.#publicRaw;
   }
   async provisionPluginPublicSchema(opts) {
+    if (!/^[0-9a-f-]{36}$/i.test(opts.pluginId)) {
+      throw new Error(`provisionPluginPublicSchema: pluginId "${opts.pluginId}" is not a UUID`);
+    }
     if (!this.#skipVerify)
       await this.verifyRoles();
     await this.#public.transaction(async (tx) => {
@@ -18027,12 +18096,15 @@ class DatabaseAdapter {
     });
   }
   async provisionPluginAdminSchema(opts) {
+    if (!/^[0-9a-f-]{36}$/i.test(opts.pluginId)) {
+      throw new Error(`provisionPluginAdminSchema: pluginId "${opts.pluginId}" is not a UUID`);
+    }
     const admin = this.#adminDb("provisionPluginAdminSchema");
     if (!this.#skipVerify)
       await this.verifyRoles();
     await admin.transaction(async (tx) => {
       await tx.execute(sql.raw("SELECT set_config('caelo.actor_kind', 'system', true)"));
-      await tx.execute(sql.raw(`SELECT set_config('caelo.plugin_id', '${opts.pluginId}', true)`));
+      await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${opts.pluginId}, true)`);
       await tx.execute(sql.raw(opts.sql));
     });
   }
@@ -18067,7 +18139,18 @@ class DatabaseAdapter {
   }
 }
 // ../query-api/src/audit.ts
-var SENSITIVE_KEYS = new Set(["password", "token", "csrfToken", "passwordHash"]);
+var SENSITIVE_KEYS = new Set([
+  "password",
+  "newPassword",
+  "currentPassword",
+  "token",
+  "csrfToken",
+  "passwordHash",
+  "secret",
+  "apiKey",
+  "clientSecret"
+]);
+var SENSITIVE_KEY_RE = /pass(word|wd|phrase)?|secret|token|api[-_]?key|credential|private[-_]?key/i;
 function redact2(value) {
   if (value === null || value === undefined)
     return value;
@@ -18076,7 +18159,9 @@ function redact2(value) {
   if (typeof value === "object") {
     const out = {};
     for (const [k, v] of Object.entries(value)) {
-      out[k] = SENSITIVE_KEYS.has(k) ? "<redacted>" : redact2(v);
+      if (k === "__proto__" || k === "constructor" || k === "prototype")
+        continue;
+      out[k] = SENSITIVE_KEYS.has(k) || SENSITIVE_KEY_RE.test(k) ? "<redacted>" : redact2(v);
     }
     return out;
   }
@@ -18212,11 +18297,12 @@ class OperationRegistry {
 }
 // ../platform-updater/src/ops.ts
 var policySchema = object({
-  mode: _enum(["off", "notify", "auto"]),
+  mode: _enum(UPDATE_POLICY_MODES),
   autoSecurity: boolean2(),
   autoPatch: boolean2(),
   autoMinor: boolean2(),
-  channel: _enum(["stable", "rc", "beta", "alpha"]),
+  autoConverge: boolean2(),
+  channel: _enum(UPDATE_POLICY_CHANNELS),
   windowStart: string2().nullable(),
   windowEnd: string2().nullable(),
   windowTimezone: string2(),
@@ -18285,7 +18371,7 @@ var jobClaimOp = defineOperation({
     if (!row)
       return ok({ recovered: stale.map((s) => s.id), claimed: null });
     const policies = await tx.execute(sql`
-      SELECT mode, auto_security, auto_patch, auto_minor, channel,
+      SELECT mode, auto_security, auto_patch, auto_minor, auto_converge, channel,
              to_char(window_start, 'HH24:MI') AS window_start,
              to_char(window_end, 'HH24:MI') AS window_end,
              window_timezone, soak_hours, security_soak_hours, paused, paused_reason,
@@ -18308,6 +18394,7 @@ var jobClaimOp = defineOperation({
           autoSecurity: p.auto_security,
           autoPatch: p.auto_patch,
           autoMinor: p.auto_minor,
+          autoConverge: p.auto_converge,
           channel: p.channel,
           windowStart: p.window_start,
           windowEnd: p.window_end,

package/dist/audit-job-setup.d.ts

@@ -0,0 +1,69 @@
+import { type GcloudRunner, type Sleep } from "./gcloud-retry.js";
+import type { GcpProvider } from "./stack-contract.js";
+/** Where the admin image ships the task's entry point. */
+export declare const AUDIT_TASK_SCRIPT = "/app/packages/admin-core/src/quality/audit-task.ts";
+/** How many audit tasks run at once by default: 5 pages x 3 runs. */
+export declare const AUDIT_PARALLELISM_DEFAULT = 15;
+/**
+ * Roles the audit job's identity must never hold anywhere. Prefix matches
+ * (`roles/secretmanager.` = every Secret Manager role).
+ */
+export declare const AUDIT_FORBIDDEN_ROLES: readonly ["roles/owner", "roles/editor", "roles/run.", "roles/iam.", "roles/secretmanager.", "roles/cloudsql.", "roles/compute.", "roles/resourcemanager.", "roles/storage.admin", "roles/storage.objectAdmin", "roles/storage.objectUser"];
+/** Delete results after a day: the admin reads them within minutes. */
+export declare const AUDIT_RESULTS_LIFECYCLE: {
+    rule: {
+        action: {
+            type: string;
+        };
+        condition: {
+            age: number;
+        };
+    }[];
+};
+export interface AuditJobTarget {
+    readonly provider: GcpProvider;
+    readonly projectId: string;
+    readonly region: string;
+    /** Pulumi stack name (`production`). */
+    readonly env: string;
+    /** The admin image the job runs, digest-pinned (`…/admin@sha256:…`). */
+    readonly adminImageRef: string;
+    /**
+     * Tasks at once (`auditParallelism`, 1–15). Absent on converge: an
+     * existing job keeps the value it has, so an operator's choice survives
+     * `upgrade`; a job the converge creates gets
+     * {@link AUDIT_PARALLELISM_DEFAULT}, as a fresh install's does.
+     */
+    readonly parallelism?: number;
+}
+export type AuditJobResult = {
+    readonly ok: true;
+    readonly done: string[];
+} | {
+    readonly ok: false;
+    readonly done: string[];
+    readonly error: string;
+};
+/** Ensure the audit job and everything it needs. Never throws for a gcloud failure. */
+export declare function ensureAuditJob(target: AuditJobTarget, deps?: {
+    run?: GcloudRunner;
+    sleep?: Sleep;
+}): Promise<AuditJobResult>;
+/**
+ * {@link ensureAuditJob}'s image: the deployed admin's, so the job runs the
+ * code the admin runs.
+ */
+export declare function resolveAdminImage(opts: {
+    readonly projectId: string;
+    readonly region: string;
+    readonly env: string;
+}, deps?: {
+    run?: GcloudRunner;
+}): Promise<{
+    ok: true;
+    imageRef: string;
+} | {
+    ok: false;
+    error: string;
+}>;
+//# sourceMappingURL=audit-job-setup.d.ts.map

package/dist/audit-job-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-job-setup.d.ts","sourceRoot":"","sources":["../src/audit-job-setup.ts"],"names":[],"mappings":"AAgDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAS3F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,uDAAuD,CAAC;AAEtF,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAS5C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,6OAYxB,CAAC;AAEX,uEAAuE;AACvE,eAAO,MAAM,uBAAuB;;;;;;;;;CAEnC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,uFAAuF;AACvF,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,cAAc,CAAC,CA6NzB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACnF,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAQxE"}