@de-otio/trellis 0.4.0

package/dist/lib/exif-stripper.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * EXIF Stripping Utility
+ *
+ * PREPARATORY CHANGE: This utility is created now but not yet used in production.
+ * It will be enabled when implementing location safety features for at-risk users.
+ *
+ * Removes EXIF data from images for privacy.
+ * Can be enabled/disabled via configuration.
+ *
+ * FUTURE USE:
+ * - When EXIF_STRIPPING_ENABLED=true, this utility will strip EXIF data from
+ *   uploaded images before storing them
+ * - Prevents location data, device info, and timestamps from being embedded in images
+ * - Helps protect user privacy, especially for at-risk users
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripEXIF = stripEXIF;
+/**
+ * Strip EXIF data from image buffer
+ *
+ * FUTURE USE: This function will be called during media upload processing
+ * to remove EXIF data from images before storing them in R2.
+ *
+ * NOTE: This is currently a placeholder implementation.
+ * When implementing, use a library like 'piexifjs' or 'exifr' to actually
+ * remove EXIF data from the image buffer.
+ *
+ * @param imageBuffer - Image buffer to process
+ * @param config - Stripping configuration
+ * @returns Processed image buffer (with EXIF removed if enabled)
+ */
+async function stripEXIF(imageBuffer, config = {
+    enabled: true,
+    removeLocation: true,
+    removeDeviceInfo: true,
+    removeTimestamp: false, // Keep timestamp for now (can be enabled later)
+}) {
+    if (!config.enabled) {
+        return imageBuffer;
+    }
+    // TODO: Implement actual EXIF stripping using a library
+    // FUTURE IMPLEMENTATION:
+    // 1. Install library: npm install piexifjs or npm install exifr
+    // 2. Parse EXIF data from image buffer
+    // 3. Remove location data if removeLocation=true
+    // 4. Remove device info if removeDeviceInfo=true
+    // 5. Remove timestamp if removeTimestamp=true
+    // 6. Reconstruct image buffer without EXIF data
+    //
+    // Example with piexifjs:
+    // import piexif from 'piexifjs';
+    // const exifObj = piexif.load(imageBuffer);
+    // if (config.removeLocation) delete exifObj['GPS'];
+    // if (config.removeDeviceInfo) delete exifObj['0th'][piexif.ImageIFD.Make];
+    // const newBuffer = piexif.dump(exifObj);
+    // return newBuffer;
+    // For now, return buffer as-is (no breaking changes)
+    // This allows the utility to exist and be called without affecting current behavior
+    return imageBuffer;
+}
+//# sourceMappingURL=exif-stripper.js.map

package/dist/lib/exif-stripper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exif-stripper.js","sourceRoot":"","sources":["../../src/lib/exif-stripper.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAuBH,8BAiCC;AA/CD;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,SAAS,CAC7B,WAAwB,EACxB,SAA6B;IAC3B,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,IAAI;IACpB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,KAAK,EAAE,gDAAgD;CACzE;IAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,wDAAwD;IACxD,yBAAyB;IACzB,gEAAgE;IAChE,uCAAuC;IACvC,iDAAiD;IACjD,iDAAiD;IACjD,8CAA8C;IAC9C,gDAAgD;IAChD,EAAE;IACF,yBAAyB;IACzB,iCAAiC;IACjC,4CAA4C;IAC5C,oDAAoD;IACpD,4EAA4E;IAC5E,0CAA0C;IAC1C,oBAAoB;IAEpB,qDAAqD;IACrD,oFAAoF;IACpF,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/lib/extension-context.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Extension Context Factory
+ *
+ * Builds the scoped ExtensionContext that extensions receive instead of the
+ * full Env. Core secrets (SESSION_SECRET, DATABASE_URL, API keys) are never exposed.
+ */
+import type { ExtensionContext, TrellisExtension } from "@de-otio/trellis-extension-api";
+import type { GraphService } from "./graph";
+import type { Env } from "../env";
+/**
+ * Create a scoped ExtensionContext for an extension.
+ *
+ * @param ext - The extension to create context for
+ * @param env - The full application environment (secrets stay here)
+ * @param prisma - The full Prisma client (scoped down to safe tables)
+ * @param graph - The full GraphService (scoped to read-only methods)
+ */
+export declare function createExtensionContext(ext: TrellisExtension, env: Env, prisma: any, graph?: GraphService): ExtensionContext;
+//# sourceMappingURL=extension-context.d.ts.map

package/dist/lib/extension-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-context.d.ts","sourceRoot":"","sources":["../../src/lib/extension-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAEhB,gBAAgB,EACjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AA4BlC;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,gBAAgB,EACrB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,GAAG,EACX,KAAK,CAAC,EAAE,YAAY,GACnB,gBAAgB,CAmBlB"}

package/dist/lib/extension-context.js

@@ -0,0 +1,78 @@
+"use strict";
+/**
+ * Extension Context Factory
+ *
+ * Builds the scoped ExtensionContext that extensions receive instead of the
+ * full Env. Core secrets (SESSION_SECRET, DATABASE_URL, API keys) are never exposed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createExtensionContext = createExtensionContext;
+/**
+ * Build a read-only proxy over GraphService.
+ *
+ * Exposes only query methods — write methods (syncUser, removeUser,
+ * createRelationship, recordInteraction, etc.) are intentionally omitted
+ * so extensions cannot mutate graph state.
+ */
+function createReadOnlyGraphService(graph) {
+    return {
+        getRelationship: graph.getRelationship.bind(graph),
+        getRelationships: graph.getRelationships.bind(graph),
+        getRelationshipGraph: graph.getRelationshipGraph.bind(graph),
+        getCircleMembers: graph.getCircleMembers.bind(graph),
+        getVisiblePostIds: graph.getVisiblePostIds.bind(graph),
+        getGlanceItems: graph.getGlanceItems.bind(graph),
+        getDepthPostIds: graph.getDepthPostIds.bind(graph),
+        getCircleStatus: graph.getCircleStatus.bind(graph),
+        getCircleEntityStatus: graph.getCircleEntityStatus.bind(graph),
+        getEntityRelationships: graph.getEntityRelationships.bind(graph),
+        getPendingEntityRelationships: graph.getPendingEntityRelationships.bind(graph),
+        discoverByGraph: graph.discoverByGraph.bind(graph),
+        discoverNearby: graph.discoverNearby.bind(graph),
+        getRecommendations: graph.getRecommendations.bind(graph),
+    };
+}
+/**
+ * Create a scoped ExtensionContext for an extension.
+ *
+ * @param ext - The extension to create context for
+ * @param env - The full application environment (secrets stay here)
+ * @param prisma - The full Prisma client (scoped down to safe tables)
+ * @param graph - The full GraphService (scoped to read-only methods)
+ */
+function createExtensionContext(ext, env, prisma, graph) {
+    return {
+        db: {
+            entity: prisma.entity,
+            post: prisma.post,
+            postEntity: prisma.postEntity,
+            postMedia: prisma.postMedia,
+            taxonomyTaxon: prisma.taxonomyTaxon,
+            taxonomyCategory: prisma.taxonomyCategory,
+            taxonomyDimension: prisma.taxonomyDimension,
+            productTaxonomyTag: prisma.productTaxonomyTag,
+            activity: prisma.activity,
+        },
+        graphService: graph ? createReadOnlyGraphService(graph) : undefined,
+        appDomain: env.APP_DOMAIN ?? "",
+        appUrl: env.APP_URL ?? "",
+        stage: env.STAGE ?? "dev",
+        config: extractExtensionConfig(ext),
+    };
+}
+/**
+ * Extract only the env vars whose keys are declared in the extension's configSchema.
+ * This prevents extensions from reading SESSION_SECRET, DATABASE_URL, etc.
+ * via .passthrough() or .transform() on their Zod schema.
+ */
+function extractExtensionConfig(ext) {
+    if (!ext.configSchema || !("shape" in ext.configSchema))
+        return {};
+    const config = {};
+    for (const key of Object.keys(ext.configSchema.shape)) {
+        if (process.env[key])
+            config[key] = process.env[key];
+    }
+    return config;
+}
+//# sourceMappingURL=extension-context.js.map

package/dist/lib/extension-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-context.js","sourceRoot":"","sources":["../../src/lib/extension-context.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA4CH,wDAwBC;AA1DD;;;;;;GAMG;AACH,SAAS,0BAA0B,CAAC,KAAmB;IACrD,OAAO;QACL,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAClD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QACpD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QACpD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QACtD,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAChD,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAClD,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAClD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC9D,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAChE,6BAA6B,EAAE,KAAK,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC;QAC9E,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAChD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;KACzD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CACpC,GAAqB,EACrB,GAAQ,EACR,MAAW,EACX,KAAoB;IAEpB,OAAO;QACL,EAAE,EAAE;YACF,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B;QACD,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;QAC/B,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,KAAK;QACzB,MAAM,EAAE,sBAAsB,CAAC,GAAG,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,GAAqB;IAErB,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAE,GAAG,CAAC,YAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/extension-route-wrapper.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Extension Route Wrapper
+ *
+ * Converts ExtensionRouteDefinition → Route with core-applied:
+ * - Authentication (enforced by core, not extension)
+ * - CORS and CSRF middleware
+ * - Security headers
+ * - Error handling and logging
+ * - Scoped ExtensionContext (no secrets)
+ */
+import type { TrellisExtension, ExtensionRouteDefinition } from "@de-otio/trellis-extension-api";
+import type { Route } from "./routes/types";
+/**
+ * Wrap an extension route definition with core HTTP infrastructure.
+ */
+export declare function wrapExtensionRoute(ext: TrellisExtension, routeDef: ExtensionRouteDefinition): Route;
+/**
+ * Wrap all extension routes for a given extension.
+ */
+export declare function wrapExtensionRoutes(ext: TrellisExtension): Route[];
+//# sourceMappingURL=extension-route-wrapper.d.ts.map

package/dist/lib/extension-route-wrapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-route-wrapper.d.ts","sourceRoot":"","sources":["../../src/lib/extension-route-wrapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAS5C;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,wBAAwB,GACjC,KAAK,CA4DP;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,gBAAgB,GACpB,KAAK,EAAE,CAGT"}

package/dist/lib/extension-route-wrapper.js

@@ -0,0 +1,113 @@
+"use strict";
+/**
+ * Extension Route Wrapper
+ *
+ * Converts ExtensionRouteDefinition → Route with core-applied:
+ * - Authentication (enforced by core, not extension)
+ * - CORS and CSRF middleware
+ * - Security headers
+ * - Error handling and logging
+ * - Scoped ExtensionContext (no secrets)
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wrapExtensionRoute = wrapExtensionRoute;
+exports.wrapExtensionRoutes = wrapExtensionRoutes;
+const middleware_1 = require("./middleware");
+const security_headers_1 = require("./security-headers");
+const session_manager_1 = require("./session-manager");
+const secret_resolver_1 = require("./secret-resolver");
+const logger_1 = require("./logger");
+const extension_context_1 = require("./extension-context");
+/**
+ * Wrap an extension route definition with core HTTP infrastructure.
+ */
+function wrapExtensionRoute(ext, routeDef) {
+    const authLevel = routeDef.auth ?? "required";
+    return {
+        path: `/api/ext/${ext.id}/${routeDef.path}`,
+        method: routeDef.method,
+        middleware: authLevel === "none"
+            ? [(0, middleware_1.corsMiddleware)()]
+            : [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: routeDef.description,
+        handler: async (request, env, { params, requestContext }) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            // Auth check — enforced by core
+            let session = null;
+            if (authLevel !== "none") {
+                const sessionManager = new session_manager_1.SessionManager();
+                const secret = secret_resolver_1.Secrets.getSessionSecret(env);
+                session = await sessionManager.getSession(request, secret, env);
+                if (!session && authLevel === "required") {
+                    return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+                }
+            }
+            // Build scoped context
+            const { sharedDatabaseConnectionManager } = await Promise.resolve().then(() => __importStar(require("./database-connection-manager")));
+            const { detectRegionSync } = await Promise.resolve().then(() => __importStar(require("./region-detection")));
+            const { createGraphServiceFromEnv } = await Promise.resolve().then(() => __importStar(require("./graph")));
+            const region = detectRegionSync(request, env);
+            const managed = sharedDatabaseConnectionManager.acquireClient(region, env);
+            const prisma = managed.client;
+            const graph = await createGraphServiceFromEnv(env);
+            const ctx = (0, extension_context_1.createExtensionContext)(ext, env, prisma, graph);
+            try {
+                const result = await routeDef.handle(request, params, session, ctx);
+                return securityHeaders.addSecurityHeaders(new Response(JSON.stringify(result.body), {
+                    status: result.status,
+                    headers: {
+                        "content-type": "application/json",
+                        ...result.headers,
+                    },
+                }));
+            }
+            catch (error) {
+                logger.error(`Extension "${ext.id}" route error:`, error);
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Internal server error" }), { status: 500, headers: { "content-type": "application/json" } });
+            }
+        },
+    };
+}
+/**
+ * Wrap all extension routes for a given extension.
+ */
+function wrapExtensionRoutes(ext) {
+    if (!ext.extensionRoutes)
+        return [];
+    return ext.extensionRoutes.map((r) => wrapExtensionRoute(ext, r));
+}
+//# sourceMappingURL=extension-route-wrapper.js.map

package/dist/lib/extension-route-wrapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-route-wrapper.js","sourceRoot":"","sources":["../../src/lib/extension-route-wrapper.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBH,gDA+DC;AAKD,kDAKC;AApFD,6CAA8D;AAC9D,yDAAqD;AACrD,uDAAmD;AACnD,uDAA4C;AAC5C,qCAAkC;AAClC,2DAA6D;AAG7D;;GAEG;AACH,SAAgB,kBAAkB,CAChC,GAAqB,EACrB,QAAkC;IAElC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC;IAE9C,OAAO;QACL,IAAI,EAAE,YAAY,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE;QAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,SAAS,KAAK,MAAM;YAC9B,CAAC,CAAC,CAAC,IAAA,2BAAc,GAAE,CAAC;YACpB,CAAC,CAAC,CAAC,IAAA,2BAAc,GAAE,EAAE,IAAA,2BAAc,GAAE,CAAC;QACxC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE;YAC1D,MAAM,eAAe,GAAG,IAAI,kCAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAEvC,gCAAgC;YAChC,IAAI,OAAO,GAAQ,IAAI,CAAC;YACxB,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzB,MAAM,cAAc,GAAG,IAAI,gCAAc,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,yBAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAC7C,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBAChE,IAAI,CAAC,OAAO,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;oBACzC,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uBAAuB;YACvB,MAAM,EAAE,+BAA+B,EAAE,GAAG,wDAAa,+BAA+B,GAAC,CAAC;YAC1F,MAAM,EAAE,gBAAgB,EAAE,GAAG,wDAAa,oBAAoB,GAAC,CAAC;YAChE,MAAM,EAAE,yBAAyB,EAAE,GAAG,wDAAa,SAAS,GAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,+BAA+B,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;YAEnD,MAAM,GAAG,GAAG,IAAA,0CAAsB,EAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAE5D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBAEpE,OAAO,eAAe,CAAC,kBAAkB,CACvC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;oBACxC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,GAAG,MAAM,CAAC,OAAO;qBAClB;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAC1D,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAClD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CACjC,GAAqB;IAErB,IAAI,CAAC,GAAG,CAAC,eAAe;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC"}

package/dist/lib/extension-validator.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Extension Validator
+ *
+ * Validates extension registrations at startup:
+ * - Extension IDs are valid format and not reserved
+ * - No duplicate IDs
+ * - Routes don't shadow core endpoints
+ * - Warns about routes without auth middleware
+ */
+import type { TrellisExtension } from "@de-otio/trellis-extension-api";
+export declare function validateExtensions(extensions: TrellisExtension[]): void;
+//# sourceMappingURL=extension-validator.d.ts.map

package/dist/lib/extension-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-validator.d.ts","sourceRoot":"","sources":["../../src/lib/extension-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAcvE,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,gBAAgB,EAAE,GAC7B,IAAI,CAmDN"}

package/dist/lib/extension-validator.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * Extension Validator
+ *
+ * Validates extension registrations at startup:
+ * - Extension IDs are valid format and not reserved
+ * - No duplicate IDs
+ * - Routes don't shadow core endpoints
+ * - Warns about routes without auth middleware
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateExtensions = validateExtensions;
+const logger_1 = require("./logger");
+const RESERVED_IDS = ["user", "admin", "system", "internal", ""];
+const RESERVED_ROUTE_PREFIXES = [
+    "/api/auth",
+    "/api/admin",
+    "/api/internal",
+    "/.well-known",
+];
+const ID_PATTERN = /^[a-z][a-z0-9_-]{1,31}$/;
+const logger = logger_1.Logger.getInstance();
+function validateExtensions(extensions) {
+    const seen = new Set();
+    for (const ext of extensions) {
+        // Validate ID format
+        if (!ID_PATTERN.test(ext.id)) {
+            throw new Error(`Extension ID "${ext.id}" must be lowercase alphanumeric, 2-32 chars`);
+        }
+        if (RESERVED_IDS.includes(ext.id)) {
+            throw new Error(`Extension ID "${ext.id}" is reserved`);
+        }
+        if (seen.has(ext.id)) {
+            throw new Error(`Duplicate extension ID "${ext.id}"`);
+        }
+        seen.add(ext.id);
+        // Validate routes don't shadow core endpoints
+        for (const route of ext.routes) {
+            const path = typeof route.path === "string"
+                ? route.path
+                : route.path instanceof RegExp
+                    ? route.path.source
+                    : String(route.path);
+            for (const prefix of RESERVED_ROUTE_PREFIXES) {
+                if (path.startsWith(prefix) ||
+                    path.startsWith(prefix.replace(/\//g, "\\/"))) {
+                    throw new Error(`Extension "${ext.id}" route "${path}" conflicts with reserved prefix "${prefix}"`);
+                }
+            }
+        }
+        // Warn about routes without auth middleware
+        for (const route of ext.routes) {
+            const hasAuth = route.middleware?.some((m) => m.name === "authMiddleware" || m.name === "csrfMiddleware");
+            if (!hasAuth) {
+                logger.warn(`Extension "${ext.id}" route "${route.description ?? route.path}" has no auth middleware`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=extension-validator.js.map

package/dist/lib/extension-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-validator.js","sourceRoot":"","sources":["../../src/lib/extension-validator.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAgBH,gDAqDC;AAlED,qCAAkC;AAElC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACjE,MAAM,uBAAuB,GAAG;IAC9B,WAAW;IACX,YAAY;IACZ,eAAe;IACf,cAAc;CACf,CAAC;AACF,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAE7C,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,EAAE,CAAC;AAEpC,SAAgB,kBAAkB,CAChC,UAA8B;IAE9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,qBAAqB;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,iBAAiB,GAAG,CAAC,EAAE,8CAA8C,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEjB,8CAA8C;QAC9C,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAC5B,CAAC,CAAC,KAAK,CAAC,IAAI;gBACZ,CAAC,CAAC,KAAK,CAAC,IAAI,YAAY,MAAM;oBAC5B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM;oBACnB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,MAAM,MAAM,IAAI,uBAAuB,EAAE,CAAC;gBAC7C,IACE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;oBACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAC7C,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,cAAc,GAAG,CAAC,EAAE,YAAY,IAAI,qCAAqC,MAAM,GAAG,CACnF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,CACpC,CAAC,CAAM,EAAE,EAAE,CACT,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAC7D,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CACT,cAAc,GAAG,CAAC,EAAE,YAAY,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,0BAA0B,CAC1F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/feature-flags.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Feature Flags
+ *
+ * Provides feature flag structure for white-label support.
+ * Now checks FeatureToggleService for dynamic control.
+ */
+import { type LoggerEnv } from "./logger";
+export interface FeatureFlags {
+    posts: boolean;
+    comments: boolean;
+    entities: boolean;
+    friends: boolean;
+    sentiments: boolean;
+    feeds: boolean;
+    map: boolean;
+}
+/**
+ * Feature Flags Manager class
+ */
+export declare class FeatureFlagsManager {
+    private db?;
+    private env?;
+    private logger;
+    constructor(db?: any, env?: LoggerEnv);
+    /**
+     * Get feature flags for a tenant
+     *
+     * Checks FeatureToggleService for each feature flag.
+     * Falls back to defaults if toggle doesn't exist.
+     *
+     * @param tenantId - Optional tenant ID (not used in MVP, reserved for future)
+     * @returns Feature flags object
+     */
+    getFeatureFlags(tenantId?: string): Promise<FeatureFlags>;
+    /**
+     * Get feature flags synchronously
+     *
+     * @deprecated Use getFeatureFlags() instead for dynamic control
+     * This function returns defaults only for backward compatibility
+     */
+    getFeatureFlagsSync(tenantId?: string): FeatureFlags;
+}
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new FeatureFlagsManager class instead
+ */
+export declare function getFeatureFlags(tenantId?: string, db?: any, env?: {
+    LOG_LEVEL?: string;
+    NODE_ENV?: string;
+}): Promise<FeatureFlags>;
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new FeatureFlagsManager class instead
+ */
+export declare function getFeatureFlagsSync(tenantId?: string): FeatureFlags;
+//# sourceMappingURL=feature-flags.d.ts.map

package/dist/lib/feature-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-flags.d.ts","sourceRoot":"","sources":["../../src/lib/feature-flags.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAElD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;CACd;AAmBD;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,EAAE,CAAC,CAAM;IACjB,OAAO,CAAC,GAAG,CAAC,CAAY;IACxB,OAAO,CAAC,MAAM,CAAS;gBAEX,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS;IAMrC;;;;;;;;OAQG;IACG,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAkD/D;;;;;OAKG;IACH,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY;CAGrD;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,QAAQ,CAAC,EAAE,MAAM,EACjB,EAAE,CAAC,EAAE,GAAG,EACR,GAAG,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,CAEnE"}

package/dist/lib/feature-flags.js

@@ -0,0 +1,140 @@
+"use strict";
+/**
+ * Feature Flags
+ *
+ * Provides feature flag structure for white-label support.
+ * Now checks FeatureToggleService for dynamic control.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FeatureFlagsManager = void 0;
+exports.getFeatureFlags = getFeatureFlags;
+exports.getFeatureFlagsSync = getFeatureFlagsSync;
+const logger_1 = require("./logger");
+/**
+ * Default feature flags (general defaults - should be false for safety)
+ *
+ * Note: These are fallback defaults when feature toggles don't exist in the database.
+ * For application-specific defaults, configure FEATURE_FLAGS in environments/{env}/config.yaml
+ * and run the seed script to populate the database.
+ */
+const DEFAULT_FEATURES = {
+    posts: false, // General default: false (safe)
+    comments: false, // General default: false (safe)
+    entities: false, // General default: false (safe)
+    friends: false, // General default: false (safe)
+    sentiments: false, // General default: false (safe)
+    feeds: false, // General default: false (safe)
+    map: false, // General default: false (safe)
+};
+/**
+ * Feature Flags Manager class
+ */
+class FeatureFlagsManager {
+    db;
+    env;
+    logger;
+    constructor(db, env) {
+        this.db = db;
+        this.env = env;
+        this.logger = logger_1.Logger.getInstance(env);
+    }
+    /**
+     * Get feature flags for a tenant
+     *
+     * Checks FeatureToggleService for each feature flag.
+     * Falls back to defaults if toggle doesn't exist.
+     *
+     * @param tenantId - Optional tenant ID (not used in MVP, reserved for future)
+     * @returns Feature flags object
+     */
+    async getFeatureFlags(tenantId) {
+        // If no database provided, return defaults (backward compatibility)
+        if (!this.db) {
+            return DEFAULT_FEATURES;
+        }
+        try {
+            const { FeatureToggleService } = await Promise.resolve().then(() => __importStar(require("./feature-toggle-service")));
+            const toggleService = new FeatureToggleService(this.db);
+            // Helper function to check toggle or use default
+            const checkToggle = async (key, defaultValue) => {
+                const toggle = await toggleService.getToggle(key);
+                // If toggle doesn't exist, use default; otherwise use toggle value
+                return toggle === null ? defaultValue : toggle.enabled;
+            };
+            // Check each feature toggle
+            // Format: <feature>_enabled (e.g., posts_enabled)
+            return {
+                posts: await checkToggle("posts_enabled", DEFAULT_FEATURES.posts),
+                comments: await checkToggle("comments_enabled", DEFAULT_FEATURES.comments),
+                entities: await checkToggle("entity_profiles_enabled", DEFAULT_FEATURES.entities),
+                friends: await checkToggle("friends_enabled", DEFAULT_FEATURES.friends),
+                sentiments: await checkToggle("sentiments_enabled", DEFAULT_FEATURES.sentiments),
+                feeds: await checkToggle("feeds_enabled", DEFAULT_FEATURES.feeds),
+                map: await checkToggle("map_enabled", DEFAULT_FEATURES.map),
+            };
+        }
+        catch (error) {
+            this.logger.error("[FeatureFlags] Error checking feature toggles:", error);
+            // Fall back to defaults on error
+            return DEFAULT_FEATURES;
+        }
+    }
+    /**
+     * Get feature flags synchronously
+     *
+     * @deprecated Use getFeatureFlags() instead for dynamic control
+     * This function returns defaults only for backward compatibility
+     */
+    getFeatureFlagsSync(tenantId) {
+        return DEFAULT_FEATURES;
+    }
+}
+exports.FeatureFlagsManager = FeatureFlagsManager;
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new FeatureFlagsManager class instead
+ */
+async function getFeatureFlags(tenantId, db, env) {
+    return new FeatureFlagsManager(db, env).getFeatureFlags(tenantId);
+}
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new FeatureFlagsManager class instead
+ */
+function getFeatureFlagsSync(tenantId) {
+    return DEFAULT_FEATURES;
+}
+//# sourceMappingURL=feature-flags.js.map

package/dist/lib/feature-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-flags.js","sourceRoot":"","sources":["../../src/lib/feature-flags.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuHH,0CAMC;AAMD,kDAEC;AAnID,qCAAkD;AAYlD;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAiB;IACrC,KAAK,EAAE,KAAK,EAAE,gCAAgC;IAC9C,QAAQ,EAAE,KAAK,EAAE,gCAAgC;IACjD,QAAQ,EAAE,KAAK,EAAE,gCAAgC;IACjD,OAAO,EAAE,KAAK,EAAE,gCAAgC;IAChD,UAAU,EAAE,KAAK,EAAE,gCAAgC;IACnD,KAAK,EAAE,KAAK,EAAE,gCAAgC;IAC9C,GAAG,EAAE,KAAK,EAAE,gCAAgC;CAC7C,CAAC;AAEF;;GAEG;AACH,MAAa,mBAAmB;IACtB,EAAE,CAAO;IACT,GAAG,CAAa;IAChB,MAAM,CAAS;IAEvB,YAAY,EAAQ,EAAE,GAAe;QACnC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,QAAiB;QACrC,oEAAoE;QACpE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,wDAAa,0BAA0B,GAAC,CAAC;YAC1E,MAAM,aAAa,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAExD,iDAAiD;YACjD,MAAM,WAAW,GAAG,KAAK,EACvB,GAAW,EACX,YAAqB,EACH,EAAE;gBACpB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBAClD,mEAAmE;gBACnE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACzD,CAAC,CAAC;YAEF,4BAA4B;YAC5B,kDAAkD;YAClD,OAAO;gBACL,KAAK,EAAE,MAAM,WAAW,CAAC,eAAe,EAAE,gBAAgB,CAAC,KAAK,CAAC;gBACjE,QAAQ,EAAE,MAAM,WAAW,CACzB,kBAAkB,EAClB,gBAAgB,CAAC,QAAQ,CAC1B;gBACD,QAAQ,EAAE,MAAM,WAAW,CACzB,yBAAyB,EACzB,gBAAgB,CAAC,QAAQ,CAC1B;gBACD,OAAO,EAAE,MAAM,WAAW,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,OAAO,CAAC;gBACvE,UAAU,EAAE,MAAM,WAAW,CAC3B,oBAAoB,EACpB,gBAAgB,CAAC,UAAU,CAC5B;gBACD,KAAK,EAAE,MAAM,WAAW,CAAC,eAAe,EAAE,gBAAgB,CAAC,KAAK,CAAC;gBACjE,GAAG,EAAE,MAAM,WAAW,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,CAAC;aAC5D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gDAAgD,EAChD,KAAK,CACN,CAAC;YACF,iCAAiC;YACjC,OAAO,gBAAgB,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,mBAAmB,CAAC,QAAiB;QACnC,OAAO,gBAAgB,CAAC;IAC1B,CAAC;CACF;AA/ED,kDA+EC;AAED;;;GAGG;AACI,KAAK,UAAU,eAAe,CACnC,QAAiB,EACjB,EAAQ,EACR,GAA+C;IAE/C,OAAO,IAAI,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,QAAiB;IACnD,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}