@evalguard/vercel-ai 1.0.0 → 1.0.2

package/dist/index.js

@@ -8,10 +8,17 @@
  * EvalGuard project. Guardrail semantics are fail-CLOSED when
  * blockOnViolation is on (the default): if the firewall is unreachable the
  * call is BLOCKED with an EvalguardBlockedError, matching the langchain /
- * llamaindex wrappers. In monitor-only mode (blockOnViolation:false) a
- * guardrail outage is swallowed and the call proceeds. Trace logging always
+ * llamaindex wrappers. In monitor-only mode (blockOnViolation:false) the call
+ * proceeds and the outage is RECORDED on the trace as a `guardrail_unavailable`
+ * violation — it used to be silently swallowed, which made an unguarded call
+ * indistinguishable from a guarded one (audit 2026-08-07). Trace logging always
  * fails open — a logging error never breaks or delays the user's call.
  *
+ * SCOPE: this wrapper runs the INPUT rail only. Model output is streamed and
+ * returned verbatim and is never scanned — there is no `evalOnResponse` here,
+ * unlike @evalguard/openai, @evalguard/anthropic and @evalguard/gemini. Passing
+ * `evalOnResponse` to `withEvalguard` logs a warning and has no effect.
+ *
  * Usage:
  *
  *   import { openai } from "@ai-sdk/openai";
@@ -51,9 +58,26 @@
  *
  * Instead of importing `wrapLanguageModel` we re-implement the same "delegate
  * to the model, override doGenerate/doStream" shape directly, as a PROXY over
- * the original model. Everything except the two call methods is forwarded to the
- * real instance, so capability fields — most importantly `supportedUrls` —
- * pass through untouched. Two earlier versions got this wrong:
+ * the original model.
+ *
+ * That proxy is DEFAULT-DENY as of 2026-08-08. Until then it forwarded
+ * everything except `doGenerate` / `doStream` straight to `Reflect.get` — a
+ * denylist of two guarded names — on the recorded argument that the AI SDK model
+ * interface is "a fixed, tiny surface". `@ai-sdk/provider@3.0.10` in fact
+ * declares FOUR call methods across SEVEN model specifications, and `doEmbed`
+ * (embedding models) and `doRerank` (reranking models) were measured delivering
+ * attack text to the provider on ZERO firewall calls, as were speech and
+ * transcription calls whose payload lives in `options.text` / `options.audio`
+ * rather than `options.prompt`. Every property is now guarded unless
+ * `./surface.ts` names it, using the same wrapper-core machinery as
+ * `@evalguard/anthropic` and `@evalguard/gemini`, so a method the AI SDK ships
+ * tomorrow is gated on the day it lands.
+ *
+ * Capability fields — most importantly `supportedUrls` — still pass through
+ * untouched; they are on the policy's justified passthrough set for exactly that
+ * reason, and `src/__tests__/model-spec-surface-matrix.test.ts` asserts a
+ * wrapped model's `supportedUrls` RegExps still work and cost zero firewall
+ * requests. Two earlier versions got this wrong:
  *   1. hand-copying a fixed list of V1 props (`supportsUrl`,
  *      `supportsImageUrls`, …) that no longer exist on a V2 model, which
  *      silently STRIPPED `supportedUrls` (audit MEDIUM 2026-07-14);
@@ -69,8 +93,122 @@
  *
  * Spec reference: https://sdk.vercel.ai/docs/ai-sdk-core/middleware
  */
-import { GuardrailClient, collapsePromptText } from "@evalguard/wrapper-core";
+import { GuardrailClient, collapsePromptText, collectRequestStrings, isNonModelTextKey, ScanBoundExceededError, guardSurfaceProp, assertSurfacePolicy, } from "@evalguard/wrapper-core";
 import { estimateCostDetailed } from "./cost.js";
+import { vercelAiSurfacePolicy } from "./surface.js";
+/**
+ * Every key {@link WithEvalguardConfig} recognises. Used only to WARN about
+ * unrecognised keys — see {@link assertValidConfig}.
+ */
+const KNOWN_CONFIG_KEYS = new Set([
+    "apiKey",
+    "projectId",
+    "baseUrl",
+    "blockOnViolation",
+    "disableLogging",
+    "disableGuardrails",
+    "metadata",
+]);
+const warnedUnknownOptions = new Set();
+/** Describe a rejected value for an error message WITHOUT echoing a secret. */
+function describeConfigValue(v) {
+    if (v === undefined)
+        return "undefined";
+    if (v === null)
+        return "null";
+    if (typeof v === "string")
+        return v.trim() === "" ? `an empty/whitespace-only string` : "a string";
+    return `a ${typeof v}`;
+}
+/**
+ * Validate `config` at wrap time, so a misconfiguration is a loud error HERE
+ * rather than a silent per-request failure later.
+ *
+ * AUDIT 2026-08-07 (vercel-ai surface E2E). `withEvalguard` performed no
+ * validation at all beyond what `GuardrailClient` happened to do for `baseUrl`.
+ * Measured against the shipped `dist/`:
+ *
+ *   - `apiKey: undefined` and `apiKey: 12345` were ACCEPTED at wrap time. At
+ *     call time `resolveApiKey` does `resolver()` on a non-string, which throws
+ *     `TypeError: resolver is not a function` INSIDE withRetry — so the
+ *     firewall request was never even attempted (measured: 0 HTTP requests) and
+ *     every call surfaced the generic "guardrail unavailable". Under the
+ *     default `blockOnViolation: true` that is fail-closed but undiagnosable;
+ *     under `blockOnViolation: false` it means the customer runs COMPLETELY
+ *     UNGUARDED with no signal at all.
+ *   - `apiKey: ""` and `apiKey: "   "` were ACCEPTED and put a credential-less
+ *     `Authorization: Bearer` on the wire (measured on a loopback stub).
+ *   - `baseUrl: "ftp://…"`, `"javascript:alert(1)"`, `"file:///c:/tmp"` and a
+ *     `data:` URL were all ACCEPTED: `assertSecureBaseUrl` only rejects `http:`
+ *     for a non-loopback host, so every OTHER scheme sailed through and failed
+ *     at fetch time instead — again as a per-request "guardrail unavailable".
+ *
+ * The `apiKey` type here is `string`, but a function is accepted at runtime
+ * because wrapper-core's `resolveApiKey` supports a BYOK resolver and rejecting
+ * one would break a caller relying on that.
+ */
+function assertValidConfig(config) {
+    if (config === null || typeof config !== "object") {
+        throw new Error("withEvalguard: a config object is required, e.g. " +
+            '`withEvalguard(model, { apiKey: process.env.EVALGUARD_API_KEY! })`.');
+    }
+    const apiKey = config.apiKey;
+    // A BYOK resolver (() => string | Promise<string>) is resolved per call by
+    // wrapper-core — we cannot validate its result here, only that it exists.
+    if (typeof apiKey !== "function" && (typeof apiKey !== "string" || apiKey.trim() === "")) {
+        throw new Error(`withEvalguard: \`apiKey\` must be a non-empty EvalGuard API key (got ${describeConfigValue(apiKey)}). ` +
+            "This is usually an unset or empty EVALGUARD_API_KEY — get a key at " +
+            "https://evalguard.ai/dashboard/api-keys. Failing here is deliberate: without a usable key " +
+            "every guardrail check fails, which blocks every request under the default " +
+            "blockOnViolation:true and silently runs UNGUARDED under blockOnViolation:false.");
+    }
+    if (config.baseUrl !== undefined) {
+        if (typeof config.baseUrl !== "string" || config.baseUrl.trim() === "") {
+            throw new Error(`withEvalguard: \`baseUrl\` must be a non-empty https:// URL (got ${describeConfigValue(config.baseUrl)}).`);
+        }
+        let parsed;
+        try {
+            parsed = new URL(config.baseUrl.trim());
+        }
+        catch {
+            throw new Error(`withEvalguard: \`baseUrl\` is not a valid URL: "${config.baseUrl}"`);
+        }
+        // Scheme ALLOW-list. wrapper-core's assertSecureBaseUrl rejects `http:` on a
+        // non-loopback host (it still runs, right after this, and still owns that
+        // rule) — but it deny-lists exactly one scheme, so `ftp:` / `file:` /
+        // `data:` / `javascript:` passed. None of them can carry an EvalGuard API
+        // call; accepting them only defers the error to every request.
+        if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+            throw new Error(`withEvalguard: \`baseUrl\` must use https:// (got "${config.baseUrl}"). ` +
+                `"${parsed.protocol}" is not an HTTP(S) scheme, so no guardrail request can ever succeed against it. ` +
+                "Use https://, or http://localhost for local testing.");
+        }
+    }
+    // Unknown keys WARN rather than throw: every documented boolean option fails
+    // SAFE when misspelled (`blockOnViolation`/`disableGuardrails`/`disableLogging`
+    // all fall back to the guarded default), so a hard throw would be a breaking
+    // change for no security gain. It is still worth saying out loud — a
+    // misspelled option is silently inert, and the sibling wrappers' options
+    // (`evalOnResponse`, `onViolation`, `retry`, `circuit`, `idempotency`) are
+    // NOT implemented here, so passing one silently gets you less than you asked
+    // for.
+    const unknown = Object.keys(config).filter((k) => !KNOWN_CONFIG_KEYS.has(k));
+    if (unknown.length > 0) {
+        const signature = unknown.slice().sort().join(",");
+        if (!warnedUnknownOptions.has(signature)) {
+            warnedUnknownOptions.add(signature);
+            console.warn(`[evalguard] withEvalguard: ignoring unknown option(s): ${unknown.join(", ")}. ` +
+                `Supported options are: ${[...KNOWN_CONFIG_KEYS].join(", ")}. ` +
+                "An unknown option has NO effect — check for a typo, and note that " +
+                "evalOnResponse / onViolation / retry / circuit / idempotency are supported by " +
+                "@evalguard/openai, @evalguard/anthropic and @evalguard/gemini but NOT by this wrapper.");
+        }
+    }
+}
+/** Internal — lets the test suite re-arm the once-per-process unknown-option warning. */
+export function _resetConfigWarningsForTests() {
+    warnedUnknownOptions.clear();
+}
 /**
  * Error thrown when blockOnViolation=true and the input is rejected by
  * EvalGuard's firewall. Customers can catch this distinctly from provider
@@ -140,55 +278,109 @@ function extractOutputText(result) {
  * ai@6 + @ai-sdk/openai@3 and ai@7 + @ai-sdk/openai@4 from packed tarballs on
  * 2026-08-02, and pinned by `src/__tests__/ai-sdk-assignability.test.ts`.
  *
- * Only `doGenerate` / `doStream` are intercepted; every other property read
- * (including prototype getters such as `supportedUrls` on a class-based
- * provider model) is forwarded to the real instance, so capability fields
- * compose with other middleware (caching, logging) the customer may already
- * have.
+ * `doGenerate` / `doStream` get the rich interception (stream teeing, token
+ * accounting, cost, trace logging). Every OTHER property is default-deny: a
+ * capability or identity field named on `./surface.ts`'s justified passthrough
+ * set is forwarded to the real instance verbatim — including prototype getters
+ * such as `supportedUrls` on a class-based provider model, so capability fields
+ * still compose with other middleware (caching, logging) the customer may
+ * already have — and anything else that is callable is put behind the firewall.
+ * See `./surface.ts` for why: `Reflect.get` for everything unlisted was measured
+ * shipping attack text to the provider on zero firewall calls.
  */
 export function withEvalguard(model, config) {
+    assertValidConfig(config);
     const guardrail = new GuardrailClient({ apiKey: config.apiKey, baseUrl: config.baseUrl });
     const blockOnViolation = config.blockOnViolation ?? true;
     const enableLogging = !config.disableLogging;
     const enableGuardrails = !config.disableGuardrails;
+    /**
+     * Run the pre-call input rail. Returns the verdict to attach to the trace, or
+     * `undefined` when there was genuinely no input to scan. Throws
+     * `EvalguardBlockedError` when the call must not proceed.
+     *
+     * ONE implementation shared by doGenerate and doStream. It was duplicated
+     * verbatim in both until 2026-08-07, which is how a guardrail fix lands on one
+     * path and not the other.
+     */
+    const runInputRail = async (params) => {
+        if (!enableGuardrails)
+            return undefined;
+        try {
+            // NOTE: collapsePrompt is INSIDE the try. It can throw (an unserialisable
+            // prompt — see collapsePrompt), and "the wrapper could not read the input"
+            // must route through the same fail-CLOSED path as "the firewall could not
+            // answer", never past the rail.
+            const promptText = collapsePrompt(params);
+            if (!promptText)
+                return undefined;
+            const result = await guardrail.checkInput(promptText, {
+                provider: model.provider,
+                model: model.modelId,
+                ...config.metadata,
+            });
+            if (!result.allowed && blockOnViolation) {
+                throw new EvalguardBlockedError(`Request blocked by EvalGuard guardrails: ${result.violations.map((v) => v.type).join(", ")}`, result.violations);
+            }
+            return result;
+        }
+        catch (err) {
+            if (err instanceof EvalguardBlockedError)
+                throw err;
+            // A payload the scanner could not read IN FULL is REFUSED, in both modes.
+            //
+            // Deliberately NOT routed through `blockOnViolation` below, matching
+            // wrapper-core's `gateSurfaceMethod`: a monitor-only caller still must not
+            // forward bytes we never examined. This is a NEW throw source as of the
+            // 2026-08-08 whole-body walk, and letting it fall into the monitor-only
+            // branch would have introduced a fresh fail-open right beside the one that
+            // branch exists to close.
+            if (err instanceof ScanBoundExceededError) {
+                throw new EvalguardBlockedError(`Request blocked: EvalGuard could not scan the whole request body (${err.message}). ` +
+                    "A partially-scanned payload reports clean on the bytes it never examined, so it is refused.", [{ type: "scan_bound_exceeded", severity: "high", message: err.message }]);
+            }
+            // wrapper-core.checkInput fails CLOSED on a guardrail outage
+            // (throws once retries/circuit give up). Honor blockOnViolation:
+            // an unreachable guardrail BLOCKS the call when it's on, and is
+            // recorded (the call proceeds, monitor-only) when it's off.
+            // Mirrors the langchain / llamaindex wrappers.
+            if (blockOnViolation) {
+                throw new EvalguardBlockedError(`Request blocked: guardrail unavailable (${err instanceof Error ? err.message : "unknown"})`, [{
+                        type: "guardrail_unavailable",
+                        severity: "high",
+                        message: err instanceof Error ? err.message : "guardrail check failed",
+                    }]);
+            }
+            // AUDIT 2026-08-07 (vercel-ai surface E2E). Monitor-only mode used to
+            // SWALLOW the outage and leave `guardrailResult` undefined, so the trace
+            // POSTed `guardrailResult: undefined` and its metadata carried only
+            // provider/model/cost/costPricingSource/timestamp — nothing said the rail
+            // had not run. README.md promised the opposite in so many words:
+            // "`blockOnViolation: false` — the call proceeds and the outage is
+            // recorded." Measured on both doGenerate and doStream against a stub that
+            // 500s /firewall/check: no mention of the outage anywhere in the trace.
+            // An unguarded call that looks identical to a guarded one is the whole
+            // reason monitor-only mode is dangerous, so record it.
+            //
+            // `allowed: true` states what happened to the CALL (it proceeded, as
+            // monitor-only mode requires); the violation states WHY it was unguarded.
+            return {
+                allowed: true,
+                violations: [{
+                        type: "guardrail_unavailable",
+                        severity: "high",
+                        message: err instanceof Error ? err.message : "guardrail check failed",
+                    }],
+            };
+        }
+    };
     const overrides = {
         async doGenerate(params) {
             const t0 = performance.now();
-            let guardrailResult;
             // Pre-call: extract a single text representation of the prompt for
             // the firewall. Vercel's prompt shape is varied (chat / completion),
             // so we collapse to a string the firewall can scan.
-            if (enableGuardrails) {
-                const promptText = collapsePrompt(params);
-                if (promptText) {
-                    try {
-                        guardrailResult = await guardrail.checkInput(promptText, {
-                            provider: model.provider,
-                            model: model.modelId,
-                            ...config.metadata,
-                        });
-                        if (!guardrailResult.allowed && blockOnViolation) {
-                            throw new EvalguardBlockedError(`Request blocked by EvalGuard guardrails: ${guardrailResult.violations.map((v) => v.type).join(", ")}`, guardrailResult.violations);
-                        }
-                    }
-                    catch (err) {
-                        if (err instanceof EvalguardBlockedError)
-                            throw err;
-                        // wrapper-core.checkInput fails CLOSED on a guardrail outage
-                        // (throws once retries/circuit give up). Honor blockOnViolation:
-                        // an unreachable guardrail BLOCKS the call when it's on, and is
-                        // swallowed (the call proceeds, monitor-only) when it's off.
-                        // Mirrors the langchain / llamaindex wrappers.
-                        if (blockOnViolation) {
-                            throw new EvalguardBlockedError(`Request blocked: guardrail unavailable (${err instanceof Error ? err.message : "unknown"})`, [{
-                                    type: "guardrail_unavailable",
-                                    severity: "high",
-                                    message: err instanceof Error ? err.message : "guardrail check failed",
-                                }]);
-                        }
-                    }
-                }
-            }
+            const guardrailResult = await runInputRail(params);
             const result = await model.doGenerate(params);
             const latencyMs = Math.round(performance.now() - t0);
             // Post-call: log trace fire-and-forget so we never delay the user's
@@ -215,38 +407,7 @@ export function withEvalguard(model, config) {
         },
         async doStream(params) {
             const t0 = performance.now();
-            let guardrailResult;
-            if (enableGuardrails) {
-                const promptText = collapsePrompt(params);
-                if (promptText) {
-                    try {
-                        guardrailResult = await guardrail.checkInput(promptText, {
-                            provider: model.provider,
-                            model: model.modelId,
-                            ...config.metadata,
-                        });
-                        if (!guardrailResult.allowed && blockOnViolation) {
-                            throw new EvalguardBlockedError(`Request blocked by EvalGuard guardrails: ${guardrailResult.violations.map((v) => v.type).join(", ")}`, guardrailResult.violations);
-                        }
-                    }
-                    catch (err) {
-                        if (err instanceof EvalguardBlockedError)
-                            throw err;
-                        // wrapper-core.checkInput fails CLOSED on a guardrail outage
-                        // (throws once retries/circuit give up). Honor blockOnViolation:
-                        // an unreachable guardrail BLOCKS the call when it's on, and is
-                        // swallowed (the call proceeds, monitor-only) when it's off.
-                        // Mirrors the langchain / llamaindex wrappers.
-                        if (blockOnViolation) {
-                            throw new EvalguardBlockedError(`Request blocked: guardrail unavailable (${err instanceof Error ? err.message : "unknown"})`, [{
-                                    type: "guardrail_unavailable",
-                                    severity: "high",
-                                    message: err instanceof Error ? err.message : "guardrail check failed",
-                                }]);
-                        }
-                    }
-                }
-            }
+            const guardrailResult = await runInputRail(params);
             const result = await model.doStream(params);
             // Tee the stream — assemble the final text + token totals as parts
             // arrive, then log a trace once `finish` lands. Pass-through preserves
@@ -339,25 +500,91 @@ export function withEvalguard(model, config) {
             return { ...result, stream: wrappedStream };
         },
     };
-    return new Proxy(model, {
-        get(target, prop) {
-            if (prop === "doGenerate")
+    // ── The default-deny surface ──────────────────────────────────────────────
+    //
+    // AUDIT 2026-08-08. This trap used to read, in full:
+    //
+    //     if (prop === "doGenerate") return overrides.doGenerate;
+    //     if (prop === "doStream")   return overrides.doStream;
+    //     …
+    //     const value = Reflect.get(target, prop, target);
+    //     return typeof value === "function" ? value.bind(target) : value;
+    //
+    // — a DENYLIST of two guarded names with `Reflect.get` for everything else,
+    // the identical shape that made `@evalguard/anthropic@1.2.1` and
+    // `@evalguard/gemini@1.0.1` bypassable. It survived a wrapper sweep on the
+    // argument that the AI SDK model interface is "fixed and tiny". It is neither:
+    // `@ai-sdk/provider@3.0.10` declares `doGenerate`, `doStream`, `doEmbed` and
+    // `doRerank` across seven model specifications, and `doEmbed` / `doRerank`
+    // delivered attack text to the provider on ZERO firewall calls. See
+    // `./surface.ts` for the file:line inventory and the measured matrix.
+    //
+    // Now: every property is guarded unless `VERCEL_AI_SURFACE_POLICY` names it,
+    // and `guardSurfaceProp` is wrapper-core's — shared with anthropic and gemini
+    // — so a method the AI SDK ships TOMORROW is gated on the day it lands with no
+    // change here.
+    const ctx = {
+        guardrail,
+        blockOnViolation,
+        enableLogging,
+        config: {
+            apiKey: config.apiKey,
+            baseUrl: config.baseUrl,
+            blockOnViolation,
+            enableLogging,
+            projectId: config.projectId,
+            metadata: config.metadata,
+        },
+        policy: vercelAiSurfacePolicy(model.modelId),
+        dedicatedProxy: (name, value) => {
+            if (name === "doGenerate")
                 return overrides.doGenerate;
-            if (prop === "doStream")
+            if (name === "doStream")
                 return overrides.doStream;
+            return value;
+        },
+        logTrace: (entry) => {
+            // A generically-gated method is by definition one this wrapper has no
+            // result shape for, so token counts and output text are not available.
+            // Recording 0/null is honest; omitting the trace entirely would make an
+            // ungated-looking call invisible, which is the failure this file's
+            // monitor-only fix exists to prevent.
+            const { costUsd: cost, pricingSource: costPricingSource } = estimateCostDetailed(entry.model, 0, 0);
+            void guardrail.logTrace({
+                model: entry.model,
+                provider: model.provider,
+                input: entry.promptText,
+                output: null,
+                latencyMs: entry.latencyMs,
+                tokenUsage: { input: 0, output: 0 },
+                cost,
+                costPricingSource,
+                projectId: config.projectId,
+                metadata: { ...config.metadata, api: entry.label },
+                guardrailResult: entry.guardrailResult,
+                traceId: entry.traceId,
+            });
+        },
+    };
+    // Fails HERE, on the customer's first `withEvalguard(...)`, if the policy and
+    // this file ever disagree about which names are dedicated vs passthrough —
+    // rather than on the one call site nobody tested.
+    assertSurfacePolicy(ctx.policy);
+    return new Proxy(model, {
+        get(target, prop) {
+            if (typeof prop !== "string")
+                return Reflect.get(target, prop, target);
             // Proxy invariant: a non-configurable, non-writable own data property
-            // MUST be reported verbatim (returning a bound copy would throw).
+            // MUST be reported verbatim (returning a bound copy, or a guarded proxy
+            // over it, makes the engine throw). This check runs BEFORE the guard
+            // because the invariant is not negotiable — but it can only ever apply to
+            // a frozen own DATA property, never to a method resolved off a prototype,
+            // which is where every `@ai-sdk/provider` call method lives.
             const own = Object.getOwnPropertyDescriptor(target, prop);
             if (own && own.configurable === false && own.writable === false) {
                 return own.value;
             }
-            // Read with the TARGET as receiver, not the proxy, so a prototype getter
-            // that touches private state resolves against the real instance.
-            const value = Reflect.get(target, prop, target);
-            // Bind provider methods to the real model for the same reason — an
-            // unbound prototype method invoked as `wrapped.foo()` would get the
-            // Proxy as `this`.
-            return typeof value === "function" ? value.bind(target) : value;
+            return guardSurfaceProp(target, prop, ctx);
         },
     });
 }
@@ -380,9 +607,114 @@ export function withEvalguard(model, config) {
  * Now delegates to wrapper-core's `collapsePromptText`: every role, no
  * truncation, and shared with the langchain / llamaindex wrappers so the
  * three copies cannot drift apart again.
+ *
+ * AUDIT 2026-08-07 (vercel-ai surface E2E) — the RESIDUE fallback below.
+ * `collapsePromptText` reads a message's text out of `content` (and, only when
+ * `content == null`, `output` / `input`). Any OTHER key on the message object
+ * is never read, and the caller's rule was `if (promptText) { …check… }` — so
+ * "the collapser surfaced nothing" meant SKIP THE RAIL ENTIRELY and call the
+ * model anyway. Measured against the shipped `dist/`, with a healthy reachable
+ * firewall:
+ *
+ *   collapsePromptText([{ role: "user", text: "INJECTION" }])              -> ""
+ *   collapsePromptText([{ role: "user", parts: [{type:"text",text:"…"}] }]) -> ""
+ *
+ * and for both, `checkInput` was never called while the model WAS called. The
+ * second shape is the AI SDK's own UIMessage `parts` layout — `generateText` /
+ * `streamText` normalise it to `content` before the model boundary, so this is
+ * not reachable through the documented quickstart, but `withEvalguard` returns
+ * a model that any middleware chain or hand-built provider can drive directly.
+ *
+ * The failure MODE is the point: "no scannable text extracted" was treated as
+ * "nothing to scan" when what it actually means is "the scanner could not read
+ * this input" — the same conflation `firewall-response.ts` exists to reject on
+ * the response side, and the same one `message-text.ts` calls out ("a
+ * recognised set that produced only blanks proves nothing was read"). So when
+ * the prompt still carries payload, hand the raw bytes to the firewall rather
+ * than waving the call through.
  */
 function collapsePrompt(params) {
-    return collapsePromptText(params.prompt);
+    const prompt = params.prompt;
+    const parts = [];
+    const seen = new Set();
+    const push = (chunk) => {
+        if (!chunk || seen.has(chunk))
+            return;
+        seen.add(chunk);
+        parts.push(chunk);
+    };
+    // (1) The prompt-shaped render. Kept as the FLOOR, not as the gate: it knows
+    // how to collapse the AI SDK's message/part shapes into readable prose, which
+    // a generic walk would only ever produce as JSON.
+    push(collapsePromptText(prompt));
+    // (2) AUDIT 2026-08-08 — the whole-body walk, unioned on top.
+    //
+    // `params.prompt` is where a LANGUAGE model's text lives, and reading only
+    // that field is why speech and transcription calls were measured reaching the
+    // provider on ZERO firewall checks: `SpeechModelV3CallOptions` carries its
+    // payload in `text` / `instructions` and `TranscriptionModelV3CallOptions` in
+    // `audio` / `mediaType`, so `collapsePromptText(undefined)` returned "" and
+    // the caller's `if (promptText)` rule skipped the rail entirely. That is the
+    // same "an unrecognised field means there was nothing to scan" conflation
+    // wrapper-core's `request-scan.ts` exists to reject.
+    //
+    // This walks EVERY value at EVERY depth of the call options, excluding only
+    // wrapper-core's small reasoned `NON_MODEL_TEXT_KEYS` denylist (`headers`,
+    // `apiKey`, `authorization`, binary blobs by shape, …). It also picks up the
+    // parts of a LANGUAGE call that `collapsePromptText` never looked at — tool
+    // descriptions and JSON-schema parameters, which are model-visible and are a
+    // documented injection channel in agent apps.
+    for (const chunk of collectRequestStrings(params, { isExcludedKey: isNonModelTextKey })) {
+        push(chunk);
+    }
+    if (parts.length > 0)
+        return parts.join("\n");
+    // Collapse produced nothing. If the prompt is genuinely empty there is
+    // nothing to scan and skipping is correct (no bytes reach the model either).
+    if (!carriesPayload(prompt))
+        return "";
+    // Payload present but unsurfaced — scan the serialised prompt itself.
+    try {
+        const json = JSON.stringify(prompt);
+        if (json)
+            return json;
+    }
+    catch {
+        /* circular / BigInt — fall through to the throw below */
+    }
+    // Cannot render the prompt at all, so the firewall cannot see the input.
+    // Throwing routes this into runInputRail's catch, i.e. the same fail-CLOSED
+    // path as an outage. Never return "" here: that is the skip we just closed.
+    throw new Error("EvalGuard could not render the prompt for scanning (unserialisable value), " +
+        "so the input guardrail could not be evaluated");
+}
+/**
+ * Does `value` carry anything a scanner would want to see, ignoring the
+ * `role` / `type` discriminators that every message has by construction?
+ *
+ * Used only to tell "the prompt is genuinely empty" (skip the rail — correct,
+ * nothing reaches the model) from "the collapser did not surface what is
+ * there" (scan the raw bytes). See {@link collapsePrompt}.
+ */
+const PROMPT_DISCRIMINATOR_KEYS = new Set(["role", "type"]);
+function carriesPayload(value, depth = 0) {
+    if (value == null)
+        return false;
+    if (typeof value === "string")
+        return value.trim() !== "";
+    if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+        return true;
+    }
+    // Deeper than we will walk — assume payload rather than assume empty.
+    if (depth > 8)
+        return true;
+    if (Array.isArray(value))
+        return value.some((v) => carriesPayload(v, depth + 1));
+    if (typeof value === "object") {
+        return Object.entries(value).some(([k, v]) => !PROMPT_DISCRIMINATOR_KEYS.has(k) && carriesPayload(v, depth + 1));
+    }
+    // symbol / function — opaque, so treat as payload (fail toward scanning).
+    return true;
 }
 // ── Cost estimation (public surface) ────────────────────────────────────────
 // The README's "Cost estimates" section tells the customer to

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAA6B,MAAM,yBAAyB,CAAC;AACzG,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AA2MjD;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,UAAU,CAAqC;IACxD,YAAY,OAAe,EAAE,UAA8C;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAA8B;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,KAAuC;IACzD,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,KAAK,EAAE,YAAY,IAAI,CAAC;QACrE,MAAM,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,KAAK,EAAE,gBAAgB,IAAI,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAAqC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,OAAO;aAClB,MAAM,CACL,CAAC,CAAC,EAAuC,EAAE,CACzC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAQ,CAAoC,CAAC,IAAI,KAAK,QAAQ,CAC7F;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IACD,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,MAA2B;IAE3B,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;IACzD,MAAM,aAAa,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;IAC7C,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;IAEnD,MAAM,SAAS,GAAG;QAChB,KAAK,CAAC,UAAU,CAAC,MAAkC;YACjD,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,eAAiD,CAAC;YAEtD,mEAAmE;YACnE,qEAAqE;YACrE,oDAAoD;YACpD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,eAAe,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE;4BACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,KAAK,EAAE,KAAK,CAAC,OAAO;4BACpB,GAAG,MAAM,CAAC,QAAQ;yBACnB,CAAC,CAAC;wBACH,IAAI,CAAC,eAAe,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;4BACjD,MAAM,IAAI,qBAAqB,CAC7B,4CAA4C,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACtG,eAAe,CAAC,UAAU,CAC3B,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,GAAG,YAAY,qBAAqB;4BAAE,MAAM,GAAG,CAAC;wBACpD,6DAA6D;wBAC7D,iEAAiE;wBACjE,gEAAgE;wBAChE,6DAA6D;wBAC7D,+CAA+C;wBAC/C,IAAI,gBAAgB,EAAE,CAAC;4BACrB,MAAM,IAAI,qBAAqB,CAC7B,2CAA2C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,EAC5F,CAAC;oCACC,IAAI,EAAE,uBAAuB;oCAC7B,QAAQ,EAAE,MAAM;oCAChB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;iCACvE,CAAC,CACH,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAErD,oEAAoE;YACpE,+BAA+B;YAC/B,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9E,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAC9E,KAAK,CAAC,OAAO,EACb,WAAW,EACX,YAAY,CACb,CAAC;gBACF,KAAK,SAAS,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE,KAAK,CAAC,OAAO;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,iEAAiE;oBACjE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;oBAC7D,SAAS;oBACT,UAAU,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE;oBACxD,IAAI;oBACJ,iBAAiB;oBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,eAAe;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,MAAkC;YAC/C,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,eAAiD,CAAC;YAEtD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,eAAe,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE;4BACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,KAAK,EAAE,KAAK,CAAC,OAAO;4BACpB,GAAG,MAAM,CAAC,QAAQ;yBACnB,CAAC,CAAC;wBACH,IAAI,CAAC,eAAe,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;4BACjD,MAAM,IAAI,qBAAqB,CAC7B,4CAA4C,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACtG,eAAe,CAAC,UAAU,CAC3B,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,GAAG,YAAY,qBAAqB;4BAAE,MAAM,GAAG,CAAC;wBACpD,6DAA6D;wBAC7D,iEAAiE;wBACjE,gEAAgE;wBAChE,6DAA6D;wBAC7D,+CAA+C;wBAC/C,IAAI,gBAAgB,EAAE,CAAC;4BACrB,MAAM,IAAI,qBAAqB,CAC7B,2CAA2C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,EAC5F,CAAC;oCACC,IAAI,EAAE,uBAAuB;oCAC7B,QAAQ,EAAE,MAAM;oCAChB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;iCACvE,CAAC,CACH,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAE5C,mEAAmE;YACnE,uEAAuE;YACvE,sCAAsC;YACtC,IAAI,aAAa,GAAG,EAAE,CAAC;YACvB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,gBAAgB,GAAG,CAAC,CAAC;YACzB,IAAI,WAAW,GAAG,KAAK,CAAC;YAExB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAEzC;;;;;;eAMG;YACH,MAAM,aAAa,GAAG,CAAC,MAAe,EAAE,EAAE;gBACxC,IAAI,WAAW,IAAI,CAAC,aAAa;oBAAE,OAAO;gBAC1C,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAC9E,KAAK,CAAC,OAAO,EACb,YAAY,EACZ,gBAAgB,CACjB,CAAC;gBACF,KAAK,SAAS,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE,KAAK,CAAC,OAAO;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,MAAM,EAAE,aAAa;oBACrB,SAAS;oBACT,UAAU,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE;oBAC7D,IAAI;oBACJ,iBAAiB;oBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;oBACjF,eAAe;iBAChB,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,MAAM,aAAa,GAAG,IAAI,cAAc,CAA4B;gBAClE,mEAAmE;gBACnE,+DAA+D;gBAC/D,iEAAiE;gBACjE,mDAAmD;gBACnD,KAAK,CAAC,IAAI,CAAC,UAAU;oBACnB,IAAI,CAAC;wBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBACjD,IAAI,IAAI,EAAE,CAAC;4BACT,UAAU,CAAC,KAAK,EAAE,CAAC;4BACnB,aAAa,EAAE,CAAC;4BAChB,OAAO;wBACT,CAAC;wBACD,8CAA8C;wBAC9C,6DAA6D;wBAC7D,iEAAiE;wBACjE,8DAA8D;wBAC9D,iEAAiE;wBACjE,gDAAgD;wBAChD,MAAM,KAAK,GAAG,GAAgC,CAAC;wBAC/C,MAAM,QAAQ,GACZ,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;wBACzF,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;4BAC9B,MAAM,IAAI,GAAG,KAA2C,CAAC;4BACzD,sDAAsD;4BACtD,aAAa,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;wBACtD,CAAC;wBACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BAC1B,MAAM,UAAU,GAAG,KAAwC,CAAC;4BAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;4BAC5C,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC;4BAC5B,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;wBACnC,CAAC;wBACD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC5B,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,aAAa,CAAC,OAAO,CAAC,CAAC;wBACvB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC;gBACD,iEAAiE;gBACjE,iEAAiE;gBACjE,gEAAgE;gBAChE,0CAA0C;gBAC1C,KAAK,CAAC,MAAM,CAAC,MAAM;oBACjB,aAAa,CAAC,WAAW,CAAC,CAAC;oBAC3B,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAC9B,CAAC;oBAAC,MAAM,CAAC;wBACP,gCAAgC;oBAClC,CAAC;gBACH,CAAC;aACF,CAAC,CAAC;YAEH,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC9C,CAAC;KACF,CAAC;IAEF,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE;QACtB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,IAAI,IAAI,KAAK,YAAY;gBAAE,OAAO,SAAS,CAAC,UAAU,CAAC;YACvD,IAAI,IAAI,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;YAEnD,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,GAAG,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAChE,OAAO,GAAG,CAAC,KAAK,CAAC;YACnB,CAAC;YAED,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAChD,mEAAmE;YACnE,oEAAoE;YACpE,mBAAmB;YACnB,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACpG,CAAC;KACF,CAAW,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,cAAc,CAAC,MAAkC;IACxD,OAAO,kBAAkB,CAAC,MAAM,CAAC,MAAiB,CAAC,CAAC;AACtD,CAAC;AAID,+EAA+E;AAC/E,8DAA8D;AAC9D,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,6DAA6D;AAC7D,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8FG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AA2MrD;;;GAGG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,QAAQ;IACR,WAAW;IACX,SAAS;IACT,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE/C,+EAA+E;AAC/E,SAAS,mBAAmB,CAAC,CAAU;IACrC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,UAAU,CAAC;IACnG,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAS,iBAAiB,CAAC,MAA2B;IACpD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,mDAAmD;YACjD,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAY,MAAM,CAAC,MAAM,CAAC;IACtC,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CACb,wEAAwE,mBAAmB,CAAC,MAAM,CAAC,KAAK;YACtG,qEAAqE;YACrE,4FAA4F;YAC5F,4EAA4E;YAC5E,iFAAiF,CACpF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,oEAAoE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAC5G,CAAC;QACJ,CAAC;QACD,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,6EAA6E;QAC7E,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,sDAAsD,MAAM,CAAC,OAAO,MAAM;gBACxE,IAAI,MAAM,CAAC,QAAQ,mFAAmF;gBACtG,sDAAsD,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,6EAA6E;IAC7E,qEAAqE;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,OAAO;IACP,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CACV,0DAA0D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC9E,0BAA0B,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC/D,oEAAoE;gBACpE,gFAAgF;gBAChF,wFAAwF,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,4BAA4B;IAC1C,oBAAoB,CAAC,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,UAAU,CAAqC;IACxD,YAAY,OAAe,EAAE,UAA8C;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAA8B;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,KAAuC;IACzD,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,KAAK,EAAE,YAAY,IAAI,CAAC;QACrE,MAAM,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,KAAK,EAAE,gBAAgB,IAAI,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAAqC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,OAAO;aAClB,MAAM,CACL,CAAC,CAAC,EAAuC,EAAE,CACzC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAQ,CAAoC,CAAC,IAAI,KAAK,QAAQ,CAC7F;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IACD,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,MAA2B;IAE3B,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;IACzD,MAAM,aAAa,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;IAC7C,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;IAEnD;;;;;;;;OAQG;IACH,MAAM,YAAY,GAAG,KAAK,EACxB,MAAkC,EACS,EAAE;QAC7C,IAAI,CAAC,gBAAgB;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,0EAA0E;YAC1E,2EAA2E;YAC3E,0EAA0E;YAC1E,gCAAgC;YAChC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE;gBACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,GAAG,MAAM,CAAC,QAAQ;aACnB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;gBACxC,MAAM,IAAI,qBAAqB,CAC7B,4CAA4C,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC7F,MAAM,CAAC,UAAU,CAClB,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB;gBAAE,MAAM,GAAG,CAAC;YACpD,0EAA0E;YAC1E,EAAE;YACF,qEAAqE;YACrE,2EAA2E;YAC3E,wEAAwE;YACxE,wEAAwE;YACxE,2EAA2E;YAC3E,0BAA0B;YAC1B,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;gBAC1C,MAAM,IAAI,qBAAqB,CAC7B,qEAAqE,GAAG,CAAC,OAAO,KAAK;oBACnF,6FAA6F,EAC/F,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAC1E,CAAC;YACJ,CAAC;YACD,6DAA6D;YAC7D,iEAAiE;YACjE,gEAAgE;YAChE,4DAA4D;YAC5D,+CAA+C;YAC/C,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,IAAI,qBAAqB,CAC7B,2CAA2C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,EAC5F,CAAC;wBACC,IAAI,EAAE,uBAAuB;wBAC7B,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;qBACvE,CAAC,CACH,CAAC;YACJ,CAAC;YACD,sEAAsE;YACtE,yEAAyE;YACzE,oEAAoE;YACpE,0EAA0E;YAC1E,iEAAiE;YACjE,mEAAmE;YACnE,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,uDAAuD;YACvD,EAAE;YACF,qEAAqE;YACrE,0EAA0E;YAC1E,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,CAAC;wBACX,IAAI,EAAE,uBAAuB;wBAC7B,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;qBACvE,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG;QAChB,KAAK,CAAC,UAAU,CAAC,MAAkC;YACjD,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC7B,mEAAmE;YACnE,qEAAqE;YACrE,oDAAoD;YACpD,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;YAEnD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAErD,oEAAoE;YACpE,+BAA+B;YAC/B,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9E,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAC9E,KAAK,CAAC,OAAO,EACb,WAAW,EACX,YAAY,CACb,CAAC;gBACF,KAAK,SAAS,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE,KAAK,CAAC,OAAO;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,iEAAiE;oBACjE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;oBAC7D,SAAS;oBACT,UAAU,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE;oBACxD,IAAI;oBACJ,iBAAiB;oBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,eAAe;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,MAAkC;YAC/C,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;YAEnD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAE5C,mEAAmE;YACnE,uEAAuE;YACvE,sCAAsC;YACtC,IAAI,aAAa,GAAG,EAAE,CAAC;YACvB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,gBAAgB,GAAG,CAAC,CAAC;YACzB,IAAI,WAAW,GAAG,KAAK,CAAC;YAExB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAEzC;;;;;;eAMG;YACH,MAAM,aAAa,GAAG,CAAC,MAAe,EAAE,EAAE;gBACxC,IAAI,WAAW,IAAI,CAAC,aAAa;oBAAE,OAAO;gBAC1C,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAC9E,KAAK,CAAC,OAAO,EACb,YAAY,EACZ,gBAAgB,CACjB,CAAC;gBACF,KAAK,SAAS,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE,KAAK,CAAC,OAAO;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,MAAM,EAAE,aAAa;oBACrB,SAAS;oBACT,UAAU,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE;oBAC7D,IAAI;oBACJ,iBAAiB;oBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;oBACjF,eAAe;iBAChB,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,MAAM,aAAa,GAAG,IAAI,cAAc,CAA4B;gBAClE,mEAAmE;gBACnE,+DAA+D;gBAC/D,iEAAiE;gBACjE,mDAAmD;gBACnD,KAAK,CAAC,IAAI,CAAC,UAAU;oBACnB,IAAI,CAAC;wBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBACjD,IAAI,IAAI,EAAE,CAAC;4BACT,UAAU,CAAC,KAAK,EAAE,CAAC;4BACnB,aAAa,EAAE,CAAC;4BAChB,OAAO;wBACT,CAAC;wBACD,8CAA8C;wBAC9C,6DAA6D;wBAC7D,iEAAiE;wBACjE,8DAA8D;wBAC9D,iEAAiE;wBACjE,gDAAgD;wBAChD,MAAM,KAAK,GAAG,GAAgC,CAAC;wBAC/C,MAAM,QAAQ,GACZ,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;wBACzF,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;4BAC9B,MAAM,IAAI,GAAG,KAA2C,CAAC;4BACzD,sDAAsD;4BACtD,aAAa,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;wBACtD,CAAC;wBACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BAC1B,MAAM,UAAU,GAAG,KAAwC,CAAC;4BAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;4BAC5C,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC;4BAC5B,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;wBACnC,CAAC;wBACD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC5B,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,aAAa,CAAC,OAAO,CAAC,CAAC;wBACvB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC;gBACD,iEAAiE;gBACjE,iEAAiE;gBACjE,gEAAgE;gBAChE,0CAA0C;gBAC1C,KAAK,CAAC,MAAM,CAAC,MAAM;oBACjB,aAAa,CAAC,WAAW,CAAC,CAAC;oBAC3B,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAC9B,CAAC;oBAAC,MAAM,CAAC;wBACP,gCAAgC;oBAClC,CAAC;gBACH,CAAC;aACF,CAAC,CAAC;YAEH,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC9C,CAAC;KACF,CAAC;IAEF,6EAA6E;IAC7E,EAAE;IACF,qDAAqD;IACrD,EAAE;IACF,8DAA8D;IAC9D,4DAA4D;IAC5D,QAAQ;IACR,uDAAuD;IACvD,uEAAuE;IACvE,EAAE;IACF,4EAA4E;IAC5E,iEAAiE;IACjE,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,sEAAsE;IACtE,EAAE;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,eAAe;IACf,MAAM,GAAG,GAAmB;QAC1B,SAAS;QACT,gBAAgB;QAChB,aAAa;QACb,MAAM,EAAE;YACN,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB;YAChB,aAAa;YACb,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B;QACD,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5C,cAAc,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC9B,IAAI,IAAI,KAAK,YAAY;gBAAE,OAAO,SAAS,CAAC,UAAU,CAAC;YACvD,IAAI,IAAI,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YAClB,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,mEAAmE;YACnE,sCAAsC;YACtC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAC9E,KAAK,CAAC,KAAK,EACX,CAAC,EACD,CAAC,CACF,CAAC;YACF,KAAK,SAAS,CAAC,QAAQ,CAAC;gBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,UAAU;gBACvB,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;gBACnC,IAAI;gBACJ,iBAAiB;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClD,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,8EAA8E;IAC9E,2EAA2E;IAC3E,kDAAkD;IAClD,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEhC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE;QACtB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAEvE,sEAAsE;YACtE,wEAAwE;YACxE,qEAAqE;YACrE,0EAA0E;YAC1E,0EAA0E;YAC1E,6DAA6D;YAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,GAAG,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAChE,OAAO,GAAG,CAAC,KAAK,CAAC;YACnB,CAAC;YAED,OAAO,gBAAgB,CAAC,MAA4C,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;KACF,CAAW,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,SAAS,cAAc,CAAC,MAAkC;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAiB,CAAC;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,KAAa,EAAQ,EAAE;QACnC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QACtC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEjC,8DAA8D;IAC9D,EAAE;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,qDAAqD;IACrD,EAAE;IACF,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,8CAA8C;IAC9C,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,uEAAuE;IACvE,6EAA6E;IAC7E,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,sEAAsE;IACtE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;IAC3D,CAAC;IACD,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,IAAI,KAAK,CACb,6EAA6E;QAC3E,+CAA+C,CAClD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjF,SAAS,cAAc,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC/C,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,sEAAsE;IACtE,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,IAAI,CAC1D,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAC9E,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAID,+EAA+E;AAC/E,8DAA8D;AAC9D,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,6DAA6D;AAC7D,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}