@forumone/throughline-core 0.9.0 → 0.10.0

package/bin/payload-cli.mjs

@@ -0,0 +1,443 @@
+/*
+The Payload CLI, wrapped so a hung run cannot outlive the shell that started it.
+`bin/throughline-payload.mjs` is the entry point; this module is the runner and
+the pure pieces its tests exercise.
+
+`pnpm payload generate:types` is three processes deep — shell, pnpm, node — and
+pnpm (like npm and yarn) does not forward signals to the script child it
+spawns. Kill the shell (a Ctrl-C, an agent tool-call timeout, a closed
+terminal, a cancelled CI step) and pnpm dies while node keeps running,
+reparented to PID 1. When the run was hung rather than merely slow, that orphan
+spins on a core indefinitely: 48 of them piled up on one machine inside a day,
+~90 CPU-minutes each, at a load average of 300.
+
+Three layers, because no single one covers every way this exits.
+
+1. The child is spawned `detached`, so it leads its own process group. That is
+   what makes it killable as a *group* by pid — the whole subtree dies with it,
+   and nothing is ever matched by process name, which would put unrelated node
+   work on the same machine at risk.
+2. SIGINT, SIGTERM and SIGHUP are forwarded to that group, and a wall-clock
+   timeout kills it as well. Between them that covers Ctrl-C, a tool-call
+   timeout, and a hangup from a closing terminal.
+3. If this runner is itself SIGKILLed, no handler of ours can run. So each
+   spawn is recorded in `.payload-cli-pids` at the workspace root and the
+   *next* run (or `--reap`) sweeps the file. See `verdict` for what an entry
+   must satisfy before anything is signalled.
+
+PAYLOAD_CLI_TIMEOUT_MS sets the wall clock; 0 disables it. The default is five
+minutes, except for the `migrate` family (`migrate`, `migrate:create`, …),
+which gets none: a large migration is legitimately long, and `migrate:create`
+can stop at an interactive prompt. Layers 1 and 3 apply regardless.
+*/
+import { execFile, spawn } from 'node:child_process'
+import { createRequire } from 'node:module'
+import { promisify } from 'node:util'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const execFileAsync = promisify(execFile)
+
+export const PID_FILE_NAME = '.payload-cli-pids'
+export const DEFAULT_TIMEOUT_MS = 300_000
+export const DEFAULT_GRACE_MS = 5_000
+/** Exit code for "gave up waiting", as coreutils `timeout` uses. */
+export const TIMEOUT_EXIT_CODE = 124
+
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+const log = (message) => process.stderr.write(`throughline-payload: ${message}\n`)
+
+/** Collapse runs of whitespace, so `ps` column padding never decides a match. */
+export const norm = (value) => (value ?? '').trim().replace(/\s+/g, ' ')
+
+// ---------------------------------------------------------------------------
+// Pure pieces
+// ---------------------------------------------------------------------------
+
+/**
+ * `--reap` alone sweeps and exits. Anything else is passed to the Payload CLI
+ * untouched, including flags that look like ours further along the argv.
+ */
+export function parseArgs(argv) {
+  if (argv[0] === '--reap') return { mode: 'reap', args: [] }
+  return { mode: 'run', args: [...argv] }
+}
+
+/** `migrate`, `migrate:create`, `migrate:status`, `migrate:fresh`, … */
+export const isMigrateCommand = (args) => /^migrate(:|$)/.test(args[0] ?? '')
+
+function readMs(env, name, fallback) {
+  const raw = env[name]
+  if (raw === undefined || raw.trim() === '') return fallback
+  const value = Number(raw)
+  if (!Number.isInteger(value) || value < 0) {
+    throw new Error(`${name} must be a whole number of milliseconds (0 disables it), got '${raw}'`)
+  }
+  return value
+}
+
+/**
+ * The wall clock for a run, in ms; 0 means none. An explicit
+ * PAYLOAD_CLI_TIMEOUT_MS always wins. A malformed one is an error rather than
+ * silently "no timeout", which is the failure this exists to prevent.
+ */
+export function selectTimeout(args, env) {
+  return readMs(env, 'PAYLOAD_CLI_TIMEOUT_MS', isMigrateCommand(args) ? 0 : DEFAULT_TIMEOUT_MS)
+}
+
+/** How long a group gets between the polite signal and SIGKILL. */
+export const selectGrace = (env) => readMs(env, 'PAYLOAD_CLI_GRACE_MS', DEFAULT_GRACE_MS)
+
+/**
+ * The directory that owns the pid file: the nearest ancestor of `cwd` holding
+ * `pnpm-workspace.yaml` — the workspace root, so every app in a monorepo
+ * shares one file and one `payload:reap` — or, outside a pnpm workspace, the
+ * nearest directory with a `package.json`. Real path, because that is what
+ * the spawned command line contains.
+ */
+export function findRoot(cwd, exists = fs.existsSync) {
+  const real = fs.realpathSync(cwd)
+  let nearestPackage
+  for (let dir = real; ; dir = path.dirname(dir)) {
+    if (exists(path.join(dir, 'pnpm-workspace.yaml'))) return dir
+    if (!nearestPackage && exists(path.join(dir, 'package.json'))) nearestPackage = dir
+    if (path.dirname(dir) === dir) break
+  }
+  return nearestPackage ?? real
+}
+
+const ENTRY_FIELDS = {
+  pid: 'number',
+  pgid: 'number',
+  start: 'string',
+  command: 'string',
+  runnerPid: 'number',
+  runnerStart: 'string',
+}
+
+/**
+ * One JSON object per line. A torn line from an abrupt exit, or anything
+ * missing a field verification needs, is dropped — never guessed at.
+ */
+export function parsePidFile(text) {
+  return text
+    .split('\n')
+    .filter((line) => line.trim())
+    .flatMap((line) => {
+      let entry
+      try {
+        entry = JSON.parse(line)
+      } catch {
+        return []
+      }
+      if (!entry || typeof entry !== 'object') return []
+      for (const [field, type] of Object.entries(ENTRY_FIELDS)) {
+        if (typeof entry[field] !== type) return []
+      }
+      if (!Number.isInteger(entry.pid) || entry.pid <= 1) return []
+      if (entry.pgid !== entry.pid) return [] // We only ever record group leaders.
+      return [entry]
+    })
+}
+
+export const serializeEntries = (entries) =>
+  entries.map((entry) => `${JSON.stringify(entry)}\n`).join('')
+
+/**
+ * What the sweep does with one recorded entry, given what `ps` reports now
+ * (`undefined` fields mean the pid is gone):
+ *
+ *   'forget' — the pid is gone, or it is no longer the process we recorded:
+ *              its start time differs (the OS recycled the pid), its command
+ *              line differs, or that command line is not rooted in this
+ *              workspace. Nothing is signalled.
+ *   'keep'   — it is ours and its runner is still alive: a concurrent run in
+ *              this workspace, which keeps its child.
+ *   'reap'   — it is ours and its runner is gone: an orphan.
+ *
+ * Only 'reap' leads to a signal, and only to the recorded process group.
+ */
+export function verdict(entry, observed, root) {
+  if (!observed.start) return 'forget'
+  if (norm(observed.start) !== norm(entry.start)) return 'forget'
+  if (norm(observed.command) !== norm(entry.command)) return 'forget'
+  if (!entry.command.includes(`${root}${path.sep}`)) return 'forget'
+  if (observed.runnerStart && norm(observed.runnerStart) === norm(entry.runnerStart)) return 'keep'
+  return 'reap'
+}
+
+/** 128 + signal number, as a shell reports a signalled exit. */
+export const signalExitCode = (signal) => 128 + (os.constants.signals[signal] ?? 0)
+
+// ---------------------------------------------------------------------------
+// Processes
+// ---------------------------------------------------------------------------
+
+/*
+`payload/bin.js` is not in the package's `exports`, so it cannot be resolved
+directly. Resolve the package entry from the app's directory — never from this
+package's own install — and walk up to the directory that owns it. The result
+is a real path inside this workspace, which is what makes the spawned argv
+unambiguous: one node process whose command line names this workspace.
+*/
+export function resolvePayloadBin(fromDir) {
+  const require = createRequire(path.join(fromDir, 'package.json'))
+  let entry
+  try {
+    entry = require.resolve('payload')
+  } catch {
+    throw new Error(`could not resolve 'payload' from ${fromDir} — is it a dependency of this app?`)
+  }
+  for (let dir = path.dirname(entry); ; dir = path.dirname(dir)) {
+    const manifest = path.join(dir, 'package.json')
+    if (fs.existsSync(manifest)) {
+      const { name, bin } = JSON.parse(fs.readFileSync(manifest, 'utf8'))
+      if (name === 'payload') {
+        const relative = typeof bin === 'string' ? bin : bin?.payload
+        if (relative) return fs.realpathSync(path.join(dir, relative))
+        break
+      }
+    }
+    if (path.dirname(dir) === dir) break
+  }
+  throw new Error(`could not find the payload CLI's bin from ${fromDir}`)
+}
+
+/*
+One `ps` field for a set of pids, as a map; a pid that is gone is absent. `-ww`
+so a long command line is never truncated. Every process is listed and then
+filtered, rather than asking for the pids with `-p`: one implausible pid in the
+file ("process id too large" on macOS) makes `ps -p` fail for the whole batch,
+which would blind the sweep.
+*/
+async function psField(pids, field) {
+  const found = new Map()
+  if (!pids.length) return found
+  const wanted = new Set(pids)
+  let stdout
+  try {
+    ;({ stdout } = await execFileAsync('ps', ['-A', '-ww', '-o', `pid=,${field}=`], {
+      maxBuffer: 64 * 1024 * 1024,
+    }))
+  } catch (error) {
+    stdout = error?.stdout ?? ''
+  }
+  for (const line of stdout.split('\n')) {
+    const match = line.match(/^\s*(\d+)\s+(.*)$/)
+    if (match && wanted.has(Number(match[1]))) found.set(Number(match[1]), match[2])
+  }
+  return found
+}
+
+const groupAlive = (pgid) => {
+  try {
+    process.kill(-pgid, 0)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/*
+`signal` to the group, then SIGKILL to whatever is left after the grace period.
+The wait is on the whole group, not just its leader, so a grandchild that
+ignores the first signal is still caught.
+*/
+async function killGroup(pgid, signal, graceMs) {
+  try {
+    process.kill(-pgid, signal)
+  } catch {
+    return // Already gone.
+  }
+  for (let waited = 0; waited < graceMs; waited += 100) {
+    if (!groupAlive(pgid)) return
+    await delay(100)
+  }
+  try {
+    process.kill(-pgid, 'SIGKILL')
+  } catch {
+    // Exited during the grace period.
+  }
+}
+
+function pidFileStore(root) {
+  const file = path.join(root, PID_FILE_NAME)
+  const read = () => {
+    try {
+      return parsePidFile(fs.readFileSync(file, 'utf8'))
+    } catch {
+      return []
+    }
+  }
+  const write = (entries) => {
+    if (!entries.length) fs.rmSync(file, { force: true })
+    else fs.writeFileSync(file, serializeEntries(entries))
+  }
+  return {
+    read,
+    write,
+    append: (entry) => fs.appendFileSync(file, serializeEntries([entry])),
+    drop: (pid) => write(read().filter((entry) => entry.pid !== pid)),
+  }
+}
+
+/** The backstop: reap orphans this workspace recorded. Returns how many. */
+export async function sweep(root, graceMs) {
+  const store = pidFileStore(root)
+  const entries = store.read()
+  if (!entries.length) return 0
+
+  const pids = [...new Set(entries.flatMap((entry) => [entry.pid, entry.runnerPid]))]
+  const [starts, commands] = await Promise.all([psField(pids, 'lstart'), psField(pids, 'args')])
+
+  const keep = []
+  let reaped = 0
+  for (const entry of entries) {
+    const result = verdict(
+      entry,
+      {
+        start: starts.get(entry.pid),
+        command: commands.get(entry.pid),
+        runnerStart: starts.get(entry.runnerPid),
+      },
+      root,
+    )
+    if (result === 'keep') keep.push(entry)
+    if (result !== 'reap') continue
+    log(
+      `reaping orphaned '${entry.script ?? 'payload'}' (pid ${entry.pid}, started ${entry.at ?? entry.start})`,
+    )
+    await killGroup(entry.pgid, 'SIGTERM', graceMs)
+    reaped += 1
+  }
+  // Re-read so an entry a concurrent run appended meanwhile is not lost.
+  const handled = new Set(entries.map((entry) => entry.pid))
+  const kept = new Set(keep.map((entry) => entry.pid))
+  store.write(store.read().filter((entry) => !handled.has(entry.pid) || kept.has(entry.pid)))
+  return reaped
+}
+
+export async function main({
+  argv = process.argv.slice(2),
+  cwd = process.cwd(),
+  env = process.env,
+} = {}) {
+  let parsed, timeoutMs, graceMs, root
+  try {
+    parsed = parseArgs(argv)
+    timeoutMs = selectTimeout(parsed.args, env)
+    graceMs = selectGrace(env)
+    root = findRoot(cwd)
+  } catch (error) {
+    log(error.message)
+    process.exit(2)
+  }
+
+  if (process.platform === 'win32') {
+    // No process groups and no `ps`: run it plainly rather than not at all.
+    if (parsed.mode === 'reap') return
+    const child = spawn(process.execPath, [resolvePayloadBin(cwd), ...parsed.args], {
+      stdio: 'inherit',
+      cwd,
+    })
+    child.on('exit', (code) => process.exit(code ?? 1))
+    return
+  }
+
+  const reaped = await sweep(root, graceMs)
+  if (parsed.mode === 'reap') {
+    log(reaped ? `reaped ${reaped} orphaned run(s)` : 'nothing to reap')
+    return
+  }
+
+  let bin
+  try {
+    bin = resolvePayloadBin(cwd)
+  } catch (error) {
+    log(error.message)
+    process.exit(1)
+  }
+
+  const store = pidFileStore(root)
+  const childArgv = [bin, ...parsed.args]
+  const child = spawn(process.execPath, childArgv, { stdio: 'inherit', detached: true, cwd, env })
+
+  let timer
+  let finished = false
+  let stopping = false
+  const finish = (code) => {
+    if (finished) return
+    finished = true
+    clearTimeout(timer)
+    if (child.pid) store.drop(child.pid)
+    process.exit(code)
+  }
+
+  /*
+  Kill the group and then exit with `code`. Exiting is deliberately left to
+  this, not to the child's 'exit' event: the leader usually dies on the first
+  signal, and exiting then would abandon the grace period — and with it the
+  SIGKILL for a grandchild that ignored that signal.
+  */
+  const stop = async (signal, code) => {
+    if (stopping || finished) return
+    stopping = true
+    if (child.pid) await killGroup(child.pid, signal, graceMs)
+    finish(code)
+  }
+
+  child.on('error', (error) => {
+    log(error.message)
+    if (!stopping) finish(1)
+  })
+  child.on('exit', async (code, signal) => {
+    if (stopping) return
+    // Payload is done. Anything it left running in its group goes with it.
+    if (groupAlive(child.pid)) {
+      stopping = true
+      await killGroup(child.pid, 'SIGTERM', graceMs)
+    }
+    finish(signal ? signalExitCode(signal) : (code ?? 0))
+  })
+
+  /*
+  The child is in its own group, so a terminal Ctrl-C reaches this runner
+  alone. Forwarding the same signal lets Payload clean up as it would have;
+  the grace period then escalates to SIGKILL.
+  */
+  for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
+    process.on(signal, () => stop(signal, signalExitCode(signal)))
+  }
+
+  if (timeoutMs > 0) {
+    timer = setTimeout(() => {
+      log(
+        `no exit after ${Math.round(timeoutMs / 1000)}s — killing process group ${child.pid}. ` +
+          'Set PAYLOAD_CLI_TIMEOUT_MS higher, or 0, if this run is legitimately slow.',
+      )
+      stop('SIGTERM', TIMEOUT_EXIT_CODE)
+    }, timeoutMs)
+  }
+
+  if (!child.pid) return // Spawn failed; 'error' handles it.
+
+  /*
+  Recorded after the spawn, so a run that exits before this lands leaves an
+  entry the next sweep forgets on its first condition. The command is the argv
+  we spawned, not what `ps` shows this instant — just after fork the child can
+  still carry this runner's argv.
+  */
+  const starts = await psField([child.pid, process.pid], 'lstart')
+  if (finished) return
+  store.append({
+    pid: child.pid,
+    pgid: child.pid, // `detached` makes the child its own group leader.
+    start: norm(starts.get(child.pid)),
+    command: [process.execPath, ...childArgv].join(' '),
+    runnerPid: process.pid,
+    runnerStart: norm(starts.get(process.pid)),
+    script: parsed.args[0] ?? 'payload',
+    at: new Date().toISOString(),
+  })
+}

package/bin/throughline-payload.mjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+// The Payload CLI, run in its own process group under a wall clock, with a
+// sweep for runs a killed shell left behind. See ./payload-cli.mjs.
+import { main } from './payload-cli.mjs'
+
+await main()

package/dist/audit/collection.d.ts

@@ -1,4 +1,5 @@
 import type { Access, CollectionConfig } from 'payload';
+import { type PluginAdminOptions } from '@forumone/throughline-plugin-contract';
 export interface AuditCollectionOptions {
     /** Override the collection slug. Default: `'audit-events'`. */
     slug?: string;
@@ -7,6 +8,8 @@ export interface AuditCollectionOptions {
      * Defaults to admin/editor roles.
      */
     readAccess?: Access;
+    /** Sidebar placement. Default: the `'Throughline'` group; `group: false` leaves it ungrouped. */
+    admin?: PluginAdminOptions;
 }
 export declare const DEFAULT_AUDIT_SLUG = "audit-events";
 /**

package/dist/audit/collection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../../src/audit/collection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAGvD,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAOhD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,gBAAgB,CA+F5F"}
+{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../../src/audit/collection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AACvD,OAAO,EAAE,KAAK,kBAAkB,EAAqB,MAAM,uCAAuC,CAAA;AAGlG,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iGAAiG;IACjG,KAAK,CAAC,EAAE,kBAAkB,CAAA;CAC3B;AAED,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAOhD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,gBAAgB,CAgG5F"}

package/dist/audit/collection.js

@@ -1,3 +1,4 @@
+import { resolveAdminGroup } from '@forumone/throughline-plugin-contract';
 import { AUDIT_ACTIONS, AUDIT_MCP_SERVERS } from './types.js';
 export const DEFAULT_AUDIT_SLUG = 'audit-events';
 const defaultReadAccess = ({ req }) => {
@@ -15,6 +16,7 @@ export function createAuditCollection(options = {}) {
     return {
         slug,
         admin: {
+            ...resolveAdminGroup(options.admin),
             useAsTitle: 'summary',
             defaultColumns: ['createdAt', 'actor', 'action', 'targetCollection', 'targetId'],
             description: 'Immutable record of every consequential action in the system. Read-only through the admin.',

package/dist/audit/collection.js.map

@@ -1 +1 @@
-{"version":3,"file":"collection.js","sourceRoot":"","sources":["../../src/audit/collection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAY7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAEhD,MAAM,iBAAiB,GAAW,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IAC5C,MAAM,KAAK,GAAI,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAA0B,IAAI,EAAE,CAAA;IACjE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC5D,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkC,EAAE;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAA;IAE/C,OAAO;QACL,IAAI;QACJ,KAAK,EAAE;YACL,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,CAAC;YAChF,WAAW,EACT,4FAA4F;SAC/F;QACD,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,iBAAiB;YAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;SACpB;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC/C;YACD;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE;4BACP,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;4BAChC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;4BACpC,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE;yBAC/C;qBACF;oBACD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;oBAChC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;oBAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE;oBACpC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;oBAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE;iBACpC;aACF;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACjE;YACD;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACrE;YACD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjD,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE;YAC1C,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;YAClC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;YACrC;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,EAAE,WAAW,EAAE,4DAA4D,EAAE;aACrF;YACD;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE;aACrE;YACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE;YAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjD;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE;oBACL,WAAW,EAAE,4DAA4D;iBAC1E;aACF;YACD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE;YACzD,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE;YACtC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE;YAC3C,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE;SACxC;QACD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;YACzB,EAAE,MAAM,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE;YACzC,EAAE,MAAM,EAAE,CAAC,kBAAkB,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE;YACzD,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE;YACnC,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;SACvC;QACD,UAAU,EAAE,KAAK;KAClB,CAAA;AACH,CAAC"}
+{"version":3,"file":"collection.js","sourceRoot":"","sources":["../../src/audit/collection.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAClG,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAc7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAEhD,MAAM,iBAAiB,GAAW,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IAC5C,MAAM,KAAK,GAAI,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAA0B,IAAI,EAAE,CAAA;IACjE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC5D,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkC,EAAE;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAA;IAE/C,OAAO;QACL,IAAI;QACJ,KAAK,EAAE;YACL,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC;YACnC,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,CAAC;YAChF,WAAW,EACT,4FAA4F;SAC/F;QACD,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,iBAAiB;YAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;SACpB;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC/C;YACD;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE;4BACP,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;4BAChC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;4BACpC,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE;yBAC/C;qBACF;oBACD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;oBAChC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;oBAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE;oBACpC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;oBAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE;iBACpC;aACF;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACjE;YACD;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACrE;YACD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjD,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE;YAC1C,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;YAClC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;YACrC;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,EAAE,WAAW,EAAE,4DAA4D,EAAE;aACrF;YACD;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE;aACrE;YACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE;YAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjD;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE;oBACL,WAAW,EAAE,4DAA4D;iBAC1E;aACF;YACD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE;YACzD,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE;YACtC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE;YAC3C,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE;SACxC;QACD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;YACzB,EAAE,MAAM,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE;YACzC,EAAE,MAAM,EAAE,CAAC,kBAAkB,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE;YACzD,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE;YACnC,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;SACvC;QACD,UAAU,EAAE,KAAK;KAClB,CAAA;AACH,CAAC"}

package/dist/env/index.d.ts

@@ -0,0 +1,54 @@
+import type { EnvRequirement } from '@forumone/throughline-plugin-contract';
+/** What is wrong with one value. `undefined` from `checkEnvValue` means nothing. */
+export type EnvValueProblem = {
+    kind: 'missing';
+} | {
+    kind: 'too-short';
+    length: number;
+    minLength: number;
+};
+/**
+ * Checks one value against one requirement, without saying where the value
+ * came from. A plugin calls it on `options.x ?? process.env[requirement.name]`
+ * and words the error its own way; `assertEnvironment` calls it on the
+ * environment alone.
+ *
+ * Empty and whitespace-only count as missing. The length is the value's own,
+ * untrimmed, which is what the code that uses it will see.
+ */
+export declare function checkEnvValue(requirement: EnvRequirement, value: string | undefined): EnvValueProblem | undefined;
+/**
+ * Anything `assertEnvironment` accepts: a requirement, a plugin's list of
+ * them, or a function that throws when something is wrong — for a rule that is
+ * not "this name, this long", such as a database URL that may arrive under any
+ * of several names. The thrown message becomes the problem's line, so it must
+ * not contain the value either.
+ */
+export type EnvironmentCheck = EnvRequirement | readonly EnvRequirement[] | (() => unknown);
+/** The error `assertEnvironment` throws. `problems` holds one line per problem. */
+export declare class EnvironmentError extends Error {
+    readonly problems: readonly string[];
+    constructor(problems: readonly string[]);
+}
+/**
+ * Checks every requirement against `process.env` and throws one
+ * {@link EnvironmentError} listing every missing or too-short value, each with
+ * its `why`. Values are never printed — a too-short one is reported by length.
+ *
+ * Call it first in `payload.config.ts`, at module scope, with every plugin's
+ * list and the site's own variables:
+ *
+ * ```ts
+ * assertEnvironment(
+ *   approvalsEnv,
+ *   emailEnv,
+ *   formsEnv,
+ *   { name: 'PAYLOAD_SECRET', minLength: 32, why: 'Signs Payload sessions.' },
+ *   () => databaseConnectionString(),
+ * )
+ * ```
+ *
+ * A name listed twice is reported once, against the strictest `minLength`.
+ */
+export declare function assertEnvironment(...checks: readonly EnvironmentCheck[]): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/env/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/env/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAoB3E,oFAAoF;AACpF,MAAM,MAAM,eAAe,GACzB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAEhF;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,cAAc,EAC3B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,eAAe,GAAG,SAAS,CAO7B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,SAAS,cAAc,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;AAE3F,mFAAmF;AACnF,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;gBAExB,QAAQ,EAAE,SAAS,MAAM,EAAE;CAkBxC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,CA2C9E"}

package/dist/env/index.js

@@ -0,0 +1,113 @@
+/**
+ * Checks one value against one requirement, without saying where the value
+ * came from. A plugin calls it on `options.x ?? process.env[requirement.name]`
+ * and words the error its own way; `assertEnvironment` calls it on the
+ * environment alone.
+ *
+ * Empty and whitespace-only count as missing. The length is the value's own,
+ * untrimmed, which is what the code that uses it will see.
+ */
+export function checkEnvValue(requirement, value) {
+    if (value === undefined || value.trim() === '')
+        return { kind: 'missing' };
+    const { minLength } = requirement;
+    if (minLength !== undefined && value.length < minLength) {
+        return { kind: 'too-short', length: value.length, minLength };
+    }
+    return undefined;
+}
+/** The error `assertEnvironment` throws. `problems` holds one line per problem. */
+export class EnvironmentError extends Error {
+    problems;
+    constructor(problems) {
+        const count = problems.length;
+        super([
+            `Configuration problem: ${count} environment variable${count === 1 ? '' : 's'} ` +
+                `${count === 1 ? 'is' : 'are'} missing or invalid. This is not a code or build ` +
+                `failure; nothing will start until ${count === 1 ? 'it is' : 'they are'} set.`,
+            '',
+            ...problems.map((line) => `  - ${line}`),
+            '',
+            "Set each in the environment this process runs in (.env locally, your host's " +
+                'settings when deployed). One that is set and still listed is not reaching the ' +
+                'process: a turbo task passes only the variables its turbo.json `env` declares.',
+        ].join('\n'));
+        this.name = 'EnvironmentError';
+        this.problems = problems;
+    }
+}
+/**
+ * Checks every requirement against `process.env` and throws one
+ * {@link EnvironmentError} listing every missing or too-short value, each with
+ * its `why`. Values are never printed — a too-short one is reported by length.
+ *
+ * Call it first in `payload.config.ts`, at module scope, with every plugin's
+ * list and the site's own variables:
+ *
+ * ```ts
+ * assertEnvironment(
+ *   approvalsEnv,
+ *   emailEnv,
+ *   formsEnv,
+ *   { name: 'PAYLOAD_SECRET', minLength: 32, why: 'Signs Payload sessions.' },
+ *   () => databaseConnectionString(),
+ * )
+ * ```
+ *
+ * A name listed twice is reported once, against the strictest `minLength`.
+ */
+export function assertEnvironment(...checks) {
+    const requirements = new Map();
+    const problems = [];
+    for (const check of checks) {
+        if (typeof check === 'function') {
+            try {
+                check();
+            }
+            catch (error) {
+                problems.push(error instanceof Error ? error.message : String(error));
+            }
+            continue;
+        }
+        for (const requirement of isList(check) ? check : [check]) {
+            const seen = requirements.get(requirement.name);
+            if (!seen) {
+                requirements.set(requirement.name, {
+                    ...(requirement.minLength !== undefined ? { minLength: requirement.minLength } : {}),
+                    whys: [requirement.why],
+                });
+                continue;
+            }
+            if (requirement.minLength !== undefined) {
+                seen.minLength = Math.max(seen.minLength ?? 0, requirement.minLength);
+            }
+            if (!seen.whys.includes(requirement.why))
+                seen.whys.push(requirement.why);
+        }
+    }
+    // Requirements first, in the order given; then the free-form checks.
+    const lines = [];
+    for (const [name, { minLength, whys }] of requirements) {
+        const requirement = {
+            name,
+            why: whys.join(' '),
+            ...(minLength !== undefined ? { minLength } : {}),
+        };
+        const problem = checkEnvValue(requirement, process.env[name]);
+        if (problem)
+            lines.push(describe(requirement, problem));
+    }
+    lines.push(...problems);
+    if (lines.length > 0)
+        throw new EnvironmentError(lines);
+}
+function isList(check) {
+    return Array.isArray(check);
+}
+function describe(requirement, problem) {
+    const what = problem.kind === 'missing'
+        ? `${requirement.name} is not set.`
+        : `${requirement.name} is ${problem.length} characters; the minimum is ${problem.minLength}.`;
+    return `${what} ${requirement.why}`;
+}
+//# sourceMappingURL=index.js.map

package/dist/env/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/env/index.ts"],"names":[],"mappings":"AAwBA;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,WAA2B,EAC3B,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC1E,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAAA;IACjC,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACxD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,CAAA;IAC/D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAWD,mFAAmF;AACnF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,QAAQ,CAAmB;IAEpC,YAAY,QAA2B;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAA;QAC7B,KAAK,CACH;YACE,0BAA0B,KAAK,wBAAwB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;gBAC9E,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,mDAAmD;gBAChF,qCAAqC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO;YAChF,EAAE;YACF,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;YACxC,EAAE;YACF,8EAA8E;gBAC5E,gFAAgF;gBAChF,gFAAgF;SACnF,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;QAC9B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,MAAmC;IACtE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkD,CAAA;IAC9E,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,KAAK,EAAE,CAAA;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YACvE,CAAC;YACD,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;YAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;oBACjC,GAAG,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpF,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;iBACxB,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YACD,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACxC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAA;YACvE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,YAAY,EAAE,CAAC;QACvD,MAAM,WAAW,GAAmB;YAClC,IAAI;YACJ,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACnB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAA;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;QAC7D,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;IACzD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAA;IAEvB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,MAAM,CAAC,KAAuB;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,WAA2B,EAAE,OAAwB;IACrE,MAAM,IAAI,GACR,OAAO,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,cAAc;QACnC,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,OAAO,OAAO,CAAC,MAAM,+BAA+B,OAAO,CAAC,SAAS,GAAG,CAAA;IACjG,OAAO,GAAG,IAAI,IAAI,WAAW,CAAC,GAAG,EAAE,CAAA;AACrC,CAAC"}