@fuzdev/fuz_app 0.140.0 → 0.142.0

package/dist/http/ip_canonical.d.ts

@@ -27,9 +27,15 @@
  *    canonicalization because the dotted form is the only form the
  *    strip can recognize symmetrically.
  *
- * Mirrors `zzz_server::proxy::normalize_ip` (landed 2026-05-16) which
- * uses the same parse-then-canonicalize-then-strip ordering for the
- * same rate-limit-key-poisoning surface.
+ * Mirrors the Rust spine's `fuz_http::normalize_ip`, which uses the same
+ * parse-then-canonicalize-then-strip ordering for the same
+ * rate-limit-key-poisoning surface.
+ *
+ * `rate_limit_ip_key` is the bucket key an IP-keyed rate limiter uses: an
+ * IPv6 address collapses to its `/64`, the smallest block a host is commonly
+ * assigned, so rotating through one's own subnet buys no fresh budget. Only
+ * the limiter call sites apply it — the client IP stays the full address
+ * everywhere else (audit rows, token `last_used_ip`, `REMOTE_ADDR`).
  *
  * @module
  */
@@ -97,4 +103,25 @@ export declare const canonicalize_ip: (ip: string) => string;
  * @throws {RangeError} when `bits` is negative or exceeds 128 bits
  */
 export declare const ipv6_bigint_to_canonical: (bits: bigint) => string;
+/**
+ * The bucket key an IP-keyed rate limiter uses for client IP `ip`.
+ *
+ * An IPv6 address keys its `/64`: the low 64 bits masked off, rendered in
+ * RFC 5952 canonical form with a `/64` suffix (`2001:db8:1:2::/64`; the
+ * all-zero prefix is `::/64`). A zone suffix (`%eth0`) is dropped first. An
+ * IPv4 address — an IPv4-mapped IPv6 one included — keys its canonical form,
+ * with no suffix. Anything that doesn't parse (`'unknown'` among them) is
+ * returned unchanged. Twin of the Rust spine's `fuz_http::rate_limit_ip_key`.
+ *
+ * For limiter keys only: audit rows and every other record of the client
+ * keep the full address.
+ *
+ * @example
+ * rate_limit_ip_key('2001:db8:1:2::1')        // → '2001:db8:1:2::/64'
+ * rate_limit_ip_key('2001:db8:1:2:8000::')    // → '2001:db8:1:2::/64'
+ * rate_limit_ip_key('fe80::1%eth0')           // → 'fe80::/64'
+ * rate_limit_ip_key('203.0.113.7')            // → '203.0.113.7'
+ * rate_limit_ip_key('unknown')                // → 'unknown'
+ */
+export declare const rate_limit_ip_key: (ip: string) => string;
 //# sourceMappingURL=ip_canonical.d.ts.map

package/dist/http/ip_canonical.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ip_canonical.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/ip_canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,QAAqB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAmC5C,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,MAAM,KAAG,MAgEvD,CAAC"}
+{"version":3,"file":"ip_canonical.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/ip_canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAIH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,QAAqB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAmC5C,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,MAAM,KAAG,MAgEvD,CAAC;AAKF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,GAAI,IAAI,MAAM,KAAG,MAc9C,CAAC"}

package/dist/http/ip_canonical.js

@@ -27,9 +27,15 @@
  *    canonicalization because the dotted form is the only form the
  *    strip can recognize symmetrically.
  *
- * Mirrors `zzz_server::proxy::normalize_ip` (landed 2026-05-16) which
- * uses the same parse-then-canonicalize-then-strip ordering for the
- * same rate-limit-key-poisoning surface.
+ * Mirrors the Rust spine's `fuz_http::normalize_ip`, which uses the same
+ * parse-then-canonicalize-then-strip ordering for the same
+ * rate-limit-key-poisoning surface.
+ *
+ * `rate_limit_ip_key` is the bucket key an IP-keyed rate limiter uses: an
+ * IPv6 address collapses to its `/64`, the smallest block a host is commonly
+ * assigned, so rotating through one's own subnet buys no fresh budget. Only
+ * the limiter call sites apply it — the client IP stays the full address
+ * everywhere else (audit rows, token `last_used_ip`, `REMOTE_ADDR`).
  *
  * @module
  */
@@ -193,3 +199,44 @@ export const ipv6_bigint_to_canonical = (bits) => {
         .join(':');
     return before + '::' + after;
 };
+/** The high 64 bits of an IPv6 address — its `/64` network prefix. */
+const IPV6_PREFIX_64_MASK = ((1n << 64n) - 1n) << 64n;
+/**
+ * The bucket key an IP-keyed rate limiter uses for client IP `ip`.
+ *
+ * An IPv6 address keys its `/64`: the low 64 bits masked off, rendered in
+ * RFC 5952 canonical form with a `/64` suffix (`2001:db8:1:2::/64`; the
+ * all-zero prefix is `::/64`). A zone suffix (`%eth0`) is dropped first. An
+ * IPv4 address — an IPv4-mapped IPv6 one included — keys its canonical form,
+ * with no suffix. Anything that doesn't parse (`'unknown'` among them) is
+ * returned unchanged. Twin of the Rust spine's `fuz_http::rate_limit_ip_key`.
+ *
+ * For limiter keys only: audit rows and every other record of the client
+ * keep the full address.
+ *
+ * @example
+ * rate_limit_ip_key('2001:db8:1:2::1')        // → '2001:db8:1:2::/64'
+ * rate_limit_ip_key('2001:db8:1:2:8000::')    // → '2001:db8:1:2::/64'
+ * rate_limit_ip_key('fe80::1%eth0')           // → 'fe80::/64'
+ * rate_limit_ip_key('203.0.113.7')            // → '203.0.113.7'
+ * rate_limit_ip_key('unknown')                // → 'unknown'
+ */
+export const rate_limit_ip_key = (ip) => {
+    const zone_at = ip.indexOf('%');
+    const canonical = canonicalize_ip(zone_at === -1 ? ip : ip.slice(0, zone_at));
+    if (!IP_LITERAL_CHARS.test(canonical))
+        return ip;
+    const family = distinctRemoteAddr(canonical);
+    if (family === 'IPv4')
+        return canonical;
+    if (family !== 'IPv6')
+        return ip;
+    let bits;
+    try {
+        bits = convertIPv6ToBinary(canonical);
+    }
+    catch {
+        return ip;
+    }
+    return `${ipv6_bigint_to_canonical(bits & IPV6_PREFIX_64_MASK)}/64`;
+};

package/dist/http/middleware_spec.d.ts

@@ -8,6 +8,16 @@
  */
 import type { MiddlewareHandler } from 'hono';
 import type { RouteErrorSchemas } from './error_schemas.js';
+/**
+ * Paths a middleware layer explicitly does not run on, and why — the named
+ * exception to a layer that covers every path by default (the origin check).
+ */
+export interface MiddlewareCarveOut {
+    /** Hono-style pattern (`/hooks/*`, `/health`), matched like `MiddlewareSpec.path`. */
+    readonly path: string;
+    /** Why these paths are safe without the layer — required, so a carve-out is an argument, not an omission. */
+    readonly reason: string;
+}
 /** A named middleware layer. */
 export interface MiddlewareSpec {
     name: string;
@@ -15,5 +25,11 @@ export interface MiddlewareSpec {
     handler: MiddlewareHandler;
     /** Error response schemas this middleware can produce, keyed by HTTP status code. */
     errors?: RouteErrorSchemas;
+    /**
+     * Paths under `path` the layer does not run on. The handler enforces them
+     * itself (Hono mounts by `path` alone); the field is what keeps the
+     * generated surface from claiming the layer's errors on those routes.
+     */
+    carve_outs?: ReadonlyArray<MiddlewareCarveOut>;
 }
 //# sourceMappingURL=middleware_spec.d.ts.map

package/dist/http/middleware_spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware_spec.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/middleware_spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,qFAAqF;IACrF,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC3B"}
+{"version":3,"file":"middleware_spec.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/middleware_spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6GAA6G;IAC7G,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,qFAAqF;IACrF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC/C"}

package/dist/http/origin.d.ts

@@ -1,7 +1,7 @@
 /**
  * Request source verification middleware for API protection.
  *
- * Verifies requests are coming from expected origins/referers.
+ * Verifies requests carry an `Origin` the server allows, or none.
  * CSRF protection is `SameSite: strict` on session cookies
  * (see `auth/session_middleware.ts`) plus the CORS simple-request refusal
  * (`http/simple_request.ts`) — `SameSite` alone admits same-site pages, which
@@ -10,9 +10,18 @@
  * from making requests as the user browses the web — and is the only gate on
  * the WebSocket upgrade, which is never preflighted.
  *
+ * The allowlist grammar is shared with the Rust spine entry for entry:
+ * `parse_allowed_origins` accepts and refuses the same entries, naming each
+ * refusal with the same `AllowedOriginsErrorKind` string, and an accepted list
+ * matches the same origins. The shared conformance table
+ * (`testing/cross_backend/origin_conformance.json`) pins both.
+ *
  * @module
  */
+import type { Result } from '@fuzdev/fuz_util/result.ts';
 import type { Context, Handler } from 'hono';
+import { z } from 'zod';
+import type { MiddlewareCarveOut } from './middleware_spec.js';
 /**
  * True when the request looks like it originated from a browser context — it
  * carries an `Origin` or `Referer` header. Browsers attach these
@@ -31,29 +40,106 @@ import type { Context, Handler } from 'hono';
  */
 export declare const is_browser_context: (c: Context) => boolean;
 /**
- * Parses FUZ_ALLOWED_ORIGINS env var into regex matchers for request source verification.
+ * Why one allowlist entry was refused. The wire names both spines emit — the
+ * Rust spine's `OriginPatternError::kind` returns the same strings.
+ */
+export declare const OriginPatternErrorKind: z.ZodEnum<{
+    empty_entry: "empty_entry";
+    not_printable_ascii: "not_printable_ascii";
+    missing_scheme: "missing_scheme";
+    unsupported_scheme: "unsupported_scheme";
+    has_path: "has_path";
+    has_userinfo: "has_userinfo";
+    missing_host: "missing_host";
+    invalid_host_char: "invalid_host_char";
+    unbracketed_ipv6: "unbracketed_ipv6";
+    partial_wildcard: "partial_wildcard";
+    non_canonical_ipv4: "non_canonical_ipv4";
+    unclosed_ipv6: "unclosed_ipv6";
+    invalid_ipv6: "invalid_ipv6";
+    invalid_after_ipv6: "invalid_after_ipv6";
+    invalid_port: "invalid_port";
+    default_port: "default_port";
+}>;
+export type OriginPatternErrorKind = z.infer<typeof OriginPatternErrorKind>;
+/** Why an allowlist value was refused: `no_origins` (a blank value) or an entry's kind. */
+export declare const AllowedOriginsErrorKind: z.ZodEnum<{
+    empty_entry: "empty_entry";
+    not_printable_ascii: "not_printable_ascii";
+    missing_scheme: "missing_scheme";
+    unsupported_scheme: "unsupported_scheme";
+    has_path: "has_path";
+    has_userinfo: "has_userinfo";
+    missing_host: "missing_host";
+    invalid_host_char: "invalid_host_char";
+    unbracketed_ipv6: "unbracketed_ipv6";
+    partial_wildcard: "partial_wildcard";
+    non_canonical_ipv4: "non_canonical_ipv4";
+    unclosed_ipv6: "unclosed_ipv6";
+    invalid_ipv6: "invalid_ipv6";
+    invalid_after_ipv6: "invalid_after_ipv6";
+    invalid_port: "invalid_port";
+    default_port: "default_port";
+    no_origins: "no_origins";
+}>;
+export type AllowedOriginsErrorKind = z.infer<typeof AllowedOriginsErrorKind>;
+/** The operator-facing reason for each refusal kind. */
+export declare const ALLOWED_ORIGINS_ERROR_MESSAGES: Readonly<Record<AllowedOriginsErrorKind, string>>;
+/** One reason `parse_allowed_origins` refused a value. */
+export interface AllowedOriginsError {
+    readonly kind: AllowedOriginsErrorKind;
+    /** The refused entry's 1-based position; absent for `no_origins`. */
+    readonly index?: number;
+    /** The refused entry as given, trimmed; absent for `no_origins`. */
+    readonly entry?: string;
+}
+/**
+ * Render one refusal for a boot error — the entry in double quotes with every
+ * character but visible ASCII and the space escaped as `\uXXXX` (and `"` and
+ * `\` backslash-escaped), so an env value can't put a control, bidi, or other
+ * non-printing character in a log, nor close the quotes it is shown in.
+ *
+ * @param error - one of `parse_allowed_origins`'s errors
+ * @returns the reason as one line
+ */
+export declare const format_allowed_origins_error: (error: AllowedOriginsError) => string;
+/**
+ * Parses an allowlist value (conventionally the `FUZ_ALLOWED_ORIGINS` env var)
+ * into regex matchers for request source verification.
  * Origin allowlisting for locally-running services — not the CSRF layer
  * (that's `SameSite: strict` on session cookies plus `http/simple_request.ts`).
  *
- * Accepts comma-separated patterns with limited wildcards:
- * - Exact origins: `https://api.fuz.dev`
- * - Wildcard subdomains: `https://*.fuz.dev` (matches exactly one subdomain level)
- * - Multiple wildcards: `https://*.staging.*.fuz.dev` (for deep subdomains)
- * - Wildcard ports: `http://localhost:*` (matches any port or no port)
- * - IPv6 addresses: `http://[::1]:3000`, `https://[2001:db8::1]`
+ * Entries are comma-separated and trimmed of ASCII whitespace. Each is written
+ * the way a browser writes an `Origin` — `scheme://host[:port]` — where a whole
+ * host label or the port may be `*`:
+ * - Exact origins: `https://api.fuz.dev`, `http://localhost:3000`
+ * - Wildcard labels: `https://*.fuz.dev` (each `*` is exactly one label, in any
+ *   position — `api.fuz.dev` matches, `fuz.dev` and `a.b.fuz.dev` don't)
+ * - Wildcard ports: `http://localhost:*` (any port or none)
+ * - IPv6 addresses: `http://[::1]:3000`, `https://[2001:db8::1]` (exact)
  * - Combined: `https://*.fuz.dev:*`
  *
- * Examples:
- * - `http://localhost:3000,https://prod.fuz.dev`
- * - `https://*.api.fuz.dev,http://127.0.0.1:*`
- * - `http://[::1]:*,https://*.*.corp.fuz.dev:*`
+ * Refused, nothing normalized: anything but printable ASCII (punycode an
+ * international hostname), a scheme other than http or https (`null`,
+ * `file://`, `chrome-extension://`), a path, query, fragment or trailing
+ * slash, userinfo, a character no hostname holds, a partial wildcard, an IPv4
+ * address not written as four canonical decimal numbers (`127.1`), an IPv6
+ * address not in the form a browser sends, a port outside `1..=65535` or with
+ * leading zeros, the scheme's default port, and an empty entry. Every refused
+ * entry is reported, not just the first.
  *
- * @throws Error if any individual pattern is invalid (missing protocol, partial wildcards, etc.)
+ * @param raw - the comma-separated allowlist value
+ * @returns the matchers, or every refusal — `no_origins` when the value is blank
  */
-export declare const parse_allowed_origins: (env_value: string | undefined) => Array<RegExp>;
+export declare const parse_allowed_origins: (raw: string) => Result<{
+    origins: Array<RegExp>;
+}, {
+    errors: Array<AllowedOriginsError>;
+}>;
 /**
- * Tests if a request source (origin or referer) matches any of the allowed patterns.
- * Pattern matching is case-insensitive for domains (as per web standards).
+ * Tests if an `Origin` value matches any of the allowed patterns.
+ * Pattern matching is case-insensitive (web hosts and schemes are). A value
+ * that isn't visible ASCII matches nothing — a browser never sends one.
  */
 export declare const should_allow_origin: (origin: string, allowed_patterns: ReadonlyArray<RegExp>) => boolean;
 /**
@@ -63,6 +149,9 @@ export declare const should_allow_origin: (origin: string, allowed_patterns: Rea
  * plus `http/simple_request.ts`):
  * - Checks the `Origin` header (if present) against the allowlist
  * - Allows requests without an `Origin` header (direct access, curl, etc.)
+ * - Refuses an `Origin` that isn't visible ASCII, and a duplicated one — the
+ *   runtimes join a repeated header into one value (`a, b`), which carries a
+ *   space and so matches nothing
  *
  * Origin-only by design — Fetch spec mandates `Origin` on every unsafe
  * method (POST / PUT / DELETE / PATCH) regardless of `Referrer-Policy`,
@@ -71,9 +160,15 @@ export declare const should_allow_origin: (origin: string, allowed_patterns: Rea
  * attached session cookies, so CSRF isn't the relevant threat there —
  * auth (bearer / daemon token) is the actual control. A Referer fallback
  * would only widen the accepted-shape envelope without closing a real
- * CSRF hole; mirrors `zzz_server::auth::is_request_origin_allowed`.
+ * CSRF hole. The Rust spine's `origin_layer` is the twin.
+ *
+ * `create_app_server` mounts it on every path (`ORIGIN_MIDDLEWARE_PATH`); a
+ * request whose path a `carve_outs` entry matches passes unchecked — the named,
+ * explicit exception, each with its reason, as the Rust stack's
+ * `origin_carve_out` is.
  *
  * @param allowed_patterns - compiled regex patterns from `parse_allowed_origins`
+ * @param carve_outs - paths the check skips, matched like a middleware path (`middleware_applies`)
  */
-export declare const verify_request_source: (allowed_patterns: ReadonlyArray<RegExp>) => Handler;
+export declare const verify_request_source: (allowed_patterns: ReadonlyArray<RegExp>, carve_outs?: ReadonlyArray<MiddlewareCarveOut>) => Handler;
 //# sourceMappingURL=origin.d.ts.map

package/dist/http/origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"origin.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAI7C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAAI,GAAG,OAAO,KAAG,OAC8B,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,GAAG,SAAS,KAAG,KAAK,CAAC,MAAM,CAO5E,CAAC;AAEP;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,QAAQ,MAAM,EACd,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,OAAuD,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GAChC,kBAAkB,aAAa,CAAC,MAAM,CAAC,KAAG,OAgB1C,CAAC"}
+{"version":3,"file":"origin.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG/D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAAI,GAAG,OAAO,KAAG,OAC8B,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;EAiBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;EAA4D,CAAC;AACjG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,wDAAwD;AACxD,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAwB5F,CAAC;AAEF,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAKD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,OAAO,mBAAmB,KAAG,MAOzE,CAAC;AAwBF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,qBAAqB,GACjC,KAAK,MAAM,KACT,MAAM,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAE,EAAE;IAAE,MAAM,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAA;CAAE,CAgB3E,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,QAAQ,MAAM,EACd,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,OAAqF,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,qBAAqB,GAEhC,kBAAkB,aAAa,CAAC,MAAM,CAAC,EACvC,aAAY,aAAa,CAAC,kBAAkB,CAAM,KAChD,OAaF,CAAC"}