@gate-forge/pack-playwright 0.1.0

package/dist/discovery/trusted-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-config.d.ts","sourceRoot":"","sources":["../../src/discovery/trusted-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAMH,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,kCAAkC,CAAC;AAEnE,4EAA4E;AAC5E,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,4CAA4C;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,GAAE,MAAwB,GAAG,MAAM,CAKjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,kBAAkB,GAAG;IAClE,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,sBAAsB,CAAC;CACzC,CAyCA"}

package/dist/discovery/trusted-config.js

@@ -0,0 +1,117 @@
+/**
+ * Trusted Playwright config synthesis (execution-authority fix): the
+ * supervised runner NEVER loads the consumer's `playwright.config.*`.
+ * That file is arbitrary code running in the runner MAIN process — the
+ * same process as the gateforge reporter — so a hostile config can
+ * write fabricated lifecycle spool events and a fabricated outcomes
+ * document, then exit 0 before any spec executes (the confirmed
+ * execution bypass). Instead the supervisor synthesizes a minimal
+ * trusted config into the excluded run-state dir and runs the runner
+ * with `--config <trusted>`:
+ *
+ * - test files: the exact repo-relative files the supervisor selected
+ *   (from the planned expected set), or the runner default when the
+ *   caller selected nothing;
+ * - projects: bare names carried as data (identity only — per-project
+ *   code options are NOT honored);
+ * - reporter: the engine's own reporter entry forced by absolute path
+ *   with run-state paths as CONSTRUCTOR OPTIONS (never env — worker
+ *   processes must not learn the spool/outcomes locations);
+ * - workers: 1, fullyParallel: false (serial — one open session at a
+ *   time, so a worker can never reach another test's open session);
+ * - retries: 0, forbidOnly: true (required retries are zero; `.only`
+ *   in a required run is a runner-level error);
+ * - no globalSetup/globalTeardown, no webServer, no consumer reporters.
+ *
+ * Authority boundary after this fix:
+ * - TRUSTED: the CLI process, the witness process, and the runner MAIN
+ *   process (Playwright native + synthesized config + engine reporter).
+ * - UNTRUSTED: worker processes (test files, helpers, page objects,
+ *   and any code they import). Workers keep ONLY the witness URL + run
+ *   token + app base in env — enough for the fixture, never enough to
+ *   locate the spool or outcomes files.
+ * - Worker forgery of another test's lifecycle always collides with the
+ *   genuine reporter events for that test; the drain records the
+ *   collision and supervision fails the run closed.
+ *
+ * Compatibility limits (honest, not transparent):
+ * - consumer `globalSetup`/`globalTeardown` are NOT executed;
+ * - consumer reporters, `webServer`, per-project `use` options,
+ *   `testDir`/`testIgnore` scoping, and sharding are NOT honored;
+ * - tests must be self-contained (app provided externally via the
+ *   app-base env, as the fixture already requires).
+ */
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/** File name of the synthesized trusted config inside the run-state dir. */
+export const TRUSTED_CONFIG_FILE = 'trusted.playwright.config.mjs';
+/** File name of the forced reporter options (diagnostic mirror of argv). */
+export const TRUSTED_REPORTER_OPTIONS_FILE = 'trusted-reporter-options.json';
+/**
+ * Resolves the engine reporter entry the trusted config forces: the
+ * pack's own BUILT reporter (the same class the consumer config would
+ * reference by package name). Never a repo-relative path — the entry
+ * must be engine-owned, never candidate-controlled.
+ *
+ * Args:
+ *   fromModule: module URL to resolve the pack from (default: this file).
+ *
+ * Returns:
+ *   string: absolute `<pack>/dist/reporter/reporter.js` path.
+ */
+export function trustedReporterEntry(fromModule = import.meta.url) {
+    // Package-root relative (works for both src/ and dist/ layouts — the
+    // package.json subpath is not in `exports`, so no self-name resolve).
+    const pkgPath = fileURLToPath(new URL('../../package.json', fromModule));
+    return join(pkgPath.slice(0, -'package.json'.length), 'dist', 'reporter', 'reporter.js');
+}
+/**
+ * Synthesizes the trusted Playwright config into the run-state dir.
+ *
+ * Args:
+ *   input: repo root, run state, reporter entry, file/project selection.
+ *
+ * Returns:
+ *   { configPath, reporterOptions }: absolute config path for
+ *   `--config`, plus the reporter options embedded in it.
+ */
+export function synthesizeTrustedConfig(input) {
+    const reporterOptions = {
+        stateDir: input.stateDir,
+        runId: input.runId,
+        outcomesPath: join(input.stateDir, 'runner-outcomes.json'),
+        obligationsPath: join(input.stateDir, 'obligations.json'),
+    };
+    const testFiles = [...new Set(input.testFiles ?? [])].sort();
+    const projects = [...new Set(input.projects ?? [])].sort();
+    const lines = [
+        '// GENERATED by gateforge trusted supervision — do not edit. The',
+        '// consumer config file is NEVER loaded for supervised runs: it is',
+        '// arbitrary main-process code that could fabricate the lifecycle',
+        '// spool and outcomes document this reporter writes.',
+        'export default {',
+        `  testDir: ${JSON.stringify(input.cwd)},`,
+        ...(testFiles.length > 0 ? [`  testMatch: ${JSON.stringify(testFiles)},`] : []),
+        ...(projects.length > 0 ? [`  projects: ${JSON.stringify(projects.map((name) => ({ name })))},`] : []),
+        '  workers: 1,',
+        '  fullyParallel: false,',
+        '  retries: 0,',
+        '  forbidOnly: true,',
+        `  timeout: ${String(input.testTimeoutMs ?? 60_000)},`,
+        '  reporter: [',
+        "    ['list'],",
+        `    [${JSON.stringify(input.reporterEntry)}, ${JSON.stringify(reporterOptions)}],`,
+        '  ],',
+        '  use: { headless: true, trace: "off" },',
+        `  outputDir: ${JSON.stringify(join(input.stateDir, 'playwright-artifacts'))},`,
+        '};',
+        '',
+    ];
+    mkdirSync(input.stateDir, { recursive: true });
+    const configPath = join(input.stateDir, TRUSTED_CONFIG_FILE);
+    writeFileSync(configPath, `${lines.join('\n')}`, 'utf8');
+    writeFileSync(join(input.stateDir, TRUSTED_REPORTER_OPTIONS_FILE), `${JSON.stringify({ configPath, reporterEntry: input.reporterEntry, reporterOptions, testFiles, projects }, null, 2)}\n`, 'utf8');
+    return { configPath, reporterOptions };
+}
+//# sourceMappingURL=trusted-config.js.map

package/dist/discovery/trusted-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-config.js","sourceRoot":"","sources":["../../src/discovery/trusted-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAEnE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAgC7E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,aAAqB,MAAM,CAAC,IAAI,CAAC,GAAG;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAI/D,MAAM,eAAe,GAA2B;QAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,sBAAsB,CAAC;QAC1D,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,kBAAkB,CAAC;KAC1D,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG;QACZ,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE;QACnE,sDAAsD;QACtD,kBAAkB;QAClB,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG;QAC1C,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,eAAe;QACf,yBAAyB;QACzB,eAAe;QACf,qBAAqB;QACrB,cAAc,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,GAAG;QACtD,eAAe;QACf,eAAe;QACf,QAAQ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI;QACnF,MAAM;QACN,0CAA0C;QAC1C,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,GAAG;QAC/E,IAAI;QACJ,EAAE;KACH,CAAC;IACF,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC7D,aAAa,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,aAAa,CACX,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,6BAA6B,CAAC,EACnD,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACxH,MAAM,CACP,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AACzC,CAAC"}

package/dist/fixture/evidence.d.ts

@@ -0,0 +1,191 @@
+/**
+ * Trusted evidence primitives (plan §5.3, invariant 6, GF-22; engine-
+ * browser rewrite per plan Phase 1 item 4).
+ *
+ * The fixture exposes EXACTLY five surfaces — `ui`, `visible`,
+ * `persistence`, `http`, `finalize` — on a frozen object with a
+ * closure-private record list. It is APPLICATION-INDEPENDENT: the pack
+ * carries no Accounts strings, no product selectors, and no route
+ * knowledge. The CONSUMER supplies a declarative {@link SurfaceDescriptor}
+ * (list page, row/field selectors, form templates, archive control,
+ * status values) — the Accounts description lives in the example tree
+ * (`example/e2e/accounts-surface.js`), not here.
+ *
+ * ENGINE-OWNED BROWSER (plan Phase 1 item 4): the `ui.*` primitives no
+ * longer drive a worker-side page. They register the consumer surface
+ * with the witness and ask the ENGINE to perform each constrained
+ * operation on its own page (`POST /browser/action`), then to re-read
+ * the rendered result (`POST /browser/visible`). Test code supplies
+ * INTENT (fields, entity id, claims) only — it never touches the engine
+ * page, so it cannot manufacture DOM state, intercept the application
+ * response, or substitute script/API effects and receive browser
+ * credit. Every `ui.action` / `ui.visible-result` record the gate
+ * grades is issued engine-side with origin `engine-observed`;
+ * suite-submitted UI records never satisfy browser contracts.
+ *
+ * For create/update the action record's `fields` are the ENTERED input
+ * the engine typed (plan §3.6 exact-value echo): the engine
+ * echo-checks them against the independently fetched persisted fields,
+ * and a mismatch fails the obligation with `EVIDENCE_VALUE_MISMATCH`
+ * even when the status was 2xx.
+ *
+ * Receipts returned by UI primitives are frozen and branded with a
+ * per-instance symbol — `visible.confirm`/`persistence.verify` reject
+ * anything without the own-property brand (GF-22: hand-rolled or
+ * `Object.create`-branded forgeries fail closed).
+ *
+ * Every engine call runs under the SUPERVISOR-ISSUED test session. The
+ * trusted reporter opens one session per started test (`runId,
+ * sessionId, testId, worker`) and the fixture resolves it by the exact
+ * (workerIndex, testId) pair; a suite-supplied testId or annotation
+ * alone cannot mint records for an arbitrary session, because the
+ * witness rejects submissions without a valid OPEN session and forces
+ * the record's testId onto the session's supervisor-registered value.
+ * Sealing (test end) rejects all late submissions and closes the
+ * session's engine browser context.
+ */
+import type { Page, TestInfo } from 'playwright/test';
+import { SURFACE_DESCRIPTOR_VERSION, type SurfaceDescriptor } from '../surface.js';
+import type { SessionCredential } from '../witness/types.js';
+import { WitnessClient } from './witness-client.js';
+export { SURFACE_DESCRIPTOR_VERSION, type SurfaceDescriptor };
+/** A UI-action receipt: the ONLY token `visible`/`persistence` accept. */
+export interface Receipt {
+    readonly kind: 'ui';
+    readonly operation: 'create' | 'read' | 'update' | 'delete';
+    readonly resourceId: string;
+    readonly entityId: string;
+    readonly fields: Record<string, string>;
+    readonly mode: 'row' | 'form';
+    /**
+     * Create/update only: the engine-side pre-observation taken BEFORE the
+     * UI action, bound into the persistence record so the engine can
+     * verify the before/after delta (create postcondition, audit round 4).
+     */
+    readonly preObservationId?: string;
+}
+/** Outcome of `persistence.verify` (verdict-relevant, witness-issued). */
+export interface PersistenceOutcome {
+    recordId: string;
+    runId: string;
+    verdictRelevant: {
+        found: boolean;
+        fieldsMatch: boolean;
+        mismatches?: string[];
+    };
+}
+/** The frozen, no-escape-hatch evidence surface. */
+export interface EvidenceApi {
+    readonly ui: Readonly<{
+        /**
+         * The ENGINE drives the rendered create form with the DECLARED input
+         * fields (plan §3.6: the journey's entered values are what the
+         * engine echo-checks against the persisted state).
+         */
+        create(input: {
+            fields: Record<string, string>;
+        }): Promise<Receipt>;
+        read(input: {
+            entityId: string;
+        }): Promise<Receipt>;
+        update(input: {
+            entityId: string;
+            fields: Record<string, string>;
+        }): Promise<Receipt>;
+        archive(input: {
+            entityId: string;
+        }): Promise<Receipt>;
+    }>;
+    readonly visible: Readonly<{
+        confirm(receipt: Receipt): Promise<{
+            entityId: string;
+            fields: Record<string, string>;
+        }>;
+    }>;
+    readonly persistence: Readonly<{
+        verify(receipt: Receipt): Promise<PersistenceOutcome>;
+    }>;
+    /**
+     * ADR 0004 D7 (plan §8 / D1): consumes one witness-observed HTTP
+     * exchange for an http:* claim. Only an exchange the ENGINE captured
+     * during its own action interval can be consumed — a request supplied
+     * by another test/worker (or by setup traffic outside every interval)
+     * is never credited. Pass an explicit `obligationId` when the test
+     * declares more than one claim — omitted selection with several
+     * candidates throws instead of silently binding the first claim.
+     */
+    http: Readonly<{
+        observe(request: {
+            method: string;
+            path: string;
+            expectedStatus?: number;
+            obligationId?: string;
+        }): Promise<{
+            status: number;
+            recordId: string;
+            recordIds: string[];
+        }>;
+    }>;
+    finalize(): Promise<{
+        claims: string[];
+        records: WitnessRecord[];
+    }>;
+}
+/** One witness-issued record as the finalize ledger reports it. */
+export interface WitnessRecord {
+    recordId: string;
+    runId: string;
+    obligationId: string;
+    kind: string;
+    payload: unknown;
+}
+/** Claims from the test annotations (`{type: 'gateforge', description}`). */
+export declare function claimsFromAnnotations(annotations: readonly {
+    type: string;
+    description?: string;
+}[]): string[];
+/** Splits `<resourceId>:<contract>` at the first colon. */
+export declare function resourceIdOfClaim(claim: string): string;
+/**
+ * Creates the evidence API for one test.
+ *
+ * Args:
+ *   page: IGNORED for evidence (kept for call-shape compatibility) —
+ *     the engine drives its own page; the worker page is never an
+ *     evidence channel.
+ *   testInfo: the running test's info (annotations, testId, workerIndex).
+ *   surface: REQUIRED consumer-declared {@link SurfaceDescriptor} — the
+ *     pack carries no application-specific selectors (plan Phase 1
+ *     item 7). Registered with the witness; the ENGINE drives it
+ *     against the provisioned attested subject (fake-frontend fix:
+ *     the driven origin comes from trusted witness configuration,
+ *     never from suite input — there is no app-base parameter here
+ *     by design).
+ *   client: witness transport override (tests inject their own).
+ *   session: pre-resolved session credential (harnesses that opened the
+ *     session themselves); default resolves it from the supervisor
+ *     channel. A credential whose testId differs from this test's is
+ *     refused.
+ *   sessionResolveTimeoutMs: bounded wait for the supervisor's session
+ *     open (harness tuning; default 5s).
+ *
+ * Returns:
+ *   Promise<EvidenceApi>: the frozen primitive surface.
+ *
+ * Throws:
+ *   Error: on a missing/outdated surface descriptor (migration error
+ *     naming the new required `surface` parameter), when the test
+ *     declares no gateforge claim and its session carries no
+ *     supervisor-registered (mapped) claims, when no app base or witness
+ *     or OPEN session is wired, or when an action/verification fails
+ *     fail-closed.
+ */
+export declare function createEvidence({ page, testInfo, surface, client, session, sessionResolveTimeoutMs, }: {
+    page?: Page;
+    testInfo: TestInfo;
+    surface?: SurfaceDescriptor;
+    client?: WitnessClient;
+    session?: SessionCredential;
+    sessionResolveTimeoutMs?: number;
+}): Promise<EvidenceApi>;
+//# sourceMappingURL=evidence.d.ts.map

package/dist/fixture/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/fixture/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EACL,0BAA0B,EAG1B,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,0BAA0B,EAAE,KAAK,iBAAiB,EAAE,CAAC;AAE9D,0EAA0E;AAC1E,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC5D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE;QACf,KAAK,EAAE,OAAO,CAAC;QACf,WAAW,EAAE,OAAO,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;CACH;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;QACpB;;;;WAIG;QACH,MAAM,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACtF,OAAO,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACxD,CAAC,CAAC;IACH,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;QACzB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAAC,CAAC;KAC1F,CAAC,CAAC;IACH,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;QAC7B,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;KACvD,CAAC,CAAC;IACH;;;;;;;;OAQG;IACH,IAAI,EAAE,QAAQ,CAAC;QACb,OAAO,CAAC,OAAO,EAAE;YACf,MAAM,EAAE,MAAM,CAAC;YACf,IAAI,EAAE,MAAM,CAAC;YACb,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB,YAAY,CAAC,EAAE,MAAM,CAAC;SACvB,GAAG,OAAO,CAAC;YACV,MAAM,EAAE,MAAM,CAAC;YACf,QAAQ,EAAE,MAAM,CAAC;YACjB,SAAS,EAAE,MAAM,EAAE,CAAC;SACrB,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,QAAQ,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC,CAAC;CACrE;AAED,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAoBD,6EAA6E;AAC7E,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,GAC7D,MAAM,EAAE,CAKV;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGvD;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,MAAM,EACN,OAAO,EACP,uBAA4D,GAC7D,EAAE;IACD,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,WAAW,CAAC,CAuTvB"}