@greensecurity/javascript-sdk 0.46.0-beta.1 → 0.46.0-beta.11

package/dist/esm/apps/manifest.js

@@ -0,0 +1,346 @@
+/*
+ * Hand-written (not generated by Speakeasy). Part of the third-party app platform contract;
+ * see docs/third-party-apps/plan.md.
+ *
+ * The manifest a marketplace app publishes through `POST /api/marketplace/catalog`. Field names
+ * are snake_case because that is what the server stores. Constraints are written as `pattern`s
+ * and `enum`s wherever possible so `manifestJsonSchema` carries them to the server and the CLI
+ * too; the few that JSON Schema cannot express live in `superRefine` and are repeated by the
+ * server's own validation.
+ */
+import * as z from "zod/v4";
+import { APP_ROUTES_MAX, CONCRETE_ROUTE_PATH_PATTERN, isConcreteRoutePath, matchAppRoute, ROUTE_PATH_MAX_CHARS, ROUTE_PATH_PATTERN, routeSetIssues, } from "./routes.js";
+import { SURFACES } from "./surfaces.js";
+import { CSP_SOURCE_MAX_CHARS, CSP_SOURCE_PATTERN, CSP_SOURCES_MAX_PER_DIRECTIVE, CSP_SOURCES_MAX_TOTAL_CHARS, cspSourcesTotalChars, HTTPS_URL_PATTERN, isParsableHttpsUrl, } from "./url.js";
+// The URL and CSP-source rules live in the zod-free `url.ts` so the host renderer can use them
+// without bundling zod; re-exported here because they are part of the manifest contract.
+export { IPV4_OCTET_PATTERN, PORT_PATTERN, CSP_PATH_CHAR, CSP_SOURCE_MAX_CHARS, CSP_SOURCE_PATTERN, CSP_SOURCES_MAX_PER_DIRECTIVE, CSP_SOURCES_MAX_TOTAL_CHARS, cspSourcesTotalChars, HTTPS_URL_PATTERN, isHttpsUrl, isParsableHttpsUrl, } from "./url.js";
+// The route grammar and matcher live in the zod-free `routes.ts` for the same reason.
+export { APP_ROUTES_MAX, CONCRETE_ROUTE_PATH_PATTERN, isConcreteRoutePath, isRoutePath, matchAppRoute, normalizeRoutePath, ROUTE_PATH_MAX_CHARS, ROUTE_PATH_MAX_SEGMENTS, ROUTE_PATH_PATTERN, routeSetIssues, } from "./routes.js";
+/** A single SRI hash with the digest length its algorithm produces (32, 48 or 64 bytes, base64). */
+export const SRI_PATTERN = "^(sha256-[A-Za-z0-9+/]{43}=|sha384-[A-Za-z0-9+/]{64}|sha512-[A-Za-z0-9+/]{86}==)$";
+/** SemVer 2.0.0 (semver.org's reference pattern): no empty or leading-zero numeric identifiers. */
+export const SEMVER_PATTERN = "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)" +
+    "(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?" +
+    "(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$";
+export const COMPONENT_NAME_PATTERN = "^[A-Za-z_$][A-Za-z0-9_$]*$";
+/**
+ * A positive decimal integer no larger than `Number.MAX_SAFE_INTEGER` (9007199254740991), written
+ * as a string with no leading zeros: up to 15 digits freely, then 16-digit values digit by digit
+ * against the maximum. The server applies the same bound to a string `id`.
+ */
+export const SAFE_INTEGER_STRING_PATTERN = "^(?:[1-9][0-9]{0,14}|[1-8][0-9]{15}|900[0-6][0-9]{12}|90070[0-9]{11}|90071[0-8][0-9]{10}" +
+    "|900719[0-8][0-9]{9}|9007199[0-1][0-9]{8}|90071992[0-4][0-9]{7}|900719925[0-3][0-9]{6}" +
+    "|9007199254[0-6][0-9]{5}|90071992547[0-3][0-9]{4}|9007199254740[0-8][0-9]{2}" +
+    "|90071992547409[0-8][0-9]|9007199254740990|9007199254740991)$";
+export const PERMISSION_PATTERN = "^[a-z0-9_-]+\\.[a-z0-9_-]+$";
+/**
+ * Permissions for platform features rather than Green Security data. An app lists them in
+ * `permissions` like any other, and they are granted with the app's role when it is installed.
+ * The server checks them against the app's role only, never against the viewer's role, so they
+ * never appear in a user token's data scope.
+ */
+export const PLATFORM_PERMISSIONS = Object.freeze([
+    {
+        permission: "app_secrets.write",
+        description: "Use the Secret Store: set, find, list and delete this app's secrets, with any token.",
+    },
+]);
+const PLATFORM_PERMISSION_NAMES = new Set(PLATFORM_PERMISSIONS.map((p) => p.permission));
+export function isPlatformPermission(value) {
+    return typeof value === "string" && PLATFORM_PERMISSION_NAMES.has(value);
+}
+// A view's viewport. `page` is not one: an app declares its pages in `routes`, not in `views`.
+const SURFACE_IDS = SURFACES.filter((s) => s.kind !== "page").map((s) => s.id);
+/** Portals an app page may be offered in (`routes[].portals`). */
+const ROUTE_PORTALS = ["company", "vendor", "facility", "system"];
+/** Lifecycle events an app's own webhook endpoint can receive (see C19). */
+export const APP_WEBHOOK_EVENTS = [
+    "MarketplaceAppActivation.created",
+    "MarketplaceAppActivation.updated",
+    "MarketplaceAppActivation.destroyed",
+];
+/** Whether an https URL names a DNS host: its last label starts with a letter, so it is no IP literal. */
+function hasNamedHost(value) {
+    try {
+        const labels = new URL(value).hostname.split(".");
+        return /^[a-z]/i.test(labels[labels.length - 1] ?? "");
+    }
+    catch {
+        return false;
+    }
+}
+/** The JSON Schema keeps the `pattern`; the parse check is TypeScript-side only. */
+export const httpsUrlSchema = z
+    .string()
+    .max(2048)
+    .regex(new RegExp(HTTPS_URL_PATTERN))
+    .refine(isParsableHttpsUrl, { message: "must be a valid https URL" });
+/** Rejects a CSP whose sources together would exceed {@link CSP_SOURCES_MAX_TOTAL_CHARS}. */
+export function addCspBudgetIssue(csp, ctx, path) {
+    const total = cspSourcesTotalChars(csp);
+    if (total > CSP_SOURCES_MAX_TOTAL_CHARS) {
+        ctx.addIssue({
+            code: "custom",
+            path: [...path],
+            message: `connect_src and image_src together use ${total} characters; the limit is ${CSP_SOURCES_MAX_TOTAL_CHARS}`,
+        });
+    }
+}
+/** Components may appear on many surfaces, but each surface takes exactly one view. */
+export function addDuplicateViewportIssues(views, ctx, path) {
+    const seen = new Set();
+    views?.forEach((view, i) => {
+        if (seen.has(view.viewport)) {
+            ctx.addIssue({
+                code: "custom",
+                path: [...path, i, "viewport"],
+                message: `duplicate viewport ${view.viewport}; each surface takes one view`,
+            });
+        }
+        seen.add(view.viewport);
+    });
+}
+export const cspSourceSchema = z.string().max(CSP_SOURCE_MAX_CHARS).regex(new RegExp(CSP_SOURCE_PATTERN));
+export const appViewSchema = z.strictObject({
+    viewport: z.enum(SURFACE_IDS),
+    component: z.string().max(100).regex(new RegExp(COMPONENT_NAME_PATTERN)),
+});
+/** Reports {@link routeSetIssues} (segment cap, repeated params, duplicate paths, repeated portals). */
+export function addRouteIssues(routes, ctx, path) {
+    for (const issue of routeSetIssues(routes ?? [])) {
+        ctx.addIssue({ code: "custom", path: [...path, issue.index, issue.field], message: issue.message });
+    }
+}
+/**
+ * One app page. The host renders `component` at `/{portal}/apps/{appId}/pages{path}`.
+ *
+ * `title` is required here, for new manifests. The server keeps accepting title-less entries in a
+ * bundle-less v1 manifest, which stored `routes[{ path, component }]` before pages were rendered;
+ * such a manifest has nothing to render them with, and the host never shows them.
+ */
+/**
+ * Text a person reads (a page title, a sidebar label): at least one character that isn't
+ * whitespace. The host never shows a blank one, so the manifest can't publish one.
+ *
+ * This is JavaScript's `\S` spelled out (ASCII whitespace, the Unicode space separators,
+ * U+2028/U+2029 and U+FEFF), because the generated schema's patterns also run as Ruby regexps, and
+ * Ruby's `\S` is ASCII-only: there, a title of no-break spaces would pass.
+ */
+export const NON_BLANK_PATTERN = "[^\\t\\n\\v\\f\\r \\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000\\ufeff]";
+export const appRouteSchema = z.strictObject({
+    path: z.string().max(ROUTE_PATH_MAX_CHARS).regex(new RegExp(ROUTE_PATH_PATTERN)),
+    component: z.string().max(100).regex(new RegExp(COMPONENT_NAME_PATTERN)),
+    /** Page header title. */
+    title: z.string().min(1).max(100).regex(new RegExp(NON_BLANK_PATTERN), { message: "must not be blank" }),
+    /** Portals the page is offered in. Absent = every portal the host renders. */
+    portals: z.array(z.enum(ROUTE_PORTALS)).min(1).max(ROUTE_PORTALS.length).optional(),
+    /** Offer the page in the sidebar / mobile drawer menu under this label (default: `title`). */
+    navigation: z
+        .strictObject({
+        label: z.string().min(1).max(40).regex(new RegExp(NON_BLANK_PATTERN), { message: "must not be blank" }).optional(),
+    })
+        .optional(),
+});
+/** Constants are delivered to every view as `environment.constants`. */
+export const appConstantsSchema = z.record(z.string().max(100).regex(/^[A-Za-z_][A-Za-z0-9_]*$/), z.union([z.string().max(2048), z.number(), z.boolean()]));
+export const appCspSchema = z.strictObject({
+    connect_src: z.array(cspSourceSchema).max(CSP_SOURCES_MAX_PER_DIRECTIVE).optional(),
+    image_src: z.array(cspSourceSchema).max(CSP_SOURCES_MAX_PER_DIRECTIVE).optional(),
+    /** Accepted for manifests published before v2. Ignored: bundles run from a blob worker. */
+    script_src: z.array(z.string().max(2048)).max(50).optional(),
+    purpose: z.string().min(1).max(1000),
+});
+export const appManifestSchema = z
+    .strictObject({
+    id: z.union([z.number().int().positive(), z.string().regex(new RegExp(SAFE_INTEGER_STRING_PATTERN))]),
+    name: z.string().min(1).max(100),
+    icon: httpsUrlSchema,
+    short_description: z.string().min(1).max(500),
+    version: z.string().max(64).regex(new RegExp(SEMVER_PATTERN)).optional(),
+    permissions: z
+        .array(z.strictObject({
+        permission: z.string().max(100).regex(new RegExp(PERMISSION_PATTERN)),
+        purpose: z.string().min(1).max(1000),
+        /**
+         * Why the app cannot work without a sensitive permission (see `isSensitivePermission` in
+         * `review.ts`). Required by the catalog review for a sensitive permission a submission
+         * adds; optional otherwise. Shown to Green Security reviewers and to installers.
+         */
+        justification: z.string().min(1).max(1000).optional(),
+    }))
+        .max(100)
+        .optional(),
+    configuration_instructions: z.string().min(1).max(20000),
+    support_instructions: z.string().min(1).max(20000),
+    constants: appConstantsSchema.optional(),
+    ui_extensions: z
+        .strictObject({
+        bundle: z.strictObject({
+            url: httpsUrlSchema,
+            integrity: z.string().max(200).regex(new RegExp(SRI_PATTERN)),
+        }).optional(),
+        views: z.array(appViewSchema).max(200).optional(),
+        /** App pages, each a full screen under `/{portal}/apps/{appId}/pages`. */
+        routes: z.array(appRouteSchema).max(APP_ROUTES_MAX).optional(),
+        csp: appCspSchema.optional(),
+    })
+        .optional(),
+    post_install_action: z
+        .strictObject({
+        type: z.enum(["url", "app_settings_view", "app_main_view", "app_page"]),
+        url: httpsUrlSchema.optional(),
+        /**
+         * For `app_page` only: the page to open, a concrete path (no `:params`) that one of
+         * `ui_extensions.routes` matches, such as `/welcome` or `/reports/7`.
+         */
+        path: z.string().max(ROUTE_PATH_MAX_CHARS).regex(new RegExp(CONCRETE_ROUTE_PATH_PATTERN)).optional(),
+    })
+        .optional(),
+    // The app's own webhook endpoint: registered by the catalog when the manifest is published, not
+    // tied to any tenant, and sent only this app's lifecycle events. It is how a back-end-only app
+    // hears about its first install. `events` defaults to all of them.
+    webhooks: z
+        .strictObject({
+        url: httpsUrlSchema.refine(hasNamedHost, { message: "must use a DNS host name, not an IP address" }),
+        events: z.array(z.enum(APP_WEBHOOK_EVENTS)).min(1).max(APP_WEBHOOK_EVENTS.length).optional(),
+    })
+        .optional(),
+})
+    .superRefine((manifest, ctx) => {
+    const events = manifest.webhooks?.events ?? [];
+    if (new Set(events).size !== events.length) {
+        ctx.addIssue({ code: "custom", path: ["webhooks", "events"], message: "events must not repeat" });
+    }
+    if (manifest.post_install_action?.type === "url" && !manifest.post_install_action.url) {
+        ctx.addIssue({ code: "custom", path: ["post_install_action", "url"], message: "url is required for type=url" });
+    }
+    if (manifest.post_install_action?.type !== "app_page" && manifest.post_install_action?.path !== undefined) {
+        ctx.addIssue({ code: "custom", path: ["post_install_action", "path"], message: "path is only allowed for type=app_page" });
+    }
+    // When a field under `ui_extensions` fails its own schema, zod hands this refinement the
+    // manifest without `ui_extensions`, so every rule below would report a problem that isn't
+    // there (a missing settings view, an unmatched post-install page). Report the real one only.
+    if (ctx.issues.some((issue) => issue.path?.[0] === "ui_extensions"))
+        return;
+    addDuplicateViewportIssues(manifest.ui_extensions?.views, ctx, ["ui_extensions", "views"]);
+    addRouteIssues(manifest.ui_extensions?.routes, ctx, ["ui_extensions", "routes"]);
+    addCspBudgetIssue(manifest.ui_extensions?.csp, ctx, ["ui_extensions", "csp"]);
+    const hasViews = Boolean(manifest.ui_extensions?.views?.length);
+    const hasRoutes = Boolean(manifest.ui_extensions?.routes?.length);
+    if (hasViews && !manifest.ui_extensions?.bundle) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["ui_extensions", "bundle"],
+            message: "bundle is required when views are declared",
+        });
+    }
+    if (hasRoutes && !manifest.ui_extensions?.bundle) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["ui_extensions", "bundle"],
+            message: "bundle is required when routes are declared",
+        });
+    }
+    // `version` stays optional only for legacy (v1) manifests. Anything the host renders needs one:
+    // it names the runtime URL and reaches views as `ExtensionContext.app.version`.
+    if ((manifest.ui_extensions?.bundle || hasViews || hasRoutes) && !manifest.version) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["version"],
+            message: "version is required when ui_extensions declares a bundle, views or routes",
+        });
+    }
+    addAppPageActionIssues(manifest, ctx);
+    // A back-end-only app has no views, so it cannot land installers on one. Checked only for
+    // versioned (v2) manifests: v1 apps may carry a post-install view type from before views existed.
+    const viewports = new Set((manifest.ui_extensions?.views ?? []).map((v) => v.viewport));
+    const versioned = manifest.version !== undefined;
+    if (versioned && manifest.post_install_action?.type === "app_settings_view" && !viewports.has("settings")) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["post_install_action", "type"],
+            message: "app_settings_view requires a view for the settings viewport",
+        });
+    }
+    // The settings page is not a main view: a settings-only app should land on app_settings_view.
+    // A root page (route `/`) is one: installing opens `/{portal}/apps/{id}/pages`.
+    if (versioned && manifest.post_install_action?.type === "app_main_view" && !hasMainView(manifest)) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["post_install_action", "type"],
+            message: "app_main_view requires a view other than settings, or a root route",
+        });
+    }
+});
+/**
+ * The rules for `post_install_action.path`: required for `app_page` and allowed nowhere else, a
+ * concrete path within the route limits, and one that a declared route matches (`/reports/7` for a
+ * `/reports/:id` route), so installing never opens a page the app does not have.
+ */
+function addAppPageActionIssues(manifest, ctx) {
+    const action = manifest.post_install_action;
+    if (action === undefined)
+        return;
+    const path = ["post_install_action", "path"];
+    // `path` on another type is reported by the manifest refinement, before the rules that need
+    // `ui_extensions`.
+    if (action.type !== "app_page")
+        return;
+    if (action.path === undefined) {
+        ctx.addIssue({ code: "custom", path, message: "path is required for type=app_page" });
+    }
+    else if (!isConcreteRoutePath(action.path)) {
+        ctx.addIssue({ code: "custom", path, message: "path must be a page path without :params, such as /reports/7" });
+    }
+    else if (matchAppRoute(manifest.ui_extensions?.routes ?? [], action.path) === null) {
+        ctx.addIssue({ code: "custom", path, message: "path must match one of ui_extensions.routes" });
+    }
+}
+/** Whether a manifest has a main view to land on: a view other than settings, or a root page `/`. */
+function hasMainView(manifest) {
+    const views = manifest.ui_extensions?.views ?? [];
+    const routes = manifest.ui_extensions?.routes ?? [];
+    return views.some((v) => v.viewport !== "settings") || routes.some((r) => r.path === "/");
+}
+/**
+ * What installing the app does when `post_install_action` is left out, so the server and the host
+ * never land an installer on a view the app does not have: nothing for a back-end-only app, the
+ * settings page for a settings-only app, and the app's main view otherwise. A root page (route
+ * `/`) counts as a main view. `null` means "no post-install step". An explicit action, including
+ * `app_page`, is returned unchanged.
+ */
+export function effectivePostInstallAction(manifest) {
+    if (manifest.post_install_action)
+        return manifest.post_install_action;
+    if (hasMainView(manifest))
+        return { type: "app_main_view" };
+    if ((manifest.ui_extensions?.views ?? []).some((v) => v.viewport === "settings"))
+        return { type: "app_settings_view" };
+    return null;
+}
+/**
+ * JSON Schema for the manifest, written to `shared/app-platform/manifest.schema.json` so the
+ * server can validate without TypeScript. The cross-field rules in `superRefine` are not in it.
+ */
+export function manifestJsonSchema() {
+    return z.toJSONSchema(appManifestSchema, {
+        target: "draft-2020-12",
+        // zod labels every `.regex()` string `format: "regex"`, which in JSON Schema means "this value
+        // is itself a regular expression". The `pattern` it emits alongside is the real constraint.
+        override: (ctx) => {
+            if (ctx.jsonSchema["format"] === "regex")
+                delete ctx.jsonSchema["format"];
+        },
+    });
+}
+export function validateManifest(input) {
+    const result = appManifestSchema.safeParse(input);
+    if (result.success)
+        return { ok: true, manifest: result.data };
+    return {
+        ok: false,
+        issues: result.error.issues.map((issue) => ({ path: issue.path.join("."), message: issue.message })),
+    };
+}
+//# sourceMappingURL=manifest.js.map

package/dist/esm/apps/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../src/apps/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAe,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,2BAA2B,EAC3B,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAElB,+FAA+F;AAC/F,yFAAyF;AACzF,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,2BAA2B,EAC3B,oBAAoB,EACpB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAElB,sFAAsF;AACtF,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,GAGf,MAAM,aAAa,CAAC;AAErB,oGAAoG;AACpG,MAAM,CAAC,MAAM,WAAW,GAAG,mFAAmF,CAAC;AAC/G,mGAAmG;AACnG,MAAM,CAAC,MAAM,cAAc,GACzB,gDAAgD;IAChD,sGAAsG;IACtG,+CAA+C,CAAC;AAClD,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AACnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GACtC,0FAA0F;IAC1F,wFAAwF;IACxF,8EAA8E;IAC9E,+DAA+D,CAAC;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD;QACE,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,sFAAsF;KACpG;CACO,CAAC,CAAC;AAIZ,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AAE9G,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AACD,+FAA+F;AAC/F,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAA0B,CAAC;AAExG,kEAAkE;AAClE,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAsC,CAAC;AAEvG,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,kCAAkC;IAClC,kCAAkC;IAClC,oCAAoC;CAC5B,CAAC;AAIX,0GAA0G;AAC1G,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,IAAI,CAAC;KACT,KAAK,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;KACpC,MAAM,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;AAExE,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAC/B,GAA2G,EAC3G,GAAoB,EACpB,IAAoC;IAEpC,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,GAAG,2BAA2B,EAAE,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,0CAA0C,KAAK,6BAA6B,2BAA2B,EAAE;SACnH,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,0BAA0B,CACxC,KAAsD,EACtD,GAAoB,EACpB,IAAoC;IAEpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC;gBAC9B,OAAO,EAAE,sBAAsB,IAAI,CAAC,QAAQ,+BAA+B;aAC5E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAE1G,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,sBAAsB,CAAC,CAAC;CACzE,CAAC,CAAC;AAEH,wGAAwG;AACxG,MAAM,UAAU,cAAc,CAC5B,MAAkH,EAClH,GAAoB,EACpB,IAAoC;IAEpC,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,4FAA4F,CAAC;AAE/F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACxE,yBAAyB;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACxG,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACnF,8FAA8F;IAC9F,UAAU,EAAE,CAAC;SACV,YAAY,CAAC;QACZ,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC,QAAQ,EAAE;KACnH,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CACxC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,EACrD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CACzD,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE;IACnF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE;IACjF,2FAA2F;IAC3F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,YAAY,CAAC;IACZ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC;IACrG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,cAAc;IACpB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACrE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACpC;;;;WAIG;QACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KACtD,CAAC,CAAC;SACF,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;IACb,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IACxD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAClD,SAAS,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACxC,aAAa,EAAE,CAAC;SACb,YAAY,CAAC;QACZ,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC;YACrB,GAAG,EAAE,cAAc;YACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;SAC9D,CAAC,CAAC,QAAQ,EAAE;QACb,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QACjD,0EAA0E;QAC1E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;QAC9D,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE;KAC7B,CAAC;SACD,QAAQ,EAAE;IACb,mBAAmB,EAAE,CAAC;SACnB,YAAY,CAAC;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QACvE,GAAG,EAAE,cAAc,CAAC,QAAQ,EAAE;QAC9B;;;WAGG;QACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,QAAQ,EAAE;KACrG,CAAC;SACD,QAAQ,EAAE;IACb,gGAAgG;IAChG,+FAA+F;IAC/F,mEAAmE;IACnE,QAAQ,EAAE,CAAC;SACR,YAAY,CAAC;QACZ,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;QACpG,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KAC7F,CAAC;SACD,QAAQ,EAAE;CACd,CAAC;KACD,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;IAC/C,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,QAAQ,CAAC,mBAAmB,EAAE,IAAI,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;QACtF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,qBAAqB,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,QAAQ,CAAC,mBAAmB,EAAE,IAAI,KAAK,UAAU,IAAI,QAAQ,CAAC,mBAAmB,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1G,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAC;IAC7H,CAAC;IAED,yFAAyF;IACzF,0FAA0F;IAC1F,6FAA6F;IAC7F,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC;QAAE,OAAO;IAE5E,0BAA0B,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3F,cAAc,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjF,iBAAiB,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;YACjC,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;QACjD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;YACjC,OAAO,EAAE,6CAA6C;SACvD,CAAC,CAAC;IACL,CAAC;IAED,gGAAgG;IAChG,gFAAgF;IAChF,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,IAAI,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,2EAA2E;SACrF,CAAC,CAAC;IACL,CAAC;IAED,sBAAsB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAEtC,0FAA0F;IAC1F,kGAAkG;IAClG,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC;IACjD,IAAI,SAAS,IAAI,QAAQ,CAAC,mBAAmB,EAAE,IAAI,KAAK,mBAAmB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,qBAAqB,EAAE,MAAM,CAAC;YACrC,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IACD,8FAA8F;IAC9F,gFAAgF;IAChF,IAAI,SAAS,IAAI,QAAQ,CAAC,mBAAmB,EAAE,IAAI,KAAK,eAAe,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClG,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,qBAAqB,EAAE,MAAM,CAAC;YACrC,OAAO,EAAE,oEAAoE;SAC9E,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,QAAsE,EACtE,GAAoB;IAEpB,MAAM,MAAM,GAAG,QAAQ,CAAC,mBAAmB,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAE7C,4FAA4F;IAC5F,mBAAmB;IACnB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;IACxF,CAAC;SAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC,CAAC;IAClH,CAAC;SAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACrF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,SAAS,WAAW,CAAC,QAA4D;IAC/E,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,EAAE,MAAM,IAAI,EAAE,CAAC;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC5F,CAAC;AAID;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAsE;IAEtE,IAAI,QAAQ,CAAC,mBAAmB;QAAE,OAAO,QAAQ,CAAC,mBAAmB,CAAC;IAEtE,IAAI,WAAW,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACvH,OAAO,IAAI,CAAC;AACd,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,CAAC,YAAY,CAAC,iBAAiB,EAAE;QACvC,MAAM,EAAE,eAAe;QACvB,+FAA+F;QAC/F,4FAA4F;QAC5F,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,OAAO;gBAAE,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5E,CAAC;KACF,CAA4B,CAAC;AAChC,CAAC;AAMD,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAE/D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;KACrG,CAAC;AACJ,CAAC"}

package/dist/esm/apps/protocol.d.ts

@@ -0,0 +1,116 @@
+import type { AppTokens, ExtensionContext } from "./context.js";
+import type { DevSessionDescriptor } from "./devsession.js";
+import type { RouteDescriptor } from "./route.js";
+import type { SurfaceId } from "./surfaces.js";
+/**
+ * Structural copy of `@remote-dom/core`'s `RemoteConnection`, so this contract does not pull the
+ * rendering libraries into every SDK consumer. Kept assignable both ways with the real type.
+ */
+export interface RemoteConnection {
+    mutate(records: readonly RemoteMutationRecord[]): void;
+    call(id: string, method: string, ...args: readonly unknown[]): unknown;
+}
+/** `@remote-dom/core` mutation records: insert child, remove child, update text, update property. */
+export type RemoteMutationRecord = readonly [type: 0, parentId: string, child: unknown, index: number] | readonly [type: 1, parentId: string, index: number] | readonly [type: 2, textId: string, text: string] | readonly [type: 3, id: string, name: string, value: unknown, updateType?: 1 | 2 | 3];
+export type ViewType = "context" | "focus" | "settings" | "page";
+/** Implemented inside the worker by the SDK runtime (`defineApp`). */
+export interface SandboxExports {
+    mount(args: {
+        mountId: string;
+        /** Exported component name from the manifest's `views[].component`. */
+        viewComponent: string;
+        surfaceId: SurfaceId;
+        connection: RemoteConnection;
+        context: ExtensionContext;
+        host: HostApi;
+    }): Promise<void>;
+    unmount(mountId: string): Promise<void>;
+    updateContext(mountId: string, patch: Partial<ExtensionContext>): Promise<void>;
+    ping(): Promise<"pong">;
+}
+export type ToastType = "success" | "caution" | "pending";
+/** Implemented by the host (web-mobile-client). Every method is async across the thread. */
+export interface HostApi {
+    refreshTokens(): Promise<AppTokens>;
+    navigate(to: RouteDescriptor): Promise<void>;
+    /** https only; the host asks the user to confirm. Resolves false when declined or rejected. */
+    openExternalUrl(url: string): Promise<boolean>;
+    /** `message` must be 1–30 characters. */
+    showToast(message: string, opts?: {
+        type?: ToastType;
+    }): Promise<void>;
+    /** Invalidates the host's cached data so its screens re-fetch after the app writes. */
+    refreshHostData(): Promise<void>;
+    clipboardWriteText(text: string): Promise<void>;
+    closeView(): Promise<void>;
+}
+export declare const TOAST_MAX_LENGTH = 30;
+/** Largest single envelope either side accepts, in UTF-16 code units of its JSON form. */
+export declare const MAX_ENVELOPE_CHARS = 1000000;
+export declare const HEARTBEAT_INTERVAL_MS = 2000;
+export declare const HEARTBEAT_MAX_MISSES = 3;
+interface InitBase {
+    kind: "init";
+    protocolVersion: ExtensionContext["protocolVersion"];
+    appId: number;
+}
+/**
+ * Exactly one code source: the published bundle (checked against its SRI hash), or a dev session
+ * (checked against signed build events) for the developer who owns an active `apps-cli dev`.
+ */
+export type BootstrapInit = (InitBase & {
+    bundle: {
+        url: string;
+        integrity: string;
+    };
+    devSession?: never;
+}) | (InitBase & {
+    devSession: DevSessionDescriptor;
+    bundle?: never;
+});
+export type HostToBootstrap = BootstrapInit | {
+    kind: "thread";
+    data: unknown;
+} | {
+    kind: "terminate";
+};
+export type BootstrapToHost = {
+    kind: "ready";
+} | {
+    kind: "thread";
+    data: unknown;
+}
+/** The bundle failed its integrity or signature check and was not executed. */
+ | {
+    kind: "integrity_failed";
+    reason: string;
+} | {
+    kind: "crashed";
+    reason: string;
+}
+/** Dev sessions only: a verified rebuild replaced the worker; the host remounts every view. */
+ | {
+    kind: "reloaded";
+    seq: number;
+} | {
+    kind: "log";
+    level: "debug" | "info" | "warn" | "error";
+    message: string;
+}
+/** Dev sessions only: build diagnostics from the CLI. */
+ | {
+    kind: "build_error";
+    diagnostics: Array<{
+        file?: string;
+        line?: number;
+        message: string;
+    }>;
+};
+/**
+ * Shape check for envelopes the host receives from the sandbox, which is untrusted: every
+ * variant's payload is checked, not just its `kind`. The payload of `thread` is checked by the
+ * thread layer.
+ */
+export declare function isBootstrapToHost(value: unknown): value is BootstrapToHost;
+export {};
+//# sourceMappingURL=protocol.d.ts.map

package/dist/esm/apps/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../../src/apps/protocol.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,GAAG,IAAI,CAAC;IACvD,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC;CACxE;AAED,qGAAqG;AACrG,MAAM,MAAM,oBAAoB,GAC5B,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GACnE,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,GACnD,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAChD,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAEzF,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEjE,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,IAAI,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,uEAAuE;QACvE,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,EAAE,gBAAgB,CAAC;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,IAAI,EAAE,OAAO,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1D,4FAA4F;AAC5F,MAAM,WAAW,OAAO;IACtB,aAAa,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,QAAQ,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,+FAA+F;IAC/F,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,yCAAyC;IACzC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,uFAAuF;IACvF,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,0FAA0F;AAC1F,eAAO,MAAM,kBAAkB,UAAY,CAAC;AAE5C,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAC3C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,UAAU,QAAQ;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACrD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,CAAC,QAAQ,GAAG;IAAE,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,UAAU,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,GAC/E,CAAC,QAAQ,GAAG;IAAE,UAAU,EAAE,oBAAoB,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAEtE,MAAM,MAAM,eAAe,GACvB,aAAa,GACb;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAE1B,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AACnC,+EAA+E;GAC7E;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACrC,+FAA+F;GAC7F;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC9E,yDAAyD;GACvD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAcnG;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAoB1E"}

package/dist/esm/apps/protocol.js

@@ -0,0 +1,51 @@
+/*
+ * Hand-written (not generated by Speakeasy). Part of the third-party app platform contract;
+ * see docs/third-party-apps/plan.md.
+ *
+ * Two layers travel between the host and a sandbox:
+ *  1. Bootstrap envelopes (`HostToBootstrap` / `BootstrapToHost`): plain JSON between the host
+ *     and the trusted `runtime.html` page, which owns the worker's lifecycle.
+ *  2. Thread messages: `@quilted/threads` traffic between the host and the app's worker, carried
+ *     inside `{ kind: "thread" }` envelopes. `SandboxExports` and `HostApi` are the two sides.
+ */
+export const TOAST_MAX_LENGTH = 30;
+/** Largest single envelope either side accepts, in UTF-16 code units of its JSON form. */
+export const MAX_ENVELOPE_CHARS = 1000000;
+export const HEARTBEAT_INTERVAL_MS = 2000;
+export const HEARTBEAT_MAX_MISSES = 3;
+const LOG_LEVELS = new Set(["debug", "info", "warn", "error"]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isDiagnostic(value) {
+    return isRecord(value) && typeof value["message"] === "string" &&
+        (value["file"] === undefined || typeof value["file"] === "string") &&
+        (value["line"] === undefined || Number.isSafeInteger(value["line"]));
+}
+/**
+ * Shape check for envelopes the host receives from the sandbox, which is untrusted: every
+ * variant's payload is checked, not just its `kind`. The payload of `thread` is checked by the
+ * thread layer.
+ */
+export function isBootstrapToHost(value) {
+    if (!isRecord(value))
+        return false;
+    switch (value["kind"]) {
+        case "ready":
+            return true;
+        case "thread":
+            return "data" in value;
+        case "integrity_failed":
+        case "crashed":
+            return typeof value["reason"] === "string";
+        case "reloaded":
+            return Number.isSafeInteger(value["seq"]);
+        case "log":
+            return typeof value["level"] === "string" && LOG_LEVELS.has(value["level"]) && typeof value["message"] === "string";
+        case "build_error":
+            return Array.isArray(value["diagnostics"]) && value["diagnostics"].every(isDiagnostic);
+        default:
+            return false;
+    }
+}
+//# sourceMappingURL=protocol.js.map

package/dist/esm/apps/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../../src/apps/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAyDH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAS,CAAC;AAE5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAiCtC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE/D,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ;QAC5D,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;QAClE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnC,QAAQ,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,MAAM,IAAI,KAAK,CAAC;QACzB,KAAK,kBAAkB,CAAC;QACxB,KAAK,SAAS;YACZ,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;QAC7C,KAAK,UAAU;YACb,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,KAAK,KAAK;YACR,OAAO,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC;QACtH,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACzF;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/esm/apps/review.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The thresholds and lists the review applies to a submission's added permissions.
+ *
+ * - `purpose_min_chars`: the shortest `purpose` accepted for an added permission, after trimming.
+ * - `justification_min_chars`: the shortest `justification` accepted for an added sensitive
+ *   permission, after trimming.
+ * - `read_only_actions`: the permission actions that only read. Every other action (`add`, `edit`,
+ *   `delete`, `write`, and any added later) writes, and a permission that writes is sensitive.
+ * - `pii_resources`: the resources whose records identify people or describe them (names, contact
+ *   details, credentials, background checks, visits, payment details). Reading one is sensitive.
+ */
+export declare const REVIEW_RULES: Readonly<{
+    readonly purpose_min_chars: 30;
+    readonly justification_min_chars: 40;
+    readonly read_only_actions: readonly ["view", "search"];
+    readonly pii_resources: readonly ["background_checks", "communications", "company_managers", "contacts", "credentials", "criminal_history", "events", "invoices", "mobile_devices", "payment_profiles", "users", "vendor_credentials", "vendor_scans", "vendor_transactions", "vendors", "visitor_checkins", "visitors", "watchlist_entries"];
+}>;
+/**
+ * Whether a `resource.action` permission is sensitive: it writes (any action that is not read-only)
+ * or it reads a resource about people. A sensitive permission added by a submission needs a
+ * `justification` as well as a `purpose`, and holds the submission for a Green Security admin.
+ */
+export declare function isSensitivePermission(permission: string): boolean;
+/** Why a host is on the denylist. */
+export type CspDenylistCategory = "tunnel" | "pastebin" | "url_shortener" | "raw_code_host" | "dynamic_dns";
+export interface CspDenylistEntry {
+    /** A registrable domain or host. It matches itself and every name under it. */
+    domain: string;
+    category: CspDenylistCategory;
+}
+/**
+ * Hosts a submission may never add to `connect_src` or `image_src`, nor serve its bundle from. Each
+ * lets anybody publish content, or point a name at any address, without owning a domain, so an app
+ * that could reach one could reach anything:
+ *
+ * - `tunnel`: expose a local server under a shared domain;
+ * - `pastebin`: host arbitrary text, including code and exfiltrated data;
+ * - `url_shortener`: redirect to a destination the review never saw;
+ * - `raw_code_host`: serve files straight out of anybody's repository or gist;
+ * - `dynamic_dns`: hand out names under a shared domain, including the wildcard DNS services that
+ *   resolve a name such as `10.0.0.1.nip.io` to the IP address inside it.
+ */
+export declare const CSP_DENYLIST: readonly CspDenylistEntry[];
+/**
+ * The denylist entry a host falls under, or `undefined` when it is on none: the host is the entry's
+ * domain or a name under it (`abc.trycloudflare.com`). Case and a trailing dot are ignored.
+ */
+export declare function cspDenylistEntry(host: string): CspDenylistEntry | undefined;
+/** One problem the review would find with an added permission, as the catalog reports it. */
+export interface PermissionReviewIssue {
+    code: "purpose_too_short" | "purpose_is_permission_name" | "purpose_repeated" | "justification_required" | "justification_too_short" | "justification_repeats_purpose";
+    path: string;
+    message: string;
+}
+/**
+ * The justification rules the review applies to the permissions a submission adds, so the CLI can
+ * report them before upload. `added` names the permissions that are new since the last accepted
+ * version; the rest are not checked. Every entry's `purpose` counts when looking for repeats.
+ */
+export declare function permissionReviewIssues(permissions: ReadonlyArray<{
+    permission: string;
+    purpose: string;
+    justification?: string | undefined;
+}>, added: ReadonlySet<string>): PermissionReviewIssue[];
+//# sourceMappingURL=review.d.ts.map

package/dist/esm/apps/review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../../src/apps/review.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY;;;;;EAwBd,CAAC;AAKZ;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAOjE;AAED,qCAAqC;AACrC,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,UAAU,GAAG,eAAe,GAAG,eAAe,GAAG,aAAa,CAAC;AAE5G,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAMD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,gBAAgB,EA6FlD,CAAC;AAEH;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAG3E;AAED,6FAA6F;AAC7F,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,GAAG,4BAA4B,GAAG,kBAAkB,GAAG,wBAAwB,GACpG,yBAAyB,GAAG,+BAA+B,CAAC;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,aAAa,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC,EACvG,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB,qBAAqB,EAAE,CAqCzB"}