@heroku/js-blanket 0.0.0 → 1.0.0

package/dist/cjs/core/patterns.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PII_PATTERNS = void 0;
+/**
+ * Regex patterns for detecting PII in string content
+ */
+exports.PII_PATTERNS = [
+    // Social Security Numbers (US)
+    /\b\d{3}-\d{2}-\d{4}\b/g,
+    // Email addresses
+    /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g,
+    // Phone numbers (US format)
+    /\b\d{3}[-.]?\d{3}[-.]?\d{4}\b/g,
+    // JWT tokens
+    /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
+];
+//# sourceMappingURL=patterns.js.map

package/dist/cjs/core/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/core/patterns.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACU,QAAA,YAAY,GAAG;IAC1B,+BAA+B;IAC/B,wBAAwB;IAExB,kBAAkB;IAClB,sDAAsD;IAEtD,4BAA4B;IAC5B,gCAAgC;IAEhC,aAAa;IACb,2DAA2D;CAC5D,CAAC"}

package/dist/cjs/core/presets.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PCI_FIELDS = exports.GDPR_FIELDS = exports.HEROKU_FIELDS = void 0;
+/**
+ * Heroku-specific sensitive field patterns
+ *
+ * Consolidated list of field names and patterns that contain sensitive data in Heroku applications.
+ *
+ * Use this preset to ensure consistent PII handling across Heroku services.
+ *
+ * @example
+ * ```typescript
+ * import { HEROKU_FIELDS } from '@heroku/js-blanket/core/presets';
+ * import { Scrubber } from '@heroku/js-blanket';
+ *
+ * const scrubber = new Scrubber({ fields: HEROKU_FIELDS });
+ * const result = scrubber.scrub(data);
+ * ```
+ */
+exports.HEROKU_FIELDS = [
+    // Authentication & Sessions
+    'access_token',
+    /api[-_]?key/i, // Matches api_key, api-key, apikey (case insensitive)
+    'authenticity_token',
+    'heroku_oauth_token',
+    'heroku_session_nonce',
+    'heroku_user_session',
+    'oauth_token',
+    'sudo_oauth_token',
+    'super_user_session_secret',
+    'user_session_secret',
+    'postgres_session_nonce',
+    // Passwords & Secrets
+    'password',
+    'passwd',
+    'old_secret',
+    'secret',
+    'secret_token',
+    'confirm_password',
+    'password_confirmation',
+    /client[-_]?secret/i, // Matches client_secret, client-secret, clientsecret
+    // Tokens
+    'token',
+    'bouncer.token',
+    'bouncer.refresh_token',
+    // Headers (case-insensitive)
+    /authorization/i,
+    /cookie/i,
+    /x-refresh-token/i,
+    // SSO & Sessions
+    'www-sso-session',
+    // Payment
+    'payment_method',
+    // Infrastructure
+    'logplexUrl',
+];
+/**
+ * GDPR-relevant PII field patterns
+ *
+ * Field names that typically contain personally identifiable information (PII)
+ * regulated by GDPR (General Data Protection Regulation).
+ *
+ * Use this preset when handling EU user data to ensure compliance with GDPR requirements.
+ *
+ * @see {@link https://gdpr.eu/what-is-gdpr/|GDPR Official Documentation}
+ *
+ * @example
+ * ```typescript
+ * import { GDPR_FIELDS, HEROKU_FIELDS } from '@heroku/js-blanket/core/presets';
+ * import { Scrubber } from '@heroku/js-blanket';
+ *
+ * // Combine multiple presets
+ * const scrubber = new Scrubber({
+ *   fields: [...HEROKU_FIELDS, ...GDPR_FIELDS]
+ * });
+ * ```
+ */
+exports.GDPR_FIELDS = [
+    'email',
+    'phone',
+    'address',
+    'postal_code',
+    'ssn',
+    'tax_id',
+];
+/**
+ * PCI-DSS relevant field patterns
+ *
+ * Field names that typically contain payment card information regulated by
+ * PCI-DSS (Payment Card Industry Data Security Standard).
+ *
+ * Use this preset when handling payment card data to help maintain PCI-DSS compliance.
+ *
+ * **Important**: This preset helps reduce exposure of sensitive payment data in logs and
+ * error reports, but is not a substitute for full PCI-DSS compliance measures.
+ *
+ * @see {@link https://www.pcisecuritystandards.org/|PCI Security Standards Council}
+ *
+ * @example
+ * ```typescript
+ * import { PCI_FIELDS } from '@heroku/js-blanket/core/presets';
+ * import { Scrubber } from '@heroku/js-blanket';
+ *
+ * const scrubber = new Scrubber({
+ *   fields: PCI_FIELDS,
+ *   patterns: [/\d{4}-\d{4}-\d{4}-\d{4}/g]  // Also scrub card numbers in text
+ * });
+ * ```
+ */
+exports.PCI_FIELDS = [
+    'card_number',
+    'cvv',
+    'credit_card',
+    'payment_method',
+];
+//# sourceMappingURL=presets.js.map

package/dist/cjs/core/presets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.js","sourceRoot":"","sources":["../../../src/core/presets.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;GAeG;AACU,QAAA,aAAa,GAAG;IAC3B,4BAA4B;IAC5B,cAAc;IACd,cAAc,EAAE,sDAAsD;IACtE,oBAAoB;IACpB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,aAAa;IACb,kBAAkB;IAClB,2BAA2B;IAC3B,qBAAqB;IACrB,wBAAwB;IAExB,sBAAsB;IACtB,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,cAAc;IACd,kBAAkB;IAClB,uBAAuB;IACvB,oBAAoB,EAAE,qDAAqD;IAE3E,SAAS;IACT,OAAO;IACP,eAAe;IACf,uBAAuB;IAEvB,6BAA6B;IAC7B,gBAAgB;IAChB,SAAS;IACT,kBAAkB;IAElB,iBAAiB;IACjB,iBAAiB;IAEjB,UAAU;IACV,gBAAgB;IAEhB,iBAAiB;IACjB,YAAY;CACb,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACU,QAAA,WAAW,GAAG;IACzB,OAAO;IACP,OAAO;IACP,SAAS;IACT,aAAa;IACb,KAAK;IACL,QAAQ;CACT,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACU,QAAA,UAAU,GAAG;IACxB,aAAa;IACb,KAAK;IACL,aAAa;IACb,gBAAgB;CACjB,CAAC"}

package/dist/cjs/core/scrubber.js

@@ -0,0 +1,260 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Scrubber = void 0;
+/**
+ * Core Scrubber - Deep object traversal with PII scrubbing
+ *
+ * A high-performance, immutable scrubbing engine that removes sensitive data from structured objects.
+ * Supports three scrubbing modes:
+ * - **Field-based**: Scrubs values based on field names (e.g., 'password', 'apiToken')
+ * - **Path-based**: Scrubs values at specific paths (e.g., 'user.email', 'request.headers.authorization')
+ * - **Pattern-based**: Scrubs content matching regex patterns (e.g., SSN, credit cards)
+ *
+ * ### Design Principles
+ * - **Immutable**: All operations create new objects, never mutate inputs
+ * - **Type-safe**: Preserves TypeScript types through generic constraints
+ * - **Circular-safe**: Handles circular references without crashing
+ * - **Performance**: <1ms p95 for logging, <10ms p95 for exception handling (544k+ ops/sec)
+ *
+ * ### Pattern Adoption
+ * Patterns adopted from `@heroku/oauth-provider-adapters-for-mcp/src/logging/redaction.ts`:
+ * - Deep recursive traversal with circular reference detection
+ * - Immutable cloning strategy with fallback for complex objects
+ * - Nested path resolution (e.g., 'user.profile.email')
+ * - General array path handling (e.g., 'users[0].password')
+ * - Type-safe generics preserving input types
+ *
+ * Enhanced with:
+ * - Field-based matching supporting both strings and regular expressions
+ * - Pattern-based content scrubbing for SSN, credit cards, etc.
+ * - Dual scrubbing: both field/path matching AND content pattern replacement
+ *
+ * @example Basic Usage
+ * ```typescript
+ * const scrubber = new Scrubber({
+ *   fields: ['password', 'apiToken'],
+ *   replacement: '[REDACTED]'
+ * });
+ *
+ * const result = scrubber.scrub({
+ *   user: { name: 'John', password: 'secret123' }
+ * });
+ * // Result: { user: { name: 'John', password: '[REDACTED]' } }
+ * ```
+ *
+ * @example Advanced Usage with All Modes
+ * ```typescript
+ * const scrubber = new Scrubber({
+ *   fields: ['password', /api[-_]?key/i],  // Regex matches api_key, api-key, apikey
+ *   paths: ['user.email', 'request.headers.authorization'],
+ *   patterns: [/\b\d{3}-\d{2}-\d{4}\b/g],  // SSN pattern
+ *   replacement: '[SCRUBBED]'
+ * });
+ *
+ * const result = scrubber.scrub({
+ *   user: { name: 'John', email: 'john@example.com', password: 'secret' },
+ *   request: { headers: { authorization: 'Bearer token123' } },
+ *   message: 'User SSN is 123-45-6789'
+ * });
+ * ```
+ */
+class Scrubber {
+    config;
+    circularRefs = new WeakSet();
+    pathSet;
+    /**
+     * Creates a new Scrubber instance with the specified configuration
+     *
+     * @param config - Scrubbing configuration
+     * @param config.fields - Field names to scrub (strings or regex patterns)
+     * @param config.paths - Dot-notation paths to scrub (e.g., 'user.email', 'items[0].password')
+     * @param config.patterns - Regex patterns for content scrubbing (must include global flag for multiple matches)
+     * @param config.replacement - Replacement string for scrubbed values (default: '[SCRUBBED]')
+     * @param config.recursive - Whether to recursively scrub nested objects (default: true)
+     *
+     * @example
+     * ```typescript
+     * const scrubber = new Scrubber({
+     *   fields: ['password', /api[-_]?key/i],
+     *   paths: ['user.email'],
+     *   patterns: [/\b\d{3}-\d{2}-\d{4}\b/g],
+     *   replacement: '[REDACTED]'
+     * });
+     * ```
+     */
+    constructor(config) {
+        this.config = {
+            fields: config.fields || [],
+            paths: config.paths || [],
+            patterns: config.patterns || [],
+            replacement: config.replacement || '[SCRUBBED]',
+            recursive: config.recursive !== undefined ? config.recursive : true,
+        };
+        // Pre-compute path set for O(1) lookups
+        this.pathSet = new Set(this.config.paths);
+    }
+    /**
+     * Scrubs sensitive data from an object
+     *
+     * This is the main entry point for the scrubbing engine. It performs three types of scrubbing:
+     * 1. **Field-based**: Replaces values of fields matching configured field names/patterns
+     * 2. **Path-based**: Replaces values at specific dot-notation paths
+     * 3. **Pattern-based**: Replaces content within string values matching regex patterns
+     *
+     * The operation is immutable - the input object is not modified. A deep clone is created
+     * and scrubbed values are replaced in the clone.
+     *
+     * ### Performance Characteristics
+     * - Small objects (typical logs): ~0.003ms p95
+     * - Medium objects (typical errors): ~0.034ms p95
+     * - Large objects (10KB+): ~1.2ms p95
+     * - Throughput: 54,000+ events/sec
+     *
+     * @template T - The type of the input object (preserved in output)
+     * @param obj - The object to scrub
+     * @returns A result object containing the scrubbed data, whether scrubbing occurred, and which paths were scrubbed
+     *
+     * @example Basic scrubbing
+     * ```typescript
+     * const scrubber = new Scrubber({ fields: ['password'] });
+     * const result = scrubber.scrub({ user: 'john', password: 'secret' });
+     * // result.data === { user: 'john', password: '[SCRUBBED]' }
+     * // result.scrubbed === true
+     * // result.scrubbedPaths === ['password']
+     * ```
+     *
+     * @example Type preservation
+     * ```typescript
+     * interface User { name: string; email: string; password: string; }
+     * const scrubber = new Scrubber({ fields: ['password', 'email'] });
+     * const user: User = { name: 'John', email: 'john@example.com', password: 'secret' };
+     * const result = scrubber.scrub(user);
+     * // result.data is still typed as User
+     * ```
+     */
+    scrub(obj) {
+        const scrubbedPaths = [];
+        const cloned = this.deepClone(obj);
+        // Reset circular refs tracker for each scrub operation
+        this.circularRefs = new WeakSet();
+        const scrubbed = this.scrubObject(cloned, '', scrubbedPaths);
+        return {
+            data: scrubbed,
+            scrubbed: scrubbedPaths.length > 0,
+            scrubbedPaths,
+        };
+    }
+    scrubObject(obj, path, paths) {
+        // Handle circular references
+        if (obj && typeof obj === 'object') {
+            if (this.circularRefs.has(obj)) {
+                return '[Circular Reference]';
+            }
+            this.circularRefs.add(obj);
+        }
+        // Handle primitives
+        if (obj === null || typeof obj !== 'object') {
+            return this.scrubValue(obj, path, paths);
+        }
+        // Handle arrays
+        if (Array.isArray(obj)) {
+            return obj.map((item, index) => {
+                const indexStr = index.toString();
+                const arrayPath = path ? `${path}[${index}]` : indexStr;
+                // Check if this specific array index path should be scrubbed
+                if (this.pathSet.has(indexStr) || this.pathSet.has(arrayPath)) {
+                    paths.push(arrayPath);
+                    return this.config.replacement;
+                }
+                // Recursively scrub array items
+                return this.scrubObject(item, arrayPath, paths);
+            });
+        }
+        // Handle objects - create new object (immutable approach)
+        const result = {};
+        for (const [key, value] of Object.entries(obj)) {
+            const keyPath = path ? `${path}.${key}` : key;
+            // Check if this specific path should be scrubbed
+            if (this.pathSet.has(key) || this.pathSet.has(keyPath)) {
+                result[key] = this.config.replacement;
+                paths.push(keyPath);
+                continue;
+            }
+            // Check if key matches sensitive field pattern
+            if (this.isSensitiveField(key)) {
+                result[key] = this.config.replacement;
+                paths.push(keyPath);
+                continue;
+            }
+            // Recursively scrub value
+            result[key] = this.config.recursive
+                ? this.scrubObject(value, keyPath, paths)
+                : this.scrubValue(value, keyPath, paths);
+        }
+        return result;
+    }
+    scrubValue(value, path, paths) {
+        if (typeof value !== 'string') {
+            return value;
+        }
+        let scrubbed = value;
+        let didScrub = false;
+        // Check against patterns (SSN, credit cards, etc.)
+        for (const pattern of this.config.patterns) {
+            if (pattern.test(scrubbed)) {
+                scrubbed = scrubbed.replace(pattern, this.config.replacement);
+                didScrub = true;
+            }
+        }
+        if (didScrub) {
+            paths.push(path);
+        }
+        return scrubbed;
+    }
+    /**
+     * Check if a field name matches any configured sensitive field patterns
+     */
+    isSensitiveField(key) {
+        return this.config.fields.some((field) => {
+            if (field instanceof RegExp) {
+                return field.test(key);
+            }
+            return key.toLowerCase().includes(field.toLowerCase());
+        });
+    }
+    deepClone(obj) {
+        try {
+            // Fast path for JSON-serializable objects
+            return JSON.parse(JSON.stringify(obj));
+        }
+        catch {
+            // Fallback for objects with circular references
+            const seen = new WeakMap();
+            function clone(value) {
+                if (value === null || typeof value !== 'object') {
+                    return value;
+                }
+                if (seen.has(value)) {
+                    return seen.get(value);
+                }
+                if (Array.isArray(value)) {
+                    const arr = [];
+                    seen.set(value, arr);
+                    value.forEach((item, i) => {
+                        arr[i] = clone(item);
+                    });
+                    return arr;
+                }
+                const obj = {};
+                seen.set(value, obj);
+                Object.keys(value).forEach((key) => {
+                    obj[key] = clone(value[key]);
+                });
+                return obj;
+            }
+            return clone(obj);
+        }
+    }
+}
+exports.Scrubber = Scrubber;
+//# sourceMappingURL=scrubber.js.map

package/dist/cjs/core/scrubber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrubber.js","sourceRoot":"","sources":["../../../src/core/scrubber.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAa,QAAQ;IACX,MAAM,CAAwB;IAC9B,YAAY,GAAG,IAAI,OAAO,EAAE,CAAC;IAC7B,OAAO,CAAc;IAE7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,MAAmB;QAC7B,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,YAAY;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;SACpE,CAAC;QAEF,wCAAwC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,KAAK,CAAI,GAAM;QACb,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEnC,uDAAuD;QACvD,IAAI,CAAC,YAAY,GAAG,IAAI,OAAO,EAAE,CAAC;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;QAE7D,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC;YAClC,aAAa;SACd,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,GAAQ,EAAE,IAAY,EAAE,KAAe;QACzD,6BAA6B;QAC7B,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,sBAAsB,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,oBAAoB;QACpB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QAED,gBAAgB;QAChB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAExD,6DAA6D;gBAC7D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACtB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBACjC,CAAC;gBAED,gCAAgC;gBAChC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAClD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,0DAA0D;QAC1D,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAE9C,iDAAiD;YACjD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,+CAA+C;YAC/C,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,0BAA0B;YAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;gBACjC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;gBACzC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,UAAU,CAAC,KAAU,EAAE,IAAY,EAAE,KAAe;QAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,mDAAmD;QACnD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC9D,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,GAAW;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACvC,IAAI,KAAK,YAAY,MAAM,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAI,GAAM;QACzB,IAAI,CAAC;YACH,0CAA0C;YAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;YAChD,MAAM,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;YAE3B,SAAS,KAAK,CAAC,KAAU;gBACvB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAChD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACzB,CAAC;gBAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAU,EAAE,CAAC;oBACtB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBACrB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;wBACxB,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;oBACvB,CAAC,CAAC,CAAC;oBACH,OAAO,GAAG,CAAC;gBACb,CAAC;gBAED,MAAM,GAAG,GAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;oBACjC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/B,CAAC,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACb,CAAC;YAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAhOD,4BAgOC"}