@melra/receipt-schema 0.3.0-alpha.12 → 0.3.0-alpha.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +18 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +53 -19
- package/dist/index.js.map +1 -1
- package/package.json +1 -1
package/dist/index.d.ts
CHANGED
|
@@ -21,7 +21,7 @@ export declare function redactSecrets(text: string): {
|
|
|
21
21
|
* half of `-u user:pass`, credential-named `NAME=value` assignments, auth
|
|
22
22
|
* headers, and URL userinfo. Every argument then goes through SECRET_PATTERNS.
|
|
23
23
|
*/
|
|
24
|
-
export declare function redactArgv(argv: readonly string[]): {
|
|
24
|
+
export declare function redactArgv(argv: readonly string[], command?: string): {
|
|
25
25
|
value: string[];
|
|
26
26
|
redactions: string[];
|
|
27
27
|
};
|
|
@@ -101,6 +101,13 @@ export interface ActionReceipt {
|
|
|
101
101
|
outcome: "allow" | "deny" | "confirm";
|
|
102
102
|
policyVersion: string;
|
|
103
103
|
approvalId?: string;
|
|
104
|
+
/** Who approved, through which channel, having been shown what. */
|
|
105
|
+
approval?: {
|
|
106
|
+
channel: string;
|
|
107
|
+
renderDigest: string;
|
|
108
|
+
approver: string;
|
|
109
|
+
decidedAt: string;
|
|
110
|
+
};
|
|
104
111
|
};
|
|
105
112
|
target: string;
|
|
106
113
|
inputDigest: string;
|
|
@@ -122,6 +129,16 @@ export interface ExecutionCertificate {
|
|
|
122
129
|
receiptIds: string[];
|
|
123
130
|
evidence: EvidenceItem[];
|
|
124
131
|
createdAt: string;
|
|
132
|
+
/** The deployment mode the task ran under, as on its receipts. */
|
|
133
|
+
mode?: string;
|
|
134
|
+
/**
|
|
135
|
+
* How the task's effect was authorised: `not_required` (a read),
|
|
136
|
+
* `bypassed` (a mutation allowed with no challenge, which only
|
|
137
|
+
* developer-mode unsafe-local permits), `in_band`, or `out_of_band`. One
|
|
138
|
+
* certificate covers one task, so this is that task's channel. Absent when
|
|
139
|
+
* nothing was authorised. Covered by `digest`, like every other field.
|
|
140
|
+
*/
|
|
141
|
+
approvalChannel?: string;
|
|
125
142
|
digest: string;
|
|
126
143
|
}
|
|
127
144
|
export declare function redactStructuredValue(value: unknown): {
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAqBpE,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CASnF;AAgDD;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAe3C;AAED,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,SAAS,GACT,QAAQ,GACR,WAAW,GACX,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,kBAAkB;AACpB,+EAA+E;GAC7E,mBAAmB,CAAC;AAExB;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB;AAC1B,mEAAmE;AACjE,WAAW;AACb,oDAAoD;GAClD,OAAO;AACT,qEAAqE;GACnE,aAAa;AACf,8FAA8F;GAC5F,UAAU,CAAC;AAoBf,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAE/D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC1C;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,EAAE;QACd,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;QACtC,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mEAAmE;QACnE,QAAQ,CAAC,EAAE;YACT,OAAO,EAAE,MAAM,CAAC;YAChB,YAAY,EAAE,MAAM,CAAC;YACrB,QAAQ,EAAE,MAAM,CAAC;YACjB,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC;KACH,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,iBAAiB,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG;IACrD,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAyEA;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYpD;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE7C;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,eAAe,GAAG,QAAQ,CAAC,GAC9E,oBAAoB,CAQtB"}
|
package/dist/index.js
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
// Copyright 2026 XAGI Labs Private Limited
|
|
2
2
|
// SPDX-License-Identifier: Apache-2.0
|
|
3
3
|
import { createHash, randomUUID } from "node:crypto";
|
|
4
|
-
const SENSITIVE_KEY = /^(?:arg|authorization|constraints|content|cookie|env|goal|headers?|pass(?:word|wd)?|secret|std(?:out|err)|text|token|api[_-]?key|values?)$/i;
|
|
4
|
+
const SENSITIVE_KEY = /^(?:arg|authorization|constraints|content|cookie|env|goal|headers?|input|pass(?:word|wd)?|secret|std(?:out|err)|text|token|api[_-]?key|values?)$/i;
|
|
5
5
|
/**
|
|
6
6
|
* Secret shapes redacted wherever MELRA persists free text: receipts and task
|
|
7
7
|
* records here, memory values, and terminal output. One list, exported, because
|
|
@@ -25,7 +25,14 @@ export const SECRET_PATTERNS = [
|
|
|
25
25
|
[/\bgh[opurs]_[A-Za-z0-9]{20,}\b/g, "[REDACTED_GITHUB_TOKEN]"],
|
|
26
26
|
[/\b(?:sk|pk|api)[-_][a-z0-9_-]{16,}\b/gi, "[REDACTED_API_KEY]"],
|
|
27
27
|
[/\bBearer\s+[A-Za-z0-9._~+/-]+=*\b/gi, "Bearer [REDACTED_TOKEN]"],
|
|
28
|
-
|
|
28
|
+
// `password=x`, and the spellings that hide the word inside a longer name or
|
|
29
|
+
// behind a quote: `DB_PASSWORD=x`, `AWS_SECRET_ACCESS_KEY: x`, `"password": "x"`.
|
|
30
|
+
[
|
|
31
|
+
/(?<![A-Za-z0-9])((?:[A-Za-z0-9]+_)*(?:password|passwd|passphrase|secret)(?:_[A-Za-z0-9]+)*)(["']?)\s*[:=]\s*["']?[^\s"',;}]+/gi,
|
|
32
|
+
"$1$2=[REDACTED]",
|
|
33
|
+
],
|
|
34
|
+
// Userinfo in a URL or connection string anywhere in text: `postgres://app:pw@db`.
|
|
35
|
+
[/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]*:[^\s/@]+@/gi, "$1[REDACTED_URL_CREDENTIALS]@"],
|
|
29
36
|
];
|
|
30
37
|
/** Every SECRET_PATTERNS match in `text` replaced, and which kinds were found. */
|
|
31
38
|
export function redactSecrets(text) {
|
|
@@ -41,22 +48,30 @@ export function redactSecrets(text) {
|
|
|
41
48
|
}
|
|
42
49
|
// A flag whose value is a credential, `--token x` or `--token=x`, matched on
|
|
43
50
|
// the flag's name because the value itself may have no recognisable shape.
|
|
44
|
-
|
|
45
|
-
//
|
|
46
|
-
|
|
47
|
-
|
|
51
|
+
// The credential word may lead a longer name too: `--secret-key`,
|
|
52
|
+
// `--s3-secret-access-key`, `--passphrase`.
|
|
53
|
+
const SECRET_FLAG = /^(--?(?:[a-z0-9]+[-_])*(?:token|password|passwd|passphrase|pass|secret|api[-_]?key|apikey|auth|authorization|credentials?|cookie|private[-_]?key)(?:[-_][a-z0-9]+)*)(?:=([\s\S]*))?$/i;
|
|
54
|
+
// `-u user:pass` / `--user user:pass` (curl, wget), and curl's proxy forms:
|
|
55
|
+
// only the part after the colon is a secret, and `sort -u`, `git add -u` take
|
|
56
|
+
// no value at all.
|
|
57
|
+
const USER_FLAG = /^(?:-u|--user|-U|--proxy-user)$/;
|
|
58
|
+
// The same, attached: `-ualice:pw`.
|
|
59
|
+
const ATTACHED_USER = /^(-u[^:\s]+):[\s\S]+$/;
|
|
48
60
|
// `-pPASSWORD` (mysql and friends). Never the next argument: `mkdir -p dir`,
|
|
49
|
-
// `ssh -p 22`.
|
|
50
|
-
//
|
|
61
|
+
// `ssh -p 22`. Only after a mysql-family program, because `find -print` and
|
|
62
|
+
// `gcc -pthread` have the same shape. A remainder under three characters is
|
|
63
|
+
// read as bundled short flags (`-pv`, `-pr`), not a password.
|
|
51
64
|
const ATTACHED_PASSWORD = /^-p(.{3,})$/s;
|
|
65
|
+
const MYSQL_FAMILY = /^(?:mysql[a-z]*|mariadb[a-z-]*)(?:\.exe)?$/i;
|
|
52
66
|
// `NAME=value` with a credential-like name, as `env FOO_TOKEN=x cmd` passes it.
|
|
53
67
|
const SECRET_ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|AUTH|CREDENTIALS?))=[\s\S]*$/i;
|
|
54
68
|
// A header given as one argument, as `curl -H 'Authorization: Bearer x'` does.
|
|
55
|
-
const SECRET_HEADER = /^((?:proxy-)?authorization|cookie|[a-z0-9-]*(?:token|api-?key|secret))\s*:[\s\S]*$/i;
|
|
56
|
-
// Credentials inside a URL or connection string: `postgres://user:pass@host
|
|
57
|
-
|
|
69
|
+
const SECRET_HEADER = /^((?:--header=|-H)?(?:(?:proxy-)?authorization|cookie|[a-z0-9-]*(?:token|api-?key|secret)))\s*:[\s\S]*$/i;
|
|
70
|
+
// Credentials inside a URL or connection string: `postgres://user:pass@host`,
|
|
71
|
+
// and `redis://:pass@host`, whose username is usually empty.
|
|
72
|
+
const URL_CREDENTIALS = /(\/\/)[^\s/@:]*:[^\s/@]+@/g;
|
|
58
73
|
const REDACTED_ARG = "[REDACTED_SENSITIVE_ARG]";
|
|
59
|
-
function redactOneArg(arg, previous) {
|
|
74
|
+
function redactOneArg(arg, previous, mysql) {
|
|
60
75
|
if (previous !== undefined) {
|
|
61
76
|
const flag = SECRET_FLAG.exec(previous);
|
|
62
77
|
if (flag !== null && flag[2] === undefined)
|
|
@@ -68,8 +83,10 @@ function redactOneArg(arg, previous) {
|
|
|
68
83
|
const flag = SECRET_FLAG.exec(arg);
|
|
69
84
|
if (flag?.[2] !== undefined)
|
|
70
85
|
return `${flag[1]}=${REDACTED_ARG}`;
|
|
71
|
-
if (ATTACHED_PASSWORD.test(arg))
|
|
86
|
+
if (mysql && ATTACHED_PASSWORD.test(arg))
|
|
72
87
|
return `-p${REDACTED_ARG}`;
|
|
88
|
+
if (ATTACHED_USER.test(arg))
|
|
89
|
+
return arg.replace(ATTACHED_USER, `$1:${REDACTED_ARG}`);
|
|
73
90
|
if (SECRET_ASSIGNMENT.test(arg))
|
|
74
91
|
return arg.replace(SECRET_ASSIGNMENT, `$1=${REDACTED_ARG}`);
|
|
75
92
|
if (SECRET_HEADER.test(arg))
|
|
@@ -83,10 +100,16 @@ function redactOneArg(arg, previous) {
|
|
|
83
100
|
* half of `-u user:pass`, credential-named `NAME=value` assignments, auth
|
|
84
101
|
* headers, and URL userinfo. Every argument then goes through SECRET_PATTERNS.
|
|
85
102
|
*/
|
|
86
|
-
export function redactArgv(argv) {
|
|
103
|
+
export function redactArgv(argv, command) {
|
|
87
104
|
const redactions = new Set();
|
|
105
|
+
// Unknown program: read `-pXXXX` as a password, the cautious side.
|
|
106
|
+
const program = (name) => MYSQL_FAMILY.test(name.split(/[\\/]/).pop() ?? "");
|
|
107
|
+
let mysql = command === undefined || program(command);
|
|
88
108
|
const value = argv.map((arg, index) => {
|
|
89
|
-
|
|
109
|
+
// `env`, `sudo` and friends put the program among the arguments.
|
|
110
|
+
if (program(arg))
|
|
111
|
+
mysql = true;
|
|
112
|
+
const out = redactOneArg(arg, index === 0 ? undefined : argv[index - 1], mysql);
|
|
90
113
|
if (out !== arg)
|
|
91
114
|
redactions.add(REDACTED_ARG);
|
|
92
115
|
const redacted = redactSecrets(out);
|
|
@@ -131,7 +154,7 @@ export function redactStructuredValue(value) {
|
|
|
131
154
|
}
|
|
132
155
|
return "[REDACTED_SENSITIVE_FIELD]";
|
|
133
156
|
};
|
|
134
|
-
const visit = (current, key) => {
|
|
157
|
+
const visit = (current, key, parent) => {
|
|
135
158
|
if (key !== undefined && SENSITIVE_KEY.test(key)) {
|
|
136
159
|
return redactWholeValue(current);
|
|
137
160
|
}
|
|
@@ -141,7 +164,9 @@ export function redactStructuredValue(value) {
|
|
|
141
164
|
if (!Array.isArray(current) || !current.every((item) => typeof item === "string")) {
|
|
142
165
|
return redactWholeValue(current);
|
|
143
166
|
}
|
|
144
|
-
|
|
167
|
+
// The program sits beside its arguments, as `command`.
|
|
168
|
+
const command = typeof parent?.command === "string" ? parent.command : undefined;
|
|
169
|
+
const redacted = redactArgv(current, command);
|
|
145
170
|
for (const kind of redacted.redactions)
|
|
146
171
|
redactions.add(kind);
|
|
147
172
|
return redacted.value;
|
|
@@ -154,7 +179,16 @@ export function redactStructuredValue(value) {
|
|
|
154
179
|
url.search = "";
|
|
155
180
|
url.hash = "";
|
|
156
181
|
}
|
|
157
|
-
|
|
182
|
+
if (url.username !== "" || url.password !== "") {
|
|
183
|
+
redactions.add("[REDACTED_URL_CREDENTIALS]");
|
|
184
|
+
url.username = "";
|
|
185
|
+
url.password = "";
|
|
186
|
+
}
|
|
187
|
+
// Then the shapes any string gets: a token in the path is still a token.
|
|
188
|
+
const redacted = redactSecrets(url.toString());
|
|
189
|
+
for (const kind of redacted.redactions)
|
|
190
|
+
redactions.add(kind);
|
|
191
|
+
return redacted.value;
|
|
158
192
|
}
|
|
159
193
|
catch {
|
|
160
194
|
// Non-URL strings continue through normal pattern redaction.
|
|
@@ -172,7 +206,7 @@ export function redactStructuredValue(value) {
|
|
|
172
206
|
if (current !== null && typeof current === "object") {
|
|
173
207
|
return Object.fromEntries(Object.entries(current).map(([entryKey, entryValue]) => [
|
|
174
208
|
entryKey,
|
|
175
|
-
visit(entryValue, entryKey),
|
|
209
|
+
visit(entryValue, entryKey, current),
|
|
176
210
|
]));
|
|
177
211
|
}
|
|
178
212
|
return current;
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,aAAa,GACjB,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,aAAa,GACjB,mJAAmJ,CAAC;AACtJ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAA6C;IACvE,2EAA2E;IAC3E;QACE,6FAA6F;QAC7F,wBAAwB;KACzB;IACD,CAAC,oDAAoD,EAAE,wBAAwB,CAAC;IAChF,CAAC,gCAAgC,EAAE,uBAAuB,CAAC;IAC3D,CAAC,oEAAoE,EAAE,gBAAgB,CAAC;IACxF,CAAC,oCAAoC,EAAE,wBAAwB,CAAC;IAChE,CAAC,iCAAiC,EAAE,yBAAyB,CAAC;IAC9D,CAAC,wCAAwC,EAAE,oBAAoB,CAAC;IAChE,CAAC,qCAAqC,EAAE,yBAAyB,CAAC;IAClE,6EAA6E;IAC7E,kFAAkF;IAClF;QACE,gIAAgI;QAChI,iBAAiB;KAClB;IACD,mFAAmF;IACnF,CAAC,iDAAiD,EAAE,+BAA+B,CAAC;CACrF,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,eAAe,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC;QACrB,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,kEAAkE;AAClE,4CAA4C;AAC5C,MAAM,WAAW,GACf,uLAAuL,CAAC;AAC1L,4EAA4E;AAC5E,8EAA8E;AAC9E,mBAAmB;AACnB,MAAM,SAAS,GAAG,iCAAiC,CAAC;AACpD,oCAAoC;AACpC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAC9C,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,8DAA8D;AAC9D,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,YAAY,GAAG,6CAA6C,CAAC;AACnE,gFAAgF;AAChF,MAAM,iBAAiB,GACrB,gGAAgG,CAAC;AACnG,+EAA+E;AAC/E,MAAM,aAAa,GACjB,0GAA0G,CAAC;AAC7G,8EAA8E;AAC9E,6DAA6D;AAC7D,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAEhD,SAAS,YAAY,CAAC,GAAW,EAAE,QAA4B,EAAE,KAAc;IAC7E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC;QAChE,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;IACjE,IAAI,KAAK,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,YAAY,EAAE,CAAC;IACrE,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,YAAY,EAAE,CAAC,CAAC;IACrF,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,YAAY,EAAE,CAAC,CAAC;IAC7F,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,YAAY,EAAE,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,YAAY,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,IAAuB,EACvB,OAAgB;IAEhB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,IAAI,KAAK,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACpC,iEAAiE;QACjE,IAAI,OAAO,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;QAC/B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChF,IAAI,GAAG,KAAK,GAAG;YAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAChD,CAAC;AAiCD;;;;GAIG;AACH,MAAM,uBAAuB,GAAqC;IAChE,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,OAAO;IACpB,SAAS,EAAE,OAAO;IAClB,6EAA6E;IAC7E,yBAAyB;IACzB,WAAW,EAAE,OAAO;IACpB,4EAA4E;IAC5E,8EAA8E;IAC9E,cAAc;IACd,qBAAqB,EAAE,aAAa;CACrC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;AACtD,CAAC;AAmGD,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAIlD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,gBAAgB,GAAG,CAAC,OAAgB,EAAW,EAAE;QACrD,UAAU,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACrC,QAAQ;gBACR,4BAA4B;aAC7B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,4BAA4B,CAAC;IACtC,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,GAAY,EAAE,MAAgC,EAAW,EAAE;QAC1F,IAAI,GAAG,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,iEAAiE;YACjE,qEAAqE;YACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAClF,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,uDAAuD;YACvD,MAAM,OAAO,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACjF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,QAAQ,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,GAAG,KAAK,KAAK,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;oBACzC,UAAU,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;oBACvC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;oBAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;gBAChB,CAAC;gBACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;oBAC/C,UAAU,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;oBAC7C,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;oBAClB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;gBACpB,CAAC;gBACD,yEAAyE;gBACzE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC/C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU;oBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7D,OAAO,QAAQ,CAAC,KAAK,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;QACH,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACxC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,QAAQ,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;gBACtD,QAAQ;gBACR,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAkC,CAAC;aAChE,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC3B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SACpE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAA+E;IAE/E,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,OAAgB;QAC/B,aAAa;QACb,GAAG,KAAK;KACT,CAAC;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC"}
|