@namzu/sdk 27.0.0 → 28.0.0

package/dist/constants/secret-patterns.js

@@ -0,0 +1,99 @@
+/**
+ * Credential shapes redacted before they leave this tree, in one place.
+ *
+ * Two tables evolved independently and disagreed:
+ *
+ *  - `runtime/query/guardrail-presets.ts` carried eight vendor-prefix-anchored
+ *    patterns, private and unexported, deliberately narrow — a loose
+ *    "looks like a secret" regex over model output produces false positives
+ *    on ordinary code, and a redactor that fires on the wrong thing gets
+ *    switched off, at which point it protects nothing.
+ *  - `provider/errors.ts` carried a broader, field-name-aware set (a
+ *    generic key-prefix pattern, a bearer-header pattern, and a JSON
+ *    field-name scrubber that catches a secret by the key it sits under
+ *    regardless of value shape) because the narrow approach had already
+ *    proven insufficient there: a vendor error body echoes the request,
+ *    and a request can carry a credential shape the narrow table never
+ *    anticipated.
+ *
+ * Both live here now, as two exported sets rather than one, because the
+ * cost of a false positive is not the same at the two call sites:
+ *
+ *  - `OUTPUT_SECRET_PATTERNS` (the original narrow eight) is what
+ *    `secretRedactionGuardrail` matches against MODEL OUTPUT. A false
+ *    positive there rewrites the answer the caller asked for, so it stays
+ *    narrow on purpose.
+ *  - `LOG_SECRET_PATTERNS` (the union of both tables) is for text that is
+ *    being logged or carried in an error's `detail`, never returned as the
+ *    answer itself. A false positive there redacts one word out of a
+ *    diagnostic line nobody was going to copy-paste as a credential, which
+ *    is a cost worth paying for the wider net.
+ *
+ * `SecretPattern` label strings are never returned to the caller verbatim —
+ * consumers replace a match with `[REDACTED:<label>]`, not the matched
+ * text, so a `label` here should never itself carry anything secret.
+ *
+ * Zero imports. This is a leaf module on purpose: `utils/logger.ts` is
+ * imported by most of `runtime/query/`, so pulling this table back out of
+ * `runtime/query` would have made it a same-package import cycle, and a
+ * cycle on a security-relevant table fails as a TDZ error or a
+ * partially-initialised module — quietly, in the worst possible place.
+ * Keeping this file leaf-only is what lets `runtime/query/guardrail-presets.ts`
+ * and `provider/errors.ts` both import from it without one importing the
+ * other.
+ */
+/**
+ * The narrow, prefix-anchored set. Unchanged from the table this replaces —
+ * same labels, same regexes, same order — because moving it was the whole
+ * point of this module and widening it was not: `secretRedactionGuardrail`
+ * still needs a redactor precise enough that it never gets switched off.
+ */
+export const OUTPUT_SECRET_PATTERNS = [
+    ['aws-access-key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g],
+    ['github-token', /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g],
+    ['openai-key', /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g],
+    ['anthropic-key', /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g],
+    ['slack-token', /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g],
+    ['google-api-key', /\bAIza[0-9A-Za-z_-]{35}\b/g],
+    ['private-key-block', /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/g],
+    ['jwt', /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g],
+];
+/**
+ * The union: every pattern above, plus everything `provider/errors.ts`
+ * carried that the narrow set did not cover — a generic key-prefix catch,
+ * a bearer-header pattern, and a JSON field-name scrubber.
+ *
+ * Two adjustments over a plain concatenation, both required so that
+ * deleting any ONE entry changes behaviour for exactly the shape that
+ * entry names, which is what the test suite for this module pins:
+ *
+ *  - `github-token` uses the wider `{20,}` threshold `provider/errors.ts`
+ *    used, not the guardrail's `{36,}` — the union takes the broader of
+ *    two disagreeing thresholds for the same vendor, never the narrower.
+ *  - The two broad `sk-`-family entries each carry a negative lookahead
+ *    excluding the `sk-ant-` and `sk-proj-` shapes, which a plain
+ *    `sk-`/`pk-`/`rk-` prefix scan would otherwise ALSO match. Without the
+ *    lookaheads, deleting the narrower entry for one of those shapes leaves a
+ *    value of that shape still caught — by the broad entries, in array order —
+ *    so the redaction succeeds while the label names the wrong issuer.
+ *
+ *    A mislabelled redaction is not a cosmetic problem: the label is what an
+ *    operator greps for when rotating one credential and not another. That is
+ *    also why the mutation check deletes each entry in turn and asserts only
+ *    its own sample breaks.
+ */
+export const LOG_SECRET_PATTERNS = [
+    ['aws-access-key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g],
+    ['github-token', /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g],
+    ['anthropic-key', /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g],
+    ['openai-key', /\bsk-(?!ant-)(?:proj-)?[A-Za-z0-9_-]{20,}\b/g],
+    ['slack-token', /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g],
+    ['google-api-key', /\bAIza[0-9A-Za-z_-]{35}\b/g],
+    ['private-key-block', /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/g],
+    ['jwt', /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g],
+    ['npm-token', /\bnpm_[A-Za-z0-9]{20,}\b/g],
+    ['bearer-token', /\bBearer\s+[A-Za-z0-9._~+/-]{12,}=*/gi],
+    ['generic-key', /\b(?:sk[-_](?!ant-|proj-)|pk[-_]|rk[-_])[A-Za-z0-9_-]{12,}\b/g],
+    ['json-secret-field', /"(?:api[_-]?key|authorization|token|secret|password)"\s*:\s*"[^"]*"/gi],
+];
+//# sourceMappingURL=secret-patterns.js.map

package/dist/constants/secret-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns.js","sourceRoot":"","sources":["../../src/constants/secret-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA6B;IAC/D,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;IACpD,CAAC,cAAc,EAAE,iCAAiC,CAAC;IACnD,CAAC,YAAY,EAAE,sCAAsC,CAAC;IACtD,CAAC,eAAe,EAAE,gCAAgC,CAAC;IACnD,CAAC,aAAa,EAAE,mCAAmC,CAAC;IACpD,CAAC,gBAAgB,EAAE,4BAA4B,CAAC;IAChD,CAAC,mBAAmB,EAAE,yDAAyD,CAAC;IAChF,CAAC,KAAK,EAAE,uEAAuE,CAAC;CAChF,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA6B;IAC5D,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;IACpD,CAAC,cAAc,EAAE,iCAAiC,CAAC;IACnD,CAAC,eAAe,EAAE,gCAAgC,CAAC;IACnD,CAAC,YAAY,EAAE,8CAA8C,CAAC;IAC9D,CAAC,aAAa,EAAE,mCAAmC,CAAC;IACpD,CAAC,gBAAgB,EAAE,4BAA4B,CAAC;IAChD,CAAC,mBAAmB,EAAE,yDAAyD,CAAC;IAChF,CAAC,KAAK,EAAE,uEAAuE,CAAC;IAChF,CAAC,WAAW,EAAE,2BAA2B,CAAC;IAC1C,CAAC,cAAc,EAAE,uCAAuC,CAAC;IACzD,CAAC,aAAa,EAAE,+DAA+D,CAAC;IAChF,CAAC,mBAAmB,EAAE,uEAAuE,CAAC;CAC9F,CAAA"}

package/dist/constants/telemetry/index.d.ts

@@ -46,5 +46,47 @@ export declare const NAMZU: {
     readonly CACHE_READ_TOKENS: "namzu.cache.read_tokens";
     readonly CACHE_WRITE_TOKENS: "namzu.cache.write_tokens";
     readonly CACHE_DISCOUNT: "namzu.cache.discount";
+    readonly SESSION_ID: "namzu.session.id";
+    readonly THREAD_ID: "namzu.thread.id";
+    readonly PROJECT_ID: "namzu.project.id";
+    readonly TENANT_ID: "namzu.tenant.id";
+    readonly RUN_PARENT_ID: "namzu.run.parent_id";
+    readonly AGENT_TYPE: "namzu.agent.type";
+    readonly REGISTRY_NAME: "namzu.registry.name";
+    readonly CREDENTIAL_ID: "namzu.credential.id";
+    readonly CREDENTIAL_LABEL: "namzu.credential.label";
+    readonly SERVER_ID: "namzu.connector.server.id";
+    readonly SERVER_NAME: "namzu.connector.server.name";
+    readonly MCP_SERVER_ID: "namzu.mcp.server.id";
+    readonly CONNECTOR_TYPE: "namzu.connector.type";
+    readonly EXECUTION_TYPE: "namzu.execution.type";
+    readonly SANDBOX_ID: "namzu.sandbox.id";
 };
+/**
+ * The boot narrative's closed event-name vocabulary — every `eventName` the
+ * SDK itself emits between process start and `namzu.boot.ready`. A call
+ * site spells `BOOT_EVENT_NAMES.X`, not the literal string, so a typo
+ * becomes a missing property at compile time rather than a name that
+ * silently never matches a host's filter.
+ *
+ * `BootEventName` is DERIVED from this record rather than declared beside
+ * it, so the two cannot drift — there is only one place a member is added.
+ * `LogRecord.eventName` itself stays `string`, not this union: widening it
+ * to a fixed union would make the field unusable for a future emitter
+ * naming events from a different vocabulary.
+ */
+export declare const BOOT_EVENT_NAMES: {
+    readonly BOOT_START: "namzu.boot.start";
+    readonly CONFIG_RESOLVED: "namzu.config.resolved";
+    readonly SANDBOX_RESOLVED: "namzu.sandbox.resolved";
+    readonly PROVIDER_RESOLVED: "namzu.provider.resolved";
+    readonly CAPABILITY_DETECTED: "namzu.capability.detected";
+    readonly CAPABILITY_BROKEN: "namzu.capability.broken";
+    readonly TELEMETRY_STATUS: "namzu.telemetry.status";
+    readonly MIGRATION_COMPLETED: "namzu.migration.completed";
+    readonly DISCOVERY_COMPLETED: "namzu.discovery.completed";
+    readonly BOOT_REFUSED: "namzu.boot.refused";
+    readonly BOOT_READY: "namzu.boot.ready";
+};
+export type BootEventName = (typeof BOOT_EVENT_NAMES)[keyof typeof BOOT_EVENT_NAMES];
 //# sourceMappingURL=index.d.ts.map

package/dist/constants/telemetry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/telemetry/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,KAAK;;;;;;;;;;;IAejB;;;;;OAKG;;;;IAMH;;;;;;;;;;;;;OAaG;;;;CAKM,CAAA;AAEV,eAAO,MAAM,KAAK;;;;;;;;;;CAUR,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/telemetry/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,KAAK;;;;;;;;;;;IAejB;;;;;OAKG;;;;IAMH;;;;;;;;;;;;;OAaG;;;;CAKM,CAAA;AAEV,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;CA+ER,CAAA;AAEV;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;CAYnB,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAA"}

package/dist/constants/telemetry/index.js

@@ -46,5 +46,92 @@ export const NAMZU = {
     CACHE_READ_TOKENS: 'namzu.cache.read_tokens',
     CACHE_WRITE_TOKENS: 'namzu.cache.write_tokens',
     CACHE_DISCOUNT: 'namzu.cache.discount',
+    // Correlation attributes for the run's own logger — see
+    // RunContextFactory.buildLogger (runtime/query/context.ts). RUN_ID above
+    // already covered the run itself; these are the layers above it
+    // (Tenant -> Project -> Thread -> Session -> Run, Convention #17) that
+    // used to reach the run's logger as four bare, un-namespaced keys.
+    SESSION_ID: 'namzu.session.id',
+    THREAD_ID: 'namzu.thread.id',
+    PROJECT_ID: 'namzu.project.id',
+    TENANT_ID: 'namzu.tenant.id',
+    // Set only when a run was started by another run (the sub-agent gateway
+    // path) — see query()'s params.parentRunId in runtime/query/index.ts.
+    // Previously reached the RunContext's own fields but never the logger.
+    RUN_PARENT_ID: 'namzu.run.parent_id',
+    // AbstractAgent's per-instance identity (agents/AbstractAgent.ts). The id
+    // half reuses GENAI.AGENT_ID — an agent's id is the same concept whether
+    // it is read off a span or a log record, and GENAI.AGENT_ID already
+    // exists and is already bound at the run's own correlated logger and
+    // root span. TYPE has no GENAI analogue, so it is new.
+    AGENT_TYPE: 'namzu.agent.type',
+    // ManagedRegistry's per-subclass distinction (registry/ManagedRegistry.ts).
+    // scope.name is fixed to 'registry' for every ManagedRegistry subclass —
+    // they all log through this one file — so the per-instance name that
+    // `component: config.componentName` used to carry moves here instead.
+    // `ManagedRegistryConfig.componentName`'s FIELD NAME is unchanged.
+    REGISTRY_NAME: 'namzu.registry.name',
+    // InMemoryCredentialVault (vault/InMemoryCredentialVault.ts) — closes a
+    // PRE-EXISTING violation of "no attribute string literal at a call
+    // site": both keys already existed as raw string literals there before
+    // this change. Values are unchanged.
+    CREDENTIAL_ID: 'namzu.credential.id',
+    CREDENTIAL_LABEL: 'namzu.credential.label',
+    // MCPClient (connector/mcp/client.ts). SERVER_ID is the OPERATOR's own
+    // configured identifier for the connector instance being dialed;
+    // SERVER_NAME is the REMOTE server's own self-reported name from its
+    // initialize response — kept separate on purpose, since the remote's
+    // self-report is attacker-influenced data (see
+    // connector/mcp/__tests__/a-server-cannot-forge-a-second-log-line.test.ts).
+    // SERVER_NAME closes the same kind of pre-existing literal violation as
+    // the two CREDENTIAL_* keys above.
+    SERVER_ID: 'namzu.connector.server.id',
+    SERVER_NAME: 'namzu.connector.server.name',
+    // The MCP server this process HOSTS (connector/mcp/server/server.ts), not
+    // one it dials. Deliberately not SERVER_ID above: that key is the client
+    // side's identifier for a remote, and a record carrying both concepts
+    // under one name is the collision the namespace rule exists to stop. The
+    // value is an `MCPServerId` minted here, so unlike SERVER_NAME it is not
+    // attacker-influenced.
+    MCP_SERVER_ID: 'namzu.mcp.server.id',
+    // The concrete subclass behind a base class that logs on its children's
+    // behalf — the same shape as REGISTRY_NAME above, and for the same
+    // reason: `scope.name` is the MODULE (`connector/base`, `execution/base`)
+    // because that is the file the record is emitted from, so the subclass
+    // identity every one of those records used to carry as `component:
+    // this.constructor.name` needs somewhere to go that is not the scope.
+    CONNECTOR_TYPE: 'namzu.connector.type',
+    EXECUTION_TYPE: 'namzu.execution.type',
+    // LocalSandbox (sandbox/provider/local.ts). The file hosts two logging
+    // classes — the sandbox and its provider — and both scope to
+    // `sandbox/provider/local`, so this id is what separates one sandbox's
+    // records from the provider's and from each other's.
+    SANDBOX_ID: 'namzu.sandbox.id',
+};
+/**
+ * The boot narrative's closed event-name vocabulary — every `eventName` the
+ * SDK itself emits between process start and `namzu.boot.ready`. A call
+ * site spells `BOOT_EVENT_NAMES.X`, not the literal string, so a typo
+ * becomes a missing property at compile time rather than a name that
+ * silently never matches a host's filter.
+ *
+ * `BootEventName` is DERIVED from this record rather than declared beside
+ * it, so the two cannot drift — there is only one place a member is added.
+ * `LogRecord.eventName` itself stays `string`, not this union: widening it
+ * to a fixed union would make the field unusable for a future emitter
+ * naming events from a different vocabulary.
+ */
+export const BOOT_EVENT_NAMES = {
+    BOOT_START: 'namzu.boot.start',
+    CONFIG_RESOLVED: 'namzu.config.resolved',
+    SANDBOX_RESOLVED: 'namzu.sandbox.resolved',
+    PROVIDER_RESOLVED: 'namzu.provider.resolved',
+    CAPABILITY_DETECTED: 'namzu.capability.detected',
+    CAPABILITY_BROKEN: 'namzu.capability.broken',
+    TELEMETRY_STATUS: 'namzu.telemetry.status',
+    MIGRATION_COMPLETED: 'namzu.migration.completed',
+    DISCOVERY_COMPLETED: 'namzu.discovery.completed',
+    BOOT_REFUSED: 'namzu.boot.refused',
+    BOOT_READY: 'namzu.boot.ready',
 };
 //# sourceMappingURL=index.js.map

package/dist/constants/telemetry/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/telemetry/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,KAAK,GAAG;IACpB,cAAc,EAAE,uBAAuB;IACvC,MAAM,EAAE,eAAe;IAEvB,aAAa,EAAE,sBAAsB;IACrC,mBAAmB,EAAE,4BAA4B;IACjD,kBAAkB,EAAE,2BAA2B;IAE/C,cAAc,EAAE,uBAAuB;IACvC,uBAAuB,EAAE,gCAAgC;IACzD,WAAW,EAAE,oBAAoB;IAEjC,kBAAkB,EAAE,2BAA2B;IAC/C,mBAAmB,EAAE,4BAA4B;IAEjD;;;;;OAKG;IACH,UAAU,EAAE,mBAAmB;IAE/B,SAAS,EAAE,kBAAkB;IAC7B,SAAS,EAAE,kBAAkB;IAE7B;;;;;;;;;;;;;OAaG;IACH,YAAY,EAAE,qBAAqB;IAEnC,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,iBAAiB;CAClB,CAAA;AAEV,MAAM,CAAC,MAAM,KAAK,GAAG;IACpB,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,kBAAkB;IAC9B,SAAS,EAAE,iBAAiB;IAC5B,YAAY,EAAE,oBAAoB;IAClC,UAAU,EAAE,kBAAkB;IAC9B,UAAU,EAAE,kBAAkB;IAC9B,iBAAiB,EAAE,yBAAyB;IAC5C,kBAAkB,EAAE,0BAA0B;IAC9C,cAAc,EAAE,sBAAsB;CAC7B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/telemetry/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,KAAK,GAAG;IACpB,cAAc,EAAE,uBAAuB;IACvC,MAAM,EAAE,eAAe;IAEvB,aAAa,EAAE,sBAAsB;IACrC,mBAAmB,EAAE,4BAA4B;IACjD,kBAAkB,EAAE,2BAA2B;IAE/C,cAAc,EAAE,uBAAuB;IACvC,uBAAuB,EAAE,gCAAgC;IACzD,WAAW,EAAE,oBAAoB;IAEjC,kBAAkB,EAAE,2BAA2B;IAC/C,mBAAmB,EAAE,4BAA4B;IAEjD;;;;;OAKG;IACH,UAAU,EAAE,mBAAmB;IAE/B,SAAS,EAAE,kBAAkB;IAC7B,SAAS,EAAE,kBAAkB;IAE7B;;;;;;;;;;;;;OAaG;IACH,YAAY,EAAE,qBAAqB;IAEnC,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,iBAAiB;CAClB,CAAA;AAEV,MAAM,CAAC,MAAM,KAAK,GAAG;IACpB,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,kBAAkB;IAC9B,SAAS,EAAE,iBAAiB;IAC5B,YAAY,EAAE,oBAAoB;IAClC,UAAU,EAAE,kBAAkB;IAC9B,UAAU,EAAE,kBAAkB;IAC9B,iBAAiB,EAAE,yBAAyB;IAC5C,kBAAkB,EAAE,0BAA0B;IAC9C,cAAc,EAAE,sBAAsB;IAEtC,wDAAwD;IACxD,yEAAyE;IACzE,gEAAgE;IAChE,uEAAuE;IACvE,mEAAmE;IACnE,UAAU,EAAE,kBAAkB;IAC9B,SAAS,EAAE,iBAAiB;IAC5B,UAAU,EAAE,kBAAkB;IAC9B,SAAS,EAAE,iBAAiB;IAC5B,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,aAAa,EAAE,qBAAqB;IAEpC,0EAA0E;IAC1E,yEAAyE;IACzE,oEAAoE;IACpE,qEAAqE;IACrE,uDAAuD;IACvD,UAAU,EAAE,kBAAkB;IAE9B,4EAA4E;IAC5E,yEAAyE;IACzE,qEAAqE;IACrE,sEAAsE;IACtE,mEAAmE;IACnE,aAAa,EAAE,qBAAqB;IAEpC,wEAAwE;IACxE,mEAAmE;IACnE,uEAAuE;IACvE,qCAAqC;IACrC,aAAa,EAAE,qBAAqB;IACpC,gBAAgB,EAAE,wBAAwB;IAE1C,uEAAuE;IACvE,iEAAiE;IACjE,qEAAqE;IACrE,qEAAqE;IACrE,+CAA+C;IAC/C,4EAA4E;IAC5E,wEAAwE;IACxE,mCAAmC;IACnC,SAAS,EAAE,2BAA2B;IACtC,WAAW,EAAE,6BAA6B;IAE1C,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,uBAAuB;IACvB,aAAa,EAAE,qBAAqB;IAEpC,wEAAwE;IACxE,mEAAmE;IACnE,0EAA0E;IAC1E,uEAAuE;IACvE,mEAAmE;IACnE,sEAAsE;IACtE,cAAc,EAAE,sBAAsB;IACtC,cAAc,EAAE,sBAAsB;IAEtC,uEAAuE;IACvE,6DAA6D;IAC7D,uEAAuE;IACvE,qDAAqD;IACrD,UAAU,EAAE,kBAAkB;CACrB,CAAA;AAEV;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B,UAAU,EAAE,kBAAkB;IAC9B,eAAe,EAAE,uBAAuB;IACxC,gBAAgB,EAAE,wBAAwB;IAC1C,iBAAiB,EAAE,yBAAyB;IAC5C,mBAAmB,EAAE,2BAA2B;IAChD,iBAAiB,EAAE,yBAAyB;IAC5C,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,2BAA2B;IAChD,mBAAmB,EAAE,2BAA2B;IAChD,YAAY,EAAE,oBAAoB;IAClC,UAAU,EAAE,kBAAkB;CACrB,CAAA"}