@nifrajs/web 3.3.0 → 4.0.0

package/dist/internal/secret-scan.js

@@ -0,0 +1,485 @@
+/**
+ * Secret detection for everything a client build publishes: a heuristic net under the zone rules,
+ * not a guarantee. The zone rules keep backend code out of the browser; this catches a credential
+ * typed straight into browser code, a library carrying one, and a server-only environment value that
+ * reached the output some other way (a `define`, a prerendered page, a copied `public/` file).
+ *
+ * - Source rules run on the browser build's own modules before minification, while names still exist.
+ * - Format rules and private-value matching also run on every emitted file, every `public/` file and
+ *   every prerendered page and `_data.json`, source maps included.
+ *
+ * A finding never prints the value it found: only the rule, the location and a redacted preview.
+ */
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { basename, isAbsolute, join, relative } from "node:path";
+import { codeUnitOrder } from "./code-unit-order.js";
+import { isSensitiveFieldName } from "./output-guard.js";
+const RULES = new Set([
+    "private-key",
+    "credential-url",
+    "key-format",
+    "assigned-secret",
+    "private-env-value",
+]);
+/** High-precision token formats. Publishable keys (Stripe `pk_`, Google `AIza`, Supabase anon JWTs)
+ * are public by design and deliberately absent. */
+const KEY_FORMATS = [
+    { what: "AWS access key id", pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+    { what: "Stripe secret key", pattern: /\b[sr]k_(?:live|test)_[0-9A-Za-z]{16,}/g },
+    { what: "Stripe webhook secret", pattern: /\bwhsec_[0-9A-Za-z+/=]{24,}/g },
+    {
+        what: "GitHub token",
+        pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{50,})/g,
+    },
+    { what: "Slack token", pattern: /\bxox[abeoprs]-[A-Za-z0-9-]{10,}/g },
+    {
+        what: "Slack webhook URL",
+        pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{16,}/g,
+    },
+    {
+        what: "OpenAI API key",
+        pattern: /\bsk-(?:(?:proj|svcacct|admin)-[A-Za-z0-9_-]{40,}|[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20})/g,
+    },
+    { what: "Anthropic API key", pattern: /\bsk-ant-(?:api|admin)\d{2}-[A-Za-z0-9_-]{80,}/g },
+    { what: "SendGrid API key", pattern: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g },
+    { what: "Twilio API key", pattern: /\bSK[0-9a-f]{32}\b/g },
+    { what: "Mailgun API key", pattern: /\bkey-[0-9a-f]{32}\b/g },
+    { what: "npm token", pattern: /\bnpm_[A-Za-z0-9]{36}\b/g },
+];
+/** A PEM block with a body: a parser's bare `-----BEGIN PRIVATE KEY-----` constant is not a key. */
+const PRIVATE_KEY = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----[A-Za-z0-9+/=\s\\]{64,}?-----END/g;
+const CREDENTIAL_URL = /\b[a-z][a-z0-9+.-]{1,20}:\/\/([^\s/?#@:"'`<>\\]{1,64}):([^\s/?#@"'`<>\\]{3,128})@[^\s/?#"'`<>\\]+/gi;
+const JWT = /\beyJ[A-Za-z0-9_-]{8,}\.(eyJ[A-Za-z0-9_-]{8,})\.[A-Za-z0-9_-]{16,}/g;
+const PLACEHOLDER = /^(?:user(?:name)?|pass(?:word)?|pwd|secret|admin|root|guest|test|demo|example|changeme|change-me|xxx+|\*+|\.\.\.+|my-?password|your-?password|<[^>]*>|\$\{[^}]*\}|\{\{[^}]*\}\}|%[A-Za-z_]+%?)$/i;
+/** A literal assigned to a name: `apiKey: "..."`, `const secret = '...'`. Template literals with an
+ * interpolation are not literals. The lookbehind starts a name only where an identifier starts: a
+ * match from inside a long word run backtracks the rest of that run, quadratic in its length. */
+const ASSIGNED = /(?<![\w$])([A-Za-z_$][\w$]*)["']?\s*(?:[:=]|\?\?=|\|\|=)\s*(?:"([^"\\\r\n]{16,256})"|'([^'\\\r\n]{16,256})'|`([^`\\$\r\n]{16,256})`)/g;
+const EXTRA_SECRET_NAME = /(?:accesskey|signingkey|encryptionkey|masterkey|serviceaccountkey|connectionstring)$/;
+/** Values that look like keys but are public by design. */
+const PUBLIC_VALUE = /^(?:AIza[0-9A-Za-z_-]{35}|pk_(?:live|test)_[0-9A-Za-z]+|6L[0-9A-Za-z_-]{38}|G-[A-Z0-9]{6,}|UA-\d+-\d+)$/;
+/** Shannon entropy in bits per character. */
+function entropy(value) {
+    const counts = new Map();
+    for (const char of value)
+        counts.set(char, (counts.get(char) ?? 0) + 1);
+    let bits = 0;
+    for (const count of counts.values()) {
+        const p = count / value.length;
+        bits -= p * Math.log2(p);
+    }
+    return bits;
+}
+/** Random-looking: long, unbroken, mixed character classes, high entropy. Excludes paths and URLs. */
+function looksRandom(value, minLength) {
+    if (value.length < minLength || /\s/.test(value))
+        return false;
+    if (/^(?:[/~.]|[A-Za-z]:[\\/])/.test(value) || /^[a-z][a-z0-9+.-]*:\/\//i.test(value))
+        return false;
+    const classes = Number(/[a-z]/.test(value)) +
+        Number(/[A-Z]/.test(value)) +
+        Number(/[0-9]/.test(value)) +
+        Number(/[^A-Za-z0-9]/.test(value));
+    return classes >= 2 && entropy(value) >= 3.5;
+}
+function jwtRole(payload) {
+    try {
+        const json = atob(payload.replaceAll("-", "+").replaceAll("_", "/"));
+        return JSON.parse(json).role;
+    }
+    catch {
+        return undefined;
+    }
+}
+function formatMatches(text) {
+    const matches = [];
+    for (const { what, pattern } of KEY_FORMATS) {
+        for (const found of text.matchAll(pattern)) {
+            matches.push({ rule: "key-format", index: found.index, text: found[0], what });
+        }
+    }
+    for (const found of text.matchAll(JWT)) {
+        // A Supabase-style service key: a JWT whose role bypasses row-level security.
+        if (jwtRole(found[1] ?? "") === "service_role") {
+            matches.push({
+                rule: "key-format",
+                index: found.index,
+                text: found[0],
+                what: "service-role JWT",
+            });
+        }
+    }
+    for (const found of text.matchAll(PRIVATE_KEY)) {
+        matches.push({ rule: "private-key", index: found.index, text: found[0], what: "private key" });
+    }
+    for (const found of text.matchAll(CREDENTIAL_URL)) {
+        const user = found[1] ?? "";
+        const password = found[2] ?? "";
+        // @nifra-gate-reviewed: a password equal to its user name is a placeholder in the text being
+        // scanned; nothing is authenticated here.
+        if (PLACEHOLDER.test(password) || password === user || /[${}<>*]/.test(password))
+            continue;
+        matches.push({
+            rule: "credential-url",
+            index: found.index,
+            text: found[0],
+            what: "URL with a password",
+        });
+    }
+    return matches;
+}
+function assignedMatches(text) {
+    const matches = [];
+    for (const found of text.matchAll(ASSIGNED)) {
+        const name = found[1] ?? "";
+        if (!isSensitiveFieldName(name) && !EXTRA_SECRET_NAME.test(name.toLowerCase()))
+            continue;
+        const value = found[2] ?? found[3] ?? found[4] ?? "";
+        if (PUBLIC_VALUE.test(value) || PLACEHOLDER.test(value) || !looksRandom(value, 16))
+            continue;
+        matches.push({
+            rule: "assigned-secret",
+            index: found.index + found[0].indexOf(value),
+            text: value,
+            what: `literal assigned to "${name}"`,
+        });
+    }
+    return matches;
+}
+// Environment variables a shell, an OS or a CI system sets: none is an app secret unless its name
+// says so (`GITHUB_TOKEN`, `VERCEL_OIDC_TOKEN`).
+const AMBIENT_ENV = /^(?:PATH|HOME|PWD|OLDPWD|SHELL|USER|LOGNAME|TMPDIR|TMP|TEMP|LANG|LANGUAGE|EDITOR|VISUAL|PAGER|HOSTNAME|SHLVL|DISPLAY|MANPATH|INFOPATH|COLORTERM|COMMAND_MODE|_|(?:LC|NPM|npm|BUN|NODE|XPC|TERM|__CF|HOMEBREW|SSH|GPG|ITERM|VSCODE|JAVA|ANDROID|CONDA|PYENV|NVM|ZSH|GITHUB|RUNNER|CI|VERCEL|CF_PAGES|NETLIFY|RENDER|RAILWAY|FLY|CLAUDE|CLAUDECODE|GIT|DENO|PNPM|YARN)(?:_.*)?)$/;
+const SECRET_ENV_TOKENS = new Set([
+    "SECRET",
+    "SECRETS",
+    "TOKEN",
+    "PASSWORD",
+    "PASSWD",
+    "PASS",
+    "PRIVATE",
+    "CREDENTIAL",
+    "CREDENTIALS",
+    "APIKEY",
+    "KEY",
+    "DSN",
+    "SALT",
+    "PEPPER",
+    "WEBHOOK",
+]);
+const CONNECTION_ENV = /(?:DATABASE|DB|REDIS|MONGO(?:DB)?|POSTGRES(?:QL)?|PG|MYSQL|AMQP|RABBITMQ)_?(?:URL|URI)$|CONNECTION_?STRING/;
+const secretEnvName = (name) => CONNECTION_ENV.test(name.toUpperCase()) ||
+    name
+        .toUpperCase()
+        .split(/[^A-Z0-9]+/)
+        .some((token) => SECRET_ENV_TOKENS.has(token));
+function base64Variants(value) {
+    const bytes = new TextEncoder().encode(value);
+    const variants = [];
+    // A value inside a larger encoded blob lands at one of three byte alignments. Keep only the
+    // characters the value's own bytes determine: none that mix in a neighbour or the padding.
+    for (const shift of [0, 1, 2]) {
+        const shifted = new Uint8Array(shift + bytes.length);
+        shifted.set(bytes, shift);
+        let binary = "";
+        for (const byte of shifted)
+            binary += String.fromCharCode(byte);
+        const encoded = btoa(binary);
+        const core = encoded.slice(shift === 0 ? 0 : shift + 1, Math.floor(shifted.length / 3) * 4);
+        if (core.length >= 8) {
+            variants.push(core);
+            const url = core.replaceAll("+", "-").replaceAll("/", "_");
+            if (url !== core)
+                variants.push(url);
+        }
+    }
+    return variants;
+}
+/** The non-public values a build must not publish, in every encoding a page or bundle carries. */
+function envNeedles(env, prefix) {
+    const publicValues = new Set();
+    if (prefix !== "") {
+        for (const [name, value] of Object.entries(env)) {
+            if (name.startsWith(prefix) && value !== undefined)
+                publicValues.add(value);
+        }
+    }
+    const needles = [];
+    for (const [name, value] of Object.entries(env)) {
+        if (value === undefined || value.length < 8 || (prefix !== "" && name.startsWith(prefix))) {
+            continue;
+        }
+        // The same value published under a public name is public by declaration.
+        if (publicValues.has(value))
+            continue;
+        const named = secretEnvName(name);
+        if (!named && AMBIENT_ENV.test(name))
+            continue;
+        const credentialUrl = /^[a-z][a-z0-9+.-]*:\/\/[^/@\s]+:[^/@\s]+@/i.test(value);
+        if (!named && !credentialUrl && !looksRandom(value, 20))
+            continue;
+        const forms = [["raw", value]];
+        const add = (form, encoded) => {
+            if (encoded !== value && !forms.some(([, existing]) => existing === encoded)) {
+                forms.push([form, encoded]);
+            }
+        };
+        add("URL-encoded", encodeURIComponent(value));
+        add("JSON-escaped", JSON.stringify(value).slice(1, -1));
+        add("HTML-escaped", value
+            .replaceAll("&", "&amp;")
+            .replaceAll("<", "&lt;")
+            .replaceAll(">", "&gt;")
+            .replaceAll('"', "&quot;"));
+        for (const encoded of base64Variants(value))
+            add("base64", encoded);
+        for (const [form, needle] of forms)
+            needles.push({ env: name, form, needle });
+    }
+    return needles;
+}
+function envMatches(text, needles) {
+    const matches = [];
+    for (const { env, form, needle } of needles) {
+        const index = text.indexOf(needle);
+        if (index === -1)
+            continue;
+        matches.push({
+            rule: "private-env-value",
+            index,
+            text: needle,
+            what: `value of ${env}${form === "raw" ? "" : ` (${form})`}`,
+            env,
+        });
+    }
+    return matches;
+}
+const lineOf = (text, index) => {
+    let line = 1;
+    for (let i = text.indexOf("\n"); i !== -1 && i < index; i = text.indexOf("\n", i + 1))
+        line++;
+    return line;
+};
+const preview = (match) => match.rule === "private-env-value"
+    ? `${match.text.length} chars`
+    : `${match.text.slice(0, 4)}... (${match.text.length} chars)`;
+/** Refuse an exemption that does not name its rule, its location and its reason. */
+export function assertSecretExemptions(exemptions) {
+    exemptions.forEach((exemption, i) => {
+        const where = `secretExemptions[${i}]`;
+        if (!RULES.has(exemption.rule)) {
+            throw new Error(`[nifra/web] ${where}.rule must be one of ${[...RULES].join(", ")}; got ${JSON.stringify(exemption.rule)}`);
+        }
+        if (typeof exemption.reason !== "string" || exemption.reason.trim() === "") {
+            throw new Error(`[nifra/web] ${where} needs a reason: why this may reach the browser`);
+        }
+        const file = typeof exemption.file === "string" && exemption.file !== "";
+        const env = typeof exemption.env === "string" && exemption.env !== "";
+        if (!file && !(env && exemption.rule === "private-env-value")) {
+            throw new Error(`[nifra/web] ${where} must name a file${exemption.rule === "private-env-value" ? " or an env variable" : ""}; an exemption covers one location, never a value everywhere`);
+        }
+    });
+}
+/**
+ * Scan what a build publishes. Sources are scanned first: a match there is reported at its source
+ * location, and the same text in an emitted file (where names are hashed) is not reported again,
+ * exempted or not.
+ */
+export function scanForSecrets(input) {
+    const exemptions = input.exemptions ?? [];
+    assertSecretExemptions(exemptions);
+    const needles = envNeedles(input.env ?? {}, input.publicEnvPrefix ?? "PUBLIC_");
+    const seen = new Set();
+    const findings = [];
+    const exempt = (file, match) => exemptions.some((exemption) => exemption.rule === match.rule &&
+        (exemption.file === file || (match.env !== undefined && exemption.env === match.env)));
+    const originTexts = new Map();
+    const originText = (origin) => {
+        if (!originTexts.has(origin.path)) {
+            let text;
+            try {
+                text = readFileSync(origin.path, "utf8");
+            }
+            catch {
+                text = undefined;
+            }
+            originTexts.set(origin.path, text);
+        }
+        return originTexts.get(origin.path);
+    };
+    const scan = (file, isSource) => {
+        const matches = [
+            ...formatMatches(file.text),
+            ...(isSource && file.firstParty === true ? assignedMatches(file.text) : []),
+            ...envMatches(file.text, needles),
+        ];
+        for (const match of matches) {
+            const key = `${match.rule}\0${match.text}`;
+            if (!isSource && seen.has(key))
+                continue;
+            seen.add(key);
+            let at = { name: file.name, text: file.text, index: match.index };
+            for (const origin of file.origins ?? []) {
+                const text = originText(origin);
+                const index = text?.indexOf(match.text) ?? -1;
+                if (text !== undefined && index !== -1) {
+                    at = { name: origin.name, text, index };
+                    break;
+                }
+            }
+            if (exempt(at.name, match) || (at.name !== file.name && exempt(file.name, match)))
+                continue;
+            findings.push({
+                rule: match.rule,
+                file: at.name,
+                line: lineOf(at.text, at.index),
+                ...(at.name === file.name ? {} : { via: file.name }),
+                what: match.what,
+                preview: preview(match),
+            });
+        }
+    };
+    for (const file of input.sources ?? [])
+        scan(file, true);
+    for (const file of input.artifacts ?? [])
+        scan(file, false);
+    return findings.sort((a, b) => codeUnitOrder(a.file, b.file) || a.line - b.line || codeUnitOrder(a.rule, b.rule));
+}
+const AUTH_SCHEME = /\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{16,}/g;
+const CREDENTIAL_HEADER = /\b(cookie|set-cookie|authorization|proxy-authorization|x-api-key|api-key)(["']?\s*(?:=>|:|=)\s*["'`]?)[^"'`\r\n,}]{8,}/gi;
+/**
+ * A scrubber for text a dev tool hands to a person or an agent: logs, error messages, stacks,
+ * codeframes. Broader than the build scan because a log line is not a published artifact: every JWT
+ * (a session token is a credential), an `Authorization`/`Cookie` value, and every non-public env
+ * value in each encoding the build scan matches. Each hit becomes `[redacted:<what>]`.
+ */
+export function createRedactor(env, publicEnvPrefix = "PUBLIC_") {
+    const needles = envNeedles(env, publicEnvPrefix).sort((a, b) => b.needle.length - a.needle.length);
+    return (text) => {
+        if (text.length < 8)
+            return text;
+        let out = text;
+        for (const { env: name, needle } of needles) {
+            if (out.includes(needle))
+                out = out.replaceAll(needle, `[redacted:${name}]`);
+        }
+        out = out.replace(PRIVATE_KEY, "[redacted:private key]");
+        for (const { what, pattern } of KEY_FORMATS)
+            out = out.replace(pattern, `[redacted:${what}]`);
+        out = out.replace(JWT, "[redacted:JWT]");
+        out = out.replace(CREDENTIAL_URL, (match, user, password) => 
+        // @nifra-gate-reviewed: the same placeholder test as the scan; nothing is authenticated here.
+        PLACEHOLDER.test(password) || password === user
+            ? match
+            : match.replace(`:${password}@`, ":[redacted]@"));
+        out = out.replace(AUTH_SCHEME, "$1 [redacted]");
+        return out.replace(CREDENTIAL_HEADER, "$1$2[redacted]");
+    };
+}
+/** The build environment: Bun's, else Node's. */
+export const buildEnvironment = () => (typeof Bun !== "undefined" ? Bun.env : undefined) ?? process.env;
+/** Scan and throw the build-failing message on any finding. */
+export function assertNoSecrets(input) {
+    const message = formatSecretFindings(scanForSecrets(input));
+    if (message !== undefined)
+        throw new Error(message);
+}
+/** The build-failing message for secret findings, or `undefined` when there are none. */
+export function formatSecretFindings(findings) {
+    if (findings.length === 0)
+        return undefined;
+    const lines = findings.map((finding) => `  - ${finding.file}:${finding.line}${finding.via === undefined ? "" : ` (in ${finding.via})`} ${finding.what} [${finding.rule}] ${finding.preview}`);
+    return [
+        "[nifra/web] the build would publish what looks like a credential:",
+        ...lines,
+        "Keep credentials on the server: read them from the environment in a route's backend half or under",
+        "backend/, and rotate any that were committed. A reviewed false positive is exempted in",
+        'nifra.config.ts: export const secretExemptions = [{ rule, file, reason: "why it may ship" }].',
+    ].join("\n");
+}
+const INLINE_MAP = /\/[/*]# sourceMappingURL=data:application\/json;(?:charset=[^;,]+;)?base64,([A-Za-z0-9+/=]+)/;
+/** A published file's text, or `undefined` for a binary one (a NUL byte in its first 8 KB). */
+export function textOf(bytes) {
+    if (bytes.subarray(0, 8192).includes(0))
+        return undefined;
+    return new TextDecoder().decode(bytes);
+}
+/** An emitted bundle, plus its inline source map decoded: base64 would hide a key from every rule. */
+export function emittedScanFiles(name, text, origins) {
+    const files = [{ name, text, ...(origins ? { origins } : {}) }];
+    const inline = INLINE_MAP.exec(text)?.[1];
+    if (inline !== undefined) {
+        try {
+            files.push({ name: `${name} (inline source map)`, text: atob(inline) });
+        }
+        catch {
+            // An unreadable inline map is the output accounting's finding, not this scan's.
+        }
+    }
+    return files;
+}
+/** How a finding names a module: app-relative inside the app, from `node_modules/` for a package. */
+export function originName(appRoot, file) {
+    const rel = relative(appRoot, file).replaceAll("\\", "/");
+    if (!rel.startsWith("../") && !isAbsolute(rel))
+        return rel;
+    const at = file.replaceAll("\\", "/").lastIndexOf("/node_modules/");
+    return at === -1 ? file : file.replaceAll("\\", "/").slice(at + 1);
+}
+/**
+ * The scan's view of a client graph: the first-party browser modules as sources, and for each emitted
+ * file (by basename) the modules bundled into it.
+ */
+export function graphScanInput(graph, sourceOf, classifier) {
+    const sources = [];
+    const fileOf = (id) => {
+        const source = sourceOf(id);
+        return source.kind === "file" ? source.file : undefined;
+    };
+    for (const id of Object.keys(graph.modules)) {
+        const file = fileOf(id);
+        if (file === undefined)
+            continue;
+        const zone = classifier.classify(file).zone;
+        if (zone !== "route-frontend" && zone !== "frontend" && zone !== "shared")
+            continue;
+        let text;
+        try {
+            text = readFileSync(file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        sources.push({ name: originName(classifier.appRoot, file), text, firstParty: true });
+    }
+    const byOutput = new Map();
+    for (const [output, chunk] of Object.entries(graph.chunks)) {
+        const origins = chunk.modules
+            .map(fileOf)
+            .filter((file) => file !== undefined)
+            .map((path) => ({ name: originName(classifier.appRoot, path), path }));
+        byOutput.set(basename(output), origins);
+    }
+    return { sources, originsOf: (outputName) => byOutput.get(basename(outputName)) ?? [] };
+}
+/** Every file under a `public/` directory, named as the app sees it (`public/robots.txt`). */
+export function publicScanFiles(dir, label) {
+    const files = [];
+    for (const entry of readdirSync(dir, { recursive: true })) {
+        const path = join(dir, entry);
+        let bytes;
+        try {
+            if (!statSync(path).isFile())
+                continue;
+            bytes = readFileSync(path);
+        }
+        catch {
+            continue;
+        }
+        const text = textOf(bytes);
+        if (text !== undefined) {
+            files.push({ name: `${label}/${entry.replaceAll("\\", "/")}`, text });
+        }
+    }
+    return files;
+}
+//# sourceMappingURL=secret-scan.js.map

package/dist/internal/secret-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../../src/internal/secret-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAGhE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAexD,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAa;IACrD,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,iBAAiB;IACjB,mBAAmB;CACpB,CAAC,CAAA;AAyEF;mDACmD;AACnD,MAAM,WAAW,GAA0B;IACzC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,gCAAgC,EAAE;IACxE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,yCAAyC,EAAE;IACjF,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,8BAA8B,EAAE;IAC1E;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,gEAAgE;KAC1E;IACD,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACrE;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EACL,4FAA4F;KAC/F;IACD,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,iDAAiD,EAAE;IACzF,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,+CAA+C,EAAE;IACtF,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC1D,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC7D,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0BAA0B,EAAE;CAC3D,CAAA;AAED,oGAAoG;AACpG,MAAM,WAAW,GACf,wFAAwF,CAAA;AAE1F,MAAM,cAAc,GAClB,qGAAqG,CAAA;AAEvG,MAAM,GAAG,GAAG,qEAAqE,CAAA;AAEjF,MAAM,WAAW,GACf,kMAAkM,CAAA;AAEpM;;iGAEiG;AACjG,MAAM,QAAQ,GACZ,uIAAuI,CAAA;AAEzI,MAAM,iBAAiB,GACrB,sFAAsF,CAAA;AAExF,2DAA2D;AAC3D,MAAM,YAAY,GAChB,yGAAyG,CAAA;AAE3G,6CAA6C;AAC7C,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAA;QAC9B,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,sGAAsG;AACtG,SAAS,WAAW,CAAC,KAAa,EAAE,SAAiB;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9D,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QACnF,OAAO,KAAK,CAAA;IACd,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACpC,OAAO,OAAO,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAA;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACpE,OAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC,IAAI,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,OAAO,GAAY,EAAE,CAAA;IAC3B,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,8EAA8E;QAC9E,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,cAAc,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACd,IAAI,EAAE,kBAAkB;aACzB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;IAChG,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/B,6FAA6F;QAC7F,0CAA0C;QAC1C,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAQ;QAC1F,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACd,IAAI,EAAE,qBAAqB;SAC5B,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,OAAO,GAAY,EAAE,CAAA;IAC3B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,SAAQ;QACxF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACpD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC;YAAE,SAAQ;QAC5F,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5C,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,wBAAwB,IAAI,GAAG;SACtC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,kGAAkG;AAClG,iDAAiD;AACjD,MAAM,WAAW,GACf,gXAAgX,CAAA;AAElX,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,QAAQ;IACR,MAAM;IACN,SAAS;IACT,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,KAAK;IACL,KAAK;IACL,MAAM;IACN,QAAQ;IACR,SAAS;CACV,CAAC,CAAA;AACF,MAAM,cAAc,GAClB,4GAA4G,CAAA;AAE9G,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAC9C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI;SACD,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;AAElD,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,4FAA4F;IAC5F,2FAA2F;IAC3F,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACzB,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,MAAM,IAAI,IAAI,OAAO;YAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3F,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC1D,IAAI,GAAG,KAAK,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAQD,kGAAkG;AAClG,SAAS,UAAU,CACjB,GAAiD,EACjD,MAAc;IAEd,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAgB,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC1F,SAAQ;QACV,CAAC;QACD,yEAAyE;QACzE,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAQ;QACrC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC9C,MAAM,aAAa,GAAG,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC;YAAE,SAAQ;QACjE,MAAM,KAAK,GAAuB,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;QAClD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAQ,EAAE;YAClD,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;gBAC7E,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC,CAAA;QACD,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAA;QAC7C,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,GAAG,CACD,cAAc,EACd,KAAK;aACF,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;aACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;aACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;aACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAC7B,CAAA;QACD,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACnE,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,OAA6B;IAC7D,MAAM,OAAO,GAAY,EAAE,CAAA;IAC3B,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,mBAAmB;YACzB,KAAK;YACL,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,YAAY,GAAG,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,EAAE;YAC5D,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE;IACrD,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;QAAE,IAAI,EAAE,CAAA;IAC7F,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,KAAY,EAAU,EAAE,CACvC,KAAK,CAAC,IAAI,KAAK,mBAAmB;IAChC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ;IAC9B,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,SAAS,CAAA;AAEjE,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,UAAsC;IAC3E,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAA;QACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,wBAAwB,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC3G,CAAA;QACH,CAAC;QACD,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,iDAAiD,CAAC,CAAA;QACxF,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,KAAK,EAAE,CAAA;QACxE,MAAM,GAAG,GAAG,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,KAAK,EAAE,CAAA;QACrE,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,oBAAoB,SAAS,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,8DAA8D,CAC1K,CAAA;QACH,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAsB;IACnD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAA;IACzC,sBAAsB,CAAC,UAAU,CAAC,CAAA;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,eAAe,IAAI,SAAS,CAAC,CAAA;IAC/E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAY,EAAW,EAAE,CACrD,UAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAC7B,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CACxF,CAAA;IACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAA;IACzD,MAAM,UAAU,GAAG,CAAC,MAAoB,EAAsB,EAAE;QAC9D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,IAAwB,CAAA;YAC5B,IAAI,CAAC;gBACH,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,SAAS,CAAA;YAClB,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACpC,CAAC;QACD,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAE,QAAiB,EAAQ,EAAE;QAC7D,MAAM,OAAO,GAAG;YACd,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;SAClC,CAAA;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAA;YAC1C,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAQ;YACxC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAA;YACjE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACxC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;gBAC/B,MAAM,KAAK,GAAG,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;gBAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACvC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;oBACvC,MAAK;gBACP,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,SAAQ;YAC3F,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC;gBAC/B,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACpD,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC;aACxB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACxD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC3D,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAC5F,CAAA;AACH,CAAC;AAED,MAAM,WAAW,GAAG,mDAAmD,CAAA;AACvE,MAAM,iBAAiB,GACrB,0HAA0H,CAAA;AAE5H;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAiD,EACjD,eAAe,GAAG,SAAS;IAE3B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAClG,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAChC,IAAI,GAAG,GAAG,IAAI,CAAA;QACd,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,IAAI,GAAG,CAAC,CAAA;QAC9E,CAAC;QACD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAA;QACxD,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,WAAW;YAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,IAAI,GAAG,CAAC,CAAA;QAC7F,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;QACxC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,QAAgB,EAAE,EAAE;QAC1E,8FAA8F;QAC9F,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI;YAC7C,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,QAAQ,GAAG,EAAE,cAAc,CAAC,CACnD,CAAA;QACD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,CAAA;QAC/C,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAA;IACzD,CAAC,CAAA;AACH,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAiD,EAAE,CACjF,CAAC,OAAO,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAA;AAEnE,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,OAAO,GAAG,oBAAoB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAA;IAC3D,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;AACrD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,oBAAoB,CAAC,QAAkC;IACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CACxB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CACvJ,CAAA;IACD,OAAO;QACL,mEAAmE;QACnE,GAAG,KAAK;QACR,mGAAmG;QACnG,wFAAwF;QACxF,+FAA+F;KAChG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,UAAU,GACd,8FAA8F,CAAA;AAEhG,+FAA+F;AAC/F,MAAM,UAAU,MAAM,CAAC,KAAiB;IACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACzD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,IAAY,EACZ,OAAiC;IAEjC,MAAM,KAAK,GAAqB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACjF,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,sBAAsB,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,IAAY;IACtD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAA;IAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAA;IACnE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAwB,EACxB,QAAsC,EACtC,UAA0B;IAE1B,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,MAAM,MAAM,GAAG,CAAC,EAAU,EAAsB,EAAE;QAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC3B,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACzD,CAAC,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;QACvB,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAChC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;QAC3C,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ;YAAE,SAAQ;QACnF,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAA;IAClD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO;aAC1B,GAAG,CAAC,MAAM,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;aACpD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACxE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;AACzF,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,KAAa;IACxD,MAAM,KAAK,GAAqB,EAAE,CAAA;IAClC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAa,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC7B,IAAI,KAAiB,CAAA;QACrB,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAQ;YACtC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/internal/server-boundary.d.ts

@@ -1,39 +1,16 @@
 /**
- * The server/client boundary, owned in one place.
+ * The client-build transforms that every pipeline must apply identically - the Bun client build, the
+ * Vite dev server, the Vite production build, and `nifra dev --bun`:
  *
- * The client build must never ship server-only code, or server-only config, to a browser. Three
- * conventions enforce that, and each has to mean the SAME thing in every pipeline that builds the client
- * - the Bun client build, the Vite dev server, the Vite production build, and `nifra dev --bun`:
- *
- *   - `*.server` modules - emptied, so a secret / `node:` / native import subtree never reaches the client.
  *   - `*.fn` modules     - replaced with HTTP stubs, so the function bodies (and their imports) stay server-side.
  *   - public-env prefix  - which environment variables the client bundle is allowed to inline.
  *
- * When each pipeline re-encoded one of these rules, they drifted. A hand-written glob
- * `**\/*.server.{ts,tsx,js,jsx}` missed the extensionless `db.server` and the `.mts`/`.cts`/`.mjs`/`.cjs`
- * forms the regex matches, waving a module the build empties straight into the browser. So the matchers,
- * the replacement bodies, and the env mapping get exactly one definition here; every pipeline imports it,
- * and parity tests assert the Bun and Vite halves emit identical bytes. A matcher that decides whether a
- * secret can reach a browser gets one owner, not four.
+ * Which files may reach a browser at all is the zone classifier's job (`zones.ts`). These two get one
+ * definition here so the Bun and Vite halves emit identical bytes; a copied-then-edited second version
+ * is how a client that works in dev and 404s in production happens.
  */
-/** Matches `db.server.ts`, `auth.server.tsx`, `x.server.mjs`, and the extensionless `foo.server`. */
-export declare const SERVER_ONLY_MODULE: RegExp;
-/** Modules whose exports become client stubs. Mirrors the `.server` convention's shape. */
+/** Modules whose exports become client stubs: `todos.fn.ts`, `x.fn.mjs`, or the extensionless `foo.fn`. */
 export declare const SERVER_FN_MODULE: RegExp;
-/**
- * The replacement body for an emptied module. A Proxy rather than `export {}` so any named OR default
- * import resolves to `undefined` instead of failing the bundle with a missing-export error - the client
- * degrades at the call site it wrote, not at link time in a file it never named.
- *
- * Shared so the Bun and Vite pipelines emit the same bytes; a parity test asserts it.
- */
-export declare const SERVER_ONLY_REPLACEMENT = "module.exports = new Proxy({}, { get: () => undefined })";
-/**
- * Vite dev serves native ESM, so the Bun/CommonJS proxy above is invalid there. Emit inert ESM
- * bindings derived from the source's public names while discarding the implementation and imports.
- * An unsupported exotic export fails closed at ESM link time; server code is never served as fallback.
- */
-export declare function viteServerOnlyReplacement(source: string): string;
 /**
  * The namespace a `*.fn.ts` module is mounted under: its filename without the `.fn` suffix.
  *

package/dist/internal/server-boundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-boundary.d.ts","sourceRoot":"","sources":["../../src/internal/server-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,qGAAqG;AACrG,eAAO,MAAM,kBAAkB,QAA+B,CAAA;AAC9D,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,QAA2B,CAAA;AAMxD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,6DAA6D,CAAA;AAQjG;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAyBhE;AA+DD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,+DAA+D;AAC/D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAa5D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAmC9E;AAMD,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKtE"}
+{"version":3,"file":"server-boundary.d.ts","sourceRoot":"","sources":["../../src/internal/server-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,2GAA2G;AAC3G,eAAO,MAAM,gBAAgB,QAA2B,CAAA;AAiExD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,+DAA+D;AAC/D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAa5D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAmC9E;AAMD,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKtE"}