@oscharko-dev/keiko-server 0.2.0

package/dist/credentialVault.js

@@ -0,0 +1,206 @@
+// Provider-credential vault policy (Issue #1320, Epic #1319).
+//
+// This is the local, dependency-light glue between the generic AES-256-GCM secret vault
+// (@oscharko-dev/keiko-security/secret-vault) and the Model Gateway config. It owns:
+//   - the stable, NON-SECRET reference scheme persisted in keiko.config.json (`cred:<modelId>`),
+//   - where the encrypted provider-credential store lives (a `credentials/` dir next to the config),
+//   - the env -> keychain -> keyfile key namespace for that store,
+//   - the read-side resolver the gateway/CLI inject to turn a reference back into a real apiKey,
+//   - the write-side transform that seals provider apiKeys and strips plaintext from the config.
+//
+// It deliberately imports nothing heavy (no server barrel, no SQLite, no Figma orchestration) so the
+// offline `keiko run` and `keiko repair` commands can resolve/detect credentials without loading the
+// full BFF runtime. Figma PAT routing and the migration orchestration live in credentialPersistence.
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { createLocalSecretVault, readLocalVaultReferences, resolveLocalVaultKey, } from "@oscharko-dev/keiko-security/secret-vault";
+const CREDENTIALS_SUBDIR = "credentials";
+const CREDENTIALS_STORE_FILE = "provider-credentials.vault";
+const CREDENTIALS_KEYFILE = "provider-credentials-vault.key";
+const CREDENTIALS_KEY_ENV = "KEIKO_PROVIDER_CREDENTIALS_KEY";
+const CREDENTIALS_KEYCHAIN_SERVICE = "keiko-provider-credentials-vault";
+// The reference prefix is an opaque, NON-SECRET marker stored in plaintext config alongside the
+// (separately keyed) sealed material. It is derived from the provider modelId — already present in
+// the same config entry — so it is stable across re-saves and migrations and leaks nothing new.
+export const PROVIDER_SECRET_REF_PREFIX = "cred:";
+export function providerSecretRef(modelId) {
+    return `${PROVIDER_SECRET_REF_PREFIX}${modelId}`;
+}
+// The credential store lives next to keiko.config.json so a copied or synced config directory carries
+// only its separately-keyed ciphertext — never plaintext, and never the key when env/keychain tiers
+// are in use.
+export function credentialVaultDir(configPath) {
+    return join(dirname(configPath), CREDENTIALS_SUBDIR);
+}
+export function credentialStorePath(configPath) {
+    return join(credentialVaultDir(configPath), CREDENTIALS_STORE_FILE);
+}
+export function openProviderCredentialVault(options) {
+    const vaultDir = credentialVaultDir(options.configPath);
+    const { key } = resolveLocalVaultKey({
+        env: options.env,
+        vaultDir,
+        envVarName: CREDENTIALS_KEY_ENV,
+        keychainService: CREDENTIALS_KEYCHAIN_SERVICE,
+        keyfileName: CREDENTIALS_KEYFILE,
+        ...(options.keychainAccess !== undefined ? { keychainAccess: options.keychainAccess } : {}),
+    });
+    return createLocalSecretVault({ key, storePath: credentialStorePath(options.configPath) });
+}
+// A crypto-free resolver for the gateway/CLI: maps `cred:<modelId>` to its plaintext secret. It is
+// store-existence-gated so a config without vaulted credentials (env-only or legacy plaintext) never
+// triggers key generation, and degrades to undefined on any vault fault so a locked/tampered vault
+// surfaces as the gateway's honest "apiKey must be set" config error rather than a crash.
+export function createProviderSecretResolver(options) {
+    const storePath = credentialStorePath(options.configPath);
+    let vault;
+    return (reference) => {
+        if (!existsSync(storePath))
+            return undefined;
+        try {
+            vault ??= openProviderCredentialVault(options);
+            return vault.get(reference);
+        }
+        catch {
+            return undefined;
+        }
+    };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function envModelToken(modelId) {
+    return modelId.replace(/[^A-Za-z0-9]/g, "_").toUpperCase();
+}
+// True when the environment supplies the exact same effective apiKey, so it must NOT be persisted
+// (env credentials stay transient and are never written back to disk). If an env override differs
+// from the file value, the file value is still a durable configured credential and must be vaulted so
+// behavior survives after the temporary env override is removed.
+export function isEnvProvidedApiKey(modelId, apiKey, env) {
+    const perModel = env[`KEIKO_MODEL_${envModelToken(modelId)}_API_KEY`];
+    if (perModel !== undefined && perModel.length > 0 && perModel === apiKey) {
+        return true;
+    }
+    const defaultKey = env.KEIKO_DEFAULT_API_KEY;
+    return defaultKey !== undefined && defaultKey.length > 0 && defaultKey === apiKey;
+}
+function stripCredentialFields(provider) {
+    const out = {};
+    for (const [key, value] of Object.entries(provider)) {
+        if (key !== "apiKey" && key !== "apiKeySecretRef") {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+function existingSecretRef(provider) {
+    const value = provider.apiKeySecretRef;
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function providerWithSecretRef(cleaned, reference) {
+    return { provider: { ...cleaned, apiKeySecretRef: reference }, activeSecretRef: reference };
+}
+function planPlaintextProviderCredential(modelId, apiKey, cleaned, configuredRef, env, vaultedRefs, toSeal) {
+    const reference = providerSecretRef(modelId);
+    if (!isEnvProvidedApiKey(modelId, apiKey, env)) {
+        toSeal.set(reference, apiKey);
+        return providerWithSecretRef(cleaned, reference);
+    }
+    // Env override: preserve the durable vaulted credential + its reference if one already exists.
+    const durableRef = configuredRef ?? reference;
+    return vaultedRefs.has(durableRef) ? providerWithSecretRef(cleaned, durableRef) : { provider: cleaned };
+}
+function planReferenceOnlyProviderCredential(modelId, cleaned, configuredRef, vaultedRefs) {
+    // No plaintext: keep an explicit reference as-is. If the config omitted a reference but a durable
+    // vault entry for the model already exists, preserve that entry through a re-save.
+    const reference = providerSecretRef(modelId);
+    const ref = configuredRef ?? (vaultedRefs.has(reference) ? reference : undefined);
+    return ref === undefined ? { provider: cleaned } : providerWithSecretRef(cleaned, ref);
+}
+// Decides how a single provider is persisted, given the references already present in the vault:
+//   - a non-env plaintext key is sealed into the vault and the provider carries its reference;
+//   - an env-provided key whose durable credential is ALREADY vaulted keeps its reference and its
+//     vaulted value untouched (env is a transient override layered over the durable secret, so the
+//     vault entry must survive an env var being later unset — Issue #1320 / review blocker);
+//   - a reference-bearing provider with no plaintext (an already-migrated entry) keeps its reference;
+//   - a pure-env or referenceless provider is stripped (env stays transient, nothing persists).
+// `toSeal` is populated only with new non-env values. Stale refs are pruned only after the config
+// rewrite succeeds, so an already reference-only config is never left pointing at deleted vault
+// material after a crash.
+function planProviderCredential(provider, env, vaultedRefs, toSeal) {
+    const modelId = typeof provider.modelId === "string" ? provider.modelId : "";
+    const apiKey = typeof provider.apiKey === "string" ? provider.apiKey : "";
+    const cleaned = stripCredentialFields(provider);
+    if (modelId.length === 0) {
+        return { provider: cleaned };
+    }
+    const configuredRef = existingSecretRef(provider);
+    if (apiKey.length > 0) {
+        return planPlaintextProviderCredential(modelId, apiKey, cleaned, configuredRef, env, vaultedRefs, toSeal);
+    }
+    return planReferenceOnlyProviderCredential(modelId, cleaned, configuredRef, vaultedRefs);
+}
+// Seals each persistable provider apiKey into the credential vault and returns the providers array
+// rewritten to carry an `apiKeySecretRef` instead of the plaintext `apiKey`. Vault writes happen
+// FIRST (before the caller rewrites the config) so a crash leaves the old plaintext config in place
+// and the next migration re-runs idempotently. Pure env credentials are dropped entirely (no
+// reference, no vault entry), while env overrides layered over an existing durable vault entry keep
+// that reference. Stale refs are pruned only after the config rewrite succeeds, so an already
+// reference-only config is never left pointing at deleted vault material after a crash.
+export function prepareSealedProviderApiKeys(options) {
+    const providersRaw = Array.isArray(options.raw.providers)
+        ? options.raw.providers
+        : [];
+    const vaultedRefs = new Set(readLocalVaultReferences(credentialStorePath(options.configPath)));
+    const vaultEntries = new Map();
+    const activeSecretRefs = new Set();
+    const sealedProviders = providersRaw.map((provider) => {
+        if (!isRecord(provider)) {
+            return provider;
+        }
+        const planned = planProviderCredential(provider, options.env, vaultedRefs, vaultEntries);
+        if (planned.activeSecretRef !== undefined) {
+            activeSecretRefs.add(planned.activeSecretRef);
+        }
+        return planned.provider;
+    });
+    persistVaultEntries(options, vaultEntries);
+    return { providers: sealedProviders, activeSecretRefs: [...activeSecretRefs] };
+}
+function persistVaultEntries(options, entries) {
+    if (entries.size === 0)
+        return;
+    const vault = openProviderCredentialVault(options);
+    for (const [reference, secret] of entries) {
+        vault.set(reference, secret);
+    }
+}
+export function pruneProviderCredentialVault(options, activeSecretRefs) {
+    const storePath = credentialStorePath(options.configPath);
+    if (!existsSync(storePath))
+        return;
+    const active = new Set(activeSecretRefs);
+    const vault = openProviderCredentialVault(options);
+    for (const reference of vault.list()) {
+        if (!active.has(reference)) {
+            vault.delete(reference);
+        }
+    }
+}
+export function sealProviderApiKeys(options) {
+    const sealed = prepareSealedProviderApiKeys(options);
+    return sealed.providers;
+}
+// Structural detector for an UNMIGRATED or partially migrated config: any provider still carrying a
+// plaintext apiKey, or a figma block still carrying a plaintext accessToken. Pure and read-only —
+// `keiko repair` uses it to flag an incomplete credential migration without opening any vault.
+export function hasPlaintextGatewayCredentials(raw) {
+    if (!isRecord(raw)) {
+        return false;
+    }
+    const providers = Array.isArray(raw.providers) ? raw.providers : [];
+    const providerHasPlaintext = providers.some((provider) => isRecord(provider) && typeof provider.apiKey === "string" && provider.apiKey.length > 0);
+    const figma = raw.figma;
+    const figmaHasPlaintext = isRecord(figma) && typeof figma.accessToken === "string" && figma.accessToken.trim().length > 0;
+    return providerHasPlaintext || figmaHasPlaintext;
+}

package/dist/csp.d.ts

@@ -0,0 +1,3 @@
+export declare function extractInlineScriptHashes(htmlDocuments: readonly string[]): readonly string[];
+export declare function buildCspHeader(scriptHashes: readonly string[]): string;
+//# sourceMappingURL=csp.d.ts.map

package/dist/csp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../src/csp.ts"],"names":[],"mappings":"AAoCA,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAgB7F;AAKD,wBAAgB,cAAc,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAsBtE"}

package/dist/csp.js

@@ -0,0 +1,75 @@
+// Hash-based Content-Security-Policy support (ADR-0011 D5, risk #1). The Next static export emits
+// inline RSC-bootstrap `<script>` blocks (`self.__next_f.push(...)`). The BFF serves
+// `script-src 'self'` with NO `'unsafe-inline'`, so each distinct inline script must be allowed by
+// its SHA-256 hash. `extractInlineScriptHashes` computes those hashes from exported HTML at build
+// time; `buildCspHeader` folds them into the policy the BFF sets on every response.
+//
+// The SHA-256 base64 primitive is sourced from @oscharko-dev/keiko-security so the CSP hash and the
+// rest of Keiko's content hashing share one audited cryptographic boundary.
+import { sha256Base64 } from "@oscharko-dev/keiko-security";
+// `/\bsrc\s*=/i` matches an attribute key only — no `<`/`>` involved, so it does not trigger
+// CodeQL js/bad-tag-filter (which fires on regexes that structurally match HTML tags).
+const SRC_ATTRIBUTE_PATTERN = /\bsrc\s*=/i;
+// Finds the next inline-script body starting at cursor `i`, using a case-insensitive indexOf scan
+// rather than a tag-matching regex (eliminates the CodeQL js/bad-tag-filter class entirely). Body
+// is sliced from original-case `html` so the SHA-256 matches what the browser executes.
+function nextInlineScript(html, lower, i) {
+    const open = lower.indexOf("<script", i);
+    if (open === -1)
+        return null;
+    const openEnd = lower.indexOf(">", open);
+    if (openEnd === -1)
+        return null;
+    const close = lower.indexOf("</script", openEnd + 1);
+    if (close === -1)
+        return null;
+    const closeEnd = lower.indexOf(">", close);
+    const next = closeEnd === -1 ? close + 8 : closeEnd + 1;
+    return { openTag: html.slice(open, openEnd + 1), body: html.slice(openEnd + 1, close), next };
+}
+// Returns the distinct `'sha256-...'` CSP source tokens for every inline script across the given
+// HTML documents, in stable sorted order so the generated policy is deterministic.
+export function extractInlineScriptHashes(htmlDocuments) {
+    const tokens = new Set();
+    for (const html of htmlDocuments) {
+        const lower = html.toLowerCase();
+        let i = 0;
+        for (;;) {
+            const found = nextInlineScript(html, lower, i);
+            if (found === null)
+                break;
+            const { openTag, body, next } = found;
+            if (!SRC_ATTRIBUTE_PATTERN.test(openTag) && body.length > 0) {
+                tokens.add(`'sha256-${sha256Base64(body)}'`);
+            }
+            i = next;
+        }
+    }
+    return [...tokens].sort();
+}
+// Builds the full CSP header value. `scriptHashes` are folded into `script-src` alongside `'self'`.
+// `style-src` keeps `'unsafe-inline'` for Tailwind's injected styles (the only permitted inline
+// source); `script-src` never receives `'unsafe-inline'` or `'unsafe-eval'`.
+export function buildCspHeader(scriptHashes) {
+    const scriptSrc = ["'self'", ...scriptHashes].join(" ");
+    return [
+        "default-src 'none'",
+        `script-src ${scriptSrc}`,
+        "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' data:",
+        "connect-src 'self'",
+        "font-src 'self'",
+        // `manifest-src 'self'` is required for the PWA manifest at /manifest.webmanifest to load
+        // under our `default-src 'none'` fallback (browsers will otherwise refuse the fetch). The
+        // directive is strictly additive and does not loosen any existing source allow-list.
+        "manifest-src 'self'",
+        // `worker-src 'self'` is required for the service worker at /sw.js to register under the
+        // `default-src 'none'` fallback (issue #126, ADR-0024 D6). The SW script itself is loaded
+        // by the existing `script-src 'self'`; this directive controls worker creation. Strictly
+        // additive — no existing source allow-list is loosened.
+        "worker-src 'self'",
+        "base-uri 'none'",
+        "form-action 'none'",
+        "frame-ancestors 'none'",
+    ].join("; ");
+}

package/dist/deps.d.ts

@@ -0,0 +1,78 @@
+import { type EnvSource, type GatewayConfig } from "@oscharko-dev/keiko-model-gateway";
+import type { ModelPort } from "@oscharko-dev/keiko-harness";
+import type { EvidenceStore } from "@oscharko-dev/keiko-evidence";
+import type { RunRegistry } from "./runs.js";
+import { type UiStore } from "./store/index.js";
+import { type TerminalExecutionManager } from "./terminal.js";
+import { type BrowserSessionManager } from "@oscharko-dev/keiko-tools";
+import { type MemoryVaultStore } from "@oscharko-dev/keiko-memory-vault";
+import { type ConsolidationJobRegistry } from "./memory-consolidation-registry.js";
+import type { OpenAIEmbeddingBatchOutcome, OpenAIEmbeddingBatchRequest, OpenAIEmbeddingOutcome, OpenAIEmbeddingRequest } from "@oscharko-dev/keiko-model-gateway";
+import { type RelationshipHandlerDeps } from "./relationship-handlers.js";
+import { type GroundingLimits } from "@oscharko-dev/keiko-contracts/bff-wire";
+import type { EditorLanguageRouteOptions } from "./editor/languageRoutes.js";
+import type { KnowledgeStoreKeyProvider } from "@oscharko-dev/keiko-local-knowledge";
+import { type QiRetentionAuditSink } from "./qualityIntelligence/retentionEnforcement.js";
+export type Redactor = (value: unknown) => unknown;
+export type ModelPortFactory = (modelId: string) => ModelPort | undefined;
+type GatewayEgressConfig = NonNullable<GatewayConfig["egress"]>;
+export interface RuntimeGatewayConfig {
+    readonly storagePath: string;
+    current(): GatewayConfig | undefined;
+    present(): boolean;
+    set(config: GatewayConfig | undefined, present: boolean): void;
+}
+export interface UiHandlerDeps {
+    readonly config: GatewayConfig | undefined;
+    readonly configPresent: boolean;
+    readonly evidenceStore: EvidenceStore;
+    readonly env: EnvSource;
+    readonly egress?: GatewayEgressConfig | undefined;
+    readonly redactor: Redactor;
+    readonly registry: RunRegistry;
+    readonly modelPortFactory: ModelPortFactory;
+    readonly redactionSecrets?: readonly string[] | undefined;
+    readonly store: UiStore;
+    readonly uiDbPath?: string | undefined;
+    readonly preferredProjectPath?: string | undefined;
+    readonly terminal?: TerminalExecutionManager | undefined;
+    readonly browser?: BrowserSessionManager | undefined;
+    readonly memoryVault?: MemoryVaultStore | undefined;
+    readonly consolidationJobs?: ConsolidationJobRegistry | undefined;
+    readonly gatewayConfig?: RuntimeGatewayConfig | undefined;
+    readonly gatewaySetupTester?: ((config: GatewayConfig, candidateModelIds: readonly string[]) => Promise<readonly string[]>) | undefined;
+    readonly gatewayModelDiscovery?: ((baseUrl: string, apiKey: string, apiKeyHeaderName?: string, egress?: GatewayEgressConfig) => Promise<readonly string[]>) | undefined;
+    readonly figmaCredentialTester?: ((accessToken: string, egress?: GatewayEgressConfig) => Promise<void>) | undefined;
+    readonly editorLanguageRouteOptions?: EditorLanguageRouteOptions | undefined;
+    readonly localKnowledgeEmbeddingRequest?: ((request: OpenAIEmbeddingRequest) => Promise<OpenAIEmbeddingOutcome>) | undefined;
+    readonly localKnowledgeEmbeddingBatchRequest?: ((request: OpenAIEmbeddingBatchRequest) => Promise<OpenAIEmbeddingBatchOutcome>) | undefined;
+    readonly relationship?: RelationshipHandlerDeps | undefined;
+    readonly evidenceDir?: string | undefined;
+    readonly localKnowledgeKeyProvider?: KnowledgeStoreKeyProvider | undefined;
+}
+export interface BuildHandlerDepsOptions {
+    readonly configPath: string | undefined;
+    readonly evidenceDir: string | undefined;
+    readonly env: EnvSource;
+    readonly registry?: RunRegistry | undefined;
+    readonly modelPortFactory?: ModelPortFactory | undefined;
+    readonly uiDbPath?: string | undefined;
+    readonly store?: UiStore | undefined;
+    readonly initialProjectPath?: string | undefined;
+    readonly gatewaySetupTester?: ((config: GatewayConfig, candidateModelIds: readonly string[]) => Promise<readonly string[]>) | undefined;
+    readonly gatewayModelDiscovery?: ((baseUrl: string, apiKey: string, apiKeyHeaderName?: string, egress?: GatewayEgressConfig) => Promise<readonly string[]>) | undefined;
+    readonly figmaCredentialTester?: ((accessToken: string, egress?: GatewayEgressConfig) => Promise<void>) | undefined;
+    readonly qiRetentionAuditSink?: QiRetentionAuditSink | undefined;
+    readonly qiRetentionNow?: (() => number) | undefined;
+}
+export declare function currentGatewayConfig(deps: UiHandlerDeps): GatewayConfig | undefined;
+export declare function currentGatewayConfigPresent(deps: UiHandlerDeps): boolean;
+export declare function currentGatewayEgressConfig(deps: Pick<UiHandlerDeps, "config" | "gatewayConfig" | "env" | "egress">): GatewayEgressConfig | undefined;
+export declare function currentGroundingLimits(deps: UiHandlerDeps): GroundingLimits;
+export type { GroundingLimits };
+export declare function buildRedactor(env: EnvSource, config?: GatewayConfig): Redactor;
+export declare function currentRedactionSecrets(deps: UiHandlerDeps): readonly string[];
+export declare function currentEvidenceTopologyRedactionSecrets(deps: UiHandlerDeps): readonly string[];
+export declare function currentEvidenceRequiresFullStringRedaction(deps: UiHandlerDeps): boolean;
+export declare function buildUiHandlerDeps(options: BuildHandlerDepsOptions): UiHandlerDeps;
+//# sourceMappingURL=deps.d.ts.map

package/dist/deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../src/deps.ts"],"names":[],"mappings":"AAQA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,mCAAmC,CAAC;AAG3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAQ7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAML,KAAK,OAAO,EACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAkC,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAA+B,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAGzE,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAG7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,+CAA+C,CAAC;AAIvD,MAAM,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;AAMnD,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,SAAS,CAAC;AAC1E,KAAK,mBAAmB,GAAG,WAAW,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;AAEhE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,IAAI,aAAa,GAAG,SAAS,CAAC;IACrC,OAAO,IAAI,OAAO,CAAC;IACnB,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAChE;AAED,MAAM,WAAW,aAAa;IAE5B,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,CAAC;IAE3C,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAEhC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAEtC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAElD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAE5B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAE/B,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAE5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAG1D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAGxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAGvC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAGnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAGzD,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAGrD,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAEpD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAGlE,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAE1D,QAAQ,CAAC,kBAAkB,CAAC,EACxB,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC,GAC7F,SAAS,CAAC;IAEd,QAAQ,CAAC,qBAAqB,CAAC,EAC3B,CAAC,CACC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,EAAE,MAAM,EACzB,MAAM,CAAC,EAAE,mBAAmB,KACzB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC,GAChC,SAAS,CAAC;IAEd,QAAQ,CAAC,qBAAqB,CAAC,EAC3B,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GACtE,SAAS,CAAC;IAGd,QAAQ,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IAG7E,QAAQ,CAAC,8BAA8B,CAAC,EACpC,CAAC,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC,GACtE,SAAS,CAAC;IAId,QAAQ,CAAC,mCAAmC,CAAC,EACzC,CAAC,CAAC,OAAO,EAAE,2BAA2B,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC,GAChF,SAAS,CAAC;IAId,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAI5D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAK1C,QAAQ,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;CAC5E;AAED,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAExC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAE5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAGzD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEvC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAGrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjD,QAAQ,CAAC,kBAAkB,CAAC,EACxB,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC,GAC7F,SAAS,CAAC;IAEd,QAAQ,CAAC,qBAAqB,CAAC,EAC3B,CAAC,CACC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,EAAE,MAAM,EACzB,MAAM,CAAC,EAAE,mBAAmB,KACzB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC,GAChC,SAAS,CAAC;IAEd,QAAQ,CAAC,qBAAqB,CAAC,EAC3B,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GACtE,SAAS,CAAC;IAId,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CACtD;AA2HD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,SAAS,CAEnF;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAExE;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,eAAe,GAAG,KAAK,GAAG,QAAQ,CAAC,GACvE,mBAAmB,GAAG,SAAS,CAOjC;AA0CD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,CAG3E;AAGD,YAAY,EAAE,eAAe,EAAE,CAAC;AA8FhC,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,QAAQ,CAS9E;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,MAAM,EAAE,CAE9E;AAED,wBAAgB,uCAAuC,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,MAAM,EAAE,CAO9F;AAED,wBAAgB,0CAA0C,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAMvF;AA8LD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,uBAAuB,GAAG,aAAa,CAiDlF"}