@pellux/goodvibes-sdk 0.18.13 → 0.18.15

package/dist/_internal/platform/config/secrets.js

@@ -0,0 +1,444 @@
+/**
+ * SecretsManager — hierarchy-aware secret resolution and persistence.
+ *
+ * Resolution order:
+ *   1. Environment variable (process.env[key])
+ *   2. Project/ancestor secure stores (.goodvibes/goodvibes/secrets.enc), nearest first
+ *   3. Project/ancestor plaintext stores (.goodvibes/goodvibes.secrets.json), nearest first
+ *   4. User secure store (~/.goodvibes/goodvibes/secrets.enc)
+ *   5. User plaintext store (~/.goodvibes/goodvibes.secrets.json)
+ *   6. If a resolved value is a SecretRef, resolve through the referenced provider
+ *
+ * The active policy decides whether plaintext stores are eligible:
+ *   - plaintext_allowed  → read/write plaintext or secure
+ *   - preferred_secure   → prefer secure, allow plaintext fallback with warning
+ *   - require_secure     → never read/write plaintext
+ *
+ * Secret values are never logged.
+ */
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'crypto';
+import { dirname, isAbsolute, join, resolve } from 'path';
+import { hostname, userInfo } from 'os';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { getSecretRefSource, isSecretRefInput, resolveSecretRef } from '@pellux/goodvibes-sdk/platform/config/secret-refs';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils/logger';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils/error-display';
+function requireAbsoluteOwnedPath(path, name) {
+    const trimmed = path.trim();
+    if (!trimmed) {
+        throw new Error(`SecretsManager ${name} must be a non-empty absolute path.`);
+    }
+    if (!isAbsolute(trimmed)) {
+        throw new Error(`SecretsManager ${name} must be an absolute path.`);
+    }
+    return resolve(trimmed);
+}
+function normalizeOptionalOwnedPath(path, name) {
+    return path === undefined ? undefined : requireAbsoluteOwnedPath(path, name);
+}
+function deriveEncryptionKey() {
+    const seed = hostname() + userInfo().username + 'goodvibes-secrets';
+    return createHash('sha256').update(seed, 'utf8').digest();
+}
+function encrypt(plaintext, key) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return { iv: iv.toString('hex'), tag: tag.toString('hex'), data: encrypted.toString('hex') };
+}
+function decrypt(store, key) {
+    const iv = Buffer.from(store.iv, 'hex');
+    const tag = Buffer.from(store.tag, 'hex');
+    const data = Buffer.from(store.data, 'hex');
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
+    return decrypted.toString('utf8');
+}
+function loadConfiguredSecretPolicy(configManager) {
+    try {
+        return configManager?.get('storage.secretPolicy') ?? 'preferred_secure';
+    }
+    catch {
+        return 'preferred_secure';
+    }
+}
+function uniquePaths(paths) {
+    const seen = new Set();
+    const ordered = [];
+    for (const path of paths) {
+        const key = `${path.source}:${path.path}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        ordered.push(path);
+    }
+    return ordered;
+}
+function collectAncestorRoots(start) {
+    const roots = [];
+    let current = resolve(start);
+    while (true) {
+        roots.push(current);
+        const parent = dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return roots;
+}
+export class SecretsManager {
+    encKey;
+    options;
+    constructor(options) {
+        this.encKey = deriveEncryptionKey();
+        this.options = {
+            ...options,
+            projectRoot: requireAbsoluteOwnedPath(options.projectRoot, 'projectRoot'),
+            globalHome: requireAbsoluteOwnedPath(options.globalHome, 'globalHome'),
+            secureProjectFilePath: normalizeOptionalOwnedPath(options.secureProjectFilePath, 'secureProjectFilePath'),
+            secureUserFilePath: normalizeOptionalOwnedPath(options.secureUserFilePath, 'secureUserFilePath'),
+            plaintextProjectFilePath: normalizeOptionalOwnedPath(options.plaintextProjectFilePath, 'plaintextProjectFilePath'),
+            plaintextUserFilePath: normalizeOptionalOwnedPath(options.plaintextUserFilePath, 'plaintextUserFilePath'),
+        };
+    }
+    getGlobalHome() {
+        return this.options.globalHome;
+    }
+    async get(key) {
+        return this.getInternal(key, new Set([key]));
+    }
+    async getInternal(key, seen) {
+        const envValue = process.env[key];
+        if (envValue !== undefined) {
+            logger.debug('SecretsManager: resolved from env', { key });
+            return this.resolveMaybeReferencedValue(key, envValue, seen);
+        }
+        for (const path of this.getReadOrder()) {
+            const secrets = path.secure
+                ? this.readEncryptedFile(path.path)
+                : this.readPlaintextFile(path.path);
+            if (secrets !== null && key in secrets) {
+                logger.debug('SecretsManager: resolved from store', { key, source: path.source });
+                const value = secrets[key];
+                return value === undefined ? null : this.resolveMaybeReferencedValue(key, value, seen);
+            }
+        }
+        return null;
+    }
+    async resolveMaybeReferencedValue(key, value, seen) {
+        if (!isSecretRefInput(value))
+            return value;
+        try {
+            const resolved = await resolveSecretRef(value, {
+                resolveLocalSecret: async (nextKey) => {
+                    if (seen.has(nextKey)) {
+                        throw new Error(`Recursive GoodVibes secret reference for ${nextKey}`);
+                    }
+                    const nextSeen = new Set(seen);
+                    nextSeen.add(nextKey);
+                    return this.getInternal(nextKey, nextSeen);
+                },
+                homeDirectory: this.options.globalHome,
+            });
+            logger.debug('SecretsManager: resolved secret reference', { key, refSource: resolved.source });
+            return resolved.value;
+        }
+        catch (error) {
+            logger.warn('SecretsManager: failed to resolve secret reference', {
+                key,
+                refSource: getSecretRefSource(value) ?? 'unknown',
+                error: summarizeError(error),
+            });
+            return null;
+        }
+    }
+    async set(key, value, options = {}) {
+        const policy = this.getPolicy();
+        const medium = options.medium ?? this.getDefaultWriteMedium(policy);
+        const scope = options.scope ?? 'project';
+        if (policy === 'require_secure' && medium === 'plaintext') {
+            throw new Error('Secret policy require_secure forbids plaintext persistence');
+        }
+        const target = this.resolveWriteTarget(scope, medium);
+        const existing = target.secure
+            ? this.readEncryptedFile(target.path) ?? {}
+            : this.readPlaintextFile(target.path) ?? {};
+        existing[key] = value;
+        try {
+            if (target.secure) {
+                this.writeEncryptedFile(target.path, existing);
+            }
+            else {
+                this.writePlaintextFile(target.path, existing);
+            }
+            logger.debug('SecretsManager: stored secret', { key, source: target.source });
+            return;
+        }
+        catch (error) {
+            if (policy === 'preferred_secure' && target.secure) {
+                const fallback = this.resolveWriteTarget(scope, 'plaintext');
+                const fallbackExisting = this.readPlaintextFile(fallback.path) ?? {};
+                fallbackExisting[key] = value;
+                this.writePlaintextFile(fallback.path, fallbackExisting);
+                logger.warn('SecretsManager: secure write failed, fell back to plaintext', {
+                    key,
+                    path: fallback.path,
+                    error: summarizeError(error),
+                });
+                return;
+            }
+            throw error;
+        }
+    }
+    async list() {
+        const keys = new Set();
+        for (const path of this.getReadOrder()) {
+            const values = path.secure
+                ? this.readEncryptedFile(path.path)
+                : this.readPlaintextFile(path.path);
+            if (!values)
+                continue;
+            for (const key of Object.keys(values))
+                keys.add(key);
+        }
+        return [...keys].sort((a, b) => a.localeCompare(b));
+    }
+    async listDetailed() {
+        const envKeys = new Set(Object.keys(process.env));
+        const records = [];
+        for (const path of this.getReadOrder()) {
+            const values = path.secure
+                ? this.readEncryptedFile(path.path)
+                : this.readPlaintextFile(path.path);
+            if (!values)
+                continue;
+            for (const key of Object.keys(values)) {
+                const refSource = getSecretRefSource(values[key]);
+                records.push({
+                    key,
+                    source: path.source,
+                    scope: path.scope,
+                    secure: path.secure,
+                    path: path.path,
+                    overriddenByEnv: envKeys.has(key),
+                    ...(refSource ? { refSource } : {}),
+                });
+            }
+        }
+        for (const key of envKeys) {
+            records.push({
+                key,
+                source: 'env',
+                scope: 'env',
+                secure: false,
+                overriddenByEnv: false,
+            });
+        }
+        return records.sort((a, b) => a.key.localeCompare(b.key) || a.source.localeCompare(b.source));
+    }
+    async inspect() {
+        const policy = this.getPolicy();
+        const records = await this.listDetailed();
+        const storedRecords = records.filter((record) => record.source !== 'env');
+        const locations = uniquePaths(this.getAllCandidateStores()).map((path) => ({
+            source: path.source,
+            path: path.path,
+            exists: existsSync(path.path),
+            readable: (path.secure ? this.readEncryptedFile(path.path) : this.readPlaintextFile(path.path)) !== null,
+        }));
+        const warnings = [];
+        if (policy === 'preferred_secure' && storedRecords.some((record) => !record.secure)) {
+            warnings.push('plaintext fallback secrets are present');
+        }
+        if (policy === 'require_secure' && storedRecords.some((record) => !record.secure)) {
+            warnings.push('plaintext secrets exist but are ignored by current policy');
+        }
+        return {
+            policy,
+            secureAvailable: true,
+            storedKeys: new Set(storedRecords.map((record) => record.key)).size,
+            envBackedKeys: new Set(records.filter((record) => record.source === 'env').map((record) => record.key)).size,
+            secureKeys: new Set(storedRecords.filter((record) => record.secure).map((record) => record.key)).size,
+            plaintextKeys: new Set(storedRecords.filter((record) => !record.secure).map((record) => record.key)).size,
+            warnings,
+            locations,
+        };
+    }
+    async delete(key, options = {}) {
+        const stores = this.getAllCandidateStores().filter((store) => {
+            if (options.scope && store.scope !== options.scope)
+                return false;
+            if (options.medium && (options.medium === 'secure') !== store.secure)
+                return false;
+            return true;
+        });
+        for (const store of stores) {
+            const values = store.secure
+                ? this.readEncryptedFile(store.path)
+                : this.readPlaintextFile(store.path);
+            if (!values || !(key in values))
+                continue;
+            delete values[key];
+            if (store.secure)
+                this.writeEncryptedFile(store.path, values);
+            else
+                this.writePlaintextFile(store.path, values);
+            logger.debug('SecretsManager: deleted secret', { key, source: store.source });
+        }
+    }
+    getPolicy() {
+        return this.options.policy ?? loadConfiguredSecretPolicy(this.options.configManager);
+    }
+    getReadOrder() {
+        const policy = this.getPolicy();
+        const includePlaintext = policy !== 'require_secure';
+        const ordered = [];
+        const projectRoot = this.options.projectRoot;
+        const userHome = this.options.globalHome;
+        for (const root of collectAncestorRoots(projectRoot)) {
+            ordered.push({
+                source: 'project-secure',
+                path: this.options.secureProjectFilePath ?? join(root, '.goodvibes', 'goodvibes', 'secrets.enc'),
+                secure: true,
+                scope: 'project',
+            });
+            if (includePlaintext) {
+                ordered.push({
+                    source: 'project-plaintext',
+                    path: this.options.plaintextProjectFilePath ?? join(root, '.goodvibes', 'goodvibes.secrets.json'),
+                    secure: false,
+                    scope: 'project',
+                });
+            }
+        }
+        ordered.push({
+            source: 'user-secure',
+            path: this.options.secureUserFilePath ?? join(userHome, '.goodvibes', 'goodvibes', 'secrets.enc'),
+            secure: true,
+            scope: 'user',
+        });
+        if (includePlaintext) {
+            ordered.push({
+                source: 'user-plaintext',
+                path: this.options.plaintextUserFilePath ?? join(userHome, '.goodvibes', 'goodvibes.secrets.json'),
+                secure: false,
+                scope: 'user',
+            });
+        }
+        return uniquePaths(ordered);
+    }
+    getAllCandidateStores() {
+        const projectRoot = this.options.projectRoot;
+        const userHome = this.options.globalHome;
+        const ordered = [];
+        for (const root of collectAncestorRoots(projectRoot)) {
+            ordered.push({
+                source: 'project-secure',
+                path: this.options.secureProjectFilePath ?? join(root, '.goodvibes', 'goodvibes', 'secrets.enc'),
+                secure: true,
+                scope: 'project',
+            });
+            ordered.push({
+                source: 'project-plaintext',
+                path: this.options.plaintextProjectFilePath ?? join(root, '.goodvibes', 'goodvibes.secrets.json'),
+                secure: false,
+                scope: 'project',
+            });
+        }
+        ordered.push({
+            source: 'user-secure',
+            path: this.options.secureUserFilePath ?? join(userHome, '.goodvibes', 'goodvibes', 'secrets.enc'),
+            secure: true,
+            scope: 'user',
+        });
+        ordered.push({
+            source: 'user-plaintext',
+            path: this.options.plaintextUserFilePath ?? join(userHome, '.goodvibes', 'goodvibes.secrets.json'),
+            secure: false,
+            scope: 'user',
+        });
+        return uniquePaths(ordered);
+    }
+    resolveWriteTarget(scope, medium) {
+        if (scope === 'project') {
+            const root = this.options.projectRoot;
+            return medium === 'secure'
+                ? {
+                    source: 'project-secure',
+                    path: this.options.secureProjectFilePath ?? join(root, '.goodvibes', 'goodvibes', 'secrets.enc'),
+                    secure: true,
+                    scope,
+                }
+                : {
+                    source: 'project-plaintext',
+                    path: this.options.plaintextProjectFilePath ?? join(root, '.goodvibes', 'goodvibes.secrets.json'),
+                    secure: false,
+                    scope,
+                };
+        }
+        const userHome = this.options.globalHome;
+        return medium === 'secure'
+            ? {
+                source: 'user-secure',
+                path: this.options.secureUserFilePath ?? join(userHome, '.goodvibes', 'goodvibes', 'secrets.enc'),
+                secure: true,
+                scope,
+            }
+            : {
+                source: 'user-plaintext',
+                path: this.options.plaintextUserFilePath ?? join(userHome, '.goodvibes', 'goodvibes.secrets.json'),
+                secure: false,
+                scope,
+            };
+    }
+    getDefaultWriteMedium(policy) {
+        return policy === 'plaintext_allowed' ? 'plaintext' : 'secure';
+    }
+    readEncryptedFile(filePath) {
+        try {
+            const raw = readFileSync(filePath, 'utf-8');
+            const store = JSON.parse(raw);
+            return JSON.parse(decrypt(store, this.encKey));
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== 'ENOENT') {
+                logger.error('SecretsManager: failed to read encrypted store', { path: filePath });
+            }
+            return null;
+        }
+    }
+    writeEncryptedFile(filePath, secrets) {
+        mkdirSync(dirname(filePath), { recursive: true });
+        const plaintext = JSON.stringify(secrets);
+        const store = encrypt(plaintext, this.encKey);
+        writeFileSync(filePath, `${JSON.stringify(store, null, 2)}\n`, 'utf-8');
+    }
+    readPlaintextFile(filePath) {
+        try {
+            const raw = readFileSync(filePath, 'utf-8');
+            const parsed = JSON.parse(raw);
+            if (!parsed || typeof parsed !== 'object')
+                return null;
+            if ('version' in parsed && 'secrets' in parsed) {
+                const secrets = parsed.secrets;
+                return secrets && typeof secrets === 'object' ? secrets : null;
+            }
+            return parsed;
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== 'ENOENT') {
+                logger.error('SecretsManager: failed to read plaintext store', { path: filePath });
+            }
+            return null;
+        }
+    }
+    writePlaintextFile(filePath, secrets) {
+        mkdirSync(dirname(filePath), { recursive: true });
+        const payload = { version: 1, secrets };
+        writeFileSync(filePath, `${JSON.stringify(payload, null, 2)}\n`, 'utf-8');
+    }
+}

package/dist/_internal/platform/config/service-registry.d.ts

@@ -0,0 +1,98 @@
+/**
+ * ServiceRegistry — named service credential resolution.
+ *
+ * Reads service configs from .goodvibes/goodvibes/services.json.
+ * Each service entry declares its authType and the SecretsManager key
+ * that holds the credential.
+ *
+ * Example services.json:
+ * {
+ *   "openai": { "name": "openai", "baseUrl": "https://api.openai.com", "authType": "bearer", "tokenKey": "OPENAI_API_KEY" },
+ *   "github":  { "name": "github",  "baseUrl": "https://api.github.com",  "authType": "bearer", "tokenKey": "GITHUB_TOKEN" },
+ *   "slack":   { "name": "slack", "authType": "bearer", "tokenKey": "SLACK_BOT_TOKEN", "tokenRef": { "source": "vaultwarden", "item": "GoodVibes Slack", "field": "password", "server": "https://vault.example.test" } }
+ * }
+ */
+import { SecretsManager } from './secrets.js';
+import { type SecretRefInput } from '@pellux/goodvibes-sdk/platform/config/secret-refs';
+import type { OAuthProviderConfig } from '@pellux/goodvibes-sdk/platform/config/subscriptions';
+import { SubscriptionManager } from '@pellux/goodvibes-sdk/platform/config/subscriptions';
+export interface ServiceConfig {
+    /** Human-readable / lookup name. */
+    name: string;
+    /** Base URL for the service (informational). */
+    baseUrl?: string;
+    /** Auth type used by this service. */
+    authType: 'bearer' | 'basic' | 'api-key' | 'oauth';
+    /** SecretsManager key that holds the primary credential (token or API key). */
+    tokenKey: string;
+    /** Optional external/local secret reference for the primary credential. */
+    tokenRef?: SecretRefInput;
+    /** For basic auth: SecretsManager key that holds the password. */
+    passwordKey?: string;
+    /** Optional external/local secret reference for the basic-auth password. */
+    passwordRef?: SecretRefInput;
+    /** For api-key auth: the header name. Defaults to X-API-Key. */
+    apiKeyHeader?: string;
+    /** Optional secret key holding a webhook or callback URL for this service. */
+    webhookUrlKey?: string;
+    /** Optional external/local secret reference for a webhook or callback URL. */
+    webhookUrlRef?: SecretRefInput;
+    /** Optional secret key for inbound request signing/verification. */
+    signingSecretKey?: string;
+    /** Optional external/local secret reference for inbound request signing/verification. */
+    signingSecretRef?: SecretRefInput;
+    /** Optional public-key secret used for inbound signature verification. */
+    publicKeyKey?: string;
+    /** Optional external/local secret reference for inbound public-key verification. */
+    publicKeyRef?: SecretRefInput;
+    /** Optional provider ID used for subscription token override lookup. */
+    providerId?: string;
+    /** OAuth metadata for subscription-backed services. */
+    oauth?: OAuthProviderConfig;
+}
+export type ServiceSecretField = 'primary' | 'password' | 'webhookUrl' | 'signingSecret' | 'publicKey';
+export interface ServiceInspection {
+    readonly config: ServiceConfig;
+    readonly hasPrimaryCredential: boolean;
+    readonly hasPasswordCredential: boolean;
+    readonly hasWebhookUrl: boolean;
+    readonly hasSigningSecret: boolean;
+    readonly hasPublicKey: boolean;
+}
+export interface ServiceConnectionTestResult {
+    readonly ok: boolean;
+    readonly status: number | null;
+    readonly testedUrl: string | null;
+    readonly error?: string;
+}
+export interface ServiceRegistryOptions {
+    readonly secretsManager: SecretsManager;
+    readonly subscriptionManager: SubscriptionManager;
+}
+export declare class ServiceRegistry {
+    private readonly servicesFilePath;
+    private readonly secretsManager;
+    private readonly subscriptionManager;
+    constructor(servicesFilePath: string, options: ServiceRegistryOptions);
+    /**
+     * Return all registered service configs.
+     */
+    getAll(): Record<string, ServiceConfig>;
+    /**
+     * Return the config for a named service, or null if not found.
+     */
+    get(serviceName: string): ServiceConfig | null;
+    private resolveConfiguredSecret;
+    /**
+     * Resolve auth headers for a named service.
+     * Looks up the service config, fetches credential from SecretsManager,
+     * and returns the appropriate HTTP headers.
+     *
+     * Returns null if the service is not registered or credential is unavailable.
+     */
+    resolveAuth(serviceName: string): Promise<Record<string, string> | null>;
+    resolveSecret(serviceName: string, field: ServiceSecretField): Promise<string | null>;
+    inspect(serviceName: string): Promise<ServiceInspection | null>;
+    testConnection(serviceName: string): Promise<ServiceConnectionTestResult>;
+}
+//# sourceMappingURL=service-registry.d.ts.map

package/dist/_internal/platform/config/service-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-registry.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/config/service-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAQ1F,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,QAAQ,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IACnD,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,cAAc,CAAC;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,KAAK,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AAED,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,UAAU,GACV,YAAY,GACZ,eAAe,GACf,WAAW,CAAC;AAEhB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;CACnD;AAqBD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAsB;gBAE9C,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB;IAMrE;;OAEG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;IAIvC;;OAEG;IACH,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;YAKhC,uBAAuB;IA4BrC;;;;;;OAMG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAyDxE,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkBnB,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA4B/D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;CA+ChF"}