@polardbx/pxbaas 0.0.0-stage → 0.1.0-beta.1

package/bin/pxbaas.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+// Import and run the CLI
+import(join(__dirname, '..', 'dist', 'main.js')).catch((err) => {
+  console.error('Failed to start CLI:', err);
+  process.exit(1);
+});

package/dist/app/preflight.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Preflight guardrails for `pxbaas app deploy`.
+ *
+ * These checks encode the edge-function sandbox constraints (see doc 02 and the
+ * sandbox webapp evaluation): 5-function quota, no root-absolute asset refs
+ * (they escape the /functions/v1/ prefix onto Studio), and cross-machine sharing
+ * requires a public endpoint (sandbox URLs are internal).
+ */
+export interface QuotaCheck {
+    used: number;
+    limit: number;
+    ok: boolean;
+    near: boolean;
+}
+export interface PreflightInput {
+    source: string;
+    endpoint: string;
+    functionsCount: number;
+    quotaLimit?: number;
+    verifyJwt: boolean;
+    entrypointExists: boolean;
+    sourceBytes?: number;
+}
+export interface PreflightResult {
+    quota: QuotaCheck;
+    rootAbsoluteRefs: string[];
+    publicReachable: boolean;
+    warnings: string[];
+    blockers: string[];
+}
+/** Detect root-absolute references that would escape the /functions/v1/ prefix. */
+export declare function scanRootAbsoluteRefs(source: string): string[];
+/** True when the endpoint host is publicly reachable (not loopback / RFC1918). */
+export declare function isPublicEndpoint(endpoint: string): boolean;
+export declare function checkQuota(used: number, limit?: number): QuotaCheck;
+/** Run all preflight checks and collect warnings/blockers. */
+export declare function runPreflight(input: PreflightInput): PreflightResult;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/app/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/app/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,UAAU,CAAC;IAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAY7D;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAY1D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,UAAU,CAE9D;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAiDnE"}

package/dist/app/preflight.js

@@ -0,0 +1,79 @@
+/**
+ * Preflight guardrails for `pxbaas app deploy`.
+ *
+ * These checks encode the edge-function sandbox constraints (see doc 02 and the
+ * sandbox webapp evaluation): 5-function quota, no root-absolute asset refs
+ * (they escape the /functions/v1/ prefix onto Studio), and cross-machine sharing
+ * requires a public endpoint (sandbox URLs are internal).
+ */
+/** Detect root-absolute references that would escape the /functions/v1/ prefix. */
+export function scanRootAbsoluteRefs(source) {
+    const patterns = [
+        /(href|src|action)\s*=\s*["']\/(?!\/)[^"']*["']/gi,
+        /fetch\(\s*["'`]\/(?!\/)[^"'`]*["'`]/gi,
+        /url\(\s*\/(?!\/)[^)]*\)/gi,
+    ];
+    const hits = [];
+    for (const re of patterns) {
+        const m = source.match(re);
+        if (m)
+            hits.push(...m);
+    }
+    return hits;
+}
+/** True when the endpoint host is publicly reachable (not loopback / RFC1918). */
+export function isPublicEndpoint(endpoint) {
+    const host = endpoint
+        .replace(/^https?:\/\//, "")
+        .split("/")[0]
+        .split(":")[0]
+        .toLowerCase();
+    if (!host)
+        return false;
+    if (["localhost", "127.0.0.1", "::1", "0.0.0.0"].includes(host))
+        return false;
+    if (/^10\./.test(host))
+        return false;
+    if (/^192\.168\./.test(host))
+        return false;
+    if (/^172\.(1[6-9]|2\d|3[01])\./.test(host))
+        return false;
+    return true;
+}
+export function checkQuota(used, limit = 5) {
+    return { used, limit, ok: used < limit, near: used === limit - 1 };
+}
+/** Run all preflight checks and collect warnings/blockers. */
+export function runPreflight(input) {
+    const quota = checkQuota(input.functionsCount, input.quotaLimit ?? 5);
+    const rootAbsoluteRefs = scanRootAbsoluteRefs(input.source);
+    const publicReachable = isPublicEndpoint(input.endpoint);
+    const warnings = [];
+    const blockers = [];
+    if (!input.entrypointExists) {
+        blockers.push("Entrypoint file not found. Run `pxbaas app new <name>` first.");
+    }
+    if (!quota.ok) {
+        blockers.push(`Edge Function quota reached (${quota.used}/${quota.limit}). Remove an existing function (\`pxbaas app remove\` / \`pxbaas functions delete\`) or request a higher quota.`);
+    }
+    else if (quota.near) {
+        warnings.push(`Approaching the Edge Function quota (${quota.used}/${quota.limit}).`);
+    }
+    if (rootAbsoluteRefs.length > 0) {
+        // Root-absolute refs are a hard spec violation and are reported as a BLOCKER
+        // by spec-lint (pxbaas-app-spec). We still surface the raw list here for data,
+        // but do not double-report it as a preflight warning.
+    }
+    if (!publicReachable) {
+        warnings.push(`Endpoint ${input.endpoint} is not publicly reachable (loopback/private). The share URL will NOT work cross-machine.`);
+    }
+    if (!input.verifyJwt) {
+        warnings.push("verify_jwt=false: the share URL is public and the slug is enumerable. Do not co-locate secrets or sensitive logic in this function.");
+    }
+    const bytes = input.sourceBytes ?? Buffer.byteLength(input.source, "utf8");
+    if (bytes > 1_000_000) {
+        warnings.push(`Single-file bundle is large (${Math.round(bytes / 1024)}KB). Worker memory is limited (~150MB); consider hosting static assets via Storage/CDN instead.`);
+    }
+    return { quota, rootAbsoluteRefs, publicReachable, warnings, blockers };
+}
+//# sourceMappingURL=preflight.js.map

package/dist/app/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/app/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA2BH,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,QAAQ,GAAG;QACf,kDAAkD;QAClD,uCAAuC;QACvC,2BAA2B;KAC5B,CAAC;IACF,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,IAAI,GAAG,QAAQ;SAClB,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACb,WAAW,EAAE,CAAC;IACjB,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAK,GAAG,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,KAAK,KAAK,GAAG,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,KAAqB;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CACX,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,QAAQ,CAAC,IAAI,CACX,gCAAgC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,iHAAiH,CAC3K,CAAC;IACJ,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CACX,wCAAwC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,CACtE,CAAC;IACJ,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,6EAA6E;QAC7E,+EAA+E;QAC/E,sDAAsD;IACxD,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CACX,YAAY,KAAK,CAAC,QAAQ,2FAA2F,CACtH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CACX,qIAAqI,CACtI,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3E,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CACX,gCAAgC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,iGAAiG,CAC1J,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC1E,CAAC"}

package/dist/app/spec-lint.d.ts

@@ -0,0 +1,45 @@
+/** Static compliance checks for legacy edge-function apps and manifest-v2 webapps. */
+import type { BackendFramework } from "./templates.js";
+export type Severity = "blocker" | "warning";
+export interface Finding {
+    rule: string;
+    severity: Severity;
+    message: string;
+    specRef: string;
+}
+export interface SpecLintResult {
+    passed: boolean;
+    blockers: Finding[];
+    warnings: Finding[];
+}
+export interface ArtifactSource {
+    path: string;
+    source: string;
+}
+export interface SpecLintOptions {
+    verifyJwt?: boolean;
+    mode?: string;
+    declaredFiles?: string[];
+    existingFiles?: string[];
+    auxiliarySources?: string[];
+    frontendFiles?: string[];
+    frontendSources?: ArtifactSource[];
+    frontendConfigSource?: string;
+    frontendProjectSources?: string[];
+    requireHashRouter?: boolean;
+    backendSource?: string;
+    backendFramework?: BackendFramework;
+    honoVersion?: string | null;
+    /** Capability ssrLibs: curated SSR renderer allow-list (name@version) (W9/D7). */
+    ssrLibs?: string[];
+    secrets?: string[];
+    egressPolicy?: string;
+    ssrFallback?: boolean;
+    ssrProbePath?: string;
+    backendSession?: string;
+    sessionMode?: string;
+    sessionHeaders?: string[];
+}
+/** Lint source and artifact metadata while preserving legacy spa/api/mpa behavior. */
+export declare function lintAppSource(source: string, options?: SpecLintOptions): SpecLintResult;
+//# sourceMappingURL=spec-lint.d.ts.map

package/dist/app/spec-lint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-lint.d.ts","sourceRoot":"","sources":["../../src/app/spec-lint.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAGtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7C,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAmaD,sFAAsF;AACtF,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,eAAoB,GAC5B,cAAc,CA6GhB"}

package/dist/app/spec-lint.js

@@ -0,0 +1,407 @@
+/** Static compliance checks for legacy edge-function apps and manifest-v2 webapps. */
+import { scanRootAbsoluteRefs } from "./preflight.js";
+const SPEC = "pxbaas-app-spec";
+const BINARY_ASSET_RE = /\.(png|jpe?g|gif|webp|ico|bmp|tiff?|woff2?|ttf|otf|eot|pdf|zip|gz|tgz|mp4|webm|mp3|wav|avif|wasm)$/i;
+const NODE_PATTERNS = [
+    { re: /\brequire\s*\(/, hint: "require()" },
+    { re: /(?:from\s+|import\s*)["']node:/, hint: "node: import" },
+    {
+        re: /\bfrom\s+["'](?:fs|path|http|https|os|crypto|child_process|express|koa|fastify|axios)["']/,
+        hint: "Node/builtin import",
+    },
+    {
+        re: /\bprocess\.(?:env|exit|argv|stdin|stdout|stderr)\b/,
+        hint: "process.*",
+    },
+    { re: /\b__dirname\b|\b__filename\b/, hint: "__dirname/__filename" },
+];
+/**
+ * Platform-injected public env keys readable by App candidate workers.
+ * Mirrors edge-runtime `mysql/builtin-functions/main/app-env.ts`
+ * APP_PUBLIC_ENV_KEYS (MR #30497903). Role contract: SUPABASE_INTERNAL_URL is the
+ * only legal data-plane fetch base, SUPABASE_ANON_KEY the data-plane credential,
+ * SUPABASE_URL a render-only public origin (never fetch through it).
+ */
+const APP_PUBLIC_ENV_KEYS = new Set([
+    "SUPABASE_URL",
+    "SUPABASE_ANON_KEY",
+    "SUPABASE_INTERNAL_URL",
+]);
+/**
+ * Strip line and block comments while preserving string and template literals,
+ * so keyword rules (Deno.env, Set-Cookie, Node APIs, ...) do not false-positive
+ * on explanatory comments. Regex literals are not lexed: a slash only begins a
+ * comment when followed by another slash or an asterisk.
+ */
+function stripComments(src) {
+    let out = "";
+    let i = 0;
+    const n = src.length;
+    let state = "code";
+    while (i < n) {
+        const c = src[i];
+        const c2 = src[i + 1];
+        if (state === "code") {
+            if (c === "/" && c2 === "/") {
+                state = "line";
+                i += 2;
+                continue;
+            }
+            if (c === "/" && c2 === "*") {
+                state = "block";
+                i += 2;
+                continue;
+            }
+            if (c === "'") {
+                state = "sq";
+                out += c;
+                i++;
+                continue;
+            }
+            if (c === '"') {
+                state = "dq";
+                out += c;
+                i++;
+                continue;
+            }
+            if (c === "`") {
+                state = "tpl";
+                out += c;
+                i++;
+                continue;
+            }
+            out += c;
+            i++;
+            continue;
+        }
+        if (state === "line") {
+            if (c === "\n") {
+                state = "code";
+                out += c;
+            }
+            i++;
+            continue;
+        }
+        if (state === "block") {
+            if (c === "*" && c2 === "/") {
+                state = "code";
+                i += 2;
+                continue;
+            }
+            if (c === "\n")
+                out += c;
+            i++;
+            continue;
+        }
+        // string / template states: copy verbatim, honour backslash escapes
+        if (c === "\\") {
+            out += c + (c2 ?? "");
+            i += 2;
+            continue;
+        }
+        if ((state === "sq" && c === "'") ||
+            (state === "dq" && c === '"') ||
+            (state === "tpl" && c === "`")) {
+            state = "code";
+        }
+        out += c;
+        i++;
+        continue;
+    }
+    return out;
+}
+function finding(rule, message, ref) {
+    return {
+        rule,
+        severity: "blocker",
+        message,
+        specRef: `${SPEC}/references/${ref}`,
+    };
+}
+function lintBackend(source, options, blockers, warnings) {
+    const code = stripComments(source);
+    if (!/Deno\.serve\s*\(/.test(code)) {
+        blockers.push(finding("deno-serve", "Missing top-level Deno.serve(...). The webapp backend must use the Deno HTTP server contract.", "runtime-contract.md"));
+    }
+    for (const { re, hint } of NODE_PATTERNS) {
+        if (re.test(code)) {
+            blockers.push(finding("no-node-api", `Node.js API detected (${hint}). The backend runtime is Deno.`, "runtime-contract.md"));
+            break;
+        }
+    }
+    // Custom Secrets are unsupported in the first webapp release.
+    if ((options.secrets?.length ?? 0) > 0) {
+        blockers.push(finding("custom-secrets-not-supported", "Custom Secrets are not supported by the first webapp release. Remove the backend.secrets entries from app.json.", "guardrails-pitfalls.md"));
+    }
+    // Deno.env: only the platform public three-key whitelist is readable. Any
+    // other key, or dynamic/toObject access that could expose the whole env, is a
+    // blocker. Matched on comment-stripped code so documented examples do not trip it.
+    const envOffenders = new Set();
+    let sawUnverifiableEnv = false;
+    for (const match of code.matchAll(/Deno\.env\.(get|toObject|set|delete)\s*\(([^)]*)\)/g)) {
+        const method = match[1];
+        const argRaw = match[2].trim();
+        if (method === "toObject") {
+            sawUnverifiableEnv = true;
+            continue;
+        }
+        const literal = argRaw.match(/^["']([^"']+)["']/);
+        if (literal) {
+            if (!APP_PUBLIC_ENV_KEYS.has(literal[1]))
+                envOffenders.add(literal[1]);
+        }
+        else {
+            sawUnverifiableEnv = true;
+        }
+    }
+    if (envOffenders.size > 0 || sawUnverifiableEnv) {
+        const detail = envOffenders.size > 0
+            ? [...envOffenders].slice(0, 3).join(", ")
+            : "dynamic key or Deno.env.toObject()";
+        blockers.push(finding("deno-env-not-allowed", `Only the platform public env keys are readable (${[...APP_PUBLIC_ENV_KEYS].join(", ")}). Offending Deno.env access: ${detail}.`, "guardrails-pitfalls.md"));
+    }
+    if ((options.egressPolicy ?? "deny") !== "deny") {
+        blockers.push(finding("egress-deny", 'The first webapp release requires backend.egressPolicy="deny".', "runtime-contract.md"));
+    }
+    const importSpecifiers = [
+        ...code.matchAll(/(?:from\s*|import\s*(?:\(\s*)?)["']([^"']+)["']/g),
+    ].map((match) => match[1]);
+    const remoteImports = importSpecifiers.filter((value) => /^(?:https?:|jsr:|npm:)/.test(value));
+    const ssrLibs = options.ssrLibs ?? [];
+    const isAllowedSsrImport = (value) => ssrLibs.some((e) => value === `npm:${e}` || value.startsWith(`npm:${e}/`));
+    const honoExpected = options.backendFramework === "hono" && options.honoVersion
+        ? `npm:hono@${options.honoVersion}`
+        : null;
+    // Hono (D7): the hono-version rule governs ONLY the Hono import itself.
+    if (options.backendFramework === "hono") {
+        if (!honoExpected || !importSpecifiers.includes(honoExpected)) {
+            blockers.push(finding("hono-version", honoExpected
+                ? `Hono must use the exact platform import ${honoExpected}.`
+                : "Hono is not available because the instance did not report an exact offline-ready version.", "runtime-contract.md"));
+        }
+    }
+    // Off-list remote imports: anything except the exact Hono import and the
+    // capability-curated SSR renderers (npm:<name>@<version>[/subpath]).
+    const offList = remoteImports.filter((value) => {
+        if (honoExpected && value === honoExpected)
+            return false;
+        if (options.backendFramework === "hono" && /^npm:hono@/.test(value))
+            return false; // wrong-version Hono is reported by hono-version above
+        if (value.startsWith("npm:") && isAllowedSsrImport(value))
+            return false;
+        return true;
+    });
+    const npmOffList = offList.filter((value) => value.startsWith("npm:"));
+    const otherOffList = offList.filter((value) => !value.startsWith("npm:"));
+    if (npmOffList.length > 0) {
+        blockers.push(ssrLibs.length > 0
+            ? finding("ssr-lib-not-allowed", `npm import(s) not in this instance's capability ssrLibs: ${npmOffList.slice(0, 3).join(", ")}. Allowed SSR renderers: ${ssrLibs.map((e) => `npm:${e}`).join(", ")} (a /subpath such as /server or /web is allowed).`, "runtime-contract.md")
+            : finding("no-remote-import", `Remote/npm/jsr import(s) are not allowed: ${npmOffList.slice(0, 3).join(", ")}. ` +
+                "This instance reported an EMPTY capabilities.ssrLibs allow-list, so every npm: import is blocked. " +
+                "ssrLibs is a declaration baked from SSR_LIBS_LIST (/etc/supabase/ssr-libs); an empty value usually means " +
+                "the AIO image was built without it even though the sandbox caches the renderers. Fix the instance " +
+                "(bake SSR_LIBS_LIST or set APP_SSR_LIBS, then restart edge-proxy/studio) rather than working around it " +
+                "with --skip-spec-check; Hono itself is gated by hono-version/honoOfflineReady, not by ssrLibs.", "runtime-contract.md"));
+    }
+    if (otherOffList.length > 0) {
+        blockers.push(finding("no-remote-import", `Remote http/https/jsr import(s) are not allowed: ${otherOffList.slice(0, 3).join(", ")}.`, "runtime-contract.md"));
+    }
+    const hasCors = /Access-Control-Allow-Origin/i.test(code);
+    const hasOptions = /OPTIONS/.test(code);
+    if (!hasCors || !hasOptions) {
+        warnings.push({
+            rule: "cors-options",
+            severity: "warning",
+            message: `Missing ${!hasCors ? "CORS headers" : ""}${!hasCors && !hasOptions ? " and " : ""}${!hasOptions ? "OPTIONS handling" : ""}. Browser calls to the backend may fail.`,
+            specRef: `${SPEC}/references/guardrails-pitfalls.md`,
+        });
+    }
+}
+function lintWebappFrontend(options, blockers) {
+    const files = options.frontendFiles ?? [];
+    const normalized = files.map((file) => file.replace(/\\/g, "/"));
+    const forbiddenEnv = normalized.filter((file) => /(^|\/)\.env(?:\.|$)/.test(file));
+    const sourceMaps = normalized.filter((file) => /\.map$/i.test(file));
+    const nodeModules = normalized.filter((file) => /(^|\/)node_modules\//.test(file));
+    const sourceDirs = normalized.filter((file) => /(^|\/)src\//.test(file));
+    const serviceWorkers = normalized.filter((file) => /(^|\/)(?:service-worker|sw)\.(?:js|mjs|ts)$/i.test(file));
+    if (forbiddenEnv.length > 0)
+        blockers.push(finding("no-env-files", `Frontend artifacts must not include .env files: ${forbiddenEnv.slice(0, 5).join(", ")}.`, "guardrails-pitfalls.md"));
+    if (sourceMaps.length > 0)
+        blockers.push(finding("no-source-maps", `Frontend artifacts must not include source maps: ${sourceMaps.slice(0, 5).join(", ")}.`, "guardrails-pitfalls.md"));
+    if (nodeModules.length > 0)
+        blockers.push(finding("no-node-modules", "Upload the built frontend output, not node_modules.", "guardrails-pitfalls.md"));
+    if (sourceDirs.length > 0)
+        blockers.push(finding("no-frontend-source", "Upload the prebuilt frontend directory, not a source directory.", "templates-examples.md"));
+    if (serviceWorkers.length > 0)
+        blockers.push(finding("no-service-worker", `Service Worker files are not supported: ${serviceWorkers.slice(0, 5).join(", ")}.`, "guardrails-pitfalls.md"));
+    const frontendSource = (options.frontendSources ?? [])
+        .map((file) => file.source)
+        .join("\n");
+    const projectSource = (options.frontendProjectSources ?? []).join("\n");
+    if (/navigator\.serviceWorker|serviceWorker\.register\s*\(/.test(`${frontendSource}\n${projectSource}`)) {
+        blockers.push(finding("no-service-worker", "Service Worker registration is not supported by the first webapp release.", "guardrails-pitfalls.md"));
+    }
+    if (options.frontendConfigSource !== undefined &&
+        !/\bbase\s*:\s*["']\.\/["']/.test(options.frontendConfigSource)) {
+        blockers.push(finding("vite-relative-base", 'Vite must set base: "./" so assets remain under the App mount.', "templates-examples.md"));
+    }
+    if (options.frontendConfigSource !== undefined &&
+        /\bsourcemap\s*:\s*(?:true|["'](?:inline|hidden)["'])/.test(options.frontendConfigSource)) {
+        blockers.push(finding("no-source-maps", "Vite source maps must be disabled for uploaded frontend artifacts.", "guardrails-pitfalls.md"));
+    }
+    if (options.requireHashRouter && !/\bHashRouter\b/.test(projectSource)) {
+        blockers.push(finding("react-hash-router", "React webapps must use HashRouter; history fallback is not supported.", "templates-examples.md"));
+    }
+}
+/** SSR (W5): authoring guards for fallback=worker apps (DX-2 marker, D16 self-contained). */
+function lintSsr(backendSource, options, blockers, warnings) {
+    const code = stripComments(backendSource);
+    const probe = options.ssrProbePath;
+    if (typeof probe !== "string" || !probe.startsWith("/") || probe.includes("..")) {
+        blockers.push(finding("ssr-probe-declared", 'manifest.ssrProbePath is required (safe logical path, e.g. "/page") when frontend.fallback="worker".', "runtime-contract.md"));
+    }
+    if (/from\s+["']\.\//.test(code) || /import\s*\(\s*["']\.\//.test(code)) {
+        blockers.push(finding("ssr-self-contained", "SSR worker must be single-file self-contained: relative module imports fail at boot on the current runtime (D16). Inline helpers or import platform-pinned packages only.", "runtime-contract.md"));
+    }
+    // The marker may be written with escaped quotes inside a double-quoted JS
+    // string (e.g. "<div ... data-ssr=\"v1\">"), so match an optional backslash
+    // before each quote rather than a naive substring.
+    if (!/data-ssr=\\?["']v1\\?["']/.test(code)) {
+        blockers.push(finding("ssr-marker-present", 'SSR page output must include the hydration root marker <div id="__ssr" data-ssr="v1"> so the publish probe can verify rendering (DX-2).', "runtime-contract.md"));
+    }
+    if (/\bwindow\b|\bdocument\b/.test(code)) {
+        warnings.push({
+            ...finding("ssr-no-browser-globals", "SSR worker references window/document: server render must not touch browser globals at import or render time.", "runtime-contract.md"),
+            severity: "warning",
+        });
+    }
+}
+/** Lint source and artifact metadata while preserving legacy spa/api/mpa behavior. */
+export function lintAppSource(source, options = {}) {
+    const blockers = [];
+    const warnings = [];
+    const mode = options.mode ?? "spa";
+    const verifyJwt = options.verifyJwt ?? false;
+    const isWebapp = mode === "webapp";
+    const backendSource = options.backendSource ?? source;
+    // Backend lint runs for legacy apps and for webapps with a declared framework.
+    // A webapp backend missing `framework` is rejected earlier by manifest
+    // validation (requireWebappManifestValue, R2-09), so it never reaches a state
+    // where these checks would be silently skipped.
+    if (!isWebapp || options.backendFramework)
+        lintBackend(backendSource, options, blockers, warnings);
+    if (isWebapp)
+        lintWebappFrontend(options, blockers);
+    const scannedSources = isWebapp
+        ? [
+            ...(options.frontendSources ?? []).map((file) => file.source),
+            ...(options.frontendProjectSources ?? []),
+            // R2-08: also scan SSR backend output for root-absolute refs (href="/x",
+            // fetch("/x"), url(/x)) that would escape the /apps/{mount} prefix. Comments
+            // are stripped first so documented examples do not false-positive; server-side
+            // fetches use the injected internal base (base + "/rest/..."), not root-absolute
+            // literals, so legitimate SSR data access is unaffected.
+            ...(options.backendSource ? [stripComments(options.backendSource)] : []),
+        ]
+        : [source, ...(options.auxiliarySources ?? [])];
+    const rootAbs = scanRootAbsoluteRefs(scannedSources.join("\n"));
+    if (rootAbs.length > 0) {
+        blockers.push(finding("no-root-absolute", `Root-absolute reference(s) found: ${rootAbs.slice(0, 3).join(", ")}. Use mount-relative URLs.`, "guardrails-pitfalls.md"));
+    }
+    if (mode === "mpa") {
+        const existing = new Set(options.existingFiles ?? []);
+        const missing = (options.declaredFiles ?? []).filter((file) => !existing.has(file));
+        if (missing.length > 0)
+            blockers.push(finding("mpa-assets-exist", `app.json declares missing page(s)/asset(s): ${missing.join(", ")}.`, "templates-examples.md"));
+    }
+    if (isWebapp && options.ssrFallback)
+        lintSsr(backendSource, options, blockers, warnings);
+    if (isWebapp)
+        lintSession(backendSource, options, blockers, warnings);
+    if (mode === "mpa" || isWebapp) {
+        const files = isWebapp
+            ? (options.frontendFiles ?? [])
+            : (options.existingFiles ?? []);
+        const binary = files.filter((file) => BINARY_ASSET_RE.test(file));
+        if (binary.length > 0)
+            blockers.push(finding("no-binary-assets", `Binary assets are not supported by the text-only release: ${binary.slice(0, 5).join(", ")}. Put binary assets in Storage instead.`, "guardrails-pitfalls.md"));
+    }
+    if (!isWebapp) {
+        const servesHtml = /text\/html/i.test(source);
+        const hasEscape = /\besc\s*\(|escapeHtml|encodeHTML|replace\(\s*\/&\/g/.test(source);
+        if (servesHtml && !hasEscape)
+            warnings.push({
+                rule: "escape-reflected",
+                severity: "warning",
+                message: "Serves text/html but no HTML-escaping helper was found.",
+                specRef: `${SPEC}/references/guardrails-pitfalls.md`,
+            });
+        if (/<script[^>]+src=["']https?:\/\//i.test(source) ||
+            /<link[^>]+href=["']https?:\/\//i.test(source))
+            warnings.push({
+                rule: "no-external-cdn",
+                severity: "warning",
+                message: "External CDN core assets were detected; bundle or inline them.",
+                specRef: `${SPEC}/references/guardrails-pitfalls.md`,
+            });
+        if (!verifyJwt &&
+            /service_role|serviceRoleKey|SERVICE_ROLE|dbPassword|DASHBOARD_PASSWORD|secret\s*[:=]/i.test(source))
+            warnings.push({
+                rule: "no-secrets-public",
+                severity: "warning",
+                message: "A public function appears to reference a secret.",
+                specRef: `${SPEC}/references/guardrails-pitfalls.md`,
+            });
+    }
+    return { passed: blockers.length === 0, blockers, warnings };
+}
+/** 方案 C: session-contract authoring guards for webapp backends. */
+function lintSession(backendSource, options, blockers, warnings) {
+    const session = options.backendSession ?? "none";
+    const src = stripComments(backendSource ?? "");
+    if (session === "proxy-injected") {
+        // Worker must NOT read the client cookie: /apps strips it, so any cookie the
+        // worker sees is a proxy-jar artifact. Identity comes from injected headers.
+        if (/headers?\s*(?:\.get\s*\(\s*["']cookie["']|\[\s*["']cookie["']\s*\])/i.test(src))
+            blockers.push(finding("session-no-cookie-read", 'backend.session="proxy-injected" must not read the Cookie header; use the injected X-App-User-* headers.', "ssr-session.md"));
+        if (/set-cookie/i.test(src))
+            blockers.push(finding("session-no-set-cookie", 'backend.session="proxy-injected" must not issue Set-Cookie; the proxy owns the session cookie.', "ssr-session.md"));
+        if (/[?&](sid|session_token|access_token)=/i.test(src))
+            blockers.push(finding("session-no-url-token", "Do not carry the user token in URLs (?sid=/&token=); the proxy injects X-App-User-Token.", "ssr-session.md"));
+        const headers = (options.sessionHeaders ?? []).map((h) => h.toLowerCase());
+        const used = headers.filter((h) => src.toLowerCase().includes(h));
+        if (used.length === 0)
+            warnings.push({
+                rule: "session-use-injected-header",
+                severity: "warning",
+                message: 'backend.session="proxy-injected" but no capabilities.sessionHeaders reference found; read X-App-User-Token/X-App-User-Id.',
+                specRef: `${SPEC}/references/ssr-session.md`,
+            });
+        // Any X-App-User-* header not in the capability whitelist is a forgery risk / typo.
+        const referenced = [
+            ...new Set((src.toLowerCase().match(/x-app-user-[a-z-]+/g) ?? [])),
+        ];
+        const unknown = referenced.filter((h) => !headers.includes(h));
+        if (unknown.length > 0)
+            blockers.push(finding("session-header-name-whitelist", `Unknown injected session header(s): ${unknown.join(", ")}. Use only capabilities.sessionHeaders.`, "ssr-session.md"));
+        if (/JWT_SECRET/i.test(src))
+            warnings.push({
+                rule: "session-env-secret",
+                severity: "warning",
+                message: "proxy-injected sessions are verified by the proxy; the worker needs no JWT signing secret.",
+                specRef: `${SPEC}/references/ssr-session.md`,
+            });
+    }
+    if (session === "browser-side") {
+        if (/headers?\s*(?:\.get\s*\(\s*["'](cookie|authorization)["']|\[\s*["'](cookie|authorization)["']\s*\])/i
+            .test(src))
+            warnings.push({
+                rule: "session-browser-side-no-worker-auth",
+                severity: "warning",
+                message: 'backend.session="browser-side": authentication belongs in the browser (localStorage + Authorization to /auth,/rest), not the worker.',
+                specRef: `${SPEC}/references/ssr-session.md`,
+            });
+    }
+}
+//# sourceMappingURL=spec-lint.js.map

package/dist/app/spec-lint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-lint.js","sourceRoot":"","sources":["../../src/app/spec-lint.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAkDtD,MAAM,IAAI,GAAG,iBAAiB,CAAC;AAC/B,MAAM,eAAe,GACnB,qGAAqG,CAAC;AACxG,MAAM,aAAa,GAAwC;IACzD,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE;IAC3C,EAAE,EAAE,EAAE,gCAAgC,EAAE,IAAI,EAAE,cAAc,EAAE;IAC9D;QACE,EAAE,EAAE,2FAA2F;QAC/F,IAAI,EAAE,qBAAqB;KAC5B;IACD;QACE,EAAE,EAAE,oDAAoD;QACxD,IAAI,EAAE,WAAW;KAClB;IACD,EAAE,EAAE,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE;CACrE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,cAAc;IACd,mBAAmB;IACnB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,IAAI,KAAK,GAAoD,MAAM,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,MAAM,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAClE,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,OAAO,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnE,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,IAAI,CAAC;gBAAC,GAAG,IAAI,CAAC,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YACzD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,IAAI,CAAC;gBAAC,GAAG,IAAI,CAAC,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YACzD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,KAAK,CAAC;gBAAC,GAAG,IAAI,CAAC,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1D,GAAG,IAAI,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAC1B,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAAC,KAAK,GAAG,MAAM,CAAC;gBAAC,GAAG,IAAI,CAAC,CAAC;YAAC,CAAC;YAC7C,CAAC,EAAE,CAAC;YAAC,SAAS;QAChB,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,MAAM,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAClE,IAAI,CAAC,KAAK,IAAI;gBAAE,GAAG,IAAI,CAAC,CAAC;YACzB,CAAC,EAAE,CAAC;YAAC,SAAS;QAChB,CAAC;QACD,oEAAoE;QACpE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,IACE,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;YAC7B,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;YAC7B,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC,EAC9B,CAAC;YACD,KAAK,GAAG,MAAM,CAAC;QACjB,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QAAC,CAAC,EAAE,CAAC;QAAC,SAAS;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe,EAAE,GAAW;IACzD,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,SAAS;QACnB,OAAO;QACP,OAAO,EAAE,GAAG,IAAI,eAAe,GAAG,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,MAAc,EACd,OAAwB,EACxB,QAAmB,EACnB,QAAmB;IAEnB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,YAAY,EACZ,+FAA+F,EAC/F,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,aAAa,EACb,yBAAyB,IAAI,iCAAiC,EAC9D,qBAAqB,CACtB,CACF,CAAC;YACF,MAAM;QACR,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,8BAA8B,EAC9B,iHAAiH,EACjH,wBAAwB,CACzB,CACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,8EAA8E;IAC9E,mFAAmF;IACnF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAC/B,qDAAqD,CACtD,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,kBAAkB,GAAG,IAAI,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAChD,MAAM,MAAM,GACV,YAAY,CAAC,IAAI,GAAG,CAAC;YACnB,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1C,CAAC,CAAC,oCAAoC,CAAC;QAC3C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,sBAAsB,EACtB,mDAAmD,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,MAAM,GAAG,EAChI,wBAAwB,CACzB,CACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,aAAa,EACb,gEAAgE,EAChE,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG;QACvB,GAAG,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC;KACrE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACtD,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CACrC,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAW,EAAE,CACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,MAAM,YAAY,GAChB,OAAO,CAAC,gBAAgB,KAAK,MAAM,IAAI,OAAO,CAAC,WAAW;QACxD,CAAC,CAAC,YAAY,OAAO,CAAC,WAAW,EAAE;QACnC,CAAC,CAAC,IAAI,CAAC;IAEX,wEAAwE;IACxE,IAAI,OAAO,CAAC,gBAAgB,KAAK,MAAM,EAAE,CAAC;QACxC,IAAI,CAAC,YAAY,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,cAAc,EACd,YAAY;gBACV,CAAC,CAAC,2CAA2C,YAAY,GAAG;gBAC5D,CAAC,CAAC,2FAA2F,EAC/F,qBAAqB,CACtB,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7C,IAAI,YAAY,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,KAAK,CAAC;QACzD,IAAI,OAAO,CAAC,gBAAgB,KAAK,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YACjE,OAAO,KAAK,CAAC,CAAC,uDAAuD;QACvE,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,MAAM,GAAG,CAAC;YAChB,CAAC,CAAC,OAAO,CACL,qBAAqB,EACrB,4DAA4D,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD,EACrN,qBAAqB,CACtB;YACH,CAAC,CAAC,OAAO,CACL,kBAAkB,EAClB,6CAA6C,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAChF,oGAAoG;gBACpG,2GAA2G;gBAC3G,oGAAoG;gBACpG,yGAAyG;gBACzG,gGAAgG,EAClG,qBAAqB,CACtB,CACN,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,kBAAkB,EAClB,oDAAoD,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAC1F,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,0CAA0C;YAC7K,OAAO,EAAE,GAAG,IAAI,oCAAoC;SACrD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAwB,EACxB,QAAmB;IAEnB,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9C,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CACjC,CAAC;IACF,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7C,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAClC,CAAC;IACF,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAChD,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1D,CAAC;IAEF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,cAAc,EACd,mDAAmD,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACzF,wBAAwB,CACzB,CACF,CAAC;IACJ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,gBAAgB,EAChB,oDAAoD,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACxF,wBAAwB,CACzB,CACF,CAAC;IACJ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QACxB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,iBAAiB,EACjB,qDAAqD,EACrD,wBAAwB,CACzB,CACF,CAAC;IACJ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,iEAAiE,EACjE,uBAAuB,CACxB,CACF,CAAC;IACJ,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAC3B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,mBAAmB,EACnB,2CAA2C,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACnF,wBAAwB,CACzB,CACF,CAAC;IAEJ,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;SACnD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;SAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,IACE,uDAAuD,CAAC,IAAI,CAC1D,GAAG,cAAc,KAAK,aAAa,EAAE,CACtC,EACD,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,mBAAmB,EACnB,2EAA2E,EAC3E,wBAAwB,CACzB,CACF,CAAC;IACJ,CAAC;IAED,IACE,OAAO,CAAC,oBAAoB,KAAK,SAAS;QAC1C,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAC/D,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,gEAAgE,EAChE,uBAAuB,CACxB,CACF,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,oBAAoB,KAAK,SAAS;QAC1C,sDAAsD,CAAC,IAAI,CACzD,OAAO,CAAC,oBAAoB,CAC7B,EACD,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,gBAAgB,EAChB,oEAAoE,EACpE,wBAAwB,CACzB,CACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,mBAAmB,EACnB,uEAAuE,EACvE,uBAAuB,CACxB,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,OAAO,CACd,aAAqB,EACrB,OAAwB,EACxB,QAAmB,EACnB,QAAmB;IAEnB,MAAM,IAAI,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,sGAAsG,EACtG,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,2KAA2K,EAC3K,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,mDAAmD;IACnD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,yIAAyI,EACzI,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IACD,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,OAAO,CACR,wBAAwB,EACxB,+GAA+G,EAC/G,qBAAqB,CACtB;YACD,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,UAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,KAAK,QAAQ,CAAC;IACnC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IAEtD,+EAA+E;IAC/E,uEAAuE;IACvE,8EAA8E;IAC9E,gDAAgD;IAChD,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,gBAAgB;QACvC,WAAW,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,QAAQ;QAAE,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEpD,MAAM,cAAc,GAAG,QAAQ;QAC7B,CAAC,CAAC;YACE,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,sBAAsB,IAAI,EAAE,CAAC;YACzC,yEAAyE;YACzE,6EAA6E;YAC7E,+EAA+E;YAC/E,iFAAiF;YACjF,yDAAyD;YACzD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE;QACH,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,kBAAkB,EAClB,qCAAqC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAC/F,wBAAwB,CACzB,CACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAC9B,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,kBAAkB,EAClB,+CAA+C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACpE,uBAAuB,CACxB,CACF,CAAC;IACN,CAAC;IAED,IAAI,QAAQ,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACzF,IAAI,QAAQ;QAAE,WAAW,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEtE,IAAI,IAAI,KAAK,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ;YACpB,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;YAC/B,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACnB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,kBAAkB,EAClB,6DAA6D,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,EACnI,wBAAwB,CACzB,CACF,CAAC;IACN,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GACb,qDAAqD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,UAAU,IAAI,CAAC,SAAS;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,yDAAyD;gBAClE,OAAO,EAAE,GAAG,IAAI,oCAAoC;aACrD,CAAC,CAAC;QACL,IACE,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/C,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC;YAE9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EACL,gEAAgE;gBAClE,OAAO,EAAE,GAAG,IAAI,oCAAoC;aACrD,CAAC,CAAC;QACL,IACE,CAAC,SAAS;YACV,uFAAuF,CAAC,IAAI,CAC1F,MAAM,CACP;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,kDAAkD;gBAC3D,OAAO,EAAE,GAAG,IAAI,oCAAoC;aACrD,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC/D,CAAC;AAED,mEAAmE;AACnE,SAAS,WAAW,CAClB,aAAqB,EACrB,OAAwB,EACxB,QAAmB,EACnB,QAAmB;IAEnB,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC;IACjD,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACjC,6EAA6E;QAC7E,6EAA6E;QAC7E,IAAI,sEAAsE,CAAC,IAAI,CAAC,GAAG,CAAC;YAClF,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,wBAAwB,EACxB,0GAA0G,EAC1G,gBAAgB,CACjB,CACF,CAAC;QACJ,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,uBAAuB,EACvB,gGAAgG,EAChG,gBAAgB,CACjB,CACF,CAAC;QACJ,IAAI,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC;YACpD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,sBAAsB,EACtB,0FAA0F,EAC1F,gBAAgB,CACjB,CACF,CAAC;QACJ,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B;gBACnC,QAAQ,EAAE,SAAS;gBACnB,OAAO,EACL,2HAA2H;gBAC7H,OAAO,EAAE,GAAG,IAAI,4BAA4B;aAC7C,CAAC,CAAC;QACL,oFAAoF;QACpF,MAAM,UAAU,GAAG;YACjB,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CACvD;SACF,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,+BAA+B,EAC/B,uCAAuC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,EAClG,gBAAgB,CACjB,CACF,CAAC;QACJ,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EACL,4FAA4F;gBAC9F,OAAO,EAAE,GAAG,IAAI,4BAA4B;aAC7C,CAAC,CAAC;IACP,CAAC;IACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,IACE,sGAAsG;aACnG,IAAI,CAAC,GAAG,CAAC;YAEZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,qCAAqC;gBAC3C,QAAQ,EAAE,SAAS;gBACnB,OAAO,EACL,sIAAsI;gBACxI,OAAO,EAAE,GAAG,IAAI,4BAA4B;aAC7C,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}