@polardbx/pxbaas 0.0.0-stage → 0.1.0-beta.2

package/dist/app/spec-lint.js

@@ -0,0 +1,407 @@
+/** Static compliance checks for legacy edge-function apps and manifest-v2 webapps. */
+import { scanRootAbsoluteRefs } from "./preflight.js";
+const SPEC = "pxbaas-app-spec";
+const BINARY_ASSET_RE = /\.(png|jpe?g|gif|webp|ico|bmp|tiff?|woff2?|ttf|otf|eot|pdf|zip|gz|tgz|mp4|webm|mp3|wav|avif|wasm)$/i;
+const NODE_PATTERNS = [
+    { re: /\brequire\s*\(/, hint: "require()" },
+    { re: /(?:from\s+|import\s*)["']node:/, hint: "node: import" },
+    {
+        re: /\bfrom\s+["'](?:fs|path|http|https|os|crypto|child_process|express|koa|fastify|axios)["']/,
+        hint: "Node/builtin import",
+    },
+    {
+        re: /\bprocess\.(?:env|exit|argv|stdin|stdout|stderr)\b/,
+        hint: "process.*",
+    },
+    { re: /\b__dirname\b|\b__filename\b/, hint: "__dirname/__filename" },
+];
+/**
+ * Platform-injected public env keys readable by App candidate workers.
+ * Mirrors edge-runtime `mysql/builtin-functions/main/app-env.ts`
+ * APP_PUBLIC_ENV_KEYS (MR #30497903). Role contract: SUPABASE_INTERNAL_URL is the
+ * only legal data-plane fetch base, SUPABASE_ANON_KEY the data-plane credential,
+ * SUPABASE_URL a render-only public origin (never fetch through it).
+ */
+const APP_PUBLIC_ENV_KEYS = new Set([
+    "SUPABASE_URL",
+    "SUPABASE_ANON_KEY",
+    "SUPABASE_INTERNAL_URL",
+]);
+/**
+ * Strip line and block comments while preserving string and template literals,
+ * so keyword rules (Deno.env, Set-Cookie, Node APIs, ...) do not false-positive
+ * on explanatory comments. Regex literals are not lexed: a slash only begins a
+ * comment when followed by another slash or an asterisk.
+ */
+function stripComments(src) {
+    let out = "";
+    let i = 0;
+    const n = src.length;
+    let state = "code";
+    while (i < n) {
+        const c = src[i];
+        const c2 = src[i + 1];
+        if (state === "code") {
+            if (c === "/" && c2 === "/") {
+                state = "line";
+                i += 2;
+                continue;
+            }
+            if (c === "/" && c2 === "*") {
+                state = "block";
+                i += 2;
+                continue;
+            }
+            if (c === "'") {
+                state = "sq";
+                out += c;
+                i++;
+                continue;
+            }
+            if (c === '"') {
+                state = "dq";
+                out += c;
+                i++;
+                continue;
+            }
+            if (c === "`") {
+                state = "tpl";
+                out += c;
+                i++;
+                continue;
+            }
+            out += c;
+            i++;
+            continue;
+        }
+        if (state === "line") {
+            if (c === "\n") {
+                state = "code";
+                out += c;
+            }
+            i++;
+            continue;
+        }
+        if (state === "block") {
+            if (c === "*" && c2 === "/") {
+                state = "code";
+                i += 2;
+                continue;
+            }
+            if (c === "\n")
+                out += c;
+            i++;
+            continue;
+        }
+        // string / template states: copy verbatim, honour backslash escapes
+        if (c === "\\") {
+            out += c + (c2 ?? "");
+            i += 2;
+            continue;
+        }
+        if ((state === "sq" && c === "'") ||
+            (state === "dq" && c === '"') ||
+            (state === "tpl" && c === "`")) {
+            state = "code";
+        }
+        out += c;
+        i++;
+        continue;
+    }
+    return out;
+}
+function finding(rule, message, ref) {
+    return {
+        rule,
+        severity: "blocker",
+        message,
+        specRef: `${SPEC}/references/${ref}`,
+    };
+}
+function lintBackend(source, options, blockers, warnings) {
+    const code = stripComments(source);
+    if (!/Deno\.serve\s*\(/.test(code)) {
+        blockers.push(finding("deno-serve", "Missing top-level Deno.serve(...). The webapp backend must use the Deno HTTP server contract.", "runtime-contract.md"));
+    }
+    for (const { re, hint } of NODE_PATTERNS) {
+        if (re.test(code)) {
+            blockers.push(finding("no-node-api", `Node.js API detected (${hint}). The backend runtime is Deno.`, "runtime-contract.md"));
+            break;
+        }
+    }
+    // Custom Secrets are unsupported in the first webapp release.
+    if ((options.secrets?.length ?? 0) > 0) {
+        blockers.push(finding("custom-secrets-not-supported", "Custom Secrets are not supported by the first webapp release. Remove the backend.secrets entries from app.json.", "guardrails-pitfalls.md"));
+    }
+    // Deno.env: only the platform public three-key whitelist is readable. Any
+    // other key, or dynamic/toObject access that could expose the whole env, is a
+    // blocker. Matched on comment-stripped code so documented examples do not trip it.
+    const envOffenders = new Set();
+    let sawUnverifiableEnv = false;
+    for (const match of code.matchAll(/Deno\.env\.(get|toObject|set|delete)\s*\(([^)]*)\)/g)) {
+        const method = match[1];
+        const argRaw = match[2].trim();
+        if (method === "toObject") {
+            sawUnverifiableEnv = true;
+            continue;
+        }
+        const literal = argRaw.match(/^["']([^"']+)["']/);
+        if (literal) {
+            if (!APP_PUBLIC_ENV_KEYS.has(literal[1]))
+                envOffenders.add(literal[1]);
+        }
+        else {
+            sawUnverifiableEnv = true;
+        }
+    }
+    if (envOffenders.size > 0 || sawUnverifiableEnv) {
+        const detail = envOffenders.size > 0
+            ? [...envOffenders].slice(0, 3).join(", ")
+            : "dynamic key or Deno.env.toObject()";
+        blockers.push(finding("deno-env-not-allowed", `Only the platform public env keys are readable (${[...APP_PUBLIC_ENV_KEYS].join(", ")}). Offending Deno.env access: ${detail}.`, "guardrails-pitfalls.md"));
+    }
+    if ((options.egressPolicy ?? "deny") !== "deny") {
+        blockers.push(finding("egress-deny", 'The first webapp release requires backend.egressPolicy="deny".', "runtime-contract.md"));
+    }
+    const importSpecifiers = [
+        ...code.matchAll(/(?:from\s*|import\s*(?:\(\s*)?)["']([^"']+)["']/g),
+    ].map((match) => match[1]);
+    const remoteImports = importSpecifiers.filter((value) => /^(?:https?:|jsr:|npm:)/.test(value));
+    const ssrLibs = options.ssrLibs ?? [];
+    const isAllowedSsrImport = (value) => ssrLibs.some((e) => value === `npm:${e}` || value.startsWith(`npm:${e}/`));
+    const honoExpected = options.backendFramework === "hono" && options.honoVersion
+        ? `npm:hono@${options.honoVersion}`
+        : null;
+    // Hono (D7): the hono-version rule governs ONLY the Hono import itself.
+    if (options.backendFramework === "hono") {
+        if (!honoExpected || !importSpecifiers.includes(honoExpected)) {
+            blockers.push(finding("hono-version", honoExpected
+                ? `Hono must use the exact platform import ${honoExpected}.`
+                : "Hono is not available because the instance did not report an exact offline-ready version.", "runtime-contract.md"));
+        }
+    }
+    // Off-list remote imports: anything except the exact Hono import and the
+    // capability-curated SSR renderers (npm:<name>@<version>[/subpath]).
+    const offList = remoteImports.filter((value) => {
+        if (honoExpected && value === honoExpected)
+            return false;
+        if (options.backendFramework === "hono" && /^npm:hono@/.test(value))
+            return false; // wrong-version Hono is reported by hono-version above
+        if (value.startsWith("npm:") && isAllowedSsrImport(value))
+            return false;
+        return true;
+    });
+    const npmOffList = offList.filter((value) => value.startsWith("npm:"));
+    const otherOffList = offList.filter((value) => !value.startsWith("npm:"));
+    if (npmOffList.length > 0) {
+        blockers.push(ssrLibs.length > 0
+            ? finding("ssr-lib-not-allowed", `npm import(s) not in this instance's capability ssrLibs: ${npmOffList.slice(0, 3).join(", ")}. Allowed SSR renderers: ${ssrLibs.map((e) => `npm:${e}`).join(", ")} (a /subpath such as /server or /web is allowed).`, "runtime-contract.md")
+            : finding("no-remote-import", `Remote/npm/jsr import(s) are not allowed: ${npmOffList.slice(0, 3).join(", ")}. ` +
+                "This instance reported an EMPTY capabilities.ssrLibs allow-list, so every npm: import is blocked. " +
+                "ssrLibs is a declaration baked from SSR_LIBS_LIST (/etc/supabase/ssr-libs); an empty value usually means " +
+                "the AIO image was built without it even though the sandbox caches the renderers. Fix the instance " +
+                "(bake SSR_LIBS_LIST or set APP_SSR_LIBS, then restart edge-proxy/studio) rather than working around it " +
+                "with --skip-spec-check; Hono itself is gated by hono-version/honoOfflineReady, not by ssrLibs.", "runtime-contract.md"));
+    }
+    if (otherOffList.length > 0) {
+        blockers.push(finding("no-remote-import", `Remote http/https/jsr import(s) are not allowed: ${otherOffList.slice(0, 3).join(", ")}.`, "runtime-contract.md"));
+    }
+    const hasCors = /Access-Control-Allow-Origin/i.test(code);
+    const hasOptions = /OPTIONS/.test(code);
+    if (!hasCors || !hasOptions) {
+        warnings.push({
+            rule: "cors-options",
+            severity: "warning",
+            message: `Missing ${!hasCors ? "CORS headers" : ""}${!hasCors && !hasOptions ? " and " : ""}${!hasOptions ? "OPTIONS handling" : ""}. Browser calls to the backend may fail.`,
+            specRef: `${SPEC}/references/guardrails-pitfalls.md`,
+        });
+    }
+}
+function lintWebappFrontend(options, blockers) {
+    const files = options.frontendFiles ?? [];
+    const normalized = files.map((file) => file.replace(/\\/g, "/"));
+    const forbiddenEnv = normalized.filter((file) => /(^|\/)\.env(?:\.|$)/.test(file));
+    const sourceMaps = normalized.filter((file) => /\.map$/i.test(file));
+    const nodeModules = normalized.filter((file) => /(^|\/)node_modules\//.test(file));
+    const sourceDirs = normalized.filter((file) => /(^|\/)src\//.test(file));
+    const serviceWorkers = normalized.filter((file) => /(^|\/)(?:service-worker|sw)\.(?:js|mjs|ts)$/i.test(file));
+    if (forbiddenEnv.length > 0)
+        blockers.push(finding("no-env-files", `Frontend artifacts must not include .env files: ${forbiddenEnv.slice(0, 5).join(", ")}.`, "guardrails-pitfalls.md"));
+    if (sourceMaps.length > 0)
+        blockers.push(finding("no-source-maps", `Frontend artifacts must not include source maps: ${sourceMaps.slice(0, 5).join(", ")}.`, "guardrails-pitfalls.md"));
+    if (nodeModules.length > 0)
+        blockers.push(finding("no-node-modules", "Upload the built frontend output, not node_modules.", "guardrails-pitfalls.md"));
+    if (sourceDirs.length > 0)
+        blockers.push(finding("no-frontend-source", "Upload the prebuilt frontend directory, not a source directory.", "templates-examples.md"));
+    if (serviceWorkers.length > 0)
+        blockers.push(finding("no-service-worker", `Service Worker files are not supported: ${serviceWorkers.slice(0, 5).join(", ")}.`, "guardrails-pitfalls.md"));
+    const frontendSource = (options.frontendSources ?? [])
+        .map((file) => file.source)
+        .join("\n");
+    const projectSource = (options.frontendProjectSources ?? []).join("\n");
+    if (/navigator\.serviceWorker|serviceWorker\.register\s*\(/.test(`${frontendSource}\n${projectSource}`)) {
+        blockers.push(finding("no-service-worker", "Service Worker registration is not supported by the first webapp release.", "guardrails-pitfalls.md"));
+    }
+    if (options.frontendConfigSource !== undefined &&
+        !/\bbase\s*:\s*["']\.\/["']/.test(options.frontendConfigSource)) {
+        blockers.push(finding("vite-relative-base", 'Vite must set base: "./" so assets remain under the App mount.', "templates-examples.md"));
+    }
+    if (options.frontendConfigSource !== undefined &&
+        /\bsourcemap\s*:\s*(?:true|["'](?:inline|hidden)["'])/.test(options.frontendConfigSource)) {
+        blockers.push(finding("no-source-maps", "Vite source maps must be disabled for uploaded frontend artifacts.", "guardrails-pitfalls.md"));
+    }
+    if (options.requireHashRouter && !/\bHashRouter\b/.test(projectSource)) {
+        blockers.push(finding("react-hash-router", "React webapps must use HashRouter; history fallback is not supported.", "templates-examples.md"));
+    }
+}
+/** SSR (W5): authoring guards for fallback=worker apps (DX-2 marker, D16 self-contained). */
+function lintSsr(backendSource, options, blockers, warnings) {
+    const code = stripComments(backendSource);
+    const probe = options.ssrProbePath;
+    if (typeof probe !== "string" || !probe.startsWith("/") || probe.includes("..")) {
+        blockers.push(finding("ssr-probe-declared", 'manifest.ssrProbePath is required (safe logical path, e.g. "/page") when frontend.fallback="worker".', "runtime-contract.md"));
+    }
+    if (/from\s+["']\.\//.test(code) || /import\s*\(\s*["']\.\//.test(code)) {
+        blockers.push(finding("ssr-self-contained", "SSR worker must be single-file self-contained: relative module imports fail at boot on the current runtime (D16). Inline helpers or import platform-pinned packages only.", "runtime-contract.md"));
+    }
+    // The marker may be written with escaped quotes inside a double-quoted JS
+    // string (e.g. "<div ... data-ssr=\"v1\">"), so match an optional backslash
+    // before each quote rather than a naive substring.
+    if (!/data-ssr=\\?["']v1\\?["']/.test(code)) {
+        blockers.push(finding("ssr-marker-present", 'SSR page output must include the hydration root marker <div id="__ssr" data-ssr="v1"> so the publish probe can verify rendering (DX-2).', "runtime-contract.md"));
+    }
+    if (/\bwindow\b|\bdocument\b/.test(code)) {
+        warnings.push({
+            ...finding("ssr-no-browser-globals", "SSR worker references window/document: server render must not touch browser globals at import or render time.", "runtime-contract.md"),
+            severity: "warning",
+        });
+    }
+}
+/** Lint source and artifact metadata while preserving legacy spa/api/mpa behavior. */
+export function lintAppSource(source, options = {}) {
+    const blockers = [];
+    const warnings = [];
+    const mode = options.mode ?? "spa";
+    const verifyJwt = options.verifyJwt ?? false;
+    const isWebapp = mode === "webapp";
+    const backendSource = options.backendSource ?? source;
+    // Backend lint runs for legacy apps and for webapps with a declared framework.
+    // A webapp backend missing `framework` is rejected earlier by manifest
+    // validation (requireWebappManifestValue, R2-09), so it never reaches a state
+    // where these checks would be silently skipped.
+    if (!isWebapp || options.backendFramework)
+        lintBackend(backendSource, options, blockers, warnings);
+    if (isWebapp)
+        lintWebappFrontend(options, blockers);
+    const scannedSources = isWebapp
+        ? [
+            ...(options.frontendSources ?? []).map((file) => file.source),
+            ...(options.frontendProjectSources ?? []),
+            // R2-08: also scan SSR backend output for root-absolute refs (href="/x",
+            // fetch("/x"), url(/x)) that would escape the /apps/{mount} prefix. Comments
+            // are stripped first so documented examples do not false-positive; server-side
+            // fetches use the injected internal base (base + "/rest/..."), not root-absolute
+            // literals, so legitimate SSR data access is unaffected.
+            ...(options.backendSource ? [stripComments(options.backendSource)] : []),
+        ]
+        : [source, ...(options.auxiliarySources ?? [])];
+    const rootAbs = scanRootAbsoluteRefs(scannedSources.join("\n"));
+    if (rootAbs.length > 0) {
+        blockers.push(finding("no-root-absolute", `Root-absolute reference(s) found: ${rootAbs.slice(0, 3).join(", ")}. Use mount-relative URLs.`, "guardrails-pitfalls.md"));
+    }
+    if (mode === "mpa") {
+        const existing = new Set(options.existingFiles ?? []);
+        const missing = (options.declaredFiles ?? []).filter((file) => !existing.has(file));
+        if (missing.length > 0)
+            blockers.push(finding("mpa-assets-exist", `app.json declares missing page(s)/asset(s): ${missing.join(", ")}.`, "templates-examples.md"));
+    }
+    if (isWebapp && options.ssrFallback)
+        lintSsr(backendSource, options, blockers, warnings);
+    if (isWebapp)
+        lintSession(backendSource, options, blockers, warnings);
+    if (mode === "mpa" || isWebapp) {
+        const files = isWebapp
+            ? (options.frontendFiles ?? [])
+            : (options.existingFiles ?? []);
+        const binary = files.filter((file) => BINARY_ASSET_RE.test(file));
+        if (binary.length > 0)
+            blockers.push(finding("no-binary-assets", `Binary assets are not supported by the text-only release: ${binary.slice(0, 5).join(", ")}. Put binary assets in Storage instead.`, "guardrails-pitfalls.md"));
+    }
+    if (!isWebapp) {
+        const servesHtml = /text\/html/i.test(source);
+        const hasEscape = /\besc\s*\(|escapeHtml|encodeHTML|replace\(\s*\/&\/g/.test(source);
+        if (servesHtml && !hasEscape)
+            warnings.push({
+                rule: "escape-reflected",
+                severity: "warning",
+                message: "Serves text/html but no HTML-escaping helper was found.",
+                specRef: `${SPEC}/references/guardrails-pitfalls.md`,
+            });
+        if (/<script[^>]+src=["']https?:\/\//i.test(source) ||
+            /<link[^>]+href=["']https?:\/\//i.test(source))
+            warnings.push({
+                rule: "no-external-cdn",
+                severity: "warning",
+                message: "External CDN core assets were detected; bundle or inline them.",
+                specRef: `${SPEC}/references/guardrails-pitfalls.md`,
+            });
+        if (!verifyJwt &&
+            /service_role|serviceRoleKey|SERVICE_ROLE|dbPassword|DASHBOARD_PASSWORD|secret\s*[:=]/i.test(source))
+            warnings.push({
+                rule: "no-secrets-public",
+                severity: "warning",
+                message: "A public function appears to reference a secret.",
+                specRef: `${SPEC}/references/guardrails-pitfalls.md`,
+            });
+    }
+    return { passed: blockers.length === 0, blockers, warnings };
+}
+/** 方案 C: session-contract authoring guards for webapp backends. */
+function lintSession(backendSource, options, blockers, warnings) {
+    const session = options.backendSession ?? "none";
+    const src = stripComments(backendSource ?? "");
+    if (session === "proxy-injected") {
+        // Worker must NOT read the client cookie: /apps strips it, so any cookie the
+        // worker sees is a proxy-jar artifact. Identity comes from injected headers.
+        if (/headers?\s*(?:\.get\s*\(\s*["']cookie["']|\[\s*["']cookie["']\s*\])/i.test(src))
+            blockers.push(finding("session-no-cookie-read", 'backend.session="proxy-injected" must not read the Cookie header; use the injected X-App-User-* headers.', "ssr-session.md"));
+        if (/set-cookie/i.test(src))
+            blockers.push(finding("session-no-set-cookie", 'backend.session="proxy-injected" must not issue Set-Cookie; the proxy owns the session cookie.', "ssr-session.md"));
+        if (/[?&](sid|session_token|access_token)=/i.test(src))
+            blockers.push(finding("session-no-url-token", "Do not carry the user token in URLs (?sid=/&token=); the proxy injects X-App-User-Token.", "ssr-session.md"));
+        const headers = (options.sessionHeaders ?? []).map((h) => h.toLowerCase());
+        const used = headers.filter((h) => src.toLowerCase().includes(h));
+        if (used.length === 0)
+            warnings.push({
+                rule: "session-use-injected-header",
+                severity: "warning",
+                message: 'backend.session="proxy-injected" but no capabilities.sessionHeaders reference found; read X-App-User-Token/X-App-User-Id.',
+                specRef: `${SPEC}/references/ssr-session.md`,
+            });
+        // Any X-App-User-* header not in the capability whitelist is a forgery risk / typo.
+        const referenced = [
+            ...new Set((src.toLowerCase().match(/x-app-user-[a-z-]+/g) ?? [])),
+        ];
+        const unknown = referenced.filter((h) => !headers.includes(h));
+        if (unknown.length > 0)
+            blockers.push(finding("session-header-name-whitelist", `Unknown injected session header(s): ${unknown.join(", ")}. Use only capabilities.sessionHeaders.`, "ssr-session.md"));
+        if (/JWT_SECRET/i.test(src))
+            warnings.push({
+                rule: "session-env-secret",
+                severity: "warning",
+                message: "proxy-injected sessions are verified by the proxy; the worker needs no JWT signing secret.",
+                specRef: `${SPEC}/references/ssr-session.md`,
+            });
+    }
+    if (session === "browser-side") {
+        if (/headers?\s*(?:\.get\s*\(\s*["'](cookie|authorization)["']|\[\s*["'](cookie|authorization)["']\s*\])/i
+            .test(src))
+            warnings.push({
+                rule: "session-browser-side-no-worker-auth",
+                severity: "warning",
+                message: 'backend.session="browser-side": authentication belongs in the browser (localStorage + Authorization to /auth,/rest), not the worker.',
+                specRef: `${SPEC}/references/ssr-session.md`,
+            });
+    }
+}
+//# sourceMappingURL=spec-lint.js.map

package/dist/app/spec-lint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-lint.js","sourceRoot":"","sources":["../../src/app/spec-lint.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAkDtD,MAAM,IAAI,GAAG,iBAAiB,CAAC;AAC/B,MAAM,eAAe,GACnB,qGAAqG,CAAC;AACxG,MAAM,aAAa,GAAwC;IACzD,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE;IAC3C,EAAE,EAAE,EAAE,gCAAgC,EAAE,IAAI,EAAE,cAAc,EAAE;IAC9D;QACE,EAAE,EAAE,2FAA2F;QAC/F,IAAI,EAAE,qBAAqB;KAC5B;IACD;QACE,EAAE,EAAE,oDAAoD;QACxD,IAAI,EAAE,WAAW;KAClB;IACD,EAAE,EAAE,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE;CACrE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,cAAc;IACd,mBAAmB;IACnB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,IAAI,KAAK,GAAoD,MAAM,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,MAAM,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAClE,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,OAAO,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnE,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,IAAI,CAAC;gBAAC,GAAG,IAAI,CAAC,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YACzD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,IAAI,CAAC;gBAAC,GAAG,IAAI,CAAC,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YACzD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,KAAK,CAAC;gBAAC,GAAG,IAAI,CAAC,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1D,GAAG,IAAI,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAC1B,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAAC,KAAK,GAAG,MAAM,CAAC;gBAAC,GAAG,IAAI,CAAC,CAAC;YAAC,CAAC;YAC7C,CAAC,EAAE,CAAC;YAAC,SAAS;QAChB,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,MAAM,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAClE,IAAI,CAAC,KAAK,IAAI;gBAAE,GAAG,IAAI,CAAC,CAAC;YACzB,CAAC,EAAE,CAAC;YAAC,SAAS;QAChB,CAAC;QACD,oEAAoE;QACpE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,IACE,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;YAC7B,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;YAC7B,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC,EAC9B,CAAC;YACD,KAAK,GAAG,MAAM,CAAC;QACjB,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QAAC,CAAC,EAAE,CAAC;QAAC,SAAS;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe,EAAE,GAAW;IACzD,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,SAAS;QACnB,OAAO;QACP,OAAO,EAAE,GAAG,IAAI,eAAe,GAAG,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,MAAc,EACd,OAAwB,EACxB,QAAmB,EACnB,QAAmB;IAEnB,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,YAAY,EACZ,+FAA+F,EAC/F,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,aAAa,EACb,yBAAyB,IAAI,iCAAiC,EAC9D,qBAAqB,CACtB,CACF,CAAC;YACF,MAAM;QACR,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,8BAA8B,EAC9B,iHAAiH,EACjH,wBAAwB,CACzB,CACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,8EAA8E;IAC9E,mFAAmF;IACnF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAC/B,qDAAqD,CACtD,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,kBAAkB,GAAG,IAAI,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAChD,MAAM,MAAM,GACV,YAAY,CAAC,IAAI,GAAG,CAAC;YACnB,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1C,CAAC,CAAC,oCAAoC,CAAC;QAC3C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,sBAAsB,EACtB,mDAAmD,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,MAAM,GAAG,EAChI,wBAAwB,CACzB,CACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,aAAa,EACb,gEAAgE,EAChE,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG;QACvB,GAAG,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC;KACrE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACtD,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CACrC,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAW,EAAE,CACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,MAAM,YAAY,GAChB,OAAO,CAAC,gBAAgB,KAAK,MAAM,IAAI,OAAO,CAAC,WAAW;QACxD,CAAC,CAAC,YAAY,OAAO,CAAC,WAAW,EAAE;QACnC,CAAC,CAAC,IAAI,CAAC;IAEX,wEAAwE;IACxE,IAAI,OAAO,CAAC,gBAAgB,KAAK,MAAM,EAAE,CAAC;QACxC,IAAI,CAAC,YAAY,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,cAAc,EACd,YAAY;gBACV,CAAC,CAAC,2CAA2C,YAAY,GAAG;gBAC5D,CAAC,CAAC,2FAA2F,EAC/F,qBAAqB,CACtB,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7C,IAAI,YAAY,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,KAAK,CAAC;QACzD,IAAI,OAAO,CAAC,gBAAgB,KAAK,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YACjE,OAAO,KAAK,CAAC,CAAC,uDAAuD;QACvE,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,MAAM,GAAG,CAAC;YAChB,CAAC,CAAC,OAAO,CACL,qBAAqB,EACrB,4DAA4D,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD,EACrN,qBAAqB,CACtB;YACH,CAAC,CAAC,OAAO,CACL,kBAAkB,EAClB,6CAA6C,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAChF,oGAAoG;gBACpG,2GAA2G;gBAC3G,oGAAoG;gBACpG,yGAAyG;gBACzG,gGAAgG,EAClG,qBAAqB,CACtB,CACN,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,kBAAkB,EAClB,oDAAoD,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAC1F,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,0CAA0C;YAC7K,OAAO,EAAE,GAAG,IAAI,oCAAoC;SACrD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAwB,EACxB,QAAmB;IAEnB,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9C,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CACjC,CAAC;IACF,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7C,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAClC,CAAC;IACF,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAChD,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1D,CAAC;IAEF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,cAAc,EACd,mDAAmD,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACzF,wBAAwB,CACzB,CACF,CAAC;IACJ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,gBAAgB,EAChB,oDAAoD,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACxF,wBAAwB,CACzB,CACF,CAAC;IACJ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QACxB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,iBAAiB,EACjB,qDAAqD,EACrD,wBAAwB,CACzB,CACF,CAAC;IACJ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,iEAAiE,EACjE,uBAAuB,CACxB,CACF,CAAC;IACJ,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAC3B,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,mBAAmB,EACnB,2CAA2C,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACnF,wBAAwB,CACzB,CACF,CAAC;IAEJ,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;SACnD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;SAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,IACE,uDAAuD,CAAC,IAAI,CAC1D,GAAG,cAAc,KAAK,aAAa,EAAE,CACtC,EACD,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,mBAAmB,EACnB,2EAA2E,EAC3E,wBAAwB,CACzB,CACF,CAAC;IACJ,CAAC;IAED,IACE,OAAO,CAAC,oBAAoB,KAAK,SAAS;QAC1C,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAC/D,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,gEAAgE,EAChE,uBAAuB,CACxB,CACF,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,oBAAoB,KAAK,SAAS;QAC1C,sDAAsD,CAAC,IAAI,CACzD,OAAO,CAAC,oBAAoB,CAC7B,EACD,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,gBAAgB,EAChB,oEAAoE,EACpE,wBAAwB,CACzB,CACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,mBAAmB,EACnB,uEAAuE,EACvE,uBAAuB,CACxB,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,OAAO,CACd,aAAqB,EACrB,OAAwB,EACxB,QAAmB,EACnB,QAAmB;IAEnB,MAAM,IAAI,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,sGAAsG,EACtG,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,2KAA2K,EAC3K,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,mDAAmD;IACnD,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,oBAAoB,EACpB,yIAAyI,EACzI,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IACD,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,OAAO,CACR,wBAAwB,EACxB,+GAA+G,EAC/G,qBAAqB,CACtB;YACD,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,UAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,KAAK,QAAQ,CAAC;IACnC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IAEtD,+EAA+E;IAC/E,uEAAuE;IACvE,8EAA8E;IAC9E,gDAAgD;IAChD,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,gBAAgB;QACvC,WAAW,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,QAAQ;QAAE,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEpD,MAAM,cAAc,GAAG,QAAQ;QAC7B,CAAC,CAAC;YACE,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,sBAAsB,IAAI,EAAE,CAAC;YACzC,yEAAyE;YACzE,6EAA6E;YAC7E,+EAA+E;YAC/E,iFAAiF;YACjF,yDAAyD;YACzD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE;QACH,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,kBAAkB,EAClB,qCAAqC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAC/F,wBAAwB,CACzB,CACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAC9B,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,kBAAkB,EAClB,+CAA+C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACpE,uBAAuB,CACxB,CACF,CAAC;IACN,CAAC;IAED,IAAI,QAAQ,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACzF,IAAI,QAAQ;QAAE,WAAW,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEtE,IAAI,IAAI,KAAK,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ;YACpB,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;YAC/B,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACnB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,kBAAkB,EAClB,6DAA6D,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,EACnI,wBAAwB,CACzB,CACF,CAAC;IACN,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GACb,qDAAqD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,UAAU,IAAI,CAAC,SAAS;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,yDAAyD;gBAClE,OAAO,EAAE,GAAG,IAAI,oCAAoC;aACrD,CAAC,CAAC;QACL,IACE,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/C,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC;YAE9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EACL,gEAAgE;gBAClE,OAAO,EAAE,GAAG,IAAI,oCAAoC;aACrD,CAAC,CAAC;QACL,IACE,CAAC,SAAS;YACV,uFAAuF,CAAC,IAAI,CAC1F,MAAM,CACP;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,kDAAkD;gBAC3D,OAAO,EAAE,GAAG,IAAI,oCAAoC;aACrD,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC/D,CAAC;AAED,mEAAmE;AACnE,SAAS,WAAW,CAClB,aAAqB,EACrB,OAAwB,EACxB,QAAmB,EACnB,QAAmB;IAEnB,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC;IACjD,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACjC,6EAA6E;QAC7E,6EAA6E;QAC7E,IAAI,sEAAsE,CAAC,IAAI,CAAC,GAAG,CAAC;YAClF,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,wBAAwB,EACxB,0GAA0G,EAC1G,gBAAgB,CACjB,CACF,CAAC;QACJ,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,uBAAuB,EACvB,gGAAgG,EAChG,gBAAgB,CACjB,CACF,CAAC;QACJ,IAAI,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC;YACpD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,sBAAsB,EACtB,0FAA0F,EAC1F,gBAAgB,CACjB,CACF,CAAC;QACJ,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,6BAA6B;gBACnC,QAAQ,EAAE,SAAS;gBACnB,OAAO,EACL,2HAA2H;gBAC7H,OAAO,EAAE,GAAG,IAAI,4BAA4B;aAC7C,CAAC,CAAC;QACL,oFAAoF;QACpF,MAAM,UAAU,GAAG;YACjB,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CACvD;SACF,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,+BAA+B,EAC/B,uCAAuC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,EAClG,gBAAgB,CACjB,CACF,CAAC;QACJ,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EACL,4FAA4F;gBAC9F,OAAO,EAAE,GAAG,IAAI,4BAA4B;aAC7C,CAAC,CAAC;IACP,CAAC;IACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,IACE,sGAAsG;aACnG,IAAI,CAAC,GAAG,CAAC;YAEZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,qCAAqC;gBAC3C,QAAQ,EAAE,SAAS;gBACnB,OAAO,EACL,sIAAsI;gBACxI,OAAO,EAAE,GAAG,IAAI,4BAA4B;aAC7C,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}

package/dist/app/templates.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Webapp template resolution & scaffolding for `pxbaas app`.
+ *
+ * Templates ship as package files under `apps/baas/templates/webapp/` (route A,
+ * same as the bundled skill). We resolve the package root by walking up from this
+ * module until we find `templates/webapp/manifest.json`. The standalone single-file
+ * binary does not carry these assets; scaffolding then fails with a clear error.
+ */
+export type AppMode = "spa" | "api" | "mpa" | "webapp";
+export type BackendFramework = "deno" | "hono";
+export interface AppFrontend {
+    root: string;
+    routing: "files";
+    index: string;
+    /** null = static-only; "worker" = static-miss falls through to the worker (SSR). */
+    fallback: null | "worker";
+}
+export interface AppBackend {
+    entrypoint: string;
+    framework: BackendFramework;
+    pathMode: "strip-app-api-prefix";
+    verifyJwt: boolean;
+    secrets: string[];
+    egressPolicy: "deny";
+    /** 方案 C: session delivery. none | proxy-injected | browser-side. */
+    session?: "none" | "proxy-injected" | "browser-side";
+    /**
+     * Optional backend health probe path for `pxbaas app verify` (a mount-relative
+     * logical path such as "/api/health"). When absent, verify checks only the
+     * mount homepage and does NOT probe a fixed backend route.
+     */
+    healthPath?: string;
+}
+export interface WebappTemplate {
+    id: string;
+    description: string;
+    entrypoint: string;
+    /** Deploy mode written into app.json; defaults to the template id (spa/api). */
+    mode?: AppMode;
+    /** Multi-file templates list every file to scaffold; paths may be nested. */
+    files?: string[];
+    /** mpa: the static HTML pages served by path. */
+    pages?: string[];
+    /** mpa: the static assets (css/js/images) served by path. */
+    assets?: string[];
+    /** webapp: prebuilt frontend artifact contract. */
+    frontend?: AppFrontend;
+    /** webapp: optional Deno/Hono backend contract. */
+    backend?: AppBackend | null;
+    /** webapp SSR (DX-2): publish-probe logical path; required when frontend.fallback==="worker". */
+    ssrProbePath?: string;
+    /**
+     * Machine-readable post-scaffold TODOs surfaced by `app new --json` (R2-11):
+     * e.g. database initialization for templates that ship db/schema.sql. The CLI
+     * never auto-runs DDL; these are reminders requiring explicit user action.
+     */
+    nextSteps?: string[];
+}
+export interface AppManifest {
+    schemaVersion?: 1 | 2;
+    name: string;
+    slug: string;
+    template: string;
+    entrypoint: string;
+    verifyJwt: boolean;
+    createdAt: string;
+    /** Legacy spa/api/mpa modes and the v2 webapp mode are both supported. */
+    mode?: AppMode;
+    /** mpa: static HTML pages that must exist and be served by path. */
+    pages?: string[];
+    /** mpa: static assets that must exist and be served by path. */
+    assets?: string[];
+    /** webapp: frontend staging layout. */
+    frontend?: AppFrontend;
+    /** webapp: backend runtime contract; null for static-only apps. */
+    backend?: AppBackend | null;
+    /** Optional SSR publish-probe path (DX-2): logical path returning the SSR page. */
+    ssrProbePath?: string;
+    /** Local deployment state used by lifecycle commands; ignored by the runtime. */
+    deployment?: {
+        mountId: string;
+        candidateFunctionSlug?: string;
+        generation: number;
+    };
+}
+/** Replaced with the exact capability version only in the uploaded candidate. */
+export declare const HONO_VERSION_PLACEHOLDER = "{{HONO_VERSION}}";
+export declare class TemplatesNotFoundError extends Error {
+    constructor(message: string);
+}
+/** Walk up to find the package root holding templates/webapp/manifest.json. */
+export declare function resolveTemplatesRoot(startDir?: string): string | null;
+export declare function resolveTemplatesDir(startDir?: string): string;
+export declare function listTemplates(startDir?: string): Promise<WebappTemplate[]>;
+/**
+ * Synchronous template-id list for CLI help text (command registration is sync).
+ * Returns [] when the bundled templates are unavailable (standalone binary), so
+ * callers can fall back to a generic hint instead of throwing at startup.
+ */
+export declare function listTemplateIdsSync(startDir?: string): string[];
+/** Read a template's entrypoint and substitute {{APP_NAME}} / {{SLUG}}. */
+export declare function renderTemplate(templateId: string, vars: {
+    appName: string;
+    slug: string;
+}, startDir?: string): Promise<{
+    entrypoint: string;
+    source: string;
+}>;
+/**
+ * Resolve a template definition and render every file it declares.
+ *
+ * Single-file templates (spa/api) render just the entrypoint; multi-file
+ * templates (mpa) render each entry in `files` (falling back to the entrypoint).
+ * Returns the template definition plus the rendered `{ name, source }` list.
+ */
+export declare function renderTemplateFiles(templateId: string, vars: {
+    appName: string;
+    slug: string;
+}, startDir?: string): Promise<{
+    template: WebappTemplate;
+    files: Array<{
+        name: string;
+        source: string;
+    }>;
+}>;
+/**
+ * Scaffold a new app under `<dir>/<name>/`: writes the rendered entrypoint and an
+ * `app.json` manifest. Refuses to overwrite an existing entrypoint unless forced.
+ */
+export declare function scaffoldApp(opts: {
+    name: string;
+    slug: string;
+    template: string;
+    dir: string;
+    force?: boolean;
+    startDir?: string;
+}): Promise<{
+    appDir: string;
+    files: string[];
+    manifest: AppManifest;
+    nextSteps: string[];
+}>;
+//# sourceMappingURL=templates.d.ts.map

package/dist/app/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/app/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;AACvD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,QAAQ,EAAE,IAAI,GAAG,QAAQ,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,cAAc,CAAC;IACrD;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,mDAAmD;IACnD,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,iGAAiG;IACjG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,mEAAmE;IACnE,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAMD,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAClC,QAAQ,GAAE,MAAoB,GAC7B,MAAM,GAAG,IAAI,CAUf;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,GAAE,MAAoB,GAAG,MAAM,CAQ1E;AAED,wBAAsB,aAAa,CACjC,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,EAAE,CAAC,CAQ3B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAU/D;AAED,2EAA2E;AAC3E,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvC,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAYjD;AAWD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvC,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IACT,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC,CAiBD;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAwD3F"}