@rebasepro/server 0.13.0 → 0.13.1-canary.g06dbe5b

package/dist/logger-DfvF_8r-.js

@@ -0,0 +1,190 @@
+import { createRequire as __createRequire } from "module";
+import process from "process";
+__createRequire(import.meta.url);
+//#region src/utils/logger.ts
+/** Google Cloud Logging severity strings. */
+var GCP_SEVERITY = {
+	debug: "DEBUG",
+	info: "INFO",
+	warn: "WARNING",
+	error: "ERROR"
+};
+var LOG_PRIORITY = {
+	debug: 0,
+	info: 1,
+	warn: 2,
+	error: 3
+};
+function isProduction() {
+	return process.env.NODE_ENV === "production";
+}
+function getMinLevel() {
+	const env = (process.env.LOG_LEVEL || "info").toLowerCase();
+	if (env in LOG_PRIORITY) return env;
+	return "info";
+}
+var FAILED_QUERY_MARKER = "Failed query:";
+var REDACTED_QUERY = "Failed query: [redacted]";
+var REDACTED_VALUE = "[redacted]";
+/**
+* Key fragments whose values are never safe to publish. Compared against the
+* key with separators and case removed, so `api_key`, `apiKey` and `API-KEY`
+* all match `apikey`.
+*/
+var SENSITIVE_KEY_FRAGMENTS = [
+	"password",
+	"passwd",
+	"passphrase",
+	"secret",
+	"token",
+	"apikey",
+	"authorization",
+	"credential",
+	"cookie",
+	"privatekey",
+	"sessionid"
+];
+/** Longest structure the redactor will walk before giving up. */
+var MAX_REDACT_DEPTH = 8;
+function isSensitiveKey(key) {
+	const normalised = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+	return SENSITIVE_KEY_FRAGMENTS.some((fragment) => normalised.includes(fragment));
+}
+/**
+* Local escape hatch for the `Failed query:` strip only — the statement is the
+* fastest way to diagnose a failing query on a developer machine. Ignored in
+* production, so a runtime that inherits the variable cannot leak because of
+* it, and it never re-enables the key deny-list.
+*/
+function rawQueriesAllowed() {
+	return process.env.NODE_ENV !== "production" && process.env.REBASE_LOG_RAW_QUERIES === "true";
+}
+/**
+* Strip every `Failed query: … / params: …` span out of a message or stack,
+* keeping the surrounding text (including stack frames, which carry no user
+* data). When no `params:` line follows the marker the rest of the string is
+* dropped: a statement of unknown extent is treated as sensitive rather than
+* guessed at.
+*
+* Idempotent, and it has to be: an already-redacted span still starts with the
+* marker but has no `params:` line, so a second pass over it would fall into
+* the drop-the-rest branch and eat the stack frames behind it. Redaction runs
+* more than once on the same string in practice — the cron scheduler redacts
+* before persisting and then logs the result.
+*/
+function redactSensitiveText(text) {
+	if (!text.includes(FAILED_QUERY_MARKER) || rawQueriesAllowed()) return text;
+	let out = text;
+	let idx = out.indexOf(FAILED_QUERY_MARKER);
+	while (idx !== -1) {
+		if (out.startsWith(REDACTED_QUERY, idx)) {
+			idx = out.indexOf(FAILED_QUERY_MARKER, idx + 24);
+			continue;
+		}
+		const paramsIdx = out.indexOf("\nparams:", idx);
+		let end;
+		if (paramsIdx === -1) end = out.length;
+		else {
+			const eol = out.indexOf("\n", paramsIdx + 1);
+			end = eol === -1 ? out.length : eol;
+		}
+		out = out.slice(0, idx) + REDACTED_QUERY + out.slice(end);
+		idx = out.indexOf(FAILED_QUERY_MARKER, idx + 24);
+	}
+	return out;
+}
+/**
+* Serialise an Error into a plain object (stack + message), with the query
+* text redacted out of both. `query`/`params` own-properties — which
+* `DrizzleQueryError` carries beside the message — are deliberately not
+* copied.
+* Handles non-Error values gracefully.
+*/
+function serialiseError(value) {
+	if (value instanceof Error) return {
+		name: value.name,
+		message: redactSensitiveText(value.message),
+		stack: value.stack ? redactSensitiveText(value.stack) : void 0
+	};
+	return { value: redactSensitiveText(String(value)) };
+}
+/**
+* Redact one logged value: errors are serialised, strings are stripped of
+* query text, objects and arrays are walked. Cycles and over-deep structures
+* collapse to a marker rather than throwing — a logger that can fail is worse
+* than one that logs less. (An object referenced twice in one payload is
+* reported as `[circular]` the second time; bounding the walk matters more
+* than rendering a shared reference twice.)
+*/
+function redactValue(value, depth, seen) {
+	if (value instanceof Error) return serialiseError(value);
+	if (typeof value === "string") return redactSensitiveText(value);
+	if (value === null || typeof value !== "object") return value;
+	if (depth >= MAX_REDACT_DEPTH) return "[truncated]";
+	if (seen.has(value)) return "[circular]";
+	seen.add(value);
+	if (Array.isArray(value)) return value.map((item) => redactValue(item, depth + 1, seen));
+	if (value instanceof Date) return value;
+	const out = {};
+	for (const [key, val] of Object.entries(value)) out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, depth + 1, seen);
+	return out;
+}
+function formatData(data) {
+	if (!data) return void 0;
+	const seen = /* @__PURE__ */ new WeakSet();
+	const out = {};
+	for (const [key, val] of Object.entries(data)) out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, 0, seen);
+	return out;
+}
+function createLogger(rawDefaultFields = {}) {
+	const minLevel = getMinLevel();
+	const defaultFields = formatData(rawDefaultFields) ?? {};
+	function emit(level, message, data) {
+		if (LOG_PRIORITY[level] < LOG_PRIORITY[minLevel]) return;
+		const safeMessage = redactSensitiveText(message);
+		const merged = {
+			...defaultFields,
+			...formatData(data)
+		};
+		if (isProduction()) {
+			const entry = {
+				severity: GCP_SEVERITY[level],
+				message: safeMessage,
+				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+				...merged
+			};
+			const line = JSON.stringify(entry);
+			if (level === "error") process.stderr.write(line + "\n");
+			else process.stdout.write(line + "\n");
+		} else {
+			const prefix = level === "error" ? "❌" : level === "warn" ? "⚠️" : level === "info" ? "ℹ️" : "🐛";
+			const extra = Object.keys(merged).length > 0 ? ` ${JSON.stringify(merged)}` : "";
+			const out = `${prefix} [${level.toUpperCase()}] ${safeMessage}${extra}`;
+			if (level === "error") console.error(out);
+			else if (level === "warn") console.warn(out);
+			else console.log(out);
+		}
+	}
+	return {
+		debug: (msg, data) => emit("debug", msg, data),
+		info: (msg, data) => emit("info", msg, data),
+		warn: (msg, data) => emit("warn", msg, data),
+		error: (msg, data) => emit("error", msg, data),
+		child(fields) {
+			return createLogger({
+				...defaultFields,
+				...fields
+			});
+		}
+	};
+}
+/**
+* Singleton logger instance.
+* In production: emits JSON lines with `severity`, `message`, `timestamp`.
+* In development: emits human-readable prefixed lines.
+*/
+var logger = createLogger();
+//#endregion
+export { redactSensitiveText as n, logger as t };
+
+//# sourceMappingURL=logger-DfvF_8r-.js.map

package/dist/logger-DfvF_8r-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger-DfvF_8r-.js","names":[],"sources":["../src/utils/logger.ts"],"sourcesContent":["/**\n * Structured Logger for Rebase Backend\n *\n * Outputs JSON lines when `NODE_ENV=production`, human-readable prefixed\n * lines otherwise.  Designed to work with Google Cloud Logging severity levels.\n *\n * Every line — message and data, at any depth — passes through the redaction\n * below, which strips Drizzle's `Failed query: … / params: …` wrapper and the\n * values of secret-looking keys. See the block above `serialiseError`.\n *\n * Usage:\n *   import { logger } from \"./utils/logger\";\n *   logger.info(\"Server started\", { port: 3001 });\n *   logger.error(\"Request failed\", { path: \"/api/test\", error: err });\n */\n\nexport type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\n/** Google Cloud Logging severity strings. */\nconst GCP_SEVERITY: Record<LogLevel, string> = {\n    debug: \"DEBUG\",\n    info: \"INFO\",\n    warn: \"WARNING\",\n    error: \"ERROR\"\n};\n\nconst LOG_PRIORITY: Record<LogLevel, number> = {\n    debug: 0,\n    info: 1,\n    warn: 2,\n    error: 3\n};\n\nexport interface LogEntry {\n    severity: string;\n    message: string;\n    timestamp: string;\n    [key: string]: unknown;\n}\n\nexport interface Logger {\n    debug(message: string, data?: Record<string, unknown>): void;\n    info(message: string, data?: Record<string, unknown>): void;\n    warn(message: string, data?: Record<string, unknown>): void;\n    error(message: string, data?: Record<string, unknown>): void;\n    child(defaultFields: Record<string, unknown>): Logger;\n}\n\nfunction isProduction(): boolean {\n    return process.env.NODE_ENV === \"production\";\n}\n\nfunction getMinLevel(): LogLevel {\n    const env = (process.env.LOG_LEVEL || \"info\").toLowerCase();\n    if (env in LOG_PRIORITY) return env as LogLevel;\n    return \"info\";\n}\n\n// ── Redaction ───────────────────────────────────────────────────────\n//\n// Drizzle builds every query failure as\n// `Failed query: ${query}\\nparams: ${params}` (drizzle-orm/errors.js), so the\n// statement *and* every bound value ride along in `.message` and `.stack` of\n// whatever a driver rethrows — an email and a bcrypt hash reach stdout the\n// moment a registration hits a unique violation. The redaction lives here, in\n// the one function every log line passes through, rather than at the ~124\n// `{ error: … }` call sites: a per-site rule is what produced the leak (one\n// file suppressed the stack, four others did not), and the next caller would\n// reintroduce it. Nothing above this line needs to know about it.\n\nconst FAILED_QUERY_MARKER = \"Failed query:\";\nconst REDACTED_QUERY = \"Failed query: [redacted]\";\nconst REDACTED_VALUE = \"[redacted]\";\n\n/**\n * Key fragments whose values are never safe to publish. Compared against the\n * key with separators and case removed, so `api_key`, `apiKey` and `API-KEY`\n * all match `apikey`.\n */\nconst SENSITIVE_KEY_FRAGMENTS = [\n    \"password\",\n    \"passwd\",\n    \"passphrase\",\n    \"secret\",\n    \"token\",\n    \"apikey\",\n    \"authorization\",\n    \"credential\",\n    \"cookie\",\n    \"privatekey\",\n    \"sessionid\"\n];\n\n/** Longest structure the redactor will walk before giving up. */\nconst MAX_REDACT_DEPTH = 8;\n\nfunction isSensitiveKey(key: string): boolean {\n    const normalised = key.toLowerCase().replace(/[^a-z0-9]/g, \"\");\n    return SENSITIVE_KEY_FRAGMENTS.some(fragment => normalised.includes(fragment));\n}\n\n/**\n * Local escape hatch for the `Failed query:` strip only — the statement is the\n * fastest way to diagnose a failing query on a developer machine. Ignored in\n * production, so a runtime that inherits the variable cannot leak because of\n * it, and it never re-enables the key deny-list.\n */\nfunction rawQueriesAllowed(): boolean {\n    return process.env.NODE_ENV !== \"production\"\n        && process.env.REBASE_LOG_RAW_QUERIES === \"true\";\n}\n\n/**\n * Strip every `Failed query: … / params: …` span out of a message or stack,\n * keeping the surrounding text (including stack frames, which carry no user\n * data). When no `params:` line follows the marker the rest of the string is\n * dropped: a statement of unknown extent is treated as sensitive rather than\n * guessed at.\n *\n * Idempotent, and it has to be: an already-redacted span still starts with the\n * marker but has no `params:` line, so a second pass over it would fall into\n * the drop-the-rest branch and eat the stack frames behind it. Redaction runs\n * more than once on the same string in practice — the cron scheduler redacts\n * before persisting and then logs the result.\n */\nexport function redactSensitiveText(text: string): string {\n    if (!text.includes(FAILED_QUERY_MARKER) || rawQueriesAllowed()) return text;\n\n    let out = text;\n    let idx = out.indexOf(FAILED_QUERY_MARKER);\n    while (idx !== -1) {\n        if (out.startsWith(REDACTED_QUERY, idx)) {\n            idx = out.indexOf(FAILED_QUERY_MARKER, idx + REDACTED_QUERY.length);\n            continue;\n        }\n        const paramsIdx = out.indexOf(\"\\nparams:\", idx);\n        let end: number;\n        if (paramsIdx === -1) {\n            end = out.length;\n        } else {\n            const eol = out.indexOf(\"\\n\", paramsIdx + 1);\n            end = eol === -1 ? out.length : eol;\n        }\n        out = out.slice(0, idx) + REDACTED_QUERY + out.slice(end);\n        idx = out.indexOf(FAILED_QUERY_MARKER, idx + REDACTED_QUERY.length);\n    }\n    return out;\n}\n\n/**\n * Serialise an Error into a plain object (stack + message), with the query\n * text redacted out of both. `query`/`params` own-properties — which\n * `DrizzleQueryError` carries beside the message — are deliberately not\n * copied.\n * Handles non-Error values gracefully.\n */\nfunction serialiseError(value: unknown): Record<string, unknown> {\n    if (value instanceof Error) {\n        return {\n            name: value.name,\n            message: redactSensitiveText(value.message),\n            stack: value.stack ? redactSensitiveText(value.stack) : undefined\n        };\n    }\n    return { value: redactSensitiveText(String(value)) };\n}\n\n/**\n * Redact one logged value: errors are serialised, strings are stripped of\n * query text, objects and arrays are walked. Cycles and over-deep structures\n * collapse to a marker rather than throwing — a logger that can fail is worse\n * than one that logs less. (An object referenced twice in one payload is\n * reported as `[circular]` the second time; bounding the walk matters more\n * than rendering a shared reference twice.)\n */\nfunction redactValue(value: unknown, depth: number, seen: WeakSet<object>): unknown {\n    // `serialiseError` returns only already-redacted strings, so it is the\n    // terminal step — walking its output again would redact twice.\n    if (value instanceof Error) return serialiseError(value);\n    if (typeof value === \"string\") return redactSensitiveText(value);\n    if (value === null || typeof value !== \"object\") return value;\n    if (depth >= MAX_REDACT_DEPTH) return \"[truncated]\";\n    if (seen.has(value)) return \"[circular]\";\n    seen.add(value);\n\n    if (Array.isArray(value)) {\n        return value.map(item => redactValue(item, depth + 1, seen));\n    }\n    if (value instanceof Date) return value;\n\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(value as Record<string, unknown>)) {\n        out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, depth + 1, seen);\n    }\n    return out;\n}\n\nfunction formatData(data?: Record<string, unknown>): Record<string, unknown> | undefined {\n    if (!data) return undefined;\n    const seen = new WeakSet<object>();\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(data)) {\n        out[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(val, 0, seen);\n    }\n    return out;\n}\n\nfunction createLogger(rawDefaultFields: Record<string, unknown> = {}): Logger {\n    const minLevel = getMinLevel();\n    // Child fields go through the same pass as per-call data — they are merged\n    // into every line this logger emits, so leaving them raw would be a hole\n    // the moment `child()` gets its first caller.\n    const defaultFields = formatData(rawDefaultFields) ?? {};\n\n    function emit(level: LogLevel, message: string, data?: Record<string, unknown>): void {\n        if (LOG_PRIORITY[level] < LOG_PRIORITY[minLevel]) return;\n\n        // The message is redacted too, not just the data: several call sites\n        // interpolate `error.message` straight into the line they log.\n        const safeMessage = redactSensitiveText(message);\n        const merged = { ...defaultFields,\n...formatData(data) };\n\n        if (isProduction()) {\n            // Structured JSON for Cloud Logging\n            const entry: LogEntry = {\n                severity: GCP_SEVERITY[level],\n                message: safeMessage,\n                timestamp: new Date().toISOString(),\n                ...merged\n            };\n            const line = JSON.stringify(entry);\n\n            if (level === \"error\") {\n                process.stderr.write(line + \"\\n\");\n            } else {\n                process.stdout.write(line + \"\\n\");\n            }\n        } else {\n            // Human-readable for development\n            const prefix = level === \"error\" ? \"❌\"\n                : level === \"warn\" ? \"⚠️\"\n                : level === \"info\" ? \"ℹ️\"\n                : \"🐛\";\n            const extra = Object.keys(merged).length > 0 ? ` ${JSON.stringify(merged)}` : \"\";\n            const out = `${prefix} [${level.toUpperCase()}] ${safeMessage}${extra}`;\n\n            if (level === \"error\") {\n                console.error(out);\n            } else if (level === \"warn\") {\n                console.warn(out);\n            } else {\n                console.log(out);\n            }\n        }\n    }\n\n    return {\n        debug: (msg, data) => emit(\"debug\", msg, data),\n        info: (msg, data) => emit(\"info\", msg, data),\n        warn: (msg, data) => emit(\"warn\", msg, data),\n        error: (msg, data) => emit(\"error\", msg, data),\n        child(fields: Record<string, unknown>): Logger {\n            return createLogger({ ...defaultFields,\n...fields });\n        }\n    };\n}\n\n/**\n * Singleton logger instance.\n * In production: emits JSON lines with `severity`, `message`, `timestamp`.\n * In development: emits human-readable prefixed lines.\n */\nexport const logger: Logger = createLogger();\n"],"mappings":";;;;;AAmBA,IAAM,eAAyC;CAC3C,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;AACX;AAEA,IAAM,eAAyC;CAC3C,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;AACX;AAiBA,SAAS,eAAwB;CAC7B,OAAA,QAAA,IAAA,aAAgC;AACpC;AAEA,SAAS,cAAwB;CAC7B,MAAM,OAAO,QAAQ,IAAI,aAAa,OAAA,CAAQ,YAAY;CAC1D,IAAI,OAAO,cAAc,OAAO;CAChC,OAAO;AACX;AAcA,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;;;;;;AAOvB,IAAM,0BAA0B;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;AAGA,IAAM,mBAAmB;AAEzB,SAAS,eAAe,KAAsB;CAC1C,MAAM,aAAa,IAAI,YAAY,CAAC,CAAC,QAAQ,cAAc,EAAE;CAC7D,OAAO,wBAAwB,MAAK,aAAY,WAAW,SAAS,QAAQ,CAAC;AACjF;;;;;;;AAQA,SAAS,oBAA6B;CAClC,OAAA,QAAA,IAAA,aAAgC,gBACzB,QAAQ,IAAI,2BAA2B;AAClD;;;;;;;;;;;;;;AAeA,SAAgB,oBAAoB,MAAsB;CACtD,IAAI,CAAC,KAAK,SAAS,mBAAmB,KAAK,kBAAkB,GAAG,OAAO;CAEvE,IAAI,MAAM;CACV,IAAI,MAAM,IAAI,QAAQ,mBAAmB;CACzC,OAAO,QAAQ,IAAI;EACf,IAAI,IAAI,WAAW,gBAAgB,GAAG,GAAG;GACrC,MAAM,IAAI,QAAQ,qBAAqB,MAAM,EAAqB;GAClE;EACJ;EACA,MAAM,YAAY,IAAI,QAAQ,aAAa,GAAG;EAC9C,IAAI;EACJ,IAAI,cAAc,IACd,MAAM,IAAI;OACP;GACH,MAAM,MAAM,IAAI,QAAQ,MAAM,YAAY,CAAC;GAC3C,MAAM,QAAQ,KAAK,IAAI,SAAS;EACpC;EACA,MAAM,IAAI,MAAM,GAAG,GAAG,IAAI,iBAAiB,IAAI,MAAM,GAAG;EACxD,MAAM,IAAI,QAAQ,qBAAqB,MAAM,EAAqB;CACtE;CACA,OAAO;AACX;;;;;;;;AASA,SAAS,eAAe,OAAyC;CAC7D,IAAI,iBAAiB,OACjB,OAAO;EACH,MAAM,MAAM;EACZ,SAAS,oBAAoB,MAAM,OAAO;EAC1C,OAAO,MAAM,QAAQ,oBAAoB,MAAM,KAAK,IAAI,KAAA;CAC5D;CAEJ,OAAO,EAAE,OAAO,oBAAoB,OAAO,KAAK,CAAC,EAAE;AACvD;;;;;;;;;AAUA,SAAS,YAAY,OAAgB,OAAe,MAAgC;CAGhF,IAAI,iBAAiB,OAAO,OAAO,eAAe,KAAK;CACvD,IAAI,OAAO,UAAU,UAAU,OAAO,oBAAoB,KAAK;CAC/D,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,IAAI,SAAS,kBAAkB,OAAO;CACtC,IAAI,KAAK,IAAI,KAAK,GAAG,OAAO;CAC5B,KAAK,IAAI,KAAK;CAEd,IAAI,MAAM,QAAQ,KAAK,GACnB,OAAO,MAAM,KAAI,SAAQ,YAAY,MAAM,QAAQ,GAAG,IAAI,CAAC;CAE/D,IAAI,iBAAiB,MAAM,OAAO;CAElC,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,KAAgC,GACpE,IAAI,OAAO,eAAe,GAAG,IAAI,iBAAiB,YAAY,KAAK,QAAQ,GAAG,IAAI;CAEtF,OAAO;AACX;AAEA,SAAS,WAAW,MAAqE;CACrF,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,MAAM,uBAAO,IAAI,QAAgB;CACjC,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,IAAI,GACxC,IAAI,OAAO,eAAe,GAAG,IAAI,iBAAiB,YAAY,KAAK,GAAG,IAAI;CAE9E,OAAO;AACX;AAEA,SAAS,aAAa,mBAA4C,CAAC,GAAW;CAC1E,MAAM,WAAW,YAAY;CAI7B,MAAM,gBAAgB,WAAW,gBAAgB,KAAK,CAAC;CAEvD,SAAS,KAAK,OAAiB,SAAiB,MAAsC;EAClF,IAAI,aAAa,SAAS,aAAa,WAAW;EAIlD,MAAM,cAAc,oBAAoB,OAAO;EAC/C,MAAM,SAAS;GAAE,GAAG;GAC5B,GAAG,WAAW,IAAI;EAAE;EAEZ,IAAI,aAAa,GAAG;GAEhB,MAAM,QAAkB;IACpB,UAAU,aAAa;IACvB,SAAS;IACT,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;IAClC,GAAG;GACP;GACA,MAAM,OAAO,KAAK,UAAU,KAAK;GAEjC,IAAI,UAAU,SACV,QAAQ,OAAO,MAAM,OAAO,IAAI;QAEhC,QAAQ,OAAO,MAAM,OAAO,IAAI;EAExC,OAAO;GAEH,MAAM,SAAS,UAAU,UAAU,MAC7B,UAAU,SAAS,OACnB,UAAU,SAAS,OACnB;GACN,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,IAAI,IAAI,KAAK,UAAU,MAAM,MAAM;GAC9E,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,YAAY,EAAE,IAAI,cAAc;GAEhE,IAAI,UAAU,SACV,QAAQ,MAAM,GAAG;QACd,IAAI,UAAU,QACjB,QAAQ,KAAK,GAAG;QAEhB,QAAQ,IAAI,GAAG;EAEvB;CACJ;CAEA,OAAO;EACH,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI;EAC7C,OAAO,KAAK,SAAS,KAAK,QAAQ,KAAK,IAAI;EAC3C,OAAO,KAAK,SAAS,KAAK,QAAQ,KAAK,IAAI;EAC3C,QAAQ,KAAK,SAAS,KAAK,SAAS,KAAK,IAAI;EAC7C,MAAM,QAAyC;GAC3C,OAAO,aAAa;IAAE,GAAG;IACrC,GAAG;GAAO,CAAC;EACH;CACJ;AACJ;;;;;;AAOA,IAAa,SAAiB,aAAa"}