@salesforce/b2c-cli 2.0.0 → 2.2.0

package/dist/script-types/node_modules/@salesforce/b2c-script-types/plugin/index.js

@@ -37,8 +37,9 @@ const SFRA_AMBIENT_MODULES = new Set([
 ]);
 // Candidate suffixes appended when resolving a SFCC-style relative require to
 // a cartridge file. SFRA convention is to omit the .js extension, so .js wins
-// first; .json captures the occasional resource bundle import.
-const CANDIDATE_EXTENSIONS = ['.js', '.json', '/index.js'];
+// first; .json captures the occasional resource bundle import; .ds covers
+// legacy pipeline-era scripts, which the platform also resolves after .js.
+const CANDIDATE_EXTENSIONS = ['.js', '.json', '.ds', '/index.js', '/index.ds'];
 // Cartridges that conventionally sit at the bottom of the cartridge path when
 // the user hasn't told us otherwise (no `cartridges` in dw.json/SFCC_CARTRIDGES).
 // Higher rank = lower in the cartridge path. SFRA's runtime path ends with
@@ -77,7 +78,12 @@ function init({ typescript: ts }) {
     const setCartridges = (list) => {
         cartridges = list.map(({ name, src }) => {
             const n = normalize(src);
-            return { name, root: n.endsWith('/') ? n : n + '/' };
+            const raw = src.replace(/\\/g, '/');
+            return {
+                name,
+                root: n.endsWith('/') ? n : n + '/',
+                srcRoot: raw.endsWith('/') ? raw : raw + '/',
+            };
         });
     };
     const applyConfig = (config) => {
@@ -275,7 +281,7 @@ function init({ typescript: ts }) {
         if (!subpath)
             return undefined;
         for (const c of order) {
-            const baseAbs = c.root + subpath;
+            const baseAbs = c.srcRoot + subpath;
             for (const ext of CANDIDATE_EXTENSIONS) {
                 const candidate = baseAbs + ext;
                 if (fileExists(candidate)) {
@@ -307,7 +313,7 @@ function init({ typescript: ts }) {
         const modulesCart = cartridges.find((c) => c.name === 'modules');
         if (!modulesCart)
             return undefined;
-        const baseAbs = modulesCart.root + moduleName;
+        const baseAbs = modulesCart.srcRoot + moduleName;
         for (const ext of CANDIDATE_EXTENSIONS) {
             const candidate = baseAbs + ext;
             if (fileExists(candidate)) {
@@ -322,7 +328,7 @@ function init({ typescript: ts }) {
                 if (content) {
                     const main = JSON.parse(content).main;
                     if (typeof main === 'string' && main.length > 0) {
-                        const resolved = (modulesCart.root + moduleName + '/' + main.replace(/^\.\//, '')).replace(/\\/g, '/');
+                        const resolved = (modulesCart.srcRoot + moduleName + '/' + main.replace(/^\.\//, '')).replace(/\\/g, '/');
                         if (fileExists(resolved)) {
                             return { resolved, source: modulesCart.name };
                         }
@@ -430,6 +436,17 @@ function init({ typescript: ts }) {
             }
             return additions.length > 0 ? [...list, ...additions] : list;
         };
+        // TS derives a file's ScriptKind from its extension and falls back to TS
+        // for anything it doesn't recognize, which would parse legacy .ds scripts
+        // as TypeScript. Report JS so they get the same JavaScript semantics
+        // (allowJs/checkJs, JSDoc types) as their .js siblings. Returning Unknown
+        // for everything else lets TS fall back to its own extension mapping.
+        const origGetScriptKind = host.getScriptKind?.bind(host);
+        host.getScriptKind = (fileName) => {
+            if (enabled && fileName.endsWith('.ds'))
+                return ts.ScriptKind.JS;
+            return origGetScriptKind ? origGetScriptKind(fileName) : ts.ScriptKind.Unknown;
+        };
         const origResolveModuleNameLiterals = host.resolveModuleNameLiterals?.bind(host);
         if (origResolveModuleNameLiterals) {
             host.resolveModuleNameLiterals = (moduleLiterals, containingFile, redirectedReference, options, containingSourceFile, reusedNames) => {
@@ -538,7 +555,7 @@ function init({ typescript: ts }) {
             const moduleName = sfraModuleAtOffset(def.textSpan.start);
             if (!moduleName)
                 return def;
-            const candidates = [modulesCart.root + moduleName + '.js', modulesCart.root + moduleName + '/index.js'];
+            const candidates = [modulesCart.srcRoot + moduleName + '.js', modulesCart.srcRoot + moduleName + '/index.js'];
             for (const candidate of candidates) {
                 if (fileExists(candidate)) {
                     return { ...def, fileName: candidate, textSpan: { start: 0, length: 0 } };

package/dist/utils/ecdn/mtls.d.ts

@@ -0,0 +1,80 @@
+import { type CdnZonesClient } from '@salesforce/b2c-tooling-sdk/clients';
+import { type MtlsCertificate } from '@salesforce/b2c-tooling-sdk/operations/mtls';
+/** Paths of the files written when generating code upload certificates. */
+export interface CodeUploadCertificateFiles {
+    /** CA certificate (PEM) — uploaded to eCDN */
+    caCertificate: string;
+    /** CA private key (PEM) — needed to issue more client certificates */
+    caPrivateKey: string;
+    /** Client certificate bundle (PKCS12) — used for WebDAV code upload */
+    clientCertificate: string;
+}
+/** Options for {@link generateAndUploadCodeUploadCertificate}. */
+export interface GenerateAndUploadOptions {
+    caCommonName?: string;
+    caValidityDays?: number;
+    client: CdnZonesClient;
+    clientName: string;
+    clientValidityDays?: number;
+    force?: boolean;
+    name: string;
+    onProgress?: (message: string) => void;
+    organizationId: string;
+    outDir: string;
+    passphrase?: string;
+}
+/** Result of {@link generateAndUploadCodeUploadCertificate}. */
+export interface GenerateAndUploadResult {
+    /** Expiry of the generated CA (ISO 8601) */
+    caExpiresOn: string;
+    certificate: MtlsCertificate;
+    clientPassphrase: string;
+    files: CodeUploadCertificateFiles;
+}
+/**
+ * Converts a name into a safe file name stem.
+ */
+export declare function toFileStem(name: string): string;
+/**
+ * Throws if any of the given files exist and `force` is not set.
+ */
+export declare function assertFilesWritable(files: string[], force?: boolean): void;
+/**
+ * Writes a file readable only by the current user, creating parent directories.
+ */
+export declare function writePrivateFile(file: string, data: Buffer | string): void;
+/**
+ * Writes a `.gitignore` ignoring everything in a directory of generated secrets,
+ * unless the directory already has one.
+ */
+export declare function ensureGitIgnored(dir: string): void;
+/**
+ * Resolves the default CA common name. Salesforce recommends the staging
+ * Business Manager hostname (`staging-<realm>-<customer>.demandware.net`).
+ */
+export declare function defaultCaCommonName(name: string, hostname?: string): string;
+/**
+ * Returns a warning if the organization is not a staging organization;
+ * eCDN only accepts code upload certificates for `_stg` organizations.
+ */
+export declare function stagingOrganizationWarning(organizationId: string): string | undefined;
+/**
+ * Human-readable security guidance for a generated CA private key.
+ */
+export declare function caKeySecurityNotice(caPrivateKey: string, caExpiresOn?: string): string;
+/**
+ * Human-readable guidance for an issued client certificate.
+ */
+export declare function clientCertificateNotice(options: {
+    file: string;
+    hostname?: string;
+    passphrase: string;
+}): string;
+/**
+ * Generates a CA, uploads it to eCDN, and issues a first client certificate.
+ *
+ * CA files are written before the upload so the CA key is never lost: if the
+ * upload fails, the files can be uploaded later with `--certificate-file` and
+ * `--private-key-file`.
+ */
+export declare function generateAndUploadCodeUploadCertificate(options: GenerateAndUploadOptions): Promise<GenerateAndUploadResult>;

package/dist/utils/ecdn/mtls.js

@@ -0,0 +1,161 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+import { ux } from '@oclif/core';
+import * as fs from 'node:fs';
+import path from 'node:path';
+import { normalizeTenantId } from '@salesforce/b2c-tooling-sdk/clients';
+import { createCodeUploadCertificate, generateCaCertificate, issueClientCertificate, } from '@salesforce/b2c-tooling-sdk/operations/mtls';
+/**
+ * Converts a name into a safe file name stem.
+ */
+export function toFileStem(name) {
+    return (name
+        .trim()
+        .replaceAll(/[^\w.-]+/g, '-')
+        .replaceAll(/^-+|-+$/g, '') || 'client');
+}
+/**
+ * Throws if any of the given files exist and `force` is not set.
+ */
+export function assertFilesWritable(files, force = false) {
+    if (force)
+        return;
+    const existing = files.filter((f) => fs.existsSync(f));
+    if (existing.length > 0) {
+        throw new Error(`Refusing to overwrite existing file(s): ${existing.join(', ')}. Use --force to overwrite.`);
+    }
+}
+/**
+ * Writes a file readable only by the current user, creating parent directories.
+ */
+export function writePrivateFile(file, data) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, data, { mode: 0o600 });
+    // writeFileSync only applies mode to new files
+    fs.chmodSync(file, 0o600);
+}
+/**
+ * Writes a `.gitignore` ignoring everything in a directory of generated secrets,
+ * unless the directory already has one.
+ */
+export function ensureGitIgnored(dir) {
+    const gitignore = path.resolve(dir, '.gitignore');
+    if (fs.existsSync(gitignore))
+        return;
+    fs.mkdirSync(path.dirname(gitignore), { recursive: true });
+    fs.writeFileSync(gitignore, '# Generated mTLS certificates and keys: never commit these\n*\n');
+}
+/**
+ * Resolves the default CA common name. Salesforce recommends the staging
+ * Business Manager hostname (`staging-<realm>-<customer>.demandware.net`).
+ */
+export function defaultCaCommonName(name, hostname) {
+    return hostname?.startsWith('staging-') ? hostname : `${name} CA`;
+}
+/**
+ * Returns a warning if the organization is not a staging organization;
+ * eCDN only accepts code upload certificates for `_stg` organizations.
+ */
+export function stagingOrganizationWarning(organizationId) {
+    if (organizationId.endsWith('_stg'))
+        return undefined;
+    return `Code upload certificates are only supported for staging organizations (tenant ID ending in "_stg"); "${organizationId}" may be rejected.`;
+}
+/**
+ * Human-readable security guidance for a generated CA private key.
+ */
+export function caKeySecurityNotice(caPrivateKey, caExpiresOn) {
+    const lines = [
+        ux.colorize('yellow', 'IMPORTANT: protect the CA private key'),
+        `  ${caPrivateKey}`,
+        '  Anyone with this key can issue client certificates that are trusted for code upload',
+        '  to your staging instance. Treat it like a password:',
+        '    - Move it (and ca.pem) to a secure location such as a password manager or secrets vault.',
+        '      It is only needed to issue new client certificates ("b2c ecdn mtls issue").',
+        '    - Never commit it to a source repository or share it. The output directory',
+        '      contains a .gitignore to help prevent this.',
+        '    - Give each user or pipeline its own client certificate (.p12) instead of sharing the CA.',
+    ];
+    if (caExpiresOn) {
+        lines.push('', `  The CA expires on ${caExpiresOn}. The CA certificate bundle is allowed a maximum expiry`, '  of 1 year; renew it before it expires to avoid disruption with code uploads. Create a', '  new CA, re-issue client certificates from it, verify uploads, then delete the old CA.');
+    }
+    return lines.join('\n');
+}
+/**
+ * Human-readable guidance for an issued client certificate.
+ */
+export function clientCertificateNotice(options) {
+    // On Hyperforce the code upload hostname is the standard staging hostname, so a
+    // separate webdav-hostname isn't needed.
+    const config = {};
+    if (options.hostname)
+        config.hostname = options.hostname;
+    config.certificate = options.file;
+    config['certificate-passphrase'] = options.passphrase;
+    const snippet = JSON.stringify(config, null, 2)
+        .split('\n')
+        .map((line) => `    ${line}`)
+        .join('\n');
+    return [
+        'Client certificate (use this for code upload, not the CA):',
+        `  File:        ${options.file}`,
+        `  Passphrase:  ${options.passphrase}`,
+        '  The .p12 and its passphrase are credentials: store them securely, keep the',
+        '  passphrase separate from the file, and never commit either to a repository.',
+        '',
+        '  To upload code, add these settings to your instance in dw.json',
+        '  (or use --server, --certificate and --passphrase):',
+        snippet,
+    ].join('\n');
+}
+/**
+ * Generates a CA, uploads it to eCDN, and issues a first client certificate.
+ *
+ * CA files are written before the upload so the CA key is never lost: if the
+ * upload fails, the files can be uploaded later with `--certificate-file` and
+ * `--private-key-file`.
+ */
+export async function generateAndUploadCodeUploadCertificate(options) {
+    const progress = options.onProgress ?? (() => { });
+    const files = {
+        caCertificate: path.resolve(options.outDir, 'ca.pem'),
+        caPrivateKey: path.resolve(options.outDir, 'ca.key'),
+        clientCertificate: path.resolve(options.outDir, `${toFileStem(options.clientName)}.p12`),
+    };
+    assertFilesWritable(Object.values(files), options.force);
+    ensureGitIgnored(options.outDir);
+    progress(`Generating CA certificate for tenant ${normalizeTenantId(options.organizationId)}...`);
+    const ca = generateCaCertificate({
+        commonName: options.caCommonName ?? `${options.name} CA`,
+        validityDays: options.caValidityDays,
+    });
+    writePrivateFile(files.caCertificate, ca.certificatePem);
+    writePrivateFile(files.caPrivateKey, ca.privateKeyPem);
+    progress('Uploading CA certificate to eCDN...');
+    let certificate;
+    try {
+        certificate = await createCodeUploadCertificate(options.client, options.organizationId, {
+            name: options.name,
+            certificatePem: ca.certificatePem,
+            privateKeyPem: ca.privateKeyPem,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`${message}\nThe generated CA was saved to ${files.caCertificate} and ${files.caPrivateKey}; ` +
+            'retry the upload with --certificate-file and --private-key-file.', { cause: error });
+    }
+    progress('Issuing client certificate...');
+    const clientCert = issueClientCertificate({
+        ca,
+        commonName: options.clientName,
+        validityDays: options.clientValidityDays,
+        passphrase: options.passphrase,
+    });
+    writePrivateFile(files.clientCertificate, clientCert.pkcs12);
+    return { caExpiresOn: ca.notAfter.toISOString(), certificate, clientPassphrase: clientCert.passphrase, files };
+}
+//# sourceMappingURL=mtls.js.map

package/dist/utils/ecdn/mtls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mtls.js","sourceRoot":"","sources":["../../../src/utils/ecdn/mtls.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,iBAAiB,EAAsB,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,6CAA6C,CAAC;AAoCrD;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,CACL,IAAI;SACD,IAAI,EAAE;SACN,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC;SAC5B,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,QAAQ,CAC1C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAe,EAAE,KAAK,GAAG,KAAK;IAChE,IAAI,KAAK;QAAE,OAAO;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAqB;IAClE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;IACpD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAC,IAAI,EAAE,KAAK,EAAC,CAAC,CAAC;IAC5C,+CAA+C;IAC/C,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IACrC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;IACzD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,iEAAiE,CAAC,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAiB;IACjE,OAAO,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAsB;IAC/D,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,OAAO,wGAAwG,cAAc,oBAAoB,CAAC;AACpJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,WAAoB;IAC5E,MAAM,KAAK,GAAG;QACZ,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,uCAAuC,CAAC;QAC9D,KAAK,YAAY,EAAE;QACnB,uFAAuF;QACvF,uDAAuD;QACvD,8FAA8F;QAC9F,mFAAmF;QACnF,gFAAgF;QAChF,mDAAmD;QACnD,+FAA+F;KAChG,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,uBAAuB,WAAW,yDAAyD,EAC3F,yFAAyF,EACzF,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA8D;IACpG,gFAAgF;IAChF,yCAAyC;IACzC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACzD,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAClC,MAAM,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;SAC5C,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;SAC5B,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,4DAA4D;QAC5D,kBAAkB,OAAO,CAAC,IAAI,EAAE;QAChC,kBAAkB,OAAO,CAAC,UAAU,EAAE;QACtC,8EAA8E;QAC9E,+EAA+E;QAC/E,EAAE;QACF,kEAAkE;QAClE,sDAAsD;QACtD,OAAO;KACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAAiC;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GAA+B;QACxC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;QACrD,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;QACpD,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;KACzF,CAAC;IACF,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEzD,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,wCAAwC,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACjG,MAAM,EAAE,GAAG,qBAAqB,CAAC;QAC/B,UAAU,EAAE,OAAO,CAAC,YAAY,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK;QACxD,YAAY,EAAE,OAAO,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,gBAAgB,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;IACzD,gBAAgB,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC;IAEvD,QAAQ,CAAC,qCAAqC,CAAC,CAAC;IAChD,IAAI,WAA4B,CAAC;IACjC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE;YACtF,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,cAAc,EAAE,EAAE,CAAC,cAAc;YACjC,aAAa,EAAE,EAAE,CAAC,aAAa;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,mCAAmC,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,YAAY,IAAI;YAC5F,kEAAkE,EACpE,EAAC,KAAK,EAAE,KAAK,EAAC,CACf,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,+BAA+B,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,sBAAsB,CAAC;QACxC,EAAE;QACF,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,kBAAkB;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAE7D,OAAO,EAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,CAAC,UAAU,EAAE,KAAK,EAAC,CAAC;AAC/G,CAAC"}