@sfdxy/anypoint-connect 0.16.3 → 0.17.0

package/dist/safety/preapproval.js

@@ -0,0 +1,251 @@
+/**
+ * Production policy: pre-approvals and unmarked-artifact allowances
+ *
+ * Both live only in the user-level store, ~/.anypoint-connect/production-approvals.json, outside any
+ * repository, so a branch cannot plant or widen one. Every entry is bound to a resolved organization
+ * ID and environment ID; names are kept for display only and never matched. A `productionPreapproval`
+ * found in a project's .anypoint-connect.json is ignored and reported.
+ *
+ *   {
+ *     "productionPreapprovals": [
+ *       { "orgId": "...", "environmentId": "...", "environmentName": "Production",
+ *         "tools": ["update_app"] | "all-mutating", "expires": "2026-12-31T00:00:00Z", "projectPath": "/abs/repo" }
+ *     ],
+ *     "unmarkedArtifactAllowances": [
+ *       { "orgId": "...", "environmentId": "...", "environmentName": "Production", "expires": "...", "projectPath": "..." }
+ *     ]
+ *   }
+ *
+ * A pre-approval stands in for confirmProduction (MCP) and the typed phrase (CLI). An allowance lets
+ * jars without a build marker go to that environment. Neither waives confirm: true, bound IDs,
+ * digests, or the refusal of a jar marked not production deployable.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { discoverProjectConfig, findProjectConfigFile, getConfigDir } from '../config/profiles.js';
+import { resolveProjectRoot } from './paths.js';
+/** Tools whose production confirmation can be pre-approved. The CLI uses the same names. */
+export const PREAPPROVABLE_TOOLS = [
+    'deploy_jar',
+    'deploy_app',
+    'update_app',
+    'update_app_artifact',
+    'rollback_app',
+    'update_app_settings',
+    'restart_app',
+    'scale_app',
+    'stop_app',
+    'start_app',
+    'smoke_test_api',
+    'delete_app',
+    'create_alert',
+    'update_alert',
+    'set_alert_enabled',
+    'delete_alert',
+];
+export const ALL_MUTATING = 'all-mutating';
+/** Tools that "all-mutating" does not cover; they are pre-approved only when named. */
+export const NAMED_ONLY_TOOLS = ['delete_app', 'delete_alert'];
+export const APPROVALS_FILE_NAME = 'production-approvals.json';
+/** The user-level store path. */
+export function approvalsFile() {
+    return path.join(getConfigDir(), APPROVALS_FILE_NAME);
+}
+function validateScope(input, errors) {
+    const { orgId, environmentId, environmentName, expires, projectPath } = input;
+    for (const [name, value] of [
+        ['orgId', orgId],
+        ['environmentId', environmentId],
+    ]) {
+        if (typeof value !== 'string' || !value.trim())
+            errors.push(`${name} must be a non-empty ID`);
+        else if (/[*?]/.test(value))
+            errors.push(`${name}: wildcards are not allowed`);
+    }
+    if (environmentName !== undefined && typeof environmentName !== 'string')
+        errors.push('environmentName must be a string');
+    if (expires !== undefined && (typeof expires !== 'string' || Number.isNaN(Date.parse(expires)))) {
+        errors.push('expires must be an ISO 8601 date-time');
+    }
+    if (projectPath !== undefined && (typeof projectPath !== 'string' || !path.isAbsolute(projectPath))) {
+        errors.push('projectPath must be an absolute path');
+    }
+    return {
+        orgId: orgId,
+        environmentId: environmentId,
+        ...(environmentName !== undefined ? { environmentName: environmentName } : {}),
+        ...(expires !== undefined ? { expires: expires } : {}),
+        ...(projectPath !== undefined ? { projectPath: projectPath } : {}),
+    };
+}
+function asObject(input, what) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error(`${what} must be an object`);
+    return input;
+}
+function rejectUnknown(input, allowed, errors) {
+    const unknown = Object.keys(input).filter((key) => !allowed.includes(key));
+    if (unknown.length)
+        errors.push(`unknown fields: ${unknown.join(', ')}`);
+}
+const SCOPE_FIELDS = ['orgId', 'environmentId', 'environmentName', 'expires', 'projectPath'];
+/** Validate one pre-approval entry. Throws with every problem found. */
+export function validatePreapproval(input) {
+    const object = asObject(input, 'A production pre-approval');
+    const errors = [];
+    rejectUnknown(object, [...SCOPE_FIELDS, 'tools'], errors);
+    const scope = validateScope(object, errors);
+    const { tools } = object;
+    if (tools !== ALL_MUTATING) {
+        if (!Array.isArray(tools) || tools.length === 0) {
+            errors.push(`tools must be "${ALL_MUTATING}" or a non-empty list of tool names`);
+        }
+        else {
+            for (const tool of tools) {
+                if (!PREAPPROVABLE_TOOLS.includes(tool)) {
+                    errors.push(`"${String(tool)}" is not a pre-approvable tool (${PREAPPROVABLE_TOOLS.join(', ')})`);
+                }
+            }
+        }
+    }
+    if (errors.length)
+        throw new Error(`Invalid production pre-approval:\n- ${errors.join('\n- ')}`);
+    return { ...scope, tools: tools === ALL_MUTATING ? ALL_MUTATING : [...new Set(tools)] };
+}
+/** Validate one unmarked-artifact allowance. Throws with every problem found. */
+export function validateUnmarkedAllowance(input) {
+    const object = asObject(input, 'An unmarked-artifact allowance');
+    const errors = [];
+    rejectUnknown(object, SCOPE_FIELDS, errors);
+    const scope = validateScope(object, errors);
+    if (errors.length)
+        throw new Error(`Invalid unmarked-artifact allowance:\n- ${errors.join('\n- ')}`);
+    return scope;
+}
+function readRawStore(file) {
+    if (!fs.existsSync(file))
+        return { store: {}, invalid: [] };
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return { store: asObject(parsed, file), invalid: [] };
+    }
+    catch (error) {
+        return { store: {}, invalid: [`${file} is unreadable: ${error.message}`] };
+    }
+}
+/** Read and validate the user-level store. */
+export function readApprovalState(options = {}) {
+    const source = approvalsFile();
+    const { store, invalid } = readRawStore(source);
+    const now = options.now ?? Date.now();
+    const expired = (expires) => expires !== undefined && Date.parse(expires) <= now;
+    const state = { source, productionPreapprovals: [], unmarkedArtifactAllowances: [], invalid };
+    for (const item of Array.isArray(store.productionPreapprovals) ? store.productionPreapprovals : []) {
+        try {
+            const entry = validatePreapproval(item);
+            state.productionPreapprovals.push({ ...entry, expired: expired(entry.expires) });
+        }
+        catch (error) {
+            state.invalid.push(error.message);
+        }
+    }
+    for (const item of Array.isArray(store.unmarkedArtifactAllowances) ? store.unmarkedArtifactAllowances : []) {
+        try {
+            const entry = validateUnmarkedAllowance(item);
+            state.unmarkedArtifactAllowances.push({ ...entry, expired: expired(entry.expires) });
+        }
+        catch (error) {
+            state.invalid.push(error.message);
+        }
+    }
+    return state;
+}
+function sameScope(a, b) {
+    return a.orgId === b.orgId && a.environmentId === b.environmentId && a.projectPath === b.projectPath;
+}
+/** Replace (or, with `entry` null, remove) the entry with the same org, environment and project. */
+function upsert(list, scope, entry) {
+    const rest = (list ?? []).filter((item) => !sameScope(item, scope));
+    return entry ? [...rest, entry] : rest;
+}
+function writeStore(update) {
+    const file = approvalsFile();
+    const { store, invalid } = readRawStore(file);
+    if (invalid.length)
+        throw new Error(`${invalid[0]}; fix or remove it first`);
+    fs.writeFileSync(file, JSON.stringify(update(store), null, 2) + '\n', { mode: 0o600 });
+    fs.chmodSync(file, 0o600);
+    return file;
+}
+/** Store a pre-approval (replacing one with the same scope), or remove it when `entry` is null. */
+export function savePreapproval(scope, entry) {
+    const valid = entry ? validatePreapproval(entry) : null;
+    return writeStore((store) => ({
+        ...store,
+        productionPreapprovals: upsert(store.productionPreapprovals, scope, valid),
+    }));
+}
+/** Store an unmarked-artifact allowance (replacing one with the same scope), or remove it. */
+export function saveUnmarkedAllowance(scope, entry) {
+    const valid = entry ? validateUnmarkedAllowance(entry) : null;
+    return writeStore((store) => ({
+        ...store,
+        unmarkedArtifactAllowances: upsert(store.unmarkedArtifactAllowances, scope, valid),
+    }));
+}
+function coversTool(entry, tool) {
+    if (entry.tools === ALL_MUTATING) {
+        return (PREAPPROVABLE_TOOLS.includes(tool) &&
+            !NAMED_ONLY_TOOLS.includes(tool));
+    }
+    return entry.tools.includes(tool);
+}
+function matcher(target, options) {
+    let root = options.projectRoot;
+    const projectMatches = (projectPath) => {
+        if (!projectPath)
+            return true;
+        root ??= resolveProjectRoot();
+        return path.resolve(projectPath) === path.resolve(root);
+    };
+    return (entry) => !entry.expired &&
+        entry.orgId === target.orgId &&
+        entry.environmentId === target.env.id &&
+        projectMatches(entry.projectPath);
+}
+/** Whether a production write by `tool` to the target org and environment is pre-approved. */
+export function checkPreapproval(target, tool, options = {}) {
+    const state = options.state ?? readApprovalState(options);
+    const inScope = matcher(target, options);
+    const match = state.productionPreapprovals.find((e) => inScope(e) && coversTool(e, tool));
+    if (!match)
+        return { productionPreapproved: false };
+    return {
+        productionPreapproved: true,
+        preapprovalSource: `${state.source} productionPreapprovals`,
+        ...(match.expires ? { preapprovalExpires: match.expires } : {}),
+    };
+}
+/** Whether jars without a build marker may go to the target org and environment. */
+export function checkUnmarkedAllowance(target, options = {}) {
+    const state = options.state ?? readApprovalState(options);
+    const match = state.unmarkedArtifactAllowances.find(matcher(target, options));
+    if (!match)
+        return { unmarkedAllowed: false };
+    return {
+        unmarkedAllowed: true,
+        source: `${state.source} unmarkedArtifactAllowances`,
+        ...(match.expires ? { expires: match.expires } : {}),
+    };
+}
+/** A warning when the project's .anypoint-connect.json carries an approval, which is never honored. */
+export function ignoredProjectApprovalWarning(startDir) {
+    const config = discoverProjectConfig(startDir);
+    if (!config)
+        return undefined;
+    const keys = ['productionPreapproval', 'productionPreapprovals', 'unmarkedArtifactAllowances'].filter((key) => config[key] !== undefined);
+    if (!keys.length)
+        return undefined;
+    return `${findProjectConfigFile(startDir)} contains ${keys.join(', ')}, which is ignored: production approvals are read only from ${approvalsFile()}`;
+}
+//# sourceMappingURL=preapproval.js.map

package/dist/safety/preapproval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preapproval.js","sourceRoot":"","sources":["../../src/safety/preapproval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAC/B,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,qBAAqB;IACrB,cAAc;IACd,qBAAqB;IACrB,aAAa;IACb,WAAW;IACX,UAAU;IACV,WAAW;IACX,gBAAgB;IAChB,YAAY;IACZ,cAAc;IACd,cAAc;IACd,mBAAmB;IACnB,cAAc;CACR,CAAC;AAGX,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C,uFAAuF;AACvF,MAAM,CAAC,MAAM,gBAAgB,GAAiC,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAE7F,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAwB/D,iCAAiC;AACjC,MAAM,UAAU,aAAa;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,mBAAmB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B,EAAE,MAAgB;IACnE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QACxB,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,eAAe,EAAE,aAAa,CAAC;KAC1B,EAAE,CAAC;QACT,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC;aACzF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,eAAe,KAAK,SAAS,IAAI,OAAO,eAAe,KAAK,QAAQ;QACpE,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAClG,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO;QACH,KAAK,EAAE,KAAe;QACtB,aAAa,EAAE,aAAuB;QACtC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,eAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;AACN,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAY;IAC1C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC9G,OAAO,KAAgC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B,EAAE,OAAiB,EAAE,MAAgB;IACtF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAE7F,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,kBAAkB,YAAY,qCAAqC,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAyB,CAAC,EAAE,CAAC;oBAC3D,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,mCAAmC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtG,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAA4B,CAAC,CAAC,EAAE,CAAC;AACnH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC;AACjB,CAAC;AAYD,SAAS,YAAY,CAAC,IAAY;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5D,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,mBAAoB,KAAe,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1F,CAAC;AACL,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,UAA4B,EAAE;IAC5D,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;IAC1F,MAAM,KAAK,GAAkB,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,EAAE,0BAA0B,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAC7G,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjG,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACxC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,KAAK,CAAC,OAAO,CAAC,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzG,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAC9C,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,KAAK,CAAC,OAAO,CAAC,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,CAAc,EAAE,CAAc;IAC7C,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAC;AACzG,CAAC;AAED,oGAAoG;AACpG,SAAS,MAAM,CAAwB,IAAqB,EAAE,KAAkB,EAAE,KAAe;IAC7F,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,MAA+C;IAC/D,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IAC7E,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAAC,KAAkB,EAAE,KAAmC;IACnF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,OAAO,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1B,GAAG,KAAK;QACR,sBAAsB,EAAE,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,EAAE,KAAK,CAAC;KAC7E,CAAC,CAAC,CAAC;AACR,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,qBAAqB,CAAC,KAAkB,EAAE,KAAuC;IAC7F,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,OAAO,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1B,GAAG,KAAK;QACR,0BAA0B,EAAE,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,EAAE,KAAK,CAAC;KACrF,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,UAAU,CAAC,KAA4B,EAAE,IAAY;IAC1D,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,CACH,mBAAmB,CAAC,QAAQ,CAAC,IAAyB,CAAC;YACvD,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAyB,CAAC,CACxD,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAyB,CAAC,CAAC;AAC3D,CAAC;AAcD,SAAS,OAAO,CAAC,MAAoB,EAAE,OAAqB;IACxD,IAAI,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC;IAC/B,MAAM,cAAc,GAAG,CAAC,WAAoB,EAAE,EAAE;QAC5C,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC;IACF,OAAO,CAAC,KAA6B,EAAE,EAAE,CACrC,CAAC,KAAK,CAAC,OAAO;QACd,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QAC5B,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE;QACrC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC1C,CAAC;AASD,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,MAAoB,EAAE,IAAY,EAAE,UAAwB,EAAE;IAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;IACpD,OAAO;QACH,qBAAqB,EAAE,IAAI;QAC3B,iBAAiB,EAAE,GAAG,KAAK,CAAC,MAAM,yBAAyB;QAC3D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACN,CAAC;AAQD,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,MAAoB,EAAE,UAAwB,EAAE;IACnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC9C,OAAO;QACH,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,6BAA6B;QACpD,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACN,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,6BAA6B,CAAC,QAAiB;IAC3D,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAmC,CAAC;IACjF,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,uBAAuB,EAAE,wBAAwB,EAAE,4BAA4B,CAAC,CAAC,MAAM,CACjG,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CACrC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACnC,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D,aAAa,EAAE,EAAE,CAAC;AAC1J,CAAC"}

package/dist/safety/secrets.d.ts

@@ -29,4 +29,11 @@ export declare function redactDeep(value: unknown, depth?: number): unknown;
  * characters are skipped because they would match ordinary text.
  */
 export declare function redactText(text: string, knownSecrets: Iterable<string>): string;
+/**
+ * Sanitize free text a platform echoed back (an error message), when its secrets are not known in
+ * advance: email addresses keep only their domain, and credential-looking values are masked (JWTs,
+ * bearer tokens, Salesforce session IDs, `secret=value` pairs, and long opaque strings). UUIDs, which
+ * identify resources, are kept.
+ */
+export declare function sanitizePlatformText(text: string): string;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/safety/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/safety/secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,MAAM,WAAW,CAAC;AAuB/B;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWhD;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CAAO,GAO7F,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAC9B;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAY7D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAM/E"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/safety/secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,MAAM,WAAW,CAAC;AAuB/B;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWhD;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CAAO,GAO7F,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAC9B;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAY7D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAM/E;AAID;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWzD"}

package/dist/safety/secrets.js

@@ -88,4 +88,20 @@ export function redactText(text, knownSecrets) {
         result = result.split(value).join(MASKED);
     return result;
 }
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Sanitize free text a platform echoed back (an error message), when its secrets are not known in
+ * advance: email addresses keep only their domain, and credential-looking values are masked (JWTs,
+ * bearer tokens, Salesforce session IDs, `secret=value` pairs, and long opaque strings). UUIDs, which
+ * identify resources, are kept.
+ */
+export function sanitizePlatformText(text) {
+    return text
+        .replace(/[A-Za-z0-9._%+-]+@([A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+)/g, '***@$1')
+        .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/g, MASKED)
+        .replace(/\b(bearer)\s+[A-Za-z0-9._~+/=-]+/gi, `$1 ${MASKED}`)
+        .replace(/\b00D[A-Za-z0-9]{12,15}![A-Za-z0-9._]+/g, MASKED)
+        .replace(/\b((?:password|passwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret|credential)s?["']?\s*[:=]\s*["']?)[^\s"',;&]+/gi, `$1${MASKED}`)
+        .replace(/[A-Za-z0-9+/_=-]{32,}/g, (match) => (UUID.test(match) ? match : MASKED));
+}
 //# sourceMappingURL=secrets.js.map

package/dist/safety/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/safety/secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;AAE/B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC5B,UAAU;IACV,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,cAAc;CACjB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG;IACjB,CAAC,SAAS,EAAE,KAAK,CAAC;IAClB,CAAC,KAAK,EAAE,KAAK,CAAC;IACd,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,QAAQ,EAAE,KAAK,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACnC,MAAM,QAAQ,GAAG,GAAG;SACf,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,WAAW,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAA8B,EAAE,UAAuC,EAAE;IAClG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACzC,GAAG;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;KAC3E,CAAC,CACqB,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAClE,GAAG;YACH,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;SACjG,CAAC,CACL,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,YAA8B;IACnE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAClB,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/safety/secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;AAE/B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC5B,UAAU;IACV,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,OAAO;IACP,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,cAAc;CACjB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG;IACjB,CAAC,SAAS,EAAE,KAAK,CAAC;IAClB,CAAC,KAAK,EAAE,KAAK,CAAC;IACd,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,QAAQ,EAAE,KAAK,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACnC,MAAM,QAAQ,GAAG,GAAG;SACf,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,WAAW,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAA8B,EAAE,UAAuC,EAAE;IAClG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACzC,GAAG;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;KAC3E,CAAC,CACqB,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAClE,GAAG;YACH,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;SACjG,CAAC,CACL,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,YAA8B;IACnE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC7C,OAAO,IAAI;SACN,OAAO,CAAC,wDAAwD,EAAE,QAAQ,CAAC;SAC3E,OAAO,CAAC,sDAAsD,EAAE,MAAM,CAAC;SACvE,OAAO,CAAC,oCAAoC,EAAE,MAAM,MAAM,EAAE,CAAC;SAC7D,OAAO,CAAC,yCAAyC,EAAE,MAAM,CAAC;SAC1D,OAAO,CACJ,iIAAiI,EACjI,KAAK,MAAM,EAAE,CAChB;SACA,OAAO,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3F,CAAC"}

package/dist/workflows/alerts.d.ts

@@ -0,0 +1,299 @@
+/**
+ * Alert workflows
+ * Shared by the alert MCP tools and `anc alerts`: normalizing alerts for display (recipients masked by
+ * default), turning human inputs (percent thresholds, minutes, explicit notifications) into the
+ * platform's payload, resolving the target from CloudHub 2.0 or API Manager, duplicate detection,
+ * and the get-merge-replace update the platform requires.
+ */
+import type { AnypointClient } from '../client/AnypointClient.js';
+import type { Environment } from '../api/AccessManagementApi.js';
+import { type AlertEntity, type AlertMetricId, type AlertNotification, type AlertOperator, type AlertWriteBody, type MonitoringAlert, type RuntimeManagerAlert } from '../api/AlertsApi.js';
+export type MetricUnit = 'percent' | 'count' | 'ms';
+export interface MetricInfo {
+    unit: MetricUnit;
+    entityType: 'application' | 'api';
+    aggregation: 'AVG' | 'SUM';
+    /** An API filter this metric needs. */
+    requires?: 'RESPONSE_CODE' | 'POLICY';
+}
+/** Every metric an alert can watch, in one table. */
+export declare const ALERT_METRICS: Record<AlertMetricId, MetricInfo>;
+export declare const MAX_DURATION_MINUTES = 60;
+export interface RecipientSummary {
+    recipientCount: number;
+    /** Email domains only, never addresses. */
+    recipientDomains: string[];
+    slackChannels: number;
+}
+export declare function summarizeRecipients(notifications?: AlertNotification[]): RecipientSummary;
+/**
+ * Notifications as written back: the read side (`notificationTemplates`) under the write name, with
+ * every field the platform returned kept, including ones this tool does not know.
+ */
+export declare function notificationsOf(alert: MonitoringAlert): AlertNotification[];
+/** Which aspects of the notifications differ, by name only, so a masked diff still says what changed. */
+export declare function notificationDifferences(before: AlertNotification[], after: AlertNotification[]): string[];
+/**
+ * A recipient summary for display. Domains can identify clients, so they are shown only with `reveal`;
+ * otherwise only the counts.
+ */
+export declare function displayRecipients(notifications: AlertNotification[], reveal?: boolean): {
+    recipientCount: number;
+    slackChannels: number;
+} | {
+    recipientDomains: string[];
+    recipientCount: number;
+    slackChannels: number;
+};
+/** Notifications for display: masked to counts unless `reveal`. */
+export declare function describeNotifications(notifications: AlertNotification[], reveal?: boolean): AlertNotification[];
+/** The Monitoring UI's levels: the stored number is the index. */
+export declare const SEVERITY_LABELS: readonly ["LOW", "MEDIUM", "HIGH", "CRITICAL"];
+export type SeverityLabel = (typeof SEVERITY_LABELS)[number];
+/** A severity given as 0-3 or a label (LOW, MEDIUM, HIGH, CRITICAL), as the stored number. */
+export declare function parseSeverity(input: number | string): number;
+/** One label for any family's severity: a Monitoring number, or a word such as INFO or warning. */
+export declare function severityLabel(value: unknown): string | undefined;
+export declare function windowMinutes(interval: string | undefined): number | undefined;
+export declare function metricInfo(metric: string): MetricInfo | undefined;
+/** A stored threshold in the unit people use: percent metrics are stored as fractions. */
+export declare function displayThreshold(metric: string, stored: number): number;
+export type AlertSource = 'monitoring' | 'runtime-manager';
+export declare function normalizeAlert(alert: MonitoringAlert, options?: {
+    reveal?: boolean;
+}): {
+    notifications?: AlertNotification[] | undefined;
+    recipientCount: number;
+    slackChannels: number;
+    id: string;
+    source: AlertSource;
+    name: string;
+    enabled: boolean;
+    severity: string | undefined;
+    severityLevel: number;
+    status: import("../api/AlertsApi.js").AlertStatus | undefined;
+    state: string | undefined;
+    entity: {
+        deploymentType: import("../api/AlertsApi.js").AlertDeploymentType | undefined;
+        environment: string;
+        environmentId: string;
+        apiInstanceId?: string | undefined;
+        type: import("../api/AlertsApi.js").AlertEntityType;
+        name: string | undefined;
+    };
+    condition: {
+        metric: string;
+        operator: "GREATER_THAN" | "LESS_THAN" | "GREATER_THAN_EQUAL_TO" | "LESS_THAN_EQUAL_TO" | "EQUALS";
+        threshold: number | undefined;
+        unit: MetricUnit | undefined;
+        windowMinutes: number | undefined;
+    };
+} | {
+    notifications?: AlertNotification[] | undefined;
+    recipientDomains: string[];
+    recipientCount: number;
+    slackChannels: number;
+    id: string;
+    source: AlertSource;
+    name: string;
+    enabled: boolean;
+    severity: string | undefined;
+    severityLevel: number;
+    status: import("../api/AlertsApi.js").AlertStatus | undefined;
+    state: string | undefined;
+    entity: {
+        deploymentType: import("../api/AlertsApi.js").AlertDeploymentType | undefined;
+        environment: string;
+        environmentId: string;
+        apiInstanceId?: string | undefined;
+        type: import("../api/AlertsApi.js").AlertEntityType;
+        name: string | undefined;
+    };
+    condition: {
+        metric: string;
+        operator: "GREATER_THAN" | "LESS_THAN" | "GREATER_THAN_EQUAL_TO" | "LESS_THAN_EQUAL_TO" | "EQUALS";
+        threshold: number | undefined;
+        unit: MetricUnit | undefined;
+        windowMinutes: number | undefined;
+    };
+};
+/** Whether a Runtime Manager alert targets an app: membership in its resources, case-insensitive. */
+export declare function targetsApp(resources: readonly string[] | undefined, app: string): boolean;
+/**
+ * View of a Runtime Manager event alert (deployment failed and similar). Observed shape:
+ * condition{type, resourceType, resources[]}, actions[]{type, userIds[], emails[], subject, content},
+ * plus conditionType, isSystem and productName.
+ */
+export declare function normalizeRuntimeManagerAlert(alert: RuntimeManagerAlert, options?: {
+    reveal?: boolean;
+}): {
+    recipientDomains?: string[] | undefined;
+    actions?: {
+        type: unknown;
+        emails: string[];
+        userIds: string[];
+    }[] | undefined;
+    recipientCount: number;
+    productName?: string | number | undefined;
+    isSystem?: boolean | undefined;
+    conditionType?: string | number | undefined;
+    id: string | number | undefined;
+    source: AlertSource;
+    name: string | number | undefined;
+    enabled: boolean | undefined;
+    severity: string | undefined;
+    status: string | number | undefined;
+    state: string | number | undefined;
+    entity: {
+        type: string | number | undefined;
+        name: string | undefined;
+        /** Every target, for filtering by membership. */
+        resources: string[];
+    };
+    condition: {
+        event: string | number | undefined;
+    };
+};
+export type NotificationInput = {
+    type: 'EMAIL';
+    recipients: string[];
+    subject: string;
+    message: string;
+} | {
+    type: 'SLACK';
+    channelId: string;
+    carrierId?: string;
+    message: string;
+};
+/** Turn explicit notification inputs into the platform shape. At least one is required; there are no defaults. */
+export declare function buildNotifications(inputs: NotificationInput[] | undefined): AlertNotification[];
+/** Convert and validate a threshold given in the metric's unit (percent for % metrics). */
+export declare function storedThreshold(metric: AlertMetricId, value: number): number;
+export declare function evaluationInterval(durationMinutes: number): string;
+export declare const checkSeverity: typeof parseSeverity;
+export interface ApiFilterInput {
+    responseCodes?: string[];
+    policies?: string[];
+}
+export type AlertTarget = {
+    app: string;
+} | {
+    apiInstanceId: string;
+};
+export interface CreateAlertInput {
+    environment: string;
+    name: string;
+    target: AlertTarget;
+    metric: AlertMetricId;
+    operator: AlertOperator;
+    /** In the metric's unit: percent (0-100] for cpu and memory, a count, or milliseconds. */
+    threshold: number;
+    durationMinutes: number;
+    /** 0-3, or LOW, MEDIUM, HIGH, CRITICAL. */
+    severity: number | string;
+    enabled?: boolean;
+    notifications: NotificationInput[];
+    apiFilters?: ApiFilterInput;
+    allowDuplicate?: boolean;
+}
+/** Resolve the alert entity from CloudHub 2.0 (an app) or API Manager (an API instance). */
+export declare function resolveAlertEntity(client: AnypointClient, orgId: string, env: Pick<Environment, 'id' | 'name'>, target: AlertTarget, metric: AlertMetricId, filters?: ApiFilterInput): Promise<AlertEntity>;
+export declare function sameEntity(a: AlertEntity | undefined, b: AlertEntity): boolean;
+/** Recipients outside the user's own email domain, as domains. The user's address is never returned. */
+export declare function outsideDomains(notifications: AlertNotification[], userEmail: string | undefined): string[];
+export interface CreateAlertPlan {
+    orgId: string;
+    env: Environment;
+    body: AlertWriteBody;
+    warnings: string[];
+    /** An existing alert with the same name on the same entity. */
+    duplicate?: {
+        id: string;
+        name: string;
+        status?: string;
+    };
+}
+/**
+ * The create payload for a preview. For an API target only the instance ID the caller passed is shown;
+ * the API name and endpoint resolved from API Manager are sent but not printed.
+ */
+export declare function previewPayload(body: AlertWriteBody): AlertWriteBody;
+export declare function planCreateAlert(client: AnypointClient, input: CreateAlertInput, options?: {
+    enableHint?: string;
+}): Promise<CreateAlertPlan>;
+export interface AlertPatch {
+    name?: string;
+    /** 0-3, or LOW, MEDIUM, HIGH, CRITICAL. */
+    severity?: number | string;
+    enabled?: boolean;
+    operator?: AlertOperator;
+    /** In the metric's unit, as for create. */
+    threshold?: number;
+    durationMinutes?: number;
+    /** Replaces every notification. */
+    notifications?: NotificationInput[];
+}
+export interface AlertChange {
+    field: string;
+    from: unknown;
+    to: unknown;
+    /** For notifications: which parts differ (recipients, subject, messageTemplate, channelId, ...). */
+    differs?: string[];
+}
+export interface UpdateAlertPlan {
+    orgId: string;
+    env: Environment;
+    existing: MonitoringAlert;
+    body: AlertWriteBody;
+    changes: AlertChange[];
+    noop: boolean;
+}
+export declare function loadAlert(client: AnypointClient, orgId: string, id: string): Promise<MonitoringAlert>;
+/** The environment an alert belongs to, for production checks. */
+export declare function alertEnvironment(client: AnypointClient, orgId: string, alert: MonitoringAlert): Promise<Environment>;
+/** Read the alert, merge the patch, and build the full replacement body the platform needs. */
+export declare function planUpdateAlert(client: AnypointClient, id: string, patch: AlertPatch): Promise<UpdateAlertPlan>;
+/**
+ * Find an alert in the list, narrowed by environment and name so the listing stays small. `complete`
+ * is false when the listing hit its page cap; absence from an incomplete listing proves nothing.
+ */
+export declare function findListedAlert(client: AnypointClient, orgId: string, alert: {
+    id: string;
+    name?: string;
+    environmentId?: string;
+}): Promise<{
+    alert?: MonitoringAlert;
+    complete: boolean;
+}>;
+export interface UpdateAlertResult {
+    accepted: true;
+    /** True only when the listed alert is ACTIVE and carries the new values. */
+    verified: boolean;
+    status: 'ACTIVE' | 'PENDING' | 'UNVERIFIED';
+    message: string;
+}
+/**
+ * Send the full replacement, then re-read the alert from the list once. The platform answers 202 and
+ * applies the change asynchronously, so "updated" is claimed only when the list shows it applied.
+ */
+export declare function executeUpdateAlert(client: AnypointClient, plan: Pick<UpdateAlertPlan, 'orgId' | 'existing' | 'body'>): Promise<UpdateAlertResult>;
+export interface DeleteAlertResult {
+    accepted: boolean;
+    /** PENDING while the platform deletes it; GONE once the complete list no longer shows it. */
+    status: 'PENDING' | 'ACTIVE' | 'DELETED' | 'GONE' | 'UNVERIFIED';
+    verifiedAbsent: boolean;
+    message: string;
+}
+export declare const CHANGE_IN_PROGRESS = "A change to this alert is in progress (PENDING); the platform refuses changes and deletion until it finishes. Retry later.";
+/**
+ * Read an alert for deletion. The list is fresher than GET right after a change (GET can keep
+ * answering ACTIVE, or 404 while the list still shows PENDING), so the listed entry wins.
+ */
+export declare function readAlertForDelete(client: AnypointClient, orgId: string, id: string): Promise<MonitoringAlert | null>;
+/**
+ * Request deletion, then verify it from the list. Never claims deleted while the list still shows the
+ * alert, or when the listing was cut off. A 404 on DELETE with the alert absent from a complete
+ * listing means it is already gone.
+ */
+export declare function executeDeleteAlert(client: AnypointClient, orgId: string, alert: Pick<MonitoringAlert, 'id' | 'name' | 'entity'>): Promise<DeleteAlertResult>;
+//# sourceMappingURL=alerts.d.ts.map

package/dist/workflows/alerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/workflows/alerts.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAEH,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAC3B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;AAEpD,MAAM,WAAW,UAAU;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,aAAa,GAAG,KAAK,CAAC;IAClC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC;IAC3B,uCAAuC;IACvC,QAAQ,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;CACzC;AAED,qDAAqD;AACrD,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,UAAU,CAW3D,CAAC;AAEF,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAIvC,MAAM,WAAW,gBAAgB;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;CACzB;AAOD,wBAAgB,mBAAmB,CAAC,aAAa,GAAE,iBAAiB,EAAO,GAAG,gBAAgB,CAO7F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,iBAAiB,EAAE,CAK3E;AAcD,yGAAyG;AACzG,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,EAAE,CAczG;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,iBAAiB,EAAE,EAAE,MAAM,UAAQ;oBAhEhE,MAAM;mBAGP,MAAM;;;oBAHL,MAAM;mBAGP,MAAM;EAgExB;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,iBAAiB,EAAE,EAAE,MAAM,UAAQ,uBAUvF;AAID,kEAAkE;AAClE,eAAO,MAAM,eAAe,gDAAiD,CAAC;AAC9E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAc7D,8FAA8F;AAC9F,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAU5D;AAED,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIhE;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI9E;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAEjE;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAE3D,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO;;oBAzIrE,MAAM;mBAGP,MAAM;;YA4IO,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;oBA/IvB,MAAM;mBAGP,MAAM;;YA4IO,WAAW;;;;;;;;;;;;;;;;;;;;;;EAyB1C;AAID,qGAAqG;AACrG,wBAAgB,UAAU,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO;;;;;;;;;;;;YAYtE,WAAW;;;;;;;;;QASpC,iDAAiD;;;;;;EAmB5D;AAID,MAAM,MAAM,iBAAiB,GACvB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAIhF,kHAAkH;AAClH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,SAAS,GAAG,iBAAiB,EAAE,CAoB/F;AAED,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAc5E;AAED,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAKlE;AAED,eAAO,MAAM,aAAa,sBAAgB,CAAC;AAE3C,MAAM,WAAW,cAAc;IAC3B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,aAAa,CAAC;IACxB,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,4FAA4F;AAC5F,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,MAAM,CAAC,EACrC,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,aAAa,EACrB,OAAO,CAAC,EAAE,cAAc,GACzB,OAAO,CAAC,WAAW,CAAC,CA+CtB;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,WAAW,GAAG,SAAS,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAG9E;AAED,wGAAwG;AACxG,wBAAgB,cAAc,CAAC,aAAa,EAAE,iBAAiB,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAI1G;AAED,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,WAAW,CAAC;IACjB,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+DAA+D;IAC/D,SAAS,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAInE;AAED,wBAAsB,eAAe,CACjC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,gBAAgB,EACvB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GACtC,OAAO,CAAC,eAAe,CAAC,CAmD1B;AAID,MAAM,WAAW,UAAU;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,aAAa,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,oGAAoG;IACpG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAcD,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,WAAW,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,IAAI,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAI3G;AAED,kEAAkE;AAClE,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,wBAEnG;AAED,+FAA+F;AAC/F,wBAAsB,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,CA2DrH;AAID;;;GAGG;AACH,wBAAsB,eAAe,CACjC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAAC;IAAE,KAAK,CAAC,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CAMzD;AAID,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,EAAE,IAAI,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC;CACnB;AAcD;;;GAGG;AACH,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC,GAC3D,OAAO,CAAC,iBAAiB,CAAC,CAkC5B;AAID,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,6FAA6F;IAC7F,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,CAAC;IACjE,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,kBAAkB,+HACiG,CAAC;AAEjI;;;GAGG;AACH,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAQjC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACpC,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,QAAQ,CAAC,GACvD,OAAO,CAAC,iBAAiB,CAAC,CA0C5B"}