@smoothbricks/cli 0.11.19 → 0.11.20

package/dist/secrets/resolver.js

@@ -0,0 +1,100 @@
+/**
+ * The bootstrap secret resolver, as the CLI sees it.
+ *
+ * `managed/raw/tooling/direnv/secret-references.ts` holds the one
+ * implementation of THE RULE — which group resolves where, and what CI and a
+ * cowshed workspace refuse instead. A managed repository runs the copy smoo
+ * writes into its own `tooling/direnv/secret-references.ts` at shell entry;
+ * `smoo secrets run` runs THIS package's copy of the same file. One
+ * implementation, so the command and the shell cannot disagree about a group.
+ *
+ * It is loaded, not statically imported, and that is forced rather than
+ * chosen: the file is a raw bootstrap script that must load before any
+ * workspace package and before the Typia transform exists, so it lives
+ * outside `src` — outside this package's compiled `rootDir`, which a static
+ * import may not cross. A dynamic `import()` reaches it in both layouts
+ * (`src/secrets/` and `dist/secrets/` are each two directories below the
+ * package root), and typia validates what comes back: the same boundary
+ * ../monorepo/packed-package.ts puts around a foreign module. `require` is
+ * not the alternative — under a Bun loader plugin, which this package's own
+ * tests preload, every module is async and `require` of one throws.
+ */
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import typia from 'typia';
+const isSecretReferencesModule = (() => {
+    const _io0 = input => true && true;
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+const isGroupedSecrets = (() => {
+    const _io0 = input => "string" === typeof input.name && "string" === typeof input.group && "string" === typeof input.derivedGroup;
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
+const isSecretResolution = (() => {
+    const _io0 = input => "object" === typeof input.values && null !== input.values && false === Array.isArray(input.values) && _io1(input.values) && (Array.isArray(input.deferred) && input.deferred.every(elem => "object" === typeof elem && null !== elem && _io2(elem)));
+    const _io1 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return "string" === typeof value;
+    });
+    const _io2 = input => "string" === typeof input.name && "string" === typeof input.group && "string" === typeof input.guidance;
+    return input => "object" === typeof input && null !== input && _io0(input);
+})();
+const RESOLVER_PATH = fileURLToPath(new URL('../../managed/raw/tooling/direnv/secret-references.ts', import.meta.url));
+/**
+ * A loaded export, narrowed to the signature this file calls it with. typia
+ * validates data, not functions — it reports a module missing both of these
+ * as valid — so presence is checked here, and what each one RETURNS is
+ * validated below, where it is data again.
+ */
+function isSecretGroupsReader(value) {
+    return typeof value === 'function';
+}
+function isSecretGroupResolver(value) {
+    return typeof value === 'function';
+}
+let loaded;
+async function secretReferences() {
+    if (loaded !== undefined) {
+        return loaded;
+    }
+    // Dynamic by necessity: the target is a managed raw script outside this
+    // package's compiled rootDir, so no static import can name it.
+    const imported = await import(pathToFileURL(RESOLVER_PATH).href);
+    if (!isSecretReferencesModule(imported)) {
+        throw new Error(`${RESOLVER_PATH} did not load as a module`);
+    }
+    const { readSecretGroups: read, resolveSecretEnvironment: resolve } = imported;
+    if (!isSecretGroupsReader(read) || !isSecretGroupResolver(resolve)) {
+        throw new Error(`${RESOLVER_PATH} does not expose the expected secret resolver API`);
+    }
+    loaded = { readSecretGroups: read, resolveSecretEnvironment: resolve };
+    return loaded;
+}
+/**
+ * Every `smoo.secrets` entry of the repository at `root`, each with the group
+ * that resolves it. Rejects with the offending declaration named — never a
+ * value — when the manifest or `.npmrc` cannot be read.
+ */
+export async function readSecretGroups(root) {
+    const references = await secretReferences();
+    const groups = references.readSecretGroups(root);
+    if (!isGroupedSecrets(groups)) {
+        throw new Error(`${RESOLVER_PATH} returned an unexpected group listing`);
+    }
+    return groups;
+}
+/**
+ * Resolve exactly one group's secrets for one child process. Everything
+ * outside the group comes back deferred rather than resolved, so a run for
+ * one group never triggers another group's provider command. Rejects with the
+ * resolver's aggregated refusal, which names variables and groups only.
+ */
+export async function resolveSecretGroup(root, group) {
+    const references = await secretReferences();
+    const resolution = await references.resolveSecretEnvironment({ root, group });
+    if (!isSecretResolution(resolution)) {
+        throw new Error(`${RESOLVER_PATH} returned an unexpected resolution`);
+    }
+    return resolution;
+}

package/dist/secrets/run.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `smoo secrets run <group> <command...>` — the half of THE RULE that shell
+ * entry is not.
+ *
+ * The rule lives in tooling/direnv/secret-references.ts: shell entry resolves
+ * the `shell` group and nothing else, because a provider authorises per
+ * requesting process lineage and every direnv reload is a new one. Every
+ * other group belongs to the command that needs it, and this is that command.
+ * One deliberate `smoo secrets run registry bun install` instead of a
+ * credential prompt on every shell.
+ *
+ * Exactly one group is resolved. A repository that declares a registry
+ * credential and a cache token runs one provider command here, not two: a
+ * wrapper that resolved everything declared would fire provider commands for
+ * credentials the command never touches, which is the prompt this exists to
+ * remove.
+ *
+ * The value reaches the child the only way that leaves no trace: its
+ * environment. Never a file, never argv — argv is world-readable through
+ * `ps` — and never this process's stdout.
+ */
+export declare function secretsRun(root: string, group: string | undefined, command: readonly string[]): Promise<number>;
+//# sourceMappingURL=run.d.ts.map

package/dist/secrets/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/secrets/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAiBH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA0CrH"}

package/dist/secrets/run.js

@@ -0,0 +1,130 @@
+/**
+ * `smoo secrets run <group> <command...>` — the half of THE RULE that shell
+ * entry is not.
+ *
+ * The rule lives in tooling/direnv/secret-references.ts: shell entry resolves
+ * the `shell` group and nothing else, because a provider authorises per
+ * requesting process lineage and every direnv reload is a new one. Every
+ * other group belongs to the command that needs it, and this is that command.
+ * One deliberate `smoo secrets run registry bun install` instead of a
+ * credential prompt on every shell.
+ *
+ * Exactly one group is resolved. A repository that declares a registry
+ * credential and a cache token runs one provider command here, not two: a
+ * wrapper that resolved everything declared would fire provider commands for
+ * credentials the command never touches, which is the prompt this exists to
+ * remove.
+ *
+ * The value reaches the child the only way that leaves no trace: its
+ * environment. Never a file, never argv — argv is world-readable through
+ * `ps` — and never this process's stdout.
+ */
+import { spawn } from 'node:child_process';
+import { constants } from 'node:os';
+import { readSecretGroups, resolveSecretGroup } from './resolver.js';
+/**
+ * Nothing ran, and the listing is the answer: no group named, a group this
+ * repository does not declare, or a group with no command to run. Distinct
+ * from 1, which is a resolution that refused, and from any other code, which
+ * is the child's own.
+ */
+const REFUSED = 2;
+/** A command that could not be started at all, as a shell reports it. */
+const NOT_EXECUTABLE = 127;
+export async function secretsRun(root, group, command) {
+    let declared;
+    try {
+        declared = await readSecretGroups(root);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+    if (group === undefined) {
+        console.error('smoo secrets run <group> <command...> runs one command with one group of secrets in its environment.');
+        printGroups(declared);
+        return REFUSED;
+    }
+    const members = declared.filter((secret) => secret.group === group);
+    if (members.length === 0) {
+        console.error(`smoo secrets run: no declared secret is in group \`${group}\`.`);
+        printGroups(declared);
+        return REFUSED;
+    }
+    const [program, ...args] = command;
+    if (program === undefined) {
+        console.error(`smoo secrets run ${group} <command...>: name the command to run with ` +
+            `${members.map((secret) => secret.name).join(', ')} in its environment.`);
+        return REFUSED;
+    }
+    let values;
+    try {
+        ({ values } = await resolveSecretGroup(root, group));
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+    return await runWithSecrets(program, args, values);
+}
+/**
+ * The child's exit status, reproduced: a code as itself, death by signal as
+ * 128+signum, and a program that could not be started as 127. It shares this
+ * process group, so terminal signals reach it directly; it is spawned rather
+ * than exec'd only because neither Bun nor Node exposes `execve`.
+ */
+async function runWithSecrets(program, args, values) {
+    return await new Promise((resolve) => {
+        const child = spawn(program, [...args], { stdio: 'inherit', env: { ...process.env, ...values } });
+        child.on('error', (error) => {
+            console.error(`smoo secrets run: cannot run \`${program}\`: ${error.message}`);
+            resolve(NOT_EXECUTABLE);
+        });
+        child.on('close', (code, signal) => {
+            if (signal !== null) {
+                resolve(128 + constants.signals[signal]);
+                return;
+            }
+            resolve(code ?? 1);
+        });
+    });
+}
+/**
+ * The groups this repository declares and the secrets in each. Most people
+ * meet this command exactly once, at a 401, after reading a message that
+ * named it — so the refusal answers "which group?" from this checkout's own
+ * declarations rather than printing a usage line that sends them to the
+ * manifest to work it out.
+ */
+function printGroups(declared) {
+    if (declared.length === 0) {
+        console.error('This repository declares no smoo.secrets, so there is no group to run.');
+        return;
+    }
+    const members = new Map();
+    for (const secret of declared) {
+        const named = members.get(secret.group);
+        if (named === undefined) {
+            members.set(secret.group, [secret.name]);
+            continue;
+        }
+        named.push(secret.name);
+    }
+    const groups = [...members.keys()].sort((left, right) => left.localeCompare(right));
+    const width = Math.max(...groups.map((group) => group.length));
+    console.error('');
+    console.error('Groups this repository declares:');
+    for (const group of groups) {
+        console.error(`  ${group.padEnd(width)}  ${(members.get(group) ?? []).join(', ')}`);
+    }
+    // An override is stated, never left for the next reader to discover by
+    // wondering why a `.npmrc` credential resolves at shell entry.
+    for (const secret of declared) {
+        if (secret.group === secret.derivedGroup)
+            continue;
+        console.error(`  note: ${secret.name} declares group \`${secret.group}\`, overriding the \`${secret.derivedGroup}\` ` +
+            "this repository's declarations derive.");
+    }
+    console.error('');
+    console.error(`  smoo secrets run ${groups[0] ?? '<group>'} <command...>`);
+}

package/dist/secrets/status.d.ts

@@ -0,0 +1,177 @@
+/**
+ * The value model behind `smoo secrets`: one row per secret name, reconciled
+ * from every source that has an opinion about it, plus the machine-readable
+ * document `smoo secrets status --json` emits.
+ *
+ * Everything here is pure and depends on nothing but typia, which is what lets
+ * `@smoothbricks/cli/secrets` be imported for the types alone — a consumer
+ * driving a UI or a repository's own operations CLI gets the document type and
+ * a validator without pulling in `gh`, the filesystem readers, or commander.
+ * The readers that produce these facts live in ./index.ts; the operator
+ * commands that print them live in ./commands.ts.
+ */
+import typia from 'typia';
+import type { SecretStageMap, SecretStageScope } from '../wrangler/stage-secrets.js';
+export type { SecretStageScope };
+/** Where an env name is described, which repository secret carries it, and whether that exists. */
+export interface SecretRow {
+    name: string;
+    /** The repository secret this env name reads from, by convention or declaration. */
+    repositorySecret: string;
+    /** Wrangler projects whose `.dev.vars.example` declares it. */
+    declaredByWorkers: string[];
+    /** True when a managed workflow renders `secrets.<name>` into a job. */
+    suppliedByWorkflow: boolean;
+    /** True when `smoo.secrets` can fetch it for a developer shell; equivalently, `localGroup` is set. */
+    fetchableLocally: boolean;
+    /**
+     * How `smoo.secrets` resolves it locally: the group that resolves it, and
+     * the group this repository's own declarations derive. They differ exactly
+     * when the entry overrides the derivation, which is the one thing a reader
+     * must never have to infer. Absent when nothing fetches the name locally.
+     */
+    localGroup?: {
+        resolves: string;
+        derived: string;
+    };
+    /** True when the repository holds a secret of this name. */
+    onRepository: boolean;
+    /**
+     * GitHub Environments holding their own value for this name. A job bound to
+     * an environment reads that value in preference to the repository's, which
+     * is how one name carries test credentials on a preview stage and live ones
+     * in production.
+     */
+    heldByEnvironment: string[];
+}
+/**
+ * One `smoo.secrets` entry as the reconciliation needs it: the name, the
+ * group that resolves it, and the group this repository's declarations
+ * derive. ../secrets/resolver.ts produces these from the same file shell
+ * entry routes with.
+ */
+export interface LocalSecret {
+    name: string;
+    group: string;
+    derivedGroup: string;
+}
+export interface SecretSources {
+    /** Worker label -> env names it declares. */
+    workerSecrets: Record<string, readonly string[]>;
+    /** Env names a managed workflow passes into a job. */
+    workflowSecrets: readonly string[];
+    /** Env name -> repository secret, by convention with declared exceptions. */
+    secretNames: Readonly<Record<string, string>>;
+    /** Every `smoo.secrets` entry with the group that resolves it. */
+    localSecrets: readonly LocalSecret[];
+    /** Repository secret names GitHub currently holds. */
+    repositorySecrets: readonly string[];
+    /** Environment name -> secret names that environment holds. */
+    environmentSecrets?: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * One row per name known to any source, sorted, so a reader sees the whole
+ * picture rather than one source's view of it.
+ */
+export declare function reconcileSecrets(sources: SecretSources): SecretRow[];
+/**
+ * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
+ * promises to pass it, and the repository has no value to pass. Reported
+ * separately from "declared but not wired into any workflow", because the
+ * remedies differ — set a secret, versus declare it in `smoo.github`.
+ */
+export declare function unsatisfiedSecrets(rows: readonly SecretRow[], boundEnvironments?: readonly string[]): SecretRow[];
+/** Bound environments that lack their own value and cannot fall back to the repository. */
+export declare function environmentsMissing(row: SecretRow, boundEnvironments: readonly string[]): string[];
+/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
+export declare function unwiredSecrets(rows: readonly SecretRow[]): SecretRow[];
+/** The repository the status was read from, and how that repository was chosen. */
+export interface SecretsStatusRepository {
+    /** `owner/name`, the form `gh --repo` takes. */
+    repo: string;
+    /** Why this repository — the checkout fact that decided it, verbatim from the resolver. */
+    source: string;
+    /** How many secrets it holds at repository scope. */
+    secretCount: number;
+}
+/**
+ * One GitHub Environment the status looked at. Discriminated on `readable`
+ * because an environment `gh` refused to list is not an empty one: reporting
+ * it as empty would call values missing that may well be set, and the reason
+ * is the only thing that lets an operator tell the two apart.
+ */
+export type SecretsStatusEnvironment = {
+    name: string;
+    /** True when a managed workflow binds a job to it, so a job reads it before the repository. */
+    bound: boolean;
+    readable: true;
+    secretCount: number;
+} | {
+    name: string;
+    bound: boolean;
+    readable: false;
+    /** What `gh` said, so nothing below claims what this environment holds. */
+    reason: string;
+};
+/** A reconciled row, plus which deployment stages require the name to have a value. */
+export interface SecretsStatusRow extends SecretRow {
+    /**
+     * Stages that refuse to deploy without a value, from `smoo.wrangler.secretStages`
+     * unioned over every wrangler project declaring the name: absent from the map
+     * means every stage, mapped to `[]` means none. A name no wrangler project
+     * declares is `[]` too — `declaredByWorkers` tells those two apart.
+     */
+    requiredByStages: SecretStageScope[];
+}
+/** A name a workflow passes that no scope the job reads can supply: this is what fails a deploy. */
+export interface UnsatisfiedSecret {
+    name: string;
+    repositorySecret: string;
+    /**
+     * Bound environments holding no value for it. Empty means no environment is
+     * bound and the repository itself is the scope to set it in.
+     */
+    missingIn: string[];
+}
+/**
+ * Everything `smoo secrets status` learned, in one document.
+ *
+ * `unsatisfied` is the exit code's reason and not a convenience: the rule that
+ * decides whether a value exists in a scope a bound job reads is smoo's, and a
+ * consumer re-deriving it from `secrets` would be maintaining a second copy of
+ * it.
+ */
+export interface SecretsStatusDocument {
+    /** Document shape, so a consumer refuses a document it does not understand instead of misreading it. */
+    version: 1;
+    repository: SecretsStatusRepository;
+    /** Every environment looked at: those the workflows bind, then any asked for with `--env`. */
+    environments: SecretsStatusEnvironment[];
+    /** One row per name any source knows, sorted by name. */
+    secrets: SecretsStatusRow[];
+    /** Empty exactly when the command exits 0. */
+    unsatisfied: UnsatisfiedSecret[];
+}
+/** The facts a document is projected from, all gathered before anything is printed. */
+export interface SecretsStatusFacts {
+    repository: SecretsStatusRepository;
+    environments: readonly SecretsStatusEnvironment[];
+    rows: readonly SecretRow[];
+    /** Worker label -> its `smoo.wrangler.secretStages` declaration; a worker with no block is absent. */
+    stageScopes: Readonly<Record<string, SecretStageMap>>;
+}
+/** The document, from facts. Pure: every read happened before this was called. */
+export declare function projectSecretsStatus(facts: SecretsStatusFacts): SecretsStatusDocument;
+/**
+ * The consumer's boundary: text off a `smoo secrets status --json` run into a
+ * validated document, or typia's own account of every field that disagreed.
+ */
+export declare const parseSecretsStatusDocument: (input: string) => typia.IValidation<SecretsStatusDocument>;
+/**
+ * The emitter's boundary: the projection is checked against its declared type
+ * before it becomes text. A shape bug then fails here, naming the field, rather
+ * than reaching a consumer as a document its validator rejects with no idea who
+ * produced it.
+ */
+export declare const stringifySecretsStatusDocument: (input: unknown, errorFactory?: undefined | ((props: typia.TypeGuardError.IProps) => Error)) => string;
+//# sourceMappingURL=status.d.ts.map

package/dist/secrets/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/secrets/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErF,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,sGAAsG;IACtG,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,4DAA4D;IAC5D,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACjD,sDAAsD;IACtD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6EAA6E;IAC7E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,kEAAkE;IAClE,YAAY,EAAE,SAAS,WAAW,EAAE,CAAC;IACrC,sDAAsD;IACtD,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,CAyCpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,iBAAiB,GAAE,SAAS,MAAM,EAAO,GAAG,SAAS,EAAE,CAUrH;AAED,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAGlG;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAEtE;AASD,mFAAmF;AACnF,MAAM,WAAW,uBAAuB;IACtC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,IAAI,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,KAAK,CAAC;IAChB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,uFAAuF;AACvF,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD;;;;;OAKG;IACH,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;CACtC;AAED,oGAAoG;AACpG,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,wGAAwG;IACxG,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,uBAAuB,CAAC;IACpC,8FAA8F;IAC9F,YAAY,EAAE,wBAAwB,EAAE,CAAC;IACzC,yDAAyD;IACzD,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,8CAA8C;IAC9C,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,uBAAuB,CAAC;IACpC,YAAY,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAClD,IAAI,EAAE,SAAS,SAAS,EAAE,CAAC;IAC3B,sGAAsG;IACtG,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CACvD;AAsBD,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,qBAAqB,CAqBrF;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,6DAA0D,CAAC;AAElG;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,wGAA4D,CAAC"}