@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/environment/controller.js

@@ -0,0 +1,429 @@
+import { create, fromBinary } from "@bufbuild/protobuf";
+import { EnvironmentCommandController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/command_pb";
+import { EnvironmentQueryController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/query_pb";
+import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import { EnvironmentListSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/io_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
+import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
+import { failedPreconditionError, internalError, notFoundError, } from "../../pipeline/errors.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import { newAuthorizeVisibilityTransitionStep } from "../../pipeline/steps/visibility-gates.js";
+import { newBuildNewStateStep, setAuditFieldsForUpdate, } from "../../pipeline/steps/defaults.js";
+import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
+import { newCheckDuplicateStep } from "../../pipeline/steps/duplicate.js";
+import { RESOURCE_ID_KEY, newDeleteResourceStep, newLoadExistingForDeleteStep, } from "../../pipeline/steps/delete.js";
+import { newDeleteSearchIndexStep, newIndexSearchStep, } from "../../pipeline/steps/index-search.js";
+import { compareCreatedAtDesc, matchesAllLabels, } from "../../pipeline/steps/helpers.js";
+import { EXISTING_RESOURCE_KEY, newLoadExistingStep, } from "../../pipeline/steps/load-existing.js";
+import { SHOULD_CREATE_KEY, newLoadForApplyStep, withResolvedApplyId, } from "../../pipeline/steps/load-for-apply.js";
+import { newLoadByReferenceStep } from "../../pipeline/steps/load-by-reference.js";
+import { TARGET_RESOURCE_KEY, newLoadTargetStep, } from "../../pipeline/steps/load-target.js";
+import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import { newCleanupIamPoliciesStep, newCreateAuthorizationTuplesStep, newRecordVisibilityBeforeUpdateStep, newUpdateVisibilityTuplesStep, } from "../../pipeline/steps/authorization-tuples.js";
+import { newPersistStep } from "../../pipeline/steps/persist.js";
+import { newDestroySecretBackingStateStep } from "../../pipeline/steps/secret-cleanup.js";
+import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { newValidateVisibilityStep, newValidateVisibilityUpdateStep, } from "../../pipeline/steps/validate-visibility.js";
+import { redactEnvironmentSecrets, shareRestrictionReason } from "./redact.js";
+import { environmentSearchExtractor } from "./search-extractor.js";
+import { SECRET_VALUE_KEY, UPDATED_ENVIRONMENT_KEY, newDestroyDroppedEnvironmentSecretsStep, newEncryptSecretValuesStep, newEnforcePersonalUniquenessStep, newExtractAndDecryptSingleKeyStep, newLoadEnvironmentByIdStep, newMergeVariablesAndPersistStep, newPreserveRedactedSecretsStep, newRemoveVariableKeysAndPersistStep, secretValuesOfEnvironment, } from "./steps.js";
+/** Registers both environment services on the router (routes stage). */
+export function registerEnvironmentServices(router, deps) {
+    router.service(EnvironmentCommandController, {
+        apply: (env, ctx) => apply(deps, env, ctx),
+        create: (env, ctx) => createEnvironment(deps, env, ctx),
+        update: (env, ctx) => update(deps, env, ctx),
+        updateVisibility: (input, ctx) => updateVisibility(deps, input, ctx),
+        delete: (input, ctx) => deleteEnvironment(deps, input, ctx),
+        updateVariables: (req, ctx) => updateVariables(deps, req, ctx),
+        removeVariables: (req, ctx) => removeVariables(deps, req, ctx),
+    });
+    router.service(EnvironmentQueryController, {
+        get: (id, ctx) => get(deps, id, ctx),
+        getByReference: (ref, ctx) => getByReference(deps, ref, ctx),
+        getSecretValue: (input, ctx) => getSecretValue(deps, input, ctx),
+        list: (req, ctx) => list(deps, req, ctx),
+    });
+}
+function kindOf(ctx) {
+    return ctx.values.get(apiResourceKindKey);
+}
+/**
+ * Create — chain per Go buildCreatePipeline. Redaction runs AFTER
+ * Persist: the store keeps ciphertext, the response carries markers
+ * (never ciphertext — clients cannot round-trip it past the enc: prefix
+ * guard, and it is server-internal by design).
+ */
+async function createEnvironment(deps, env, ctx) {
+    const reqCtx = new RequestContext(EnvironmentSchema, env, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("environment-create", deps.logger)
+        .addStep(newAuthorizeStep(EnvironmentCommandController.method.create, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newValidateVisibilityStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newCheckDuplicateStep(deps.store))
+        .addStep(newEnforcePersonalUniquenessStep(deps.store))
+        .addStep(newBuildNewStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newPreserveRedactedSecretsStep())
+        .addStep(newEncryptSecretValuesStep(deps.secretService, deps.logger))
+        .addStep(newPersistStep(deps.store))
+        .addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle, deps.logger))
+        .addStep(newIndexSearchStep(deps.store, environmentSearchExtractor, deps.logger))
+        .build()
+        .execute(reqCtx);
+    redactEnvironmentSecrets(reqCtx.newState);
+    return reqCtx.newState;
+}
+/** Update — chain per Go buildUpdatePipeline; redact after persist. */
+async function update(deps, env, ctx) {
+    const reqCtx = new RequestContext(EnvironmentSchema, env, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("environment-update", deps.logger)
+        .addStep(newAuthorizeStep(EnvironmentCommandController.method.update, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newLoadExistingStep(deps.store))
+        .addStep(newBuildUpdateStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newPreserveRedactedSecretsStep())
+        .addStep(newEncryptSecretValuesStep(deps.secretService, deps.logger))
+        .addStep(newNormalizeReferencesStep())
+        .addStep(newPersistStep(deps.store))
+        .addStep(newDestroyDroppedEnvironmentSecretsStep(deps.secretService, deps.logger))
+        .addStep(newIndexSearchStep(deps.store, environmentSearchExtractor, deps.logger))
+        .build()
+        .execute(reqCtx);
+    redactEnvironmentSecrets(reqCtx.newState);
+    return reqCtx.newState;
+}
+/**
+ * Apply — kubectl-style create-or-update: a minimal probe pipeline decides
+ * existence, then delegates to Create or Update with the ORIGINAL request
+ * message (Go delegates `environment`, not the pipeline's mutated clone);
+ * the update arm carries the resolved id via withResolvedApplyId.
+ */
+async function apply(deps, env, ctx) {
+    const reqCtx = new RequestContext(EnvironmentSchema, env, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("environment-apply", deps.logger)
+        .addStep(newAuthorizeStep(EnvironmentCommandController.method.apply, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newLoadForApplyStep(deps.store))
+        .build()
+        .execute(reqCtx);
+    const shouldCreate = reqCtx.get(SHOULD_CREATE_KEY);
+    if (typeof shouldCreate !== "boolean") {
+        throw internalError(new Error("apply pipeline did not set shouldCreate flag"), "apply operation failed to determine create vs update");
+    }
+    return shouldCreate
+        ? createEnvironment(deps, env, ctx)
+        : update(deps, withResolvedApplyId(EnvironmentSchema, env, reqCtx), ctx);
+}
+/**
+ * Delete — returns the deleted environment REDACTED (the audit-trail
+ * convention; even a parting response never carries secrets). The id is
+ * seeded into context manually because ApiResourceDeleteInput carries
+ * resource_id, not the `value` field ExtractResourceId expects (Go does
+ * the same manual seed).
+ */
+async function deleteEnvironment(deps, input, ctx) {
+    const reqCtx = new RequestContext(EnvironmentCommandController.method.delete.input, input, callerIdentityOf(ctx), kindOf(ctx));
+    reqCtx.set(RESOURCE_ID_KEY, input.resourceId);
+    await newPipeline("environment-delete", deps.logger)
+        .addStep(newAuthorizeStep(EnvironmentCommandController.method.delete, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadExistingForDeleteStep(deps.store, EnvironmentSchema))
+        .addStep(newDeleteResourceStep(deps.store))
+        .addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger))
+        .addStep(newDestroySecretBackingStateStep(deps.secretService, deps.logger, secretValuesOfEnvironment))
+        .addStep(newDeleteSearchIndexStep(deps.store, deps.logger))
+        .build()
+        .execute(reqCtx);
+    const deleted = reqCtx.get(EXISTING_RESOURCE_KEY);
+    if (deleted === undefined) {
+        throw internalError(new Error("deleted environment not found in context"), "deleted environment not found in context");
+    }
+    const env = deleted;
+    redactEnvironmentSecrets(env);
+    return env;
+}
+// ---------------------------------------------------------------------------
+// updateVisibility — Go update_visibility.go: a targeted metadata update
+// (only metadata.visibility changes; spec/status untouched). Environments
+// cap out at org visibility (the kind's VisibilityConfig — secret values
+// must never be resolvable across the org boundary); personal and
+// OAuth-managed environments reject org sharing entirely.
+// ---------------------------------------------------------------------------
+const UPDATE_VISIBILITY_ENVIRONMENT_KEY = "updateVisibilityEnvironment";
+async function updateVisibility(deps, input, ctx) {
+    const reqCtx = new RequestContext(EnvironmentCommandController.method.updateVisibility.input, input, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("environment-update-visibility", deps.logger)
+        .addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVisibility, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadEnvironmentForVisibilityUpdateStep(deps.store))
+        .addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_ENVIRONMENT_KEY))
+        // After load, per the cross-edition error precedence: unknown id +
+        // bad level = NOT_FOUND on both editions.
+        .addStep(newValidateVisibilityUpdateStep())
+        .addStep(newAuthorizeVisibilityTransitionStep(UPDATE_VISIBILITY_ENVIRONMENT_KEY, deps.authorizer))
+        .addStep(newValidateEnvironmentShareRestrictionStep())
+        .addStep(newSetEnvironmentVisibilityStep())
+        .addStep(newPersistEnvironmentForVisibilityUpdateStep(deps.store))
+        .addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle, UPDATE_VISIBILITY_ENVIRONMENT_KEY))
+        .addStep(newIndexEnvironmentAfterVisibilityUpdateStep(deps.store, deps.logger))
+        .build()
+        .execute(reqCtx);
+    const env = reqCtx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);
+    redactEnvironmentSecrets(env);
+    return env;
+}
+/** Loads the environment by resource_id; ANY load failure → NotFound. */
+function newLoadEnvironmentForVisibilityUpdateStep(store) {
+    return {
+        name: "LoadEnvironmentForVisibilityUpdate",
+        async execute(ctx) {
+            const input = ctx.input;
+            let env;
+            try {
+                env = await store.getResource(ctx.apiResourceKind, input.resourceId, EnvironmentSchema);
+            }
+            catch {
+                throw notFoundError("environment", input.resourceId);
+            }
+            ctx.set(UPDATE_VISIBILITY_ENVIRONMENT_KEY, env);
+        },
+    };
+}
+/**
+ * Rejects org sharing on personal and OAuth-managed environments BEFORE
+ * any state changes. Only gates the transitions that WIDEN access —
+ * restoring a share-restricted environment to private must always be
+ * possible. Level support is validated by the shared
+ * ValidateVisibilityUpdate composed just before this one.
+ */
+function newValidateEnvironmentShareRestrictionStep() {
+    return {
+        name: "ValidateEnvironmentShareRestriction",
+        execute(ctx) {
+            if (ctx.input.visibility !== ApiResourceVisibility.visibility_org) {
+                return;
+            }
+            const env = ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);
+            const reason = shareRestrictionReason(env.metadata);
+            if (reason !== "") {
+                throw failedPreconditionError(reason);
+            }
+        },
+    };
+}
+/** Sets metadata.visibility and stamps the StatusAudit slot (#540). */
+function newSetEnvironmentVisibilityStep() {
+    return {
+        name: "SetVisibility",
+        execute(ctx) {
+            const env = ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);
+            if (env.metadata !== undefined) {
+                env.metadata.visibility = ctx.input.visibility;
+            }
+            // Go wraps a stamping failure as a PLAIN error (not grpclib) — the
+            // wire then carries the sanitized "internal server error", exactly
+            // what the pipeline's non-Connect fallback produces here.
+            setAuditFieldsForUpdate(EnvironmentSchema, env, "status_audit", ctx.callerIdentity);
+        },
+    };
+}
+/** Persists the visibility change. */
+function newPersistEnvironmentForVisibilityUpdateStep(store) {
+    return {
+        name: "PersistEnvironmentForVisibilityUpdate",
+        async execute(ctx) {
+            const env = ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);
+            try {
+                await store.saveResource(ctx.apiResourceKind, env.metadata?.id ?? "", EnvironmentSchema, env);
+            }
+            catch (error) {
+                throw internalError(error, "failed to save environment");
+            }
+        },
+    };
+}
+/**
+ * Re-indexes after the visibility change (visibility is an indexed
+ * field). Domain-local because the shared IndexSearch reads newState,
+ * which is the UpdateVisibilityInput here, not the environment.
+ * Best-effort by contract, as in Go.
+ */
+function newIndexEnvironmentAfterVisibilityUpdateStep(store, logger) {
+    return {
+        name: "IndexEnvironmentAfterVisibilityUpdate",
+        async execute(ctx) {
+            const env = ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);
+            const entry = environmentSearchExtractor.getSearchIndexEntry(env);
+            if (entry === undefined) {
+                logger.warn("IndexEnvironmentAfterVisibilityUpdate: extractor returned nil, skipping", { id: env.metadata?.id ?? "" });
+                return;
+            }
+            try {
+                await store.upsertSearchIndex(ctx.apiResourceKind, env.metadata?.id ?? "", entry);
+            }
+            catch (error) {
+                logger.warn("IndexEnvironmentAfterVisibilityUpdate: failed (best-effort)", {
+                    id: env.metadata?.id ?? "",
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        },
+    };
+}
+/**
+ * UpdateVariables — server-side merge: request keys overwrite, absent
+ * keys are preserved. Avoids the read-modify-write secret destruction
+ * problem inherent in the full-resource Update RPC.
+ */
+async function updateVariables(deps, req, ctx) {
+    const reqCtx = new RequestContext(EnvironmentCommandController.method.updateVariables.input, req, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("environment-update-variables", deps.logger)
+        .addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVariables, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadEnvironmentByIdStep(deps.store))
+        .addStep(newMergeVariablesAndPersistStep(deps.store, deps.secretService, deps.logger))
+        .build()
+        .execute(reqCtx);
+    const updated = reqCtx.get(UPDATED_ENVIRONMENT_KEY);
+    redactEnvironmentSecrets(updated);
+    return updated;
+}
+/** RemoveVariables — named keys deleted; unknown keys silently ignored. */
+async function removeVariables(deps, req, ctx) {
+    const reqCtx = new RequestContext(EnvironmentCommandController.method.removeVariables.input, req, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("environment-remove-variables", deps.logger)
+        .addStep(newAuthorizeStep(EnvironmentCommandController.method.removeVariables, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadEnvironmentByIdStep(deps.store))
+        .addStep(newRemoveVariableKeysAndPersistStep(deps.store, deps.secretService, deps.logger))
+        .build()
+        .execute(reqCtx);
+    const updated = reqCtx.get(UPDATED_ENVIRONMENT_KEY);
+    redactEnvironmentSecrets(updated);
+    return updated;
+}
+/** Get — LoadTarget by id; the response is redacted (oss#405). */
+async function get(deps, id, ctx) {
+    const reqCtx = new RequestContext(EnvironmentQueryController.method.get.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("environment-get", deps.logger)
+        .addStep(newAuthorizeStep(EnvironmentQueryController.method.get, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadTargetStep(deps.store, EnvironmentSchema))
+        .build()
+        .execute(reqCtx);
+    const env = reqCtx.get(TARGET_RESOURCE_KEY);
+    redactEnvironmentSecrets(env);
+    return env;
+}
+/** GetByReference — slug+org lookup; the response is redacted. */
+async function getByReference(deps, ref, ctx) {
+    const reqCtx = new RequestContext(EnvironmentQueryController.method.getByReference.input, ref, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("environment-get-by-reference", deps.logger)
+        .addStep(newAuthorizeStep(EnvironmentQueryController.method.getByReference, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadByReferenceStep(deps.store, EnvironmentSchema))
+        .build()
+        .execute(reqCtx);
+    const env = reqCtx.get(TARGET_RESOURCE_KEY);
+    redactEnvironmentSecrets(env);
+    return env;
+}
+/**
+ * GetSecretValue — the sanctioned single-key reveal path; the ONE
+ * Environment surface that returns an unredacted value.
+ */
+async function getSecretValue(deps, input, ctx) {
+    const reqCtx = new RequestContext(EnvironmentQueryController.method.getSecretValue.input, input, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("environment-get-secret-value", deps.logger)
+        .addStep(newAuthorizeStep(EnvironmentQueryController.method.getSecretValue, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadEnvironmentByIdStep(deps.store))
+        .addStep(newExtractAndDecryptSingleKeyStep(deps.secretService, deps.logger))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.get(SECRET_VALUE_KEY);
+}
+const LIST_RESULT_KEY = "listResult";
+/**
+ * List — org + labels filter with per-item redaction. Versus Cloud, OSS
+ * excludes authorization filtering AND pagination (returns all matches),
+ * exactly as Go's list.go records.
+ */
+async function list(deps, req, ctx) {
+    const reqCtx = new RequestContext(EnvironmentQueryController.method.list.input, req, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("environment-list", deps.logger)
+        .addStep(newAuthorizeStep(EnvironmentQueryController.method.list, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newListByOrgAndLabelsStep(deps.store, deps.listReadScope))
+        .build()
+        .execute(reqCtx);
+    const result = reqCtx.get(LIST_RESULT_KEY);
+    if (result === undefined) {
+        throw internalError(new Error("environment list not found in context"), "environment list not found in context");
+    }
+    return result;
+}
+/**
+ * ListByOrgAndLabels — Go list.go's domain step: full scan, malformed
+ * rows skipped, org equality + AND-label filtering, per-item redaction,
+ * sorted by spec-audit created_at descending (seconds then nanos;
+ * timestamped entries before untimestamped ones). With a composed
+ * ListReadScope (20260830.01, census lane 10) the decoded scan narrows
+ * to the caller's authorized environments first — the existing org
+ * filter here already serves the Java handler's org arm, so the helper's
+ * org argument stays blank.
+ */
+function newListByOrgAndLabelsStep(store, listReadScope) {
+    return {
+        name: "ListByOrgAndLabels",
+        async execute(ctx) {
+            const { org, labels: filterLabels } = ctx.input;
+            let rows;
+            try {
+                rows = await store.listResources(ctx.apiResourceKind);
+            }
+            catch (error) {
+                throw internalError(error, "failed to list environments");
+            }
+            const decoded = [];
+            for (const bytes of rows) {
+                try {
+                    decoded.push(fromBinary(EnvironmentSchema, bytes));
+                }
+                catch {
+                    continue; // skip malformed rows, as Go does
+                }
+            }
+            const visible = await restrictListByReadScope(listReadScope, ctx.callerIdentity, ApiResourceKind.environment, decoded, "");
+            const environments = [];
+            for (const env of visible) {
+                if ((env.metadata?.org ?? "") !== org) {
+                    continue;
+                }
+                if (!matchesAllLabels(env.metadata?.labels ?? {}, filterLabels)) {
+                    continue;
+                }
+                redactEnvironmentSecrets(env);
+                environments.push(env);
+            }
+            environments.sort((a, b) => compareCreatedAtDesc(a.status?.audit?.specAudit?.createdAt, b.status?.audit?.specAudit?.createdAt));
+            ctx.set(LIST_RESULT_KEY, create(EnvironmentListSchema, {
+                totalCount: environments.length,
+                items: environments,
+            }));
+        },
+    };
+}
+//# sourceMappingURL=controller.js.map

package/dist/domain/environment/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/environment/controller.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,8DAA8D,CAAC;AAC5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AACxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAE7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAShG,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAO/F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAG9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,0CAA0C,CAAC;AAChG,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EACL,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,6CAA6C,CAAC;AAGrD,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,uCAAuC,EACvC,0BAA0B,EAC1B,gCAAgC,EAChC,iCAAiC,EACjC,0BAA0B,EAC1B,+BAA+B,EAC/B,8BAA8B,EAC9B,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AAcpB,wEAAwE;AACxE,MAAM,UAAU,2BAA2B,CACzC,MAAqB,EACrB,IAA+B;IAE/B,MAAM,CAAC,OAAO,CAAC,4BAA4B,EAAE;QAC3C,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC1C,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QACvD,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5C,gBAAgB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACpE,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC3D,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC9D,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KAC/D,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE;QACzC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5D,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAChE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA+B,EAC/B,GAAgB,EAChB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,iBAAiB,EACjB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA2B,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3E,OAAO,CACN,gBAAgB,CACd,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAC1C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACrD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,8BAA8B,EAAE,CAAC;SACzC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACpE,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CACN,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC,CACxE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,MAAM,CACnB,IAA+B,EAC/B,GAAgB,EAChB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,iBAAiB,EACjB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA2B,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3E,OAAO,CACN,gBAAgB,CACd,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAC1C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,8BAA8B,EAAE,CAAC;SACzC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACpE,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,uCAAuC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CACzE;SACA,OAAO,CACN,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC,CACxE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CAClB,IAA+B,EAC/B,GAAgB,EAChB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,iBAAiB,EACjB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA2B,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC1E,OAAO,CACN,gBAAgB,CACd,4BAA4B,CAAC,MAAM,CAAC,KAAK,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8CAA8C,CAAC,EACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY;QACjB,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QACnC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA+B,EAC/B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAChD,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,CACf,oBAAoB,EACpB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAC1C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;SACpE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CACN,gCAAgC,CAG9B,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAC9D;SACA,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC1D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0CAA0C,CAAC,EACrD,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAsB,CAAC;IACnC,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,kEAAkE;AAClE,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,iCAAiC,GAAG,6BAA6B,CAAC;AAKxE,KAAK,UAAU,gBAAgB,CAC7B,IAA+B,EAC/B,KAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAC1D,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,+BAA+B,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,EACpD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yCAAyC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC9D,OAAO,CACN,mCAAmC,CAAC,iCAAiC,CAAC,CACvE;QACD,mEAAmE;QACnE,0CAA0C;SACzC,OAAO,CAAC,+BAA+B,EAAE,CAAC;SAC1C,OAAO,CACN,oCAAoC,CAClC,iCAAiC,EACjC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,0CAA0C,EAAE,CAAC;SACrD,OAAO,CAAC,+BAA+B,EAAE,CAAC;SAC1C,OAAO,CAAC,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACjE,OAAO,CACN,6BAA6B,CAC3B,IAAI,CAAC,sBAAsB,EAC3B,iCAAiC,CAClC,CACF;SACA,OAAO,CACN,4CAA4C,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CACtE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAgB,CAAC;IACzE,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,SAAS,yCAAyC,CAChD,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,oCAAoC;QAC1C,KAAK,CAAC,OAAO,CAAC,GAAyC;YACrD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,IAAI,GAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,CAC3B,GAAG,CAAC,eAAe,EACnB,KAAK,CAAC,UAAU,EAChB,iBAAiB,CAClB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YACvD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,0CAA0C;IACjD,OAAO;QACL,IAAI,EAAE,qCAAqC;QAC3C,OAAO,CAAC,GAAyC;YAC/C,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,qBAAqB,CAAC,cAAc,EAAE,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAgB,CAAC;YACtE,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBAClB,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,+BAA+B;IACtC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,CAAC,GAAyC;YAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAgB,CAAC;YACtE,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC/B,GAAG,CAAC,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YACjD,CAAC;YACD,mEAAmE;YACnE,mEAAmE;YACnE,0DAA0D;YAC1D,uBAAuB,CACrB,iBAAiB,EACjB,GAAG,EACH,cAAc,EACd,GAAG,CAAC,cAAc,CACnB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sCAAsC;AACtC,SAAS,4CAA4C,CACnD,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,uCAAuC;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAyC;YACrD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAgB,CAAC;YACtE,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,YAAY,CACtB,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EACtB,iBAAiB,EACjB,GAAG,CACJ,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,4CAA4C,CACnD,KAAY,EACZ,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,uCAAuC;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAyC;YACrD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAgB,CAAC;YACtE,MAAM,KAAK,GAAG,0BAA0B,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CACT,yEAAyE,EACzE,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAC/B,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,iBAAiB,CAC3B,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EACtB,KAAK,CACN,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CACT,6DAA6D,EAC7D;oBACE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;oBAC1B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAC5B,IAA+B,EAC/B,GAAsC,EACtC,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,4BAA4B,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,EACzD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,8BAA8B,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3C,OAAO,CACN,gBAAgB,CACd,4BAA4B,CAAC,MAAM,CAAC,eAAe,EACnD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC/C,OAAO,CACN,+BAA+B,CAC7B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAgB,CAAC;IACnE,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,eAAe,CAC5B,IAA+B,EAC/B,GAAsC,EACtC,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,4BAA4B,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,EACzD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,8BAA8B,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3C,OAAO,CACN,gBAAgB,CACd,4BAA4B,CAAC,MAAM,CAAC,eAAe,EACnD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC/C,OAAO,CACN,mCAAmC,CACjC,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAgB,CAAC;IACnE,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,GAAG,CAChB,IAA+B,EAC/B,EAAiB,EACjB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAC3C,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,iBAAiB,EACjB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,0BAA0B,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;SACzD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAgB,CAAC;IAC3D,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,cAAc,CAC3B,IAA+B,EAC/B,GAAyB,EACzB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EACtD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,8BAA8B,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3C,OAAO,CACN,gBAAgB,CACd,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAChD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;SAC9D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAgB,CAAC;IAC3D,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,IAA+B,EAC/B,KAAkC,EAClC,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EACtD,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,8BAA8B,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3C,OAAO,CACN,gBAAgB,CACd,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAChD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC/C,OAAO,CAAC,iCAAiC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC3E,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAqB,CAAC;AAC1D,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC;;;;GAIG;AACH,KAAK,UAAU,IAAI,CACjB,IAA+B,EAC/B,GAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAC5C,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,kBAAkB,EAClB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;SAClE,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,uCAAuC,CAAC,EAClD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO,MAAyB,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,yBAAyB,CAChC,KAAY,EACZ,aAAwC;IAExC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CACX,GAAwE;YAExE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;YAEhD,IAAI,IAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,OAAO,GAAkB,EAAE,CAAC;YAClC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,kCAAkC;gBAC9C,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAC3C,aAAa,EACb,GAAG,CAAC,cAAc,EAClB,eAAe,CAAC,WAAW,EAC3B,OAAO,EACP,EAAE,CACH,CAAC;YAEF,MAAM,YAAY,GAAkB,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC;oBAChE,SAAS;gBACX,CAAC;gBACD,wBAAwB,CAAC,GAAG,CAAC,CAAC;gBAC9B,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAED,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzB,oBAAoB,CAClB,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EACrC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CACtC,CACF,CAAC;YAEF,GAAG,CAAC,GAAG,CACL,eAAe,EACf,MAAM,CAAC,qBAAqB,EAAE;gBAC5B,UAAU,EAAE,YAAY,CAAC,MAAM;gBAC/B,KAAK,EAAE,YAAY;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/environment/redact.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Redaction + share-restriction helpers — port
+ * pkg/domain/environment/controller/steps/{redact_secret_values,
+ * share_restricted}.go. Deliberately NOT pipeline steps: redaction runs
+ * post-pipeline at every Environment-returning boundary, and the share
+ * restriction is a predicate the visibility pipeline consumes.
+ */
+import type { Environment } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import type { ApiResourceMetadata } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+/**
+ * Go RedactEnvironmentSecrets: replaces every NON-EMPTY is_secret value
+ * with the marker — called at every controller boundary that returns an
+ * Environment (get, getByReference, list, create, update, updateVariables,
+ * removeVariables, updateVisibility, delete; apply inherits via
+ * delegation). getSecretValue is the sanctioned single-key reveal path and
+ * stays unredacted; server-internal consumers go through the
+ * RuntimeResolutionService, never the RPC surface.
+ *
+ * is_secret and description are preserved so clients know a hidden value
+ * exists; EMPTY secret declarations stay empty (a marker would falsely
+ * signal a stored value). Mutates in place: callers hold either a fresh
+ * store unmarshal (reads) or the already-persisted new state (writes), so
+ * the redaction never reaches the store. Runs strictly AFTER Persist on
+ * write paths.
+ */
+export declare function redactEnvironmentSecrets(env: Environment | undefined): void;
+/**
+ * Go ShareRestrictionReason: why an environment must never leave private
+ * visibility, or "" when no restriction applies.
+ *
+ * Two classes are share-restricted by construction:
+ *   - Personal (stigmer.ai/personal=true): the user's whole credential
+ *     fallback bag — org-sharing it would expose every credential the user
+ *     ever stored, not a deliberately scoped set.
+ *   - Managed (stigmer.ai/managed=true): system-created holders of
+ *     per-user OAuth tokens. Sharing OAuth grants needs its own identity
+ *     and refresh design (tracked follow-up), so it is rejected rather
+ *     than silently half-working.
+ *
+ * Both editions enforce this identically — the error copy is shared.
+ */
+export declare function shareRestrictionReason(metadata: ApiResourceMetadata | undefined): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/domain/environment/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../../src/domain/environment/redact.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0DAA0D,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAYtG;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,CAU3E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,MAAM,CASR"}

package/dist/domain/environment/redact.js

@@ -0,0 +1,54 @@
+import { MANAGED_LABEL_KEY, MANAGED_LABEL_VALUE, MANAGED_SHARE_RESTRICTION, PERSONAL_LABEL_KEY, PERSONAL_LABEL_VALUE, PERSONAL_SHARE_RESTRICTION, REDACTED_MARKER, } from "./constants.js";
+/**
+ * Go RedactEnvironmentSecrets: replaces every NON-EMPTY is_secret value
+ * with the marker — called at every controller boundary that returns an
+ * Environment (get, getByReference, list, create, update, updateVariables,
+ * removeVariables, updateVisibility, delete; apply inherits via
+ * delegation). getSecretValue is the sanctioned single-key reveal path and
+ * stays unredacted; server-internal consumers go through the
+ * RuntimeResolutionService, never the RPC surface.
+ *
+ * is_secret and description are preserved so clients know a hidden value
+ * exists; EMPTY secret declarations stay empty (a marker would falsely
+ * signal a stored value). Mutates in place: callers hold either a fresh
+ * store unmarshal (reads) or the already-persisted new state (writes), so
+ * the redaction never reaches the store. Runs strictly AFTER Persist on
+ * write paths.
+ */
+export function redactEnvironmentSecrets(env) {
+    const data = env?.spec?.data;
+    if (data === undefined) {
+        return;
+    }
+    for (const value of Object.values(data)) {
+        if (value.isSecret && value.value !== "") {
+            value.value = REDACTED_MARKER;
+        }
+    }
+}
+/**
+ * Go ShareRestrictionReason: why an environment must never leave private
+ * visibility, or "" when no restriction applies.
+ *
+ * Two classes are share-restricted by construction:
+ *   - Personal (stigmer.ai/personal=true): the user's whole credential
+ *     fallback bag — org-sharing it would expose every credential the user
+ *     ever stored, not a deliberately scoped set.
+ *   - Managed (stigmer.ai/managed=true): system-created holders of
+ *     per-user OAuth tokens. Sharing OAuth grants needs its own identity
+ *     and refresh design (tracked follow-up), so it is rejected rather
+ *     than silently half-working.
+ *
+ * Both editions enforce this identically — the error copy is shared.
+ */
+export function shareRestrictionReason(metadata) {
+    const labels = metadata?.labels ?? {};
+    if (labels[PERSONAL_LABEL_KEY] === PERSONAL_LABEL_VALUE) {
+        return PERSONAL_SHARE_RESTRICTION;
+    }
+    if (labels[MANAGED_LABEL_KEY] === MANAGED_LABEL_VALUE) {
+        return MANAGED_SHARE_RESTRICTION;
+    }
+    return "";
+}
+//# sourceMappingURL=redact.js.map

package/dist/domain/environment/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../../src/domain/environment/redact.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAA4B;IACnE,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAyC;IAEzC,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;IACtC,IAAI,MAAM,CAAC,kBAAkB,CAAC,KAAK,oBAAoB,EAAE,CAAC;QACxD,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,CAAC,KAAK,mBAAmB,EAAE,CAAC;QACtD,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/domain/environment/resolution/resolution.d.ts

@@ -0,0 +1,47 @@
+import type { Environment } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { Logger } from "../../../boot/logger.js";
+import type { SecretService } from "../../../encryption/encryption.js";
+import type { Store } from "../../../store/interface.js";
+/**
+ * Resolves environments with secret values decrypted, for merging into an
+ * ExecutionContext.
+ */
+export declare class RuntimeResolutionService {
+    private readonly store;
+    private readonly secretService;
+    private readonly logger;
+    constructor(store: Store, secretService: SecretService, logger: Logger);
+    /**
+     * Go ResolveByReference: loads the referenced environment and decrypts
+     * its is_secret values in place on the freshly-loaded copy (the store is
+     * never touched). Lookup semantics match the getByReference RPC exactly
+     * — same slug+org matching and the same org requirement for this
+     * org-scoped kind — so a ref that resolves through the RPC surface
+     * resolves identically here, and vice versa.
+     *
+     * Error doctrine (the cloud service's two-armed taxonomy, errors.ts):
+     *   - The value-scoped arm (InvalidCiphertextError family —
+     *     tampered/truncated/wrong-key) is scoped to one value: WARN and
+     *     drop that key (the cloud's per-key skip).
+     *   - The infrastructure arm (EncryptionUnavailableError, incl. its
+     *     keyless EncryptionDisabledError case) propagates: the stored
+     *     ciphertext may be perfectly valid (key file lost, codec's key
+     *     provider unreachable, version with no codec here), and skipping
+     *     it would start the execution silently missing a credential — a
+     *     confusing downstream failure instead of a clear one here.
+     *   - An unresolvable reference is NotFound, same as the RPC path — the
+     *     execution-context builders treat that as an authoring error that
+     *     fails the create (never a silent run without credentials).
+     */
+    resolveByReference(ref: ApiResourceReference | undefined): Promise<Environment>;
+    /**
+     * Decrypts every encrypted is_secret value in place. Plaintext legacy
+     * rows pass through decrypt unchanged, so pre-oss#405 stores resolve
+     * without migration. Values decrypt one at a time, deliberately NOT
+     * through the batch verb: decryptAll fails as a whole, and this lane's
+     * contract is per-key skip for value-scoped failures.
+     */
+    private decryptSecretValues;
+}
+//# sourceMappingURL=resolution.d.ts.map

package/dist/domain/environment/resolution/resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolution.d.ts","sourceRoot":"","sources":["../../../../src/domain/environment/resolution/resolution.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0DAA0D,CAAC;AAC5F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAWvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD;;;GAGG;AACH,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,KAAK,EAAE,KAAK,EACZ,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM;IAGjC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,kBAAkB,CACtB,GAAG,EAAE,oBAAoB,GAAG,SAAS,GACpC,OAAO,CAAC,WAAW,CAAC;IAqCvB;;;;;;OAMG;YACW,mBAAmB;CAiClC"}