@superblocksteam/telemetry 2.0.173-next.4 → 2.0.174

package/dist-esm/browser/sanitizer.js

@@ -0,0 +1,207 @@
+/**
+ * Browser PII Sanitizing Processors
+ *
+ * Span and log processors that redact PII before export from the browser.
+ * Browser telemetry always runs in untrusted context, so aggressive sanitization
+ * is applied unconditionally.
+ *
+ * - SanitizingSpanProcessor: redacts sensitive span attributes and strips
+ *   sensitive query params from URL attributes.
+ * - SanitizingLogProcessor: redacts sensitive log record attributes and
+ *   replaces email-like patterns in log body text.
+ */
+// ============================================================================
+// Constants
+// ============================================================================
+const REDACTED = "[REDACTED]";
+const REDACTED_EMAIL = "[REDACTED_EMAIL]";
+/**
+ * Attribute key substrings that indicate sensitive values.
+ * Case-insensitive matching is applied.
+ */
+const SENSITIVE_KEY_SUBSTRINGS = [
+    "email",
+    "token",
+    "secret",
+    "password",
+    "authorization",
+    "cookie",
+    "credential",
+];
+/**
+ * Attribute key patterns (regex) for additional well-known sensitive keys
+ * not covered by simple substring matching (e.g. api_key, x-api-key).
+ */
+const SENSITIVE_KEY_PATTERNS = [
+    /api[_\-.]?key/i,
+    /x[_\-.]?api[_\-.]?key/i,
+];
+/**
+ * URL query parameter names that should be stripped.
+ * Exact (case-insensitive) match against param name.
+ */
+const SENSITIVE_URL_PARAMS = [
+    "token",
+    "key",
+    "secret",
+    "password",
+    "code",
+    "state",
+    "auth",
+];
+/** URL attribute keys that receive query-param sanitization. */
+const URL_ATTRIBUTE_KEYS = new Set(["http.url", "url.full"]);
+/** Regex matching email-like patterns in log body text. */
+const EMAIL_PATTERN = /[\w.+-]+@[\w.-]+(\.\w+)?/g;
+// ============================================================================
+// Helpers
+// ============================================================================
+/**
+ * Returns true if the attribute key is sensitive and its value should be
+ * replaced with [REDACTED].
+ */
+function isSensitiveKey(key, additionalPatterns) {
+    const lower = key.toLowerCase();
+    for (const substr of SENSITIVE_KEY_SUBSTRINGS) {
+        if (lower.includes(substr)) {
+            return true;
+        }
+    }
+    for (const pattern of SENSITIVE_KEY_PATTERNS) {
+        pattern.lastIndex = 0;
+        if (pattern.test(key)) {
+            return true;
+        }
+    }
+    for (const pattern of additionalPatterns) {
+        pattern.lastIndex = 0;
+        if (pattern.test(key)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Strips sensitive query parameters from a URL string.
+ * Sensitive param values are replaced with [REDACTED] (key is preserved).
+ */
+function sanitizeUrl(url, additionalParams) {
+    const qIdx = url.indexOf("?");
+    if (qIdx === -1) {
+        return url;
+    }
+    const base = url.slice(0, qIdx);
+    const query = url.slice(qIdx + 1);
+    const sensitiveSet = new Set([
+        ...SENSITIVE_URL_PARAMS.map((p) => p.toLowerCase()),
+        ...additionalParams.map((p) => p.toLowerCase()),
+    ]);
+    const sanitizedParts = query.split("&").map((part) => {
+        const eqIdx = part.indexOf("=");
+        if (eqIdx === -1) {
+            return part;
+        }
+        const rawParamName = part.slice(0, eqIdx);
+        let paramName;
+        try {
+            paramName = decodeURIComponent(rawParamName).toLowerCase();
+        }
+        catch {
+            paramName = rawParamName.toLowerCase();
+        }
+        if (sensitiveSet.has(paramName)) {
+            return `${part.slice(0, eqIdx)}=${REDACTED}`;
+        }
+        return part;
+    });
+    return `${base}?${sanitizedParts.join("&")}`;
+}
+/**
+ * Sanitizes span/log attributes in-place. Sensitive keys get value [REDACTED];
+ * URL attributes get query-param sanitization.
+ */
+function sanitizeAttributes(attributes, additionalKeyPatterns, additionalSensitiveParams) {
+    for (const key of Object.keys(attributes)) {
+        if (URL_ATTRIBUTE_KEYS.has(key)) {
+            const val = attributes[key];
+            if (typeof val === "string") {
+                attributes[key] = sanitizeUrl(val, additionalSensitiveParams);
+            }
+            // URL attributes are handled; skip further key-based check
+            continue;
+        }
+        if (isSensitiveKey(key, additionalKeyPatterns)) {
+            attributes[key] = REDACTED;
+        }
+    }
+}
+// ============================================================================
+// SanitizingSpanProcessor
+// ============================================================================
+class SanitizingSpanProcessor {
+    additionalKeyPatterns;
+    additionalSensitiveParams;
+    constructor(config = {}) {
+        this.additionalKeyPatterns = config.additionalKeyPatterns ?? [];
+        this.additionalSensitiveParams = config.additionalSensitiveParams ?? [];
+    }
+    onStart(_span, _parentContext) {
+        // Nothing to do at start; sanitization occurs at end when attributes are final.
+    }
+    onEnd(span) {
+        // ReadableSpan.attributes is typed as Attributes (readonly in API), but
+        // in practice the SDK implementation uses a mutable object. We cast to
+        // allow in-place mutation, which avoids allocating a new span wrapper.
+        const attrs = span.attributes;
+        sanitizeAttributes(attrs, this.additionalKeyPatterns, this.additionalSensitiveParams);
+    }
+    async shutdown() { }
+    async forceFlush() { }
+}
+// ============================================================================
+// SanitizingLogProcessor
+// ============================================================================
+class BrowserSanitizingLogProcessor {
+    additionalKeyPatterns;
+    constructor(config = {}) {
+        this.additionalKeyPatterns = config.additionalKeyPatterns ?? [];
+    }
+    onEmit(record, _context) {
+        // Sanitize attributes in-place
+        const attrs = record.attributes;
+        for (const key of Object.keys(attrs)) {
+            if (isSensitiveKey(key, this.additionalKeyPatterns)) {
+                attrs[key] = REDACTED;
+            }
+        }
+        // Redact email-like patterns in string body
+        if (typeof record.body === "string") {
+            EMAIL_PATTERN.lastIndex = 0;
+            record.body = record.body.replace(EMAIL_PATTERN, REDACTED_EMAIL);
+        }
+    }
+    async shutdown() { }
+    async forceFlush() { }
+}
+// ============================================================================
+// Factory functions
+// ============================================================================
+/**
+ * Create a SpanProcessor that redacts PII from span attributes before export.
+ *
+ * @param config - Optional configuration for additional key patterns / URL params
+ * @returns A SpanProcessor suitable for use in a browser WebTracerProvider
+ */
+export function createSanitizingSpanProcessor(config) {
+    return new SanitizingSpanProcessor(config);
+}
+/**
+ * Create a LogRecordProcessor that redacts PII from log records before export.
+ *
+ * @param config - Optional configuration for additional key patterns
+ * @returns A LogRecordProcessor suitable for use in a browser log provider
+ */
+export function createSanitizingLogProcessor(config) {
+    return new BrowserSanitizingLogProcessor(config);
+}
+//# sourceMappingURL=sanitizer.js.map

package/dist-esm/browser/sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.js","sourceRoot":"","sources":["../../src/browser/sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAE1C;;;GAGG;AACH,MAAM,wBAAwB,GAAG;IAC/B,OAAO;IACP,OAAO;IACP,QAAQ;IACR,UAAU;IACV,eAAe;IACf,QAAQ;IACR,YAAY;CACb,CAAC;AAEF;;;GAGG;AACH,MAAM,sBAAsB,GAAa;IACvC,gBAAgB;IAChB,wBAAwB;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,oBAAoB,GAAG;IAC3B,OAAO;IACP,KAAK;IACL,QAAQ;IACR,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC;AAEF,gEAAgE;AAChE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAE7D,2DAA2D;AAC3D,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAalD,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,kBAA4B;IAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAW,EAAE,gBAA0B;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAElC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC3B,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;KAChD,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,UAAmC,EACnC,qBAA+B,EAC/B,yBAAmC;IAEnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,UAAU,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAChE,CAAC;YACD,2DAA2D;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,CAAC;YAC/C,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,MAAM,uBAAuB;IACV,qBAAqB,CAAW;IAChC,yBAAyB,CAAW;IAErD,YAAY,SAA2B,EAAE;QACvC,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,IAAI,EAAE,CAAC;IAC1E,CAAC;IAED,OAAO,CAAC,KAAW,EAAE,cAAuB;QAC1C,gFAAgF;IAClF,CAAC;IAED,KAAK,CAAC,IAAkB;QACtB,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAqC,CAAC;QACzD,kBAAkB,CAChB,KAAK,EACL,IAAI,CAAC,qBAAqB,EAC1B,IAAI,CAAC,yBAAyB,CAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,KAAmB,CAAC;IAClC,KAAK,CAAC,UAAU,KAAmB,CAAC;CACrC;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E,MAAM,6BAA6B;IAChB,qBAAqB,CAAW;IAEjD,YAAY,SAA2B,EAAE;QACvC,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,MAAyB,EAAE,QAAiB;QACjD,+BAA+B;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAqC,CAAC;QAC3D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACpD,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACxB,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;YAC3B,MAA4B,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CACtD,aAAa,EACb,cAAc,CACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,KAAmB,CAAC;IAClC,KAAK,CAAC,UAAU,KAAmB,CAAC;CACrC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAyB;IAEzB,OAAO,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAyB;IAEzB,OAAO,IAAI,6BAA6B,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC"}

package/dist-esm/browser/traced-socket.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Browser-side TracedSocket for WebSocket tracing.
+ *
+ * Wraps a WebSocket client (or any WebSocket-like object) and adds
+ * OpenTelemetry tracing. Designed to speak the same envelope protocol as the
+ * server-side TracedSocket so that distributed traces link correctly across
+ * the browser–server boundary.
+ *
+ * Envelope format (matches @superblocksteam/shared SocketRequest):
+ *   outbound: { request: { method, id, traceparent?, tracestate?, ... } }
+ *   inbound:  { request: { method, id, traceparent?, tracestate?, ... } }
+ *             { response: { id, ... } }
+ *
+ * Propagation uses the W3C Trace Context propagator registered globally by
+ * initBrowserTelemetry() (see browser/init.ts). The carrier is the
+ * `request` object itself — the same convention as the server side.
+ */
+import { type Tracer } from "@opentelemetry/api";
+import type { SocketMessageEnvelope } from "../common/traced-socket-types.js";
+/** Minimal browser WebSocket surface needed by BrowserTracedSocket. */
+export interface WebSocketLike {
+    readonly readyState: number;
+    close(code?: number, reason?: string): void;
+    send(data: string | ArrayBuffer): void;
+    addEventListener(type: string, listener: (event: unknown) => void): void;
+    removeEventListener(type: string, listener: (event: unknown) => void): void;
+}
+/** Configuration for BrowserTracedSocket. */
+export interface BrowserTracedSocketConfig {
+    /**
+     * Tracer instance. When omitted the global tracer named
+     * "superblocks-ws" is used (requires initBrowserTelemetry() first).
+     */
+    tracer?: Tracer;
+}
+/**
+ * BrowserTracedSocket wraps a WebSocket and provides:
+ *
+ * 1. `decorateOutbound(msg)` — call this before sending any message.
+ *    Injects traceparent/tracestate into msg.request so the server can
+ *    extract the browser's active context.
+ *
+ * 2. `traceOutboundCall(method)` — wraps a client-initiated RPC call in a
+ *    CLIENT span.  Returns the span's end function.
+ *
+ * 3. `handleInbound(msg)` — call this when a message arrives from the server.
+ *    Extracts the server's trace context and creates a SERVER span so that
+ *    server-initiated pushes appear in the browser's trace.
+ *
+ * 4. `recordReconnect({ attempt })` — call this from the reconnect loop to
+ *    create a ws.reconnect span.
+ *
+ * Lifecycle spans (ws.connect, ws.disconnect) are attached automatically via
+ * WebSocket open/close event listeners.
+ */
+export declare class BrowserTracedSocket {
+    private readonly ws;
+    private readonly tracer;
+    private connectStartTime;
+    constructor(ws: WebSocketLike, config: BrowserTracedSocketConfig);
+    private readonly onOpen;
+    private readonly onClose;
+    /**
+     * Records a ws.reconnect span.  Call this from the reconnect loop just
+     * before opening a new WebSocket, passing the attempt counter so it shows
+     * up as a span attribute.
+     */
+    recordReconnect({ attempt }: {
+        attempt: number;
+    }): void;
+    /**
+     * Injects W3C trace context into the message's request envelope.
+     * Call this on every outbound message before handing it to the transport.
+     *
+     * Mirrors the server-side TracedSocket.decorateToSend() behaviour so that
+     * the server can extract the browser's active context via propagation.extract.
+     */
+    decorateOutbound(message: SocketMessageEnvelope): SocketMessageEnvelope;
+    /**
+     * Creates a CLIENT span for a browser-initiated RPC call.
+     * Returns the span so the caller can end it after the response resolves.
+     *
+     * Usage:
+     * ```typescript
+     * const span = socket.traceOutboundCall("editor.runApi");
+     * const result = await socket.request("editor.runApi", params);
+     * span.end();
+     * ```
+     */
+    traceOutboundCall(method: string): import("@opentelemetry/api").Span;
+    /**
+     * Handles an inbound message from the server.
+     * - Extracts the server's trace context from the request envelope.
+     * - Creates a SERVER span as a child of the server's trace so that
+     *   server-initiated pushes appear in the browser's distributed trace.
+     * - Response-only messages (no request field) are ignored.
+     */
+    handleInbound(message: SocketMessageEnvelope): void;
+    /** Remove lifecycle listeners. Call when tearing down the socket. */
+    dispose(): void;
+}
+//# sourceMappingURL=traced-socket.d.ts.map

package/dist-esm/browser/traced-socket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traced-socket.d.ts","sourceRoot":"","sources":["../../src/browser/traced-socket.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAML,KAAK,MAAM,EACZ,MAAM,oBAAoB,CAAC;AAM5B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAE9E,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IACvC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI,CAAC;IACzE,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI,CAAC;CAC7E;AAED,6CAA6C;AAC7C,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAmB;IAK5B,OAAO,CAAC,QAAQ,CAAC,EAAE;IAJrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,gBAAgB,CAAqB;gBAG1B,EAAE,EAAE,aAAa,EAClC,MAAM,EAAE,yBAAyB;IAoBnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAwBrB;IAEF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAuBtB;IAEF;;;;OAIG;IACI,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAoB9D;;;;;;OAMG;IACI,gBAAgB,CACrB,OAAO,EAAE,qBAAqB,GAC7B,qBAAqB;IAexB;;;;;;;;;;OAUG;IACI,iBAAiB,CAAC,MAAM,EAAE,MAAM;IAkBvC;;;;;;OAMG;IACI,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAgC1D,qEAAqE;IAC9D,OAAO,IAAI,IAAI;CAIvB"}

package/dist-esm/browser/traced-socket.js

@@ -0,0 +1,199 @@
+/**
+ * Browser-side TracedSocket for WebSocket tracing.
+ *
+ * Wraps a WebSocket client (or any WebSocket-like object) and adds
+ * OpenTelemetry tracing. Designed to speak the same envelope protocol as the
+ * server-side TracedSocket so that distributed traces link correctly across
+ * the browser–server boundary.
+ *
+ * Envelope format (matches @superblocksteam/shared SocketRequest):
+ *   outbound: { request: { method, id, traceparent?, tracestate?, ... } }
+ *   inbound:  { request: { method, id, traceparent?, tracestate?, ... } }
+ *             { response: { id, ... } }
+ *
+ * Propagation uses the W3C Trace Context propagator registered globally by
+ * initBrowserTelemetry() (see browser/init.ts). The carrier is the
+ * `request` object itself — the same convention as the server side.
+ */
+import { ROOT_CONTEXT, SpanKind, context as otelCtx, propagation, trace, } from "@opentelemetry/api";
+import { SEMATTRS_MESSAGING_DESTINATION_KIND, SEMATTRS_MESSAGING_SYSTEM, } from "@opentelemetry/semantic-conventions";
+const MESSAGING_ATTRS = {
+    [SEMATTRS_MESSAGING_SYSTEM]: "ws",
+    [SEMATTRS_MESSAGING_DESTINATION_KIND]: "websocket",
+};
+/**
+ * BrowserTracedSocket wraps a WebSocket and provides:
+ *
+ * 1. `decorateOutbound(msg)` — call this before sending any message.
+ *    Injects traceparent/tracestate into msg.request so the server can
+ *    extract the browser's active context.
+ *
+ * 2. `traceOutboundCall(method)` — wraps a client-initiated RPC call in a
+ *    CLIENT span.  Returns the span's end function.
+ *
+ * 3. `handleInbound(msg)` — call this when a message arrives from the server.
+ *    Extracts the server's trace context and creates a SERVER span so that
+ *    server-initiated pushes appear in the browser's trace.
+ *
+ * 4. `recordReconnect({ attempt })` — call this from the reconnect loop to
+ *    create a ws.reconnect span.
+ *
+ * Lifecycle spans (ws.connect, ws.disconnect) are attached automatically via
+ * WebSocket open/close event listeners.
+ */
+export class BrowserTracedSocket {
+    ws;
+    tracer;
+    connectStartTime;
+    constructor(ws, config) {
+        this.ws = ws;
+        this.tracer = config.tracer ?? trace.getTracer("superblocks-ws", "0.0.0");
+        this.connectStartTime = performance.now();
+        this.ws.addEventListener("open", this.onOpen);
+        this.ws.addEventListener("close", this.onClose);
+        // If the WebSocket is already open (e.g. constructed after connectWebSocket
+        // resolves), the "open" event won't fire again. Fire onOpen immediately so
+        // the ws.connect lifecycle span is still recorded.
+        if (this.ws.readyState === 1 /* WebSocket.OPEN */) {
+            this.onOpen(undefined);
+        }
+    }
+    // ------------------------------------------------------------------
+    // Lifecycle handlers
+    // ------------------------------------------------------------------
+    onOpen = (_event) => {
+        try {
+            const durationMs = this.connectStartTime
+                ? performance.now() - this.connectStartTime
+                : undefined;
+            this.tracer.startActiveSpan("ws.connect", {
+                kind: SpanKind.CLIENT,
+                attributes: {
+                    ...MESSAGING_ATTRS,
+                    ...(durationMs !== undefined
+                        ? { "ws.connect_duration_ms": durationMs }
+                        : {}),
+                },
+            }, (span) => {
+                span.end();
+            });
+        }
+        catch (err) {
+            console.error("[TracedSocket] onOpen tracing error", err);
+        }
+    };
+    onClose = (event) => {
+        try {
+            const ev = event;
+            const code = ev.code ?? 1000;
+            const reason = ev.reason ?? "";
+            this.tracer.startActiveSpan("ws.disconnect", {
+                kind: SpanKind.CLIENT,
+                attributes: {
+                    ...MESSAGING_ATTRS,
+                    "ws.close_code": code,
+                    "ws.close_reason": reason,
+                },
+            }, (span) => {
+                span.end();
+            });
+        }
+        catch (err) {
+            console.error("[TracedSocket] onClose tracing error", err);
+        }
+    };
+    /**
+     * Records a ws.reconnect span.  Call this from the reconnect loop just
+     * before opening a new WebSocket, passing the attempt counter so it shows
+     * up as a span attribute.
+     */
+    recordReconnect({ attempt }) {
+        this.tracer.startActiveSpan("ws.reconnect", {
+            kind: SpanKind.CLIENT,
+            attributes: {
+                ...MESSAGING_ATTRS,
+                "ws.reconnect_attempt": attempt,
+            },
+        }, (span) => {
+            span.end();
+        });
+    }
+    // ------------------------------------------------------------------
+    // Outbound
+    // ------------------------------------------------------------------
+    /**
+     * Injects W3C trace context into the message's request envelope.
+     * Call this on every outbound message before handing it to the transport.
+     *
+     * Mirrors the server-side TracedSocket.decorateToSend() behaviour so that
+     * the server can extract the browser's active context via propagation.extract.
+     */
+    decorateOutbound(message) {
+        if (!message.request) {
+            return message;
+        }
+        // Skip if already injected (e.g. manual traceparent for testing)
+        if (message.request.traceparent || message.request.tracestate) {
+            return message;
+        }
+        propagation.inject(otelCtx.active(), message.request);
+        return message;
+    }
+    /**
+     * Creates a CLIENT span for a browser-initiated RPC call.
+     * Returns the span so the caller can end it after the response resolves.
+     *
+     * Usage:
+     * ```typescript
+     * const span = socket.traceOutboundCall("editor.runApi");
+     * const result = await socket.request("editor.runApi", params);
+     * span.end();
+     * ```
+     */
+    traceOutboundCall(method) {
+        return this.tracer.startActiveSpan(`WS CLIENT ${method}`, {
+            kind: SpanKind.CLIENT,
+            attributes: {
+                ...MESSAGING_ATTRS,
+                "ws.method": method,
+            },
+        }, (span) => span);
+    }
+    // ------------------------------------------------------------------
+    // Inbound
+    // ------------------------------------------------------------------
+    /**
+     * Handles an inbound message from the server.
+     * - Extracts the server's trace context from the request envelope.
+     * - Creates a SERVER span as a child of the server's trace so that
+     *   server-initiated pushes appear in the browser's distributed trace.
+     * - Response-only messages (no request field) are ignored.
+     */
+    handleInbound(message) {
+        if (!message.request) {
+            return;
+        }
+        const method = message.request.method ?? "unknown";
+        const parentCtx = propagation.extract(ROOT_CONTEXT, message.request);
+        otelCtx.with(parentCtx, () => {
+            this.tracer.startActiveSpan(`WS SERVER ${method}`, {
+                kind: SpanKind.CONSUMER,
+                attributes: {
+                    ...MESSAGING_ATTRS,
+                    "ws.method": method,
+                },
+            }, (span) => {
+                span.end();
+            });
+        });
+    }
+    // ------------------------------------------------------------------
+    // Cleanup
+    // ------------------------------------------------------------------
+    /** Remove lifecycle listeners. Call when tearing down the socket. */
+    dispose() {
+        this.ws.removeEventListener("open", this.onOpen);
+        this.ws.removeEventListener("close", this.onClose);
+    }
+}
+//# sourceMappingURL=traced-socket.js.map

package/dist-esm/browser/traced-socket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"traced-socket.js","sourceRoot":"","sources":["../../src/browser/traced-socket.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,OAAO,IAAI,OAAO,EAClB,WAAW,EACX,KAAK,GAEN,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,qCAAqC,CAAC;AAsB7C,MAAM,eAAe,GAAG;IACtB,CAAC,yBAAyB,CAAC,EAAE,IAAI;IACjC,CAAC,mCAAmC,CAAC,EAAE,WAAW;CAC1C,CAAC;AAEX;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,mBAAmB;IAKX;IAJF,MAAM,CAAS;IACxB,gBAAgB,CAAqB;IAE7C,YACmB,EAAiB,EAClC,MAAiC;QADhB,OAAE,GAAF,EAAE,CAAe;QAGlC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAE1C,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAEhD,4EAA4E;QAC5E,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,CAAC,CAAC,oBAAoB,EAAE,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,qBAAqB;IACrB,qEAAqE;IAEpD,MAAM,GAAG,CAAC,MAAe,EAAQ,EAAE;QAClD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB;gBACtC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB;gBAC3C,CAAC,CAAC,SAAS,CAAC;YAEd,IAAI,CAAC,MAAM,CAAC,eAAe,CACzB,YAAY,EACZ;gBACE,IAAI,EAAE,QAAQ,CAAC,MAAM;gBACrB,UAAU,EAAE;oBACV,GAAG,eAAe;oBAClB,GAAG,CAAC,UAAU,KAAK,SAAS;wBAC1B,CAAC,CAAC,EAAE,wBAAwB,EAAE,UAAU,EAAE;wBAC1C,CAAC,CAAC,EAAE,CAAC;iBACR;aACF,EACD,CAAC,IAAI,EAAE,EAAE;gBACP,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IAEe,OAAO,GAAG,CAAC,KAAc,EAAQ,EAAE;QAClD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,KAA2C,CAAC;YACvD,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC;YAC7B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC;YAE/B,IAAI,CAAC,MAAM,CAAC,eAAe,CACzB,eAAe,EACf;gBACE,IAAI,EAAE,QAAQ,CAAC,MAAM;gBACrB,UAAU,EAAE;oBACV,GAAG,eAAe;oBAClB,eAAe,EAAE,IAAI;oBACrB,iBAAiB,EAAE,MAAM;iBAC1B;aACF,EACD,CAAC,IAAI,EAAE,EAAE;gBACP,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,CAAC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC;IAEF;;;;OAIG;IACI,eAAe,CAAC,EAAE,OAAO,EAAuB;QACrD,IAAI,CAAC,MAAM,CAAC,eAAe,CACzB,cAAc,EACd;YACE,IAAI,EAAE,QAAQ,CAAC,MAAM;YACrB,UAAU,EAAE;gBACV,GAAG,eAAe;gBAClB,sBAAsB,EAAE,OAAO;aAChC;SACF,EACD,CAAC,IAAI,EAAE,EAAE;YACP,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC,CACF,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,WAAW;IACX,qEAAqE;IAErE;;;;;;OAMG;IACI,gBAAgB,CACrB,OAA8B;QAE9B,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,iEAAiE;QACjE,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,WAAW,CAAC,MAAM,CAChB,OAAO,CAAC,MAAM,EAAE,EAChB,OAAO,CAAC,OAA6C,CACtD,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;OAUG;IACI,iBAAiB,CAAC,MAAc;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAChC,aAAa,MAAM,EAAE,EACrB;YACE,IAAI,EAAE,QAAQ,CAAC,MAAM;YACrB,UAAU,EAAE;gBACV,GAAG,eAAe;gBAClB,WAAW,EAAE,MAAM;aACpB;SACF,EACD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CACf,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,UAAU;IACV,qEAAqE;IAErE;;;;;;OAMG;IACI,aAAa,CAAC,OAA8B;QACjD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC;QACnD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CACnC,YAAY,EACZ,OAAO,CAAC,OAA4C,CACrD,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAC3B,IAAI,CAAC,MAAM,CAAC,eAAe,CACzB,aAAa,MAAM,EAAE,EACrB;gBACE,IAAI,EAAE,QAAQ,CAAC,QAAQ;gBACvB,UAAU,EAAE;oBACV,GAAG,eAAe;oBAClB,WAAW,EAAE,MAAM;iBACpB;aACF,EACD,CAAC,IAAI,EAAE,EAAE;gBACP,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,UAAU;IACV,qEAAqE;IAErE,qEAAqE;IAC9D,OAAO;QACZ,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;CACF"}

package/dist-esm/common/contracts/tier2-traces.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Tier 2 Traces Contract (v0.6.0) — TypeScript mirror.
+ *
+ * THIS FILE IS A MIRROR, NOT THE SOURCE OF TRUTH. The canonical Tier 2 traces
+ * contract lives in the `engineering` repo:
+ *   - engineering/projects/o11y-refactor/contracts/tier2-traces.v0.6.0.json  (canonical contract)
+ *   - engineering/projects/o11y-refactor/contracts/README.md                 (rationale, Versioning Policy, Review Checklist)
+ * Org-wide telemetry naming and the Tier 2 privacy boundary are documented in the
+ * `workspace` repo: workspace/docs/naming-conventions.md and the `observability`
+ * skill (.agents/skills/observability/SKILL.md).
+ *
+ * CHANGING TIER 2 BEHAVIOR (forbidden / hashed / dropped / allowed attributes):
+ *   1. Update the canonical JSON in `engineering` FIRST, as a NEW version, per the
+ *      README Versioning Policy (breaking = MAJOR, additive = MINOR, docs = PATCH).
+ *   2. Propagate the SAME change to every mirror so they stay byte-for-byte aligned:
+ *        - this file                                                   (TS SDK sanitizer / ESLint / guardrails)
+ *        - orchestrator/pkg/telemetry/forbidden_attributes.go          (Go SDK maps)
+ *        - orchestrator/pkg/telemetry/contracts/tier2-traces.json      (Go embedded; regenerate via
+ *          orchestrator/scripts/sync-ts-telemetry-contracts.sh — do not hand-edit)
+ * Editing this file alone silently drifts from the contract and the other SDKs, which
+ * lets a re-cased or newly added attribute bypass the Tier 2 privacy boundary. Cross-surface
+ * parity is enforced by the orchestrator Go tests (TestForbiddenAttributesMatchTSContract,
+ * TestDroppedAttributesMatchTS).
+ *
+ * Used by: trace-sanitizer (which spans/attributes to export), lint/forbidden-attributes
+ * (ESLint), guardrails (dev-time warnings), and Collector config generation.
+ * "request handler *" is a local extension for Express instrumentation (not in the JSON).
+ */
+import { DeploymentTypeEnum } from "@superblocksteam/shared";
+export interface AttributeDefinition {
+    name: string;
+    allowedValues?: string[];
+    maxCardinality?: number;
+    type?: "string" | "number" | "boolean";
+}
+export type AllowedAttribute = string | AttributeDefinition;
+export interface SpanDefinition {
+    name: string;
+    description?: string;
+    allowedAttributes: AllowedAttribute[];
+    alwaysSample?: boolean;
+}
+export declare function getAttributeName(attr: AllowedAttribute): string;
+/**
+ * Span patterns from tier2-traces.v0.4.0.json.
+ * Suffix wildcard only: "HTTP POST *" matches "HTTP POST /api/..." or "POST /api/...".
+ */
+export declare const TIER_2_TRACE_CONTRACT: SpanDefinition[];
+/**
+ * Cloud trace contract: match-all span name ("*") so no spans are dropped by name.
+ * Attribute allowlist is not used when attributeAllowlistPassthrough is true.
+ */
+export declare const CLOUD_TRACE_CONTRACT: SpanDefinition[];
+/**
+ * Returns the trace contract (span definitions) for the given deployment type.
+ * Cloud: match-all so no traces are dropped by span name.
+ * Cloud-prem: Tier 2 contract (named spans only).
+ */
+export declare function getTraceContract(deploymentType: DeploymentTypeEnum): SpanDefinition[];
+/** Forbidden in Tier 2 (forbiddenAttributes in contract). Collector strips these entirely. */
+export declare const FORBIDDEN_TIER_2_SPAN_ATTRIBUTES: string[];
+/**
+ * Hashed (keyed HMAC) for Tier 2 (hashedAttributes in contract).
+ * v0.5.0 (AGENT-3255): per-user / per-session identifiers single out a natural
+ * person (pseudonymous personal data even as a UUID), so pseudonymize rather than
+ * forbid. This is the full contract hashedAttributes set: enduser.id, session.id,
+ * and the user-id variants. organization-id is intentionally NOT hashed (single
+ * customer org per cloud-prem deployment → pass-through).
+ * NOTE: with no hashConfig, TraceSanitizer.hashValue() emits "[redacted]", so
+ * these fail closed and never flow raw until an HMAC key is provisioned.
+ */
+export declare const HASHED_TIER_2_SPAN_ATTRIBUTES: string[];
+/**
+ * Dropped — high cardinality, no hash value (droppedAttributes in contract).
+ * The contract's dropped set also lists correlation/request/trace/execution ids,
+ * but those are dropped at the collector (and pass through at the SDK in
+ * pass-through mode); the SDK only hard-drops binding keys. v0.6.0 adds the
+ * dotted/kebab spellings of binding_keys for casing parity.
+ */
+export declare const DROPPED_HIGH_CARDINALITY_ATTRIBUTES: string[];
+export declare const TIER2_FORBIDDEN_ATTRIBUTES: Set<string>;
+export declare const TIER2_HASHED_ATTRIBUTES: Set<string>;
+export declare const TIER2_DROPPED_ATTRIBUTES: Set<string>;
+/**
+ * Attribute sets and contract options used by TraceSanitizer.
+ * Allows different rules per deployment type (e.g. cloud vs cloud-prem).
+ */
+export interface TraceSanitizerAttributeSets {
+    forbiddenAttributes: Set<string>;
+    droppedAttributes: Set<string>;
+    hashedAttributes: Set<string>;
+    /** Span definitions for name matching; cloud uses match-all ("*"). */
+    spanDefinitions: SpanDefinition[];
+    /** When true, span attributes are not filtered by allowedAttributes (pass-through). */
+    attributeAllowlistPassthrough: boolean;
+}
+/**
+ * Returns the Tier 2 trace attribute sets and contract options for the given deployment type.
+ * Cloud: relaxed policy (no attributes dropped/hashed), match-all span names, pass-through attributes.
+ * Cloud-prem: full Tier 2 contract (forbidden/dropped/hashed), named spans only, allowlist enforced.
+ */
+export declare function getTraceSanitizerAttributeSets(deploymentType: DeploymentTypeEnum): TraceSanitizerAttributeSets;
+/** Spans that should ALWAYS be sampled (samplingPolicy.alwaysSampleSpans in contract). */
+export declare const ALWAYS_SAMPLE_SPANS: Set<string>;
+/**
+ * Patterns that indicate forbidden content in attribute values (e.g. secrets in strings).
+ * No ^/$ anchors so they match secrets embedded anywhere.
+ * It's not used by TraceSanitizer, only in guardrails.
+ */
+export declare const FORBIDDEN_VALUE_PATTERNS: RegExp[];
+export declare function isForbiddenAttribute(name: string): boolean;
+export declare function isHashedAttribute(name: string): boolean;
+export declare function isDroppedAttribute(name: string): boolean;
+export declare function containsForbiddenPattern(value: unknown): boolean;
+export declare function shouldAlwaysSample(spanName: string): boolean;
+//# sourceMappingURL=tier2-traces.d.ts.map

package/dist-esm/common/contracts/tier2-traces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier2-traces.d.ts","sourceRoot":"","sources":["../../../src/common/contracts/tier2-traces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAM7D,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,mBAAmB,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACtC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAE/D;AA0KD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,EA+TjD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,cAAc,EAEhD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,kBAAkB,GACjC,cAAc,EAAE,CAQlB;AAMD,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,EAAE,MAAM,EAiEpD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,EAAE,MAAM,EAUjD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,EAAE,MAAM,EAIvD,CAAC;AAMF,eAAO,MAAM,0BAA0B,aAEtC,CAAC;AACF,eAAO,MAAM,uBAAuB,aAAyC,CAAC;AAC9E,eAAO,MAAM,wBAAwB,aAEpC,CAAC;AASF;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,sEAAsE;IACtE,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,uFAAuF;IACvF,6BAA6B,EAAE,OAAO,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,cAAc,EAAE,kBAAkB,GACjC,2BAA2B,CAwB7B;AAMD,0FAA0F;AAC1F,eAAO,MAAM,mBAAmB,aAA2B,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,UAYpC,CAAC;AAMF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGhE;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D"}